Link to home
Start Free TrialLog in
Avatar of BrianGEFF719
BrianGEFF719Flag for United States of America

asked on

System Unstable

Hello I'm Using XP Pro SP2 and my system is constantly getting blue screens. Its obviously from a driver because the error message is IRQL_NOT_LESS_OR_EQUAL, but sometimes Win32k.sys will crash and blue screen also.


How can I trouble shoot this?


-Brian
Avatar of cpc2004
cpc2004
Flag of Hong Kong image

Whenever Windows crashes, it writes a system event 1001 and a minidump to the folder \windows\minidump
Check system event 1001 and it has the content of the blue screen

Control Panel -> Adminstrative Tools -> Event Viewer -> System -> Event 1001. Copy the content and paste it back here

I also want to know your software list
Run  msinfo32 and navigate to Software > Program Group. Click anywhere in the right pane.  Press CTRL-A and then CTRL-C. Copy that data to the clipboard and paste that data
Avatar of Caeser_Augustus
Caeser_Augustus

You may want to try booting into safe mode if you can't do the steps cpc2K4 suggested in normal mode.
Amd while at it, check if it happens in safe mode or not.
Avatar of BrianGEFF719

ASKER

IS this what you want:

The computer has rebooted from a bugcheck.  The bugcheck was: 0x1000008e (0xc000001d, 0xbf85783c, 0xeffa5ef8, 0x00000000). A dump was saved in: C:\WINDOWS\Minidump\Mini120904-01.dmp.
While I was posting that it did it again:

The computer has rebooted from a bugcheck.  The bugcheck was: 0x10000050 (0x92c71749, 0x00000000, 0xf7bee5e4, 0x00000000). A dump was saved in: C:\WINDOWS\Minidump\Mini121004-01.dmp.
I got another one of:

PAGE_FAULT_IN_NON_PAGED_SYSTEM_AREA
Can you attach Mini121004-01.dmp at any webspace as I want to process the duimp and find out the culprit. You can find the minidump at the folder \windows\minidump
Can I email it to you?

-Brian
ASKER CERTIFIED SOLUTION
Avatar of cpc2004
cpc2004
Flag of Hong Kong image

Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
SENT
I've processed the Mini121004-01.dmp and the failing module is alcxsens.sys which is realtek AC97 sound card driver.
The failing module of Mini120904-01.dmp is win32k.sys and the failing module at Mini121004-02.dmp  is ntoskrnl.exe. Both of them are not the culprit and they are victim.

BugCheck 10000050, {92c71749, 0, f7bee5e4, 0}
Probably caused by : ALCXSENS.SYS ( ALCXSENS+505e4 )

I've searched google using the timestamp 403A423D and no hit but there has a lot of hits relating alcesens causing windows crash.

ALCXSENS.SYS Tue Feb 24 02:11:09 2004 (403A423D)
nv4_disp.dll Thu Mar 25 02:38:36 2004 (4061D5AC)

1) I have two suggestion upgrade the latest pathc of realtek AC97 sound card driver.

2) After you upgrade realtek driver and the problem still occurs. Then it is your nVidia Display card driver is incompatible with XP SP2. Install Version: 61.77 Release Date: July 27, 2004 http://www.nvidia.com/object/winxp_2k_61.77.html
Version 61.77 is the stable version and don't upgrade to current version which is unstbale.

You have to do it one by one. Don't install two patches at the same time. Otherwise I duno who is the culprit. Btw do you get the blue screen after your windows is upgraded to SP2 and you didn't have this problem at SP1?


Hope it can help you
cpc2004
Wow, What a response. I never had this Problem with SP1 because I just went straight to SP2.


-Brian
When did you start to have the blue screen? Check the system event 1001.

If can print out all the system event 1001, I can determine whether it is nVidia Display card problem, Realtek Sound Card Driver or faulty ram as IRQL_NOT_LESS_OR_EQUAL may be related to faulty ram or device driver. If you can provide more information, I can provide better answer.
I can test the ram if you feel that my problem might be related to ram.
i went back to the driver you suggested for nVidia Card, now for the sound card, its on board sound and I have the latest driver? This is also the first time i've had a problem with sound card.


-Brian
I only have the information for three of your crashes. Actually I have no idea how frequently your windows crashes and what is bugcheck code of the crashes? Base upon three crashes, they have different bugcheck codes. If the crashes are consistent and the failing instruction address of the crash are the same, I can confirm the root cause. Base upon the information that you provide, I can only make a prelimary finding as I've resolved a lot of blue screen problem at SP2 and the culprit is nVidia Display Card in the recent two months.

Hope it can help you
After switching to the nVidia driver you recommended I still had a blue screen happen.

