Solved

BSOD 0x000008E

Posted on 2007-11-27
9
6,436 Views
Last Modified: 2013-11-05
I need help troubleshooting an intermittent BSOD, I get 0x000008E and bf837895. The documentation I have read indicates hardware. I have updated video drivers, removed a sound card etc .....

Attached is a decode of the latest minidump. Any help would be appreciated, I am not sure how to read the decode.

Microsoft (R) Windows Debugger Version 6.8.0004.0 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\WINDOWS\Minidump\Mini112707-03.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: .sympath SRV*f:\localsymbols*http://msdl.microsoft.com/download/symbols

Executable search path is:
Windows XP Kernel Version 2600 (Service Pack 2) UP Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 2600.xpsp_sp2_gdr.070227-2254
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055a620
Debug session time: Tue Nov 27 21:28:27.578 2007 (GMT-5)
System Uptime: 0 days 0:29:18.210
Loading Kernel Symbols
..........................................................................................................................................
Loading User Symbols
Loading unloaded module list
.........................................
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1000008E, {c0000005, bf837895, b781ba68, 0}



Probably caused by : win32k.sys ( win32k!HMUnlockObjectInternal+1c )

Followup: MachineOwner
---------

kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

KERNEL_MODE_EXCEPTION_NOT_HANDLED_M (1000008e)
This is a very common bugcheck.  Usually the exception address pinpoints
the driver/function that caused the problem.  Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003.  This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG.  This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG.  This will let us see why this breakpoint is
happening.
Arguments:
Arg1: c0000005, The exception code that was not handled
Arg2: bf837895, The address that the exception occurred at
Arg3: b781ba68, Trap Frame
Arg4: 00000000

Debugging Details:
------------------




EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx". The memory could not be "%s".

FAULTING_IP:
win32k!HMUnlockObjectInternal+1c
bf837895 8a5109          mov     dl,byte ptr [ecx+9]

TRAP_FRAME:  b781ba68 -- (.trap 0xffffffffb781ba68)
ErrCode = 00000000
eax=b781bb08 ebx=00000063 ecx=bc59c700 edx=bc510000 esi=bc686c10 edi=00000000
eip=bf837895 esp=b781badc ebp=b781badc iopl=0         nv up ei pl nz na po nc
cs=0008  ss=0010  ds=0023  es=0023  fs=0030  gs=0000             efl=00010202
win32k!HMUnlockObjectInternal+0x1c:
bf837895 8a5109          mov     dl,byte ptr [ecx+9]        ds:0023:bc59c709=??
Resetting default scope

CUSTOMER_CRASH_COUNT:  3

DEFAULT_BUCKET_ID:  DRIVER_FAULT

BUGCHECK_STR:  0x8E

PROCESS_NAME:  iexplore.exe

LAST_CONTROL_TRANSFER:  from bf823a4a to bf837895

STACK_TEXT:  
b781badc bf823a4a b781bb08 bf823f48 bc686c10 win32k!HMUnlockObjectInternal+0x1c
b781bae4 bf823f48 bc686c10 b781bafc 00000202 win32k!ThreadLockExchangeAlways+0x23
b781bb08 bf823e9d bc684d30 00000202 00000063 win32k!xxxWindowHitTest+0x2f
b781bb40 bf823f5a bc6406e8 00000202 00000063 win32k!xxxWindowHitTest2+0xfd
b781bb70 bf825068 bc6406e8 00000202 00000063 win32k!xxxWindowHitTest+0x41
b781bc94 bf801ee5 00000200 b781bd14 00000000 win32k!xxxScanSysQueue+0x442
b781bce8 bf80370a b781bd14 000025ff 00000000 win32k!xxxRealInternalGetMessage+0x335
b781bd48 804de7ec 03feeef8 00000000 00000000 win32k!NtUserPeekMessage+0x40
b781bd48 7c90eb94 03feeef8 00000000 00000000 nt!KiFastCallEntry+0xf8
WARNING: Frame IP not in any known module. Following frames may be wrong.
03feee4c 00000000 00000000 00000000 00000000 0x7c90eb94


STACK_COMMAND:  kb

FOLLOWUP_IP:
win32k!HMUnlockObjectInternal+1c
bf837895 8a5109          mov     dl,byte ptr [ecx+9]

SYMBOL_STACK_INDEX:  0

SYMBOL_NAME:  win32k!HMUnlockObjectInternal+1c

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: win32k

IMAGE_NAME:  win32k.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  45f013f6

FAILURE_BUCKET_ID:  0x8E_win32k!HMUnlockObjectInternal+1c

BUCKET_ID:  0x8E_win32k!HMUnlockObjectInternal+1c

Followup: MachineOwner
---------



harbor235
0
Comment
Question by:harbor235
  • 5
  • 4
9 Comments
 
LVL 32

Author Comment

by:harbor235
ID: 20362851
In the decode it states that the "DEFAULT_BUCKET_ID:  DRIVER_FAULT",  however, it does not say which driver!


harbor235
0
 
LVL 20

Expert Comment

by:cpc2004
ID: 20362914
I resolved a similar problem at another web and the stack trace is almost the same as yours. The culprit of that problem is faulty ram.  Probably the ram is bad.  Reseat the ram to another memroy slot may resolve the blue screen problem.

