Link to home
Start Free TrialLog in
Avatar of alanlam
alanlam

asked on

XP crash - Blue screen - C5 (???,2,1,8053de49)

Hi,

Win XP SP1
1.5Gb
Gigabyte 7ZXE
AMD 1800+
Other hw

Amongst other utilities, running
Agnitum Outpost - firewall
Agnitum tauscan - antitrojan
Eset Nod32 - antivirus
MSN
taskinfo2003
Seti

I've also set services to here http://www.blackviper.com/WinXP/servicecfg.htm
to SAFE" Configuration

I'm getting intermittent crashes (0.25 - 5 crashes/day).
Sometimes PC crashes by itself.
Sometimes it happens when I click on a button (any program)
I've isolated the C5 crashes as these are the most common.

c5 (020A0005, 2, 1, 8053ce4b)
c5 (6b576343, 2, 1, 8053ce49)
c5 (6e66744e, 2, 1, 8053ce49)
c5 (       0, 2, 1, 8053ce49)
c5 (       0, 2, 1, 8053ce49)
c5 (    1880, 2, 1, 8053ce49)

I've d/l windows debugger & the symbol table, pointed it at the minidump, did
!analyze -v and got the following results.

-------
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck C5, {1880, 2, 1, 8053ce49}

Probably caused by : ntoskrnl.exe ( nt!KiTrap0E+2ad )

Followup: MachineOwner
---------

kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

DRIVER_CORRUPTED_EXPOOL (c5)
An attempt was made to access a pagable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is
caused by drivers that have corrupted the system pool.  Run the driver
verifier against any new (or suspect) drivers, and if that doesn't turn up
the culprit, then use gflags to enable special pool.
Arguments:
Arg1: 00001880, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000001, value 0 = read operation, 1 = write operation
Arg4: 8053ce49, address which referenced memory

Debugging Details:
------------------


DEFAULT_BUCKET_ID:  DRIVER_FAULT

BUGCHECK_STR:  0xC5

LAST_CONTROL_TRANSFER:  from 804dce53 to 805266db

STACK_TEXT:  
80541cd0 804dce53 0000000a 00001880 00000002 nt!KeBugCheckEx+0x19
80541cec 89676188 8860c4c0 f755a4e7 f755d888 nt!KiTrap0E+0x2ad
WARNING: Frame IP not in any known module. Following frames may be wrong.
8860c59c 00000000 00000000 00000000 00000000 0x89676188


FOLLOWUP_IP:
nt!KiTrap0E+2ad
804dce53 ??               ???

FOLLOWUP_NAME:  MachineOwner

SYMBOL_NAME:  nt!KiTrap0E+2ad

MODULE_NAME:  nt

IMAGE_NAME:  ntoskrnl.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  3d6de35c

STACK_COMMAND:  kb

BUCKET_ID:  0xC5_nt!KiTrap0E+2ad

Followup: MachineOwner
---------


Does anyone know what goes on at '8053ce49' in ntoskrnl.exe?

Could it be due to a paging fault somewhere?
I've got 1.5Gb of ram, only about 500Mb gets used.
When I've set the swapfile to 20Mb, from time to time
the PC complains the virtual memory is too
small even when there's over 1Gb free in ram.

Let me know if you want any other details or if you want
me to do other experiments.

Not urgent but I would like to get this sorted out.
In and out all the time but will reply within 24hrs.

Thanks.
Avatar of pelejab
pelejab
Flag of Botswana image

possibly try reducing your RAM to under 1GB for a while and see if the crashes still occur. Refer to the following KB article (although this has to do with hibernation problems).
http://support.microsoft.com/default.aspx?scid=kb;en-us;Q330909
Possibly download and install the fix given here and see if it helps.

cheers
Pete
ASKER CERTIFIED SOLUTION
Avatar of CrazyOne
CrazyOne
Flag of United States of America image

Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
Avatar of alanlam
alanlam

ASKER

@pelejab
Downloading file. Will install and see how it goes.

@CrazyOne
Re: Swapfile size
I've set it to custom 300-1000Mb for the moment to see how it goes.

The other funny thing to note is when I set the custom size, initial to 20Mb and Max size to 1000Mb, WinXP never increased the size of the swapfile beyond 20Mb and just complains that it wasn't large enough at 20Mb. Is there a clue in there somewhere?

