?
Solved

XP crash - Blue screen - C5 (???,2,1,8053de49)

Posted on 2003-03-17
39
Medium Priority
?
4,182 Views
Last Modified: 2012-06-22
Hi,

Win XP SP1
1.5Gb
Gigabyte 7ZXE
AMD 1800+
Other hw

Amongst other utilities, running
Agnitum Outpost - firewall
Agnitum tauscan - antitrojan
Eset Nod32 - antivirus
MSN
taskinfo2003
Seti

I've also set services to here http://www.blackviper.com/WinXP/servicecfg.htm
to SAFE" Configuration

I'm getting intermittent crashes (0.25 - 5 crashes/day).
Sometimes PC crashes by itself.
Sometimes it happens when I click on a button (any program)
I've isolated the C5 crashes as these are the most common.

c5 (020A0005, 2, 1, 8053ce4b)
c5 (6b576343, 2, 1, 8053ce49)
c5 (6e66744e, 2, 1, 8053ce49)
c5 (       0, 2, 1, 8053ce49)
c5 (       0, 2, 1, 8053ce49)
c5 (    1880, 2, 1, 8053ce49)

I've d/l windows debugger & the symbol table, pointed it at the minidump, did
!analyze -v and got the following results.

-------
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck C5, {1880, 2, 1, 8053ce49}

Probably caused by : ntoskrnl.exe ( nt!KiTrap0E+2ad )

Followup: MachineOwner
---------

kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

DRIVER_CORRUPTED_EXPOOL (c5)
An attempt was made to access a pagable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is
caused by drivers that have corrupted the system pool.  Run the driver
verifier against any new (or suspect) drivers, and if that doesn't turn up
the culprit, then use gflags to enable special pool.
Arguments:
Arg1: 00001880, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000001, value 0 = read operation, 1 = write operation
Arg4: 8053ce49, address which referenced memory

Debugging Details:
------------------


DEFAULT_BUCKET_ID:  DRIVER_FAULT

BUGCHECK_STR:  0xC5

LAST_CONTROL_TRANSFER:  from 804dce53 to 805266db

STACK_TEXT:  
80541cd0 804dce53 0000000a 00001880 00000002 nt!KeBugCheckEx+0x19
80541cec 89676188 8860c4c0 f755a4e7 f755d888 nt!KiTrap0E+0x2ad
WARNING: Frame IP not in any known module. Following frames may be wrong.
8860c59c 00000000 00000000 00000000 00000000 0x89676188


FOLLOWUP_IP:
nt!KiTrap0E+2ad
804dce53 ??               ???

FOLLOWUP_NAME:  MachineOwner

SYMBOL_NAME:  nt!KiTrap0E+2ad

MODULE_NAME:  nt

IMAGE_NAME:  ntoskrnl.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  3d6de35c

STACK_COMMAND:  kb

BUCKET_ID:  0xC5_nt!KiTrap0E+2ad

Followup: MachineOwner
---------


Does anyone know what goes on at '8053ce49' in ntoskrnl.exe?

Could it be due to a paging fault somewhere?
I've got 1.5Gb of ram, only about 500Mb gets used.
When I've set the swapfile to 20Mb, from time to time
the PC complains the virtual memory is too
small even when there's over 1Gb free in ram.

Let me know if you want any other details or if you want
me to do other experiments.

Not urgent but I would like to get this sorted out.
In and out all the time but will reply within 24hrs.

Thanks.
0
Comment
Question by:alanlam
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 23
  • 11
  • +2
39 Comments
 
LVL 5

Expert Comment

by:pelejab
ID: 8151579
possibly try reducing your RAM to under 1GB for a while and see if the crashes still occur. Refer to the following KB article (although this has to do with hibernation problems).
http://support.microsoft.com/default.aspx?scid=kb;en-us;Q330909
Possibly download and install the fix given here and see if it helps.

cheers
Pete
0
 
LVL 44

Accepted Solution

by:
CrazyOne earned 1000 total points
ID: 8151822
Well first off some programs and the OS will use the page file no matter how much RAM you have. Increase the size to lets say 100MB's for now.

Also the errors seem to be pointing to a driver issue. If you installed any hardware or updated any drivers lately take a look at them as the possible culprit.

