Solved

0x8e BSOD when starting windows XP

Posted on 2006-11-07
19
828 Views
Last Modified: 2012-05-05
greetings experts,

I have a (customers) Compaq Presario 2200  (2267AP  1.5Ghz Celeron, 256 MB Ram Win XP Home SP2), which consistently suffers a 0x8e BSOD shortly after starting up. Most of the posts I was able to find on this error suggest it is a memory error or driver problem so I have pursued this line but with no success.
I have run various memory tests, including memtest, MS memory diagnostic, and Hp's online health check; none report any problems with the RAM.
On occassions the Microsoft Online Crash Analysis tool has kicked in. The reports from this indicate a problem with the video driver so I have followed the recommendations, installing the latest video driver from the HP website, and, when this didn't help, the latest driver from the Intel website. Also tried turning off hardware acceleration. problem remains.
I have updated any other drivers and bios that were available from the HP website. still no joy.
At this point I did a repair install (inplace upgrade) of windows, but on completing this process the problem remains.
Most recently, (its been a couple of days now!) I noticed that, during startup, one of the SVCHOST processes was using all of the available of CPU and a constantly increasing amount of storage. If left to its own devices the working set for the process climbs steadily to > 100,000kb and then the machine BSODs. If I kill the process the BSOD doesn't occur.  So.... a memory leak??
Tasklist shows the SVCHOST is the one that runs a whole swag of the services (of course it is);
svchost.exe                 1024 AudioSrv, CryptSvc, Dhcp, ERSvc,
                                 EventSystem, FastUserSwitchingCompatibility,
                                 helpsvc, lanmanserver, lanmanworkstation,
                                 Netman, Nla, RasMan, Schedule, seclogon,
                                 SENS, SharedAccess, ShellHWDetection,
                                 srservice, TapiSrv, Themes, TrkWks, W32Time,
                                 winmgmt, wscsvc, wuauserv, WZCSVC
It may be just a coincidence, but windows update seems to be implicated in this problem. If wuauclt is running at startup the bsod occurs. If I kill the svchost but then access the windows update website I see the same pattern of memory usage and then the bsod.

I've got about a 1000 minidumps from this error but don't really know what to do with them. I've tried following the directions in http://support.microsoft.com/kb/315271/EN-US/ but the output doesn't show an ExceptionAddress I could use with PSTAT.  I would appreciate any advice or assistance with the minidumps if they'll help isolate the problem. (not sure how to attach one to the question for starters)

I guess I've run out of ideas so the points are there for any suggestions that resolve the problem (apart from the obvious, of a clean install, which is what I'm going to do next anyway)


0
Comment
Question by:Peter_Knox
  • 8
  • 4
  • 4
  • +2
19 Comments
 
LVL 21

Expert Comment

by:jvuz
Comment Utility
Do a scan for viruses
0
 
LVL 3

Expert Comment

by:Stekman99
Comment Utility
There is an issue with same symptons with this:
Virus scan Software TrendMicro OfficeScan

As well there is a Hotfix from MS that solves issues with WU:
http://support.microsoft.com/kb/916089

Even what the KB is saying it solves a lot more issues..

If non of this work.. Copy paste the eventvwr logfiles here and it will be easier to find a solution.

Cheers,
Stefan
0
 

Author Comment

by:Peter_Knox
Comment Utility
forgot to mention that the machine runs quite happily in safe mode so I have been able to run a couple of different AV programs over it- appears to be clean. A couple of remnants of things turned up in spyware/adware scans but nothing too sinister.
The only errors in event viewer (system log) are as follows.
Source: System error   Category: (102)  Event: 1003
Error code 1000008e, parameter1 c0000005, parameter2 f1343d59, parameter3 f0d97a20, parameter4 00000000

The hotfix seems to describe the symptons exactly. I haven't seen the system go to 100% except when wu is detecting or trying to install updates.  Doesn't explain the bsod but that may well be a consequence. (machine gets pretty hot running at 100%)  I'll give M$ a call during Business Hours to get a copy of the hotfix
and will report back.  (Thanks for the quick responses)
0
 
LVL 3

Expert Comment

by:Stekman99
Comment Utility
Hi again,

As I said it solved a lot more problem than explaind in the KB. There will be an update fairly soon I hope but I have been pushing for it (I work for outsourced MS support).

