BSoD and various errors - Minidumps

Posted on 2010-09-08
Last Modified: 2012-05-10
Hi all,

I have been tring to diagnose a problem on someone's XP system without success.
There seem to be random BSoDs and from what I am told it is usually on start up. I attach a basic analysis of some of these.

The minidump probable causes after a basic analysis are all different:

Mini071310-01: Probably caused by : MpFilter.sys ( MpFilter+a6aa )
Mini071310-01: Probably caused by : win32k.sys ( win32k!xxxDestroyThreadInfo+403 )
Mini073110-01: Probably caused by : ntkrpamp.exe ( nt!NtWaitForMultipleObjects+299 )
Mini080510-01: Probably caused by : SRTSP.SYS ( SRTSP+7be2 )
Mini080510-01: Probably caused by : win32k.sys ( win32k!GetMouseCoord+178 )
Mini080710-01: Probably caused by : NAVEX15.SYS ( NAVEX15+5df6e )
Mini080710-02: Probably caused by : csrss.exe
Mini080710-03: Probably caused by : memory_corruption ( nt!MiLocateAndReserveWsle+51 )

Since I was able to get these minidumps there have been more errors but I have not been there to get any minidumps. His description of these is pasted below.

I can attach the original minidump files from those BSoDs prior to 2nd Sept 10 if it would help. Please let me know.

2nd Sep 2010
On opening that morning screen message “ Recovering form serious error

BCCode 100000071
BCP1 0000008                          BCP2 F78ECD70          
BCP3 0000000                          BCP4 0000000
OSVer 5_1_2600                       SP 3_0 Product 768_1

3rd Sep 2010
“Serious error” again on switching on
BLUE SCREEN  but I failed to get the BCCode details in time

4th Sep 2010
On switching on “Apologies that Windows did not start successfully ….”  (I was given no time to read the rest of the message and I switched off).

Next try- “ System has recovered from a serious error”

BCCode 1000000a                    
BCP1 DOE06750                       BCP2 0000001
BCP3    0000000                        BCP4    80505F37
OSVer 5_1_2600                       SP 3_0             Product 768_1
BLue Screen

5th Sep 2010
Message after booting “System on J  Fats 32. One of your drives needs to be checked for consistency. You may cancel the disk check but it is strongly recommended you continue.” (Which I did).
“Windows will now check the disk
Volume serial no. is 0000 – OED4. Windows is verifying files and folders (83% completed etc).”
“Checked and found no problems”

It closed down and I then re-booted.  5th September (still) 0510am
“Windows apologises for the inconvenience. Windows did not start normally……”
(I had no time to read the rest before it switched itself off).
I rebooted again at 0525 “System has recovered from a serious error

BCCode 14.
BCP1 0000003              BCP2 86FODOC8
BCP3 86FOD23C                       BCP4 805D2954
OSVer 5_1 2600                        SP3_0
Product no 768_1
Time now 0532

I would apreciate any help in diagnosing what is wrong with the PC.
Question by:JackHodson
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 10
  • 2
  • 2
  • +2
LVL 27

Expert Comment

by:Lukasz Chmielewski
ID: 33624953
Did you run any diagnostic tools ? RAM, HDD, etc. ?

Author Comment

ID: 33624984
Only for spyware so far which was more or less clear.

Which is the best memory and hdd diagnostic tools these days? I have used memtest86 in the past but there seems to be no end to its diagnostic process - or at least I have not been patient enough. I have been a bit time limited in previous visits.

LVL 27

Accepted Solution

Lukasz Chmielewski earned 125 total points
ID: 33625018
You were not patient enough :) Run HDD regenerator
at least you can eliminate these two hardware devices. HDD regenerator in demo version allows you to repair only one bad sector, but it can tell you if there are any.
From what it seems the fastest way would be to run a repair install, it does not guarantee success though.
How our DevOps Teams Maximize Uptime

Our Dev teams are like yours. They’re continually cranking out code for new features/bugs fixes, testing, deploying, responding to production monitoring events and more. It’s complex. So, we thought you’d like to see what’s working for us. Read the use case whitepaper.


Author Comment

ID: 33625086
There are other HDDs attached too - one by USB and the other is a NAS. I guess I should scan all of these.
I will try memtest again too.

Are the minidump analyses telling you much or are they too random?
LVL 18

Assisted Solution

awawada earned 250 total points
ID: 33625173
Please upload mini.dmp files.

did any bios changes? Did you change drivers? installed new hardware or antivirus last days?
if you have installed any thing and it started happening after that, try to restore your computer to few days back...

all drivers up to date?
scan with
after post the “DriverAgent Scan Results” link

all hotfixes and service packs installed?
if no = do it please
if yes:
Can you test your harddisc ram and cpu for errors with:  (FREE) ?
Memory Tests with: Memtest86
CPU Tests with: CPU Burn-in, Mersenne Prime Test & StressCPU
Hard Disk Diagnostic with: your Hard Disk Manufacturers tool. (Drive Fitness Test (IBM/Hitachi) works with most)

Author Comment

ID: 33625286
Thanks awawada, Here are the mini.dmp files.