I'm using the latest realTek Sound Drivers too...


Suggestions?
-Brian
Please attach the latest minidump at the webspace and I will investigate why it still fails.
Okay, I gave up, I disabled onBoard sound and installed a new SBLive Sound Card, ill keep you posted, but for now, take a look at the latest minidumps I sent you...


-Brian
From the time stamp of nv4_disp.dll, I confirm that your nVidia Driver is updated to version 61.77
nv4_disp.dll Fri Jul 16 03:13:32 2004 (40F6D75C)

Mini121004-04.dmp  BugCheck 1000007F, {8, 80042000, 0, 0} ntoskrnl.exe ( nt+9e7e )
Bugcheck code 7F is UNEXPECTED_KERNEL_MODE_TRAP_M

Mini121004-05.dmp  BugCheck 1000008E, {c0000005, bf8463f2, efd28c3c, 0} ( win32k+463f2 )
Bugcheck code 8E is KERNEL_MODE_EXCEPTION_NOT_HANDLED_M

It looks like it is a storage overlaid problem and cause windows crashes with different bugcheck code.  Unless you take the full dump, it is impossible to find out the culprit. Hardware problem also can unpredicatable error hence the failing bugcheck code is also random.

I've processed 5 minidump and each dump has different bugcheck code. I think it is worthwhile to make sure the hardware is healthy. Install Prime 95 to stress test your PC's memory, cache memory of CPU and mother.

http://www.mersenne.org/freesoft.htm      

My first windows crash was related to faulty on-board sound from realtek. Whenever windows play  an acknowledge sound from the internet, my windows crashes with blue screen. This was my first time to diagnostic windows blue screeen problem. Finally  I found out the culprit is the on-board reaktek sound card driver. I download the latest patch and the system freeze when internet an acknowledge sound.  Finally I gave me and install a sound card. For your case, it may be related to hardware, stress test your PC. If you cannot find any hardware error, install new sound card.

cpc2004
I reprocessed the Mini120904-01.dmp and it reported the probable cause is hardware. You had better run stress test before you install SB sound card.


Loading Dump File [C:\Problem Determination\Minidump\XP\SP2\Mini120904-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1000008E, {c000001d, bf85783c, effa5ef8, 0}

***** Kernel symbols are WRONG. Please fix symbols to do analysis.

Unable to load image win32k.sys, Win32 error 2
Probably caused by : hardware ( win32k+5783c )


Send me more dumps if you have as I want to analyze the failing pattern. If it is a hardware problem, I will expect the crash has no pattern (random). Usually software error, the crash pattern repeat several times.

cpc2004
Your latest dump Mini121004-07.dmp shows that you have installed Sound Blaster PCI sound card . It crashes with bugcheck code 0A (ie IRQL_NOT_LESS_OR_EQUAL). Bugcheck code 0A can be software or hardware error. You should run the stress test to check your hardware.

BugCheck 1000000A, {30bb, ff, 0, 804df955}
Probably caused by : ntoskrnl.exe ( nt+8955 )

es1371mp.sys Fri Jul 20 06:28:37 2001 (3B575F15)
The creative SB PCI card driver is three years behind. Can you install the latest driver.

After running prime 95, I am getting Illegal Sumout erros, which prime95 says under windows XP is a hardware error? What hardware do you suggest I test? RAM or CPU? and what programs do you suggest I use to isolate the problem.

-Brian
The hardware problem may be faulty ram, faulty cache memory of CPU, faulty cache memory of the mother board or Power Supply unit.  If I were you, I will run the stress test at least 5 more times and verify the result.  

If you have two memory sticks, take one memory stick. If your PC still crashes, swap it with another memory stick. If it still crashes, it may be CPU or motherborad. You have to take PC to the computer shop to do hardware diagnostic.




After doing an hr 1/2 memory diagnostic it appears RAM is okay, so I belive that its either CPU or MB. How can I test CPU for hardware faults?


-Brian
Mother board monitor      http://mbm.livewiredev.com/      
overheat      http://www.hmonitor.com/      
How do I determine whether the problem is on the motherboard or processor?

