Problem with BSODs

Hello all.

I am having problems with Windows XP BSODs (actually, it looks like a problem of all NT based systems - I have tried installing Win2000 and even Win2003 Server Trial version - same BSODs; Linux seems to work fine though). BSODs occur randomly, sometimes after logon, sometimes when logging in, sometimes WinXP runs for several days with no BSODs... There have been some cases, when I could tell - "hey, I have BSOD coming" - some program starts crashing, after being lauched again it crashes again, WinXP starts working a bit slower... A minute or two later - BSOD...

This should not be the overheating issue - for example, I can play Grand Theft Auto: San Andreas and Half-Life 2 on max settings for hours. CPU temperature stays at ~70C, motherboard at ~50C, but it doesn't crash, give me BSOD or something... Another day I logon to Windows, check my mail, then click on Start button or do something else - bang, BSOD. It happens randomly (at least it looks like that), so I can't find what is responsible for the crash...

I have uploaded my minidumps to http://www.geocities.com/gedazx/minidumps.zip. Some of them refer to ntfs.sys driver, I hope I have fixed the problem by chkdsk'ing my disk... But most of them say this: MODULE_NAME:  nt; FAULTING_MODULE: 804d7000 nt. The address (804d7000) is always the same, so I guess it's some kind of instruction or function that make WinXP crash... Anyway, I ask you to help me find out what is crashing my PC. At first, I offer 250 points; however, if someone manages to find the source of BSODs and that helps to fix an issue, I will give 1000 more points. Changing the parts is the last resort - I really don't want to pay additional money for them, because I don't believe that, for example, double clicking on My Computer can crash the system, when Half-Life 2 running for 10 hours, can not...

System specs (copied from EVEREST, if you need something else, please ask):
Operating System      Microsoft Windows XP Professional
OS Service Pack      Service Pack 2
Internet Explorer      6.0.2900.2180 (IE 6.0 SP2)
DirectX      4.09.00.0904 (DirectX 9.0c)
      
CPU Type      Intel Pentium 4E, 2800 MHz (14 x 200)
Motherboard Name      Unknown
Motherboard Chipset      Intel Springdale i865PE
System Memory      512 MB  (DDR SDRAM)
BIOS Type      Asus AMI (01/14/04)
Communication Port      Communications Port (COM1)
Communication Port      Communications Port (COM2)
Communication Port      ECP Printer Port (LPT1)
      
Video Adapter      RADEON 9800 PRO - Secondary  (128 MB)
Video Adapter      RADEON 9800 PRO  (128 MB)
3D Accelerator      ATI Radeon 9800 Pro (R350)
Monitor      LG Flatron 1715S  [17" LCD]  (1405105283)
      
Audio Adapter      Intel 82801EB ICH5 - AC'97 Audio Controller
      
IDE Controller      Intel(R) 82801EB Ultra ATA Storage Controllers
IDE Controller      Intel(R) 82801EB Ultra ATA Storage Controllers
SCSI/RAID Controller      NERO IMAGEDRIVE SCSI Controller
Disk Drive      WDC WD1600JD-00HBB0  (149 GB, IDE)
Optical Drive      LITE-ON DVDRW SOHW-832S  (DVD+R9:2.4x, DVD+RW:8x/4x, DVD-RW:8x/4x, DVD-ROM:12x, CD-RW:40x/24x/40x DVD+RW/DVD-RW)
Optical Drive      NERO IMAGEDRIVE2 SCSI CdRom Device  (Virtual CD-ROM)
SMART Hard Disks Status      OK
      
Input      
Keyboard      Standard 101/102-Key or Microsoft Natural PS/2 Keyboard
Mouse      Microsoft PS/2 Mouse
      
Network      
Network Adapter      Realtek RTL8139/810x Family Fast Ethernet NIC
      
Printer      Samsung ML-1250/ML-250
USB1 Controller      Intel 82801EB ICH5 - USB Universal Host Controller
USB1 Controller      Intel 82801EB ICH5 - USB Universal Host Controller
USB1 Controller      Intel 82801EB ICH5 - USB Universal Host Controller
USB1 Controller      Intel 82801EB ICH5 - USB Universal Host Controller
USB2 Controller      Intel 82801EB(M) ICH5(-M) - Enhanced USB2 Controller

Thank you in advance.
GedaZXAsked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

PeregianCommented:
Try  running the verifier tool as described here. http://techrepublic.com.com/5100-10877_11-5714091.html# 
That might help identify the problem driver or hardware.
GedaZXAuthor Commented:
Tried it with "all drivers" setting earlier - no results...
cpc2004Commented:
Your minidumps have 7 bugcheck code (ie 0A, 24, 50, 7E, 8E, C2 and C9). Those bugcheck codes are related to RAM problem

Bugcheck code    Number of occurences
0A                     14
7E                      1
8E                      4  
24                      2
50                      1
C2                      1
C9                      1

The stack trace of bugcheck 24 shows that the crash occurred when a file was closed. Maybe the chkdsk can fix your problem.

