Start Free Trial

asked on

BSOD help

Gigabyte P35-DS4
Intel E6750
2 sticks 1 GB Crucial Ballistix RAM
Gigabyte GeForce 8400GS
--------------------------------------------------------
I built this computer for a customer a few months ago. After running fine for a couple months, the computer started crashing randomly and rebooting. It would usually get into a reboot "loop" and corrupt the RAID 1 operating system drive.

I have set the computer to not reboot automatically on a crash and have captured several minidumps, but I cannot pinpoint the trouble. I have tested all of the hardware as well as I know how. The trouble seems to occur only after plugging a device into the onboard USB ports, but I am not sure as the cause of the crash appears to be different each time.

I have never had this type of problem before and am stuck. Any help is greatly appreciated! I have 6 minidump files that I can send.

Please post the minidumps and also post the stop error message you are getting. To stop the reboot loop upon bootup press f8 then select disable automatic restart on system failure. This will give you the exact stop error message.

You should try to use that computer with another hard disk drive.

If you are using SATA RAID, unplug all hard drives except the one has windows installed, and test if you are not having any BSOD.

If that doesn't work, the problem is very possible to be caused by the RAM, please remove 1 of the memory Sticks, so you are nos doing any Dual Channel.

ASKER

Microsoft (R) Windows Debugger Version 6.8.0004.0 X86
Copyright (c) Microsoft Corporation. All rights reserved.

Loading Dump File [C:\WINDOWS\Minidump\Mini041108-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\debug*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows XP Kernel Version 2600 (Service Pack 2) MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 2600.xpsp_sp2_gdr.070227-2254
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055c700
Debug session time: Fri Apr 11 01:55:08.156 2008 (GMT-6)
System Uptime: 0 days 0:25:38.864
Loading Kernel Symbols
......................................................................................................................................
Loading User Symbols
Loading unloaded module list
.........
Unable to load image mfeavfk.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for mfeavfk.sys
*** ERROR: Module load completed but symbols could not be loaded for mfeavfk.sys
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 100000C5, {a050051, 2, 0, 8054afcb}

*** WARNING: Unable to verify timestamp for mfehidk.sys
*** ERROR: Module load completed but symbols could not be loaded for mfehidk.sys

Probably caused by : mfeavfk.sys ( mfeavfk+7864 )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

DRIVER_CORRUPTED_EXPOOL (c5)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is
caused by drivers that have corrupted the system pool. Run the driver
verifier against any new (or suspect) drivers, and if that doesn't turn up
the culprit, then use gflags to enable special pool.
Arguments:
Arg1: 0a050051, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000000, value 0 = read operation, 1 = write operation
Arg4: 8054afcb, address which referenced memory

Debugging Details:
------------------

BUGCHECK_STR: 0xC5_2

CURRENT_IRQL: 2

FAULTING_IP:
nt!ExAllocatePoolWithTag+663
8054afcb 8b06 mov eax,dword ptr [esi]

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: DRIVER_FAULT

PROCESS_NAME: iexplore.exe

LAST_CONTROL_TRANSFER: from a5b55864 to 8054afcb

STACK_TEXT:
a58f39d0 a5b55864 00000000 00000001 3045464d nt!ExAllocatePoolWithTag+0x663
WARNING: Stack unwind information not available. Following frames may be wrong.
a58f39e4 a5b515bf 0000034c a5b5a984 00000000 mfeavfk+0x7864
a58f3a7c a5b4fcfa 88134210 a58f3b34 00000000 mfeavfk+0x35bf
a58f3b04 a5a37660 00000000 a58f3b34 00000000 mfeavfk+0x1cfa
a58f3b20 a5a330cf a58f3b34 88670690 8815d5e0 mfehidk+0xb660
a58f3b98 a5a332de 8815d3c0 89324cd8 a58f3bbc mfehidk+0x70cf
a58f3c2c a5a40bd9 89324cd8 8815d3c0 a58f3c64 mfehidk+0x72de
a58f3c3c a5a40c29 a58f3c4c 88f2fbd8 88b30c70 mfehidk+0x14bd9
a58f3c64 804ef095 88b30c70 8815d3c0 8815d3c0 mfehidk+0x14c29
a58f3c74 805826c7 89324cc0 89e62900 00000001 nt!IopfCallDriver+0x31
a58f3ca4 805bb459 8826eda0 88b30c70 00120196 nt!IopCloseFile+0x26b
a58f3cd4 805badab 8826eda0 01324cc0 89e62900 nt!ObpDecrementHandleCount+0x11b
a58f3cfc 805bae49 e187d720 89324cd8 00001ca8 nt!ObpCloseHandleTableEntry+0x14d
a58f3d44 805baf81 00001ca8 00000001 00000000 nt!ObpCloseHandle+0x87
a58f3d58 8054086c 00001ca8 13dff540 7c90eb94 nt!NtClose+0x1d
a58f3d58 7c90eb94 00001ca8 13dff540 7c90eb94 nt!KiFastCallEntry+0xfc
13dff540 00000000 00000000 00000000 00000000 0x7c90eb94

