Comments on: The Hunt For Blue Screen http://www.softblog.com/2008-02/the-hunt-for-blue-screen/ About software, etc. Wed, 16 Jun 2010 21:30:24 +0000 http://wordpress.org/?v=2.9.2 hourly 1 By: lapa http://www.softblog.com/2008-02/the-hunt-for-blue-screen/comment-page-1/#comment-117 lapa Tue, 11 May 2010 07:54:08 +0000 http://www.softblog.com/2008-02/the-hunt-for-blue-screen/#comment-117 I use TC 6.0a (and some previous versions) for whole-disk encryption with an XP SP3. I get also BSOD, and I suspect TC as well. It's a Dell D630, dual core. The disk is formatted to NTFS, if that matters. No antivirus. I use TC 6.0a (and some previous versions) for whole-disk encryption with an XP SP3. I get also BSOD, and I suspect TC as well. It’s a Dell D630, dual core. The disk is formatted to NTFS, if that matters. No antivirus.

]]> By: Adobe Wan Kenobi http://www.softblog.com/2008-02/the-hunt-for-blue-screen/comment-page-1/#comment-116 Adobe Wan Kenobi Thu, 29 Apr 2010 04:40:07 +0000 http://www.softblog.com/2008-02/the-hunt-for-blue-screen/#comment-116 I just ran into the dreaded BSoD when mounting a TrueCrypt file container. I have multiple 4.6gb file containers on a local 1TB SATA drive. Each container is formatted with NTFS. I had flawless operation for over a year... until recently. I read this forum and determined another possible cause of a (non-specific) blue screen of death: Antivirus trying to scan the container file upon a mounting attempt. I recently renewed my subscription to ESET's Smart Security 4, and they had a download link to update to v4.2. This was a stand-alone install and not a 'check for updates' feature of the application. As it turns out, the FULL install (over a previous one) reset the 'exclusions' for the file system scanner. As a result, the previously excluded TrueCrypt containers were now included in file scanning. I simply re-added the containers and their parent folder to the exclusion list and it seems to have corrected the issue. I will post back if any other issues arise. Again... BSoD can be caused in TrueCrypt v6.2a if you try to mount a local file volume, and that volume is being scanned by any antivirus program. Add your file-based volumes to your antivirus program's "exclusion list" so the antivirus does NOT scan the encrypted file container. I just ran into the dreaded BSoD when mounting a TrueCrypt file container. I have multiple 4.6gb file containers on a local 1TB SATA drive. Each container is formatted with NTFS. I had flawless operation for over a year… until recently. I read this forum and determined another possible cause of a (non-specific) blue screen of death:

Antivirus trying to scan the container file upon a mounting attempt.

I recently renewed my subscription to ESET’s Smart Security 4, and they had a download link to update to v4.2. This was a stand-alone install and not a ‘check for updates’ feature of the application. As it turns out, the FULL install (over a previous one) reset the ‘exclusions’ for the file system scanner. As a result, the previously excluded TrueCrypt containers were now included in file scanning. I simply re-added the containers and their parent folder to the exclusion list and it seems to have corrected the issue. I will post back if any other issues arise.

Again… BSoD can be caused in TrueCrypt v6.2a if you try to mount a local file volume, and that volume is being scanned by any antivirus program.

Add your file-based volumes to your antivirus program’s “exclusion list” so the antivirus does NOT scan the encrypted file container.

]]> By: Gareth Nixon http://www.softblog.com/2008-02/the-hunt-for-blue-screen/comment-page-1/#comment-114 Gareth Nixon Thu, 22 Apr 2010 16:32:03 +0000 http://www.softblog.com/2008-02/the-hunt-for-blue-screen/#comment-114 It's people like you that restore my faith in humanity. A big THANK YOU. I'm using 6.3a (latest at time of writing) and get the Blues all the time (often 3 a day). I went an awful long way to identify the problem (although not nearly as far as you) so thank you for saving me the time. I realised it was happening when the thumb was in, and after reading and testing, confirm your diagnosis. Also very glad I found your page... It’s people like you that restore my faith in humanity. A big THANK YOU.

I’m using 6.3a (latest at time of writing) and get the Blues all the time (often 3 a day). I went an awful long way to identify the problem (although not nearly as far as you) so thank you for saving me the time.

I realised it was happening when the thumb was in, and after reading and testing, confirm your diagnosis.

