Link to home
Start Free TrialLog in
Avatar of build18er
build18erFlag for United States of America

asked on

STOP C000021C

I recieved the following BSOD, this is the first time that it has happend.  can someone please translate it for me.

STOP C000021C

The windows lower process system process terminated unexpectedly with a state of 0x00000402 ( 0x0000000 0x0000000)

The system has been shut down.

thanks for the help
Avatar of cpc2004
cpc2004
Flag of Hong Kong image

I cannot find bugcheck code C000021C. Is it a typo error?  Is it bugcheck code c0000218 or c000021a? Check the system event log 1001 or 1003 and it has the bugcheck code.

The crash may be caused by faulty ram or device driver error (ie video, sound card, modem and etc). The system event log and the minidump has the most useful diagnostic information. When Windows crashes with blue screen, it writes a system event 1001 or 1003 and a minidump to the folder \windows\minidump. Check system event 1001 and 1003 and it has the detail of the blue screen.

Event ID: 1001
Source: Save Dump
Description:
The computer has rebooted from a bugcheck.The bugcheck was : 0xc000000a (0xe1270188, 0x00000002, 0x00000000, 0x804032100).
Microsoft Windows..... A dump was saved in: .......

Event Source: System Error
Event Category: (102)
Event ID: 1003
Description:
Error code 1000007f, parameter1 0000000d, parameter2 00000000, parameter3 00000000, parameter4 00000000

Control Panel -> Adminstrative Tools -> Event Viewer -> System -> Event 1001/1003. Copy the content and paste it back here

Zip 5 to 6 minidumps to a zip file and attach it at any webspace. I will study the dump and find out the culprit. If you can't provide the minidumps, run memtest to stress test the ram. Make sure that your windows is not infected with spyware, adware adn chkdsk /r.
http://www.memtest86.com/.

Get public webspace
Use a free service like rapidshare to attach the minidumps and post the url of the mimidumps at this thread.
http://www.rapidshare.de/
Avatar of build18er

ASKER

its c000021a
The computer has rebooted from a bugcheck.  The bugcheck was: 0x1000008e (0xc0000005, 0xba241de3, 0xb003bae4, 0x00000000). A dump was saved in: C:\WINDOWS\Minidump\Mini012807-01.dmp.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.


you can download the .dmp from mattcomphosting.com/minidump/Mini012807-01.dmp

thanks
ASKER CERTIFIED SOLUTION
Avatar of cpc2004
cpc2004
Flag of Hong Kong image

Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
about 4 weeks ago i ran memtest 86 for 24 hours without failure, so i don't think the ram is bad.
Memtest is not 100% correct. Some faulty ram can pass memtest. Refer the following problem, memtest does not find any problem. Change the ram and no more BSOD.

https://www.experts-exchange.com/questions/21505124/Seemingly-random-BSOD-on-MPC-Transport-x1000-laptop-XP-Pro-SP2.html
They are the same problem. ks.sys belongs to microsoft and it is a very stable module. There have a lot of problems relating to system crash at ks.sys and most of them have no solution and a few of them are confirmed relating to hardware problem (ie RAM).  Search google with key ks.sys. Let me know if you find out it is the software problem of ks.sys.
and the same for the other error??
Both problems are crashed at KS.sys and I believe that they are related to hardware problem.

STOP: 0x0000008E ( 0xC0000005, 0xBA241DE3, 0xB003BAE4, 0x0000000)
KS.sys Address BA241DE3 base at BA23900C DateStamp 41107EF8

BugCheck 1000008E, {c0000005, ba241de3, b003bae4, 0}
Probably caused by : ks.sys ( ks!FindPropertyItem+11 )

Followup: MachineOwner
---------
1: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************
KERNEL_MODE_EXCEPTION_NOT_HANDLED_M (1000008e)
This is a very common bugcheck.  Usually the exception address pinpoints
the driver/function that caused the problem.  Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003.  This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG.  This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG.  This will let us see why this breakpoint is
happening.
Arguments:
Arg1: c0000005, The exception code that was not handled
Arg2: ba241de3, The address that the exception occurred at
Arg3: b003bae4, Trap Frame
Arg4: 00000000

Debugging Details:
------------------
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx". The memory could not be "%s".