STACK_COMMAND: kb

FOLLOWUP_IP:
mfeavfk+7864
a5b55864 ?? ???

SYMBOL_STACK_INDEX: 1

SYMBOL_NAME: mfeavfk+7864

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: mfeavfk

IMAGE_NAME: mfeavfk.sys

DEBUG_FLR_IMAGE_TIMESTAMP: 4564d549

FAILURE_BUCKET_ID: 0xC5_2_mfeavfk+7864

BUCKET_ID: 0xC5_2_mfeavfk+7864

Followup: MachineOwner
---------

0: kd> lmvm mfeavfk
start end module name
a5b4e000 a5b5df00 mfeavfk T (no symbols)
Loaded symbol image file: mfeavfk.sys
Image path: mfeavfk.sys
Image name: mfeavfk.sys
Timestamp: Wed Nov 22 15:55:05 2006 (4564D549)
CheckSum: 000137D5
ImageSize: 0000FF00
Translations: 0000.04b0 0000.04e0 0409.04b0 0409.04e0

ASKER

Microsoft (R) Windows Debugger Version 6.8.0004.0 X86
Copyright (c) Microsoft Corporation. All rights reserved.

Loading Dump File [C:\WINDOWS\Minidump\Mini041208-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\debug*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows XP Kernel Version 2600 (Service Pack 2) MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 2600.xpsp_sp2_gdr.070227-2254
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055c700
Debug session time: Fri Apr 11 04:48:05.593 2008 (GMT-6)
System Uptime: 0 days 0:51:58.312
Loading Kernel Symbols
.....................................................................................................................................
Loading User Symbols
Loading unloaded module list
............
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1000000A, {c95b5e6f, 2, 0, 8050d7db}

Probably caused by : memory_corruption

Followup: memory_corruption
---------

1: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: c95b5e6f, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000000, bitfield :
      bit 0 : value 0 = read operation, 1 = write operation
      bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: 8050d7db, address which referenced memory

Debugging Details:
------------------

READ_ADDRESS: c95b5e6f

CURRENT_IRQL: 2

FAULTING_IP:
nt!MiGatherPagefilePages+35d
8050d7db 8b865f5e5bc9 mov eax,dword ptr [esi-36A4A1A1h]

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: CODE_CORRUPTION

BUGCHECK_STR: 0xA

PROCESS_NAME: System

LAST_CONTROL_TRANSFER: from 8050daba to 8050d7db

STACK_TEXT:
bad1fd3c 8050daba 819c0654 000142d6 00000014 nt!MiGatherPagefilePages+0x35d
bad1fd74 8064c321 00000000 89dae790 00000000 nt!MiModifiedPageWriterWorker+0x1bc
bad1fdac 805ce84c 00000000 00000000 00000000 nt!MiModifiedPageWriter+0x165
bad1fddc 8054532e 8064c1bc 00000000 00000000 nt!PspSystemThreadStartup+0x34
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16

STACK_COMMAND: kb

CHKIMG_EXTENSION: !chkimg -lo 50 -d !nt
8050d7dc - nt!MiGatherPagefilePages+35e
      [ c6:86 ]
1 error : !nt (8050d7dc)

MODULE_NAME: memory_corruption

IMAGE_NAME: memory_corruption

FOLLOWUP_NAME: memory_corruption

DEBUG_FLR_IMAGE_TIMESTAMP: 0

MEMORY_CORRUPTOR: ONE_BIT

FAILURE_BUCKET_ID: MEMORY_CORRUPTION_ONE_BIT

BUCKET_ID: MEMORY_CORRUPTION_ONE_BIT

Followup: memory_corruption
---------

1: kd> lmvm memory_corruption
start end module name

ASKER

Microsoft (R) Windows Debugger Version 6.8.0004.0 X86
Copyright (c) Microsoft Corporation. All rights reserved.