Also very glad I found your page…

]]> By: Matt http://www.softblog.com/2008-02/the-hunt-for-blue-screen/comment-page-1/#comment-92 Matt Wed, 16 Sep 2009 12:36:25 +0000 http://www.softblog.com/2008-02/the-hunt-for-blue-screen/#comment-92 THANK YOU. I was killing myself trying to figure out why my dell latitude E6500 laptop kept blue screening over and over and over. I very recently changed my truecrypt volume to FAT32 on my thumbdrive to make it compatible with some linux grub multiboot stuff. Ever since I did that, I have randomly been getting bluescreens. I'm on the latest (at the time of this writing - 6.2a or something) of truecrypt. I guess I'll just buy two thumbrives (one for the multipass) and keep my other drive NTFS for work... Glad I found your page. THANK YOU. I was killing myself trying to figure out why my dell latitude E6500 laptop kept blue screening over and over and over.

I very recently changed my truecrypt volume to FAT32 on my thumbdrive to make it compatible with some linux grub multiboot stuff. Ever since I did that, I have randomly been getting bluescreens. I’m on the latest (at the time of this writing – 6.2a or something) of truecrypt.

I guess I’ll just buy two thumbrives (one for the multipass) and keep my other drive NTFS for work…

Glad I found your page.

]]> By: Chris F http://www.softblog.com/2008-02/the-hunt-for-blue-screen/comment-page-1/#comment-88 Chris F Mon, 27 Jul 2009 12:23:44 +0000 http://www.softblog.com/2008-02/the-hunt-for-blue-screen/#comment-88 Well it's six weeks since I converted all my FAT32 volumes to NTFS, and I've not had a BSOD since. So I'm reasonably confident that Truecrypt was the culprit. I should add that whilst I do have hyper-threading, I don't have a multi-core processor. Well it’s six weeks since I converted all my FAT32 volumes to NTFS, and I’ve not had a BSOD since. So I’m reasonably confident that Truecrypt was the culprit. I should add that whilst I do have hyper-threading, I don’t have a multi-core processor.

]]> By: Danny http://www.softblog.com/2008-02/the-hunt-for-blue-screen/comment-page-1/#comment-87 Danny Mon, 20 Jul 2009 22:58:39 +0000 http://www.softblog.com/2008-02/the-hunt-for-blue-screen/#comment-87 Gah, after half a year with virtually no problems, I had three BSoDs last night from the Truecrypt + Fat32 bug. Now I'm seriously considering using NTFS for my thumb drives. Gah, after half a year with virtually no problems, I had three BSoDs last night from the Truecrypt + Fat32 bug. Now I’m seriously considering using NTFS for my thumb drives.

]]> By: BenP http://www.softblog.com/2008-02/the-hunt-for-blue-screen/comment-page-1/#comment-83 BenP Wed, 08 Jul 2009 01:02:55 +0000 http://www.softblog.com/2008-02/the-hunt-for-blue-screen/#comment-83 Altough i came here because i suspect TC as well I do wonder if there might be other reasons. 1) it happened a few times that i shut down my computer without unmounting the TC Volumes or that my laptop went off due to low battery... therefore it might be that this caused an error in the filesystem. 2) I suspect an option that came along with the latest processor generations and which i activated shortly before the first bsod happened- while everything worked fine for half a year without this option. The option i am talking about is the "no execute bit" that came along with amd64 and the latest pentium 4 models. which in fact coincides with other users experience that their first bsod happened on multicore systems. in case it is the second reason there must be an software error in windows or TC which in combination with the nxBit causes the crash. otherwise there wouldn´t be the reports of linux systems without problems. i will try the fx of disabling the option instead of converting to nz´tfs and report if it helps solving the issue. Altough i came here because i suspect TC as well I do wonder if there might be other reasons. 1) it happened a few times that i shut down my computer without unmounting the TC Volumes or that my laptop went off due to low battery… therefore it might be that this caused an error in the filesystem. 2) I suspect an option that came along with the latest processor generations and which i activated shortly before the first bsod happened- while everything worked fine for half a year without this option. The option i am talking about is the “no execute bit” that came along with amd64 and the latest pentium 4 models. which in fact coincides with other users experience that their first bsod happened on multicore systems.

in case it is the second reason there must be an software error in windows or TC which in combination with the nxBit causes the crash. otherwise there wouldn´t be the reports of linux systems without problems.

i will try the fx of disabling the option instead of converting to nz´tfs and report if it helps solving the issue.