Re: Rollback
It happened on a pretty much newish installation, after a few days after a complete rebuild. I've been installing updated drivers, bios etc but no joy in getting rid of it.
C5 errors is coming from a pretty constant location (8053ce49), although it seems to be calling different areas of memory. Then it goes beyond me!

Re: Memory Performance Tweak
Already done.
IOPageLockLimit=c00000 (12582912)
Would having too much of that cause any problems?

Re: Memory testing
I ran memtest86 overnight previously without any reported faults.
Would DocMemory give different results?

Thanks.
>>>Would DocMemory give different results?

Probably not.

Note what programs are running when this happens. If you see that a certain program is always running when this takes place then look at as the possible problem.

Also try this

Start > Runs sfc /scannow

and you might consider doing this.

Repair
How to Perform an In-Place Upgrade (Reinstallation) of Windows XP
http://support.microsoft.com/default.aspx?scid=kb;en-us;315341

Visual aid to the above procedure
http://www.webtree.ca/windowsxp/repair_xp.htm
Click on How To Run a Repair Install
Avatar of alanlam

ASKER

@CrazyOne

Re: Programs
Will feel naked without firewall, AV, AT programs <lol>
Was hoping the debug would give direct trace on which program was causing the problem.


>>>Start > Runs sfc /scannow
New command on me. Seemed to pull in a few files into the DLL cache. Will that overwrite any new SP1 files?? Complained about the Winfast Windows 2000/XP Driver Library Installation. Had to skip that one <shrug>. Thought I had winfast (isn't that the awful office find utility?) switched off!

Will try in-place reinstallation as last resort if it keeps crashing. Hasn't crashed yet with all the expert attention on it recently! :)

Going to give it a week or so to see if it stablizes. <fingers crossed>
Avatar of alanlam

ASKER

Has crashed within 10 min of a reboot and sometimes lasted over 4 days before crashing so very variable. So if it lasts a week without crashing, things will be much better.

Would be interesting to 'know' if the virtual memory thing is related to this or not but I don't have the knowledge :(

Wish I 'knew' what is at 8053ce49 and what it does.

Hopefully, all going well, I'll be back in a week to give out points!
Avatar of alanlam

ASKER

Close button on Mozilla 1.2.1
Crash C2, {7, cd4, 7897, 8960e960}

Any ideas?
These error numbers are unfimilar to me. Making hard to figure out that the cause is.
Avatar of alanlam

ASKER

@CrazyOne
As you can imagine, I close Mozilla quite a lot. But why this time, it causes a crash? <shrug> got me puzzled.
I also had a few other C2 (7, cd4, ???, ???)
Would be glad if someone could help me get to the bottom of those as well!
Avatar of alanlam

ASKER

Click on 'Open Groups' in BNR2 (Binary News Reader) resulted in

C5, {6e66744e, 2, 1, 80533ed4}
Avatar of alanlam

ASKER

03-21 - viewing webpage - 24, {1902fa, f78ba65c, f78ba35c, 80534430} - New error code for me!
03-23 - close BNR - C5, {12090005, 2, 1, 80533ed6}
03-26 - Spontaneous reboot - was running BNR though C2, {7, cd4, 81e5, 882aa2d0}

Will try to keep an eye on the last action that happened and when it reboots. My suspicion is BNR at the moment.
Ok do this so as to a Blue Screen error when crashes the system.

Right-click My Computer, click Properties, click the Advanced tab, and then click Settings under Startup and Recovery and uncheck Automatically Reboot.
Avatar of alanlam

ASKER

Thank you for you efforts CrazyOne :) Already unchecked auto reboot :)

03-26 - Close Windows Explorer - C5, {12030005, 2, 1, 80533ed6}

I had BNR running but have already shut it down.

Another thing is windbg doesn't like the symbol file I've d/l from microsoft. Argh! Keeps complaining "Kernel symbols are WRONG. Please fix symbols to do analysis" Dang!

My suspicion is whenever I run BNR, it is mucking around with the memory, which then can lead to a spontaneous reboot at any time WinXP ?pages? memory. Will try to observe if reboots 'only' happen during/after running BNR.

Don't suppose you know of any memory utility that will crawl through the memory space and check all the pointers are going to the right place! :)
>>>Don't suppose you know of any memory utility that will crawl through the memory space and check all the pointers are going to the right place!

