Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Blue Screen? Win32k.sys


  • Please log in to reply
13 replies to this topic

#1 micoa

micoa

  • Members
  • 54 posts
  • OFFLINE
  •  
  • Local time:08:45 AM

Posted 18 August 2008 - 06:27 AM

hi, i have been having complete random reboots with my new computer
my computer specs
quad q9550
Ati Radeon HD4870
650gb hdd
550W thermal take psu

this is from the WinDbg program analysing my dump file

*********************************************************************
* Symbols can not be loaded because symbol path is not initialized. *
* *
* The Symbol Path can be set by: *
* using the _NT_SYMBOL_PATH environment variable. *
* using the -y <symbol_path> argument when starting the debugger. *
* using .sympath and .sympath+ *
*********************************************************************

MODULE_NAME: win32k

FAULTING_MODULE: 804d7000 nt

DEBUG_FLR_IMAGE_TIMESTAMP: 47e0e106

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx". The memory could not be "%s".

FAULTING_IP:
+718053aa
718053aa ?? ???

TRAP_FRAME: a9a41580 -- (.trap 0xffffffffa9a41580)
ErrCode = 00000010
eax=000000a2 ebx=bf80f87b ecx=a9a41620 edx=00107324 esi=00107328 edi=a9a41624
eip=718053aa esp=a9a415f4 ebp=a9a41618 iopl=0 nv up ei ng nz ac pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010296
718053aa ?? ???
Resetting default scope

CUSTOMER_CRASH_COUNT: 4

DEFAULT_BUCKET_ID: WRONG_SYMBOLS

BUGCHECK_STR: 0x8E

LAST_CONTROL_TRANSFER: from bf80f7c1 to 718053aa

STACK_TEXT:
WARNING: Frame IP not in any known module. Following frames may be wrong.
a9a415f0 bf80f7c1 06011178 a9a414d4 a9a41600 0x718053aa
a9a41618 8054086c 06011178 0010732c 7c90eb94 win32k+0xf7c1
a9a41624 7c90eb94 badb0d00 00107324 00000000 nt+0x6986c
a9a41628 badb0d00 00107324 00000000 00000000 0x7c90eb94
a9a4162c 00107324 00000000 00000000 00000000 0xbadb0d00
a9a41630 00000000 00000000 00000000 00000000 0x107324


STACK_COMMAND: kb

FOLLOWUP_IP:
win32k+f7c1
bf80f7c1 8d00 lea eax,[eax]

SYMBOL_STACK_INDEX: 1

SYMBOL_NAME: win32k+f7c1

FOLLOWUP_NAME: MachineOwner

IMAGE_NAME: win32k.sys

BUCKET_ID: WRONG_SYMBOLS

Followup: MachineOwner

thanks in advanced

BC AdBot (Login to Remove)

 


#2 hamluis

hamluis

    Moderator


  • Moderator
  • 56,295 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Killeen, TX
  • Local time:05:15 PM

Posted 18 August 2008 - 09:06 AM

What's the STOP error number given when it BSODs?

Is XP updated?

Similar problems seem to be related to RAM or lack of O/S updates, from what I see.

http://www.google.com/search?hl=en&q=win32k.sys

Louis

#3 usasma

usasma

    Still visually handicapped (avatar is memory developed by my Dad


  • BSOD Kernel Dump Expert
  • 25,091 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Southeastern CT, USA
  • Local time:06:15 PM

Posted 18 August 2008 - 03:17 PM

BUGCHECK_STR: 0x8E

equates to STOP 0x0000008E: KERNEL_MODE_EXCEPTION_NOT_HANDLED

We can assume that the first parameter of the bugcheck is 0xC0000005: STATUS_ACCESS_VIOLATION (A memory access violation occurred) from this line:

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx". The memory could not be "%s".

.

Most often it's a driver issue - but without the correct symbols in the dump analysis we can't see if it's revealed there. Try running the analysis again from the directions at this link: http://forums.majorgeeks.com/showthread.php?t=35246
My browser caused a flood of traffic, sio my IP address was banned. Hope to fix it soon. Will get back to posting as soon as Im able.

- John  (my website: http://www.carrona.org/ )**If you need a more detailed explanation, please ask for it. I have the Knack. **  If I haven't replied in 48 hours, please send me a message. My eye problems have recently increased and I'm having difficult reading posts. (23 Nov 2017)FYI - I am completely blind in the right eye and ~30% blind in the left eye.<p>If the eye problems get worse suddenly, I may not be able to respond.If that's the case and help is needed, please PM a staff member for assistance.

#4 micoa

micoa
  • Topic Starter

  • Members
  • 54 posts
  • OFFLINE
  •  
  • Local time:08:45 AM

Posted 19 August 2008 - 02:33 AM

Microsoft Windows Debugger Version 6.9.0003.113 X86
Copyright Microsoft Corporation. All rights reserved.


Loading Dump File [C:\WINDOWS\Minidump\Mini081808-04.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: C:\WINDOWS\Symbols
Executable search path is:
Unable to load image ntoskrnl.exe, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
Windows XP Kernel Version 2600 (Service Pack 2) MP (4 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055c700
Debug session time: Mon Aug 18 20:26:57.437 2008 (GMT+10)
System Uptime: 0 days 0:55:37.375
Unable to load image ntoskrnl.exe, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
Loading Kernel Symbols
.............................................................................................................................
Loading User Symbols
Loading unloaded module list
...............
Unable to load image win32k.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for win32k.sys
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1000008E, {c0000005, 718053aa, a9a41580, 0}

Probably caused by : win32k.sys ( win32k!RtlInitLargeUnicodeString+4b )

Followup: MachineOwner
---------

1: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

KERNEL_MODE_EXCEPTION_NOT_HANDLED_M (1000008e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003. This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG. This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG. This will let us see why this breakpoint is
happening.
Arguments:
Arg1: c0000005, The exception code that was not handled
Arg2: 718053aa, The address that the exception occurred at
Arg3: a9a41580, Trap Frame
Arg4: 00000000

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx". The memory could not be "%s".

FAULTING_IP:
+718053aa
718053aa ?? ???

TRAP_FRAME: a9a41580 -- (.trap 0xffffffffa9a41580)
ErrCode = 00000010
eax=000000a2 ebx=bf80f87b ecx=a9a41620 edx=00107324 esi=00107328 edi=a9a41624
eip=718053aa esp=a9a415f4 ebp=a9a41618 iopl=0 nv up ei ng nz ac pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010296
718053aa ?? ???
Resetting default scope

CUSTOMER_CRASH_COUNT: 4

DEFAULT_BUCKET_ID: COMMON_SYSTEM_FAULT

BUGCHECK_STR: 0x8E

PROCESS_NAME: WinRAR.exe

LAST_CONTROL_TRANSFER: from bf80f7c1 to 718053aa

STACK_TEXT:
WARNING: Frame IP not in any known module. Following frames may be wrong.
a9a415f0 bf80f7c1 06011178 a9a414d4 a9a41600 0x718053aa
a9a41618 8054086c 06011178 0010732c 7c90eb94 win32k!RtlInitLargeUnicodeString+0x4b
a9a41624 7c90eb94 badb0d00 00107324 00000000 nt!RtlIpv4StringToAddressExA+0x149
a9a41638 00000000 00000000 00000000 00000000 0x7c90eb94


STACK_COMMAND: kb

FOLLOWUP_IP:
win32k!RtlInitLargeUnicodeString+4b
bf80f7c1 8d00 lea eax,[eax]

SYMBOL_STACK_INDEX: 1

SYMBOL_NAME: win32k!RtlInitLargeUnicodeString+4b

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: win32k

IMAGE_NAME: win32k.sys

DEBUG_FLR_IMAGE_TIMESTAMP: 47e0e106

FAILURE_BUCKET_ID: 0x8E_win32k!RtlInitLargeUnicodeString+4b

BUCKET_ID: 0x8E_win32k!RtlInitLargeUnicodeString+4b

Followup: MachineOwner


---------



Microsoft ® Windows Debugger Version 6.9.0003.113 X86
Copyright © Microsoft Corporation. All rights reserved.


Loading Dump File [C:\WINDOWS\Minidump\Mini081808-03.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: C:\WINDOWS\Symbols
Executable search path is:
Unable to load image ntoskrnl.exe, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
Windows XP Kernel Version 2600 (Service Pack 2) MP (4 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055c700
Debug session time: Mon Aug 18 17:54:06.843 2008 (GMT+9)
System Uptime: 0 days 0:24:06.787
Unable to load image ntoskrnl.exe, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
Loading Kernel Symbols
.............................................................................................................................
Loading User Symbols
Loading unloaded module list
...............
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1000000A, {1, 2, 1, 805149e9}

*** WARNING: Unable to verify timestamp for Ntfs.sys
Probably caused by : ntoskrnl.exe ( nt!PipDeviceActionWorker+127 )

Followup: MachineOwner
---------

2: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 00000001, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000001, bitfield :
bit 0 : value 0 = read operation, 1 = write operation
bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: 805149e9, address which referenced memory

Debugging Details:
------------------


WORKER_ROUTINE:
+1
00000001 ?? ???

WORK_ITEM: 805149e9

CURRENT_IRQL: 2

CUSTOMER_CRASH_COUNT: 3

DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: 0xA

PROCESS_NAME: svchost.exe

LOCK_ADDRESS: 80558b60 -- (!locks 80558b60)

Resource @ nt!PiEngineLock (0x80558b60) Available

WARNING: SystemResourcesList->Flink chain invalid. Resource may be corrupted, or already deleted.


WARNING: SystemResourcesList->Blink chain invalid. Resource may be corrupted, or already deleted.

1 total locks

PNP_TRIAGE:
Lock address : 0x80558b60
Thread Count : 0
Thread address: 0x00000000
Thread wait : 0x0

LAST_CONTROL_TRANSFER: from 805154b7 to 805149e9

STACK_TEXT:
aa28b860 805154b7 00001000 898377d4 898377d4 nt!PipDeviceActionWorker+0x127
aa28b8a4 8051567d 00000000 c4842000 c0624210 nt!_amsg_exit+0x1ac
aa28b928 8051f347 e2715018 c4842000 c0624210 nt!IoEnumerateDeviceObjectList+0x2e
aa28b994 8051a1bf 00000000 c4842000 00000000 nt!MmProbeAndLockPages+0x197
aa28b9f4 805683f2 c4842000 00000000 88676008 nt!CcWorkerThread+0xf8
aa28ba80 b9e0ae31 885fdbd0 aa28bac8 00000001 nt!CmpComputeHashValue+0x33
aa28bab4 b9e097b7 88676008 86edec10 e17d6528 Ntfs!NtfsPrepareToShrinkFileSize+0xa3
aa28bb98 b9e08e2f 88676008 86edec10 86e1ce28 Ntfs!NtfsSetEndOfFileInfo+0x144
aa28bc08 b9de1ad8 88676008 86e1ce28 86e1ce28 Ntfs!NtfsCommonSetInformation+0x477
aa28bc70 804eeeb1 8996c020 86e1ce28 86e1cfdc Ntfs!NtfsFsdSetInformation+0xa3
aa28bc94 804eeeb1 8996d848 e27a7ca8 a9dbc6cc nt!MiAddViewsForSection+0x38
aa28bcb0 804eeeb1 86dd8020 86e1ce28 86e1ce38 nt!MiAddViewsForSection+0x38
aa28bd48 8054060c 000006f0 0160f1d4 0160f1e4 nt!MiAddViewsForSection+0x38
aa28bd64 7c90eb94 badb0d00 0160f1b8 00000000 nt!RtlIpv4StringToAddressA+0xfd
WARNING: Frame IP not in any known module. Following frames may be wrong.
aa28bd78 00000000 00000000 00000000 00000000 0x7c90eb94


STACK_COMMAND: kb

FOLLOWUP_IP:
nt!PipDeviceActionWorker+127
805149e9 0000 add byte ptr [eax],al

SYMBOL_STACK_INDEX: 0

SYMBOL_NAME: nt!PipDeviceActionWorker+127

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nt

IMAGE_NAME: ntoskrnl.exe

DEBUG_FLR_IMAGE_TIMESTAMP: 41107b0d

FAILURE_BUCKET_ID: 0xA_nt!PipDeviceActionWorker+127

BUCKET_ID: 0xA_nt!PipDeviceActionWorker+127

Followup: MachineOwner
---------


Microsoft ® Windows Debugger Version 6.9.0003.113 X86
Copyright © Microsoft Corporation. All rights reserved.


