Question

"The system has recovered from a serious error" message

Asked by: DAHelp

Hi There, I seem to keep having an issue with one of our users machine, the machine is a HP DC7900. The machine is running MS XP Pro SP 3 and has 4GB RAM and running a NVIDIA Quadro NVS 285 graphics card for dual monitors. This machine was used to build an image which is deployed to 5 machines, all DC7900's.

User complains that they are getting the error message "The system has recovered from a serious error"   The first instance of this error, that machine restarted unexpectantly and he was greeeted with the same message, a linked followed and advised that it was caused by antivirus software.  I had inclination it could be the RAM, I have taken the RAM out and seated it correctly. The error pop-up again, this time I have uninstalled the Nvidia drivers and removed graphics card and then install another nvidia card and new drivers. No problem was recorded for 2 days, today the error has occured twice, the lastest a BSOD and system restarted with an error message http://wer.microsoft.com/responses/Response.aspx/10/en-au/5.1.2600.0.00000000.9.9?SGD=860a89e0-33a1-4b4f-a41e-16933312bca1

None of the other users have experienced any problems and this is the only user. When building the machine i could only build it on IDE and not the default AHCI setting.

These are the following log errors and dates:

05/01/09 8:03am - Error code 0000004e, parameter1 0000008f, parameter2 000ab06f, parameter3 000b9d6f, parameter4 00000000.

05/01/09 1:58pm - Error code 000000de, parameter1 00000002, parameter2 e899df38, parameter3 e899c5b0, parameter4 19f648c6.

06/01/09 11:40am - Error code 1000000a, parameter1 00000000, parameter2 00000002, parameter3 00000001, parameter4 805226f8.

07/01/09 10:20am - Error code 1000008e, parameter1 c0000005, parameter2 805ded8e, parameter3 b6426b6c, parameter4 00000000.

09/01/09 2:36pm - Error code 1000000a, parameter1 00000010, parameter2 00000002, parameter3 00000001, parameter4 805172d6.

14/01/09 7:59am - Error code 1000000a, parameter1 00000000, parameter2 00000002, parameter3 00000001, parameter4 805226f8.

14/01/09 11:01am: Error code 00000024, parameter1 001902fe, parameter2 b622a160, parameter3 b6229e5c, parameter4 8051afe6.

Any help pointing me in the right direction would be appreciated.

This Question has been solved and asker verified All Experts Exchange premium technology solutions are available to subscription members.

Subscribe now for full access to Experts Exchange and get

Instant Access to this Solution

  • Plus...
  • 30 Day FREE access, no risk, no obligation
  • Collaborate with the world's top tech experts
  • Unlimited access to our exclusive solution database
  • Never be left without tech help again

Subscribe Now

Asked On
2009-01-13 at 17:21:48ID24049734
Tags

System Boot Up

,

Crashes

Topic

Hardware Components

Participating Experts
1
Points
500
Comments
3

Trusted by hundreds of thousands everyday for fast, accurate and reliable tech support.

  • "The time we save is the biggest benefit of Experts Exchange to Warner Bros. What could take multiple guys 2 hours or more each to find is accessed in around 15 minutes on Experts Exchange." Mike Kapnisakis, Warner Bros.
  • "Our team likes having a resource that is more secure than just using Google and most experts using this service really know their stuff. It's nice to look here first versus using Google." Dayna Sellner, Lockheed Martin
  • "Anytime that I've been stumped with a problem, 9 out of 10 times Experts Exchange has either the accepted solution or an open discussion of the potential solution to the problem." Kenny Red, eBay Inc.

See what Experts Exchange can do for you.

Got a question?

We've got the answer.

Experts Exchange has been collecting answers to technology questions since 1996…3 million and counting! If you have a question, chances are we already have your answer.

Screenshot of Experts Exchange Knowledgebase

Need individual assistance?

Our experts are ready to help.

If you can't find the exact answer you're looking for, ask our exclusive community of 50,000 experts. You’ll get a personalized answer from a trusted professional.

Screenshot of Experts Exchange Knowledgebase

Want to learn from the best?

Read articles from industry experts.