Loading Dump File [C:\WINDOWS\Minidump\Mini041708-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\debug*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows XP Kernel Version 2600 (Service Pack 2) MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 2600.xpsp_sp2_gdr.070227-2254
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055c700
Debug session time: Thu Apr 17 03:55:27.609 2008 (GMT-6)
System Uptime: 0 days 5:32:11.317
Loading Kernel Symbols
.......................................................................................................................................
Loading User Symbols
Loading unloaded module list
.............
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1000008E, {c0000005, 8060bfe1, aaedbb0c, 0}

Probably caused by : ntkrpamp.exe ( nt!ExpAllocateHandleTableEntry+165 )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

KERNEL_MODE_EXCEPTION_NOT_HANDLED_M (1000008e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003. This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG. This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG. This will let us see why this breakpoint is
happening.
Arguments:
Arg1: c0000005, The exception code that was not handled
Arg2: 8060bfe1, The address that the exception occurred at
Arg3: aaedbb0c, Trap Frame
Arg4: 00000000

Debugging Details:
------------------

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx". The memory could not be "%s".

FAULTING_IP:
nt!ExpAllocateHandleTableEntry+165
8060bfe1 8b4804 mov ecx,dword ptr [eax+4]

TRAP_FRAME: aaedbb0c -- (.trap 0xffffffffaaedbb0c)
ErrCode = 00000000
eax=00000000 ebx=001f0003 ecx=00000000 edx=e254b558 esi=e254b534 edi=88eb1908
eip=8060bfe1 esp=aaedbb80 ebp=aaedbb9c iopl=0 nv up ei pl zr na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010246
nt!ExpAllocateHandleTableEntry+0x165:
8060bfe1 8b4804 mov ecx,dword ptr [eax+4] ds:0023:00000004=????????
Resetting default scope

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: 0x8E

PROCESS_NAME: ppped.exe

LAST_CONTROL_TRANSFER: from 8060c541 to 8060bfe1

STACK_TEXT:
aaedbb9c 8060c541 e254b528 aaedbbb4 001f0003 nt!ExpAllocateHandleTableEntry+0x165
aaedbbb8 805bc45a e254b528 aaedbbec 00000000 nt!ExCreateHandle+0x19
aaedbbfc 805c1974 881fc540 001f0003 00000001 nt!ObpCreateUnnamedHandle+0x11a
aaedbcf0 80612fad 881fc540 00000000 001f0003 nt!ObInsertObject+0xb4
aaedbd48 8054086c 0075f5e0 001f0003 00000000 nt!NtCreateSemaphore+0xb5
aaedbd48 7c90eb94 0075f5e0 001f0003 00000000 nt!KiFastCallEntry+0xfc
WARNING: Frame IP not in any known module. Following frames may be wrong.
0075f5e4 00000000 00000000 00000000 00000000 0x7c90eb94

STACK_COMMAND: kb

FOLLOWUP_IP:
nt!ExpAllocateHandleTableEntry+165
8060bfe1 8b4804 mov ecx,dword ptr [eax+4]

SYMBOL_STACK_INDEX: 0

SYMBOL_NAME: nt!ExpAllocateHandleTableEntry+165

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nt

IMAGE_NAME: ntkrpamp.exe

DEBUG_FLR_IMAGE_TIMESTAMP: 45e53f9d

FAILURE_BUCKET_ID: 0x8E_nt!ExpAllocateHandleTableEntry+165

BUCKET_ID: 0x8E_nt!ExpAllocateHandleTableEntry+165

Followup: MachineOwner
---------

0: kd> lmvm nt
start end module name
804d7000 806e2000 nt # (pdb symbols) c:\debug\ntkrpamp.pdb\966DF78E558F483199141B029DF5A9D51\ntkrpamp.pdb
Loaded symbol image file: ntkrpamp.exe
Mapped memory image file: c:\debug\ntkrpamp.exe\45E53F9D20b000\ntkrpamp.exe
Image path: ntkrpamp.exe
Image name: ntkrpamp.exe
Timestamp: Wed Feb 28 01:38:53 2007 (45E53F9D)
CheckSum: 001F873F
ImageSize: 0020B000
File version: 5.1.2600.3093
Product version: 5.1.2600.3093
File flags: 0 (Mask 3F)
File OS: 40004 NT Win32
File type: 1.0 App
File date: 00000000.00000000
Translations: 0415.04b0
CompanyName: Microsoft Corporation
ProductName: System operacyjny Microsoft® Windows®
InternalName: ntkrpamp.exe
OriginalFilename: ntkrpamp.exe
ProductVersion: 5.1.2600.3093
FileVersion: 5.1.2600.3093 (xpsp_sp2_gdr.070227-2254)
FileDescription: Jdro i system NT
LegalCopyright: © Microsoft Corporation. Wszelkie prawa zastrze|one.