Loading Dump File [C:\WINDOWS\Minidump\Mini081808-02.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: C:\WINDOWS\Symbols
Executable search path is:
Unable to load image ntoskrnl.exe, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
Windows XP Kernel Version 2600 (Service Pack 2) MP (4 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055c700
Debug session time: Mon Aug 18 17:29:05.171 2008 (GMT+10)
System Uptime: 0 days 0:27:01.116
Unable to load image ntoskrnl.exe, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
Loading Kernel Symbols
............................................................................................................................
Loading User Symbols
Loading unloaded module list
...............
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 24, {1902fe, a982053c, a9820238, b9e06d53}

*** WARNING: Unable to verify timestamp for Ntfs.sys
*** WARNING: Unable to verify timestamp for sr.sys
Unable to load image eamon.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for eamon.sys
*** ERROR: Module load completed but symbols could not be loaded for eamon.sys
Probably caused by : Ntfs.sys ( Ntfs!NtfsCommonCreate+10c3 )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

NTFS_FILE_SYSTEM (24)
If you see NtfsExceptionFilter on the stack then the 2nd and 3rd
parameters are the exception record and context record. Do a .cxr
on the 3rd parameter and then kb to obtain a more informative stack
trace.
Arguments:
Arg1: 001902fe
Arg2: a982053c
Arg3: a9820238
Arg4: b9e06d53

Debugging Details:
------------------


EXCEPTION_RECORD: a982053c -- (.exr 0xffffffffa982053c)
ExceptionAddress: b9e06d53 (Ntfs!NtfsLookupEntry)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 00000001
Parameter[1]: 00000101
Attempt to write to address 00000101

CONTEXT: a9820238 -- (.cxr 0xffffffffa9820238)
eax=00000101 ebx=a9820980 ecx=00000000 edx=a9820630 esi=00000000 edi=a9820850
eip=b9e06d53 esp=a9820604 ebp=a982082c iopl=0 nv up ei pl nz na po nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010202
Ntfs!NtfsLookupEntry:
b9e06d53 0000 add byte ptr [eax],al ds:0023:00000101=??
Resetting default scope

CUSTOMER_CRASH_COUNT: 2

PROCESS_NAME: IEXPLORE.EXE

ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx". The memory could not be "%s".

WRITE_ADDRESS: 00000101

BUGCHECK_STR: 0x24

DEFAULT_BUCKET_ID: NULL_CLASS_PTR_DEREFERENCE

LAST_CONTROL_TRANSFER: from b9e06b28 to b9e06d53

STACK_TEXT:
a9820600 b9e06b28 a9820850 e27c4d20 00000101 Ntfs!NtfsLookupEntry
a982082c b9e02f72 a9820850 88680300 a9820980 Ntfs!NtfsCommonCreate+0x10c3
a98209d8 b9e89f70 88680300 a9820c00 8a682020 Ntfs!NtfsNetworkOpenCreate+0x8a
a98209f8 a9deaab2 88680300 a9820c00 8a683c10 sr!SrFastIoQueryOpen+0x40
WARNING: Stack unwind information not available. Following frames may be wrong.
a9820a18 80581dc6 88680300 a9820c00 86fa4ac0 eamon+0x4ab2
a9820b04 805bdd10 8a68a2b8 00000000 8866d728 nt!NtQueryInformationProcess+0x2d9
a9820b7c 805ba398 00000000 a9820bbc 00000040 nt!NtCreatePagingFile+0x420
a9820bd0 80575de1 00000000 00000000 a9820c01 nt!CcPfParametersRead+0x8f
a9820d54 8054060c 026df1f4 026df1cc 026df220 nt!RtlpCoalesceFreeBlocks+0x3f
a9820d64 7c90eb94 badb0d00 026df1b8 aaa87d98 nt!RtlIpv4StringToAddressA+0xfd
a9820d78 00000000 00000000 00000000 00000000 0x7c90eb94


FOLLOWUP_IP:
Ntfs!NtfsCommonCreate+10c3
b9e06b28 84c0 test al,al

SYMBOL_STACK_INDEX: 1

SYMBOL_NAME: Ntfs!NtfsCommonCreate+10c3

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: Ntfs

IMAGE_NAME: Ntfs.sys

DEBUG_FLR_IMAGE_TIMESTAMP: 41107eea

STACK_COMMAND: .cxr 0xffffffffa9820238 ; kb

FAILURE_BUCKET_ID: 0x24_Ntfs!NtfsCommonCreate+10c3

BUCKET_ID: 0x24_Ntfs!NtfsCommonCreate+10c3

Followup: MachineOwner
---------


Microsoft ® Windows Debugger Version 6.9.0003.113 X86
Copyright © Microsoft Corporation. All rights reserved.


Loading Dump File [C:\WINDOWS\Minidump\Mini081808-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: C:\WINDOWS\Symbols
Executable search path is:
Unable to load image ntoskrnl.exe, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
Windows XP Kernel Version 2600 (Service Pack 2) MP (4 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055c700
Debug session time: Mon Aug 18 17:01:09.343 2008 (GMT+10)
System Uptime: 0 days 0:12:28.915
Unable to load image ntoskrnl.exe, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
Loading Kernel Symbols
...........................................................................................................................
Loading User Symbols
Loading unloaded module list
................
Unable to load image win32k.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for win32k.sys
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1000008E, {c0000005, bf900ec5, a9c616b8, 0}

Probably caused by : win32k.sys ( win32k!GreStretchDIBitsInternal+b7b )

Followup: MachineOwner
---------

2: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

KERNEL_MODE_EXCEPTION_NOT_HANDLED_M (1000008e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003. This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG. This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG. This will let us see why this breakpoint is
happening.
Arguments:
Arg1: c0000005, The exception code that was not handled
Arg2: bf900ec5, The address that the exception occurred at
Arg3: a9c616b8, Trap Frame
Arg4: 00000000

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx". The memory could not be "%s".

FAULTING_IP:
win32k!GreStretchDIBitsInternal+b7b
bf900ec5 0000 add byte ptr [eax],al

TRAP_FRAME: a9c616b8 -- (.trap 0xffffffffa9c616b8)
ErrCode = 00000002
eax=00000000 ebx=bf8ff588 ecx=e3adf008 edx=bf8ff588 esi=bf8ff588 edi=e365eb40
eip=bf900ec5 esp=a9c6172c ebp=a9c61874 iopl=0 nv up ei pl zr na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010246
win32k!GreStretchDIBitsInternal+0xb7b:
bf900ec5 0000 add byte ptr [eax],al ds:0023:00000000=??
Resetting default scope

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: 0x8E

PROCESS_NAME: IEXPLORE.EXE

LAST_CONTROL_TRANSFER: from bf9014e9 to bf900ec5

STACK_TEXT:
a9c61874 bf9014e9 00000400 000000b3 00000098 win32k!GreStretchDIBitsInternal+0xb7b
a9c618ec 8054060c 51010f93 000000b3 00000098 win32k!NtGdiStretchDIBitsInternal+0xd2
a9c61934 7c90eb94 badb0d00 0013a3dc 805beb9f nt!RtlIpv4StringToAddressA+0xfd
WARNING: Frame IP not in any known module. Following frames may be wrong.
a9c61948 a9c61901 00000000 e11c7a28 a9c61c1c 0x7c90eb94
a9c6194c 00000000 e11c7a28 a9c61c1c a9c61901 0xa9c61901


STACK_COMMAND: kb

FOLLOWUP_IP:
win32k!GreStretchDIBitsInternal+b7b
bf900ec5 0000 add byte ptr [eax],al

SYMBOL_STACK_INDEX: 0

SYMBOL_NAME: win32k!GreStretchDIBitsInternal+b7b

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: win32k

IMAGE_NAME: win32k.sys

DEBUG_FLR_IMAGE_TIMESTAMP: 41107f7a

FAILURE_BUCKET_ID: 0x8E_win32k!GreStretchDIBitsInternal+b7b

BUCKET_ID: 0x8E_win32k!GreStretchDIBitsInternal+b7b

Followup: MachineOwner
---------

Edited by micoa, 19 August 2008 - 02:37 AM.


#5 usasma

usasma

    Still visually handicapped (avatar is memory developed by my Dad


  • BSOD Kernel Dump Expert
  • 25,091 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Southeastern CT, USA
  • Local time:06:15 PM

Posted 19 August 2008 - 08:25 AM

There's no clear cut answer contained in the dump analysis'. I'd suggest enabling Driver Verifier ( http://support.microsoft.com/kb/244617 ) to see if it can pinpoint it.

To do this, go to Start - Run - and type in "verifier.exe" (without the quotes) and press Enter.
In the first screen, just click the "Next" button (this'll create the Standard settings)
In the second screen, also just click the "Next" button (this'll select the unsigned drivers)
In the next screen, click on "Finish" (this'll confirm the selection of the unsigned drivers).

Ideally, you'll then reboot the system and will be greeted with a BSOD as soon as those drivers load. You'll have to analyze that minidump and post it for us to have a look at (it should reveal the driver name).

Sometimes the BSOD won't occur immediately - and that usually means that the information presented in the next minidump may or may not be helpful. Still, it's extra info for us to work with.

Once the minidump is captured, you must go back into Driver Verifier, and at the first screen select "Delete existing settings". Driver Verifier adds some stuff when it's running and this will affect the performance of your system (and is why we don't verify all the drivers on the system - as it would be painfully slow). Deleting the settings will stop the Driver Verifier components from running in the future.
My browser caused a flood of traffic, sio my IP address was banned. Hope to fix it soon. Will get back to posting as soon as Im able.

- John  (my website: http://www.carrona.org/ )**If you need a more detailed explanation, please ask for it. I have the Knack. **  If I haven't replied in 48 hours, please send me a message. My eye problems have recently increased and I'm having difficult reading posts. (23 Nov 2017)FYI - I am completely blind in the right eye and ~30% blind in the left eye.<p>If the eye problems get worse suddenly, I may not be able to respond.If that's the case and help is needed, please PM a staff member for assistance.

#6 micoa

micoa
  • Topic Starter

  • Members
  • 54 posts
  • OFFLINE
  •  
  • Local time:08:45 AM

Posted 22 August 2008 - 07:37 AM

Microsoft ® Windows Debugger Version 6.9.0003.113 X86
Copyright © Microsoft Corporation. All rights reserved.


Loading Dump File [C:\WINDOWS\Minidump\Mini082208-02.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: C:\WINDOWS\Symbols
Executable search path is:
Unable to load image ntoskrnl.exe, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
Windows XP Kernel Version 2600 (Service Pack 2) MP (4 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055c700
Debug session time: Fri Aug 22 21:41:53.406 2008 (GMT+9)
System Uptime: 0 days 2:31:25.968
Unable to load image ntoskrnl.exe, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
Loading Kernel Symbols
..............................................................................................................................
Loading User Symbols
Loading unloaded module list
.....................
Unable to load image win32k.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for win32k.sys
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1000008E, {c000001d, bf8b6947, b92b2070, 0}

Probably caused by : win32k.sys ( win32k!SetupClassAtoms+c8 )

Followup: MachineOwner
---------

2: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

KERNEL_MODE_EXCEPTION_NOT_HANDLED_M (1000008e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003. This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG. This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG. This will let us see why this breakpoint is
happening.
Arguments:
Arg1: c000001d, The exception code that was not handled
Arg2: bf8b6947, The address that the exception occurred at
Arg3: b92b2070, Trap Frame
Arg4: 00000000

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc000001d - {EXCEPTION} Illegal Instruction An attempt was made to execute an illegal instruction.

FAULTING_IP:
win32k!SetupClassAtoms+c8
bf8b6947 ff ???

