Solved

Need help analyzing dumpchk file

Posted on 2006-11-10
13
810 Views
Last Modified: 2008-02-26
I have an HP Pavilion xf335 laptop that crashes after Windows

loads.  I see the desktop for 15 or 20 seconds, then it blue

screens and restarts.  Not always.  It's random.  It flashes

too fast too read what it says.  It always makes it to the

Windows login screen, but not far after that.   Sometimes it

will run for hours without a crash.  It is running SP2, with

an AMD 1500+ and 256MB of memory.  I ran the HP e-diag

diagnostic utility, and everything was fine.  I also ran

another hard drive utility, the Windows memory test, and

Memtest.  No hardware problems detected.

Here is the dumpchk file.  


Loading Dump File [c:\windows\minidump\mini110906-03.dmp]
Mini Kernel Dump File: Only registers and stack trace are

available

Symbol search path is: c:\windows\symbols
Executable search path is:
Unable to load image ntoskrnl.exe, Win32 error 2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
Windows XP Kernel Version 2600 (Service Pack 2) UP Free x86

compatible
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055a420
Debug session time: Thu Nov  9 20:22:44.872 2006 (GMT-8)
System Uptime: 0 days 0:00:36.442
Unable to load image ntoskrnl.exe, Win32 error 2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
Loading Kernel Symbols
.............................................................

...................
..........................................
Loading User Symbols
Loading unloaded module list
..
Unable to load image Ntfs.sys, Win32 error 2
*** WARNING: Unable to verify timestamp for Ntfs.sys
*************************************************************

******************
*                                                            

                *
*                        Bugcheck Analysis                    

                *
*                                                            

                *
*************************************************************

******************

Use !analyze -v to get detailed debugging information.

BugCheck 24, {1902fe, f419b538, f419b234, 80501f91}

Probably caused by : Ntfs.sys ( Ntfs!NtfsMapStream+46 )

Followup: MachineOwner
---------

----- 32 bit Kernel Mini Dump Analysis

DUMP_HEADER32:
MajorVersion        0000000f
MinorVersion        00000a28
KdSecondaryVersion  00000000
DirectoryTableBase  004b8000
PfnDataBase         81800000
PsLoadedModuleList  8055a420
PsActiveProcessHead 805604d8
MachineImageType    0000014c
NumberProcessors    00000001
BugCheckCode        00000024
BugCheckParameter1  001902fe
BugCheckParameter2  f419b538
BugCheckParameter3  f419b234
BugCheckParameter4  80501f91
PaeEnabled          00000000
KdDebuggerDataBlock 8054c060
SecondaryDataState  00000000
ProductType         00000001
SuiteMask           00000310
MiniDumpFields      00000dff

TRIAGE_DUMP32:
ServicePackBuild      00000200
SizeOfDump            00010000
ValidOffset           0000fffc
ContextOffset         00000320
ExceptionOffset       000007d0
MmOffset              00001068
UnloadedDriversOffset 000010a0
PrcbOffset            00001878
ProcessOffset         000024c8
ThreadOffset          00002728
CallStackOffset       00002980
SizeOfCallStack       00001054
DriverListOffset      00003c68
DriverCount           0000007b
StringPoolOffset      000060f0
StringPoolSize        000010e8
BrokenDriverOffset    00000000
TriageOptions         00000041
TopOfStack            f419afac
DebuggerDataOffset    000039d8
DebuggerDataSize      00000290
DataBlocksOffset      000071d8
DataBlocksCount       00000007
  00190000 - 00190fff at offset 00007248
  f419b000 - f419bfff at offset 00008248
  80501000 - 80501fff at offset 00009248
  80533000 - 80533fff at offset 0000a248
  81a8c000 - 81a8cfff at offset 0000b248
  c0000000 - c0000fff at offset 0000c248
  ffdff000 - ffdfffff at offset 0000d248
  Max offset e248, 5db8 from end of file


