BSOD Error code

Today I began seeing spontanious reboots. Just before rebooting a Blue Screen of Death would be displayed only to dissappear right away.  One BSOD did stay on the screen and the error code was:

I need some assistance interpreting this code.

Thanks very much.
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

starpilot1Author Commented:
Is it possible to interpet the rest of the numbers too?
Check in Event Viewer, you may see that some access violations. Then, you could possible interpret those.
The 7 Worst Nightmares of a Sysadmin

Fear not! To defend your business’ IT systems we’re going to shine a light on the seven most sinister terrors that haunt sysadmins. That way you can be sure there’s nothing in your stack waiting to go bump in the night.

It would probably be more beneficial to check for a Minidump which is the state of your system at the time it crashed.  
The dumps are normally located in c:\windows\minidump\    
or  %systemroot%\minidump\

It (or they) will contain information about the bugcheck that was generated.
Can you paste the latest dump(s) in the "Attach Code Snippet" box and someone here can hopefully tell you the cause of the crash.

You may need to disable auto restart:
Right click My Computer > Properties > Advanced > Startup and Recovery Settings and uncheck Automatically Restart.
If you cannot reach Windows, you can turn off the 'Automatic reboot on error' option by selecting the Advanced Options Menu at bootup.  Keep press/releasing the F8 function key and you'll reach a menu where you can select the option "Disable Automatic restart on system failure".

@ PUNKY  .. my earlier comments of course were refering to "the rest of the numbers" statement, not yours  :)
Sure, Yonvee :o) ... feel free to correct me if I post any wrong ... so I can learn more.
starpilot1Author Commented:
Thanks very much for all your esponses - I'll do this tomorrow morning and attach the file...
John GriffithConsultantCommented:
I believe the bugcheck itself is missing - a 0x3 is extremely rare.  I think we have the four parameters, not the STOP code.
I would advise checking WERCON - Problem Reports and Solutions in addition to the already proposed Event Viewer.  Certainly the mini kernel dumps will tell us.  If you can upload them somewhere, I can take a look to see what clues they (it) holds.
WERCON - START | type wercon.exe - hit enter.  View Problems.  The full bugcheck s/b there.
Also look at WERCON portion of msinfo32 - START | type msinfo32 & hit enter | Software Environment | Windows Error Reporting
John GriffithConsultantCommented:
To interpret the four parms (located inside the parenthesis) normally requires a FULL kernel dump.  A mini kernel dump won't do b/c page not contained and therefore unable to convert virtual and physical memory addresses.
starpilot1Author Commented:
Good Morning,
I went to c:\windows\minidump\    and  %systemroot%\minidump\ did not find any Minidumps.  I went to: My Computer > Properties > Advanced > Startup and Recovery Settings and unchecked Automatically Restart - and found the setting for dumps set to None.  I set it to Complete Memory Dump.
My computer doesn't have wercon.exe but I was able to run MSINFO32 andI'm attaching a document that shows that info.
I have 2 GB of RAM and and whe I was trying to do a detect and repair on OUtlook I was getting CRC errors on a file called outlook.pst - I eventually pulled out one of the sticks of RAM and the system calmed down.  It's running fine on 1 GB of RAM - could all thhis have been caused by a bad dimm?

By a bad RAM, yes.  Will analyse your Minidump & get back to you.
A quick check of the results show several reasons for the crashdump which can be indicative of a memory problem.  Will continue to inspect these dumps, but meanwhile you have an option or two ..

1)  Remove the 1GB of RAM & install the 2nd 1GB stick, & see if  the problem returns.

2) Check the sockets/seating of both RAM sticks, pushing both firmly home.

3)  Test both RAMs with memtest86+  v1.70 :