STACK_TEXT:  
f8972b94 805076e0 00000400 f8972bbc f83ec6ec nt!FsRtlUninitializeFileLock+0xc
f8972ba0 f83ec6ec 00000400 e24fb4c0 e24fb588 nt!FsRtlFreeFileLock+0xd  
f8972bbc f83e0cb4 81d57760 f8970705 e24fb4f0 Ntfs!NtfsDeleteScb+0xeb
f8972bd4 f83bb7a9 81d57760 e24fb588 00000000 Ntfs!NtfsRemoveScb+0x88
f8972bf0 f83e0a9b 81d57760 e24fb4c0 00000000 Ntfs!NtfsPrepareFcbForRemoval+0x52
f8972c38 f83bb759 81d57760 e24fb588 00000000 Ntfs!NtfsTeardownStructures+0x5b
f8972c64 f83de6eb 81d57760 004fb588 00000000 Ntfs!NtfsDecrementCloseCounts+0x9e
f8972ce8 f83e6e13 81d57760 e24fb588 e24fb4c0 Ntfs!NtfsCommonClose+0x397
f8972d7c 804e23b5 00000000 00000000 823c7640 Ntfs!NtfsFspClose+0xe3  <--- ?? close file
f8972dac 80574128 00000000 00000000 00000000 nt!ExpWorkerThread+0xef
f8972ddc 804efc81 804e22f1 00000000 00000000 nt!PspSystemThreadStartup+0x34
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16


Suggestion
1. Run chkdsk /r
2. Run memtetst  http://www.memtest86.com
3. Reseat memory to another memory slot

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
Exploring ASP.NET Core: Fundamentals

Learn to build web apps and services, IoT apps, and mobile backends by covering the fundamentals of ASP.NET Core and  exploring the core foundations for app libraries.

GedaZXAuthor Commented:
Thank you for your answer. I have tried reseating memory earlier, it didn't help. I have tried Memtest and Microsoft RAM checking utility too, it ran for ~30 minutes, no errors.

Checking disks now... Those disk errors are probably caused by those BSODs, so I guess I will have to put autochk back to the BootExecute parameter...

I suspected RAM too, but, well, those new 3D games are probably using 99% of available RAM all the time and still no BSODs while playing... Not a single one...

Maybe I should get a "complete" dump and put the information WinDbg gives here?
cpc2004Commented:
Some faulty RAM can pass memtest.  Your XP have 14 crashes with bugcheck 0A and they are crashed at the same instruction address (ie nt!MiDecrementCloneBlockReference+a).  I don't have the source code and it is very hard to find out why windows crashes. I believe that it is memory overlay issue as some windows system data area is corrupted. The data area may be corrupted by hardware or software driver. Usually the current running process is the culprit that overlay the system data area. However the minidump does not have information of the running process. Full memory have the detail of the current running process.

From the stack trace of bugcheck 0A, the crash was encountered when Windows try to celan up virtual memory when a thead is terminated. The system data area is pointed by register ebp with offset 8 is corrputed with zero.

Storage pointed by register ebp
b8985a3c  b8985a74 80529e45 00000000 e1000000  tZ..E.R.........
                                              ^^^^^^
IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 0000001c, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000001, value 0 = read operation, 1 = write operation
Arg4: 8053f6a9, address which referenced memory

STACK_TEXT:  
f8042b44 80529e45 00000000 e1000100 81bd9020 nt!MiDecrementCloneBlockReference+0xa
f8042b7c 804eede3 c00006c4 001b1000 00000000 nt!MiDeletePte+0x324
f8042c40 80503c21 000001c4 0023ffff 00000000 nt!MiDeleteVirtualAddresses+0x162
f8042c80 8058c292 01bd9020 81c00da8 81c00ff0 nt!MmCleanProcessAddressSpace+0x262
f8042d08 805739b4 00000000 81c00da8 00000000 nt!PspExitThread+0x621
f8042d28 8058c631 81c00da8 00000000 f8042d64 nt!PspTerminateThreadByPointer+0x52
f8042d54 804dd99f 00000000 00000000 0012ff10 nt!NtTerminateProcess+0x118
f8042d54 7c90eb94 00000000 00000000 0012ff10 nt!KiFastCallEntry+0xfc
FOLLOWUP_IP:
nt!MiDecrementCloneBlockReference+a
8053f6a9 ff4b1c           dec     dword ptr [ebx+0x1c]

SYMBOL_STACK_INDEX:  0
FOLLOWUP_NAME:  MachineOwner
SYMBOL_NAME:  nt!MiDecrementCloneBlockReference+a
MODULE_NAME:  nt
DEBUG_FLR_IMAGE_TIMESTAMP:  42250f77
STACK_COMMAND:  kb
IMAGE_NAME:  memory_corruption
FAILURE_BUCKET_ID:  0xA_W_nt!MiDecrementCloneBlockReference+a
BUCKET_ID:  0xA_W_nt!MiDecrementCloneBlockReference+a

eax=00000000 ebx=00000000 ecx=c000c6c4 edx=81dcd144 esi=e1000000 edi=00000000
eip=8053f6a9 esp=b8985a34 ebp=b8985a3c iopl=0         nv up ei pl zr na po nc
cs=0008  ss=0010  ds=0023  es=0023  fs=0030  gs=0000             efl=00010246
nt!MiDecrementCloneBlockReference+0xa:
8053f6a9 ff4b1c           dec  dword ptr [ebx+0x1c] ds:0023:0000001c=????????