HOW TO: Use the Driver Roll Back Feature to Restore a Previous Version of a Device Driver in Windows XP
http://support.microsoft.com/default.aspx?scid=kb;en-us;306546
-----------------------

Memory Performance Tweak
http://www.windowsxpatoz.com/cgi-bin/performance/index.cgi?answer=1036284180&id=1036282433

These Settings will fine tune your systems memory

management -atleast 256MB of ram recccomended

go to start\run\regedit -and then to the following key

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management

1.DisablePagingExecutive -double click it and in the decimal put a 1 - this allows XP to keep data in memory now instead of paging sections of ram to harddrive yeilds faster performance.

2.LargeSystemCache- double click it and change the decimal to 1 -this allows XP Kernal to Run in memory improves system performance alot

3.create a new dword and name it IOPageLockLimit - double click it and set the value in hex - 4000 if you have 128MB of ram or set it to 10000 if you have 256MB set it to 40000 if you have more than 512MB of ram -this tweak will speed up your disckcache

Reboot and watch your system fly
-----------------------------

Test the RAM

NOTE if this doesn't find anything wrong with the RAM this DOESN'T mean the RAM is good you would need to swap out the RAM with known good modules for testing. However if it does find something wrong then chances are the RAM is bad.

DocMemory PC RAM
Diagnostic Software
http://www.simmtester.com/PAGE/products/doc/docinfo.asp

or

http://www.memtest86.com/ 
0
 

Author Comment

by:alanlam
ID: 8153506
@pelejab
Downloading file. Will install and see how it goes.

@CrazyOne
Re: Swapfile size
I've set it to custom 300-1000Mb for the moment to see how it goes.

The other funny thing to note is when I set the custom size, initial to 20Mb and Max size to 1000Mb, WinXP never increased the size of the swapfile beyond 20Mb and just complains that it wasn't large enough at 20Mb. Is there a clue in there somewhere?

Re: Rollback
It happened on a pretty much newish installation, after a few days after a complete rebuild. I've been installing updated drivers, bios etc but no joy in getting rid of it.
C5 errors is coming from a pretty constant location (8053ce49), although it seems to be calling different areas of memory. Then it goes beyond me!

Re: Memory Performance Tweak
Already done.
IOPageLockLimit=c00000 (12582912)
Would having too much of that cause any problems?

Re: Memory testing
I ran memtest86 overnight previously without any reported faults.
Would DocMemory give different results?

Thanks.
0
Technology Partners: We Want Your Opinion!

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

 
LVL 44

Expert Comment

by:CrazyOne
ID: 8153789
>>>Would DocMemory give different results?

Probably not.

Note what programs are running when this happens. If you see that a certain program is always running when this takes place then look at as the possible problem.

Also try this

Start > Runs sfc /scannow

and you might consider doing this.

Repair
How to Perform an In-Place Upgrade (Reinstallation) of Windows XP
http://support.microsoft.com/default.aspx?scid=kb;en-us;315341

Visual aid to the above procedure
http://www.webtree.ca/windowsxp/repair_xp.htm
Click on How To Run a Repair Install
0
 

Author Comment

by:alanlam
ID: 8155593
@CrazyOne

Re: Programs
Will feel naked without firewall, AV, AT programs <lol>
Was hoping the debug would give direct trace on which program was causing the problem.


>>>Start > Runs sfc /scannow
New command on me. Seemed to pull in a few files into the DLL cache. Will that overwrite any new SP1 files?? Complained about the Winfast Windows 2000/XP Driver Library Installation. Had to skip that one <shrug>. Thought I had winfast (isn't that the awful office find utility?) switched off!

Will try in-place reinstallation as last resort if it keeps crashing. Hasn't crashed yet with all the expert attention on it recently! :)

Going to give it a week or so to see if it stablizes. <fingers crossed>
0
 
LVL 44

Expert Comment

by:CrazyOne
ID: 8156055
Ok
0
 

Author Comment

by:alanlam
ID: 8157760
Has crashed within 10 min of a reboot and sometimes lasted over 4 days before crashing so very variable. So if it lasts a week without crashing, things will be much better.

Would be interesting to 'know' if the virtual memory thing is related to this or not but I don't have the knowledge :(

Wish I 'knew' what is at 8053ce49 and what it does.