Good luck,
Stefan
0
 
LVL 20

Expert Comment

by:cpc2004
Comment Utility
Hi,

Zip 5 to 6 minidumps to a zip file and attach it at any webspace.  You can find the minidumps at the folder \winodws\minidump.  I will study the dump and find out the culprit. If you can't provide the minidumps, run memtest to stress test the ram. Make sure that your windows is not infected with spyware, adware adn chkdsk /r.
http://www.memtest86.com/.

Get public webspace
Use a free service like rapidshare to attach the minidumps and post the url of the mimidumps at this thread.
http://www.rapidshare.de/
0
 

Author Comment

by:Peter_Knox
Comment Utility
Stefan,
downloaded the hotfix (916089) from ms this evening and applied. After rebooting, I installed some pending ms updates. CPU went straight to %100, with svchost behaving as described above. Updates sat at "initializng installation..." message for about 2 minutes then BSOD as above.  After restarting system, wu downloaded updates again. (8 this time but 13 the first time?) and this time installed them successsfully.  Funny thing is that the update history on the windows update site shows 100+ updates having installed successfully in the last two days but the last update is the only one that has got far enough to indicate that the process  was successful.
Having rebooted again I went back to MS Update and this time it found 13 high priority updates. Initiated download of these but got another BSOD shortly after.  My thinking at this point is that WU is a trigger for the problem but perhaps not the actual cause.

So... over to cpc2004. minidunps are at http://rapidshare.com/files/2471800/Mini110806-06.zip. I'll try memtest again and chkdsk and report back.
0
 
LVL 3

Expert Comment

by:Stekman99
Comment Utility
Run this tool and put up the cab-file on rapidshare:

To provide me with the right information, I would like you to follow this link and download MPS Reports to your server, please use the MPSRPT_SUS.EXE version;

http://www.microsoft.com/downloads/details.aspx?familyid=cebf3c7c-7ca5-408f-88b7-f9c79b7306c0&displaylang=en

On your system a CAB file will be generated for your convenience in the
%systemroot%\MPSReports\SUS\Bin\Logs.x\Cab directory called:
 %COMPUTERNAME%_MPSReports.CAB.
(Usally the systemroot is equal to C:\windows)
The CAB file will contain the reports generated by the MPS Reporting Tool.
0
 
LVL 3

Expert Comment

by:Stekman99
Comment Utility
Sorry.. I wont sign up for rapidshare, use some better free nonspam service instead


0
 

Author Comment

by:Peter_Knox
Comment Utility
update.
10 passes of memtest86 v3.2 - no errors
symantec online scan - clean. Trend Micro DCE scan - clean. spybot/adaware scans - clean. F-Secure blacklight beta and sysinternals rootkitrevealer scans - clean.

Stefan, MPS report at http://www.wombatdesign.com/PC700919577265_MPSRPT_SUS.CAB
0
Free Trending Threat Insights Every Day

Enhance your security with threat intelligence from the web. Get trending threat insights on hackers, exploits, and suspicious IP addresses delivered to your inbox with our free Cyber Daily.

 
LVL 20

Expert Comment

by:cpc2004
Comment Utility
Hi,

I find synTP.sys is installed at the Compaq PC.  I search Google with the keyword synTP.sys and it is device driver of IBM thinkpad.  I don't know why the Compag PC install IBM device driver. synTP.sys has software error which causes blue screen.

http://www-3.ibm.com/pc/support/site.wss/document.do?lndocid=MIGR-52259

f995c000 f998b220   SynTP    SynTP.sys    Sat Apr 01 07:41:41 2006 (442DBE35)
0
 

Author Comment

by:Peter_Knox
Comment Utility
Hi cpc2004,

Synaptics is an oem company that supplies touchpads to just about every notebook manufacturer including Acer, Apple, Compaq, Dell, eMachines, Fujitsu, Gateway, Hewlett Packard, Hitachi, IBM, NEC, Panasonic, Samsung, Siemens, Sony, and Toshiba. So it's not an IBM device driver per se, rather it is a device and driver that both HP and IBM use. Nonetheless, if this driver is causing the problem I'll re-install it and/or try other versions and see what happens.  Thanks for the analysis of the minidump.  Will report back soon.  
0
 

Author Comment

by:Peter_Knox
Comment Utility
Doh. did I mention that the Compaq Presario 2200 is a notebook!
0
 

Author Comment

by:Peter_Knox
Comment Utility
I've re-installed the synaptics driver but got the same bsod as soon as some load was put on the system (windows update). I also tried disabling the device completely - same result. tried the previous driver - same result.
I have noticed that, since reinstalling the driver, the BSOD parameters have changed. I'm assuming that it's still the same driver but if anyone is interested in checking the minidumps I've zipped the most recent ones to the following location:  http://www.wombatdesign.com/Mini111006-01.zip
One further observation; I've installed a diagnostic program - PC  Wizard - so I can keep an eye on the temperatures. Processor temp sits around 50C/121F at idle and has been as high as 63C under load. Seems a bit on the toasty side to me but then I don't know what the normal temp. range is supposed to be. Might give HP a call tomorrow and ask them.