TRAP_FRAME: b92b2070 -- (.trap 0xffffffffb92b2070)
ErrCode = 00000000
eax=bfbbbde4 ebx=b92b2188 ecx=b92b2110 edx=00000001 esi=ffffffff edi=b92b2180
eip=bf8b6947 esp=b92b20e4 ebp=b92b21cc iopl=0 nv dn ei ng nz ac pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010696
win32k!SetupClassAtoms+0xc8:
bf8b6947 ff ???
Resetting default scope

CUSTOMER_CRASH_COUNT: 2

DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: 0x8E

PROCESS_NAME: csrss.exe

LAST_CONTROL_TRANSFER: from bf8b94ca to bf8b6947

FAILED_INSTRUCTION_ADDRESS:
win32k!SetupClassAtoms+c8
bf8b6947 ff ???

STACK_TEXT:
b92b21cc bf8b94ca 000001bb 00000000 fffffce0 win32k!SetupClassAtoms+0xc8
b92b21e0 bf8ce1b6 b92b2188 b92b22ac b92b21ac win32k!DrvChangeDisplaySettings+0x877
b92b235c e5fc1458 00000001 b92b2518 b92b2570 win32k!DrvEnumDisplayDevices+0x287
WARNING: Frame IP not in any known module. Following frames may be wrong.
00000000 00000000 00000000 00000000 00000000 0xe5fc1458


STACK_COMMAND: kb

FOLLOWUP_IP:
win32k!SetupClassAtoms+c8
bf8b6947 ff ???

SYMBOL_STACK_INDEX: 0

SYMBOL_NAME: win32k!SetupClassAtoms+c8

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: win32k

IMAGE_NAME: win32k.sys

DEBUG_FLR_IMAGE_TIMESTAMP: 47e0e106

FAILURE_BUCKET_ID: 0x8E_BAD_IP_win32k!SetupClassAtoms+c8

BUCKET_ID: 0x8E_BAD_IP_win32k!SetupClassAtoms+c8

Followup: MachineOwner
---------


Microsoft ® Windows Debugger Version 6.9.0003.113 X86
Copyright © Microsoft Corporation. All rights reserved.


Loading Dump File [C:\WINDOWS\Minidump\Mini082208-02.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: C:\WINDOWS\Symbols
Executable search path is:
Unable to load image ntoskrnl.exe, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
Windows XP Kernel Version 2600 (Service Pack 2) MP (4 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055c700
Debug session time: Fri Aug 22 21:41:53.406 2008 (GMT+9)
System Uptime: 0 days 2:31:25.968
Unable to load image ntoskrnl.exe, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
Loading Kernel Symbols
..............................................................................................................................
Loading User Symbols
Loading unloaded module list
.....................
Unable to load image win32k.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for win32k.sys
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1000008E, {c000001d, bf8b6947, b92b2070, 0}

Probably caused by : win32k.sys ( win32k!SetupClassAtoms+c8 )

Followup: MachineOwner
---------

2: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

KERNEL_MODE_EXCEPTION_NOT_HANDLED_M (1000008e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003. This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG. This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG. This will let us see why this breakpoint is
happening.
Arguments:
Arg1: c000001d, The exception code that was not handled
Arg2: bf8b6947, The address that the exception occurred at
Arg3: b92b2070, Trap Frame
Arg4: 00000000

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc000001d - {EXCEPTION} Illegal Instruction An attempt was made to execute an illegal instruction.

FAULTING_IP:
win32k!SetupClassAtoms+c8
bf8b6947 ff ???

TRAP_FRAME: b92b2070 -- (.trap 0xffffffffb92b2070)
ErrCode = 00000000
eax=bfbbbde4 ebx=b92b2188 ecx=b92b2110 edx=00000001 esi=ffffffff edi=b92b2180
eip=bf8b6947 esp=b92b20e4 ebp=b92b21cc iopl=0 nv dn ei ng nz ac pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010696
win32k!SetupClassAtoms+0xc8:
bf8b6947 ff ???
Resetting default scope

CUSTOMER_CRASH_COUNT: 2

DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: 0x8E

PROCESS_NAME: csrss.exe

LAST_CONTROL_TRANSFER: from bf8b94ca to bf8b6947

FAILED_INSTRUCTION_ADDRESS:
win32k!SetupClassAtoms+c8
bf8b6947 ff ???

STACK_TEXT:
b92b21cc bf8b94ca 000001bb 00000000 fffffce0 win32k!SetupClassAtoms+0xc8
b92b21e0 bf8ce1b6 b92b2188 b92b22ac b92b21ac win32k!DrvChangeDisplaySettings+0x877
b92b235c e5fc1458 00000001 b92b2518 b92b2570 win32k!DrvEnumDisplayDevices+0x287
WARNING: Frame IP not in any known module. Following frames may be wrong.
00000000 00000000 00000000 00000000 00000000 0xe5fc1458


STACK_COMMAND: kb

FOLLOWUP_IP:
win32k!SetupClassAtoms+c8
bf8b6947 ff ???

SYMBOL_STACK_INDEX: 0

SYMBOL_NAME: win32k!SetupClassAtoms+c8

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: win32k

IMAGE_NAME: win32k.sys

DEBUG_FLR_IMAGE_TIMESTAMP: 47e0e106

FAILURE_BUCKET_ID: 0x8E_BAD_IP_win32k!SetupClassAtoms+c8

BUCKET_ID: 0x8E_BAD_IP_win32k!SetupClassAtoms+c8

Followup: MachineOwner
---------


Microsoft ® Windows Debugger Version 6.9.0003.113 X86
Copyright © Microsoft Corporation. All rights reserved.


Loading Dump File [C:\WINDOWS\Minidump\Mini082208-02.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: C:\WINDOWS\Symbols
Executable search path is:
Unable to load image ntoskrnl.exe, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
Windows XP Kernel Version 2600 (Service Pack 2) MP (4 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055c700
Debug session time: Fri Aug 22 21:41:53.406 2008 (GMT+9)
System Uptime: 0 days 2:31:25.968
Unable to load image ntoskrnl.exe, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
Loading Kernel Symbols
..............................................................................................................................
Loading User Symbols
Loading unloaded module list
.....................
Unable to load image win32k.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for win32k.sys
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1000008E, {c000001d, bf8b6947, b92b2070, 0}

Probably caused by : win32k.sys ( win32k!SetupClassAtoms+c8 )

Followup: MachineOwner
---------

2: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

KERNEL_MODE_EXCEPTION_NOT_HANDLED_M (1000008e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003. This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG. This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG. This will let us see why this breakpoint is
happening.
Arguments:
Arg1: c000001d, The exception code that was not handled
Arg2: bf8b6947, The address that the exception occurred at
Arg3: b92b2070, Trap Frame
Arg4: 00000000

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc000001d - {EXCEPTION} Illegal Instruction An attempt was made to execute an illegal instruction.

FAULTING_IP:
win32k!SetupClassAtoms+c8
bf8b6947 ff ???

TRAP_FRAME: b92b2070 -- (.trap 0xffffffffb92b2070)
ErrCode = 00000000
eax=bfbbbde4 ebx=b92b2188 ecx=b92b2110 edx=00000001 esi=ffffffff edi=b92b2180
eip=bf8b6947 esp=b92b20e4 ebp=b92b21cc iopl=0 nv dn ei ng nz ac pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010696
win32k!SetupClassAtoms+0xc8:
bf8b6947 ff ???
Resetting default scope

CUSTOMER_CRASH_COUNT: 2

DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: 0x8E

PROCESS_NAME: csrss.exe

LAST_CONTROL_TRANSFER: from bf8b94ca to bf8b6947

FAILED_INSTRUCTION_ADDRESS:
win32k!SetupClassAtoms+c8
bf8b6947 ff ???

STACK_TEXT:
b92b21cc bf8b94ca 000001bb 00000000 fffffce0 win32k!SetupClassAtoms+0xc8
b92b21e0 bf8ce1b6 b92b2188 b92b22ac b92b21ac win32k!DrvChangeDisplaySettings+0x877
b92b235c e5fc1458 00000001 b92b2518 b92b2570 win32k!DrvEnumDisplayDevices+0x287
WARNING: Frame IP not in any known module. Following frames may be wrong.
00000000 00000000 00000000 00000000 00000000 0xe5fc1458


STACK_COMMAND: kb

FOLLOWUP_IP:
win32k!SetupClassAtoms+c8
bf8b6947 ff ???

SYMBOL_STACK_INDEX: 0

SYMBOL_NAME: win32k!SetupClassAtoms+c8

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: win32k

IMAGE_NAME: win32k.sys

DEBUG_FLR_IMAGE_TIMESTAMP: 47e0e106

FAILURE_BUCKET_ID: 0x8E_BAD_IP_win32k!SetupClassAtoms+c8

BUCKET_ID: 0x8E_BAD_IP_win32k!SetupClassAtoms+c8

Followup: MachineOwner
---------


Microsoft ® Windows Debugger Version 6.9.0003.113 X86
Copyright © Microsoft Corporation. All rights reserved.


Loading Dump File [C:\WINDOWS\Minidump\Mini082208-02.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: C:\WINDOWS\Symbols
Executable search path is:
Unable to load image ntoskrnl.exe, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
Windows XP Kernel Version 2600 (Service Pack 2) MP (4 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055c700
Debug session time: Fri Aug 22 21:41:53.406 2008 (GMT+9)
System Uptime: 0 days 2:31:25.968
Unable to load image ntoskrnl.exe, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
Loading Kernel Symbols
..............................................................................................................................
Loading User Symbols
Loading unloaded module list
.....................
Unable to load image win32k.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for win32k.sys
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1000008E, {c000001d, bf8b6947, b92b2070, 0}

Probably caused by : win32k.sys ( win32k!SetupClassAtoms+c8 )

Followup: MachineOwner
---------

2: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

KERNEL_MODE_EXCEPTION_NOT_HANDLED_M (1000008e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003. This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG. This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG. This will let us see why this breakpoint is
happening.
Arguments:
Arg1: c000001d, The exception code that was not handled
Arg2: bf8b6947, The address that the exception occurred at
Arg3: b92b2070, Trap Frame
Arg4: 00000000

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc000001d - {EXCEPTION} Illegal Instruction An attempt was made to execute an illegal instruction.

FAULTING_IP:
win32k!SetupClassAtoms+c8
bf8b6947 ff ???

TRAP_FRAME: b92b2070 -- (.trap 0xffffffffb92b2070)
ErrCode = 00000000
eax=bfbbbde4 ebx=b92b2188 ecx=b92b2110 edx=00000001 esi=ffffffff edi=b92b2180
eip=bf8b6947 esp=b92b20e4 ebp=b92b21cc iopl=0 nv dn ei ng nz ac pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010696
win32k!SetupClassAtoms+0xc8:
bf8b6947 ff ???
Resetting default scope

CUSTOMER_CRASH_COUNT: 2

DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: 0x8E

PROCESS_NAME: csrss.exe

LAST_CONTROL_TRANSFER: from bf8b94ca to bf8b6947

FAILED_INSTRUCTION_ADDRESS:
win32k!SetupClassAtoms+c8
bf8b6947 ff ???

STACK_TEXT:
b92b21cc bf8b94ca 000001bb 00000000 fffffce0 win32k!SetupClassAtoms+0xc8
b92b21e0 bf8ce1b6 b92b2188 b92b22ac b92b21ac win32k!DrvChangeDisplaySettings+0x877
b92b235c e5fc1458 00000001 b92b2518 b92b2570 win32k!DrvEnumDisplayDevices+0x287
WARNING: Frame IP not in any known module. Following frames may be wrong.
00000000 00000000 00000000 00000000 00000000 0xe5fc1458


STACK_COMMAND: kb

FOLLOWUP_IP:
win32k!SetupClassAtoms+c8
bf8b6947 ff ???

SYMBOL_STACK_INDEX: 0

SYMBOL_NAME: win32k!SetupClassAtoms+c8

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: win32k

IMAGE_NAME: win32k.sys

DEBUG_FLR_IMAGE_TIMESTAMP: 47e0e106

FAILURE_BUCKET_ID: 0x8E_BAD_IP_win32k!SetupClassAtoms+c8

BUCKET_ID: 0x8E_BAD_IP_win32k!SetupClassAtoms+c8

Followup: MachineOwner
---------


Microsoft ® Windows Debugger Version 6.9.0003.113 X86
Copyright © Microsoft Corporation. All rights reserved.