You have a problem with the memory.

One of those 2 memory sticks could be damaged.

Please try this:
- Remove one of the Crucial Ballistix RAM Sticks so you will have only one stick at the DDR Slot 1
- If you still having BSOD, try with the other stick.

If one of those sticks is the problem, you should buy a new one.

ASKER

Microsoft (R) Windows Debugger Version 6.8.0004.0 X86
Copyright (c) Microsoft Corporation. All rights reserved.

Loading Dump File [C:\WINDOWS\Minidump\Mini041708-02.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\debug*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows XP Kernel Version 2600 (Service Pack 2) MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 2600.xpsp_sp2_gdr.070227-2254
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055c700
Debug session time: Thu Apr 17 14:15:02.000 2008 (GMT-6)
System Uptime: 0 days 3:43:34.715
Loading Kernel Symbols
......................................................................................................................................
Loading User Symbols
Loading unloaded module list
...........
Unable to load image mfehidk.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for mfehidk.sys
*** ERROR: Module load completed but symbols could not be loaded for mfehidk.sys
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 100000D1, {e8804e0b, 2, 8, e8804e0b}

Probably caused by : mfehidk.sys ( mfehidk+cfa5 )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: e8804e0b, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000008, value 0 = read operation, 1 = write operation
Arg4: e8804e0b, address which referenced memory

Debugging Details:
------------------

READ_ADDRESS: e8804e0b

CURRENT_IRQL: 2

FAULTING_IP:
+ffffffffe8804e0b
e8804e0b ?? ???

CUSTOMER_CRASH_COUNT: 2

DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: 0xD1

PROCESS_NAME: csrss.exe

LAST_CONTROL_TRANSFER: from a4ed0fa5 to e8804e0b

FAILED_INSTRUCTION_ADDRESS:
+ffffffffe8804e0b
e8804e0b ?? ???

STACK_TEXT:
WARNING: Frame IP not in any known module. Following frames may be wrong.
b0050c98 a4ed0fa5 b0050ce8 b0050d64 88f6f020 0xe8804e0b
b0050cd0 a4ed43ed a4ed408b b0050ce8 00000000 mfehidk+0xcfa5
b0050cf0 a4ed44bc 000003c4 88f6f020 b0050d64 mfehidk+0x103ed
b0050d34 8054086c 00000980 ffffffff 0052f7fc mfehidk+0x104bc
b0050d34 7c90eb94 00000980 ffffffff 0052f7fc nt!KiFastCallEntry+0xfc
0052f7e8 00000000 00000000 00000000 00000000 0x7c90eb94

STACK_COMMAND: kb

FOLLOWUP_IP:
mfehidk+cfa5
a4ed0fa5 ?? ???

SYMBOL_STACK_INDEX: 1

SYMBOL_NAME: mfehidk+cfa5

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: mfehidk

IMAGE_NAME: mfehidk.sys

DEBUG_FLR_IMAGE_TIMESTAMP: 477c0c14

FAILURE_BUCKET_ID: 0xD1_CODE_AV_BAD_IP_mfehidk+cfa5

BUCKET_ID: 0xD1_CODE_AV_BAD_IP_mfehidk+cfa5

Followup: MachineOwner
---------

0: kd> lmvm mfehidk
start end module name
a4ec4000 a4eec340 mfehidk T (no symbols)
Loaded symbol image file: mfehidk.sys
Image path: mfehidk.sys
Image name: mfehidk.sys
Timestamp: Wed Jan 02 15:11:32 2008 (477C0C14)
CheckSum: 0002C52D
ImageSize: 00028340
Translations: 0000.04b0 0000.04e0 0409.04b0 0409.04e0

ASKER

Microsoft (R) Windows Debugger Version 6.8.0004.0 X86
Copyright (c) Microsoft Corporation. All rights reserved.