Hopefully, all going well, I'll be back in a week to give out points!
0
 

Author Comment

by:alanlam
ID: 8161007
Close button on Mozilla 1.2.1
Crash C2, {7, cd4, 7897, 8960e960}

Any ideas?
0
 
LVL 44

Expert Comment

by:CrazyOne
ID: 8162010
These error numbers are unfimilar to me. Making hard to figure out that the cause is.
0
 

Author Comment

by:alanlam
ID: 8165119
@CrazyOne
As you can imagine, I close Mozilla quite a lot. But why this time, it causes a crash? <shrug> got me puzzled.
I also had a few other C2 (7, cd4, ???, ???)
Would be glad if someone could help me get to the bottom of those as well!
0
 

Author Comment

by:alanlam
ID: 8181668
Click on 'Open Groups' in BNR2 (Binary News Reader) resulted in

C5, {6e66744e, 2, 1, 80533ed4}
0
 

Author Comment

by:alanlam
ID: 8209952
03-21 - viewing webpage - 24, {1902fa, f78ba65c, f78ba35c, 80534430} - New error code for me!
03-23 - close BNR - C5, {12090005, 2, 1, 80533ed6}
03-26 - Spontaneous reboot - was running BNR though C2, {7, cd4, 81e5, 882aa2d0}

Will try to keep an eye on the last action that happened and when it reboots. My suspicion is BNR at the moment.
0
 
LVL 44

Expert Comment

by:CrazyOne
ID: 8211544
Ok do this so as to a Blue Screen error when crashes the system.

Right-click My Computer, click Properties, click the Advanced tab, and then click Settings under Startup and Recovery and uncheck Automatically Reboot.
0
 

Author Comment

by:alanlam
ID: 8216371
Thank you for you efforts CrazyOne :) Already unchecked auto reboot :)

03-26 - Close Windows Explorer - C5, {12030005, 2, 1, 80533ed6}

I had BNR running but have already shut it down.

Another thing is windbg doesn't like the symbol file I've d/l from microsoft. Argh! Keeps complaining "Kernel symbols are WRONG. Please fix symbols to do analysis" Dang!

My suspicion is whenever I run BNR, it is mucking around with the memory, which then can lead to a spontaneous reboot at any time WinXP ?pages? memory. Will try to observe if reboots 'only' happen during/after running BNR.

Don't suppose you know of any memory utility that will crawl through the memory space and check all the pointers are going to the right place! :)
0
 
LVL 44

Expert Comment

by:CrazyOne
ID: 8216510
>>>Don't suppose you know of any memory utility that will crawl through the memory space and check all the pointers are going to the right place!

Ummm no I don't.
0
 

Author Comment

by:alanlam
ID: 8221022
Dang! Rebooted again.

03-27 - Closing a Mozilla window -  C5, {0, 2, 1, 80533e7b}

I'm pretty sure that I didn't use BNR. However, whereas before the error messages pointed at the ntos kernal. This time it said "amon.sys ( amon+1f1a0 )" might be causing the problem, which is the antivirus software. Will keep an eye on future error messages.
0
 

Author Comment

by:alanlam
ID: 8265370
Rebooted again

04-03 - typed in new address in Mozilla - C2, {7, cd4, 90b2, 898ce5b0}

I have not used BNR. However, I did uninstall some software and had not rebooted the PC. So that could be the cause. Will continue to see if only BNR provokes a reboot.
0
 
LVL 44

Expert Comment

by:CrazyOne
ID: 8266847
What file did it point to this time?
0
 

Author Comment

by:alanlam
ID: 8268256
@CrazyOne

Cut & paste from windbg

Cannot get _POOL_TRACKER_BIG_PAGES type size
Probably caused by : afd.sys ( afd!AfdFreeConnection+69 )

Using TaskInfo2003 to have a look at the 'modules' used by all the programs but I can't any of them using afd.sys :-(

04-04 - restart WinXP - crashed - This was after I used BNR, closed it down successfully, and was in the process of rebooting the PC to clear out any 'bad' pointers.
BugCheck C5, {6c646156, 2, 1, 80533ed4}
Probably caused by : ntoskrnl.exe ( nt!Kei386EoiHelper+257d )

Will continue to try and see if there is a correlation between using or not using BNR and subsequent crash :)
0
 

Author Comment

by:alanlam
ID: 8269539
04-04 - click on print button in Word 2000. Crashed.

I definitely did not use BNR or require a reboot from WinXP.

Windbg report
BugCheck C5, {0, 2, 1, 80533e7b}
Probably caused by : ntoskrnl.exe ( nt!Kei386EoiHelper+257d )

Will contine to keep reporting as some kind of pattern may emerge.
0
 
LVL 44

Expert Comment

by:CrazyOne
ID: 8270795
Have we tested the RAM yet?