Loading Dump File [C:\WINDOWS\Minidump\Mini082208-02.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: C:\WINDOWS\Symbols
Executable search path is:
Unable to load image ntoskrnl.exe, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
Windows XP Kernel Version 2600 (Service Pack 2) MP (4 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055c700
Debug session time: Fri Aug 22 21:41:53.406 2008 (GMT+9)
System Uptime: 0 days 2:31:25.968
Unable to load image ntoskrnl.exe, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
Loading Kernel Symbols
..............................................................................................................................
Loading User Symbols
Loading unloaded module list
.....................
Unable to load image win32k.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for win32k.sys
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1000008E, {c000001d, bf8b6947, b92b2070, 0}

Probably caused by : win32k.sys ( win32k!SetupClassAtoms+c8 )

Followup: MachineOwner
---------

2: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

KERNEL_MODE_EXCEPTION_NOT_HANDLED_M (1000008e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003. This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG. This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG. This will let us see why this breakpoint is
happening.
Arguments:
Arg1: c000001d, The exception code that was not handled
Arg2: bf8b6947, The address that the exception occurred at
Arg3: b92b2070, Trap Frame
Arg4: 00000000

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc000001d - {EXCEPTION} Illegal Instruction An attempt was made to execute an illegal instruction.

FAULTING_IP:
win32k!SetupClassAtoms+c8
bf8b6947 ff ???

TRAP_FRAME: b92b2070 -- (.trap 0xffffffffb92b2070)
ErrCode = 00000000
eax=bfbbbde4 ebx=b92b2188 ecx=b92b2110 edx=00000001 esi=ffffffff edi=b92b2180
eip=bf8b6947 esp=b92b20e4 ebp=b92b21cc iopl=0 nv dn ei ng nz ac pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010696
win32k!SetupClassAtoms+0xc8:
bf8b6947 ff ???
Resetting default scope

CUSTOMER_CRASH_COUNT: 2

DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: 0x8E

PROCESS_NAME: csrss.exe

LAST_CONTROL_TRANSFER: from bf8b94ca to bf8b6947

FAILED_INSTRUCTION_ADDRESS:
win32k!SetupClassAtoms+c8
bf8b6947 ff ???

STACK_TEXT:
b92b21cc bf8b94ca 000001bb 00000000 fffffce0 win32k!SetupClassAtoms+0xc8
b92b21e0 bf8ce1b6 b92b2188 b92b22ac b92b21ac win32k!DrvChangeDisplaySettings+0x877
b92b235c e5fc1458 00000001 b92b2518 b92b2570 win32k!DrvEnumDisplayDevices+0x287
WARNING: Frame IP not in any known module. Following frames may be wrong.
00000000 00000000 00000000 00000000 00000000 0xe5fc1458


STACK_COMMAND: kb

FOLLOWUP_IP:
win32k!SetupClassAtoms+c8
bf8b6947 ff ???

SYMBOL_STACK_INDEX: 0

SYMBOL_NAME: win32k!SetupClassAtoms+c8

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: win32k

IMAGE_NAME: win32k.sys

DEBUG_FLR_IMAGE_TIMESTAMP: 47e0e106

FAILURE_BUCKET_ID: 0x8E_BAD_IP_win32k!SetupClassAtoms+c8

BUCKET_ID: 0x8E_BAD_IP_win32k!SetupClassAtoms+c8

Followup: MachineOwner
---------


Microsoft ® Windows Debugger Version 6.9.0003.113 X86
Copyright © Microsoft Corporation. All rights reserved.


Loading Dump File [C:\WINDOWS\Minidump\Mini082208-02.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: C:\WINDOWS\Symbols
Executable search path is:
Unable to load image ntoskrnl.exe, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
Windows XP Kernel Version 2600 (Service Pack 2) MP (4 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055c700
Debug session time: Fri Aug 22 21:41:53.406 2008 (GMT+9)
System Uptime: 0 days 2:31:25.968
Unable to load image ntoskrnl.exe, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
Loading Kernel Symbols
..............................................................................................................................
Loading User Symbols
Loading unloaded module list
.....................
Unable to load image win32k.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for win32k.sys
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1000008E, {c000001d, bf8b6947, b92b2070, 0}

Probably caused by : win32k.sys ( win32k!SetupClassAtoms+c8 )

Followup: MachineOwner
---------

2: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

KERNEL_MODE_EXCEPTION_NOT_HANDLED_M (1000008e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003. This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG. This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG. This will let us see why this breakpoint is
happening.
Arguments:
Arg1: c000001d, The exception code that was not handled
Arg2: bf8b6947, The address that the exception occurred at
Arg3: b92b2070, Trap Frame
Arg4: 00000000

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc000001d - {EXCEPTION} Illegal Instruction An attempt was made to execute an illegal instruction.

FAULTING_IP:
win32k!SetupClassAtoms+c8
bf8b6947 ff ???

TRAP_FRAME: b92b2070 -- (.trap 0xffffffffb92b2070)
ErrCode = 00000000
eax=bfbbbde4 ebx=b92b2188 ecx=b92b2110 edx=00000001 esi=ffffffff edi=b92b2180
eip=bf8b6947 esp=b92b20e4 ebp=b92b21cc iopl=0 nv dn ei ng nz ac pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010696
win32k!SetupClassAtoms+0xc8:
bf8b6947 ff ???
Resetting default scope

CUSTOMER_CRASH_COUNT: 2

DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: 0x8E

PROCESS_NAME: csrss.exe

LAST_CONTROL_TRANSFER: from bf8b94ca to bf8b6947

FAILED_INSTRUCTION_ADDRESS:
win32k!SetupClassAtoms+c8
bf8b6947 ff ???

STACK_TEXT:
b92b21cc bf8b94ca 000001bb 00000000 fffffce0 win32k!SetupClassAtoms+0xc8
b92b21e0 bf8ce1b6 b92b2188 b92b22ac b92b21ac win32k!DrvChangeDisplaySettings+0x877
b92b235c e5fc1458 00000001 b92b2518 b92b2570 win32k!DrvEnumDisplayDevices+0x287
WARNING: Frame IP not in any known module. Following frames may be wrong.
00000000 00000000 00000000 00000000 00000000 0xe5fc1458


STACK_COMMAND: kb

FOLLOWUP_IP:
win32k!SetupClassAtoms+c8
bf8b6947 ff ???

SYMBOL_STACK_INDEX: 0

SYMBOL_NAME: win32k!SetupClassAtoms+c8

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: win32k

IMAGE_NAME: win32k.sys

DEBUG_FLR_IMAGE_TIMESTAMP: 47e0e106

FAILURE_BUCKET_ID: 0x8E_BAD_IP_win32k!SetupClassAtoms+c8

BUCKET_ID: 0x8E_BAD_IP_win32k!SetupClassAtoms+c8

Followup: MachineOwner
---------


Microsoft ® Windows Debugger Version 6.9.0003.113 X86
Copyright © Microsoft Corporation. All rights reserved.


Loading Dump File [C:\WINDOWS\Minidump\Mini082208-02.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: C:\WINDOWS\Symbols
Executable search path is:
Unable to load image ntoskrnl.exe, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
Windows XP Kernel Version 2600 (Service Pack 2) MP (4 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055c700
Debug session time: Fri Aug 22 21:41:53.406 2008 (GMT+9)
System Uptime: 0 days 2:31:25.968
Unable to load image ntoskrnl.exe, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
Loading Kernel Symbols
..............................................................................................................................
Loading User Symbols
Loading unloaded module list
.....................
Unable to load image win32k.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for win32k.sys
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1000008E, {c000001d, bf8b6947, b92b2070, 0}

Probably caused by : win32k.sys ( win32k!SetupClassAtoms+c8 )

Followup: MachineOwner
---------

2: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

KERNEL_MODE_EXCEPTION_NOT_HANDLED_M (1000008e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003. This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG. This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG. This will let us see why this breakpoint is
happening.
Arguments:
Arg1: c000001d, The exception code that was not handled
Arg2: bf8b6947, The address that the exception occurred at
Arg3: b92b2070, Trap Frame
Arg4: 00000000

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc000001d - {EXCEPTION} Illegal Instruction An attempt was made to execute an illegal instruction.

FAULTING_IP:
win32k!SetupClassAtoms+c8
bf8b6947 ff ???

TRAP_FRAME: b92b2070 -- (.trap 0xffffffffb92b2070)
ErrCode = 00000000
eax=bfbbbde4 ebx=b92b2188 ecx=b92b2110 edx=00000001 esi=ffffffff edi=b92b2180
eip=bf8b6947 esp=b92b20e4 ebp=b92b21cc iopl=0 nv dn ei ng nz ac pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010696
win32k!SetupClassAtoms+0xc8:
bf8b6947 ff ???
Resetting default scope

CUSTOMER_CRASH_COUNT: 2

DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: 0x8E

PROCESS_NAME: csrss.exe

LAST_CONTROL_TRANSFER: from bf8b94ca to bf8b6947

FAILED_INSTRUCTION_ADDRESS:
win32k!SetupClassAtoms+c8
bf8b6947 ff ???

STACK_TEXT:
b92b21cc bf8b94ca 000001bb 00000000 fffffce0 win32k!SetupClassAtoms+0xc8
b92b21e0 bf8ce1b6 b92b2188 b92b22ac b92b21ac win32k!DrvChangeDisplaySettings+0x877
b92b235c e5fc1458 00000001 b92b2518 b92b2570 win32k!DrvEnumDisplayDevices+0x287
WARNING: Frame IP not in any known module. Following frames may be wrong.
00000000 00000000 00000000 00000000 00000000 0xe5fc1458


STACK_COMMAND: kb

FOLLOWUP_IP:
win32k!SetupClassAtoms+c8
bf8b6947 ff ???

SYMBOL_STACK_INDEX: 0

SYMBOL_NAME: win32k!SetupClassAtoms+c8

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: win32k

IMAGE_NAME: win32k.sys

DEBUG_FLR_IMAGE_TIMESTAMP: 47e0e106

FAILURE_BUCKET_ID: 0x8E_BAD_IP_win32k!SetupClassAtoms+c8

BUCKET_ID: 0x8E_BAD_IP_win32k!SetupClassAtoms+c8

Followup: MachineOwner
---------


Microsoft ® Windows Debugger Version 6.9.0003.113 X86
Copyright © Microsoft Corporation. All rights reserved.


Loading Dump File [C:\WINDOWS\Minidump\Mini082208-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: C:\WINDOWS\Symbols
Executable search path is:
Unable to load image ntoskrnl.exe, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
Windows XP Kernel Version 2600 (Service Pack 2) MP (4 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055c700
Debug session time: Fri Aug 22 18:19:23.546 2008 (GMT+10)
System Uptime: 0 days 1:51:48.128
Unable to load image ntoskrnl.exe, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
Loading Kernel Symbols
............................................................................................................................
Loading User Symbols
Loading unloaded module list
...................
Unable to load image atikvmag.dll, Win32 error 0n2
*** WARNING: Unable to verify timestamp for atikvmag.dll
*** ERROR: Module load completed but symbols could not be loaded for atikvmag.dll
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1000008E, {c0000005, bf0fc7e4, a92ec680, 0}

Probably caused by : atikvmag.dll ( atikvmag+117e4 )

Followup: MachineOwner
---------

3: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

KERNEL_MODE_EXCEPTION_NOT_HANDLED_M (1000008e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003. This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG. This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG. This will let us see why this breakpoint is
happening.
Arguments:
Arg1: c0000005, The exception code that was not handled
Arg2: bf0fc7e4, The address that the exception occurred at
Arg3: a92ec680, Trap Frame
Arg4: 00000000

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx". The memory could not be "%s".