Things are getting a bit more urgent now so I've maxed out the points.  
0
 
LVL 20

Expert Comment

by:cpc2004
Comment Utility
Hi,

The last two crashes are related to nt staus code c00001d (ie illegal instruction) and this is the sign of hardware problem. Probably it is faulty ram or m/b.  Run memtest to stress test code and upgrade the firmware of the bios.

Mini111006-01.dmp BugCheck 1000008E, {c000001d, 64006f, f07b8cf0, 0}
Probably caused by : ntoskrnl.exe ( nt!CmpParseKey+558 )

Mini111006-02.dmp BugCheck 1000008E, {c000001d, 64006f, efe22cf0, 0}
Probably caused by : NDIS.sys ( NDIS!___PchSym_+c )

cpc2004
0
 

Author Comment

by:Peter_Knox
Comment Utility
Upgraded to latest BIOS release before first post. Memtest didn't report any errors, as per previous post. Subsequently, I swapped the RAM with that in another machine but  the problem still occurs when the machine is put under heavy load.  As well as when running windows update, I've managed to crash the machine, with the same stop error, when running Registry Mechanic. The common factor seems to be high CPU utilisation (and subsequently cpu temperature). I'm not sure how reliable the temperature readings from PC Wizard are, but, as previously reported, when the machine is under load the CPU temperature is shown to be above 60C. The processor cooling fan only seems to start when the temp has exceeded 60C but the machine then dies before it has had time to do anything.
I guess I'll pull the heatsink cover off and check that there are no obstructions but otherwise I'm about done with this thing.  Any more suggestions?        
0
 
LVL 20

Expert Comment

by:cpc2004
Comment Utility
Hi,

This is hardware problem. Some faulty ram can pass memtest. If you have more than one memory module, take out one memory module and restart Windows.  If blue screen disappears, the removed memory module is bad.

cpc2004
0
 

Author Comment

by:Peter_Knox
Comment Utility
Hi folks,
well, I finally bit the bullet and did a clean install to see if that helped.  Windows installed without problem and MS updates were downloaded and installed with no recurrence of the original problem. Ran some burn-in tests without error and subsequently returned machine to customer. It has beeen running without error for the last week.  In the circumstances I don't feel that I can award points as there has been no satisfactory explanation of the problem. (I am nonetheless, very grateful for the efforts of Stefan and cpc2004 in attempting to identify and resolve the error.)  Please post again if you feel this is inapropriate.
0
 
LVL 1

Accepted Solution

by:
DarthMod earned 0 total points
Comment Utility
PAQd, 500 points refunded.

DarthMod
CS Moderator
0

Featured Post

Complete VMware vSphere® ESX(i) & Hyper-V Backup

Capture your entire system, including the host, with patented disk imaging integrated with VMware VADP / Microsoft VSS and RCT. RTOs is as low as 15 seconds with Acronis Active Restore™. You can enjoy unlimited P2V/V2V migrations from any source (even from a different hypervisor)

Join & Write a Comment

Suggested Solutions

Are you unable to synchronize your OST (Offline Storage Table) file with Microsoft Exchange Server? Is your OST file exceeding 2 GB size limit? In Microsoft Outlook 2002 and earlier versions, there is a 2 GB size limit for the OST file. If the file …
Migration of Exchange mailbox can be done with the ExProfre.exe tool. But at times, when the ExProfre.exe tool migrates the Exchange Server user profile, it results in numerous synchronization problems. Synchronization error messages appear in the e…
When you create an app prototype with Adobe XD, you can insert system screens -- sharing or Control Center, for example -- with just a few clicks. This video shows you how. You can take the full course on Experts Exchange at http://bit.ly/XDcourse.
This video demonstrates how to create an example email signature rule for a department in a company using CodeTwo Exchange Rules. The signature will be inserted beneath users' latest emails in conversations and will be displayed in users' Sent Items…

763 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

7 Experts available now in Live!

Get 1:1 Help Now