nt!MiDecrementCloneBlockReference:
8053f69f 8bff             mov     edi,edi
8053f6a1 55               push    ebp
8053f6a2 8bec             mov     ebp,esp
8053f6a4 51               push    ecx
8053f6a5 53               push    ebx
8053f6a6 8b5d08           mov     ebx,[ebp+0x8]          <--- move 0 to ebx ??
8053f6a9 ff4b1c           dec     dword ptr [ebx+0x1c]   <--- failing at here
8053f6ac 56               push    esi


If they are difficult instruction address, I will believe that it is RAM problem.  Base upon the availale information, most likely it is either hard disk with broken link, faulty hardware such as RAM or CPU, software driver error. Faulty RAM is the number 1 suspected culprit. If you have time, re-install windows may be one of the solution.


If you can provide the full memory dump, I can further analysis the problem.
cpc2004Commented:
Mini070205-01.dmp crahed with bugcheck code C9
Probably caused by : PciBus.sys ( PciBus+36e )

Pcibus.sys does not belong Microsoft. Can you get rid of this module from your windows?


DRIVER_VERIFIER_IOMANAGER_VIOLATION (c9)
The IO manager has caught a misbehaving driver.
Arguments:
Arg1: 00000224, (Fatal error) An IRP dispatch handler has returned a status that is inconsistent
      with the IRP's IoStatus.Status field. (Dispatch handler routine, IRP, IRP's
      IoStatus.Status, and returned Status specified.)
Arg2: f8b5636e
Arg3: 00000000
Arg4: 00000000

Debugging Details:
------------------
BUGCHECK_STR:  0xc9
ERROR_CODE: (NTSTATUS) 0xc9 -  @ ~ t   L k     %1 C
DRIVER_VERIFIER_IO_VIOLATION_TYPE:  224

FAULTING_IP:PciBus+36e  f8b5636e 55               push    ebp
GedaZXAuthor Commented:
Thanks a lot for this analysis. I will try to get rid of that pcibus.sys (I got BSOD mentioning it when trying to run PCMark05. After reboot, I could run this program without BSOD. Strange again...) and see if that solves the problem.

Something else - IRQ 16 is shared by my video card and two USB universal host controllers; IRQ 18 - by Ultra ATA Storage controller and another USB universal host controller. Could this be a problem?
cpc2004Commented:
IRQ conflict is no longer an issue.  When did you upgrade ATI display card driver? As the 2 crashes with  bugcheck 8E are probably caused by ATI display card driver.
cpc2004Commented:
I've searched google and no similar hit as yours. My prelimary finding is still hardware problem (faulty RAM or CPU L2 cache memory). Your PC has 512MB. If it has two memory stick, take out a memory stick. If no more BSOD occurs, that memory stick is faulty. If it still crashes, swap with another memory stick. If it still crashes, probably it is the faulty L2 cache memory of the CPU.  As you have re-install your PC with W2K and W2k3. The BSOD still exist.
GedaZXAuthor Commented:
ATI driver is the newest one... I remember having BSODs both with older and newest versions of it.

I will try reinstalling WinXP tommorow and installing drivers step-by-step, maybe that will help to identify the problem...
GedaZXAuthor Commented:
Regarding RAM - it's Dual DDR, 2 chips with 256 mb each. I will try swapping/removing sticks if the "find that damn driver" way doesn't work... But, shouldn't Linux OS and Windows games have problems with the RAM as well? :/
BillDLCommented:
Did you run the Microsoft memory Testing Utility by pressing "T" to make it run the FULL tests?

30 minutes might be sufficient to run the 6 (I think it is 6) basic tests, but the advanced tests can take several hours and will test your memory using a lot more patterns that can reveal problems which won't always be discovered from the basic test mode.

Try disabling the level 2 cpu cache memory from CMOS Setup and see what happens.  The computer will probably be unbearably slow, but if the bsod's cease, then you may well have discovered the culprit.

You say that you have SP1 installed.  Had it been SP2 and a Prescott cpu, then this page would have made interesting reading in relation to the level2 cache:

http://cquirke.mvps.org/sp2intel.htm

I have looked at known issues on the Intel site for YOUR motherboard/processor, but I don't see any that seem to relate.  That is not to say that there AREN'T any similar issues, just that they haven't been documented by Intel.  Remember that, even if you have SP1 installed, Windows update may well have updated some system files to SP2 versions.
GedaZXAuthor Commented:
Hello, BillDL.