Stack trace of similiar problem at another website
BugCheck 1000008E, {c0000005, bf837815, b203ac3c, 0}
Probably caused by : win32k.sys ( win32k!HMUnlockObjectInternal+1c )

Followup: MachineOwner
STACK_TEXT:  
b203acb0 bf82399a b203acdc bf823e98 bc71b5a0 win32k!HMUnlockObjectInternal+0x1c
b203acb8 bf823e98 bc71b5a0 b203acd0 000001ec win32k!ThreadLockExchangeAlways+0x23
b203acdc bf823ded bc69f3d0 000001ec 000002b3 win32k!xxxWindowHitTest+0x2f
b203ad14 bf8245f8 bc6506e8 000001ec 000002b3 win32k!xxxWindowHitTest2+0xfd
b203ad40 bf8245a3 000001ec 000002b3 0013e878 win32k!xxxWindowFromPoint+0x3a
b203ad54 804de7ec 000001ec 000002b3 0013e914 win32k!NtUserWindowFromPoint+0x16
b203ad54 7c90eb94 000001ec 000002b3 0013e914 nt!KiFastCallEntry+0xf8
0
 
LVL 20

Expert Comment

by:cpc2004
ID: 20362998
If the ram is bad, you will have minidump crashed with bugcheck code 0A, 50, 7E and 8E. You can double check the size of DrWatson log. If the size of the DrWatson log is over 2MB and the crash reason are acess viloation at different location, this is also the symptom of faulty ram.  You can find the DrWatson log at the folder C:\Documents and Settings\All Users\Documents\DrWatson\drwtsn32.log
0
 
LVL 32

Author Comment

by:harbor235
ID: 20393437
I have reseatted the memory, things have gotten better, however, it still has crashed once or twice. How do verify that it is/was the memory?

harbor235 ;}
0
Backup Your Microsoft Windows Server®

Backup all your Microsoft Windows Server – on-premises, in remote locations, in private and hybrid clouds. Your entire Windows Server will be backed up in one easy step with patented, block-level disk imaging. We achieve RTOs (recovery time objectives) as low as 15 seconds.

 
LVL 20

Expert Comment

by:cpc2004
ID: 20439413
I resovled 2 similar problems at another forum as the stack trace are exactly the same as your problem. Attach the latest debug log here . Maybe the crash have another culprit.
0
 
LVL 32

Author Comment

by:harbor235
ID: 20453800

Microsoft (R) Windows Debugger Version 6.8.0004.0 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\WINDOWS\Minidump\Mini121107-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: .sympath SRV*f:\localsymbols*http://msdl.microsoft.com/download/symbols

Executable search path is:
Windows XP Kernel Version 2600 (Service Pack 2) UP Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 2600.xpsp_sp2_gdr.070227-2254
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055a620
Debug session time: Tue Dec 11 03:19:59.015 2007 (GMT-5)
System Uptime: 0 days 16:19:20.647
Loading Kernel Symbols
......................................................................................................................................
Loading User Symbols
Loading unloaded module list
...............................
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1000008E, {c0000005, bf837895, b91d5a6c, 0}



Probably caused by : win32k.sys ( win32k!HMUnlockObjectInternal+1c )

Followup: MachineOwner
---------

kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

KERNEL_MODE_EXCEPTION_NOT_HANDLED_M (1000008e)
This is a very common bugcheck.  Usually the exception address pinpoints
the driver/function that caused the problem.  Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003.  This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG.  This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG.  This will let us see why this breakpoint is
happening.
Arguments:
Arg1: c0000005, The exception code that was not handled
Arg2: bf837895, The address that the exception occurred at
Arg3: b91d5a6c, Trap Frame
Arg4: 00000000

Debugging Details:
------------------




EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx". The memory could not be "%s".

