Gigabyte P35-DS4
Intel E6750
2 sticks 1 GB Crucial Ballistix RAM
Gigabyte GeForce 8400GS
--------------------------
I built this computer for a customer a few months ago. After running fine for a couple months, the computer started crashing randomly and rebooting. It would usually get into a reboot "loop" and corrupt the RAID 1 operating system drive.
I have set the computer to not reboot automatically on a crash and have captured several minidumps, but I cannot pinpoint the trouble. I have tested all of the hardware as well as I know how. The trouble seems to occur only after plugging a device into the onboard USB ports, but I am not sure as the cause of the crash appears to be different each time.
I have never had this type of problem before and am stuck. Any help is greatly appreciated! I have 6 minidump files that I can send.
This Question has been solved and asker verified All Experts Exchange premium technology solutions are available to subscription members.
Experts Exchange has been collecting answers to technology questions since 1996…3 million and counting! If you have a question, chances are we already have your answer.
If you can't find the exact answer you're looking for, ask our exclusive community of 50,000 experts. You’ll get a personalized answer from a trusted professional.
Thousands of free tech tips, tricks, how-to’s and tutorials are available in our peer reviewed articles section. See for yourself how smart our experts are, no login required.
Save solutions to your questions, answers you’ve discovered through searching plus helpful articles in your personal knowledgebase for easy future access.
Access the answers to your technology questions today.
30-day free trial. Register in 60 seconds.
Members of the expert community talk about why the experience at Experts Exchange is different than what you will find anywhere else.
Try it out and discover for yourself.
30-day free trial. Register in 60 seconds.
Join the community of experts here and help other tech pros by answering question in your area of expertise. You can earn FREE access to all Experts Exchange's premium features and resources.
You should try to use that computer with another hard disk drive.
If you are using SATA RAID, unplug all hard drives except the one has windows installed, and test if you are not having any BSOD.
If that doesn't work, the problem is very possible to be caused by the RAM, please remove 1 of the memory Sticks, so you are nos doing any Dual Channel.
Microsoft (R) Windows Debugger Version 6.8.0004.0 X86
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [C:\WINDOWS\Minidump\Mini0
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\debug*http://msdl.m
Executable search path is:
Windows XP Kernel Version 2600 (Service Pack 2) MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 2600.xpsp_sp2_gdr.070227-2
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055c700
Debug session time: Fri Apr 11 01:55:08.156 2008 (GMT-6)
System Uptime: 0 days 0:25:38.864
Loading Kernel Symbols
..........................
Loading User Symbols
Loading unloaded module list
.........
Unable to load image mfeavfk.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for mfeavfk.sys
*** ERROR: Module load completed but symbols could not be loaded for mfeavfk.sys
**************************
* *
* Bugcheck Analysis *
* *
**************************
Use !analyze -v to get detailed debugging information.
BugCheck 100000C5, {a050051, 2, 0, 8054afcb}
*** WARNING: Unable to verify timestamp for mfehidk.sys
*** ERROR: Module load completed but symbols could not be loaded for mfehidk.sys
Probably caused by : mfeavfk.sys ( mfeavfk+7864 )
Followup: MachineOwner
---------
0: kd> !analyze -v
**************************
* *
* Bugcheck Analysis *
* *
**************************
DRIVER_CORRUPTED_EXPOOL (c5)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is
caused by drivers that have corrupted the system pool. Run the driver
verifier against any new (or suspect) drivers, and if that doesn't turn up
the culprit, then use gflags to enable special pool.
Arguments:
Arg1: 0a050051, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000000, value 0 = read operation, 1 = write operation
Arg4: 8054afcb, address which referenced memory
Debugging Details:
------------------
BUGCHECK_STR: 0xC5_2
CURRENT_IRQL: 2
FAULTING_IP:
nt!ExAllocatePoolWithTag+6
8054afcb 8b06 mov eax,dword ptr [esi]
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: DRIVER_FAULT
PROCESS_NAME: iexplore.exe
LAST_CONTROL_TRANSFER: from a5b55864 to 8054afcb
STACK_TEXT:
a58f39d0 a5b55864 00000000 00000001 3045464d nt!ExAllocatePoolWithTag+0
WARNING: Stack unwind information not available. Following frames may be wrong.
