Solved

Daily BSOD with Category 102 Event ID 1003

Posted on 2004-10-28
15,113 Views
Last Modified: 2011-08-18
I've been getting on average one BSOD per day for the last few weeks so have started monitoring them over the last few days.  Here is a typical extract from the Event Viewer:

Error code 1000000a, parameter1 805d8617, parameter2 00000002, parameter3 00000000, parameter4 805d8617.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Microsoft Online Crash Analysis reports each time that a driver has caused the problem, which is not very helpful.  In the last few weeks I have upgraded to XP SP2, installed Winamp and installed a D-Link Bluetooth dongle.

Is there any way of identifying and rectifying the exact source of the problem without having to uninstall recent changes one at a time and leaving it a few days to see if things improve?

On reboot the system advises that it has recovered from a serious error and sends data to the microsoft oca site.  I have kept the files that have been sent on the last three occassions though I don't know how to analyse these or even if they will help.

Can anyone provide advice on this?  Is further information needed for investigation? If so let me know what is needed and I will try to provide it.
0
Question by:krankie
    30 Comments
     
    LVL 32

    Accepted Solution

    by:
    Hi krankie,

    0xA: IRQL_NOT_LESS_OR_EQUAL (which is essentially the same as 0x1000000a)
    http://www.aumha.org/win5/kbestop.php#0x0a

    Typically due to a bad driver, or faulty or incompatible hardware or software. Use the General Troubleshooting of STOP Messages checklist http://www.aumha.org/win5/kbestop.php#general Technically, this error condition means that a kernel-mode process or driver tried to access a memory location to which it did not have permission, or at a kernel Interrupt ReQuest Level (IRQL) that was too high. (A kernel-mode process can access only other processes that have an IRQL lower than, or equal to, its own.)

    What microsoft has to say about it:
    http://www.microsoft.com/technet/prodtechnol/winxppro/reskit/prmd_stp_hwpg.asp

    Possible Resolutions to STOP 0x0A, 0x01E, and 0x50 Errors {KB 183169} Win NT, Win 2000, Win XP
    http://support.microsoft.com/?kbid=183169

    STOP 0x4E, STOP 0x1A, STOP 0x50, and STOP 0xA Errors Occur When You Try to Start the Computer {KB 271955} Win NT 4.0 (corrupt physical RAM)
    http://support.microsoft.com/?kbid=271955

    NT, 2000, XP - Troubleshooting “Stop 0x0A” Messages in Windows
    http://support.microsoft.com/?kbid=165863

    XP - Troubleshooting a Stop 0x0000000A Error in Windows XP
    http://support.microsoft.com/default.aspx?scid=kb;EN-US;314063

    Can be caused by faulty memmory, check for it: http://www.memtest86.com (if this tool doesn't say it is bad, doesn't mean it's good, the only way to test that is to replace it with "known good memmory"

    Greetings,

    LucF
    0
     
    LVL 27

    Expert Comment

    by:Asta Cu
    I'm quite sure the information provided you by LucF should remedy the problem.  I've encountered a few roadblocks on issues when timing was urgent and used the FREE XP SP2 TechChat process to get immediate assistance, and it's been great, though phone options and email also exist.  I can only say that my experience with the Tech Chat option has been outstanding and quick!  I think it's worth it in the long run, since I've seen new entries in the KB as a result that can help others and hopefully, as new bugs are identified, will help us all when the next release or update is rolled out.  Here's that link.
    http://support.microsoft.com/oas/default.aspx?gprid=6794
    0
     

    Author Comment

    by:krankie
    Well after posting the above the system was stable for 4 or 5 days, then BOSD'd 3 times in one day.

    I did a restore to late September, before installation of new software and hardware but after upgrade to XP SP2.  I think SP2 is the problem but my system restore calendar does not go as far back as that and I don't really want to uninstall that anyway, I'd rather fix the problem.