FAULTING_IP:
atikvmag+117e4
bf0fc7e4 0100 add dword ptr [eax],eax

TRAP_FRAME: a92ec680 -- (.trap 0xffffffffa92ec680)
ErrCode = 00000002
eax=23000000 ebx=e225f1b0 ecx=0000000e edx=00000000 esi=e2260000 edi=e236fad0
eip=bf0fc7e4 esp=a92ec6f4 ebp=a92ec758 iopl=0 nv up ei pl zr na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010246
atikvmag+0x117e4:
bf0fc7e4 0100 add dword ptr [eax],eax ds:0023:23000000=????????
Resetting default scope

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: 0x8E

PROCESS_NAME: iexplore.exe

LAST_CONTROL_TRANSFER: from bf1066a5 to bf0fc7e4

STACK_TEXT:
WARNING: Stack unwind information not available. Following frames may be wrong.
a92ec758 bf1066a5 a92ec778 a92ec7d8 a92ec818 atikvmag+0x117e4
a92ec75c a92ec778 a92ec7d8 a92ec818 e225f3b0 atikvmag+0x1b6a5
a92ec760 a92ec7d8 a92ec818 e225f3b0 a92ec860 0xa92ec778
a92ec778 00000000 e1263080 00000000 e2215ef0 0xa92ec7d8


STACK_COMMAND: kb

FOLLOWUP_IP:
atikvmag+117e4
bf0fc7e4 0100 add dword ptr [eax],eax

SYMBOL_STACK_INDEX: 0

SYMBOL_NAME: atikvmag+117e4

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: atikvmag

IMAGE_NAME: atikvmag.dll

DEBUG_FLR_IMAGE_TIMESTAMP: 486d8b43

FAILURE_BUCKET_ID: 0x8E_atikvmag+117e4

BUCKET_ID: 0x8E_atikvmag+117e4

Followup: MachineOwner
---------


Microsoft ® Windows Debugger Version 6.9.0003.113 X86
Copyright © Microsoft Corporation. All rights reserved.


Loading Dump File [C:\WINDOWS\Minidump\Mini082208-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: C:\WINDOWS\Symbols
Executable search path is:
Unable to load image ntoskrnl.exe, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
Windows XP Kernel Version 2600 (Service Pack 2) MP (4 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055c700
Debug session time: Fri Aug 22 18:19:23.546 2008 (GMT+10)
System Uptime: 0 days 1:51:48.128
Unable to load image ntoskrnl.exe, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
Loading Kernel Symbols
............................................................................................................................
Loading User Symbols
Loading unloaded module list
...................
Unable to load image atikvmag.dll, Win32 error 0n2
*** WARNING: Unable to verify timestamp for atikvmag.dll
*** ERROR: Module load completed but symbols could not be loaded for atikvmag.dll
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1000008E, {c0000005, bf0fc7e4, a92ec680, 0}

Probably caused by : atikvmag.dll ( atikvmag+117e4 )

Followup: MachineOwner
---------

3: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

KERNEL_MODE_EXCEPTION_NOT_HANDLED_M (1000008e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003. This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG. This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG. This will let us see why this breakpoint is
happening.
Arguments:
Arg1: c0000005, The exception code that was not handled
Arg2: bf0fc7e4, The address that the exception occurred at
Arg3: a92ec680, Trap Frame
Arg4: 00000000

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx". The memory could not be "%s".

FAULTING_IP:
atikvmag+117e4
bf0fc7e4 0100 add dword ptr [eax],eax

TRAP_FRAME: a92ec680 -- (.trap 0xffffffffa92ec680)
ErrCode = 00000002
eax=23000000 ebx=e225f1b0 ecx=0000000e edx=00000000 esi=e2260000 edi=e236fad0
eip=bf0fc7e4 esp=a92ec6f4 ebp=a92ec758 iopl=0 nv up ei pl zr na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010246
atikvmag+0x117e4:
bf0fc7e4 0100 add dword ptr [eax],eax ds:0023:23000000=????????
Resetting default scope

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: 0x8E

PROCESS_NAME: iexplore.exe

LAST_CONTROL_TRANSFER: from bf1066a5 to bf0fc7e4

STACK_TEXT:
WARNING: Stack unwind information not available. Following frames may be wrong.
a92ec758 bf1066a5 a92ec778 a92ec7d8 a92ec818 atikvmag+0x117e4
a92ec75c a92ec778 a92ec7d8 a92ec818 e225f3b0 atikvmag+0x1b6a5
a92ec760 a92ec7d8 a92ec818 e225f3b0 a92ec860 0xa92ec778
a92ec778 00000000 e1263080 00000000 e2215ef0 0xa92ec7d8


STACK_COMMAND: kb

FOLLOWUP_IP:
atikvmag+117e4
bf0fc7e4 0100 add dword ptr [eax],eax

SYMBOL_STACK_INDEX: 0

SYMBOL_NAME: atikvmag+117e4

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: atikvmag

IMAGE_NAME: atikvmag.dll

DEBUG_FLR_IMAGE_TIMESTAMP: 486d8b43

FAILURE_BUCKET_ID: 0x8E_atikvmag+117e4

BUCKET_ID: 0x8E_atikvmag+117e4

Followup: MachineOwner
---------


Microsoft ® Windows Debugger Version 6.9.0003.113 X86
Copyright © Microsoft Corporation. All rights reserved.


Loading Dump File [C:\WINDOWS\Minidump\Mini082208-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: C:\WINDOWS\Symbols
Executable search path is:
Unable to load image ntoskrnl.exe, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
Windows XP Kernel Version 2600 (Service Pack 2) MP (4 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055c700
Debug session time: Fri Aug 22 18:19:23.546 2008 (GMT+10)
System Uptime: 0 days 1:51:48.128
Unable to load image ntoskrnl.exe, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
Loading Kernel Symbols
............................................................................................................................
Loading User Symbols
Loading unloaded module list
...................
Unable to load image atikvmag.dll, Win32 error 0n2
*** WARNING: Unable to verify timestamp for atikvmag.dll
*** ERROR: Module load completed but symbols could not be loaded for atikvmag.dll
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1000008E, {c0000005, bf0fc7e4, a92ec680, 0}

Probably caused by : atikvmag.dll ( atikvmag+117e4 )

Followup: MachineOwner
---------

3: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

KERNEL_MODE_EXCEPTION_NOT_HANDLED_M (1000008e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003. This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG. This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG. This will let us see why this breakpoint is
happening.
Arguments:
Arg1: c0000005, The exception code that was not handled
Arg2: bf0fc7e4, The address that the exception occurred at
Arg3: a92ec680, Trap Frame
Arg4: 00000000

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx". The memory could not be "%s".

FAULTING_IP:
atikvmag+117e4
bf0fc7e4 0100 add dword ptr [eax],eax

TRAP_FRAME: a92ec680 -- (.trap 0xffffffffa92ec680)
ErrCode = 00000002
eax=23000000 ebx=e225f1b0 ecx=0000000e edx=00000000 esi=e2260000 edi=e236fad0
eip=bf0fc7e4 esp=a92ec6f4 ebp=a92ec758 iopl=0 nv up ei pl zr na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010246
atikvmag+0x117e4:
bf0fc7e4 0100 add dword ptr [eax],eax ds:0023:23000000=????????
Resetting default scope

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: 0x8E

PROCESS_NAME: iexplore.exe

LAST_CONTROL_TRANSFER: from bf1066a5 to bf0fc7e4

STACK_TEXT:
WARNING: Stack unwind information not available. Following frames may be wrong.
a92ec758 bf1066a5 a92ec778 a92ec7d8 a92ec818 atikvmag+0x117e4
a92ec75c a92ec778 a92ec7d8 a92ec818 e225f3b0 atikvmag+0x1b6a5
a92ec760 a92ec7d8 a92ec818 e225f3b0 a92ec860 0xa92ec778
a92ec778 00000000 e1263080 00000000 e2215ef0 0xa92ec7d8


STACK_COMMAND: kb

FOLLOWUP_IP:
atikvmag+117e4
bf0fc7e4 0100 add dword ptr [eax],eax

SYMBOL_STACK_INDEX: 0

SYMBOL_NAME: atikvmag+117e4

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: atikvmag

IMAGE_NAME: atikvmag.dll

DEBUG_FLR_IMAGE_TIMESTAMP: 486d8b43

FAILURE_BUCKET_ID: 0x8E_atikvmag+117e4

BUCKET_ID: 0x8E_atikvmag+117e4

Followup: MachineOwner
---------


Microsoft ® Windows Debugger Version 6.9.0003.113 X86
Copyright © Microsoft Corporation. All rights reserved.


Loading Dump File [C:\WINDOWS\Minidump\Mini082208-03.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: C:\WINDOWS\Symbols
Executable search path is:
Unable to load image ntoskrnl.exe, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
Windows XP Kernel Version 2600 (Service Pack 2) MP (4 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055c700
Debug session time: Fri Aug 22 21:44:47.734 2008 (GMT+9)
System Uptime: 0 days 0:02:21.306
Unable to load image ntoskrnl.exe, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
Loading Kernel Symbols
.............................................................................................................................
Loading User Symbols
Loading unloaded module list
..............
Unable to load image tcpip.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for tcpip.sys
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 100000D1, {0, 2, 1, acd8e470}

Unable to load image TDI.SYS, Win32 error 0n2
*** WARNING: Unable to verify timestamp for TDI.SYS
Probably caused by : TDI.SYS ( TDI!CTEpEventHandler+32 )

Followup: MachineOwner
---------

2: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: 00000000, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000001, value 0 = read operation, 1 = write operation
Arg4: acd8e470, address which referenced memory

Debugging Details:
------------------


OVERLAPPED_MODULE: Address regions for 'eamon' and 'kmixer.sys' overlap

WRITE_ADDRESS: 00000000

CURRENT_IRQL: 2

FAULTING_IP:
tcpip!SendACK+18c
acd8e470 0803 or byte ptr [ebx],al

CUSTOMER_CRASH_COUNT: 3

DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: 0xD1

PROCESS_NAME: System

UNALIGNED_STACK_POINTER: ba50fc59

LAST_CONTROL_TRANSFER: from acd92058 to acd8e470

STACK_TEXT:
ba50fc74 acd92058 886932c0 00000080 00000000 tcpip!SendACK+0x18c
ba50fc94 acd8aa08 00000002 00000002 ba50fcc0 tcpip!CompleteConnReq+0x43
ba50fcc8 acd8a94f 00000002 acd8a900 acd8a3d6 tcpip!ProcessTCBDelayQ+0xc4
ba50fcd4 acd8a3d6 acdc9c80 00000000 acd994da tcpip!TCPRcvComplete+0x20
ba50fce0 acd994da acdcb304 acdcb300 acd99391 tcpip!IPRcvComplete+0x21
ba50fd60 ba4183e4 acdcb300 895ab250 acdcb310 tcpip!SetAOOptions+0xb03
ba50fd7c 805379bd 895ab250 00000000 8a6f43c8 TDI!CTEpEventHandler+0x32
ba50fdac 805ce84c acdcb300 00000000 00000000 nt!MmEnableModifiedWriteOfSection+0x29
ba50fddc 8054532e 805378ce 00000001 00000000 nt!`string'+0x14
ba50fe64 00000000 00000000 00000000 00000000 nt!WmiTraceMessageVa+0x290


STACK_COMMAND: kb

FOLLOWUP_IP:
TDI!CTEpEventHandler+32
ba4183e4 ?? ???

SYMBOL_STACK_INDEX: 6

SYMBOL_NAME: TDI!CTEpEventHandler+32

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: TDI

IMAGE_NAME: TDI.SYS

DEBUG_FLR_IMAGE_TIMESTAMP: 41107d33

FAILURE_BUCKET_ID: 0xD1_W_TDI!CTEpEventHandler+32

BUCKET_ID: 0xD1_W_TDI!CTEpEventHandler+32

Followup: MachineOwner
---------

#7 micoa

micoa
  • Topic Starter

  • Members
  • 54 posts
  • OFFLINE
  •  
  • Local time:08:45 AM

Posted 22 August 2008 - 09:22 AM

Microsoft ® Windows Debugger Version 6.9.0003.113 X86
Copyright © Microsoft Corporation. All rights reserved.