Ummm no I don't.
Avatar of alanlam

ASKER

Dang! Rebooted again.

03-27 - Closing a Mozilla window -  C5, {0, 2, 1, 80533e7b}

I'm pretty sure that I didn't use BNR. However, whereas before the error messages pointed at the ntos kernal. This time it said "amon.sys ( amon+1f1a0 )" might be causing the problem, which is the antivirus software. Will keep an eye on future error messages.
Avatar of alanlam

ASKER

Rebooted again

04-03 - typed in new address in Mozilla - C2, {7, cd4, 90b2, 898ce5b0}

I have not used BNR. However, I did uninstall some software and had not rebooted the PC. So that could be the cause. Will continue to see if only BNR provokes a reboot.
What file did it point to this time?
Avatar of alanlam

ASKER

@CrazyOne

Cut & paste from windbg

Cannot get _POOL_TRACKER_BIG_PAGES type size
Probably caused by : afd.sys ( afd!AfdFreeConnection+69 )

Using TaskInfo2003 to have a look at the 'modules' used by all the programs but I can't any of them using afd.sys :-(

04-04 - restart WinXP - crashed - This was after I used BNR, closed it down successfully, and was in the process of rebooting the PC to clear out any 'bad' pointers.
BugCheck C5, {6c646156, 2, 1, 80533ed4}
Probably caused by : ntoskrnl.exe ( nt!Kei386EoiHelper+257d )

Will continue to try and see if there is a correlation between using or not using BNR and subsequent crash :)
Avatar of alanlam

ASKER

04-04 - click on print button in Word 2000. Crashed.

I definitely did not use BNR or require a reboot from WinXP.

Windbg report
BugCheck C5, {0, 2, 1, 80533e7b}
Probably caused by : ntoskrnl.exe ( nt!Kei386EoiHelper+257d )

Will contine to keep reporting as some kind of pattern may emerge.
Have we tested the RAM yet?

NOTE if this doesn't find anything wrong with the RAM this DOESN'T mean the RAM is good you would need to swap out the RAM with known good modules for testing. However if it does find something wrong then chances are the RAM is bad.

DocMemory PC RAM
Diagnostic Software
http://www.simmtester.com/PAGE/products/doc/docinfo.asp

or

http://www.memtest86.com/ 
Avatar of alanlam

ASKER

Done. Previously tested memtest86 overnight. No Problem.
Tested DocMem. Burn in test. 4 hours. 5 passes. Pass.

04-09 C2, {7, cd4, 9066, 89410138} - open Word file. while running BNR.
04-09 C5, {0, 2, 1, 80533ed4} - closed BNR - rebooting.
04-10 C5, {70627375, 2, 1, 80533ed4} - spontaneous - about 5 min into a new session after rebooting after running DocMem - This I don't know the reason for.
04-11 C2, {7, cd4, 90fb, 895382c0} - crashed on rebooting PC after running BNR. Windbg reports
Cannot get _POOL_TRACKER_BIG_PAGES type size
Probably caused by : wdmaud.sys ( wdmaud!AudioFreeMemory+5a )

Haven't got any 'known' good memory chips. Will try use existing mem chips singly this w/e and see if there any changes.
Avatar of alanlam

ASKER

04-14 - C5, {206b6444, 2, 1, 80533ed4} - Have not touched BNR - Rebooted while closing a program and starting another. But ... Setispy has an update that fixes crashes on WinXP on startup so I have installed that to see if it fixes the problem.
Ok keep us posted. :>)
Avatar of alanlam

ASKER

Dang. Thought I had it cracked with updating Setispy. Didn't run BNR for a few days. No crashes.

Running BNR today. Left it running by itself for about 30min.
04-18 C2, {7, cd4, 9109, 89596bc0}
Cannot get _POOL_TRACKER_BIG_PAGES type size
Probably caused by : ntoskrnl.exe ( nt!ExFreePoolWithTag+237 )

Will keep monitoring!
Avatar of alanlam

ASKER

A different error code!

04-19 D1, {33c, 2, 1, f746b97f} - Was running BNR, crashed when started up Quicken at the same time.

