• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 588
  • Last Modified:

BSOD in XP SP3 x86

Hi,

I had faced BSOD thrice today on my laptop, and i had to repaired my PST thrice.

and Also i am facing issue the video  not being displayed after coming out of hibernation.  So I end up having to do a cold shutdown.

I ran Windows debugging and the result i am pasting here, i noticed there is one issue with VIPRE agent. But not sure, since I am new for this debugging tool.  Please help me in identifying the issue.

Use !analyze -v to get detailed debugging information.

BugCheck 24, {1902fe, a3175650, a317534c, 8053a933}

*** WARNING: Unable to verify timestamp for fltmgr.sys
Probably caused by : Ntfs.sys ( Ntfs!NtOfsPutData+30d )

Followup: MachineOwner
---------

1: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

NTFS_FILE_SYSTEM (24)
    If you see NtfsExceptionFilter on the stack then the 2nd and 3rd
    parameters are the exception record and context record. Do a .cxr
    on the 3rd parameter and then kb to obtain a more informative stack
    trace.
Arguments:
Arg1: 001902fe
Arg2: a3175650
Arg3: a317534c
Arg4: 8053a933

Debugging Details:
------------------


EXCEPTION_RECORD:  a3175650 -- (.exr 0xffffffffa3175650)
ExceptionAddress: 8053a933 (nt!MiChargeTemporaryCommitmentForReduction+0x00000048)
   ExceptionCode: c0000005 (Access violation)
  ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 00000001
   Parameter[1]: d4c26000
Attempt to write to address d4c26000

CONTEXT:  a317534c -- (.cxr 0xffffffffa317534c)
eax=e1992988 ebx=00000058 ecx=00000016 edx=00000000 esi=e1992930 edi=d4c26000
eip=8053a933 esp=a3175718 ebp=a3175720 iopl=0         nv up ei pl nz ac po nc
cs=0008  ss=0010  ds=0023  es=0023  fs=0030  gs=0000             efl=00010212
nt!MiChargeTemporaryCommitmentForReduction+0x48:
8053a933 f3a5            rep movs dword ptr es:[edi],dword ptr [esi]
Resetting default scope

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  DRIVER_FAULT

PROCESS_NAME:  SBAMSvc.exe

ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

EXCEPTION_PARAMETER1:  00000001

EXCEPTION_PARAMETER2:  d4c26000

WRITE_ADDRESS:  d4c26000 

FOLLOWUP_IP: 
Ntfs!NtOfsPutData+30d
f7174c4e ??              ???

FAULTING_IP: 
nt!MiChargeTemporaryCommitmentForReduction+48
8053a933 f3a5            rep movs dword ptr es:[edi],dword ptr [esi]

BUGCHECK_STR:  0x24

EXCEPTION_DOESNOT_MATCH_CODE:  This indicates a hardware error.
Instruction at 8053a933 does not read/write to d4c26000