Windows XP Kernel Version 2600 (Service Pack 2) UP Free x86

compatible
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055a420
Debug session time: Thu Nov  9 20:22:44.872 2006 (GMT-8)
System Uptime: 0 days 0:00:36.442
start    end        module name
804d7000 806eb100   nt        Tue Mar 01 16:59:37 2005

(42250FF9)
806ec000 806ffd80   hal       Tue Aug 03 22:59:04 2004

(41107B28)
bf800000 bf9c1180   win32k    Wed Oct 05 17:05:44 2005

(43446A58)
bf9c2000 bf9d3580   dxg       Tue Aug 03 23:00:51 2004

(41107B93)
bf9d4000 bfa2b000   s3gnb     Fri May 03 18:09:26 2002

(3CD334C6)
f41d4000 f41eb1a0   tfsnudfa  Thu Mar 14 14:26:43 2002

(3C9123A3)
f41ec000 f4201a80   tfsnudf   Thu Mar 14 14:24:30 2002

(3C91231E)
f420e000 f4211280   ndisuio   Tue Aug 03 23:03:10 2004

(41107C1E)
f4252000 f4262280   Udfs      Tue Aug 03 23:00:27 2004

(41107B7B)
f4263000 f42b5680   BsUDF     Mon Jun 10 20:40:14 2002

(3D05711E)
f7b97000 f7bae480   dump_atapi  Tue Aug 03 22:59:41 2004

(41107B4D)
f7baf000 f7bcff00   ipnat     Wed Sep 29 15:28:36 2004

(415B3714)
f7bd0000 f7c3ea00   mrxsmb    Fri May 05 02:41:42 2006

(445B1DD6)
f7c3f000 f7c69a00   rdbss     Fri May 05 02:47:55 2006

(445B1F4B)
f7c6a000 f7c8bd00   afd       Tue Aug 03 23:14:13 2004

(41107EB5)
f7c8c000 f7cb3c00   netbt     Tue Aug 03 23:14:36 2004

(41107ECC)
f7cb4000 f7d0bd80   tcpip     Thu Apr 20 04:51:47 2006

(444775D3)
f7d0c000 f7d1e400   ipsec     Tue Aug 03 23:14:27 2004

(41107EC3)
f8dc7000 f8dcf780   tfsncofs  Thu Mar 14 14:25:25 2002

(3C912355)
f8dd7000 f8de3de0   tfsnifs   Thu Mar 14 14:23:59 2002

(3C9122FF)
f8de7000 f8df03e0   drvnddm   Tue Feb 12 14:56:08 2002

(3C699D88)
f8eb3000 f8ee6200   update    Tue Aug 03 22:58:32 2004

(41107B08)
f8ee7000 f8ef7e00   psched    Tue Aug 03 23:04:16 2004

(41107C60)
f8ef8000 f8f0e680   ndiswan   Tue Aug 03 23:14:30 2004

(41107EC6)
f8f0f000 f8fb4f80   HSF_CNXT  Tue Oct 14 07:05:45 2003

(3F8C02B9)
f8fb5000 f90b3a80   HSF_DP    Tue Oct 14 07:04:04 2003

(3F8C0254)
f90b4000 f90e3100   HSFHWVIA  Tue Oct 14 07:09:16 2003

(3F8C038C)
f90e4000 f9107980   portcls   Tue Aug 03 23:15:47 2004

(41107F13)
f9108000 f91567c0   cviaaud   Tue Feb 26 12:01:07 2002

(3C7BE983)
f9157000 f918be20   cviahal   Tue Feb 26 12:07:29 2002

(3C7BEB01)
f918c000 f91aee80   USBPORT   Tue Aug 03 23:08:34 2004

(41107D62)
f91af000 f91d1680   ks        Tue Aug 03 23:15:20 2004

(41107EF8)
f91d2000 f91e5900   parport   Tue Aug 03 22:59:04 2004

(41107B28)
f91e6000 f91f9780   VIDEOPRT  Tue Aug 03 23:07:04 2004

(41107D08)
f91fa000 f921c800   s3gnbm    Fri May 03 18:09:32 2002

(3CD334CC)
f9225000 f92285e0   tfsnopio  Thu Mar 14 14:25:43 2002

(3C912367)
f9231000 f9233900   Dxapi     Fri Aug 17 13:53:19 2001

(3B7D843F)
f9626000 f9628580   ndistapi  Fri Aug 17 13:55:29 2001

(3B7D84C1)
f962a000 f962c580   hpci      Thu Jul 26 17:09:32 2001

(3B60B13C)
f9632000 f9635120   KBFiltr   Thu Sep 06 01:15:04 2001