Thousands of free tech tips, tricks, how-to’s and tutorials are available in our peer reviewed articles section. See for yourself how smart our experts are, no login required.

Screenshot of an Article

Working on a long term project?

Store your work and research.

Save solutions to your questions, answers you’ve discovered through searching plus helpful articles in your personal knowledgebase for easy future access.

Screenshot of Experts Exchange Knowledgebase

Access the answers to your technology questions today.

Subscribe Now

30-day free trial. Register in 60 seconds.

What Makes Experts Exchange Unique?

Members of the expert community talk about why the experience at Experts Exchange is different than what you will find anywhere else.

Trusted by the world's most respected brands.

image of each brand's logo

Faithfully serving IT professionals since 1996.

Experts Exchange Logo

Try it out and discover for yourself.

Subscribe Now

30-day free trial. Register in 60 seconds.

Related Solutions

  1. NVIDIA Quadro FX 4400 vs. NVIDIA 7800 "GAMER…
    Is there an advantage between these cards for 3D software? such as GeoGraphix... (will not be used for gaming at all). Looks like the same RAM (DDR3) speed etc...yet the Quadro FX 4400 costs $1300 more! Holy cr@p. NVIDIA Quadro FX 4400 = $1925 NVIDIA 7800 = $650 I have a...
  2. "recovered from a serious error"
    I have a P4 3.2GHz system with 4GB RAM and an nVidia Gforce 6200/256MB video card. The motherboard is Intel and the processor cooler is Cooler Master Hyper 6. One of my fans stopped working last week. I didn't notice it until the system over heated and shut down. Now, I can...
  3. Linux, Open Suse, 10.3, Nvidia, Quadro NVS, 1…
    I have a Leneovo T61 with a Nvidia Quadro NVS 140M graphics card and with Open Suse 10.3 installed. I installed the latest Linux Nvidia driver which enhanced the resolution to 1920 x 1200... BUT the Nvidia driver cannot initiate the 3D acceleration. SAX2 cannot start the 3D s...
  4. Nvidia Quadro NVS clipping or what's going on ??
    Hello Just got this laptop for using it with SketchUp Pro (simple 3D modelling). This laptop, a Dell Latitude D830, comes with a Nvidia Quadro NVS135M. When using SketchUp I see the images clipping. What could be the problem? SketchUp? Nvidia Quadro? No idea... Latest dri...

Free Tech Articles

  1. WARNING: 5 Reasons why you should NEVER fix a computer for free.
    It is in our nature to love the puzzle. We are obsessed. The lot of us. We love puzzles. We love the challenge. We thrive on finding the answer. We hate disarray. It bothers us deep in our soul. W...
  2. SCCM OSD Basic troubleshooting
    SCCM 2007 OSD is a fantastic way to deploy operating systems, however, like most things SCCM issues can sometimes be difficult to resolve due to the sheer volume of logs to sift through and the dispe...
  3. Migrate Small Business Server 2003 to Exchange 2010 and Windows 2008 R2
    This guide is intended to provide step by step instructions on how to migrate from Small Business Server 2003 to Windows 2008 R2 with Exchange 2010. For this migration to work you will need the fo...
  4. Create a Win7 Gadget
    This article shows you how to create a simple "Gadget" -- a sort of mini-application supported by Windows 7 and Vista. Gadgets can be dropped anywhere on the desktop to provide instant information, ...
  5. Outlook continually prompting for username and password
    There have been a lot of questions recently regarding Outlook prompting for a username and password whilst using Exchange 2007. There are a few reasons why this would happen and I will try to cover t...
  6. Backup Exchange 2010 Information Store using Windows Backup
    There seems to be quite a lot of confusion around the ability to backup Exchange 2010 using the built in Windows Backup feature. This stems from the omission of this feature prior to Exchange 2007 s...

