How can I check what caused a recent system hang?

Discussion in 'Windows OS and Software' started by HerrKaputt, Apr 1, 2017.

Tags:
  1. HerrKaputt

    HerrKaputt Elite Notebook User

    Reputations:
    444
    Messages:
    2,513
    Likes Received:
    0
    Trophy Points:
    55
    Hi all,

    In a nutshell, I have a Dell XPS 13 which is having system hangs frequently. Dell has replaced most of the hardware (motherboard, heatsink assembly, SSD) and the problem is not fixed. I've clean installed the OS (Windows 10 Pro) multiple times and the problem is not fixed. The laptop is still in warranty but I want to narrow this down before I invoke the warranty (I know more of computer fixing than the Dell L1 support guys, who just want to keep replacing hardware parts, even if they've been replaced before).

    When the system hangs, the mouse pointer works, I can toggle Caps Lock on or off, but most other things stop working. There's not much I can do but force a hard reboot, but once I do that, the laptop is usually stable for a few hours. What can I do to investigate what caused the previous system hang?

    Here's what I've tried:
    - Googling around: I've found the Reliability monitor, which doesn't show anything apart from "unexpected shutdown". I've also discovered Windows logs and alerts, but it's a bit overwhelming. This is one thing where I'd like some pointers, it seems to have a wealth of information, and since I know the time of the system hang, I should be able to narrow it down.
    - Replacing the hardware, no help.
    - Reinstalling the OS (and Drivers), no help. In case you ask, this is a legit OS.

    I'd really appreciate it if you can give me some pointers. Thanks in advance,
    HK
     
  2. Danishblunt

    Danishblunt Notebook Consultant

    Reputations:
    14
    Messages:
    166
    Likes Received:
    27
    Trophy Points:
    41
    Did you try another OS like Windows 7?
    Maybe you can test it by installing windows 7 and see if it does the same, if it works the entire day then you at least know that your hardware is probably not broken.
     
  3. Phoenix

    Phoenix Super Tweaker

    Reputations:
    6,088
    Messages:
    13,321
    Likes Received:
    15,870
    Trophy Points:
    931

    WhoCrashed 5.53
     
  4. StormJumper

    StormJumper Notebook Virtuoso

    Reputations:
    481
    Messages:
    2,854
    Likes Received:
    277
    Trophy Points:
    101
    That's sounds like a Lemon laptop. If everything has been done and still fails then dump it and get another one.
     
  5. Rynaus

    Rynaus Notebook Consultant

    Reputations:
    35
    Messages:
    264
    Likes Received:
    143
    Trophy Points:
    56
    If you still cannot find the cause of the hang, perhaps you can post some of those log entries from Windows Event Log (Application and System errors) when the hang happens.
     
  6. Phoenix

    Phoenix Super Tweaker

    Reputations:
    6,088
    Messages:
    13,321
    Likes Received:
    15,870
    Trophy Points:
    931
    That's what WhoCrashed does but with a more detailed explanation
     
    Papusan and Rynaus like this.
  7. Rynaus

    Rynaus Notebook Consultant

    Reputations:
    35
    Messages:
    264
    Likes Received:
    143
    Trophy Points:
    56
    Hehe, I know. I was just suggesting that in case WhoCrashed did not help him, he could post the log here and we could have a look at it, try to narrow the problem down :)
     
    Phoenix likes this.
  8. HerrKaputt

    HerrKaputt Elite Notebook User

    Reputations:
    444
    Messages:
    2,513
    Likes Received:
    0
    Trophy Points:
    55
    All,

    Thank you so much for the good ideas here, and apologies for the delay in replying -- I've been sick (all good now :) ). I'll try WhoCrashed, sounds like exactly what I needed. I'll let you know how it goes.

    Thanks!
    HK
     
  9. HerrKaputt

    HerrKaputt Elite Notebook User

    Reputations:
    444
    Messages:
    2,513
    Likes Received:
    0
    Trophy Points:
    55
    Well, that was painless and might be fruitful. Here's the result of WhoCrashed:

    Crash Dump Analysis
    Crash dump directory: C:\WINDOWS\Minidump

    Crash dumps are enabled on your computer.

    On Wed 08-Mar-17 21:43:07 your computer crashed
    crash dump file: C:\WINDOWS\memory.dmp
    This was probably caused by the following module: ntdll.sys (ntdll!ZwTerminateProcess+0xA)
    Bugcheck code: 0xEF (0xFFFFE001E14852C0, 0x0, 0x0, 0x0)
    Error: CRITICAL_PROCESS_DIED
    Bug check description: This indicates that a critical system process died.
    There is a possibility this problem was caused by a virus or other malware.
    A third party driver was identified as the probable root cause of this system error. It is suggested you look for an update for the following driver: ntdll.sys .
    Google query: ntdll.sys CRITICAL_PROCESS_DIED


    Here's what I already thought/discovered about these results:
    1) I first tried to understand what this file is, by Googling "What is ntdll.sys". Surprisingly little information showed up so I'm still not sure what this is.
    2) The second attempt was to use WhoCrashed's suggested query of "ntdll.sys CRITICAL_PROCESS_DIED". That pulled up more information, including a few links of people having possibly similar issues:
    2.1) First link was someone with a malware problem. I've already tried to find the offending file in my computer (msde.exe) and results were empty.
    2.2) Second link seems similar to mine, however the guy had BSODs (I have hangs), and more importantly, he ran "sfc /scannow" and found a corruption while I ran it just now and it found no errors. I have also already tried re-installing the OS multiple times before with no improvement. (There is another link with the same problem)
    2.3) Third link is interesting. It speaks about some problems when trying to turn devices into a low-power state using Intel Rapid Storage Technology (IRST). This is interesting because I think most of my hangs happen fairly soon after I stop playing a video game (such as Civ4), which I imagine would trigger the OS putting devices into low-power mode. However:
    2.3.1) I don't have IRST on my computer, I think. It's not on "Programs and Features" nor does it show up in the Start Menu.
    2.3.2) I do have hangs in the middle of intensive tasks, including in the middle of playing Civ 4, so it might not be from this issue alone.
    3) I get the feeling I should have more hangs than this one. However, I am 100% sure I never had any problems with this laptop apart from hangs, so this crash must be one of those.
    4) I can't find the C:\WINDOWS\Minidump file/folder. It doesn't exist. If I'm not mistaken, another attempt at WhoCrashed just before the one I copy-pasted pointed to C:\WINDOWS\Memory.dmp, which does exist. It's a 377 MB file though, so I cannot attach it, but I'd love some pointers on how to debug this file.

    At this point I feel like I could use some more pointers. While help in speculating what might be the issue, I am particularly interested in help to learn how to debug these problems (such as the excellent tip of trying WhoCrashed) so that I can then do it myself and even teach others.

    Thanks again!
    HK
     
  10. HerrKaputt

    HerrKaputt Elite Notebook User

    Reputations:
    444
    Messages:
    2,513
    Likes Received:
    0
    Trophy Points:
    55
    Bumpity-bump
     
Loading...

Share This Page