Solved

BSoD and various errors - Minidumps

Posted on 2010-09-08
16
803 Views
Last Modified: 2012-05-10
Hi all,

I have been tring to diagnose a problem on someone's XP system without success.
There seem to be random BSoDs and from what I am told it is usually on start up. I attach a basic analysis of some of these.

The minidump probable causes after a basic analysis are all different:

Mini071310-01: Probably caused by : MpFilter.sys ( MpFilter+a6aa )
Mini071310-01: Probably caused by : win32k.sys ( win32k!xxxDestroyThreadInfo+403 )
Mini073110-01: Probably caused by : ntkrpamp.exe ( nt!NtWaitForMultipleObjects+299 )
Mini080510-01: Probably caused by : SRTSP.SYS ( SRTSP+7be2 )
Mini080510-01: Probably caused by : win32k.sys ( win32k!GetMouseCoord+178 )
Mini080710-01: Probably caused by : NAVEX15.SYS ( NAVEX15+5df6e )
Mini080710-02: Probably caused by : csrss.exe
Mini080710-03: Probably caused by : memory_corruption ( nt!MiLocateAndReserveWsle+51 )

Since I was able to get these minidumps there have been more errors but I have not been there to get any minidumps. His description of these is pasted below.

I can attach the original minidump files from those BSoDs prior to 2nd Sept 10 if it would help. Please let me know.

2nd Sep 2010
On opening that morning screen message “ Recovering form serious error

BCCode 100000071
BCP1 0000008                          BCP2 F78ECD70          
BCP3 0000000                          BCP4 0000000
OSVer 5_1_2600                       SP 3_0 Product 768_1
BLUE SCREEN

3rd Sep 2010
“Serious error” again on switching on
BLUE SCREEN  but I failed to get the BCCode details in time

4th Sep 2010
On switching on “Apologies that Windows did not start successfully ….”  (I was given no time to read the rest of the message and I switched off).

Next try- “ System has recovered from a serious error”

BCCode 1000000a                    
BCP1 DOE06750                       BCP2 0000001
BCP3    0000000                        BCP4    80505F37
OSVer 5_1_2600                       SP 3_0             Product 768_1
BLue Screen

5th Sep 2010
Message after booting “System on J  Fats 32. One of your drives needs to be checked for consistency. You may cancel the disk check but it is strongly recommended you continue.” (Which I did).
“Windows will now check the disk
Volume serial no. is 0000 – OED4. Windows is verifying files and folders (83% completed etc).”
“Checked and found no problems”

It closed down and I then re-booted.  5th September (still) 0510am
“Windows apologises for the inconvenience. Windows did not start normally……”
(I had no time to read the rest before it switched itself off).
I rebooted again at 0525 “System has recovered from a serious error

BCCode 14.
BCP1 0000003              BCP2 86FODOC8
BCP3 86FOD23C                       BCP4 805D2954
OSVer 5_1 2600                        SP3_0
Product no 768_1
Time now 0532
BLUE SCREEN


I would apreciate any help in diagnosing what is wrong with the PC.
Thanks,
Jack
Mini071210-01.txt
Mini071310-01.txt
Mini073010-01.txt
Mini073110-01.txt
Mini080510-01.txt
Mini080710-01.txt
Mini080710-02.txt
Mini080710-03.txt
0
Comment
Question by:JackHodson
  • 10
  • 2
  • 2
  • +2
16 Comments
 
LVL 27

Expert Comment

by:Lukasz Chmielewski
ID: 33624953
Did you run any diagnostic tools ? RAM, HDD, etc. ?
0
 
LVL 4

Author Comment

by:JackHodson
ID: 33624984
Only for spyware so far which was more or less clear.

Which is the best memory and hdd diagnostic tools these days? I have used memtest86 in the past but there seems to be no end to its diagnostic process - or at least I have not been patient enough. I have been a bit time limited in previous visits.

Thanks,
Jack
0
 
LVL 27

Accepted Solution

by:
Lukasz Chmielewski earned 125 total points
ID: 33625018
You were not patient enough :) Run HDD regenerator
http://www.dposoft.net/
at least you can eliminate these two hardware devices. HDD regenerator in demo version allows you to repair only one bad sector, but it can tell you if there are any.
From what it seems the fastest way would be to run a repair install, it does not guarantee success though.
0
 
LVL 4

Author Comment

by:JackHodson
ID: 33625086
There are other HDDs attached too - one by USB and the other is a NAS. I guess I should scan all of these.
I will try memtest again too.

Are the minidump analyses telling you much or are they too random?
0
 
LVL 18

Assisted Solution

by:awawada
awawada earned 250 total points
ID: 33625173
Please upload mini.dmp files.

did any bios changes? Did you change drivers? installed new hardware or antivirus last days?
if you have installed any thing and it started happening after that, try to restore your computer to few days back...

all drivers up to date?
scan with http://driveragent.com/scan_b.php?fn=plugin
after post the “DriverAgent Scan Results” link

all hotfixes and service packs installed?
if no = do it please
if yes:
Can you test your harddisc ram and cpu for errors with: http://www.ultimatebootcd.com/  (FREE) ?
Memory Tests with: Memtest86
CPU Tests with: CPU Burn-in, Mersenne Prime Test & StressCPU
Hard Disk Diagnostic with: your Hard Disk Manufacturers tool. (Drive Fitness Test (IBM/Hitachi) works with most)
0
 
LVL 4

Author Comment

by:JackHodson
ID: 33625286
Thanks awawada, Here are the mini.dmp files.

No changes to bios, drivers or AV - OS is up-to-date with service packs but unsure on hotfixes.