Cloud Class Webinars

  1. Avoiding Bugs in Microsoft Access
    Alison Balter takes and in-depth look at avoiding bugs in Access. In this webinar you will learn about using the immediate window to debug your applications, invoking the debugger, using breakpoints to troubleshoot, stepping through code, setting the next statement to execute, ...
  2. Top 10 Best New Features in Visio 2010
    Scott Helmers gives live demonstrations of the top 10 new features in Visio 2010. This webinar will teach you how to create compelling diagrams by adding shapes to the page with a single click, linking the shapes in a diagram to data in Excel (or SQL Server, or SharePoint), ...
  3. IT Consultant Business Secrets Revealed
    Michael Munger, Experts Exchange tech pro and IT consultant, pulls back the curtain on his very successful businesses and answers question on every IT consultant and business owner should know about. He shares secrets on what he did to solve the 5 most common problems in IT, ...
  4. Disaster Recovery and Business Continuity
    Quest CTO, Mike Billon, gives an overview of the steps involved in building a dunamic disaster recovery plan. Through case studies and an examination of software/hardware tooles for monitoring and testing, you'll gain a better understandin of where you are, where you want ...
  5. Organize Your Visio Diagrams with Containers and Lists
    Scott Helmers uses cross functional flowcharts, wireframe diagrams, data graphic legends and seating charts to teach you: how to ustilize all three new structured diagram components in Visio 2010, the best practices for organizeing shapes in previous version of Visio, how to organize ...
  6. How to Us Objects, Properties, Events and Methods in Microsoft Access
    Alison Dalter gives an in-depbth look at objects, properties, events and methods in Microsoft Access. In this webinar you will learn about using the object browser, referring to objects, working with properties and methods, working with object variables, understanding the ...

Join the Community

Give a Little. Get a Lot.

Join the community of experts here and help other tech pros by answering question in your area of expertise. You can earn FREE access to all Experts Exchange's premium features and resources.

Join the Community

Answers

 

by: nobusPosted on 2009-01-14 at 01:42:49ID: 23371076

can you post a couple of minidumps?

 

by: DAHelpPosted on 2009-01-14 at 17:27:07ID: 23379794

Hi Nobus, yes here are a few:

*** ERROR: Module load completed but symbols could not be loaded for ino_fltr.sys
Probably caused by : memory_corruption ( nt!MiFlushSectionInternal+4db )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

PFN_LIST_CORRUPT (4e)
Typically caused by drivers passing bad memory descriptor lists (ie: calling
MmUnlockPages twice with the same list, etc).  If a kernel debugger is
available get the stack trace.
Arguments:
Arg1: 00000007, A driver has unlocked a page more times than it locked it
Arg2: 000c84a4, page frame number
Arg3: 00088e5d, current share count
Arg4: 00000000, 0