a58f39e4 a5b515bf 0000034c a5b5a984 00000000 mfeavfk+0x7864
a58f3a7c a5b4fcfa 88134210 a58f3b34 00000000 mfeavfk+0x35bf
a58f3b04 a5a37660 00000000 a58f3b34 00000000 mfeavfk+0x1cfa
a58f3b20 a5a330cf a58f3b34 88670690 8815d5e0 mfehidk+0xb660
a58f3b98 a5a332de 8815d3c0 89324cd8 a58f3bbc mfehidk+0x70cf
a58f3c2c a5a40bd9 89324cd8 8815d3c0 a58f3c64 mfehidk+0x72de
a58f3c3c a5a40c29 a58f3c4c 88f2fbd8 88b30c70 mfehidk+0x14bd9
a58f3c64 804ef095 88b30c70 8815d3c0 8815d3c0 mfehidk+0x14c29
a58f3c74 805826c7 89324cc0 89e62900 00000001 nt!IopfCallDriver+0x31
a58f3ca4 805bb459 8826eda0 88b30c70 00120196 nt!IopCloseFile+0x26b
a58f3cd4 805badab 8826eda0 01324cc0 89e62900 nt!ObpDecrementHandleCount
a58f3cfc 805bae49 e187d720 89324cd8 00001ca8 nt!ObpCloseHandleTableEntr
a58f3d44 805baf81 00001ca8 00000001 00000000 nt!ObpCloseHandle+0x87
a58f3d58 8054086c 00001ca8 13dff540 7c90eb94 nt!NtClose+0x1d
a58f3d58 7c90eb94 00001ca8 13dff540 7c90eb94 nt!KiFastCallEntry+0xfc
13dff540 00000000 00000000 00000000 00000000 0x7c90eb94
STACK_COMMAND: kb
FOLLOWUP_IP:
mfeavfk+7864
a5b55864 ?? ???
SYMBOL_STACK_INDEX: 1
SYMBOL_NAME: mfeavfk+7864
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: mfeavfk
IMAGE_NAME: mfeavfk.sys
DEBUG_FLR_IMAGE_TIMESTAMP:
FAILURE_BUCKET_ID: 0xC5_2_mfeavfk+7864
BUCKET_ID: 0xC5_2_mfeavfk+7864
Followup: MachineOwner
---------
0: kd> lmvm mfeavfk
start end module name
a5b4e000 a5b5df00 mfeavfk T (no symbols)
Loaded symbol image file: mfeavfk.sys
Image path: mfeavfk.sys
Image name: mfeavfk.sys
Timestamp: Wed Nov 22 15:55:05 2006 (4564D549)
CheckSum: 000137D5
ImageSize: 0000FF00
Translations: 0000.04b0 0000.04e0 0409.04b0 0409.04e0
Microsoft (R) Windows Debugger Version 6.8.0004.0 X86
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [C:\WINDOWS\Minidump\Mini0
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\debug*http://msdl.m
Executable search path is:
Windows XP Kernel Version 2600 (Service Pack 2) MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 2600.xpsp_sp2_gdr.070227-2
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055c700
Debug session time: Fri Apr 11 04:48:05.593 2008 (GMT-6)
System Uptime: 0 days 0:51:58.312
Loading Kernel Symbols
..........................
Loading User Symbols
Loading unloaded module list
............
**************************
* *
* Bugcheck Analysis *
* *
**************************
Use !analyze -v to get detailed debugging information.