    I have installed the Support tools and ran dumpchk.exe.  Here is the output.  It looks like module 'NT' may be the source of the BSOD crashes.  Sounds serious.  Any further advice you can offer?

    ----- 32 bit Kernel Mini Dump Analysis

    DUMP_HEADER32:
    MajorVersion        0000000f
    MinorVersion        00000a28
    DirectoryTableBase  00039000
    PfnDataBase         81800000
    PsLoadedModuleList  8055ab20
    PsActiveProcessHead 80560bd8
    MachineImageType    0000014c
    NumberProcessors    00000001
    BugCheckCode        1000000a
    BugCheckParameter1  805d8617
    BugCheckParameter2  00000002
    BugCheckParameter3  00000000
    BugCheckParameter4  805d8617
    PaeEnabled          00000000
    KdDebuggerDataBlock 8054c760
    MiniDumpFields      00000dff

    TRIAGE_DUMP32:
    ServicePackBuild      00000200
    SizeOfDump            00010000
    ValidOffset           0000fffc
    ContextOffset         00000320
    ExceptionOffset       000007d0
    MmOffset              00001068
    UnloadedDriversOffset 000010a0
    PrcbOffset            00001878
    ProcessOffset         000024c8
    ThreadOffset          00002728
    CallStackOffset       00002980
    SizeOfCallStack       0000036c
    DriverListOffset      00002f80
    DriverCount           00000085
    StringPoolOffset      00005700
    StringPoolSize        00001248
    BrokenDriverOffset    00000000
    TriageOptions         00000041
    TopOfStack            f9cafc94
    DebuggerDataOffset    00002cf0
    DebuggerDataSize      00000290
    DataBlocksOffset      00006948
    DataBlocksCount       00000003


    Windows XP Kernel Version 2600 (Service Pack 2) UP Free x86 compatible
    Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055ab20
    Debug session time: Mon Oct 25 22:28:36 2004
    System Uptime: 1 days 1:49:27
    start    end        module name
    804d7000 806eb780   nt             Checksum: 002160C9  Timestamp: Wed Aug 04 07:19:48 2004 (41108004)