(3B973088)
f9636000 f9639700   CmBatt    Tue Aug 03 23:07:39 2004

(41107D2B)
f966e000 f9688580   Mup       Tue Aug 03 23:15:20 2004

(41107EF8)
f9689000 f96b5a80   NDIS      Tue Aug 03 23:14:27 2004

(41107EC3)
f96b6000 f9742480   Ntfs      Tue Aug 03 23:15:06 2004

(41107EEA)
f9743000 f9759780   KSecDD    Tue Aug 03 22:59:45 2004

(41107B51)
f975a000 f976c8c0   drvmcdb   Fri Feb 15 13:04:57 2002

(3C6D77F9)
f976d000 f977ef00   sr        Tue Aug 03 23:06:22 2004

(41107CDE)
f977f000 f979e780   fltmgr    Mon Aug 21 02:14:57 2006

(44E97991)
f979f000 f97b6480   atapi     Tue Aug 03 22:59:41 2004

(41107B4D)
f97b7000 f97d5880   ftdisk    Fri Aug 17 13:52:41 2001

(3B7D8419)
f97d6000 f97f3480   pcmcia    Tue Aug 03 23:07:45 2004

(41107D31)
f97f4000 f9804a80   pci       Tue Aug 03 23:07:45 2004

(41107D31)
f9805000 f9832d80   ACPI      Tue Aug 03 23:07:35 2004

(41107D27)
f9854000 f985cc00   isapnp    Fri Aug 17 13:58:01 2001

(3B7D8559)
f9864000 f986e500   MountMgr  Tue Aug 03 22:58:29 2004

(41107B05)
f9874000 f9880c80   VolSnap   Tue Aug 03 23:00:14 2004

(41107B6E)
f9884000 f988ce00   disk      Tue Aug 03 22:59:53 2004

(41107B59)
f9894000 f98a0200   CLASSPNP  Tue Aug 03 23:14:26 2004

(41107EC2)
f98a4000 f98ae500   viaagp    Tue Aug 03 23:07:42 2004

(41107D2E)
f98b4000 f98c3e00   IoloFltr  Fri Oct 21 18:45:55 2005

(435999D3)
f98c4000 f98cd480   NDProxy   Fri Aug 17 13:55:30 2001

(3B7D84C2)
f98f4000 f9902100   usbhub    Tue Aug 03 23:08:40 2004

(41107D68)
f9904000 f990c360   aswTdi    Mon Sep 25 08:39:01 2006

(4517F815)
f9914000 f991c700   netbios   Tue Aug 03 23:03:19 2004

(41107C27)
f9934000 f993c880   Fips      Fri Aug 17 18:31:49 2001

(3B7DC585)
f9944000 f994c700   wanarp    Tue Aug 03 23:04:57 2004

(41107C89)
f9964000 f9973900   Cdfs      Tue Aug 03 23:14:09 2004

(41107EB1)
f9a04000 f9a0d200   amdk7     Tue Aug 03 22:59:19 2004

(41107B37)
f9a14000 f9a20e00   i8042prt  Tue Aug 03 23:14:36 2004

(41107ECC)
f9a24000 f9a2e380   Imapi     Tue Aug 03 23:00:12 2004

(41107B6C)
f9a34000 f9a40180   cdrom     Tue Aug 03 22:59:52 2004

(41107B58)
f9a44000 f9a52080   redbook   Tue Aug 03 22:59:34 2004

(41107B46)
f9a54000 f9a62b80   drmk      Tue Aug 03 23:07:54 2004

(41107D3A)
f9a64000 f9a70880   rasl2tp   Tue Aug 03 23:14:21 2004

(41107EBD)
f9a74000 f9a7e200   raspppoe  Tue Aug 03 23:05:06 2004

(41107C92)
f9a84000 f9a8fd00   raspptp   Tue Aug 03 23:14:26 2004

(41107EC2)
f9a94000 f9a9c900   msgpc     Tue Aug 03 23:04:11 2004

(41107C5B)
f9aa4000 f9aadf00   termdd    Tue Aug 03 22:58:52 2004

(41107B1C)
f9ad4000 f9ada200   PCIIDEX   Tue Aug 03 22:59:40 2004

(41107B4C)
f9adc000 f9ae0900   PartMgr   Fri Aug 17 18:32:23 2001

(3B7DC5A7)
f9b9c000 f9ba1a00   mouclass  Tue Aug 03 22:58:32 2004

(41107B08)
f9ba4000 f9baa000   kbdclass  Tue Aug 03 22:58:32 2004

(41107B08)
f9bac000 f9bad000   fdc       unavailable (00000000)
f9bb4000 f9bba400   MxlW2k    Fri Jan 30 16:09:18 2004