BugCheck 1000000A, {c95b5e6f, 2, 0, 8050d7db}
Probably caused by : memory_corruption
Followup: memory_corruption
---------
1: kd> !analyze -v
**************************
* *
* Bugcheck Analysis *
* *
**************************
IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: c95b5e6f, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000000, bitfield :
bit 0 : value 0 = read operation, 1 = write operation
bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: 8050d7db, address which referenced memory
Debugging Details:
------------------
READ_ADDRESS: c95b5e6f
CURRENT_IRQL: 2
FAULTING_IP:
nt!MiGatherPagefilePages+3
8050d7db 8b865f5e5bc9 mov eax,dword ptr [esi-36A4A1A1h]
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: CODE_CORRUPTION
BUGCHECK_STR: 0xA
PROCESS_NAME: System
LAST_CONTROL_TRANSFER: from 8050daba to 8050d7db
STACK_TEXT:
bad1fd3c 8050daba 819c0654 000142d6 00000014 nt!MiGatherPagefilePages+0
bad1fd74 8064c321 00000000 89dae790 00000000 nt!MiModifiedPageWriterWor
bad1fdac 805ce84c 00000000 00000000 00000000 nt!MiModifiedPageWriter+0x
bad1fddc 8054532e 8064c1bc 00000000 00000000 nt!PspSystemThreadStartup+
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16
STACK_COMMAND: kb
CHKIMG_EXTENSION: !chkimg -lo 50 -d !nt
8050d7dc - nt!MiGatherPagefilePages+3
[ c6:86 ]
1 error : !nt (8050d7dc)
MODULE_NAME: memory_corruption
IMAGE_NAME: memory_corruption
FOLLOWUP_NAME: memory_corruption
DEBUG_FLR_IMAGE_TIMESTAMP:
MEMORY_CORRUPTOR: ONE_BIT
FAILURE_BUCKET_ID: MEMORY_CORRUPTION_ONE_BIT
BUCKET_ID: MEMORY_CORRUPTION_ONE_BIT
Followup: memory_corruption
---------
1: kd> lmvm memory_corruption
start end module name
Microsoft (R) Windows Debugger Version 6.8.0004.0 X86
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [C:\WINDOWS\Minidump\Mini0
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\debug*http://msdl.m
Executable search path is:
Windows XP Kernel Version 2600 (Service Pack 2) MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 2600.xpsp_sp2_gdr.070227-2
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055c700
Debug session time: Thu Apr 17 03:55:27.609 2008 (GMT-6)
System Uptime: 0 days 5:32:11.317
Loading Kernel Symbols
..........................
Loading User Symbols
Loading unloaded module list
.............
**************************
* *
* Bugcheck Analysis *
* *
**************************
Use !analyze -v to get detailed debugging information.
BugCheck 1000008E, {c0000005, 8060bfe1, aaedbb0c, 0}
Probably caused by : ntkrpamp.exe ( nt!ExpAllocateHandleTableE
Followup: MachineOwner
---------
0: kd> !analyze -v
**************************
* *
* Bugcheck Analysis *
* *
**************************
KERNEL_MODE_EXCEPTION_NOT_
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003. This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG. This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG. This will let us see why this breakpoint is
happening.
Arguments:
Arg1: c0000005, The exception code that was not handled
Arg2: 8060bfe1, The address that the exception occurred at
Arg3: aaedbb0c, Trap Frame
Arg4: 00000000
Debugging Details:
------------------
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx". The memory could not be "%s".
FAULTING_IP:
nt!ExpAllocateHandleTableE
8060bfe1 8b4804 mov ecx,dword ptr [eax+4]
TRAP_FRAME: aaedbb0c -- (.trap 0xffffffffaaedbb0c)
ErrCode = 00000000
eax=00000000 ebx=001f0003 ecx=00000000 edx=e254b558 esi=e254b534 edi=88eb1908
eip=8060bfe1 esp=aaedbb80 ebp=aaedbb9c iopl=0 nv up ei pl zr na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010246
nt!ExpAllocateHandleTableE
8060bfe1 8b4804 mov ecx,dword ptr [eax+4] ds:0023:00000004=????????
Resetting default scope
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: DRIVER_FAULT
BUGCHECK_STR: 0x8E
PROCESS_NAME: ppped.exe
LAST_CONTROL_TRANSFER: from 8060c541 to 8060bfe1
STACK_TEXT:
aaedbb9c 8060c541 e254b528 aaedbbb4 001f0003 nt!ExpAllocateHandleTableE
aaedbbb8 805bc45a e254b528 aaedbbec 00000000 nt!ExCreateHandle+0x19
aaedbbfc 805c1974 881fc540 001f0003 00000001 nt!ObpCreateUnnamedHandle+
aaedbcf0 80612fad 881fc540 00000000 001f0003 nt!ObInsertObject+0xb4
aaedbd48 8054086c 0075f5e0 001f0003 00000000 nt!NtCreateSemaphore+0xb5
aaedbd48 7c90eb94 0075f5e0 001f0003 00000000 nt!KiFastCallEntry+0xfc
WARNING: Frame IP not in any known module. Following frames may be wrong.