    Unloaded modules:
    f4d96000 f4ed3000   Mtlstrm.sys    Timestamp: unavailable (00000000)
    f4d81000 f4d96000   Slnthal.sys    Timestamp: unavailable (00000000)
    f4ed6000 f5013000   Mtlstrm.sys    Timestamp: unavailable (00000000)
    f4ec1000 f4ed6000   Slnthal.sys    Timestamp: unavailable (00000000)
    f50b3000 f50dd000   kmixer.sys    Timestamp: unavailable (00000000)
    f50b3000 f50dd000   kmixer.sys    Timestamp: unavailable (00000000)
    f50b3000 f50dd000   kmixer.sys    Timestamp: unavailable (00000000)
    f50b3000 f50dd000   kmixer.sys    Timestamp: unavailable (00000000)
    f50b3000 f50dd000   kmixer.sys    Timestamp: unavailable (00000000)
    f50b3000 f50dd000   kmixer.sys    Timestamp: unavailable (00000000)
    f50b3000 f50dd000   kmixer.sys    Timestamp: unavailable (00000000)
    f50b3000 f50dd000   kmixer.sys    Timestamp: unavailable (00000000)
    f50b3000 f50dd000   kmixer.sys    Timestamp: unavailable (00000000)
    f50b3000 f50dd000   kmixer.sys    Timestamp: unavailable (00000000)
    f50b3000 f50dd000   kmixer.sys    Timestamp: unavailable (00000000)
    f50b3000 f50dd000   kmixer.sys    Timestamp: unavailable (00000000)
    f50b3000 f50dd000   kmixer.sys    Timestamp: unavailable (00000000)
    f50b3000 f50dd000   kmixer.sys    Timestamp: unavailable (00000000)
    f50b3000 f50dd000   kmixer.sys    Timestamp: unavailable (00000000)
    f50b3000 f50dd000   kmixer.sys    Timestamp: unavailable (00000000)
    f50b3000 f50dd000   kmixer.sys    Timestamp: unavailable (00000000)
    f50b3000 f50dd000   kmixer.sys    Timestamp: unavailable (00000000)
    f50b3000 f50dd000   kmixer.sys    Timestamp: unavailable (00000000)
    f50b3000 f50dd000   kmixer.sys    Timestamp: unavailable (00000000)
    f50b3000 f50dd000   kmixer.sys    Timestamp: unavailable (00000000)
    f521d000 f5247000   kmixer.sys    Timestamp: unavailable (00000000)
    f5297000 f52c1000   kmixer.sys    Timestamp: unavailable (00000000)
    f5297000 f52c1000   kmixer.sys    Timestamp: unavailable (00000000)
    f5297000 f52c1000   kmixer.sys    Timestamp: unavailable (00000000)
    f5742000 f576c000   kmixer.sys    Timestamp: unavailable (00000000)
    f9ecc000 f9ecd000   drmkaud.sys    Timestamp: unavailable (00000000)
    f5a5e000 f5a6b000   DMusic.sys    Timestamp: unavailable (00000000)
    f5a6e000 f5a7c000   swmidi.sys    Timestamp: unavailable (00000000)
    f580c000 f582f000   aec.sys     Timestamp: unavailable (00000000)
    f9d84000 f9d86000   splitter.sys    Timestamp: unavailable (00000000)
    f5881000 f59be000   Mtlstrm.sys    Timestamp: unavailable (00000000)
    f586c000 f5881000   Slnthal.sys    Timestamp: unavailable (00000000)
    f90e9000 f90f2000   processr.sys    Timestamp: unavailable (00000000)
    f90f9000 f9109000   serial.sys    Timestamp: unavailable (00000000)
    f9be4000 f9be9000   Cdaudio.SYS    Timestamp: unavailable (00000000)
    f950e000 f9511000   Sfloppy.SYS    Timestamp: unavailable (00000000)

    Finished dump check
    0
     

    Author Comment

    by:krankie
    I've just confirmed this with pstat.

    The rogue module looks like ntoskrnl.exe
    0
     
    LVL 27

    Assisted Solution

    by:Asta Cu
    Can you check your version of ntoskrnl.exe?  Can you try turning off Power Management at the BIOS level, if not already done, as well as within Windows?  That exe was a problem, as noted here, but should have been fixed in XP SP2.
    Default Power Management Policy Is Not Applied When You Start Windows XP
    http://support.microsoft.com/default.aspx?scid=kb;en-us;818133
    0
     

    Author Comment

    by:krankie
    The version of ntoskrnl.exe is 5.1.2600.2180 which came with SP2.  

    Can you give me more details on why power management might be the problem?  Also how do you disable this within windows.  I only seem to have options to select different power management profiles, not to switch it off altogether.

    The PC in question is a laptop and the battery is dead.  Interestingly it probably died completely around the time that these problems started so if it is a power management issue I wonder if replacing it would sort things out.  I do get sporadic pop up messages telling me my battery is at 0% despite the fact I am now constantly on mains power.  It could be the dead battery is taking the power management software down paths which have not been fully tested and debugged?

    0
     
    LVL 27

    Expert Comment

    by:Asta Cu
    In Control Panel - power options - for power schemes, I choose office item (if memory serves me) and 'never' for all the pull down options; on one system I do have hibernate on on another not, don't really see a difference; although if hibernate is active, should save all in process work to disk before shutting down.  At the BIOS Level I always have and continue to choose to keep power management off and only use the Windows interface to control that environment; works for me.  

    Dead Battery, bad news, indeed.   Replaced one recently.
    0
     
    LVL 27

    Expert Comment

    by:Asta Cu
    What kind of Laptop is this branch and model?  Using ac/dc charger?  Docked and dead?  Not real clear about your setup.
    0
     
    LVL 27

    Expert Comment

    by:Asta Cu
    0
     

    Author Comment

    by:krankie
    The laptop is a Maxdata ECO 3100x with a UN34BS1-P battery pack.