Debugging Details:
------------------


BUGCHECK_STR:  0x4E_7

CUSTOMER_CRASH_COUNT:  2

DEFAULT_BUCKET_ID:  DRIVER_FAULT

PROCESS_NAME:  System

LAST_CONTROL_TRANSFER:  from 80522d13 to 804f9f43

STACK_TEXT:  
ba4ff790 80522d13 0000004e 00000007 000c84a4 nt!KeBugCheckEx+0x1b
ba4ff7b0 8050f165 8a826188 8a8ab640 8a8561d8 nt!MiDecrementReferenceCount+0x33
ba4ff884 8050faa4 e4898fb0 e4899010 e4899010 nt!MiFlushSectionInternal+0x4db
ba4ff8c0 804e4554 8a8561d8 00000000 0000c000 nt!MmFlushSection+0x1f2
ba4ff948 b9d3f007 0000c000 ba4ff9e8 0000c000 nt!CcFlushCache+0x3a0
ba4ffa10 b9d3f089 e150a2a8 e3cfb960 e150a2a8 Ntfs!LfsFlushLfcb+0x227
ba4ffa34 b9d493db e150a2a8 e3cfb960 e14d8040 Ntfs!LfsFlushLbcb+0x81
ba4ffa5c b9d3dc60 e150a2a8 ffffffff 7fffffff Ntfs!LfsFlushToLsnPriv+0xf3
ba4ffa9c b9d5cfe4 e14d8040 ffffffff 7fffffff Ntfs!LfsFlushToLsn+0x8e
ba4ffb08 b9d5d160 89ae5268 8a70a008 8a70a008 Ntfs!NtfsCommonFlushBuffers+0x287
ba4ffb6c 804ef19f 8a826770 8a70a008 8a81e858 Ntfs!NtfsFsdFlushBuffers+0x92
ba4ffb7c b9dc1459 ba4ffbc8 804ef19f 8a890c08 nt!IopfCallDriver+0x31
ba4ffb84 804ef19f 8a890c08 8a70a008 89dc6590 sr!SrPassThrough+0x31
ba4ffb94 b68f5544 8a0db360 8a39b030 8a70a008 nt!IopfCallDriver+0x31
WARNING: Stack unwind information not available. Following frames may be wrong.
ba4ffbc8 80576eb1 89dc64d8 8a70a008 8a0db360 ino_fltr+0x7544
ba4ffc40 8054162c 80000464 ba4ffcd4 ba4ffcdc nt!NtFlushBuffersFile+0x1b9
ba4ffc40 80500351 80000464 ba4ffcd4 ba4ffcdc nt!KiFastCallEntry+0xfc
ba4ffcc0 8063c233 80000464 ba4ffcd4 e10de000 nt!ZwFlushBuffersFile+0x11
ba4ffcdc 8063b56b e10ddb60 00000001 00000000 nt!CmpFileFlush+0x55
ba4ffd30 8063b8b7 fffffe00 e10ddb60 8067d3b0 nt!HvpWriteLog+0xe9
ba4ffd44 806320d4 e10ddb01 80559534 8055a220 nt!HvSyncHive+0x71
ba4ffd60 8062af25 00000000 8056485c 8a8ab640 nt!CmpDoFlushAll+0x6c
ba4ffd7c 8053877d 00000000 00000000 8a8ab640 nt!CmpLazyFlushWorker+0x53
ba4ffdac 805cff70 00000000 00000000 00000000 nt!ExpWorkerThread+0xef
ba4ffddc 805460ee 8053868e 00000001 00000000 nt!PspSystemThreadStartup+0x34
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16


STACK_COMMAND:  kb

FOLLOWUP_IP:
nt!MiFlushSectionInternal+4db
8050f165 8b45ec          mov     eax,dword ptr [ebp-14h]

SYMBOL_STACK_INDEX:  2

SYMBOL_NAME:  nt!MiFlushSectionInternal+4db

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

DEBUG_FLR_IMAGE_TIMESTAMP:  48a3fbd9

IMAGE_NAME:  memory_corruption

FAILURE_BUCKET_ID:  0x4E_7_nt!MiFlushSectionInternal+4db

BUCKET_ID:  0x4E_7_nt!MiFlushSectionInternal+4db

Followup: MachineOwner
___________________________________________________________________________________

Microsoft (R) Windows Debugger Version 6.10.0003.233 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Documents and Settings\duwaynem\Desktop\Mini011409-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows XP Kernel Version 2600 (Service Pack 3) MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 2600.xpsp_sp3_gdr.080814-1236
Machine Name:
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055d720
Debug session time: Wed Jan 14 10:57:55.571 2009 (GMT+10)
System Uptime: 0 days 2:38:37.286
Loading Kernel Symbols
...............................................................
..........................................................
Loading User Symbols
Loading unloaded module list
...................
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 24, {1902fe, b622a160, b6229e5c, 8051afe6}

*** WARNING: Unable to verify timestamp for ino_fltr.sys
*** ERROR: Module load completed but symbols could not be loaded for ino_fltr.sys
Probably caused by : Ntfs.sys ( Ntfs!LfsGetLbcb+5b )

Followup: MachineOwner
---------

1: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

NTFS_FILE_SYSTEM (24)
    If you see NtfsExceptionFilter on the stack then the 2nd and 3rd
    parameters are the exception record and context record. Do a .cxr
    on the 3rd parameter and then kb to obtain a more informative stack
    trace.
Arguments:
Arg1: 001902fe
Arg2: b622a160
Arg3: b6229e5c
Arg4: 8051afe6