(401AF22E)
f9bbc000 f9bc1000   usbuhci   Tue Aug 03 23:08:34 2004

(41107D62)
f9bc4000 f9bcb580   Modem     Tue Aug 03 23:08:04 2004

(41107D44)
f9bcc000 f9bd2a00   fetnd5    Fri Jul 20 04:40:24 2001

(3B5818A8)
f9bd4000 f9bd8880   TDI       Tue Aug 03 23:07:47 2004

(41107D33)
f9bdc000 f9be0580   ptilink   Fri Aug 17 13:49:53 2001

(3B7D8371)
f9be4000 f9be8080   raspti    Fri Aug 17 13:55:32 2001

(3B7D84C4)
f9bfc000 f9c01980   ssrtln    Mon Jan 28 17:03:17 2002

(3C55F4D5)
f9c04000 f9c09200   vga       Tue Aug 03 23:07:06 2004

(41107D0A)
f9c0c000 f9c10a80   Msfs      Tue Aug 03 23:00:37 2004

(41107B85)
f9c14000 f9c1b880   Npfs      Tue Aug 03 23:00:38 2004

(41107B86)
f9c24000 f9c29b00   Aavmker4  Mon Sep 25 08:37:48 2006

(4517F7CC)
f9c34000 f9c38500   watchdog  Tue Aug 03 23:07:32 2004

(41107D24)
f9c44000 f9c49c00   tfsnboio  Thu Mar 14 14:24:36 2002

(3C912324)
f9c64000 f9c67000   BOOTVID   Fri Aug 17 13:49:09 2001

(3B7D8345)
f9c68000 f9c6a480   compbatt  Fri Aug 17 13:57:58 2001

(3B7D8556)
f9c6c000 f9c6f700   BATTC     Fri Aug 17 13:57:52 2001

(3B7D8550)
f9c70000 f9c72d80   ACPIEC    Fri Aug 17 13:57:55 2001

(3B7D8553)
f9c74000 f9c77d60   PxHelp20  Tue Feb 26 15:24:54 2002

(3C7C1946)
f9c78000 f9c7a480   bsstor    Wed Jun 05 23:41:41 2002

(3CFF0425)
f9cf8000 f9cfbc80   mssmbios  Tue Aug 03 23:07:47 2004

(41107D33)
f9d20000 f9d22280   rasacd    Fri Aug 17 13:55:39 2001

(3B7D84CB)
f9d54000 f9d55b80   kdcom     Fri Aug 17 13:49:10 2001

(3B7D8346)
f9d56000 f9d57100   WMILIB    Fri Aug 17 14:07:23 2001

(3B7D878B)
f9d58000 f9d59500   viaide    Tue Aug 03 22:59:42 2004

(41107B4E)
f9d8e000 f9d8f100   swenum    Tue Aug 03 22:58:41 2004

(41107B11)
f9d90000 f9d91280   USBD      Fri Aug 17 14:02:58 2001

(3B7D8682)
f9d92000 f9d935a0   sscdbhk5  Mon Jan 28 17:04:02 2002

(3C55F502)
f9d94000 f9d95f00   Fs_Rec    Fri Aug 17 13:49:37 2001

(3B7D8361)
f9d96000 f9d97080   Beep      Fri Aug 17 13:47:33 2001

(3B7D82E5)
f9d98000 f9d99080   mnmdd     Fri Aug 17 13:57:28 2001

(3B7D8538)
f9d9a000 f9d9b080   RDPCDD    Fri Aug 17 13:46:56 2001

(3B7D82C0)
f9d9e000 f9d9f100   dump_WMILIB  Fri Aug 17 14:07:23 2001

(3B7D878B)
f9da8000 f9da9880   tfsnpool  Thu Mar 14 14:24:13 2002

(3C91230D)
f9e1c000 f9e1cd80   OPRGHDLR  Fri Aug 17 13:57:55 2001

(3B7D8553)
f9e8b000 f9e8bc00   audstub   Fri Aug 17 13:59:40 2001

(3B7D85BC)
f9e94000 f9e94d00   dxgthk    Fri Aug 17 13:53:12 2001