More stuff from windbg.exe below:

Probably caused by : tcpip.sys ( tcpip!ProcessPerCpuTCBDelayQ+174 )

DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
An attempt was made to access a pagable (or completely invalid) address at an interrupt request level (IRQL) that is too high.  This is usually caused by drivers using improper addresses.
Arguments:
Arg1: 0000033c, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000001, value 0 = read operation, 1 = write operation
Arg4: f746b97f, address which referenced memory

Still looks like BNR is messing around with the memory pointers/pages/? ... but I thought WinXP protected against things like that <shrug>
Avatar of alanlam

ASKER

04-20 C2, {7, cd4, 9039, 89582390} - Just browsing with Mozillla. Didn't run BNR. Nothing special.
Cannot get _POOL_TRACKER_BIG_PAGES type size
BUGCHECK_STR:  0xc2_7
DEFAULT_BUCKET_ID:  DRIVER_FAULT
Probably caused by : FILTNT.SYS ( FILTNT+5094 )
Avatar of alanlam

ASKER

04-21 C2, {7, cd4, 8c69, 897e1ae0}
BAD_POOL_CALLER (c2)
The current thread is making a bad pool request.  Typically this is at a bad IRQL level or double freeing the same allocation, etc.
Arguments:
Arg1: 00000007, Attempt to free pool which was already freed
Arg2: 00000cd4, (reserved)
Arg3: 00008c69, Memory contents of the pool block
Arg4: 897e1ae0, Pointer to pool header
Probably caused by : ntoskrnl.exe ( nt!ExFreePoolWithTag+237 )

Not running BNR. Just had email program and Mozilla running. Clicked on a link in Mozilla and PC rebooted.

Something is still mucking around with the memory and I just don't know what :-(
Yeah this is a tough one. It still could be faulty RAM.
Avatar of alanlam

ASKER

04-22 50, {ffffffdc, 1, b2544ebe, 0}
Probably caused by : kmixer.sys ( kmixer!WriteBuffer+38 )

New error code to me - was just opening up IE6 to look at a website that doesn't like Mozilla.

Getting desperate so finally opened up the PC. Taken two memory sticks out. Moved what I thought was the one occupying 1.0-1.5 GB area to 0-0.5GB area. Arbitarily designated that as number 1.

Fingers crossed. Wait and see. If this works, would love to give away those 500pts <LOL>
Avatar of alanlam

ASKER

04-24 C2, {7, cd4, 1b60, 81f03260}
Cannot get _POOL_TRACKER_BIG_PAGES type size
Probably caused by : ntoskrnl.exe ( nt!ExFreePoolWithTag+237 )
Was out of the room watching TV. No joy with chip no1.

Moved house. Back to dial-up. Not using BNR.

04-28 BugCheck C5, {0, 2, 1, 80533ed4}
Didn't get round to changing the chip.
Was out of the room watching TV. Will try to change the memory chip soon and try another one.
Avatar of alanlam

ASKER

After two more reboots, have changed to memory chip no.2
All going well there will be no more reboots!! <crosses fingers>
I have got my fingers crossed. :>)
alanlam:
This old question needs to be finalized -- accept an answer, split points, or get a refund.  For information on your options, please click here-> http:/help/closing.jsp#1 
EXPERTS:
Post your closing recommendations!  No comment means you don't care.
Avatar of alanlam

ASKER

Have tried all the different memeory chips individually still no luck.

Have not been able to associated any particular program used and when it crashes.

Sorry I haven't reported back earlier but I got caught in work and then the rebooting just became a way of life!!!

It's still crashing. About once or twice a day. Sometimes during the day, sometimes when I turn the PC off. Sometimes a C2 error, sometimes a C5 error. Can't afford to change the PC so I'm resigned to living with it until I can change the PC.

In the meantime, I've requested 250 for CrazyOne (outstanding efforts to help) and a refund of 250, unless you're still around and have some fresh ideas <shrug>.
Hi Alanlam,
I am also experiencing the same crashes and blue screens you are suffering from.
I also am running XP pro, and have 1.5 gig ram in 3 512mb DDR266 sdrams. I was wondering if there is a common factor between our respective set ups. May I ask which motherboard you are using? Mine is an MSI K7N2 Delta. If you are half as frustrated as I am by all of this I sympathise with you!
Avatar of alanlam

ASKER

Hi Violinman

I've got a gigabyte 7ZXE motherboard as stated in the original post! :-)

In the meantime, I've moved house last year and I've probably reinstalled windows since.

I don't remember the PC crashing much after moving house. Maybe it's the moving house with a different power supply?? Not sure.

Good luck with your PC.