0075f5e4 00000000 00000000 00000000 00000000 0x7c90eb94
STACK_COMMAND: kb
FOLLOWUP_IP:
nt!ExpAllocateHandleTableE
8060bfe1 8b4804 mov ecx,dword ptr [eax+4]
SYMBOL_STACK_INDEX: 0
SYMBOL_NAME: nt!ExpAllocateHandleTableE
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrpamp.exe
DEBUG_FLR_IMAGE_TIMESTAMP:
FAILURE_BUCKET_ID: 0x8E_nt!ExpAllocateHandleT
BUCKET_ID: 0x8E_nt!ExpAllocateHandleT
Followup: MachineOwner
---------
0: kd> lmvm nt
start end module name
804d7000 806e2000 nt # (pdb symbols) c:\debug\ntkrpamp.pdb\966D
Loaded symbol image file: ntkrpamp.exe
Mapped memory image file: c:\debug\ntkrpamp.exe\45E5
Image path: ntkrpamp.exe
Image name: ntkrpamp.exe
Timestamp: Wed Feb 28 01:38:53 2007 (45E53F9D)
CheckSum: 001F873F
ImageSize: 0020B000
File version: 5.1.2600.3093
Product version: 5.1.2600.3093
File flags: 0 (Mask 3F)
File OS: 40004 NT Win32
File type: 1.0 App
File date: 00000000.00000000
Translations: 0415.04b0
CompanyName: Microsoft Corporation
ProductName: System operacyjny Microsoft® Windows®
InternalName: ntkrpamp.exe
OriginalFilename: ntkrpamp.exe
ProductVersion: 5.1.2600.3093
FileVersion: 5.1.2600.3093 (xpsp_sp2_gdr.070227-2254)
FileDescription: Jdro i system NT
LegalCopyright: © Microsoft Corporation. Wszelkie prawa zastrze|one.
You have a problem with the memory.
One of those 2 memory sticks could be damaged.
Please try this:
- Remove one of the Crucial Ballistix RAM Sticks so you will have only one stick at the DDR Slot 1
- If you still having BSOD, try with the other stick.
If one of those sticks is the problem, you should buy a new one.
Microsoft (R) Windows Debugger Version 6.8.0004.0 X86
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [C:\WINDOWS\Minidump\Mini0
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\debug*http://msdl.m
Executable search path is:
Windows XP Kernel Version 2600 (Service Pack 2) MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 2600.xpsp_sp2_gdr.070227-2
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055c700
Debug session time: Thu Apr 17 14:15:02.000 2008 (GMT-6)
System Uptime: 0 days 3:43:34.715
Loading Kernel Symbols
..........................
Loading User Symbols
Loading unloaded module list
...........
Unable to load image mfehidk.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for mfehidk.sys
*** ERROR: Module load completed but symbols could not be loaded for mfehidk.sys
**************************
* *
* Bugcheck Analysis *
* *
**************************
Use !analyze -v to get detailed debugging information.
BugCheck 100000D1, {e8804e0b, 2, 8, e8804e0b}
Probably caused by : mfehidk.sys ( mfehidk+cfa5 )
Followup: MachineOwner
---------
0: kd> !analyze -v
**************************
* *
* Bugcheck Analysis *
* *
**************************
DRIVER_IRQL_NOT_LESS_OR_EQ
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: e8804e0b, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000008, value 0 = read operation, 1 = write operation
Arg4: e8804e0b, address which referenced memory
Debugging Details:
------------------
READ_ADDRESS: e8804e0b
CURRENT_IRQL: 2
FAULTING_IP:
+ffffffffe8804e0b
e8804e0b ?? ???
CUSTOMER_CRASH_COUNT: 2
DEFAULT_BUCKET_ID: DRIVER_FAULT
BUGCHECK_STR: 0xD1
PROCESS_NAME: csrss.exe
LAST_CONTROL_TRANSFER: from a4ed0fa5 to e8804e0b
FAILED_INSTRUCTION_ADDRESS
+ffffffffe8804e0b
e8804e0b ?? ???
STACK_TEXT:
WARNING: Frame IP not in any known module. Following frames may be wrong.
b0050c98 a4ed0fa5 b0050ce8 b0050d64 88f6f020 0xe8804e0b
b0050cd0 a4ed43ed a4ed408b b0050ce8 00000000 mfehidk+0xcfa5
b0050cf0 a4ed44bc 000003c4 88f6f020 b0050d64 mfehidk+0x103ed
b0050d34 8054086c 00000980 ffffffff 0052f7fc mfehidk+0x104bc
b0050d34 7c90eb94 00000980 ffffffff 0052f7fc nt!KiFastCallEntry+0xfc
0052f7e8 00000000 00000000 00000000 00000000 0x7c90eb94
STACK_COMMAND: kb
FOLLOWUP_IP:
mfehidk+cfa5
a4ed0fa5 ?? ???