No changes to bios, drivers or AV - OS is up-to-date with service packs but unsure on hotfixes.

I will create a new UBCD tonight.
LVL 18

Assisted Solution

awawada earned 250 total points
ID: 33625484
Most dumps points to Symantec. Is Symantec version up to date? Can you tell us the version?
You can also temporary uninstall it and see if the issue exists.

1) Hardware diagnostics as we told
2) Scan your computer for computer viruses with:
- hitmanpro
- malwarebytes
- Panda ActiveScan 2.0
- superantispyware
- Kaspersky Virus Removal Tool

Expert Comment

ID: 33635033
          please repair the window without format the partiation
i think your problem will be solved

Author Comment

ID: 33635065
So, boot from the Windows CD and run the repair install?

Assisted Solution

MikeKAtLCS earned 125 total points
ID: 33636238
I would verify the hardware before attempting a repair.  If you have a hardware problem you may make the system worse than it is now.  I use spinrite 6 for the hard disk testing and memtest 86.  You need to let memtest do at least 2 complete passes.  The more passes the better but 2 should give a fair idea.  I would bet on a virus that the Norton did not pick up.  I would take the hard drive out and install it on another system as a secondary drive. Make sure the system has a current antivirus and is clean.  If you have a root kit virus that may be the only way to detect it or clean it.

If you don't have a lot of time you could get a new hard drive and use cloning software to transfer the files. Use ghost or HD Clone for Murray software.  Still I would make sure the ram is good before doing that.

Author Comment

ID: 33711974
Hi guys, I have the PC with me now. I did 6 passes of memtest86+ (v.410) and no errors. I also ran HDD regenerator and it reported no bad sectors or anything wrong at all.

I was running malwarebytes again and after about an hour or so it gave a blue screen (minidump attached). I did a quick malewarebytes scan after and it reported nothing.

I changed the settings in StartUp and Recovery to give "Complete memory dump" and de-selected automatically restart on blue screen so this attached minidump may be a little different. I got the usual "This computer has recovered from a serious problem" ect on restart.  

Now I am just installing a few windows updates, a video card driver (which I had already done from the Nvidia website), and a couple of Realtec updates.

I have 2 Compaq recovery CDs which look to have been created manually - not sure what is on them yet. Should I just boot from a normal XP Home CD and run the repair option?

Author Comment

ID: 33712522
I tried putting the HDD in another PC to scan and make an image of it but on this machine (Windows 7) it said the disk needed to be formatted before it could be used - obviously this is not an option.

Added to this, whilst messing around with the Compaq recovery options it started a recovery which I stopped (stupidly) and now it is asking for hal.dll to be reinstalled as it is missing or corrupt. I can get this off a windows XP CD but I do not have a way to copy it over to the system32 folder. I have copies of simplyMepis and Ultimate Boot CD but have never really got on with them to copy files from a USB stick etc. Is there a method I can use to do this?

Also, as it is an original Compaq windows installation, could I do a recovery with a normal XP Home CD or should I stick to the Compaq recovery?

Many thanks,

Author Comment

ID: 33712526
In addition to simplyMepis and UBCD I also have Ubuntu 9.10 to hand in case there are any tools I can be using.

Author Comment

ID: 33714214
It seems that after a second that the Compaq recovery CD ran for, it has wiped out any files and folders starting their file name between A and P. I think the Compaq recovery is probably the safest way forward.

I have got Unbuntu running to get the MS Outlook files off although it is backed up I prefer doing it this way. The rest of the data is stored on a NAS drive.

Author Comment

ID: 33768319
I took the desision to backup all the nitty gritty bits and do a complete system restore.

Thanks for the help.

Author Closing Comment

ID: 33768327
Used OEM system restore.

Featured Post

The Eight Noble Truths of Backup and Recovery

How can IT departments tackle the challenges of a Big Data world? This white paper provides a roadmap to success and helps companies ensure that all their data is safe and secure, no matter if it resides on-premise with physical or virtual machines or in the cloud.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Learn how to PXE Boot both BIOS & UEFI machines with DHCP Policies and Custom Vendor Classes
The Windows functions GetTickCount and timeGetTime retrieve the number of milliseconds since the system was started. However, the value is stored in a DWORD, which means that it wraps around to zero every 49.7 days. This article shows how to solve t…
As developers, we are not limited to the functions provided by the VBA language. In addition, we can call the functions that are part of the Windows operating system. These functions are part of the Windows API (Application Programming Interface). U…
Get a first impression of how PRTG looks and learn how it works.   This video is a short introduction to PRTG, as an initial overview or as a quick start for new PRTG users.

696 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question