FAULTING_IP:
ks!FindPropertyItem+11
ba241de3 3b30            cmp     esi,dword ptr [eax]

TRAP_FRAME:  b003bae4 -- (.trap ffffffffb003bae4)
.trap ffffffffb003bae4
ErrCode = 00000000
eax=533cff88 ebx=876a8008 ecx=aacdb8c3 edx=d0e12ac0 esi=00000005 edi=00000003
eip=ba241de3 esp=b003bb58 ebp=b003bb5c iopl=0         nv up ei ng nz na pe nc
cs=0008  ss=0010  ds=0023  es=0023  fs=0030  gs=0000             efl=00010286
ks!FindPropertyItem+0x11:
ba241de3 3b30            cmp     esi,dword ptr [eax]  ds:0023:533cff88=????????
.trap
Resetting default scope

CUSTOMER_CRASH_COUNT:  1
DEFAULT_BUCKET_ID:  DRIVER_FAULT
BUGCHECK_STR:  0x8E
PROCESS_NAME:  iTunes.exe
LAST_CONTROL_TRANSFER:  from ba241e46 to ba241de3

STACK_TEXT:  
b003bb5c ba241e46 00000005 e15488e8 00000000 ks!FindPropertyItem+0x11
b003bbb8 ba241ec9 876a8008 00000003 b17aaa58 ks!KspPropertyHandler+0x5bd
b003bbdc b17ac28c 876a8008 00000003 b17aaa30 ks!KsPropertyHandler+0x19
b003bc30 ba241f85 88a494c0 876a8008 b003bc64 sysaudio!CPinInstance::PinDispatchIoControl+0x115
b003bc40 804eeeb1 88a494c0 876a8008 806e4410 ks!DispatchDeviceIoControl+0x28
b003bc50 8057e680 876a81e0 88acccf0 876a8008 nt!IopfCallDriver+0x31
b003bc64 8057f4e3 88a494c0 876a8008 88acccf0 nt!IopSynchronousServiceTail+0x60
b003bd00 80578038 000020ac 00000378 00000000 nt!IopXxxControlFile+0x5c5
b003bd34 8054060c 000020ac 00000378 00000000 nt!NtDeviceIoControlFile+0x2a
b003bd34 7c90eb94 000020ac 00000378 00000000 nt!KiFastCallEntry+0xfc
WARNING: Frame IP not in any known module. Following frames may be wrong.
00000010 00000000 00000000 00000000 00000000 0x7c90eb94

STACK_COMMAND:  kb

FOLLOWUP_IP:
ks!FindPropertyItem+11
ba241de3 3b30            cmp     esi,dword ptr [eax]

SYMBOL_STACK_INDEX:  0
SYMBOL_NAME:  ks!FindPropertyItem+11
FOLLOWUP_NAME:  MachineOwner
MODULE_NAME: ks
IMAGE_NAME:  ks.sys
DEBUG_FLR_IMAGE_TIMESTAMP:  41107ef8
FAILURE_BUCKET_ID:  0x8E_ks!FindPropertyItem+11
BUCKET_ID:  0x8E_ks!FindPropertyItem+11


--------------------------------------------------------------------------------------------
STOP: 0x0000008E ( 0xC0000005, 0xBABB1814, 0xB121AB94, 0x0000000)
KS.sys Address BABB1815 base at BA2BB0000 DateStamp 44D7743F


Bugcheck code C00021A is also related to hardware.
STOP C000021A
The windows lower process system process terminated unexpectedly with a state of 0x00000402 ( 0x0000000 0x0000000)