NOTE if this doesn't find anything wrong with the RAM this DOESN'T mean the RAM is good you would need to swap out the RAM with known good modules for testing. However if it does find something wrong then chances are the RAM is bad.

DocMemory PC RAM
Diagnostic Software
http://www.simmtester.com/PAGE/products/doc/docinfo.asp

or

http://www.memtest86.com/ 
0
 

Author Comment

by:alanlam
ID: 8314820
Done. Previously tested memtest86 overnight. No Problem.
Tested DocMem. Burn in test. 4 hours. 5 passes. Pass.

04-09 C2, {7, cd4, 9066, 89410138} - open Word file. while running BNR.
04-09 C5, {0, 2, 1, 80533ed4} - closed BNR - rebooting.
04-10 C5, {70627375, 2, 1, 80533ed4} - spontaneous - about 5 min into a new session after rebooting after running DocMem - This I don't know the reason for.
04-11 C2, {7, cd4, 90fb, 895382c0} - crashed on rebooting PC after running BNR. Windbg reports
Cannot get _POOL_TRACKER_BIG_PAGES type size
Probably caused by : wdmaud.sys ( wdmaud!AudioFreeMemory+5a )

Haven't got any 'known' good memory chips. Will try use existing mem chips singly this w/e and see if there any changes.
0
 

Author Comment

by:alanlam
ID: 8326599
04-14 - C5, {206b6444, 2, 1, 80533ed4} - Have not touched BNR - Rebooted while closing a program and starting another. But ... Setispy has an update that fixes crashes on WinXP on startup so I have installed that to see if it fixes the problem.
0
 
LVL 44

Expert Comment

by:CrazyOne
ID: 8327672
Ok keep us posted. :>)
0
 

Author Comment

by:alanlam
ID: 8353470
Dang. Thought I had it cracked with updating Setispy. Didn't run BNR for a few days. No crashes.

Running BNR today. Left it running by itself for about 30min.
04-18 C2, {7, cd4, 9109, 89596bc0}
Cannot get _POOL_TRACKER_BIG_PAGES type size
Probably caused by : ntoskrnl.exe ( nt!ExFreePoolWithTag+237 )

Will keep monitoring!
0
 

Author Comment

by:alanlam
ID: 8357858
A different error code!

04-19 D1, {33c, 2, 1, f746b97f} - Was running BNR, crashed when started up Quicken at the same time.

More stuff from windbg.exe below:

Probably caused by : tcpip.sys ( tcpip!ProcessPerCpuTCBDelayQ+174 )

DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
An attempt was made to access a pagable (or completely invalid) address at an interrupt request level (IRQL) that is too high.  This is usually caused by drivers using improper addresses.
Arguments:
Arg1: 0000033c, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000001, value 0 = read operation, 1 = write operation
Arg4: f746b97f, address which referenced memory

Still looks like BNR is messing around with the memory pointers/pages/? ... but I thought WinXP protected against things like that <shrug>
0
 

Author Comment

by:alanlam
ID: 8362015
04-20 C2, {7, cd4, 9039, 89582390} - Just browsing with Mozillla. Didn't run BNR. Nothing special.
Cannot get _POOL_TRACKER_BIG_PAGES type size
BUGCHECK_STR:  0xc2_7
DEFAULT_BUCKET_ID:  DRIVER_FAULT
Probably caused by : FILTNT.SYS ( FILTNT+5094 )
0
 

Author Comment

by:alanlam
ID: 8365360
04-21 C2, {7, cd4, 8c69, 897e1ae0}
BAD_POOL_CALLER (c2)
The current thread is making a bad pool request.  Typically this is at a bad IRQL level or double freeing the same allocation, etc.
Arguments:
Arg1: 00000007, Attempt to free pool which was already freed
Arg2: 00000cd4, (reserved)
Arg3: 00008c69, Memory contents of the pool block
Arg4: 897e1ae0, Pointer to pool header
Probably caused by : ntoskrnl.exe ( nt!ExFreePoolWithTag+237 )

Not running BNR. Just had email program and Mozilla running. Clicked on a link in Mozilla and PC rebooted.