SYMBOL_STACK_INDEX: 1
SYMBOL_NAME: mfehidk+cfa5
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: mfehidk
IMAGE_NAME: mfehidk.sys
DEBUG_FLR_IMAGE_TIMESTAMP:
FAILURE_BUCKET_ID: 0xD1_CODE_AV_BAD_IP_mfehid
BUCKET_ID: 0xD1_CODE_AV_BAD_IP_mfehid
Followup: MachineOwner
---------
0: kd> lmvm mfehidk
start end module name
a4ec4000 a4eec340 mfehidk T (no symbols)
Loaded symbol image file: mfehidk.sys
Image path: mfehidk.sys
Image name: mfehidk.sys
Timestamp: Wed Jan 02 15:11:32 2008 (477C0C14)
CheckSum: 0002C52D
ImageSize: 00028340
Translations: 0000.04b0 0000.04e0 0409.04b0 0409.04e0
Microsoft (R) Windows Debugger Version 6.8.0004.0 X86
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [C:\WINDOWS\Minidump\Mini0
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\debug*http://msdl.m
Executable search path is:
Windows XP Kernel Version 2600 (Service Pack 2) MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 2600.xpsp_sp2_gdr.070227-2
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055c700
Debug session time: Fri Apr 18 00:52:45.546 2008 (GMT-6)
System Uptime: 0 days 4:02:40.281
Loading Kernel Symbols
..........................
Loading User Symbols
Loading unloaded module list
............
**************************
* *
* Bugcheck Analysis *
* *
**************************
Use !analyze -v to get detailed debugging information.
BugCheck 1000007E, {c0000005, 8060bfe1, ba3829b0, ba3826ac}
Probably caused by : NDIS.sys ( NDIS!ndisWorkerThread+4b )
Followup: MachineOwner
---------
0: kd> !analyze -v
**************************
* *
* Bugcheck Analysis *
* *
**************************
SYSTEM_THREAD_EXCEPTION_NO
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003. This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG. This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG. This will let us see why this breakpoint is
happening.
Arguments:
Arg1: c0000005, The exception code that was not handled
Arg2: 8060bfe1, The address that the exception occurred at
Arg3: ba3829b0, Exception Record Address
Arg4: ba3826ac, Context Record Address
Debugging Details:
------------------
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx". The memory could not be "%s".
FAULTING_IP:
nt!ExpAllocateHandleTableE
8060bfe1 8b4804 mov ecx,dword ptr [eax+4]
EXCEPTION_RECORD: ba3829b0 -- (.exr 0xffffffffba3829b0)
ExceptionAddress: 8060bfe1 (nt!ExpAllocateHandleTable
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 00000000
Parameter[1]: 00000fe8
Attempt to read from address 00000fe8
CONTEXT: ba3826ac -- (.cxr 0xffffffffba3826ac)
eax=00000fe4 ebx=00000d00 ecx=00000000 edx=e1002ec8 esi=e1002ea4 edi=89dc3b58
eip=8060bfe1 esp=ba382a78 ebp=ba382a94 iopl=0 nv up ei pl zr na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010246
nt!ExpAllocateHandleTableE
8060bfe1 8b4804 mov ecx,dword ptr [eax+4] ds:0023:00000fe8=????????
Resetting default scope
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: DRIVER_FAULT
PROCESS_NAME: System
ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx". The memory could not be "%s".