    I have switched power management off at the BIOS level but no difference.  Still getting BSOD about once per day.  The dead battery is still in place.  The laptop is generally on 24/7 except when being moved.  With the battery being dead it is on mains power.
    0
     
    LVL 27

    Expert Comment

    by:Asta Cu
    I'd like to propose a PAQ vs. Deletion, since we did spend quite some time here with the Asker and the problem as of 11/15 still persisted; my thinking is that Asker may wish to update us and get this back into action .... or if you do refund points, perhaps open a new one and point to the activities here.  Seems a shame to waste all this information and effort with a deletion.
    Thanks for the consideration,
    Asta
    0
     

    Author Comment

    by:krankie
    Quick Update for you.

    Apologies for the length of time but as the BSoD is fairly infrequent it is difficult to give timely updates on the situation.

    After the comments above I decided it was time to buy a new battery to replace the dead one, in the hope that this would also stop the BSoDs from happenning - I had hoped the dead battery was causing problems with the power management leading to the BSoD.

    Unfortunately they are still occurring with the new battery.

    Since reversing out a lot of recently installed software the BSoD seems to be happenning less often, but it is still always at the same address in ntoskrnl.exe.  Occurring once or twice a week now.  I'm just living with it at the moment.

    I'm fairly certain that it is the new version of ntoskernl.exe that came with XP SP2 that is the problem.  I do get the PC to send error reports to Microsoft after a BSoD occurs so maybe I'll just need to wait for the next version of ntoskrnl.exe to come out with a fix for the problem if that is the root of it.

    Is there anything else tro try other than wait for Microsoft?

    I am happy to still award points as the information provided has enabled me to reduce the BSoDs to a more tolerable level, and has been a useful learning experience anyway, even if the problem has not been completely eradicated.

    0
     
    LVL 32

    Expert Comment

    by:Luc Franken
    krankie,

    Frankly it surprizes me the change of the battery helped a little, but ok, it might surely solve some stability issues.
    What I still suggest you to check (and replace if possible) is the RAM. The way you stated your original question my first suspect is either the RAM or an overheating processor.
    For the last one, please check all ventilation holes and fans in your laptop.

    LucF
    0
     

    Author Comment

    by:krankie
    Another interesting point there from LucF.

    The laptop is signed up to a Grid computing project that runs the processor constantly at 100%.  This is the reason it is also on 24/7.  I'll disable this for a week or so and see if it helps.

    I still think it is the XP SP2 version of ntoskernl.exe personally as these BSoDs only started occurring after I installed XP2 around August / September or whenever it was the Home edition patch was made available.  I have been on the grid computing project since November last year without any problems.

    However, it is worth a try if only to eliminate it from enquiries.
    0
     
    LVL 32

    Expert Comment

    by:Luc Franken
    A laptop running 24/7 on 100% computing power isn't a great idea... overheating seems to be very likely now. :)
    I surely hope that'll be the end of this problem.

    LucF

    p.s. which project are you into? distributed.net/seti or maybe just the main grid.org? (personally I've been into distributed.net a long time)
    0
     

    Author Comment

    by:krankie
    Grid.org.

    I have been running it since November 2003 and have clocked up 313 days crunching with the laptop running 24/7 without any problem up until August / September.

    I'll need to leave it at least a week to report back though as the BSoDs are not frequent enough to make a quick observation about the difference this will make.
    0
     

    Author Comment

    by:krankie
    Killing the distributed computing project made no difference.  In fact on one occassion I was using the PC outdoors in freezing temperatures and it BSOD'd 3 times in an hour which was very annoying.  For this reason i don't think it has got anything to do with overheating processor.

    Also repeated runs of memtest are finding nothing.  