(3B7D8438)
f9f3f000 f9f3fb80   Null      Fri Aug 17 13:47:39 2001

(3B7D82EB)
f9f68000 f9f68860   tfsndres  Thu Mar 14 14:27:04 2002

(3C9123B8)
f9f6c000 f9f6cfe0   tfsndrct  Thu Mar 14 14:25:39 2002

(3C912363)

Unloaded modules:
f9924000 f992d000   processr.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
f9bf4000 f9bf9000   Cdaudio.SYS
    Timestamp: unavailable (00000000)
    Checksum:  00000000
*************************************************************

******************
*                                                            

                *
*                        Bugcheck Analysis                    

                *
*                                                            

                *
*************************************************************

******************

Use !analyze -v to get detailed debugging information.

BugCheck 24, {1902fe, f419b538, f419b234, 80501f91}

Probably caused by : Ntfs.sys ( Ntfs!NtfsMapStream+46 )

Followup: MachineOwner
---------

Finished dump check

Any ideas on this one?  Thanks.
0
Comment
Question by:bleujaegel
  • 5
  • 4
  • 3
  • +1
13 Comments
 
LVL 8

Assisted Solution

by:jsvor
jsvor earned 250 total points
ID: 17916964
You can turn off the 'feature' in XP that will reboot your machine if there is a system failure.  To stop it from rebooting  your computer right-click My Computer and select Properties.  Click on the 'Advanced' tab and then click the 'Settings' button under the Startup and Recovery section.  Remove the check from 'Automatically restart' under the System failure section.  Now when you get a BSOD it will stay on the screen and you can grab all the info you want from it.

You can usually get the BSOD error reports from the Event logs, too.

When was the last time you did a defrag?  Just wondering if it gave you any sector errors or ntfs errors.
0
 
LVL 66

Accepted Solution

by:
johnb6767 earned 250 total points
ID: 17917058
More than likely driver related, but change the recovery options as jsvor asked, and go from there....
0
 
LVL 2

Author Comment

by:bleujaegel
ID: 17917712
Already ran a defrag with no problems.  Chkdsk /r has no issues either.  All drive utilities test it as good.  Am fairly certain it's a software issue (unless bad memory would cause this even though I've tested it many times with different utilities).