Loading Dump File [C:\WINDOWS\Minidump\Mini041808-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\debug*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows XP Kernel Version 2600 (Service Pack 2) MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 2600.xpsp_sp2_gdr.070227-2254
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055c700
Debug session time: Fri Apr 18 00:52:45.546 2008 (GMT-6)
System Uptime: 0 days 4:02:40.281
Loading Kernel Symbols
................................................................................................................................
Loading User Symbols
Loading unloaded module list
............
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1000007E, {c0000005, 8060bfe1, ba3829b0, ba3826ac}

Probably caused by : NDIS.sys ( NDIS!ndisWorkerThread+4b )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

SYSTEM_THREAD_EXCEPTION_NOT_HANDLED_M (1000007e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003. This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG. This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG. This will let us see why this breakpoint is
happening.
Arguments:
Arg1: c0000005, The exception code that was not handled
Arg2: 8060bfe1, The address that the exception occurred at
Arg3: ba3829b0, Exception Record Address
Arg4: ba3826ac, Context Record Address

Debugging Details:
------------------

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx". The memory could not be "%s".

FAULTING_IP:
nt!ExpAllocateHandleTableEntry+165
8060bfe1 8b4804 mov ecx,dword ptr [eax+4]

EXCEPTION_RECORD: ba3829b0 -- (.exr 0xffffffffba3829b0)
ExceptionAddress: 8060bfe1 (nt!ExpAllocateHandleTableEntry+0x00000165)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 00000000
Parameter[1]: 00000fe8
Attempt to read from address 00000fe8

CONTEXT: ba3826ac -- (.cxr 0xffffffffba3826ac)
eax=00000fe4 ebx=00000d00 ecx=00000000 edx=e1002ec8 esi=e1002ea4 edi=89dc3b58
eip=8060bfe1 esp=ba382a78 ebp=ba382a94 iopl=0 nv up ei pl zr na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010246
nt!ExpAllocateHandleTableEntry+0x165:
8060bfe1 8b4804 mov ecx,dword ptr [eax+4] ds:0023:00000fe8=????????
Resetting default scope

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: DRIVER_FAULT

PROCESS_NAME: System

ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx". The memory could not be "%s".

READ_ADDRESS: 00000fe8

BUGCHECK_STR: 0x7E

LAST_CONTROL_TRANSFER: from 8060c541 to 8060bfe1

STACK_TEXT:
ba382a94 8060c541 e1002e98 ba382aac 00000000 nt!ExpAllocateHandleTableEntry+0x165
ba382ab0 805bc201 e1002e98 ba382ae4 00000000 nt!ExCreateHandle+0x19
ba382afc 805c1bca 00000000 885b0b00 00000000 nt!ObpCreateHandle+0x39f
ba382bfc 805cef82 885b0b00 ba382c28 00000000 nt!ObInsertObject+0x30a
ba382d4c 805cfa15 ba382db4 001f03ff 00000000 nt!PspCreateThread+0x5d0
ba382d80 ba52ebd8 ba382db4 001f03ff 00000000 nt!PsCreateSystemThread+0x33
ba382dac 805ce84c 00000d00 00000000 00000000 NDIS!ndisWorkerThread+0x4b
ba382ddc 8054532e ba52eb85 00000000 00000000 nt!PspSystemThreadStartup+0x34
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16

FOLLOWUP_IP:
NDIS!ndisWorkerThread+4b
ba52ebd8 85c0 test eax,eax

SYMBOL_STACK_INDEX: 6

SYMBOL_NAME: NDIS!ndisWorkerThread+4b

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: NDIS

IMAGE_NAME: NDIS.sys

DEBUG_FLR_IMAGE_TIMESTAMP: 41107ec3

STACK_COMMAND: .cxr 0xffffffffba3826ac ; kb

FAILURE_BUCKET_ID: 0x7E_NDIS!ndisWorkerThread+4b

BUCKET_ID: 0x7E_NDIS!ndisWorkerThread+4b

Followup: MachineOwner
---------

0: kd> lmvm NDIS
start end module name
ba528000 ba554a80 NDIS (pdb symbols) c:\debug\ndis.pdb\42ED3DC0817A4246B157736BBAF668742\ndis.pdb
Loaded symbol image file: NDIS.sys
Mapped memory image file: c:\debug\NDIS.sys\41107EC32ca80\NDIS.sys
Image path: NDIS.sys
Image name: NDIS.sys
Timestamp: Wed Aug 04 00:14:27 2004 (41107EC3)
CheckSum: 0003996E
ImageSize: 0002CA80
File version: 5.1.2600.2180
Product version: 5.1.2600.2180
File flags: 0 (Mask 3F)
File OS: 40004 NT Win32
File type: 3.6 Driver
File date: 00000000.00000000
Translations: 0409.04b0
CompanyName: Microsoft Corporation
ProductName: Microsoft® Windows® Operating System
InternalName: NDIS.SYS
OriginalFilename: NDIS.SYS
ProductVersion: 5.1.2600.2180
FileVersion: 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
FileDescription: NDIS 5.1 wrapper driver
LegalCopyright: © Microsoft Corporation. All rights reserved.