IIRC, I ran Microsoft utility on basic settings... I will try to run the full tests, thanks for advice.

That page looks interesting, I will read it. I DO have SP2, as said in the specs (OS Service Pack - Service Pack 2) AND Prescott... Thanks for the finding, never fought that there might be a conflict or something like that.

BTW, my motherboard is Asus P4P800-F.

P.S. Sorry, it looks like there is a limit for the points, so I have assigned the maximum (500 points) for the answer, not 1000 as promised.
GedaZXAuthor Commented:
Ok, I tried running Microsoft RAM testing utility. Extended tests, 4 loops - no problems...
BillDLCommented:
Whoops, sorry, I could have sworn I read SP1 somewhere, but I thought your motherboard would have had one of the Intel "Extreme" edition CPU's when I checked out the Everest report that said "i865PE chipset".

I actually missed a very important line in the linked page that says:

"Similarly affected by this XP SP2 issue MAY BE the older, rare and costly Pentium 4 Extreme Edition; like Prescott, this enjoys a larger Level 2 cache".

Note the words I've uppercased namely "MAY BE".

In that case, there is a strong link there, but the page referenced mainly surrounded issues where the system wouldn't boot normally AFTER installing SP2 due to the SP2 version of "Update.sys" which can lock up the PC if the CPU's microcode is left below a certain revision and not updated by the BIOS during boot as normally happens.

They also point to the "Intel Processor Frequency ID Utility" as a means of checking your CPU revision to see if it is one of the ones that can be problematic with SP2:

"You can download a tool from Intel that will not only tell you whether your processor is relevant to this issue, but whether your BIOS is properly updating its microcode so that it will work properly (with particular respect to XP SP2)".

http://downloadfinder.intel.com/scripts-df/Product_Filter.asp?ProductID=441

For 98, 98SE, ME, 2000, XP Home, and XP professional:

http://downloadfinder.intel.com/scripts-df-external/filter_results.aspx?strTypes=all&ProductID=441&OSFullName=Windows*+XP+Professional&lang=eng&strOSs=44&submit=Go%21
(localised language versions also available)

English: Version:7.2   Date:11/18/2004   Size:851 (KB):
ftp://aiedownload.intel.com/df-support/3084/eng/fidenu32.msi 
 
They then go on to describe how to tell if your processor is one that may be affected:

"If you have a Celeron with 256k Level 2 cache, or a Pentium 4 with over 1M of Level 2 cache, you have a processor that may be at risk.  In addition to this, if the revision level is less than 8 (in some cases 7; typically it will be 0) then you are definitely at risk.

The definitive fix is to get a BIOS update that will update Prescott's microcode to Revision 8 or better.  Then everything works.  Trouble is, your motherboard vendor may not have written that BIOS as yet; in many cases, even the latest BIOS doesn't do the necessary".

Now, this is all hypothetical, and it all depends on whether this issue happened immediately after updating to SP2.  If it worked fine after installing SP2, then I don't think this is the issue, but you never know.

I DON'T recommend upgrading the BIOS unnecessarily, so it is obviously best to first check the motherboard's support site and read what issues were fixed by the BIOS updates that apply to your motherboard model.

Start here:
http://support.asus.com/cpusupport/cpusupport.aspx?SLanguage=en-us

I don't see the P4P800-F mentioned specifically with the "F" suffix, but perhaps the basic P4P800 link will cover them.  PLEASE READ all technical details and instructions very carefully.
GedaZXAuthor Commented:
Thank you for the comment. Here is some information from Intel utility:

Number of processors in system: 1
Current processor: #1
Processor Name: Intel(R) Pentium(R) 4 CPU 2.80E GHz
Type: 0
Family: F
Model: 3
Stepping: 3
Revision: B
L1 Trace Cache: 12 Kµops
L1 Data Cache: 16 KB
L2 Cache: 1 MB
Packaging: FC-PGA2
Platform Compatibility Guide: 04A
EIST: No
MMX(TM): Yes
SIMD: Yes
SIMD2: Yes
SIMD3: Yes
Enhanced Halt State: No
Execute Disable Bit: No
Hyper-Threading Technology: Yes
Intel(R) Extended Memory 64 Technology: No
Expected Processor Frequency: 2.80 GHz
Reported Processor Frequency: 2.80 GHz
Expected System Bus Frequency: 800 MHz
Reported System Bus Frequency: 800 MHz
*************************************************************

CPU Revision is B... Anyway, I don't think this could be an issue, because I didn't have any problems with SP2 installation. I also can't update BIOS since P4P800-F model is mysteriously gone from ASUS website...

I am surfing through ASUS documentation and forums now, but haven't found anything useful yet.