    My own opinion still remains that it is not a hardware issue, and that the new version of ntoskernl.exe is at fault.  I have never had a single one of these BSODs prior to the XP SP2 upgrade, even with grid.org running 24/7. Now they occur randomly and are becoming increasingly inconvenient.

    0
     
    LVL 32

    Expert Comment

    by:Luc Franken
    Hmm... :(
    You might want to try the systemfile checker, just to be sure no parts of your installation are corrupt.
    Start => Run => type "SFC /scannow" (without the quotes) and press enter.

    Description of Windows XP and Windows Server 2003 System File Checker (Sfc.exe)
    http://support.microsoft.com/?kbid=310747

    Another thing (just to sort it out)
    Have you checked for virusses and ad/spyware lately?

    LucF
    0
     

    Author Comment

    by:krankie
    I can virtually guarantee that there is no virus, spyware or other malware on the PC. Virus signature files and scans are scheduled automatically on the PC and Ad-Aware is run manually a few times each month.The PC is also fully protected behind both hardware and software firewalls.

    SFC ran for about 15 or 20 minutes then just disappeared when finished with no messages about its progress. Is that normal?
    0
     
    LVL 32

    Expert Comment

    by:Luc Franken
    Yes, that's normal :( It'll give you a message in case it finds errors.
    I'm kind of at a loss at the moment, SP2 has been pretty stable on all computers I've installed it on.

    I'm wondering if you might have any programs installed that interfere with SP2.
    You might want to try the following:
    Start => Run => type "MSCONFIG"
    Look at the startup tab, untick everything except your virusscanner (and firewall in case you don't use the winXP one)
    Reboot and see if the problem still occurs.

    Also, you might want to take a look at:
    Programs that are known to experience a loss of functionality when they run on a Windows XP Service Pack 2-based computer
    http://support.microsoft.com/?kbid=884130
    See if you have any or more of those installed.

    LucF
    0
     

    Author Comment

    by:krankie
    None of the software mentioned in that Microsoft article are installed.  I have disabled all the programs in msconfig that I don't need on a dyt-to-day basis but still no joy.

    Time for drastic action as I am convinced this is a Windows XP SP2 installation problem and not a hardware issue.  Time to re-install windows.

    I have an OEM installation of Windows XP Home Edition and I do still have the recovery disk that came with the PC.  Will doing an in-place reinstallation mean I have to reinstall all software applications or should these all still be there and working properly afterwards?
    0
     
    LVL 32

    Expert Comment

    by:Luc Franken
    With an in-place installation all your data and programs *should* still work fine, but it's never a bad idea to make a backup of your valuable data just in case anything goes wrong.

    I still doubt if ntoskernl.exe is the culprit, most likely some other program/driver.
    You might want to see if you have uncertified drivers on your computer, and take a look if you can find certified drivers for them. (note that most printerdrivers are not signed, but you can consider those as pretty safe)
    Start => Run => "sigverif"

    LucF
    0
     

    Author Comment

    by:krankie
    Quick update.

    I tried an in-place installation, but the recovery disk wouldn't let me as the version of Windows on the recovery disk was older than the version on the PC.   What were they expecting when XP has automatic update functionality built into it?!

    Tried a full installation and ended up with two copies of XP installed on the PC, with a new menu on startup to chose which operating system to load.  The new one only had the Recycle Bin on the desktop.

    I decided this was the wrong route to go down and backed the new installation out.  I'll try again tonight to get in-place installation to work.  Any clues how to get around the 'not letting you install an older version' problem?