ASKER

Microsoft (R) Windows Debugger Version 6.8.0004.0 X86
Copyright (c) Microsoft Corporation. All rights reserved.

Loading Dump File [C:\WINDOWS\Minidump\Mini041808-02.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\debug*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows XP Kernel Version 2600 (Service Pack 2) MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 2600.xpsp_sp2_gdr.070227-2254
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055c700
Debug session time: Fri Apr 18 19:35:13.140 2008 (GMT-6)
System Uptime: 0 days 9:00:54.852
Loading Kernel Symbols
................................................................................................................................
Loading User Symbols
Loading unloaded module list
...................
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 4E, {99, d581, 0, 0}

Probably caused by : memory_corruption ( nt!MiDecrementShareCount+3a )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

PFN_LIST_CORRUPT (4e)
Typically caused by drivers passing bad memory descriptor lists (ie: calling
MmUnlockPages twice with the same list, etc). If a kernel debugger is
available get the stack trace.
Arguments:
Arg1: 00000099, A PTE or PFN is corrupt
Arg2: 0000d581, page frame number
Arg3: 00000000, current page state
Arg4: 00000000, 0

Debugging Details:
------------------

BUGCHECK_STR: 0x4E_99

CUSTOMER_CRASH_COUNT: 2

DEFAULT_BUCKET_ID: DRIVER_FAULT

PROCESS_NAME: GoogleUpdaterSe

LAST_CONTROL_TRANSFER: from 805220a8 to 804f9deb

STACK_TEXT:
a7629bc0 805220a8 0000004e 00000099 0000d581 nt!KeBugCheckEx+0x1b
a7629bf0 80510d0b c0883db8 0000002f 88fa6d90 nt!MiDecrementShareCount+0x3a
a7629c14 805aeccb 7c92a101 88fa6b98 007ffff8 nt!MiDeleteValidAddress+0xf7
a7629c34 8051282d 88fa6b98 88fa6cd0 88fa6b98 nt!MiDeleteAddressesInWorkingSet+0x65
a7629c68 805d0f8d 00fa6b98 8925d138 c0000005 nt!MmCleanProcessAddressSpace+0x193
a7629cf0 805d1071 c0000005 a7629d4c 804fee65 nt!PspExitThread+0x621
a7629cfc 804fee65 8925d138 a7629d48 a7629d3c nt!PsExitSpecialApc+0x23
a7629d4c 805408d7 00000001 00000000 a7629d64 nt!KiDeliverApc+0x1af
a7629d4c 7c90eb94 00000001 00000000 a7629d64 nt!KiServiceExit+0x59
WARNING: Frame IP not in any known module. Following frames may be wrong.
00bcffb4 00000000 00000000 00000000 00000000 0x7c90eb94

STACK_COMMAND: kb

FOLLOWUP_IP:
nt!MiDecrementShareCount+3a
805220a8 ff4e08 dec dword ptr [esi+8]