I haven't got any more BSODs since yesterday, waiting for one to provide complete memory dump... (maybe that pcibus.sys was a problem?.. :)
kneHCommented:
And now for something completely offtopic:

>>CPU temperature stays at ~70C
that is too hot... put in another fan!
Or make the current ones work harder.
You can use speedfan for that (free utility)
http://www.almico.com/speedfan.php
GedaZXAuthor Commented:
70C is the temperature under heavy usage; usually it it about 60-64C. And 70C is a common temperature among Prescotts - for example, this one has a similar temperature - http://forums.tweaktown.com/showthread.php?t=19597. The fan speed can be controlled, but there is only ~2-3C difference when running on 5400 RPMs and on 3500 RPMs (it is the setting I use now).

It is not the cause of those BSODs - the system can reboot when turned on for the first time and can be very stable after running for 5-6 hours on 70C...
kneHCommented:
>>It is not the cause of those BSODs
I read that... hence the "off topic" comment

While 70 degrees might be common for the processor it's still pretty hot and the heat will spread. So I'd still look into better cooling. As suggested in that link you just posted too.
GedaZXAuthor Commented:
Yes, I noticed the cooling problem after buying this PC. I bought a new, much better fan for the CPU a bit later, but the change in temperatures was only ~5-7C..

I guess I will replace rear fan as well some day, because the whole "atmosphere" in the case is quite hot (motherboard temperature is ~50C all the time).
kneHCommented:
If at all possible go for watercooling. Quite expensive though
GedaZXAuthor Commented:
Ok, a new BSOD. Here is what WinDbg gives (full memory dump; analyze -v command):

1: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

BAD_POOL_CALLER (c2)
The current thread is making a bad pool request.  Typically this is at a bad IRQL level or double freeing the same allocation, etc.
Arguments:
Arg1: 00000040, Attempt to free usermode address to kernel pool
Arg2: 00001000, Starting address
Arg3: 80000000, Start of system address space
Arg4: 00000000, 0

Debugging Details:
------------------
MODULE_NAME:  nt

FAULTING_MODULE: 804d7000 nt

DEBUG_FLR_IMAGE_TIMESTAMP:  42250f77

FAULTING_IP:
nt!wcscpy+46
804ee17f e9c7b7ffff       jmp     nt!ExDeleteResourceLite+0x4f (804e994b)

BUGCHECK_STR:  0xc2_40

DEFAULT_BUCKET_ID:  DRIVER_FAULT

LAST_CONTROL_TRANSFER:  from 8054e137 to 805371aa

STACK_TEXT:  
WARNING: Stack unwind information not available. Following frames may be wrong.
f899ea2c 8054e137 000000c2 00000040 00001000 nt!KeBugCheckEx+0x1b
f899ea68 8055082d 00001000 00000000 00001000 nt!wcstombs+0x3893
f899eaa8 804ee17f 00001000 00000000 00000000 nt!ExFreePool+0x459
f899eac4 f83886a2 8208b970 f899eb20 f899eaf8 nt!wcscpy+0x46
f899ead4 f83b54fd 8208b970 8232d260 e38880d0 Ntfs+0x66a2
f899eaf8 f838857a 81bd23e8 f899eb20 f899eb2b Ntfs+0x334fd
f899eb44 f83a9d00 81bd23e8 8232d100 e18bbcc8 Ntfs+0x657a
f899eb9c f8384759 81bd23e8 e18bbd90 e18bbf28 Ntfs+0x27d00
f899ebc8 f83a76eb 81bd23e8 018bbd90 e18bbf28 Ntfs+0x2759
f899ec4c f83a748a 81bd23e8 e18bbd90 e18bbcc8 Ntfs+0x256eb
f899ecec 804e13d9 8232d020 81b76580 81b76580 Ntfs+0x2548a
f899ed34 8056c78f 00cb0e28 00000000 81cb0e10 nt!IofCallDriver+0x32
f899ed50 804e1957 81cb0e28 00000000 806ffa4c nt!ObCreateObject+0x218
f899ed8c 8051a610 e24ffe08 00000000 823c4268 nt!ObfDereferenceObject+0x47
f899edac 80574128 00000000 00000000 00000000 nt!MmGetPhysicalAddress+0x454
f899eddc 804efc81 8051a573 00000000 00000000 nt!PsCreateSystemThread+0x70
00000000 00000000 00000000 00000000 00000000 nt!KeInitializeTimerEx+0x1e6


STACK_COMMAND:  .bugcheck ; kb

FOLLOWUP_NAME:  MachineOwner

BUCKET_ID:  WRONG_SYMBOLS

Followup: MachineOwner
---------

Any ideas? I will try searching for info about these procedures in Google now...
cpc2004Commented:
execute windbg command !process and attach the output here
GedaZXAuthor Commented:
Here it is:

1: kd> !process
PROCESS 823c87c0  SessionId: none  Cid: 0004    Peb: 00000000  ParentCid: 0000
    DirBase: 02840000  ObjectTable: e1001e40  HandleCount: 583.
    Image: System
    VadRoot 823c41e0 Vads 3 Clone 0 Private 3. Modified 18903. Locked 0.
    DeviceMap e10001f8
    Token                             e1002ac8
    ElapsedTime                       05:05:10.700
    UserTime                          00:00:00.000
    KernelTime                        00:01:51.984
    QuotaPoolUsage[PagedPool]         0
    QuotaPoolUsage[NonPagedPool]      0
    Working Set Sizes (now,min,max)  (59, 0, 345) (236KB, 0KB, 1380KB)
    PeakWorkingSetSize                635
    VirtualSize                       0 Mb
    PeakVirtualSize                   3 Mb
    PageFaultCount                    6330
    MemoryPriority                    BACKGROUND
    BasePriority                      8
    CommitCharge                      7

        THREAD 823c8548  Cid 0004.0008  Teb: 00000000 Win32Thread: 00000000 WAIT: (WrFreePage) KernelMode Non-Alertable
            80566e10  SynchronizationEvent
            80567e00  NotificationTimer

        THREAD 823c7c98  Cid 0004.0010  Teb: 00000000 Win32Thread: 00000000 WAIT: (WrQueue) UserMode Non-Alertable
            805694c0  Unknown

        THREAD 823c7a20  Cid 0004.0014  Teb: 00000000 Win32Thread: 00000000 WAIT: (WrQueue) UserMode Non-Alertable
            805694c0  Unknown

        THREAD 823c77a8  Cid 0004.0018  Teb: 00000000 Win32Thread: 00000000 WAIT: (WrQueue) UserMode Non-Alertable
            805694c0  Unknown

        THREAD 823c7530  Cid 0004.001c  Teb: 00000000 Win32Thread: 00000000 WAIT: (WrQueue) UserMode Non-Alertable
            805694c0  Unknown

        THREAD 823c72b8  Cid 0004.0020  Teb: 00000000 Win32Thread: 00000000 WAIT: (WrQueue) UserMode Non-Alertable
            805694c0  Unknown

        THREAD 823c6020  Cid 0004.0024  Teb: 00000000 Win32Thread: 00000000 WAIT: (WrQueue) UserMode Non-Alertable
            805694fc  Unknown

        THREAD 823c6da8  Cid 0004.0028  Teb: 00000000 Win32Thread: 00000000 WAIT: (WrQueue) UserMode Non-Alertable
            805694fc  Unknown

        THREAD 823c6b30  Cid 0004.002c  Teb: 00000000 Win32Thread: 00000000 WAIT: (WrQueue) UserMode Non-Alertable
            805694fc  Unknown

        THREAD 823c68b8  Cid 0004.0030  Teb: 00000000 Win32Thread: 00000000 WAIT: (WrQueue) UserMode Non-Alertable
            805694fc  Unknown

        THREAD 823c6640  Cid 0004.0034  Teb: 00000000 Win32Thread: 00000000 WAIT: (WrQueue) UserMode Non-Alertable
            805694fc  Unknown

        THREAD 823c63c8  Cid 0004.0038  Teb: 00000000 Win32Thread: 00000000 WAIT: (WrQueue) UserMode Non-Alertable
            805694fc  Unknown

        THREAD 823c5020  Cid 0004.003c  Teb: 00000000 Win32Thread: 00000000 WAIT: (WrQueue) UserMode Non-Alertable
            805694fc  Unknown

        THREAD 823c5da8  Cid 0004.0040  Teb: 00000000 Win32Thread: 00000000 WAIT: (WrQueue) KernelMode Non-Alertable
            80569538  Unknown

        THREAD 823c5b30  Cid 0004.0044  Teb: 00000000 Win32Thread: 00000000 WAIT: (Executive) KernelMode Non-Alertable
            f899ad78  NotificationTimer
            805694a0  SynchronizationEvent
            80569490  SynchronizationEvent

        THREAD 823c4268  Cid 0004.0048  Teb: 00000000 Win32Thread: 00000000 RUNNING on processor 1
        THREAD 823bf020  Cid 0004.004c  Teb: 00000000 Win32Thread: 00000000 WAIT: (WrFreePage) KernelMode Non-Alertable
            805669d0  NotificationEvent
            80562400  NotificationEvent

        THREAD 823be020  Cid 0004.0050  Teb: 00000000 Win32Thread: 00000000 WAIT: (WrVirtualMemory) KernelMode Non-Alertable
            80566580  NotificationEvent

        THREAD 823beda8  Cid 0004.0054  Teb: 00000000 Win32Thread: 00000000 WAIT: (Executive) KernelMode Non-Alertable
            f89aad7c  NotificationTimer
            805669c0  SynchronizationEvent

        THREAD 823beb30  Cid 0004.0058  Teb: 00000000 Win32Thread: 00000000 WAIT: (Executive) KernelMode Non-Alertable
            80561350  SynchronizationEvent

        THREAD 823ecda8  Cid 0004.005c  Teb: 00000000 Win32Thread: 00000000 WAIT: (WrQueue) KernelMode Non-Alertable
            8055f600  Unknown

        THREAD 823ecb30  Cid 0004.0060  Teb: 00000000 Win32Thread: 00000000 WAIT: (WrQueue) KernelMode Non-Alertable
            8055f628  Unknown