READ_ADDRESS: 00000fe8
BUGCHECK_STR: 0x7E
LAST_CONTROL_TRANSFER: from 8060c541 to 8060bfe1
STACK_TEXT:
ba382a94 8060c541 e1002e98 ba382aac 00000000 nt!ExpAllocateHandleTableE
ba382ab0 805bc201 e1002e98 ba382ae4 00000000 nt!ExCreateHandle+0x19
ba382afc 805c1bca 00000000 885b0b00 00000000 nt!ObpCreateHandle+0x39f
ba382bfc 805cef82 885b0b00 ba382c28 00000000 nt!ObInsertObject+0x30a
ba382d4c 805cfa15 ba382db4 001f03ff 00000000 nt!PspCreateThread+0x5d0
ba382d80 ba52ebd8 ba382db4 001f03ff 00000000 nt!PsCreateSystemThread+0x
ba382dac 805ce84c 00000d00 00000000 00000000 NDIS!ndisWorkerThread+0x4b
ba382ddc 8054532e ba52eb85 00000000 00000000 nt!PspSystemThreadStartup+
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16
FOLLOWUP_IP:
NDIS!ndisWorkerThread+4b
ba52ebd8 85c0 test eax,eax
SYMBOL_STACK_INDEX: 6
SYMBOL_NAME: NDIS!ndisWorkerThread+4b
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: NDIS
IMAGE_NAME: NDIS.sys
DEBUG_FLR_IMAGE_TIMESTAMP:
STACK_COMMAND: .cxr 0xffffffffba3826ac ; kb
FAILURE_BUCKET_ID: 0x7E_NDIS!ndisWorkerThread
BUCKET_ID: 0x7E_NDIS!ndisWorkerThread
Followup: MachineOwner
---------
0: kd> lmvm NDIS
start end module name
ba528000 ba554a80 NDIS (pdb symbols) c:\debug\ndis.pdb\42ED3DC0
Loaded symbol image file: NDIS.sys
Mapped memory image file: c:\debug\NDIS.sys\41107EC3
Image path: NDIS.sys
Image name: NDIS.sys
Timestamp: Wed Aug 04 00:14:27 2004 (41107EC3)
CheckSum: 0003996E
ImageSize: 0002CA80
File version: 5.1.2600.2180
Product version: 5.1.2600.2180
File flags: 0 (Mask 3F)
File OS: 40004 NT Win32
File type: 3.6 Driver
File date: 00000000.00000000
Translations: 0409.04b0
CompanyName: Microsoft Corporation
ProductName: Microsoft® Windows® Operating System
InternalName: NDIS.SYS
OriginalFilename: NDIS.SYS
ProductVersion: 5.1.2600.2180
FileVersion: 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
FileDescription: NDIS 5.1 wrapper driver
LegalCopyright: © Microsoft Corporation. All rights reserved.
Microsoft (R) Windows Debugger Version 6.8.0004.0 X86
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [C:\WINDOWS\Minidump\Mini0
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\debug*http://msdl.m
Executable search path is:
Windows XP Kernel Version 2600 (Service Pack 2) MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 2600.xpsp_sp2_gdr.070227-2
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055c700
Debug session time: Fri Apr 18 19:35:13.140 2008 (GMT-6)
System Uptime: 0 days 9:00:54.852
Loading Kernel Symbols
..........................
Loading User Symbols
Loading unloaded module list
...................
**************************
* *
* Bugcheck Analysis *
* *
**************************
Use !analyze -v to get detailed debugging information.
BugCheck 4E, {99, d581, 0, 0}
Probably caused by : memory_corruption ( nt!MiDecrementShareCount+3
Followup: MachineOwner
---------
0: kd> !analyze -v
**************************
* *
* Bugcheck Analysis *
* *
**************************
PFN_LIST_CORRUPT (4e)
Typically caused by drivers passing bad memory descriptor lists (ie: calling
MmUnlockPages twice with the same list, etc). If a kernel debugger is
available get the stack trace.
Arguments:
Arg1: 00000099, A PTE or PFN is corrupt
Arg2: 0000d581, page frame number
Arg3: 00000000, current page state
Arg4: 00000000, 0
Debugging Details:
------------------
BUGCHECK_STR: 0x4E_99
CUSTOMER_CRASH_COUNT: 2
DEFAULT_BUCKET_ID: DRIVER_FAULT
PROCESS_NAME: GoogleUpdaterSe
LAST_CONTROL_TRANSFER: from 805220a8 to 804f9deb
STACK_TEXT:
a7629bc0 805220a8 0000004e 00000099 0000d581 nt!KeBugCheckEx+0x1b
a7629bf0 80510d0b c0883db8 0000002f 88fa6d90 nt!MiDecrementShareCount+0
a7629c14 805aeccb 7c92a101 88fa6b98 007ffff8 nt!MiDeleteValidAddress+0x
a7629c34 8051282d 88fa6b98 88fa6cd0 88fa6b98 nt!MiDeleteAddressesInWork
a7629c68 805d0f8d 00fa6b98 8925d138 c0000005 nt!MmCleanProcessAddressSp
a7629cf0 805d1071 c0000005 a7629d4c 804fee65 nt!PspExitThread+0x621
a7629cfc 804fee65 8925d138 a7629d48 a7629d3c nt!PsExitSpecialApc+0x23
a7629d4c 805408d7 00000001 00000000 a7629d64 nt!KiDeliverApc+0x1af
a7629d4c 7c90eb94 00000001 00000000 a7629d64 nt!KiServiceExit+0x59
WARNING: Frame IP not in any known module. Following frames may be wrong.