FAULTING_IP:
win32k!HMUnlockObjectInternal+1c
bf837895 8a5109          mov     dl,byte ptr [ecx+9]

TRAP_FRAME:  b91d5a6c -- (.trap 0xffffffffb91d5a6c)
ErrCode = 00000000
eax=b91d5b0c ebx=000002e2 ecx=bc554730 edx=bc510000 esi=bc676838 edi=00000000
eip=bf837895 esp=b91d5ae0 ebp=b91d5ae0 iopl=0         nv up ei pl nz na pe nc
cs=0008  ss=0010  ds=0023  es=0023  fs=0030  gs=0000             efl=00010206
win32k!HMUnlockObjectInternal+0x1c:
bf837895 8a5109          mov     dl,byte ptr [ecx+9]        ds:0023:bc554739=??
Resetting default scope

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  DRIVER_FAULT

BUGCHECK_STR:  0x8E

PROCESS_NAME:  XoftSpy.exe

LAST_CONTROL_TRANSFER:  from bf823a4a to bf837895

STACK_TEXT:  
b91d5ae0 bf823a4a b91d5b0c bf823f48 bc676838 win32k!HMUnlockObjectInternal+0x1c
b91d5ae8 bf823f48 bc676838 b91d5b00 000001cd win32k!ThreadLockExchangeAlways+0x23
b91d5b0c bf823e9d bc64fd08 000001cd 000002e2 win32k!xxxWindowHitTest+0x2f
b91d5b44 bf823f5a bc6406e8 000001cd 000002e2 win32k!xxxWindowHitTest2+0xfd
b91d5b74 bf825068 bc6406e8 000001cd 000002e2 win32k!xxxWindowHitTest+0x41
b91d5c98 bf801ee5 00000200 b91d5d18 00000000 win32k!xxxScanSysQueue+0x442
b91d5cec bf819fc8 b91d5d18 000025ff 00000000 win32k!xxxRealInternalGetMessage+0x335
b91d5d4c 804de7ec 00171148 00000000 00000000 win32k!NtUserGetMessage+0x27
b91d5d4c 7c90eb94 00171148 00000000 00000000 nt!KiFastCallEntry+0xf8
WARNING: Frame IP not in any known module. Following frames may be wrong.
0012b6cc 00000000 00000000 00000000 00000000 0x7c90eb94


STACK_COMMAND:  kb

FOLLOWUP_IP:
win32k!HMUnlockObjectInternal+1c
bf837895 8a5109          mov     dl,byte ptr [ecx+9]

SYMBOL_STACK_INDEX:  0

SYMBOL_NAME:  win32k!HMUnlockObjectInternal+1c

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: win32k

IMAGE_NAME:  win32k.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  45f013f6

FAILURE_BUCKET_ID:  0x8E_win32k!HMUnlockObjectInternal+1c

BUCKET_ID:  0x8E_win32k!HMUnlockObjectInternal+1c

Followup: MachineOwner
---------



harbor235
0
 
LVL 20

Accepted Solution

by:
cpc2004 earned 500 total points
ID: 20496840
The stack trace of the latest debug log is the same. This is hardware error. Do you overclock the CPU or RAM? Make sure that your PC is not overheat.
0
 
LVL 32

Author Comment

by:harbor235
ID: 20565327
My PC is definetley not over heating, I have reseatted everything, it has been much better.
However, I still BSOD a cuple times a week. How can I pin point the problem?

harbor235
0
 
LVL 32

Author Closing Comment

by:harbor235
ID: 31411340
I need to pinpoint this problem, it has become less of a problem but still happens 1 or 2 times a week.
This changed after reseatting everything.

thank you

harbor235
0

Featured Post

IT, Stop Being Called Into Every Meeting

Highfive is so simple that setting up every meeting room takes just minutes and every employee will be able to start or join a call from any room with ease. Never be called into a meeting just to get it started again. This is how video conferencing should work!

Join & Write a Comment

Can I legally transfer my OEM version of Windows to another PC?  (AKA - Can I put a new systemboard in my OEM PC?) Few of us are both IT and legal experts but we all have our own views of Microsoft's licensing rules and how they apply.  There are…
When you start your Windows 10 PC and got an "Operating system not found" error or just saw  "Auto repair for startup". After a while, you have entered a loop for Auto repair which does not fix anything and you will be in a  panic as all your work w…
It is a freely distributed piece of software for such tasks as photo retouching, image composition and image authoring. It works on many operating systems, in many languages.
Polish reports in Access so they look terrific. Take yourself to another level. Equations, Back Color, Alternate Back Color. Write easy VBA Code. Tighten space to use less pages. Launch report from a menu, considering criteria only when it is filled…

746 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

10 Experts available now in Live!

Get 1:1 Help Now