Something is still mucking around with the memory and I just don't know what :-(
0
 
LVL 44

Expert Comment

by:CrazyOne
ID: 8368479
Yeah this is a tough one. It still could be faulty RAM.
0
 

Author Comment

by:alanlam
ID: 8371833
04-22 50, {ffffffdc, 1, b2544ebe, 0}
Probably caused by : kmixer.sys ( kmixer!WriteBuffer+38 )

New error code to me - was just opening up IE6 to look at a website that doesn't like Mozilla.

Getting desperate so finally opened up the PC. Taken two memory sticks out. Moved what I thought was the one occupying 1.0-1.5 GB area to 0-0.5GB area. Arbitarily designated that as number 1.

Fingers crossed. Wait and see. If this works, would love to give away those 500pts <LOL>
0
 

Author Comment

by:alanlam
ID: 8412545
04-24 C2, {7, cd4, 1b60, 81f03260}
Cannot get _POOL_TRACKER_BIG_PAGES type size
Probably caused by : ntoskrnl.exe ( nt!ExFreePoolWithTag+237 )
Was out of the room watching TV. No joy with chip no1.

Moved house. Back to dial-up. Not using BNR.

04-28 BugCheck C5, {0, 2, 1, 80533ed4}
Didn't get round to changing the chip.
Was out of the room watching TV. Will try to change the memory chip soon and try another one.
0
 

Author Comment

by:alanlam
ID: 8419127
After two more reboots, have changed to memory chip no.2
All going well there will be no more reboots!! <crosses fingers>
0
 
LVL 44

Expert Comment

by:CrazyOne
ID: 8421242
I have got my fingers crossed. :>)
0
 

Expert Comment

by:CleanupPing
ID: 9066126
alanlam:
This old question needs to be finalized -- accept an answer, split points, or get a refund.  For information on your options, please click here-> http:/help/closing.jsp#1 
EXPERTS:
Post your closing recommendations!  No comment means you don't care.
0
 

Author Comment

by:alanlam
ID: 9066900
Have tried all the different memeory chips individually still no luck.

Have not been able to associated any particular program used and when it crashes.

Sorry I haven't reported back earlier but I got caught in work and then the rebooting just became a way of life!!!

It's still crashing. About once or twice a day. Sometimes during the day, sometimes when I turn the PC off. Sometimes a C2 error, sometimes a C5 error. Can't afford to change the PC so I'm resigned to living with it until I can change the PC.

In the meantime, I've requested 250 for CrazyOne (outstanding efforts to help) and a refund of 250, unless you're still around and have some fresh ideas <shrug>.
0
 

Expert Comment

by:violinman
ID: 11083956
Hi Alanlam,
I am also experiencing the same crashes and blue screens you are suffering from.
I also am running XP pro, and have 1.5 gig ram in 3 512mb DDR266 sdrams. I was wondering if there is a common factor between our respective set ups. May I ask which motherboard you are using? Mine is an MSI K7N2 Delta. If you are half as frustrated as I am by all of this I sympathise with you!
0
 

Author Comment

by:alanlam
ID: 11088140
Hi Violinman

I've got a gigabyte 7ZXE motherboard as stated in the original post! :-)

In the meantime, I've moved house last year and I've probably reinstalled windows since.

I don't remember the PC crashing much after moving house. Maybe it's the moving house with a different power supply?? Not sure.

Good luck with your PC.
0

Featured Post

Ransomware: The New Cyber Threat & How to Stop It

This infographic explains ransomware, type of malware that blocks access to your files or your systems and holds them hostage until a ransom is paid. It also examines the different types of ransomware and explains what you can do to thwart this sinister online threat.  

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Are you unable to synchronize your OST (Offline Storage Table) file with Microsoft Exchange Server? Is your OST file exceeding 2 GB size limit? In Microsoft Outlook 2002 and earlier versions, there is a 2 GB size limit for the OST file. If the file …
Issue: Unstable cursor in Windows XP and Windows runs extremely slow in that any click will bring up the Hour glass (sometimes for several seconds before giving you what you want) . Troubleshooting Process and the FINAL FIX: This issue see…
Two types of users will appreciate AOMEI Backupper Pro: 1 - Those with PCIe drives (and haven't found cloning software that works on them). 2 - Those who want a fast clone of their boot drive (no re-boots needed) and it can clone your drive wh…
NetCrunch network monitor is a highly extensive platform for network monitoring and alert generation. In this video you'll see a live demo of NetCrunch with most notable features explained in a walk-through manner. You'll also get to know the philos…
Suggested Courses

800 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question