Loading Dump File [C:\WINDOWS\Minidump\Mini082208-04.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: C:\WINDOWS\Symbols
Executable search path is:
Unable to load image ntoskrnl.exe, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
Windows XP Kernel Version 2600 (Service Pack 2) MP (4 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055c700
Debug session time: Fri Aug 22 23:46:38.265 2008 (GMT+9)
System Uptime: 0 days 1:31:29.846
Unable to load image ntoskrnl.exe, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
Loading Kernel Symbols
...................................................................................................................................
Loading User Symbols
Loading unloaded module list
.......................
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1000008E, {c0000005, 805bd9e8, a97f7684, 0}

Unable to load image ks.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ks.sys
Unable to load image sysaudio.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for sysaudio.sys
Probably caused by : ks.sys ( ks!KsiCreateObjectType+d6 )

Followup: MachineOwner
---------

1: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

KERNEL_MODE_EXCEPTION_NOT_HANDLED_M (1000008e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003. This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG. This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG. This will let us see why this breakpoint is
happening.
Arguments:
Arg1: c0000005, The exception code that was not handled
Arg2: 805bd9e8, The address that the exception occurred at
Arg3: a97f7684, Trap Frame
Arg4: 00000000

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx". The memory could not be "%s".

FAULTING_IP:
nt!NtCreatePagingFile+10
805bd9e8 0000 add byte ptr [eax],al

TRAP_FRAME: a97f7684 -- (.trap 0xffffffffa97f7684)
ErrCode = 00000002
eax=00000000 ebx=a97f7780 ecx=80582341 edx=6949001e esi=89944988 edi=00000000
eip=805bd9e8 esp=a97f76f8 ebp=a97f7740 iopl=0 nv up ei ng nz ac pe cy
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010297
nt!NtCreatePagingFile+0x10:
805bd9e8 0000 add byte ptr [eax],al ds:0023:00000000=??
Resetting default scope

CUSTOMER_CRASH_COUNT: 4

DEFAULT_BUCKET_ID: COMMON_SYSTEM_FAULT

BUGCHECK_STR: 0x8E

PROCESS_NAME: war3.exe

LAST_CONTROL_TRANSFER: from 805ba448 to 805bd9e8

STACK_TEXT:
a97f7740 805ba448 80000628 a97f7780 00000240 nt!NtCreatePagingFile+0x10
a97f7794 80574ec1 00000000 00000000 7cb33000 nt!CcPfParametersRead+0x14d
a97f7810 80575838 e295ace8 40000000 a97f78b8 nt!FsRtlIsNameInExpressionPrivate+0x4b
a97f786c b944a58b e295ace8 40000000 a97f78b8 nt!HvMarkDirty+0xdd
a97f78e8 b9449b19 80000628 b9449b20 8854fe00 ks!KsiCreateObjectType+0xd6
a97f7908 aa538fee 80000628 8854fe00 40000200 ks!KsCreatePin+0x33
a97f792c aa53841d e4c46810 e1de8838 e1df02d8 sysaudio!CPinNodeInstance::Create+0x6b
a97f7958 aa538b3a 00000000 8854fe00 00000000 sysaudio!CStartNodeInstance::Connect+0x85
a97f7980 aa537575 e3a5f358 e2467d48 8854fe00 sysaudio!CStartNodeInstance::Create+0x181
a97f79b0 aa5381f7 c0000010 8854fe00 00000000 sysaudio!CPinInstance::PinDispatchCreateKP+0xa8
a97f79cc aa53771a 87ec39c0 aa5374e7 8854fe00 sysaudio!CInstance::DispatchCreate+0x63
a97f7a00 b944a077 886c5858 87ec39c0 87ec39d0 sysaudio!CPinInstance::PinDispatchCreate+0xc1
a97f7a24 804ef095 886c5858 00000000 87ec39c0 ks!DispatchCreate+0xc7
a97f7b14 80582390 886c5858 00000000 87ec4798 nt!MiCheckControlArea+0x103
a97f7b4c 805bd99d 88420f90 00000000 87ec4798 nt!LpcpCopyRequestData+0x35
a97f7bc4 805ba448 00004510 a97f7c04 00000040 nt!MmSessionSetUnloadAddress+0xf
a97f7c18 80574ec1 00000000 00000000 62896001 nt!CcPfParametersRead+0x14d
a97f7c94 80575838 0012f388 40000000 0012f304 nt!FsRtlIsNameInExpressionPrivate+0x4b
a97f7cf0 80577f02 0012f388 40000000 0012f304 nt!HvMarkDirty+0xdd
a97f7d30 8054086c 0012f388 40000000 0012f304 nt!RtlpInheritAcl2+0x5a
a97f7d64 7c90eb94 badb0d00 0012f2cc ffffffff nt!RtlIpv4StringToAddressExA+0x149
WARNING: Frame IP not in any known module. Following frames may be wrong.
a97f7d78 00000000 00000000 00000000 00000000 0x7c90eb94


STACK_COMMAND: kb

FOLLOWUP_IP:
ks!KsiCreateObjectType+d6
b944a58b ?? ???

SYMBOL_STACK_INDEX: 4

SYMBOL_NAME: ks!KsiCreateObjectType+d6

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: ks

IMAGE_NAME: ks.sys

DEBUG_FLR_IMAGE_TIMESTAMP: 41107ef8

FAILURE_BUCKET_ID: 0x8E_ks!KsiCreateObjectType+d6

BUCKET_ID: 0x8E_ks!KsiCreateObjectType+d6

Followup: MachineOwner
---------

#8 usasma

usasma

    Still visually handicapped (avatar is memory developed by my Dad


  • BSOD Kernel Dump Expert
  • 25,091 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Southeastern CT, USA
  • Local time:06:15 PM

Posted 22 August 2008 - 04:02 PM

The majority of the stack traces refer to win32k.sys accessing the display.
Later on the errors point to an ATI driver
The ks.sys error seems related to DirectX - and the crash was related to the use of the war3.exe file (WoW)

All in all, it looks like a video issue. Uninstall your video drivers using the ATI uninstall tool, then reinstall the latest version available from the ATI website.
My browser caused a flood of traffic, sio my IP address was banned. Hope to fix it soon. Will get back to posting as soon as Im able.

- John  (my website: http://www.carrona.org/ )**If you need a more detailed explanation, please ask for it. I have the Knack. **  If I haven't replied in 48 hours, please send me a message. My eye problems have recently increased and I'm having difficult reading posts. (23 Nov 2017)FYI - I am completely blind in the right eye and ~30% blind in the left eye.<p>If the eye problems get worse suddenly, I may not be able to respond.If that's the case and help is needed, please PM a staff member for assistance.

#9 micoa

micoa
  • Topic Starter

  • Members
  • 54 posts
  • OFFLINE
  •  
  • Local time:08:45 AM

Posted 24 August 2008 - 11:11 PM

all the new ati drivers, cause my system to crash more often,
catalyst 8.8 is now causing the marjority of the crashes

Microsoft ® Windows Debugger Version 6.9.0003.113 X86
Copyright © Microsoft Corporation. All rights reserved.


Loading Dump File [C:\WINDOWS\Minidump\Mini082508-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: C:\WINDOWS\Symbols
Executable search path is:
Unable to load image ntoskrnl.exe, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
Windows XP Kernel Version 2600 (Service Pack 2) MP (4 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055c700
Debug session time: Mon Aug 25 13:35:27.562 2008 (GMT+9)
System Uptime: 0 days 0:02:38.519
Unable to load image ntoskrnl.exe, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
Loading Kernel Symbols
..............................................................................................................................
Loading User Symbols
Loading unloaded module list
.............
Unable to load image ati3duag.dll, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ati3duag.dll
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1000008E, {c0000005, bf328a23, a9e32f9b, 0}

Probably caused by : ati3duag.dll ( ati3duag!gajR300BankChoiceColorBuf+c7 )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

KERNEL_MODE_EXCEPTION_NOT_HANDLED_M (1000008e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003. This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG. This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG. This will let us see why this breakpoint is
happening.
Arguments:
Arg1: c0000005, The exception code that was not handled
Arg2: bf328a23, The address that the exception occurred at
Arg3: a9e32f9b, Trap Frame
Arg4: 00000000

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx". The memory could not be "%s".

FAULTING_IP:
ati3duag!gajR300BankChoiceColorBuf+c7
bf328a23 8b464c mov eax,dword ptr [esi+4Ch]

TRAP_FRAME: a9e32f9b -- (.trap 0xffffffffa9e32f9b)
ErrCode = 00000000
eax=00000000 ebx=00000002 ecx=00000002 edx=3f800000 esi=00000000 edi=bf34355b
eip=bf328a23 esp=a9e3300f ebp=00000002 iopl=0 vif nv up ei ng nz ac pe cy
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00290297
ati3duag!gajR300BankChoiceColorBuf+0xc7:
bf328a23 8b464c mov eax,dword ptr [esi+4Ch] ds:0023:0000004c=????????
Resetting default scope

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: 0x8E

PROCESS_NAME: war3.exe

UNALIGNED_STACK_POINTER: a9e3300f

LAST_CONTROL_TRANSFER: from 00000000 to bf328a23

STACK_TEXT:
a9e3300b 00000000 00000000 00000000 00000000 ati3duag!gajR300BankChoiceColorBuf+0xc7


STACK_COMMAND: kb

FOLLOWUP_IP:
ati3duag!gajR300BankChoiceColorBuf+c7
bf328a23 8b464c mov eax,dword ptr [esi+4Ch]

SYMBOL_STACK_INDEX: 0

SYMBOL_NAME: ati3duag!gajR300BankChoiceColorBuf+c7

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: ati3duag

IMAGE_NAME: ati3duag.dll

DEBUG_FLR_IMAGE_TIMESTAMP: 485d218b

FAILURE_BUCKET_ID: 0x8E_ati3duag!gajR300BankChoiceColorBuf+c7

BUCKET_ID: 0x8E_ati3duag!gajR300BankChoiceColorBuf+c7

Followup: MachineOwner
---------


Microsoft ® Windows Debugger Version 6.9.0003.113 X86
Copyright © Microsoft Corporation. All rights reserved.


Loading Dump File [C:\WINDOWS\Minidump\Mini082508-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: C:\WINDOWS\Symbols
Executable search path is:
Unable to load image ntoskrnl.exe, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
Windows XP Kernel Version 2600 (Service Pack 2) MP (4 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055c700
Debug session time: Mon Aug 25 13:35:27.562 2008 (GMT+9)
System Uptime: 0 days 0:02:38.519
Unable to load image ntoskrnl.exe, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
Loading Kernel Symbols
..............................................................................................................................
Loading User Symbols
Loading unloaded module list
.............
Unable to load image ati3duag.dll, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ati3duag.dll
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1000008E, {c0000005, bf328a23, a9e32f9b, 0}

Probably caused by : ati3duag.dll ( ati3duag!gajR300BankChoiceColorBuf+c7 )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

KERNEL_MODE_EXCEPTION_NOT_HANDLED_M (1000008e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003. This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG. This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG. This will let us see why this breakpoint is
happening.
Arguments:
Arg1: c0000005, The exception code that was not handled
Arg2: bf328a23, The address that the exception occurred at
Arg3: a9e32f9b, Trap Frame
Arg4: 00000000

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx". The memory could not be "%s".

FAULTING_IP:
ati3duag!gajR300BankChoiceColorBuf+c7
bf328a23 8b464c mov eax,dword ptr [esi+4Ch]

TRAP_FRAME: a9e32f9b -- (.trap 0xffffffffa9e32f9b)
ErrCode = 00000000
eax=00000000 ebx=00000002 ecx=00000002 edx=3f800000 esi=00000000 edi=bf34355b
eip=bf328a23 esp=a9e3300f ebp=00000002 iopl=0 vif nv up ei ng nz ac pe cy
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00290297
ati3duag!gajR300BankChoiceColorBuf+0xc7:
bf328a23 8b464c mov eax,dword ptr [esi+4Ch] ds:0023:0000004c=????????
Resetting default scope

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: 0x8E

PROCESS_NAME: war3.exe

UNALIGNED_STACK_POINTER: a9e3300f

LAST_CONTROL_TRANSFER: from 00000000 to bf328a23

STACK_TEXT:
a9e3300b 00000000 00000000 00000000 00000000 ati3duag!gajR300BankChoiceColorBuf+0xc7


STACK_COMMAND: kb

FOLLOWUP_IP:
ati3duag!gajR300BankChoiceColorBuf+c7
bf328a23 8b464c mov eax,dword ptr [esi+4Ch]

SYMBOL_STACK_INDEX: 0

SYMBOL_NAME: ati3duag!gajR300BankChoiceColorBuf+c7

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: ati3duag

IMAGE_NAME: ati3duag.dll

DEBUG_FLR_IMAGE_TIMESTAMP: 485d218b

FAILURE_BUCKET_ID: 0x8E_ati3duag!gajR300BankChoiceColorBuf+c7

BUCKET_ID: 0x8E_ati3duag!gajR300BankChoiceColorBuf+c7

Followup: MachineOwner
---------


Microsoft ® Windows Debugger Version 6.9.0003.113 X86
Copyright © Microsoft Corporation. All rights reserved.