    I've increased the points for this question as the scope has widened slightly and both main contributors have already put considerable effort into this.
    0
     
    LVL 32

    Expert Comment

    by:Luc Franken
    >>but the recovery disk wouldn't let me<<
    You don't have a normal windows cd-rom? Most recovery won't let you do an in-place installation, but only a repair or a clean installation :(

    LucF
    0
     

    Author Comment

    by:krankie
    No its an OEM installation so the recovery CD is the only one I have.  I might try giving the laptop manufacturer a call about it as it says on the CD that they provide the support for it, which seems reasonable for an OEM install.
    0
     

    Author Comment

    by:krankie
    Just called them and they recommended a full install from scratch, overwriting the partition thus meaning everything else will need to be re-installed from scratch.  Time to make an inventory and back up loads of data.  :-(

    I'll be leaving this task until the weekend so if you can think of anything before then please let me know.
    0
     
    LVL 27

    Expert Comment

    by:Asta Cu
    I would want and expect ZERO points here, but think others are worthy of splits.  But then, your call, Lee .... and thanks for your hard work to finalize what Asker's don't.
    Thanks,
    Asta
    0
     

    Author Comment

    by:krankie
    I'm sorry you think I've not finalised this, Asta.

    The problem is the fault is fairly random.  I don't get any incidents for a week, which is fine, and then I get three BSoDs in a day, which is unacceptable.  I've tried all the suggestions but with the fault being sporadic it takes time to see if the suggested solution has actually had any effect.

    None of the suggested solutions so far has solved the problem and I am going to go for a re-install of windows, which will probably now be next weekend.

    With this being the case in theory there should be no points awarded, however I have learnt a lot from this experience and my own opinion is that astaec and LucF should be awarded an equal split of the points.

    You have both given me great advice and I thank you both sincerely for assisting in a problem like this where the solution was never going to be a black-and-white one with a definitive answer.  You could easily have ignored this thread and gone bagging points on threads where the answer was easy, clear and abvious.  To your credit you have stayed with me and kept giving me things to try.  Nothing has worked and I'm going to have to go for a complete re-install but I think points should be awarded for at least giving me things to try before having to go down that route.

    Admin can you give me some guidance here please.  Am I allowed to award points without the problem being resolved?
    0
     
    LVL 32

    Expert Comment

    by:Luc Franken
    krankie,

    Definately a big thanks!
    Although sadly we weren't able to help you all the way through your problem I highly appreciate this.
    I hope you have a bit more luck with a fresh installation and with the future running of your system.

    Take good care,

    Luc
    0
     
    LVL 27

    Expert Comment

    by:Asta Cu
    Thank you, Krankie; sorry for the delay, have been offline.

    I second the feelings that LucF noted above; and hope to hear from you further if anything changes here after a reinstall, which is your plan.  Without log entries that are specific, and the issues we've seen here, it's definitely tough to isolate cause.  After a reinstall, be sure to get with WindowsUpdate and for any office-related applications, http://www.officeupdate.com to ensure that you've got patches, etc. as needed.

    Best wishes and thanks again,
    Asta
    0

    Write Comment

    Please enter a first name

    Please enter a last name

    We will never share this with anyone.

    Featured Post

    What Security Threats Are You Missing?

    Enhance your security with threat intelligence from the web. Get trending threat insights on hackers, exploits, and suspicious IP addresses delivered to your inbox with our free Cyber Daily.

    Can you find a fax from a vendor you saved a decade ago in seconds? Have you ever cursed your PC under your breath during an audit because you couldn’t find the requested statement or driver history?  If you answered no to the first question or yes …
    Ok I have been working on this for some time having learned and gained certification in XenDesktop 4 along came version 5 which was released last month. Since then I have been working to deploy XenDesktop 5 in a small environment with only 2 virt…
    To add imagery to an HTML email signature, you have two options available to you. You can either add a logo/image by embedding it directly into the signature or hosting it externally and linking to it. The vast majority of email clients display l…
    Migrating to Microsoft Office 365 is becoming increasingly popular for organizations both large and small. If you have made the leap to Microsoft’s cloud platform, you know that you will need to create a corporate email signature for your Office 365…

    933 members asked questions and received personalized solutions in the past 7 days.

    Join the community of 500,000 technology professionals and ask your questions.

    Join & Ask a Question

    Need Help in Real-Time?

    Connect with top rated Experts

    17 Experts available now in Live!

    Get 1:1 Help Now