        THREAD 823e28c0  Cid 0004.0064  Teb: 00000000 Win32Thread: 00000000 WAIT: (Executive) KernelMode Alertable
            f850d9c0  Semaphore Limit 0x3d0900

        THREAD 823e2648  Cid 0004.0068  Teb: 00000000 Win32Thread: 00000000 WAIT: (Executive) KernelMode Alertable
            f850d9c0  Semaphore Limit 0x3d0900

        THREAD 823e23d0  Cid 0004.006c  Teb: 00000000 Win32Thread: 00000000 WAIT: (Executive) KernelMode Alertable
            f850d9c0  Semaphore Limit 0x3d0900

        THREAD 823e2158  Cid 0004.0070  Teb: 00000000 Win32Thread: 00000000 WAIT: (Executive) KernelMode Alertable
            f850d9c0  Semaphore Limit 0x3d0900

        THREAD 823a5020  Cid 0004.0074  Teb: 00000000 Win32Thread: 00000000 WAIT: (Executive) KernelMode Alertable
            f850d9c0  Semaphore Limit 0x3d0900

        THREAD 823a5da8  Cid 0004.0078  Teb: 00000000 Win32Thread: 00000000 WAIT: (Executive) KernelMode Alertable
            f850d9c0  Semaphore Limit 0x3d0900

        THREAD 823a5b30  Cid 0004.007c  Teb: 00000000 Win32Thread: 00000000 WAIT: (Executive) KernelMode Alertable
            f850d9c0  Semaphore Limit 0x3d0900

        THREAD 823a58b8  Cid 0004.0080  Teb: 00000000 Win32Thread: 00000000 WAIT: (Executive) KernelMode Alertable
            f850d9c0  Semaphore Limit 0x3d0900

        THREAD 823a5640  Cid 0004.0084  Teb: 00000000 Win32Thread: 00000000 WAIT: (Executive) KernelMode Alertable
            f850d9c0  Semaphore Limit 0x3d0900

        THREAD 823a53c8  Cid 0004.0088  Teb: 00000000 Win32Thread: 00000000 WAIT: (Executive) KernelMode Alertable
            f850d9c0  Semaphore Limit 0x3d0900

        THREAD 823dc020  Cid 0004.008c  Teb: 00000000 Win32Thread: 00000000 WAIT: (Executive) KernelMode Alertable
            f850d9c0  Semaphore Limit 0x3d0900

        THREAD 823dcac8  Cid 0004.0090  Teb: 00000000 Win32Thread: 00000000 WAIT: (Executive) KernelMode Non-Alertable
            f84e6f90  NotificationEvent
            f84e6f80  NotificationEvent

        THREAD 823d6020  Cid 0004.0094  Teb: 00000000 Win32Thread: 00000000 WAIT: (Executive) KernelMode Non-Alertable
            f8491aa0  Semaphore Limit 0x7fffffff

        THREAD 823d1020  Cid 0004.0098  Teb: 00000000 Win32Thread: 00000000 WAIT: (WrQueue) KernelMode Non-Alertable
            f835b3dc  Unknown

        THREAD 8233ada8  Cid 0004.00a0  Teb: 00000000 Win32Thread: 00000000 WAIT: (Executive) UserMode Non-Alertable
            82339fb0  SynchronizationEvent
            82339fc0  SynchronizationEvent
            82339fd0  SynchronizationEvent
            82339fe0  SynchronizationEvent

        THREAD 821f1da8  Cid 0004.00ac  Teb: 00000000 Win32Thread: 00000000 WAIT: (WrQueue) KernelMode Non-Alertable
            f803ac48  Unknown

        THREAD 821f1b30  Cid 0004.00b0  Teb: 00000000 Win32Thread: 00000000 WAIT: (WrQueue) KernelMode Non-Alertable
            f803ab10  Unknown

        THREAD 821f18b8  Cid 0004.00b4  Teb: 00000000 Win32Thread: 00000000 WAIT: (WrQueue) KernelMode Non-Alertable
            f803abac  Unknown

        THREAD 821f1640  Cid 0004.00b8  Teb: 00000000 Win32Thread: 00000000 WAIT: (Executive) KernelMode Non-Alertable
            f803ac9c  NotificationEvent
            821f1730  NotificationTimer

        THREAD 821ee2d0  Cid 0004.00bc  Teb: 00000000 Win32Thread: 00000000 WAIT: (Executive) UserMode Non-Alertable
            821ef978  SynchronizationEvent
            821ef988  SynchronizationEvent
            821ef998  SynchronizationEvent
            821ef9a8  SynchronizationEvent

        THREAD 821c4020  Cid 0004.00ec  Teb: 00000000 Win32Thread: 00000000 WAIT: (Executive) KernelMode Non-Alertable
            f8651880  SynchronizationEvent
            f8651860  SynchronizationEvent

        THREAD 821c4da8  Cid 0004.00f0  Teb: 00000000 Win32Thread: 00000000 WAIT: (Executive) KernelMode Non-Alertable
            821cb2e0  SynchronizationEvent
            821cb2f0  SynchronizationEvent