Loading Dump File [C:\WINDOWS\Minidump\Mini082508-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: C:\WINDOWS\Symbols
Executable search path is:
Unable to load image ntoskrnl.exe, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
Windows XP Kernel Version 2600 (Service Pack 2) MP (4 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055c700
Debug session time: Mon Aug 25 13:35:27.562 2008 (GMT+9)
System Uptime: 0 days 0:02:38.519
Unable to load image ntoskrnl.exe, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
Loading Kernel Symbols
..............................................................................................................................
Loading User Symbols
Loading unloaded module list
.............
Unable to load image ati3duag.dll, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ati3duag.dll
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1000008E, {c0000005, bf328a23, a9e32f9b, 0}

Probably caused by : ati3duag.dll ( ati3duag!gajR300BankChoiceColorBuf+c7 )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

KERNEL_MODE_EXCEPTION_NOT_HANDLED_M (1000008e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003. This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG. This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG. This will let us see why this breakpoint is
happening.
Arguments:
Arg1: c0000005, The exception code that was not handled
Arg2: bf328a23, The address that the exception occurred at
Arg3: a9e32f9b, Trap Frame
Arg4: 00000000

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx". The memory could not be "%s".

FAULTING_IP:
ati3duag!gajR300BankChoiceColorBuf+c7
bf328a23 8b464c mov eax,dword ptr [esi+4Ch]

TRAP_FRAME: a9e32f9b -- (.trap 0xffffffffa9e32f9b)
ErrCode = 00000000
eax=00000000 ebx=00000002 ecx=00000002 edx=3f800000 esi=00000000 edi=bf34355b
eip=bf328a23 esp=a9e3300f ebp=00000002 iopl=0 vif nv up ei ng nz ac pe cy
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00290297
ati3duag!gajR300BankChoiceColorBuf+0xc7:
bf328a23 8b464c mov eax,dword ptr [esi+4Ch] ds:0023:0000004c=????????
Resetting default scope

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: 0x8E

PROCESS_NAME: war3.exe

UNALIGNED_STACK_POINTER: a9e3300f

LAST_CONTROL_TRANSFER: from 00000000 to bf328a23

STACK_TEXT:
a9e3300b 00000000 00000000 00000000 00000000 ati3duag!gajR300BankChoiceColorBuf+0xc7


STACK_COMMAND: kb

FOLLOWUP_IP:
ati3duag!gajR300BankChoiceColorBuf+c7
bf328a23 8b464c mov eax,dword ptr [esi+4Ch]

SYMBOL_STACK_INDEX: 0

SYMBOL_NAME: ati3duag!gajR300BankChoiceColorBuf+c7

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: ati3duag

IMAGE_NAME: ati3duag.dll

DEBUG_FLR_IMAGE_TIMESTAMP: 485d218b

FAILURE_BUCKET_ID: 0x8E_ati3duag!gajR300BankChoiceColorBuf+c7

BUCKET_ID: 0x8E_ati3duag!gajR300BankChoiceColorBuf+c7

Followup: MachineOwner
---------


Microsoft ® Windows Debugger Version 6.9.0003.113 X86
Copyright © Microsoft Corporation. All rights reserved.


Loading Dump File [C:\WINDOWS\Minidump\Mini082508-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: C:\WINDOWS\Symbols
Executable search path is:
Unable to load image ntoskrnl.exe, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
Windows XP Kernel Version 2600 (Service Pack 2) MP (4 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055c700
Debug session time: Mon Aug 25 13:35:27.562 2008 (GMT+9)
System Uptime: 0 days 0:02:38.519
Unable to load image ntoskrnl.exe, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
Loading Kernel Symbols
..............................................................................................................................
Loading User Symbols
Loading unloaded module list
.............
Unable to load image ati3duag.dll, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ati3duag.dll
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1000008E, {c0000005, bf328a23, a9e32f9b, 0}

Probably caused by : ati3duag.dll ( ati3duag!gajR300BankChoiceColorBuf+c7 )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

KERNEL_MODE_EXCEPTION_NOT_HANDLED_M (1000008e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003. This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG. This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG. This will let us see why this breakpoint is
happening.
Arguments:
Arg1: c0000005, The exception code that was not handled
Arg2: bf328a23, The address that the exception occurred at
Arg3: a9e32f9b, Trap Frame
Arg4: 00000000

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx". The memory could not be "%s".

FAULTING_IP:
ati3duag!gajR300BankChoiceColorBuf+c7
bf328a23 8b464c mov eax,dword ptr [esi+4Ch]

TRAP_FRAME: a9e32f9b -- (.trap 0xffffffffa9e32f9b)
ErrCode = 00000000
eax=00000000 ebx=00000002 ecx=00000002 edx=3f800000 esi=00000000 edi=bf34355b
eip=bf328a23 esp=a9e3300f ebp=00000002 iopl=0 vif nv up ei ng nz ac pe cy
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00290297
ati3duag!gajR300BankChoiceColorBuf+0xc7:
bf328a23 8b464c mov eax,dword ptr [esi+4Ch] ds:0023:0000004c=????????
Resetting default scope

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: 0x8E

PROCESS_NAME: war3.exe

UNALIGNED_STACK_POINTER: a9e3300f

LAST_CONTROL_TRANSFER: from 00000000 to bf328a23

STACK_TEXT:
a9e3300b 00000000 00000000 00000000 00000000 ati3duag!gajR300BankChoiceColorBuf+0xc7


STACK_COMMAND: kb

FOLLOWUP_IP:
ati3duag!gajR300BankChoiceColorBuf+c7
bf328a23 8b464c mov eax,dword ptr [esi+4Ch]

SYMBOL_STACK_INDEX: 0

SYMBOL_NAME: ati3duag!gajR300BankChoiceColorBuf+c7

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: ati3duag

IMAGE_NAME: ati3duag.dll

DEBUG_FLR_IMAGE_TIMESTAMP: 485d218b

FAILURE_BUCKET_ID: 0x8E_ati3duag!gajR300BankChoiceColorBuf+c7

BUCKET_ID: 0x8E_ati3duag!gajR300BankChoiceColorBuf+c7

Followup: MachineOwner
---------


Microsoft ® Windows Debugger Version 6.9.0003.113 X86
Copyright © Microsoft Corporation. All rights reserved.


Loading Dump File [C:\WINDOWS\Minidump\Mini082408-04.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: C:\WINDOWS\Symbols
Executable search path is:
Unable to load image ntoskrnl.exe, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
Windows XP Kernel Version 2600 (Service Pack 2) MP (4 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055c700
Debug session time: Sun Aug 24 15:16:06.218 2008 (GMT+10)
System Uptime: 0 days 0:07:08.777
Unable to load image ntoskrnl.exe, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
Loading Kernel Symbols
.............................................................................................................................
Loading User Symbols
Loading unloaded module list
...............
Unable to load image SCSIPORT.SYS, Win32 error 0n2
*** WARNING: Unable to verify timestamp for SCSIPORT.SYS
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 100000D1, {8b60478b, 2, 8, 8b60478b}

Unable to load image imapi.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for imapi.sys
Unable to load image CLASSPNP.SYS, Win32 error 0n2
*** WARNING: Unable to verify timestamp for CLASSPNP.SYS
Probably caused by : imapi.sys ( imapi!ImapiDispatchMisc+280 )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: 8b60478b, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000008, value 0 = read operation, 1 = write operation
Arg4: 8b60478b, address which referenced memory

Debugging Details:
------------------


READ_ADDRESS: 8b60478b

CURRENT_IRQL: 2

FAULTING_IP:
+ffffffff8b60478b
8b60478b ?? ???

CUSTOMER_CRASH_COUNT: 4

DEFAULT_BUCKET_ID: COMMON_SYSTEM_FAULT

BUGCHECK_STR: 0xD1

PROCESS_NAME: Idle

LAST_CONTROL_TRANSFER: from b9eb4726 to 8b60478b

FAILED_INSTRUCTION_ADDRESS:
+ffffffff8b60478b
8b60478b ?? ???

STACK_TEXT:
WARNING: Frame IP not in any known module. Following frames may be wrong.
805501c0 b9eb4726 8a66da30 898cb270 897f9fb0 0x8b60478b
805501dc b9eb7d50 8a690af0 898cb270 897e90d8 SCSIPORT!SpDispatchRequest+0x68
805501f8 b9eb7db4 8a690a38 898cb270 898cb270 SCSIPORT!ScsiPortPdoScsi+0xec
8055020c b9eb3469 8a690a38 898cb270 8a69ccc0 SCSIPORT!ScsiPortScsi1PdoScsi+0x28
80550220 804ef095 8a690a38 898cb270 898cb270 SCSIPORT!ScsiPortGlobalDispatch+0x1d
80550244 ba2ea070 00000000 898cb270 89630a70 nt!MiCheckControlArea+0x103
80550268 804ef095 897e9020 4a000000 897f9fa8 imapi!ImapiDispatchMisc+0x280
8055028c ba108616 89630a70 897f9f68 00000000 nt!MiCheckControlArea+0x103
805502a4 ba108621 89630a70 80559de0 897a95c4 CLASSPNP!ClassCheckMediaState+0x26
805502bc 804f4682 896309b8 00000000 804f4634 CLASSPNP!ClasspTimerTick+0x3f
805502e0 805016f7 80559dc0 00000000 b39543ec nt!MmUnmapViewInSystemCache+0x120
805503fc 80501813 8055b0a0 ffdff9c0 ffdff000 nt!MiModifiedPageWriterWorker+0x196
80550428 805450bf 8055b4a0 00000000 00006b30 nt!MiGatherMappedPages+0x110
ffdff980 00000000 ba4c8000 000071a4 00000000 nt!WmiTraceMessageVa+0x26


STACK_COMMAND: kb

FOLLOWUP_IP:
imapi!ImapiDispatchMisc+280
ba2ea070 ?? ???

SYMBOL_STACK_INDEX: 6

SYMBOL_NAME: imapi!ImapiDispatchMisc+280

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: imapi

IMAGE_NAME: imapi.sys

DEBUG_FLR_IMAGE_TIMESTAMP: 41107b6c

FAILURE_BUCKET_ID: 0xD1_CODE_AV_BAD_IP_imapi!ImapiDispatchMisc+280

BUCKET_ID: 0xD1_CODE_AV_BAD_IP_imapi!ImapiDispatchMisc+280

Followup: MachineOwner
---------


Microsoft ® Windows Debugger Version 6.9.0003.113 X86
Copyright © Microsoft Corporation. All rights reserved.