00bcffb4 00000000 00000000 00000000 00000000 0x7c90eb94
STACK_COMMAND: kb
FOLLOWUP_IP:
nt!MiDecrementShareCount+3
805220a8 ff4e08 dec dword ptr [esi+8]
SYMBOL_STACK_INDEX: 1
SYMBOL_NAME: nt!MiDecrementShareCount+3
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
DEBUG_FLR_IMAGE_TIMESTAMP:
IMAGE_NAME: memory_corruption
FAILURE_BUCKET_ID: 0x4E_99_nt!MiDecrementShar
BUCKET_ID: 0x4E_99_nt!MiDecrementShar
Followup: MachineOwner
---------
0: kd> lmvm nt
start end module name
804d7000 806e2000 nt # (pdb symbols) c:\debug\ntkrpamp.pdb\966D
Loaded symbol image file: ntkrpamp.exe
Mapped memory image file: c:\debug\ntkrpamp.exe\45E5
Image path: ntkrpamp.exe
Image name: ntkrpamp.exe
Timestamp: Wed Feb 28 01:38:53 2007 (45E53F9D)
CheckSum: 001F873F
ImageSize: 0020B000
File version: 5.1.2600.3093
Product version: 5.1.2600.3093
File flags: 0 (Mask 3F)
File OS: 40004 NT Win32
File type: 1.0 App
File date: 00000000.00000000
Translations: 0415.04b0
CompanyName: Microsoft Corporation
ProductName: System operacyjny Microsoft® Windows®
InternalName: ntkrpamp.exe
OriginalFilename: ntkrpamp.exe
ProductVersion: 5.1.2600.3093
FileVersion: 5.1.2600.3093 (xpsp_sp2_gdr.070227-2254)
FileDescription: Jdro i system NT
LegalCopyright: © Microsoft Corporation. Wszelkie prawa zastrze|one.
Microsoft (R) Windows Debugger Version 6.8.0004.0 X86
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [C:\WINDOWS\Minidump\Mini0
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\debug*http://msdl.m
Executable search path is:
Windows XP Kernel Version 2600 (Service Pack 2) MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 2600.xpsp_sp2_gdr.070227-2
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055c700
Debug session time: Fri Apr 18 21:15:47.968 2008 (GMT-6)
System Uptime: 0 days 1:31:36.547
Loading Kernel Symbols
..........................
Loading User Symbols
Loading unloaded module list
...........
**************************
* *
* Bugcheck Analysis *
* *
**************************
Use !analyze -v to get detailed debugging information.
BugCheck 100000D1, {a6720940, 2, 0, bab0c939}
Probably caused by : memory_corruption
Followup: memory_corruption
---------
0: kd> !analyze -v
**************************
* *
* Bugcheck Analysis *
* *
**************************
DRIVER_IRQL_NOT_LESS_OR_EQ
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: a6720940, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000000, value 0 = read operation, 1 = write operation
Arg4: bab0c939, address which referenced memory
Debugging Details:
------------------
READ_ADDRESS: a6720940
CURRENT_IRQL: 2
FAULTING_IP:
nic1394!nicQueryInformatio
bab0c939 f3a5 rep movs dword ptr es:[edi],dword ptr [esi]
CUSTOMER_CRASH_COUNT: 3
DEFAULT_BUCKET_ID: CODE_CORRUPTION
BUGCHECK_STR: 0xD1
PROCESS_NAME: System
LAST_CONTROL_TRANSFER: from bab0cbfd to bab0c939
STACK_TEXT:
a8720cdc bab0cbfd 89d91010 00000000 bace7c6c nic1394!nicQueryInformatio
a8720cf4 ba541305 89d91010 00000000 bace7c6c nic1394!NicMpCoRequest+0x5
a8720d14 ba54126c 00000001 8933f8a8 00000000 NDIS!ndisMDispatchRequest+
a8720d2c ba5413b0 8933f8a8 bace7c68 88f76250 NDIS!ndisMQueryInformation
a8720d58 ba53da01 88f76250 8933f8a8 bace7c6c NDIS!ndisMDoRequests+0x3ba
a8720d74 ba541416 88f76250 bace7c6c 885cf3a0 NDIS!ndisMRequest+0xfc
a8720d98 ba52ebaa 885cf388 00000000 8845c020 NDIS!ndisMRundownRequests+
a8720dac 805ce84c 885cf390 00000000 00000000 NDIS!ndisWorkerThread+0x75
a8720ddc 8054532e ba52eb85 885cf390 00000000 nt!PspSystemThreadStartup+
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16
STACK_COMMAND: kb
CHKIMG_EXTENSION: !chkimg -lo 50 -d !nic1394
bab0c40a - nic1394!nicQueryInformatio
[ ff:fd ]
1 error : !nic1394 (bab0c40a)
MODULE_NAME: memory_corruption
IMAGE_NAME: memory_corruption
FOLLOWUP_NAME: memory_corruption
DEBUG_FLR_IMAGE_TIMESTAMP:
MEMORY_CORRUPTOR: ONE_BIT
FAILURE_BUCKET_ID: MEMORY_CORRUPTION_ONE_BIT
BUCKET_ID: MEMORY_CORRUPTION_ONE_BIT
Followup: memory_corruption
---------
0: kd> lmvm memory_corruption
start end module name
download http://www.ultimatebootcd.