I will do that and get back.  Thanks.
0
 
LVL 6

Expert Comment

by:manicsquirrel
ID: 17919981
I would check the motherboard and power supply capacitors:

http://badcaps.net/
0
 
LVL 2

Author Comment

by:bleujaegel
ID: 17920101
Excellent comments from the both of you.  Thanks for the tip on 'automatically restart'.  Didn't realize that's what that did.  It appears it is a driver issue.  The blue screen gave me:

STOP: 0x000000c4
Parameter1 0x00000000
p2              0x00000001
p3              0x00000001
p4              0x00000000

I did a search and found out about the Windows verifier.  Anyway, I tried this and got it to crash consistently, thereby eliminating hardware as the cause.  When booting in safe mode, it seemed to hang on a driver named 'ioloflt.sys' for quite a while.  After booting, I cut this file out of the drivers folder, and pasted it on the desktop.  After that, it didn't crash after rebooting.  As soon as I added back to the drivers folder and restarted, same stop error above appeared.

I'm fairly certain this will solve the problem, but I will reserve judgement for a day or two.  As with computers, sometimes you think you've figured out the problem, only to have it resurface after you're convinced the problem was solved.  

Here's the link to the 'verifier' post if anyone is interested, it's almost half way down the page:

http://www.alegsa.com.ar/N/i73/Stop%20error%20message.php
0
 
LVL 8

Expert Comment

by:jsvor
ID: 17923923
Glad to hear you narrowed it down.
0
Comprehensive Backup Solutions for Microsoft

Acronis protects the complete Microsoft technology stack: Windows Server, Windows PC, laptop and Surface data; Microsoft business applications; Microsoft Hyper-V; Azure VMs; Microsoft Windows Server 2016; Microsoft Exchange 2016 and SQL Server 2016.

 
LVL 2

Author Comment

by:bleujaegel
ID: 17960238
It was indeed the iolofltr.sys file, which I believe is a driver for System Mechanic.  Thanks for everyones assistance on this.
0
 
LVL 2

Author Comment

by:bleujaegel
ID: 17960343
BTW, I split the points between two of you.  I accepted the answer from johnb6767 because he had the actual answer, even though jsvor had extremely valuable troubleshooting information.  So I guess john got it on a technicality.  Not trying to dis you jsvor.  Thanks again.
0
 
LVL 66

Expert Comment

by:johnb6767
ID: 17960681
I appreciate that, But in all fairness, I think you did most of the legwork and pinpointed the actual driver.  Dont get me wrong, I appreciate the award, but I think that jsvor had the better information to get you started.....
0
 
LVL 2

Author Comment

by:bleujaegel
ID: 17960924
Is there a way to change the accepted answer then?
0
 
LVL 66

Expert Comment

by:johnb6767
ID: 17961001

 
Leave a zero-point question in Community Support explaining what happened. The Moderators will "unaccept" your selection and re-open the question. Then you can reassign the points again.......
 
http://www.experts-exchange.com/Community_Support

Have a great day!!
0
 
LVL 8

Expert Comment

by:jsvor
ID: 17961839
Thanks for the points johnb.  Splitting the points was fine by me - you did suggest the driver right off the bat.  I'm just glad when things like this get resolved.
0
 
LVL 66

Expert Comment

by:johnb6767
ID: 17963156
No prob.  likie ot add to other people ideas, but I dont necessarily want the credit for something I didnt offer. Just like to keep it fun!!
0

Featured Post

Get up to 2TB FREE CLOUD per backup license!

An exclusive Black Friday offer just for Expert Exchange audience! Buy any of our top-rated backup solutions & get up to 2TB free cloud per system! Perform local & cloud backup in the same step, and restore instantly—anytime, anywhere. Grab this deal now before it disappears!

Join & Write a Comment

Suggested Solutions

Disclosure: Use this tutorial only when no other options helps to get Windows XP running without any problems and you don't want to format the drive. The back up of the data is the responsible of the user, however there is a description of how t…
We have adopted the strategy to use Computers in Student Labs as the bulletin boards. The same target can be achieved by using a Login Notice feature in Group policy but it’s not as attractive as graphical wallpapers with message which grabs the att…
This video discusses moving either the default database or any database to a new volume.
Get a first impression of how PRTG looks and learn how it works.   This video is a short introduction to PRTG, as an initial overview or as a quick start for new PRTG users.

744 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

15 Experts available now in Live!

Get 1:1 Help Now