        THREAD 821c4b30  Cid 0004.00f4  Teb: 00000000 Win32Thread: 00000000 WAIT: (Executive) KernelMode Non-Alertable
            821cb318  SynchronizationEvent
            821cb328  SynchronizationEvent

        THREAD 821cd020  Cid 0004.0124  Teb: 00000000 Win32Thread: 00000000 WAIT: (Suspended) KernelMode Non-Alertable
            82333604  NotificationEvent

        THREAD 8218bda8  Cid 0004.0130  Teb: 00000000 Win32Thread: 00000000 WAIT: (Executive) KernelMode Non-Alertable
            f89f8330  NotificationEvent

        THREAD 8208c020  Cid 0004.016c  Teb: 00000000 Win32Thread: 00000000 WAIT: (WrQueue) KernelMode Non-Alertable
            baeab068  Unknown

        THREAD 8208b020  Cid 0004.0174  Teb: 00000000 Win32Thread: 00000000 WAIT: (WrQueue) KernelMode Non-Alertable
            baeaafcc  Unknown

        THREAD 8209bda8  Cid 0004.0178  Teb: 00000000 Win32Thread: 00000000 WAIT: (Executive) KernelMode Non-Alertable
            baeab0bc  NotificationEvent
            8209be98  NotificationTimer

        THREAD 82080678  Cid 0004.017c  Teb: 00000000 Win32Thread: 00000000 WAIT: (WrLpcReceive) UserMode Non-Alertable
            8208b288  Semaphore Limit 0x7fffffff

        THREAD 81cc6c08  Cid 0004.0550  Teb: 00000000 Win32Thread: 00000000 WAIT: (WrQueue) KernelMode Non-Alertable
            b87ffb08  Unknown

        THREAD 81cc6990  Cid 0004.0554  Teb: 00000000 Win32Thread: 00000000 WAIT: (WrQueue) KernelMode Non-Alertable
            b87ff9d0  Unknown

        THREAD 81cc6718  Cid 0004.0558  Teb: 00000000 Win32Thread: 00000000 WAIT: (WrQueue) KernelMode Non-Alertable
            b87ffa6c  Unknown

        THREAD 81cc64a0  Cid 0004.055c  Teb: 00000000 Win32Thread: 00000000 WAIT: (Executive) KernelMode Non-Alertable
            b87ffb5c  NotificationEvent
            81cc6590  NotificationTimer

        THREAD 81cc0a18  Cid 0004.056c  Teb: 00000000 Win32Thread: 00000000 WAIT: (Executive) KernelMode Non-Alertable
            b87fefc0  NotificationTimer

        THREAD 81bd2518  Cid 0004.00f8  Teb: 00000000 Win32Thread: 00000000 WAIT: (Suspended) KernelMode Non-Alertable
            81b8c604  NotificationEvent

        THREAD 8218cda8  Cid 0004.025c  Teb: 00000000 Win32Thread: 00000000 WAIT: (Suspended) KernelMode Non-Alertable
            81955604  NotificationEvent

        THREAD 8218dda8  Cid 0004.0258  Teb: 00000000 Win32Thread: 00000000 WAIT: (Suspended) KernelMode Non-Alertable
            81aaf604  NotificationEvent

        THREAD 82041b90  Cid 0004.0478  Teb: 00000000 Win32Thread: 00000000 WAIT: (Suspended) KernelMode Non-Alertable
            818d4604  NotificationEvent

        THREAD 81b3cda8  Cid 0004.06cc  Teb: 00000000 Win32Thread: 00000000 WAIT: (Executive) KernelMode Non-Alertable
            82295128  SynchronizationEvent

        THREAD 82040cc8  Cid 0004.0414  Teb: 00000000 Win32Thread: 00000000 WAIT: (WrQueue) KernelMode Non-Alertable
            baeaaf30  Unknown
            82040db8  NotificationTimer
cpc2004Commented:
The failing process is system and nothing unusual. Can you zip the full dump and attach the zip at any webspace?
GedaZXAuthor Commented:
Umm, the full dump would be ~250 Mb when zipped... Too heavy for my 128 kbps connection, I suppose.

The last BSODs I had were related to NTFS problem in one of my drives. After chkdsk'ing it from Recovery Console, no more BSODs so far...

Maybe you could tell me what Windbg commands (maybe some other application can analyze those dumps?..) to use when analyzing the next dump? I would post the output here...
cpc2004Commented:
My first suggestion of my post post is chkdsk. I wonder why it only resolves your problem at Recovery Console.
GedaZXAuthor Commented:
I needed to check Windows root disk and I couldn't do that during normal startup (after installation I modified BootExecute entry to prevent automatic disk checking (it's a pain with ~60 Gb in each drive) and somehow it didn't want to work again).
BillDLCommented:
Thank you, GedaZX.
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Operating Systems

From novice to tech pro — start learning today.