run the memtest on the CD
also test your hard drive. You can located one of the diagnostics here once you know what model hard drive you have
http://www.tacktech.com/di
Do you have A McAfee product installed and a program called Daemon Tools by chance ?
https://knowledge.mcafee.c
What devices trigger this on the usbport ?
Also are you using IPX protocols on your network card ?
http://support.microsoft.c
What type of network card do you have and what driver version ?
Looking through everything I see several network based items as the cause of the error
nic1394!
PROCESS_NAME: GoogleUpdaterSe - googleupdate service
NDIS.sys
What do you have for network adapters, network services, programs, security apps etc.. basically what is all being loaded that is network or internet based ?
I had McAfee VirusScan Enterprise 8.5i installed with no patches. I found information about potential problems between the McAfee product and an Intell Dual Core processor and Daemon Tools. I installed patch 5 for the Antivirus product which should have solved both problems, but I continued to get BSOD's. I completely uninstalled McAfee and continued to get BSOD's. Daemon Tools have never been installed by me, unless they are somehow included in another product that is installed. The only programs that could have something like that included that I do not know about would be the Sandra Lite XII.SP1, BurnInTest, or Acronis True Image Home 11.
IS this computer a home computer or a in a corporate environment ?
Try downloading the most recent realtek driver
http://www.realtek.com.tw/
There is a 1394 Adapter, the Realtek adapter, LogMeIn Free Edition, apparently the Google Updater Service, Acronis True Image Backup Archive Explorer software device. I had a Linksys WUSB54G v1 attached that the customer uses at his home, but it is not currently connected. I have gotten BSOD's with it connected and without it connected. I am not sure if there is anything else. The computer will BSOD when it sits idle with nothing open after several hours.
It could be memory problems but you have said you have tried the tests and they pass...
Looking at your errors at least 3 of them point to network based items, updating the driver for the realtek, if your not using the 1394 adapter you could remove that or disable it. The Linksys USB wireless adapter could very well be part of the issue too. If that is the model that is a little box those caused a lot of issues. I had one myself I gave up with it because of all the problems it caused.
One way to test for errors would be update the realtek card, disable the 1394 driver check for the Linksys USB in device manager or under your program files either disable it or uninstall it. Disconnect any network cable attached to this PC and then try plugging in items into the USB since this is what tends to cause the error to come up. See if the error still continues.
you could try doing the CPU stress test on ultimatebootcd or the other stress type tests to see if they fail.
If you look in event viewer do you see any errors where a device or driver had an error or quit responding before this problem started happening regullarly ...
Well, last night it did another BSOD as I was about to post a pdf of the computer's setup as of last night. Since then, I have restored back to an image from Acronis from a couple of weeks ago so the software has changed a bit. I am still running the latest drivers for everything that I am aware of. I have not reattached the Linksys WUSB54G for now. I am attaching a pdf showing the Belarc profile of how the computer is setup as of right now. I am going to watch the computer to see if a BSOD happens again. McAfee Enterprise 8.5i is back on but with Patch 5 installed.
This is a computer that will operate in a home environment.
Business Accounts
Answer for Membership
by: briancassinPosted on 2008-04-18 at 20:07:38ID: 21390995
Please post the minidumps and also post the stop error message you are getting. To stop the reboot loop upon bootup press f8 then select disable automatic restart on system failure. This will give you the exact stop error message.