I will create a new UBCD tonight.
Mini071210-01.dmp
Mini071310-01.dmp
Mini073010-01.dmp
Mini073110-01.dmp
Mini080510-01.dmp
Mini080710-01.dmp
Mini080710-02.dmp
Mini080710-03.dmp
0
 
LVL 18

Assisted Solution

by:awawada
awawada earned 250 total points
ID: 33625484
Most dumps points to Symantec. Is Symantec version up to date? Can you tell us the version?
You can also temporary uninstall it and see if the issue exists.

Run
1) Hardware diagnostics as we told
2) Scan your computer for computer viruses with:
- hitmanpro
- malwarebytes
- Panda ActiveScan 2.0
- superantispyware
- Kaspersky Virus Removal Tool
0
 
LVL 4

Expert Comment

by:Nice-Ghaza
ID: 33635033
dear
          please repair the window without format the partiation
i think your problem will be solved
0
Highfive + Dolby Voice = No More Audio Complaints!

Poor audio quality is one of the top reasons people don’t use video conferencing. Get the crispest, clearest audio powered by Dolby Voice in every meeting. Highfive and Dolby Voice deliver the best video conferencing and audio experience for every meeting and every room.

 
LVL 4

Author Comment

by:JackHodson
ID: 33635065
So, boot from the Windows CD and run the repair install?
0
 
LVL 4

Assisted Solution

by:MikeKAtLCS
MikeKAtLCS earned 125 total points
ID: 33636238
I would verify the hardware before attempting a repair.  If you have a hardware problem you may make the system worse than it is now.  I use spinrite 6 for the hard disk testing and memtest 86.  You need to let memtest do at least 2 complete passes.  The more passes the better but 2 should give a fair idea.  I would bet on a virus that the Norton did not pick up.  I would take the hard drive out and install it on another system as a secondary drive. Make sure the system has a current antivirus and is clean.  If you have a root kit virus that may be the only way to detect it or clean it.

If you don't have a lot of time you could get a new hard drive and use cloning software to transfer the files. Use ghost or HD Clone for Murray software.  Still I would make sure the ram is good before doing that.
0
 
LVL 4

Author Comment

by:JackHodson
ID: 33711974
Hi guys, I have the PC with me now. I did 6 passes of memtest86+ (v.410) and no errors. I also ran HDD regenerator and it reported no bad sectors or anything wrong at all.

I was running malwarebytes again and after about an hour or so it gave a blue screen (minidump attached). I did a quick malewarebytes scan after and it reported nothing.

I changed the settings in StartUp and Recovery to give "Complete memory dump" and de-selected automatically restart on blue screen so this attached minidump may be a little different. I got the usual "This computer has recovered from a serious problem" ect on restart.  

Now I am just installing a few windows updates, a video card driver (which I had already done from the Nvidia website), and a couple of Realtec updates.

I have 2 Compaq recovery CDs which look to have been created manually - not sure what is on them yet. Should I just boot from a normal XP Home CD and run the repair option?
Mini091910-01.dmp
0
 
LVL 4

Author Comment

by:JackHodson
ID: 33712522
I tried putting the HDD in another PC to scan and make an image of it but on this machine (Windows 7) it said the disk needed to be formatted before it could be used - obviously this is not an option.

Added to this, whilst messing around with the Compaq recovery options it started a recovery which I stopped (stupidly) and now it is asking for hal.dll to be reinstalled as it is missing or corrupt. I can get this off a windows XP CD but I do not have a way to copy it over to the system32 folder. I have copies of simplyMepis and Ultimate Boot CD but have never really got on with them to copy files from a USB stick etc. Is there a method I can use to do this?

Also, as it is an original Compaq windows installation, could I do a recovery with a normal XP Home CD or should I stick to the Compaq recovery?

Many thanks,
Jack
0
 
LVL 4

Author Comment

by:JackHodson
ID: 33712526
In addition to simplyMepis and UBCD I also have Ubuntu 9.10 to hand in case there are any tools I can be using.
0
 
LVL 4

Author Comment

by:JackHodson
ID: 33714214
It seems that after a second that the Compaq recovery CD ran for, it has wiped out any files and folders starting their file name between A and P. I think the Compaq recovery is probably the safest way forward.

I have got Unbuntu running to get the MS Outlook files off although it is backed up I prefer doing it this way. The rest of the data is stored on a NAS drive.
0
 
LVL 4

Author Comment

by:JackHodson
ID: 33768319
I took the desision to backup all the nitty gritty bits and do a complete system restore.

Thanks for the help.
Jack
0
 
LVL 4

Author Closing Comment

by:JackHodson
ID: 33768327
Used OEM system restore.
0

Featured Post

Threat Intelligence Starter Resources

Integrating threat intelligence can be challenging, and not all companies are ready. These resources can help you build awareness and prepare for defense.

Join & Write a Comment

Join Greg Farro and Ethan Banks from Packet Pushers (http://packetpushers.net/podcast/podcasts/pq-show-93-smart-network-monitoring-paessler-sponsored/) and Greg Ross from Paessler (https://www.paessler.com/prtg) for a discussion about smart network …
Possible fixes for Windows 7 and Windows Server 2008 updating problem. Solutions mentioned are from Microsoft themselves. I started a case with them from our Microsoft Silver Partner option to open a case and get direct support from Microsoft. If s…
Windows 8 comes with a dramatically different user interface known as Metro. Notably missing from the new interface is a Start button and Start Menu. Many users do not like it, much preferring the interface of earlier versions — Windows 7, Windows X…
The viewer will learn how to successfully create a multiboot device using the SARDU utility on Windows 7. Start the SARDU utility: Change the image directory to wherever you store your ISOs, this will prevent you from having 2 copies of an ISO wit…

747 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

13 Experts available now in Live!

Get 1:1 Help Now