Debugging Details:
------------------


EXCEPTION_RECORD:  b622a160 -- (.exr 0xffffffffb622a160)
ExceptionAddress: 8051afe6 (nt!MmCheckCachedPageState+0x00000576)
   ExceptionCode: c0000005 (Access violation)
  ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 00000000
   Parameter[1]: 00000024
Attempt to read from address 00000024

CONTEXT:  b6229e5c -- (.cxr 0xffffffffb6229e5c)
eax=00000000 ebx=00000400 ecx=00000000 edx=00000001 esi=8a8260b8 edi=c0617d28
eip=8051afe6 esp=b622a228 ebp=b622a274 iopl=0         nv up ei pl nz na po nc
cs=0008  ss=0010  ds=0023  es=0023  fs=0030  gs=0000             efl=00010202
nt!MmCheckCachedPageState+0x576:
8051afe6 8b7824          mov     edi,dword ptr [eax+24h] ds:0023:00000024=????????
Resetting default scope

CUSTOMER_CRASH_COUNT:  1

PROCESS_NAME:  InoRT.exe

ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx". The memory could not be "%s".

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx". The memory could not be "%s".

EXCEPTION_PARAMETER1:  00000000

EXCEPTION_PARAMETER2:  00000024

READ_ADDRESS:  00000024

FOLLOWUP_IP:
Ntfs!LfsGetLbcb+5b
b9d3ebc3 8b45dc          mov     eax,dword ptr [ebp-24h]

BUGCHECK_STR:  0x24

DEFAULT_BUCKET_ID:  NULL_CLASS_PTR_DEREFERENCE

LAST_CONTROL_TRANSFER:  from 804e2480 to 8051afe6

STACK_TEXT:  
b622a274 804e2480 c2fa5000 00000000 b622a3a0 nt!MmCheckCachedPageState+0x576
b622a2bc 804e3f0a 8a8cb650 b622a2fc 00001000 nt!CcMapAndRead+0x86
b622a350 8056a5ab 8a8c1230 b622a390 00001000 nt!CcPinFileData+0x204
b622a3c4 b9d3ebc3 8a8c1230 b622a404 00001000 nt!CcPreparePinWrite+0x93
b622a444 b9d3ed21 e14d6b28 e1507298 000000d8 Ntfs!LfsGetLbcb+0x5b
b622a458 b9d3e9a2 e14d6b28 000000d0 e1507298 Ntfs!LfsPrepareLfcbForLogRecord+0x4a
b622a488 b9d3e6d6 e14d6b28 e1507298 00000002 Ntfs!LfsWriteLogRecordIntoLogPage+0x5c
b622a564 b9d3e1ff e1507298 00000002 b622a624 Ntfs!LfsWrite+0x2f7
b622a6e8 b9d59c37 b622aa6c e14d2588 89371128 Ntfs!NtfsWriteLog+0x6a2
b622a7b4 b9d9b576 b622aa6c e14d2588 16294370 Ntfs!NtOfsPutData+0x2fa
b622a848 b9d712bd b622aa6c 00000000 b622ab7c Ntfs!NtfsWriteUsnJournalChanges+0x19c
b622aa50 b9d42d4d b622aa6c 89979008 8a8cbcc0 Ntfs!NtfsCommonCleanup+0x24c5
b622abc8 804ef19f 8a826770 89979008 8a81e858 Ntfs!NtfsFsdCleanup+0xcf
b622abd8 b9dc5bbf 00000000 89f3d9a0 b622ac60 nt!IopfCallDriver+0x31
b622abe8 804ef19f 8a8cbc08 89979008 89979198 sr!SrCleanup+0xb3
b622abf8 b699aacd 89c8e5a0 8a176a18 89979018 nt!IopfCallDriver+0x31
WARNING: Stack unwind information not available. Following frames may be wrong.
b622ac60 804ef19f 8a137ea8 89979008 89979008 ino_fltr+0xcacd
b622ac70 80583953 89c8e588 00000038 8a8d0900 nt!IopfCallDriver+0x31
b622aca0 805bca16 89d8eda0 8a137ea8 00100100 nt!IopCloseFile+0x26b
b622acd4 805bc33f 89d8eda0 00000001 8a8d0900 nt!ObpDecrementHandleCount+0xd8
b622acfc 805bc3dd e237e5c8 89c8e5a0 00000154 nt!ObpCloseHandleTableEntry+0x14d
b622ad44 805bc515 00000154 00000001 00000000 nt!ObpCloseHandle+0x87
b622ad58 8054162c 00000154 024eef88 7c90e4f4 nt!NtClose+0x1d
b622ad58 7c90e4f4 00000154 024eef88 7c90e4f4 nt!KiFastCallEntry+0xfc
024eef88 00000000 00000000 00000000 00000000 0x7c90e4f4