-Brian
Further analysis your problem. It is storage overlaid problem and I believe that the realtek sound card driver is overlaid because when I unassemble the a few statement before the failing instruction. I find storage from f7bee5d8 to fb7bee5de was overlaid with hexidecimal value x'cc'

Mini121004-01.dmp   10000050 (0x92c71749, 0x00000000, 0xf7bee5e4, 0x00000000)  ( ALCXSENS+505e4 )
      eax=82161f10 ebx=00000000 ecx=82161f10 edx=81c97008 esi=8216f1e8 edi=81853000
      eip=f7bee5e4 esp=f8958d38 ebp=f8958d54 iopl=0         nv up ei ng nz na po nc
      cs=0008  ss=0010  ds=0023  es=0023  fs=0030  gs=0000             efl=00010286
      ALCXSENS+0x505e4: f7bee5e4 8a54c8b9         mov     dl,[eax+ecx*8-0x47]     ds:0023:92c71749=??
      f7bee5d8 cc               int     3  
      f7bee5d9 cc               int     3
      f7bee5da cc               int     3
      f7bee5db cc               int     3
      f7bee5dc cc               int     3
      f7bee5dd cc               int     3
      f7bee5de cc               int     3
      f7bee5df cc               int     3
      f7bee5e0 8b442404         mov     eax,[esp+0x4]
      f7bee5e4 8a54c8b9         mov     dl,[eax+ecx*8-0x47]   <------ Failing instruction
      f7bee5e8 c9               leave

Can you attach ALCXSENS.sys at any webspace as I want to confirm how many bytes are overlaid? One device driver is faulty and overlaid windows storage  randomly hence you have different bugcheck code. As you have changed the sound card hence RealTek Sound Card Driver is not the culprit. I will examine all of the device driver and try to find out the culprit. I will get back to you soon.

Anyway it is worthwhile to stress test your hardware to make sure your hardware is fine.

cpc2004
 
I dont know if this is anyhelp to you but, I currently have my hard drives set up in a raid 0 configuration. Using a VIA Raid Driver, I have two western digital raptor 10,000rpm 32.6gb SATA drives (nice huh?). Could that be contributing to the problem at all?

-Brian
According to my experience the USB modem driver always has software problem, I've examined all of your USB modem driver BrUsbMdm.sys (Wed Jun 13 04:51:46 2001) which may be incompatible with XP SP2. Do you have any spare modem? If yes, uninstall USB modem and install new modem. Maybe it can resolve your problem.

BTW when did start to have this problem? Does it occur after you upgrade SP2?
Acctually, thats my MFC (Brother 3820cn). I've always had SP2, I built the system and threw SP2 right on it, ill update my brother drivers.

-Brian
But like I said, Prime95 suggested that I have a HARDWARE PROBLEM.

-Brian
The result of Mini120904-01.dmp indicates that it may be is a hardware error
BugCheck 1000008E, {c000001d, bf85783c, effa5ef8, 0}
Unable to load image win32k.sys, Win32 error 2
Probably caused by : hardware ( win32k+5783c )

c000001d --> STATUS_ILLEGAL_INSTRUCTION
win32k+5783c bf85783c ffff

It seems that the instruction address is shift to right hand side by one byte because if the eip pointer shift to left hand side by one byte then it is valid instruction.

ffff is not a valid instruction but b1ff and ff8b4dff089 are valid intel instruction set.
b1ff                 mov cl,0xff
ff8b4dff089      dec dword ptf [ebx,0x890ff4d]

I've searched google to look for CPU hardware  cause instruction address shift one byte and no hit. Another possibility is software error, the branch address is invalid but I cannot confirm as I don't the source code of microsoft windows kernel.

I suggest you to take your PC to computer shop to do the hardware health check. Fix hardware error is much easier than software error.




This issue is still un-resolved...I dont know exactly what to do, because I have not determined that its a hard ware problem fully yet and I still dont know what piece of hardware it is if it is a hardware problem.


-brian
The ramtest and prime 95 both test the memory and cache memory. If they find the error, they cannot tell you  which hardware component fails.

Fix hardware problem is much easier to resolve but it is expansive. The hardware techican can swap the memory, CPU or motherboard to find out which hardware is malfunction. For software problem it is much harder to fix. First you have to find out the culprit. Second after you find the culprit, how to resolve the problem. as some software may have not the patches.

I have two suggestion
1) Expansive solution : take the PC to computer shop to perform the hardware diangostic.
2) Ecomonic solution: re-install windows may be some device drivers are messed due to de-installation of unused software. A clean re-install can resolve the problem. There has no software tools to scan the integrity of windows device driver. I hope Microsoft can have this tool at Longhorn.

Hope it can help you

Here is the thing, I do computer repair, I have access to memory, motherboards and processors, the problem is, the error occours so sparadically (spelling :(, that I its hard to tell whats causing it. I've tested ram fully, and ram is fine.

May be the problem is at the cache memory of the CPU, motherboard, video memory or power supply unit. At Computer shop they can swap the hardware to identify which hardware component is malfunction.

 
Ironically I brought home a new processor and new ram and a new board from work, and my system stopped crashing, so if it happens again, i'm going to yank everything out and start the RMA process on all three! he he...

thanks for your help though