?
Solved

BSOD 100000d0 and 100000c5

Posted on 2008-11-06
30
Medium Priority
?
2,347 Views
Last Modified: 2012-05-05
A Windows XP Pro Dell PC is getting blue screens periodically with the following errors:
Error code 100000d0, parameter1 ff9d9da5, parameter2 00000002, parameter3 00000001, parameter4 8054d579.
Error code 100000c5, parameter1 ff9d9da5, parameter2 00000002, parameter3 00000001, parameter4 805505a1.
The user is the QA Manager so is very PC literate and says he has not installed any new software or devices in weeks or even months, as far as he can remember.
Is there someone here that can read a dump file if I send it (actually, it would be 2 dump files for the 2 different errors)? I don't have the expertise to read a dump file and when I asked Dell tech support to read one from the last PC here that was blue screening a week ago, they could not read it either. They had the wrong "symbol library". I would like to find out what is causing this and fix it if possible, rather than have to reinstall the OS from scratch. That would have a severe impact on the productivity of this QA manager if I have to do that and then he has to reinstall all his QA software.
0
Comment
Question by:mauldlouie
  • 12
  • 11
  • 4
  • +1
28 Comments
 
LVL 19

Expert Comment

by:Rob Hutchinson
ID: 22901297
0
 
LVL 29

Expert Comment

by:chilternPC
ID: 22901325
the dump file won't be any use except to the windows programmers. - BSOD is probably hardware or device driver problems or over heating problems (check for clogs vents/heat sinks)
if overheated it may have damaged the RAM - try replacing
Dell Pc s usually come with built in daignostics - check the manual but <ctrl> <F12> at startup should bring up the utilities screen where you can check the hardware.
0
 
LVL 29

Expert Comment

by:chilternPC
ID: 22901337
also check the system restore calandar  (start -all programs - accessories -system tools - system restore) use the wizard to check the calendar of check points nad see what was installed - it may be a failed update to one of thedriver (although that would be more frequent if itwas a software problrm.
I tihnkg it its random then its probably temparature and or hardware malfunction .
0
Independent Software Vendors: We Want Your Opinion

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

 

Author Comment

by:mauldlouie
ID: 22901348
Thanks, I will ask user to run the Dell diagnostics and look at system restore calendar. I can't really get on it to troubleshoot as he is always running testing scripts on it.
0
 
LVL 9

Expert Comment

by:samiam41
ID: 22901359
A similar question was asked and the issue related to a network card (3com to be exact).  

http://www.experts-exchange.com/Software/System_Utilities/Diagnostics/Q_22701717.html

It may be worth a shot to upload the dump file.  There are a few tools that can determine if there is a driver that is flaky as in the example above.  Not ruling out hardware errors/failures, but I would start with the dump file.
0
 

Author Comment

by:mauldlouie
ID: 22901381
How can I upload the dump file? I zipped up the 2 dump files from this week and when I tried to upload, I am told "the extension of one or more files in the archive is not in the list of allowed extensions: Mini110408-01.dmp".
0
 
LVL 29

Expert Comment

by:chilternPC
ID: 22901399
the zipped file should have .zip at the end not .dmp
0
 

Author Comment

by:mauldlouie
ID: 22901420
It does have .zip at the end. It was complaining because the zip file contains .dmp files.
0
 
LVL 9

Expert Comment

by:samiam41
ID: 22901727
Rename it logfile1.txt and logfile2.txt.  let us know what to rename it to once we download it.  thanks!
0
 

Author Comment

by:mauldlouie
ID: 22908047
Good idea. I have renamed the files to logfile1.txt and logfile2.txt and zipped them up again.
These files were originally named: Mini110408-01.dmp and Mini110608-01.dmp.
Logfiles.zip
0
 
LVL 29

Expert Comment

by:chilternPC
ID: 22908613
any luck with the diagnostics and the system restore ?
0
 

Author Comment

by:mauldlouie
ID: 22908738
I am waiting for the user to do these as I can't break into his PC to do them as he is always running testing scripts. I also downloaded the latest drivers from Dell and ATI for his PC and asked him to try installing those to see if that helps.
0
 
LVL 9

Expert Comment

by:samiam41
ID: 22908751
Very good.  I will check those out this evening and post something back over the weekend.  Take care!
0
 
LVL 9

Expert Comment

by:samiam41
ID: 22913550
I am looking through the dump files now.  What SP was installed on that pc?
0
 

Author Comment

by:mauldlouie
ID: 22923806
I'm not sure if it's SP2 or SP3 (will have to check with user).
0
 

Author Comment

by:mauldlouie
ID: 22925451
The user has Windows XP Pro SP2.
0
 
LVL 9

Expert Comment

by:samiam41
ID: 22927612
Perfect.  That was the symbol pack I installed.  Running the diag now.
0
 
LVL 9

Expert Comment

by:samiam41
ID: 22927651
Alright, after loading the first dump file you posted, it appears there is a problem with your NIC.  Is this an on-board NIC?  I would disable it in the BIOS and add a new NIC.  If you are looking for a quick "test", reload the drivers of the NIC with the newest version and see if you can duplicate the BSOD.