SYMBOL_STACK_INDEX:  4

SYMBOL_NAME:  Ntfs!LfsGetLbcb+5b

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: Ntfs

IMAGE_NAME:  Ntfs.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  48025be5

STACK_COMMAND:  .cxr 0xffffffffb6229e5c ; kb

FAILURE_BUCKET_ID:  0x24_Ntfs!LfsGetLbcb+5b

BUCKET_ID:  0x24_Ntfs!LfsGetLbcb+5b

Followup: MachineOwner
---------
___________________________________________________________________________________

Microsoft (R) Windows Debugger Version 6.10.0003.233 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Documents and Settings\duwaynem\Desktop\Mini011509-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows XP Kernel Version 2600 (Service Pack 3) MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 2600.xpsp_sp3_gdr.080814-1236
Machine Name:
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055d720
Debug session time: Thu Jan 15 09:37:51.293 2009 (GMT+10)
System Uptime: 0 days 1:44:23.256
Loading Kernel Symbols
...............................................................
........................................................
Loading User Symbols
Loading unloaded module list
.....................
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1000000A, {f78001b7, 2, 1, 80522770}

Probably caused by : memory_corruption ( nt!MiRemovePageByColor+de )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: f78001b7, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000001, bitfield :
      bit 0 : value 0 = read operation, 1 = write operation
      bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: 80522770, address which referenced memory

Debugging Details:
------------------


WRITE_ADDRESS:  f78001b7

CURRENT_IRQL:  2

FAULTING_IP:
nt!MiRemovePageByColor+de
80522770 ff4808          dec     dword ptr [eax+8]

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  DRIVER_FAULT

BUGCHECK_STR:  0xA

PROCESS_NAME:  svchost.exe

LAST_CONTROL_TRANSFER:  from 80522a90 to 80522770

STACK_TEXT:  
b5a53cb4 80522a90 00000001 00000024 c0047bd8 nt!MiRemovePageByColor+0xde
b5a53cd0 80514b0f c0600238 c0047bd8 00000000 nt!MiRemoveZeroPage+0x8a
b5a53ce8 805205bd 08f7b000 c0047bd8 89e399f0 nt!MiResolveDemandZeroFault+0xc5
b5a53d4c 80544588 00000001 08f7b000 00000001 nt!MmAccessFault+0xbeb
b5a53d4c 7c910741 00000001 08f7b000 00000001 nt!KiTrap0E+0xd0
WARNING: Frame IP not in any known module. Following frames may be wrong.
00b1f170 00000000 00000000 00000000 00000000 0x7c910741


STACK_COMMAND:  kb

FOLLOWUP_IP:
nt!MiRemovePageByColor+de
80522770 ff4808          dec     dword ptr [eax+8]

SYMBOL_STACK_INDEX:  0

SYMBOL_NAME:  nt!MiRemovePageByColor+de

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

DEBUG_FLR_IMAGE_TIMESTAMP:  48a3fbd9

IMAGE_NAME:  memory_corruption

FAILURE_BUCKET_ID:  0xA_nt!MiRemovePageByColor+de

BUCKET_ID:  0xA_nt!MiRemovePageByColor+de

Followup: MachineOwner
---------
___________________________________________________________________________________
Microsoft (R) Windows Debugger Version 6.10.0003.233 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Documents and Settings\duwaynem\Desktop\Mini011509-02.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows XP Kernel Version 2600 (Service Pack 3) MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 2600.xpsp_sp3_gdr.080814-1236
Machine Name:
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055d720
Debug session time: Thu Jan 15 09:44:14.407 2009 (GMT+10)
System Uptime: 0 days 0:06:09.125
Loading Kernel Symbols
...............................................................
........................................................
Loading User Symbols
Loading unloaded module list
...........
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1000000A, {0, 2, 1, 805226f8}