SYMBOL_STACK_INDEX: 1

SYMBOL_NAME: nt!MiDecrementShareCount+3a

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nt

DEBUG_FLR_IMAGE_TIMESTAMP: 45e53f9d

IMAGE_NAME: memory_corruption

FAILURE_BUCKET_ID: 0x4E_99_nt!MiDecrementShareCount+3a

BUCKET_ID: 0x4E_99_nt!MiDecrementShareCount+3a

Followup: MachineOwner
---------

0: kd> lmvm nt
start end module name
804d7000 806e2000 nt # (pdb symbols) c:\debug\ntkrpamp.pdb\966DF78E558F483199141B029DF5A9D51\ntkrpamp.pdb
Loaded symbol image file: ntkrpamp.exe
Mapped memory image file: c:\debug\ntkrpamp.exe\45E53F9D20b000\ntkrpamp.exe
Image path: ntkrpamp.exe
Image name: ntkrpamp.exe
Timestamp: Wed Feb 28 01:38:53 2007 (45E53F9D)
CheckSum: 001F873F
ImageSize: 0020B000
File version: 5.1.2600.3093
Product version: 5.1.2600.3093
File flags: 0 (Mask 3F)
File OS: 40004 NT Win32
File type: 1.0 App
File date: 00000000.00000000
Translations: 0415.04b0
CompanyName: Microsoft Corporation
ProductName: System operacyjny Microsoft® Windows®
InternalName: ntkrpamp.exe
OriginalFilename: ntkrpamp.exe
ProductVersion: 5.1.2600.3093
FileVersion: 5.1.2600.3093 (xpsp_sp2_gdr.070227-2254)
FileDescription: Jdro i system NT
LegalCopyright: © Microsoft Corporation. Wszelkie prawa zastrze|one.

ASKER

Microsoft (R) Windows Debugger Version 6.8.0004.0 X86
Copyright (c) Microsoft Corporation. All rights reserved.

Loading Dump File [C:\WINDOWS\Minidump\Mini041808-03.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\debug*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows XP Kernel Version 2600 (Service Pack 2) MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 2600.xpsp_sp2_gdr.070227-2254
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055c700
Debug session time: Fri Apr 18 21:15:47.968 2008 (GMT-6)
System Uptime: 0 days 1:31:36.547
Loading Kernel Symbols
.................................................................................................................................
Loading User Symbols
Loading unloaded module list
...........
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 100000D1, {a6720940, 2, 0, bab0c939}

Probably caused by : memory_corruption

Followup: memory_corruption
---------

0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: a6720940, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000000, value 0 = read operation, 1 = write operation
Arg4: bab0c939, address which referenced memory

Debugging Details:
------------------

READ_ADDRESS: a6720940

CURRENT_IRQL: 2

FAULTING_IP:
nic1394!nicQueryInformation+58f
bab0c939 f3a5 rep movs dword ptr es:[edi],dword ptr [esi]

CUSTOMER_CRASH_COUNT: 3

DEFAULT_BUCKET_ID: CODE_CORRUPTION

BUGCHECK_STR: 0xD1

PROCESS_NAME: System

LAST_CONTROL_TRANSFER: from bab0cbfd to bab0c939

STACK_TEXT:
a8720cdc bab0cbfd 89d91010 00000000 bace7c6c nic1394!nicQueryInformation+0x58f
a8720cf4 ba541305 89d91010 00000000 bace7c6c nic1394!NicMpCoRequest+0x51
a8720d14 ba54126c 00000001 8933f8a8 00000000 NDIS!ndisMDispatchRequest+0x13a
a8720d2c ba5413b0 8933f8a8 bace7c68 88f76250 NDIS!ndisMQueryInformation+0x2ad
a8720d58 ba53da01 88f76250 8933f8a8 bace7c6c NDIS!ndisMDoRequests+0x3ba
a8720d74 ba541416 88f76250 bace7c6c 885cf3a0 NDIS!ndisMRequest+0xfc
a8720d98 ba52ebaa 885cf388 00000000 8845c020 NDIS!ndisMRundownRequests+0x32
a8720dac 805ce84c 885cf390 00000000 00000000 NDIS!ndisWorkerThread+0x75
a8720ddc 8054532e ba52eb85 885cf390 00000000 nt!PspSystemThreadStartup+0x34
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16

STACK_COMMAND: kb

CHKIMG_EXTENSION: !chkimg -lo 50 -d !nic1394
bab0c40a - nic1394!nicQueryInformation+60
[ ff:fd ]
1 error : !nic1394 (bab0c40a)

MODULE_NAME: memory_corruption

IMAGE_NAME: memory_corruption

FOLLOWUP_NAME: memory_corruption

DEBUG_FLR_IMAGE_TIMESTAMP: 0

MEMORY_CORRUPTOR: ONE_BIT

FAILURE_BUCKET_ID: MEMORY_CORRUPTION_ONE_BIT

BUCKET_ID: MEMORY_CORRUPTION_ONE_BIT

Followup: memory_corruption
---------

0: kd> lmvm memory_corruption
start end module name

ASKER

I have run a number of tests on the memory using TuffTest and Windows Memory Diagnostic from boot disks and using Sandra Lite XII.SP1 and BurnInTest within Windows and never get an error. What is the chance that the motherboard is bad in some way?

download http://www.ultimatebootcd.com

run the memtest on the CD

also test your hard drive. You can located one of the diagnostics here once you know what model hard drive you have
http://www.tacktech.com/display.cfm?ttid=287

I think it will be quicker to test removing and switching memory sticks.
And it's possible that you get a BSOD caused by the memory and not getting any error from memtest.