I am looking through the second dump file now.
0
 
LVL 9

Expert Comment

by:samiam41
ID: 22927657
In case you wanted to see where the first dump file mentioned the problem.  
1: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************
 
DRIVER_CORRUPTED_EXPOOL (c5)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is
caused by drivers that have corrupted the system pool.  Run the driver
verifier against any new (or suspect) drivers, and if that doesn't turn up
the culprit, then use gflags to enable special pool.
Arguments:
Arg1: ff9d9da5, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000001, value 0 = read operation, 1 = write operation
Arg4: 805505a1, address which referenced memory
 
Debugging Details:
------------------
 
 
BUGCHECK_STR:  0xC5_2
 
CURRENT_IRQL:  2
 
FAULTING_IP: 
nt!KiDoubleFaultStack+2a21
805505a1 894804          mov     dword ptr [eax+4],ecx
 
DEFAULT_BUCKET_ID:  DRIVER_FAULT
 
PROCESS_NAME:  System
 
LAST_CONTROL_TRANSFER:  from 8056c4ab to 805505a1
 
STACK_TEXT:  
f7916b98 8056c4ab 00000000 00000001 e5726854 nt!KiDoubleFaultStack+0x2a21
f7916bbc 8056c606 88c42cd0 00000000 00000000 nt!ObOpenObjectByPointer+0x2e
f7916bf0 80573bd0 00000000 89bfbe70 00000000 nt!NtQueryInformationProcess+0xed7
f7916d4c 805740eb f7916db4 001f03ff 00000000 nt!MmMapViewOfSection+0x153
f7916d80 f7415bd8 f7916db4 001f03ff 00000000 nt!IopGetModeInformation+0x2f
f7916dac 80574128 00000074 00000000 00000000 NDIS!ndisWorkerThread+0x4b
f7916ddc 804ec791 f7415b85 00000000 00000000 nt!NtQueryInformationFile+0x459
f7916e94 00000000 00000000 00000000 00000000 nt!MiDeleteSystemPagableVm+0x280
 
 
STACK_COMMAND:  kb
 
FOLLOWUP_IP: 
NDIS!ndisWorkerThread+4b
f7415bd8 ??              ???
 
SYMBOL_STACK_INDEX:  5
 
SYMBOL_NAME:  NDIS!ndisWorkerThread+4b
 
FOLLOWUP_NAME:  MachineOwner
 
MODULE_NAME: NDIS
 
IMAGE_NAME:  NDIS.sys

Open in new window

0
 
LVL 9

Accepted Solution

by:
samiam41 earned 2000 total points
ID: 22927675
The second dump file is wierd.  It's pointing to your ntoskrnl.exe as the culprit.  This is usually a problem with spyware/virus/malware infection.  An infection would also explain the problems with the NIC driver.  You really have a couple options:  1)  Replace the NIC with a new one after disabling it in the BIOS and see what results you get or 2) run a scan with SuperAntiSpyware and see what it turns up.  Either way you will need the pc for 30 minutes while you do either 1 or 2.

If you get any more dump files, let me know so I can review them and see if there is a pattern.  Thanks mauldlouie!

Superantispyware -> http://www.superantispyware.com/downloadfile.html?productid=SUPERANTISPYWAREFREE
0
 

Author Comment

by:mauldlouie
ID: 22932501
Thanks for the info. We have been migrating from TrendMicro OfficeScan (corporate antivirus) & Sunbelt Software CounterSpy to Sunbelt Software Vipre antivirus/antispyware. So I think I will migrate the user to Vipre and run a deep scan and see if it finds anything. I checked his dump directory and don't see any more dump files yet but if he keeps getting BSODs, I will try switching out his NIC as you suggested.
0
 
LVL 9

Expert Comment

by:samiam41
ID: 22934889
Outstanding work.  I will continue to monitor this post for an update.
0
 

Author Comment

by:mauldlouie
ID: 22934994
I upgraded him to Vipre and ran a deep scan and it found nothing except some cookies and non-threats like VNC. At this point, I think I will just monitor his PC and see if it behaves or not. If not, then will try putting in another network card as suggested.
0
 
LVL 9

Expert Comment

by:samiam41
ID: 22935142
You could always check to see what driver version he has on that NIC and check with the manufacturer's website to see what problems are related to that.  If you get any other BSOD, please up load them.  Also, have a spare NIC handy because I would be willing to bet that you see this error again.

; )
0
 

Author Comment

by:mauldlouie
ID: 22935162
I have several spare NICs :). I will see if there is an updated driver for the NIC from the manufacturer. I did download all the updated drivers from Dell's website but they did not have an update for the NIC.
0
 
LVL 9

Expert Comment

by:samiam41
ID: 22935250
Gotcha.  Sounds like you are staying on top of it but those NIC's are responsible for a LOT of ghosts that we chase.  Good luck.  Post back what you find.
0
 
LVL 9

Expert Comment

by:samiam41
ID: 22985076
Any news?
0
 

Author Comment

by:mauldlouie
ID: 22988792
I just checked the event log on the PC and there have been no further BSODs yet.
0

Featured Post

Free Tool: Subnet Calculator

The subnet calculator helps you design networks by taking an IP address and network mask and returning information such as network, broadcast address, and host range.

One of a set of tools we're offering as a way of saying thank you for being a part of the community.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Are you unable to synchronize your OST (Offline Storage Table) file with Microsoft Exchange Server? Is your OST file exceeding 2 GB size limit? In Microsoft Outlook 2002 and earlier versions, there is a 2 GB size limit for the OST file. If the file …
It is only natural that we all want our PCs to be in good working order, improved system performance, so that is exactly how programs are advertised to entice. They say things like:            •      PC crashes? Get registry cleaner to repair it!    …
Two types of users will appreciate AOMEI Backupper Pro: 1 - Those with PCIe drives (and haven't found cloning software that works on them). 2 - Those who want a fast clone of their boot drive (no re-boots needed) and it can clone your drive wh…
With just a little bit of  SQL and VBA, many doors open to cool things like synchronize a list box to display data relevant to other information on a form.  If you have never written code or looked at an SQL statement before, no problem! ...  give i…
Suggested Courses

807 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question