Probably caused by : memory_corruption ( nt!MiRemovePageByColor+66 )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 00000000, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000001, bitfield :
      bit 0 : value 0 = read operation, 1 = write operation
      bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: 805226f8, address which referenced memory

Debugging Details:
------------------


WRITE_ADDRESS:  00000000

CURRENT_IRQL:  2

FAULTING_IP:
nt!MiRemovePageByColor+66
805226f8 ff08            dec     dword ptr [eax]

CUSTOMER_CRASH_COUNT:  2

DEFAULT_BUCKET_ID:  DRIVER_FAULT

BUGCHECK_STR:  0xA

PROCESS_NAME:  VB6.EXE

LAST_CONTROL_TRANSFER:  from 80522a90 to 805226f8

STACK_TEXT:  
b5effcb4 80522a90 00000001 0000002f c00205c8 nt!MiRemovePageByColor+0x66
b5effcd0 80514b0f c0600100 c00205c8 00000000 nt!MiRemoveZeroPage+0x8a
b5effce8 805205bd 040b9000 c00205c8 89869810 nt!MiResolveDemandZeroFault+0xc5
b5effd4c 80544588 00000001 040b9000 00000001 nt!MmAccessFault+0xbeb
b5effd4c 7c910741 00000001 040b9000 00000001 nt!KiTrap0E+0xd0
WARNING: Frame IP not in any known module. Following frames may be wrong.
0013fb64 00000000 00000000 00000000 00000000 0x7c910741


STACK_COMMAND:  kb

FOLLOWUP_IP:
nt!MiRemovePageByColor+66
805226f8 ff08            dec     dword ptr [eax]

SYMBOL_STACK_INDEX:  0

SYMBOL_NAME:  nt!MiRemovePageByColor+66

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

DEBUG_FLR_IMAGE_TIMESTAMP:  48a3fbd9

IMAGE_NAME:  memory_corruption

FAILURE_BUCKET_ID:  0xA_nt!MiRemovePageByColor+66

BUCKET_ID:  0xA_nt!MiRemovePageByColor+66

Followup: MachineOwner
---------
___________________________________________________________________________________

Microsoft (R) Windows Debugger Version 6.10.0003.233 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Documents and Settings\duwaynem\Desktop\Mini010709-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows XP Kernel Version 2600 (Service Pack 3) MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 2600.xpsp_sp3_gdr.080814-1236
Machine Name:
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055d720
Debug session time: Wed Jan  7 10:16:55.905 2009 (GMT+10)
System Uptime: 0 days 22:41:03.023
Loading Kernel Symbols
...............................................................
........................................................
Loading User Symbols
Loading unloaded module list
............................
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1000008E, {c0000005, 805ded8e, b6426b6c, 0}

Probably caused by : win32k.sys ( win32k!Win32HeapFree+13 )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

KERNEL_MODE_EXCEPTION_NOT_HANDLED_M (1000008e)
This is a very common bugcheck.  Usually the exception address pinpoints
the driver/function that caused the problem.  Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003.  This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG.  This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG.  This will let us see why this breakpoint is
happening.
Arguments:
Arg1: c0000005, The exception code that was not handled
Arg2: 805ded8e, The address that the exception occurred at
Arg3: b6426b6c, Trap Frame
Arg4: 00000000

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx". The memory could not be "%s".