]]> By: Chris F http://www.softblog.com/2008-02/the-hunt-for-blue-screen/comment-page-1/#comment-79 Chris F Sat, 13 Jun 2009 19:29:13 +0000 http://www.softblog.com/2008-02/the-hunt-for-blue-screen/#comment-79 This is an interesting thread. I've been using FAT formatted TC volumes for some time. My PC had a FAT32 C drive, the remaining being NTFS. A couple of months ago I started getting an occasional BSOD on shutdown (around 1 shutdown out of every 35): IRQL_NOT_LESS_OR_EQUAL *** STOP: 0x0000000A (0x000000B0, 0x00000002, 0x00000000, 0x8050EEf5) Despite it being configured to do so, no minidump was produced and no errors appeared in the event log, so it was impossible to diagnose the problem. I eventually installed a new HD and reinstalled XP SP3 (all non-TC drives now being NTFS). I've just had another spontaneous BSOD: BugCheck 1000007E, {c0000005, b7c304f1, f896ac48, f896a944} which HAS produced a minidump, analysis of which suggests it's "Probably caused by : Fastfat.SYS". I'm wondering if TC has been the problem all along. Since in my previous installation my C drive was FAT32, I'm wondering if a Fastfat.SYS failure may have been responsible for the lack of a minidump or event log entry? Either way I've just changed all my TC volumes to NTFS, and fingers crossed it just may solve the problem. This is an interesting thread.

I’ve been using FAT formatted TC volumes for some time. My PC had a FAT32 C drive, the remaining being NTFS. A couple of months ago I started getting an occasional BSOD on shutdown (around 1 shutdown out of every 35):

IRQL_NOT_LESS_OR_EQUAL
*** STOP: 0×0000000A (0×000000B0, 0×00000002, 0×00000000, 0×8050EEf5)

Despite it being configured to do so, no minidump was produced and no errors appeared in the event log, so it was impossible to diagnose the problem.

I eventually installed a new HD and reinstalled XP SP3 (all non-TC drives now being NTFS). I’ve just had another spontaneous BSOD:

BugCheck 1000007E, {c0000005, b7c304f1, f896ac48, f896a944}

which HAS produced a minidump, analysis of which suggests it’s “Probably caused by : Fastfat.SYS”. I’m wondering if TC has been the problem all along. Since in my previous installation my C drive was FAT32, I’m wondering if a Fastfat.SYS failure may have been responsible for the lack of a minidump or event log entry?

Either way I’ve just changed all my TC volumes to NTFS, and fingers crossed it just may solve the problem.

]]> By: AB http://www.softblog.com/2008-02/the-hunt-for-blue-screen/comment-page-1/#comment-72 AB Tue, 12 May 2009 15:22:39 +0000 http://www.softblog.com/2008-02/the-hunt-for-blue-screen/#comment-72 Serj, Sonny Tham: are you sure that the BSoDs you are getting with an NTFS volume are due to TC? I've been using a portable drive with an NTFS-formatted TC volume for years, on several different Core 2 Duo PCs, and never had a bluescreen that I could trace to TC. And the volume is used quite heavily, too: I run FireFox and Thunderbird off it, as well as a few Virtual PCs, and other stuff, all the time. If you could send me a couple of minidumps that you think are related the TC crashes (you can find them in the C:\WINDOWS\Minidump directory) I would try to look into them with a debugger and hopefully see something. Please do not send them all, just two or three would be enough. My email is "support (AT) winability.net". Thanks. Serj, Sonny Tham: are you sure that the BSoDs you are getting with an NTFS volume are due to TC? I’ve been using a portable drive with an NTFS-formatted TC volume for years, on several different Core 2 Duo PCs, and never had a bluescreen that I could trace to TC. And the volume is used quite heavily, too: I run FireFox and Thunderbird off it, as well as a few Virtual PCs, and other stuff, all the time. If you could send me a couple of minidumps that you think are related the TC crashes (you can find them in the C:\WINDOWS\Minidump directory) I would try to look into them with a debugger and hopefully see something. Please do not send them all, just two or three would be enough. My email is “support (AT) winability.net”. Thanks.

]]> By: Serj http://www.softblog.com/2008-02/the-hunt-for-blue-screen/comment-page-1/#comment-71 Serj Tue, 12 May 2009 11:36:35 +0000 http://www.softblog.com/2008-02/the-hunt-for-blue-screen/#comment-71 Sonny Tham, I also have the BSOD under heavy load, even with NTFS vol. Not so often as with FAT, but BSOD happens... But I don't use Outlook at all. For me BSOD comes then I open many sites in Firefox Portable (on TC volume :). It happens only on native dual-core CPU, not on P4 630 with HT :) Sometimes I have 2-3 BSOD per session on Core 2 Duo, sometimes TС looks like stable 2-3 weeks... I cant say definitely what is wrong :( May be TС 6.2 will show us some improvement ;) Sonny Tham, I also have the BSOD under heavy load, even with NTFS vol. Not so often as with FAT, but BSOD happens…
But I don’t use Outlook at all. For me BSOD comes then I open many sites in Firefox Portable (on TC volume :). It happens only on native dual-core CPU, not on P4 630 with HT :) Sometimes I have 2-3 BSOD per session on Core 2 Duo, sometimes TС looks like stable 2-3 weeks… I cant say definitely what is wrong :(

May be TС 6.2 will show us some improvement ;)

]]>