Windows 7 randomly freezes \ locks up

Hello. I’m using Win 7 x64 and once in a 3 to 7 days or so it randomly locks up.

It’s always the same: Windows locks up out of nowhere, doesn’t react to keyboard, mouse and CTRL+ALT+DEL, when I reset PC it’ll then just stuck at windows logo, with HDD doing something for a while, than stops. Then I go to F8 menu >>> Repair your computer>>> Startup repair, it does something for about 10 minutes or so, then I restart the PC and it works fine for about 3 to 7 or so days, then this all repeats.

I honestly don’t have a clue at what is it and why is this happening. It doesn’t appear to be overheating problem, temperature is about 45 - 55 celcius (I use CoreTemp).

Maybe my HDD is failing? I have pretty large HDD (1 tb) and some programs say it’s fine, others say it’s not.

Do the Windows logs in Event viewer point to problem with your hard drive?

What programs are you using to determine the health of your drive? What programs tell there is a problem and what problem?

Please double check the SATA data cable between drive and motherboard. SATA cables come loose easily. Also try changing the SATA data cable.

I used Speccy and Crystal Disk Info (see screenshots).

I’ll look at the logs next time this happens… it wou;d be under “System” logs, right?

Also, I find it strange that after each of those lock-ups Windows won’t boot, and every time Repair your computer>>>startup repair fixes it.

[attachment deleted by admin]

Can you keep an eye on the Reallocated Sectors Count and see if the count goes up. Also let the Western Digital Data Lifeguard Diagnostics look at your hard drive.

If the Reallocated Sectors Count goes up then we may be looking at a hard drive problem. How old is your drive? Judging by the size it cannot be that old.

Please also change your SATA data cable to see if there is an influence there or not.

Western Digital Data Lifeguard Diagnostics pretty much shows the same data, and it says disk is ok. Quick SMART test from that utility says “pass”.

I’ll keep an eye on Reallocated Sectors Count next time it’ll lock up. IF it’ll lock-up now that I’m monitoring it… Sometimes I think it’s afraid of me when I try to monitor it, so it won’t glitch, bug out or lock-up…well, we’ll see.

This is pretty new PC, I bought it a little more than a year ago.

[attachment deleted by admin]

Ok, it happened again, while I was away from PC so I don’t know when exactly it happened, but when I returned at 8:36 P.M. it was already locked up.

Reallocated Sectors Count didn’t change it’s 197 as before.

As for windows logs (system) those are errors and warnings logged round the time I was away:

Event ID 1060 - Application Popup (2 times)
??\C:\Windows\SysWow64\Drivers\uziwotqw.sys \SystemRoot\SysWow64\drivers\prodrv06.sys has been blocked from loading due to incompatibility with this system. Please contact your software vendor for a compatible version of the driver.

Event ID 6008 - EventLog
About unexepected system shutdown

Event ID 7000 - Service Control Manager
The “ArtMoneyPro7.39.3” service failed to start due to the following error:
System could not find path

Event Id 7026 - Service Control Manager
The following boot-start or system-start driver(s) failed to load:
prodrv06
prohlp02
prosync1
sfhlp01

Event Id 11 - wininit
Custom dynamic link libraries are being loaded for every application. The system administrator should review the list of libraries to ensure they are related to trusted applications.

Event ID 3004 - SharedAccess_NAT (2 times)
The DNS proxy agent was unable to allocate 0 bytes of memory. This may indicate that the system is low on virtual memory, or that the memory manager has encountered an internal error.

When Start-up repair finished it’s job, there’s an option to view error details. There was a bunch of lines like Problem signature 01 02 03 etc, there were my windows version, words “autofailover” and “norootcause” and number 214… I don’t know what any of those mean…except win version).

Also check the Windows logs to see if there is a hint there.

When you need to go into Windows Repair Mode please decide to go manual. You need to go through 3 questions until you get there. If I remember correctly, it’s not something I have used often, it can analyse and it will show what is happening after which you can decide to let it do its magic. Key is to see what it reports is happening.

For now I focussed on hd but it may as well be a problem with a service or driver. On a side note, did you overclock your system? Is your BIOS up to date?

After I wrote the above you had posted your latest reply in which the driver angle seems to surface. Two drivers are blocked by Windows.

Uziwotqw.sys may be from AVZ Antiviral Toolkit 4.39 from Kasperksy. Please uninstall AVZ to see if that brings a solution or not.

Prodrv06.sys belongs to StarForce Protection Environment Driver. Starforce is a copyright protection driver used by games. . Please make sure to remove all possible traces of Starforce from your system. I remember from several years ago those type of drivers could interfere with Windows in unexpected ways.