4) Perhaps the best option is to run your machine with the 'good' RAM for a few hours, use a few applications, and see if you can generally encourage it to fail again.
starpilot1Author Commented:
Thanks Jonvee,
I did swap the RAM and found that when one of the DIMMs is in the system behaves badly and am now running the system on what I think is good RAM.  I'll run Memtest shortly.
Although Memtest is good, no memory Test is flawless, and for best results you probably know you'll need to run at least three passes.  Even then, with a report that says a RAM is good, it's no proof that it really is .. a RAM exchange (or swopout) gives the best result.
John GriffithConsultantCommented:
Interesting msinfo32 WERCON - Dr. Watson failed.
CRC (cyclic redundancy check) errors usually refer to hard drives - internal or external.  crc ENSURES that the origin & destination files match using a math equasion.  I would think that physical RAM would be involved only if problematic driver or app running in kernel mode - or if page file damaged, non-existant or under-sized.  It could be "leaky" driver consuming physical RAM then going after virtual memory (page file).
If page file not on OS drive or not large enoughon OS drive to handle total kernel memory + at time of crash, no dump file written.  Another reason could be an app had its own version of dbghelp.dll, which WERCON/msinfo32 indicates - Dr. Watson involved.  Usually not the case.  This would cause a 3rd party program to write the dump - not XP.
May I ask for entire msinfo32 NFO file (saved in NFO format - you'll see the extension when you go to save it)?.  Also, please perform system-wide search for  dmp (those 3 letters), specifically looking in the \Program Files folder.  Enable hidden and system files for search.   You may find a dump file ending in "hdmp" or something similar.
John GriffithConsultantCommented:
Per code snip from msinfo32 - I believe alot more than a RAM issue is going on here.
It appears to me that a vb program was somehow executed which resulted in the crashes as I have documented in the code snip area.
It is likely that the 4 hexadecimal code provided came out of Nero or msvrtcrt.dll itself calling a different dbghelp.dll.  Furthermore, if pure RAM issue, the bugchecks would be all over the map - not the same each time.
The crashes are timed too far apart to be a pure physical RAM issue - page file corruption following the same w/kernel mode drivers would be my guess.
If the XP NT Kernel fails as it appears to have, but did not, I  would expect to see a bugcheck of 0x109 - critical structure corruption.
I believe you will end up running sfc, a system repair, copying drivers in from your XP SP? CD (slipstream) and/or re-installing XP.
Regards. .  .

From msinfo32/WERCON= (edited)   - 
8:01 AM    appcrash iexplore.exe, v 7.0.6000.16735, fault_mod kernel32.dll, v 5.1.2600.5512 
8:02 AM    appcrash iexplore.exe, v 7.0.6000.16735, fault_mod msvcrt.dll, v 7.0.2600.5512  
8:17 AM    appcrash nmdllhost.exe, v, fault_mod neroapiengine.dll, v   
8:31 AM    appcrash nmdllhost.exe, v, fault_mod ntdll.dll, v 5.1.2600.5512    
9:09 AM    appcrash powerarc.exe, v, fault_mod powerarc.exe, v    
9:38 AM    appcrash powerarc.exe, v, fault_mod kernel32.dll, v 5.1.2600.5512 
10:15 AM  appcrash iexplore.exe, v 7.0.6000.16735, fault_mod comctl32.dll, v 6.0.2900.5512 
10:16 AM  appcrash drwtsn32.exe, v 5.1.2600.0, fault_mod dbghelp.dll, v 5.1.2600.5512  
10:35 AM  appcrash egui.exe, v 3.0.672.0, fault_mod uxtheme.dll, v 6.0.2900.5512

Open in new window

John GriffithConsultantCommented:
Apologies - I was unable to edit and did not include the other code snip - showing the cause and explanation line-by-line.
08:01 - IE7 fails w/ the XP NT Kernel
08:02 - IE7 fails again, w/ msvrtcrt.dll - v7.0.2600.5512 - XP modules = 5.1.2600.5512, which means that msvercrt.dll has been modified; 
         MS kb 810940 dates this back to VB6, Windows NT & the days of "DLL HELL" 
08:17 - nmdllhost.exe - no such module in Windows - it belongs to Nero8 - as does the dll file - 
	  look in C:\Program Files\Nero\Nero8\Nero Burning Rom\NEROAPIENGINE.dll
08:31 - nmdllhost.exe crashes again - but the blame goes to the Microsoft NET driver ntdll.dll
09:09 - powerarc.exe crashes - 	this appears to be a Power archiver 2007 German version for file compression and has been linked to Outlook 2002
09:38 - powerarc.exe crashes again - this time w/ the XP NT kernel kernel32.dll
10:15 - ie7 fails again - this time w/ comctl32.dll v6.0.2900.5512 - per ms kb 884883, you probabkly have v5 & v6 on your system
10:16 - drwatson.exe fails w/ dbghelp.dll - Dr Watson - this is the most likely reason no dump file written - no dbghelp.dll driver available
10:35 - egui.exe fails (ESET) w/ uxtheme.dll v6.0.2900.5512 as faulting driver -  MS has kb just for this as well -

Open in new window

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
starpilot1Author Commented:
WOW! What a great Analysis!

I'll run sfc scannow
John GriffithConsultantCommented:
Thank you.
I hope all goes well.
starpilot1Author Commented:
I read your analysis carefully and ran scannow - however I still think it was a bad ram stick - I've replaced it and the system is crisper and stable. Thank you for your tenacity and expert help.  You are the kind of person that keeps me renewing my membership.  Have a great Thanksgiving!!
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Microsoft Legacy OS

From novice to tech pro — start learning today.