Also try using only 1 hard disk drive, without using raid.

Do you have A McAfee product installed and a program called Daemon Tools by chance ?

https://knowledge.mcafee.com/article/529/KB47537_f.SAL_Public.html

What devices trigger this on the usbport ?

ASKER

Keep in mind that my primary OS drive is a RAID 1 configuration on Intel ICH9R RAID chip.

Also are you using IPX protocols on your network card ?
http://support.microsoft.com/kb/818326

What type of network card do you have and what driver version ?

ASKER

I do not use IPX. The card is a Realtek RTL8168/8111 PCI-E Gigabit Ethernet NIC with driver version 5.686.103.2008.

Looking through everything I see several network based items as the cause of the error

nic1394!
PROCESS_NAME: GoogleUpdaterSe - googleupdate service
NDIS.sys

What do you have for network adapters, network services, programs, security apps etc.. basically what is all being loaded that is network or internet based ?

ASKER

I had McAfee VirusScan Enterprise 8.5i installed with no patches. I found information about potential problems between the McAfee product and an Intell Dual Core processor and Daemon Tools. I installed patch 5 for the Antivirus product which should have solved both problems, but I continued to get BSOD's. I completely uninstalled McAfee and continued to get BSOD's. Daemon Tools have never been installed by me, unless they are somehow included in another product that is installed. The only programs that could have something like that included that I do not know about would be the Sandra Lite XII.SP1, BurnInTest, or Acronis True Image Home 11.

IS this computer a home computer or a in a corporate environment ?

Try downloading the most recent realtek driver

http://www.realtek.com.tw/downloads/downloadsView.aspx?Langid=1&PNid=13&PFid=5&Level=5&Conn=4&DownTypeID=3&GetDown=false

Do you find it happening when doing network based things ? What exactly is being plugged into the USB ports ? Jump drives or what ? Have you tried updating the MOBO drivers ?

ASKER

There is a 1394 Adapter, the Realtek adapter, LogMeIn Free Edition, apparently the Google Updater Service, Acronis True Image Backup Archive Explorer software device. I had a Linksys WUSB54G v1 attached that the customer uses at his home, but it is not currently connected. I have gotten BSOD's with it connected and without it connected. I am not sure if there is anything else. The computer will BSOD when it sits idle with nothing open after several hours.

It could be memory problems but you have said you have tried the tests and they pass...

Looking at your errors at least 3 of them point to network based items, updating the driver for the realtek, if your not using the 1394 adapter you could remove that or disable it. The Linksys USB wireless adapter could very well be part of the issue too. If that is the model that is a little box those caused a lot of issues. I had one myself I gave up with it because of all the problems it caused.

One way to test for errors would be update the realtek card, disable the 1394 driver check for the Linksys USB in device manager or under your program files either disable it or uninstall it. Disconnect any network cable attached to this PC and then try plugging in items into the USB since this is what tends to cause the error to come up. See if the error still continues.

you could try doing the CPU stress test on ultimatebootcd or the other stress type tests to see if they fail.

If you look in event viewer do you see any errors where a device or driver had an error or quit responding before this problem started happening regullarly ...

ASKER

Well, last night it did another BSOD as I was about to post a pdf of the computer's setup as of last night. Since then, I have restored back to an image from Acronis from a couple of weeks ago so the software has changed a bit. I am still running the latest drivers for everything that I am aware of. I have not reattached the Linksys WUSB54G for now. I am attaching a pdf showing the Belarc profile of how the computer is setup as of right now. I am going to watch the computer to see if a BSOD happens again. McAfee Enterprise 8.5i is back on but with Patch 5 installed.

This is a computer that will operate in a home environment.
Belarc-Advisor.pdf

ASKER

P.S. - I also ran the MS Windows Memory Diagnostic Tool again this morning for about an hour continuously and never received one error.

ASKER

Thanks for all of the help. I was finally able to solve the problem.

ASKER CERTIFIED SOLUTION

membership

This solution is only available to members.

To access this solution, you must be a member of Experts Exchange.

Start Free Trial