Event ID 7029 reports system start drivers not loading. Does it state why? It could be empty entries where the file the autorun entry points is no longer on your system. Check with Sysinternals Autoruns to see if these are empty entries, it will say file not found in that case.

Yes, I remember now that some time ago I installed one of my old games, which apparently used Starforce protection, but I suppose it was an old version that isn’t compatible with win 7 x64, because it always asked me to restart after “installing”, but after restart it was back to square 1, so to speak. I downloaded starforce removal program from their site, but it said “no drivers present”.

Drivers from event 7026 are present in autoruns with “file not found” mark, but in autoruns their path is C:\Windows\System32\drivers when in reality they’re located at C:\Windows\SysWOW64\drivers

My bios is up to date now, and I don’t overclock my pc.

I have AVZ utility, but it’s stand alone, and it says driver isn’t installed (AVZPM).

Event ID 3004 - SharedAccess_NAT (2 times) The DNS proxy agent was unable to allocate 0 bytes of memory. This may indicate that the system is low on virtual memory, or that the memory manager has encountered an internal error.
Do you have the pagefile enabled? How is it set?

Are you running the latest motherboard and graphics drivers ?

Pagefile is set to: Min - 2gb Max - 3gb, usage never exceed 2gb it seems (I have 8 Gb of RAM).

Video and motherboard drivers are now up to date.

I would like to get rid of Starforce drivers remains, they’re obviously there, and trying to load, but removal program doesn’t see them, so how do I get rid of them?

Also in Event 7000 it says could not start service “ArtMoneyPro7.39.3” because not found, funny but I don’t see this service in service lists (services.msc msconfig autoruns). I know this program, I used it a while ago, but deleted it already.

It sounds like only an autorun entry for Starforce is still there and not the driver file. Try deleting it using Autoruns.

I can only assume the removal tool for Starforce did its job and that it other than an Autorun entry is no longer present

Also in Event 7000 it says could not start service "Art*Money*Pro7.39.3" because not found, funny but I don't see this service in service lists (services.msc msconfig autoruns). I know this program, I used it a while ago, but deleted it already.
Does the manufacturer of Art Money provide a clean up tool?

For now I am out of troubleshooting ideas I’m afraid…

There is no clean-up tool for artmoney.

I deleted entries for files mentioned in event 7026 using autoruns, and anything I could fine there about art money.

We’ll see how it goes.

Keep us posted.

And in the meanwhile, if anybody has other ideas where to look please come forward…

Everything works stable so far. Was it really those starforce drivers causing lock-ups? They wern’t even loaded as far as I could see. Maybe it’s an updated BIOS? Or motherboard drivers? We kinda did a lot of stuff, dunno which of it fixed the problem.

What counts is that we fixed it. Of course it would have nicer to do this one step at a time to see what actually fixed it. But otoh this is the kind of problem you usually want fixed sooner rather than later…:-\

I guess I spoke too soon…it locked up again…

Only error logs this time are:

Event ID 6008 - EventLog
About unexepected system shutdown

and

Event ID 1060 - Application Popup
??\C:\Windows\SysWow64\Drivers\uziwotqw.sys has been blocked from loading due to incompatibility with this system. Please contact your software vendor for a compatible version of the driver.

There are 3 info logs from “StartupRepair” source № 1002 1137 and 1213

Last one said something about damaged files were restored from backup.

I noticed that after running automatic startup recovery, it said that it couldn’t repair the system, but it actually DID boot after that (it froze on windows logo during boot before I ran auto startup recovery).

It may be a coincidence, but I think whenever I use Microsoft virtual Wi-Fi network to share my internet with my notebook, it is more likely for system to lock-up out of nowhere, but not immediately.

If only I could see what this automatic startup recovery actually finds \ does, maybe that’ll give us some clues, but it doesn’t show me anything other than progress bar.

Just to be on the safe side of things I would advice to disable the loading of th uziwotqw.sys using Autoruns or similar tool.

May be it shows up in Non Plug and Play drivers in Device Manager and then you can uninstall it from there.

My radar is up when Windows states it repaired damaged files from back up. What did the other start up repair source come up with? Is it of any consequence?

Can you set Windows to create a minidump upon crash and read the minidump with Bluescreenview from Nirsoft. I hope that may give us a clue.

Ok I disabled that driver and set windows to create minidump.

The other 2 info logs from StartupRepair said (aproximate translation)

Repair (or restore) error on startup

and

Undetected changes of system configuration, are likely the cause of the problem

Third log was about restoring damaged files from backup.

Thanks. Now let’s see what happens next…