FAULTING_IP:
nt!RtlpCoalesceFreeBlocks+f8
805ded8e 8b12            mov     edx,dword ptr [edx]

TRAP_FRAME:  b6426b6c -- (.trap 0xffffffffb6426b6c)
ErrCode = 00000000
eax=00050712 ebx=bbee0000 ecx=bbf76cf8 edx=00000003 esi=bbf76cf0 edi=bbf76da0
eip=805ded8e esp=b6426be0 ebp=b6426bec iopl=0         nv up ei pl zr na pe nc
cs=0008  ss=0010  ds=0023  es=0023  fs=0030  gs=0000             efl=00010246
nt!RtlpCoalesceFreeBlocks+0xf8:
805ded8e 8b12            mov     edx,dword ptr [edx]  ds:0023:00000003=????????
Resetting default scope

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  DRIVER_FAULT

BUGCHECK_STR:  0x8E

PROCESS_NAME:  iexplore.exe

LAST_CONTROL_TRANSFER:  from 805e1639 to 805ded8e

STACK_TEXT:  
b6426bec 805e1639 bbee0000 00000003 b6426c54 nt!RtlpCoalesceFreeBlocks+0xf8
b6426c74 bf80ca54 bbee0000 00000000 bbf76da8 nt!RtlFreeHeap+0xa1
b6426c88 bf8283b3 bbee0000 bbf76da8 0000c031 win32k!Win32HeapFree+0x13
b6426ca4 bf828346 bc027438 00000000 e2067b80 win32k!CreateProp+0x7b
b6426cb8 bf8785ac bbf9e500 0000c031 e2067b80 win32k!InternalSetProp+0x37
b6426cdc bf87864e bbf9e500 d4052a1c 00000000 win32k!SetRedirectionBitmap+0x60
b6426cf4 bf878d84 bbf9e500 bbf9e500 b6426d30 win32k!CreateRedirectionBitmap+0x62
b6426d04 bf84d1af bbf9e500 00000001 b6426d64 win32k!SetRedirectedWindow+0x1e
b6426d30 bf84d1fb bbf9e500 00000000 00000000 win32k!_SetLayeredWindowAttributes+0x38
b6426d4c 8054162c 00020f16 00000000 00000000 win32k!NtUserSetLayeredWindowAttributes+0x3e
b6426d4c 7c90e4f4 00020f16 00000000 00000000 nt!KiFastCallEntry+0xfc
WARNING: Frame IP not in any known module. Following frames may be wrong.
03b2fce8 00000000 00000000 00000000 00000000 0x7c90e4f4


STACK_COMMAND:  kb

FOLLOWUP_IP:
win32k!Win32HeapFree+13
bf80ca54 0fb6c0          movzx   eax,al

SYMBOL_STACK_INDEX:  2

SYMBOL_NAME:  win32k!Win32HeapFree+13

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: win32k

IMAGE_NAME:  win32k.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  48ce513a

FAILURE_BUCKET_ID:  0x8E_win32k!Win32HeapFree+13

BUCKET_ID:  0x8E_win32k!Win32HeapFree+13

Followup: MachineOwner
---------

 

by: nobusPosted on 2009-01-15 at 00:15:25ID: 23381419

please, do not list them; attach them as file...
the first 2 talk about memory corruption :  IMAGE_NAME:  memory_corruption
so that would be my first step : test the ram with memtest86+ from www.memtest.org
the last one ==win32k.sys

20120131-EE-VQP-002

3 Ways to Join

30-Day Free Trial

The Experts

98% positive feedback on 31,087 answers since March 2000. angeliii is a Microsoft Most Valuable Professional for his work with MS SQL Server & Develoment.

He has also proven his knowledge of Visual Basic Programming, PHP Scripting and Oracle Databases.

The Experts

97% positive feedback on 10,752 answers since July 2000. lrmoore has more than 18 years experience in the networking industry.

The six-time Mircosoft MVPs specialties include firewalls, virtual private networking, and network management.

Testimonials

"...and excellent source for support... Kind of like having your very own IT dept." Electriciansnet

Testimonials

"I was apprehensive at signing up at first. However... it has already made my life as an IT administrator much easier." JaCrews

Testimonials

"WOW! You guys have great, active, and knowledgeable people on here." moore50

Business Clients

Business Clients

In the Press

"If you’ve got a question... Experts Exchange can supply an answer.”

In the Press

"...an invaluable aid for both IT professionals and those who require tech support."

In the Press

"where IT professionals provide quick answers on just about any topic"

Business Account Plans

Loading Advertisement...