LAST_CONTROL_TRANSFER:  from f7174c4e to 8053a933

STACK_TEXT:  
a3175720 f7174c4e d4c26000 e1992930 00000058 nt!MiChargeTemporaryCommitmentForReduction+0x48
a31757c0 f71b6576 a3175a78 e174fd90 fef66000 Ntfs!NtOfsPutData+0x30d
a3175854 f718c2bd a3175a78 00000000 a3175b88 Ntfs!NtfsWriteUsnJournalChanges+0x19c
a3175a5c f715dd4d a3175a78 83a4fe28 8a6d4cc8 Ntfs!NtfsCommonCleanup+0x24c5
a3175bd4 804ef1a9 8a705020 83a4fe28 89d4a030 Ntfs!NtfsFsdCleanup+0xcf
a3175bf4 804ef1a9 8a6d4c10 83a4fe28 83a4fe28 nt!MiFlushSectionInternal+0x27e
a3175c28 f71f206b a3175c48 897726e8 00000000 nt!MiFlushSectionInternal+0x27e
a3175c60 804ef1a9 897726e8 83a4fe28 83a4fe28 fltmgr!FltpDispatch+0x11f
a3175ca0 805bca56 898be020 897726e8 00120196 nt!MiFlushSectionInternal+0x27e
a3175cd4 805bc37f 898be020 00000001 8a776900 nt!PopCreateHiberFile+0xdb
a3175cfc 805bc41d e36fe6a0 865bc960 000007a4 nt!NtCreatePagingFile+0x922
a3175d44 805bc555 000007a4 00000001 00000000 nt!MiZeroPageFileFirstPage+0x99
a3175d58 8054168c 000007a4 063ddd2c 7c90e514 nt!IopCompleteDumpInitialization+0x137
a3175d64 7c90e514 badb0d00 063ddd28 00000000 nt!RtlIpv4StringToAddressExW+0x10d
WARNING: Frame IP not in any known module. Following frames may be wrong.
a3175d68 badb0d00 063ddd28 00000000 00000000 0x7c90e514
a3175d6c 063ddd28 00000000 00000000 00000000 0xbadb0d00
a3175d70 00000000 00000000 00000000 00000000 0x63ddd28


SYMBOL_STACK_INDEX:  1

SYMBOL_NAME:  Ntfs!NtOfsPutData+30d

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: Ntfs

IMAGE_NAME:  Ntfs.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  48025be5

STACK_COMMAND:  .cxr 0xffffffffa317534c ; kb

FAILURE_BUCKET_ID:  0x24_CODE_ADDRESS_MISMATCH_Ntfs!NtOfsPutData+30d

BUCKET_ID:  0x24_CODE_ADDRESS_MISMATCH_Ntfs!NtOfsPutData+30d

Followup: MachineOwner
---------

Open in new window

0
ozzietek
Asked:
ozzietek
2 Solutions
 
g000seCommented:
Hi,  was it working before?  If so, have you tried to restore from last known good configuration?
0
 
edster9999Commented:
This looks like it is a anti-malware program that is causing the issue
http://www.file.net/process/sbamsvc.exe.html

I would try removing that and see if your system becomes more stable
0
 
John HurstBusiness Consultant (Owner)Commented:
First run hardware diagnostics for your particular machine and see if there is a hardware or memory problem. Memtest is also a good memory checker.

Then, if hardware is fine, rootkit malware causes this as well. These are very tricky to remove and sometimes you cannot remove them.

If the machine is new and will go for a while, back up your data, delete all disk partitions on the machine, do a full format and reinstall windows.

If the machine is not new, XP is pretty much dead and newer, faster computers and operating systems are available.

.... Thinkpads_User
0
What does it mean to be "Always On"?

Is your cloud always on? With an Always On cloud you won't have to worry about downtime for maintenance or software application code updates, ensuring that your bottom line isn't affected.

 
yamobintoCommented:
If the BSOD is happening while Windows is running it may be your Windows profile is going corrupt. Probably a good idea to create an new Windows account and give it admin rights in case. That way you can test the machine with the new account and will have a login to use if your profile is tha actual culprit.
0
 
nobusCommented:
you can test with a free AVG, after uninstalling your AV
http://free.avg.com/ww-en/homepage
0
 
Sudeep SharmaTechnical DesignerCommented:
@ozzietek,

Could you please post the dump files from the C:\Windows\Minidump folder for the analysis?

Sudeep
0
 
nobusCommented:
how is it going ozzietek?  any feedback?

it can also be hardware (it refers to it)
so test your ram first with memtest86+ from www.memtest.org
0
 
ozzietekAuthor Commented:
Hello Friends,

I had removed my one memory module and its working fine.
0
 
John HurstBusiness Consultant (Owner)Commented:
Thank you and thanks for the update. .... Thinkpads_User
0
 
nobusCommented:
tx for feedback
0

Featured Post

Hire Technology Freelancers with Gigs

Work with freelancers specializing in everything from database administration to programming, who have proven themselves as experts in their field. Hire the best, collaborate easily, pay securely, and get projects done right.

Tackle projects and never again get stuck behind a technical roadblock.
Join Now