Loading Dump File [C:\WINDOWS\Minidump\Mini082408-03.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: C:\WINDOWS\Symbols
Executable search path is:
Unable to load image ntoskrnl.exe, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
Windows XP Kernel Version 2600 (Service Pack 2) MP (4 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055c700
Debug session time: Sun Aug 24 15:08:25.343 2008 (GMT+10)
System Uptime: 0 days 0:50:34.908
Unable to load image ntoskrnl.exe, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
Loading Kernel Symbols
............................................................................................................................
Loading User Symbols
Loading unloaded module list
....................................
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 10000050, {a8fe4324, 0, 8054401c, 0}


Could not read faulting driver name
Probably caused by : ntoskrnl.exe ( nt!VERIFY_BUFFER_LOCKED+11e )

Followup: MachineOwner
---------

2: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced. This cannot be protected by try-except,
it must be protected by a Probe. Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: a8fe4324, memory referenced.
Arg2: 00000000, value 0 = read operation, 1 = write operation.
Arg3: 8054401c, If non-zero, the instruction address which referenced the bad memory
address.
Arg4: 00000000, (reserved)

Debugging Details:
------------------


Could not read faulting driver name

READ_ADDRESS: a8fe4324

FAULTING_IP:
nt!VERIFY_BUFFER_LOCKED+11e
8054401c 8b87c0050000 mov eax,dword ptr [edi+5C0h]

MM_INTERNAL_CODE: 0

CUSTOMER_CRASH_COUNT: 3

DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: 0x50

PROCESS_NAME: msnmsgr.exe

LAST_CONTROL_TRANSFER: from 804fe38c to 8054401c

STACK_TEXT:
a8fe3934 804fe38c a8fe3d64 00000000 a8fe3a0c nt!VERIFY_BUFFER_LOCKED+0x11e
a8fe3cf4 805412d5 a8fe3d10 00000000 a8fe3d64 nt!FsRtlPrivateInitializeFileLock+0x8d
a8fe3d64 60768640 badb0d00 000008a1 a8fe3d98 nt!RtlpTraceDatabaseInitializeLock+0x2e
WARNING: Frame IP not in any known module. Following frames may be wrong.
a8fe3d6c 00000000 a8fe3d98 a8fe3dcc 00000000 0x60768640


STACK_COMMAND: kb

FOLLOWUP_IP:
nt!VERIFY_BUFFER_LOCKED+11e
8054401c 8b87c0050000 mov eax,dword ptr [edi+5C0h]

SYMBOL_STACK_INDEX: 0

SYMBOL_NAME: nt!VERIFY_BUFFER_LOCKED+11e

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nt

IMAGE_NAME: ntoskrnl.exe

DEBUG_FLR_IMAGE_TIMESTAMP: 45e53f9d

FAILURE_BUCKET_ID: 0x50_nt!VERIFY_BUFFER_LOCKED+11e

BUCKET_ID: 0x50_nt!VERIFY_BUFFER_LOCKED+11e

Followup: MachineOwner
---------


Microsoft ® Windows Debugger Version 6.9.0003.113 X86
Copyright © Microsoft Corporation. All rights reserved.


Loading Dump File [C:\WINDOWS\Minidump\Mini082408-02.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: C:\WINDOWS\Symbols
Executable search path is:
Unable to load image ntoskrnl.exe, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
Windows XP Kernel Version 2600 (Service Pack 2) MP (4 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055c700
Debug session time: Sun Aug 24 14:17:19.453 2008 (GMT+10)
System Uptime: 0 days 0:05:15.405
Unable to load image ntoskrnl.exe, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
Loading Kernel Symbols
............................................................................................................................
Loading User Symbols
Loading unloaded module list
..............
Unable to load image ati3duag.dll, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ati3duag.dll
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1000008E, {c0000005, bf4224b3, a9ab7cf0, 0}

Probably caused by : ati3duag.dll ( ati3duag!_NULL_IMPORT_DESCRIPTOR <PERF> (ati3duag+0x2884b3)+0 )

Followup: MachineOwner
---------

3: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

KERNEL_MODE_EXCEPTION_NOT_HANDLED_M (1000008e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003. This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG. This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG. This will let us see why this breakpoint is
happening.
Arguments:
Arg1: c0000005, The exception code that was not handled
Arg2: bf4224b3, The address that the exception occurred at
Arg3: a9ab7cf0, Trap Frame
Arg4: 00000000

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx". The memory could not be "%s".

FAULTING_IP:
ati3duag!_NULL_IMPORT_DESCRIPTOR <PERF> (ati3duag+0x2884b3)+0
bf4224b3 0000 add byte ptr [eax],al

TRAP_FRAME: a9ab7cf0 -- (.trap 0xffffffffa9ab7cf0)
ErrCode = 00000002
eax=0000000f ebx=e3033010 ecx=00000000 edx=00000001 esi=e3035028 edi=a9ab7e09
eip=bf4224b3 esp=a9ab7d64 ebp=e3031011 iopl=0 nv up ei ng nz na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010286
ati3duag!_NULL_IMPORT_DESCRIPTOR <PERF> (ati3duag+0x2884b3):
bf4224b3 0000 add byte ptr [eax],al ds:0023:0000000f=??
Resetting default scope

CUSTOMER_CRASH_COUNT: 2

DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: 0x8E

PROCESS_NAME: iexplore.exe

LAST_CONTROL_TRANSFER: from bf4234c5 to bf4224b3

STACK_TEXT:
a9ab7d60 bf4234c5 a9ab7f18 bf426bcf a9ab7e08 ati3duag!_NULL_IMPORT_DESCRIPTOR <PERF> (ati3duag+0x2884b3)
a9ab7d64 a9ab7f18 bf426bcf a9ab7e08 00000000 ati3duag!_NULL_IMPORT_DESCRIPTOR <PERF> (ati3duag+0x2894c5)
WARNING: Frame IP not in any known module. Following frames may be wrong.
a9ab7d68 bf426bcf a9ab7e08 00000000 0000000f 0xa9ab7f18
a9ab7f18 00000000 00020000 0000000f 00000000 ati3duag!_NULL_IMPORT_DESCRIPTOR <PERF> (ati3duag+0x28cbcf)


STACK_COMMAND: kb

FOLLOWUP_IP:
ati3duag!_NULL_IMPORT_DESCRIPTOR <PERF> (ati3duag+0x2884b3)+0
bf4224b3 0000 add byte ptr [eax],al

SYMBOL_STACK_INDEX: 0

SYMBOL_NAME: ati3duag!_NULL_IMPORT_DESCRIPTOR <PERF> (ati3duag+0x2884b3)+0

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: ati3duag

IMAGE_NAME: ati3duag.dll

DEBUG_FLR_IMAGE_TIMESTAMP: 48928cc0

FAILURE_BUCKET_ID: 0x8E_ati3duag!_NULL_IMPORT_DESCRIPTOR__PERF__(ati3duag+0x2884b3)+0

BUCKET_ID: 0x8E_ati3duag!_NULL_IMPORT_DESCRIPTOR__PERF__(ati3duag+0x2884b3)+0

Followup: MachineOwner
---------

#10 usasma

usasma

    Still visually handicapped (avatar is memory developed by my Dad


  • BSOD Kernel Dump Expert
  • 25,091 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Southeastern CT, USA
  • Local time:06:15 PM

Posted 26 August 2008 - 06:39 AM

All but the last 2 or 3 dump files appear to be caused while the ATI driver accesses memory - while working within the context of the war3.exe process. Since you've tried other video drivers, I'd tend to suspect the war3.exe process as the culprit. Uninstall WoW and then reinstall a freshly downloaded copy and see if that helps.
My browser caused a flood of traffic, sio my IP address was banned. Hope to fix it soon. Will get back to posting as soon as Im able.

- John  (my website: http://www.carrona.org/ )**If you need a more detailed explanation, please ask for it. I have the Knack. **  If I haven't replied in 48 hours, please send me a message. My eye problems have recently increased and I'm having difficult reading posts. (23 Nov 2017)FYI - I am completely blind in the right eye and ~30% blind in the left eye.<p>If the eye problems get worse suddenly, I may not be able to respond.If that's the case and help is needed, please PM a staff member for assistance.

#11 micoa

micoa
  • Topic Starter

  • Members
  • 54 posts
  • OFFLINE
  •  
  • Local time:08:45 AM

Posted 28 August 2008 - 05:20 AM

no, war 3 isnt a problem, i just installed a fresh copy and it works fine
but i keep getting more restarts

#12 micoa

micoa
  • Topic Starter

  • Members
  • 54 posts
  • OFFLINE
  •  
  • Local time:08:45 AM

Posted 28 August 2008 - 05:22 AM

Microsoft ® Windows Debugger Version 6.9.0003.113 X86
Copyright © Microsoft Corporation. All rights reserved.


Loading Dump File [C:\WINDOWS\Minidump\Mini082808-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: C:\WINDOWS\Symbols
Executable search path is:
Unable to load image ntoskrnl.exe, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
Windows XP Kernel Version 2600 (Service Pack 2) MP (4 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055c700
Debug session time: Thu Aug 28 19:44:35.531 2008 (GMT+9)
System Uptime: 0 days 3:15:07.482
Unable to load image ntoskrnl.exe, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
Loading Kernel Symbols
..................................................................................................................................
Loading User Symbols
Loading unloaded module list
...............
Unable to load image usbuhci.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for usbuhci.sys
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 100000D1, {9567b0a, 2, 0, ba413d6a}

Unable to load image USBPORT.SYS, Win32 error 0n2
*** WARNING: Unable to verify timestamp for USBPORT.SYS
Probably caused by : usbuhci.sys ( usbuhci!UhciPollIsochEndpoint+50 )

Followup: MachineOwner
---------

2: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: 09567b0a, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000000, value 0 = read operation, 1 = write operation
Arg4: ba413d6a, address which referenced memory

Debugging Details:
------------------


READ_ADDRESS: 09567b0a

CURRENT_IRQL: 2

FAULTING_IP:
usbuhci!UhciPollIsochEndpoint+50
ba413d6a 8b4708 mov eax,dword ptr [edi+8]

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: 0xD1

PROCESS_NAME: Idle

LAST_CONTROL_TRANSFER: from ba410df8 to ba413d6a

STACK_TEXT:
ba4dbc48 ba410df8 000088c0 88585180 ba4dbc78 usbuhci!UhciPollIsochEndpoint+0x50
ba4dbc58 b90632ba 8988f9dc 88585180 80545d0c usbuhci!UhciPollEndpoint+0x2a
ba4dbc78 b9064578 026c6f50 8988f0e0 88585008 USBPORT!USBPORT_PollEndpoint+0xe8
ba4dbca0 b9067ed0 8988f028 50457270 80545d0c USBPORT!USBPORT_CoreEndpointWorker+0x2be
ba4dbcd0 b9075fb0 8988f028 80545d0c 8988f028 USBPORT!USBPORT_DpcWorker+0x18a
ba4dbd0c b9076128 8988f028 00000001 8055b0a0 USBPORT!USBPORT_IsrDpcWorker+0x37e
ba4dbd28 805450bf 8988f64c 6b755044 00000000 USBPORT!USBPORT_IsrDpc+0x166
ba4dbdc0 ffdfffef 7fffffff ffdffd93 fffdffff nt!WmiTraceMessageVa+0x26
WARNING: Frame IP not in any known module. Following frames may be wrong.
ba4dbddc 00000000 00000000 00000000 00000000 0xffdfffef


STACK_COMMAND: kb

FOLLOWUP_IP:
usbuhci!UhciPollIsochEndpoint+50
ba413d6a 8b4708 mov eax,dword ptr [edi+8]

SYMBOL_STACK_INDEX: 0

SYMBOL_NAME: usbuhci!UhciPollIsochEndpoint+50

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: usbuhci

IMAGE_NAME: usbuhci.sys

DEBUG_FLR_IMAGE_TIMESTAMP: 41107d62

FAILURE_BUCKET_ID: 0xD1_usbuhci!UhciPollIsochEndpoint+50

BUCKET_ID: 0xD1_usbuhci!UhciPollIsochEndpoint+50

Followup: MachineOwner
---------

2: kd> lmvm usbuhci
start end module name
ba410000 ba415000 usbuhci M (pdb symbols) C:\WINDOWS\Symbols\sys\usbuhci.pdb
Loaded symbol image file: usbuhci.sys
Image path: usbuhci.sys
Image name: usbuhci.sys
Timestamp: Wed Aug 04 15:38:34 2004 (41107D62)
CheckSum: 00013083
ImageSize: 00005000
Translations: 0000.04b0 0000.04e0 0409.04b0 0409.04e0



Loading Dump File [C:\WINDOWS\Minidump\Mini082708-03.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: C:\WINDOWS\Symbols
Executable search path is:
Unable to load image ntoskrnl.exe, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
Windows XP Kernel Version 2600 (Service Pack 2) MP (4 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055c700
Debug session time: Wed Aug 27 21:19:20.372 2008 (GMT+10)
System Uptime: 0 days 4:28:22.447
Unable to load image ntoskrnl.exe, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
Loading Kernel Symbols
................................................................................................................................
Loading User Symbols
Loading unloaded module list
...............
Unable to load image Ntfs.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for Ntfs.sys
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 24, {1902fe, a903d9dc, a903d6d8, b9e04dd4}

Probably caused by : hardware ( Ntfs!NtfsCommonQueryInformation+14a )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

NTFS_FILE_SYSTEM (24)
If you see NtfsExceptionFilter on the stack then the 2nd and 3rd
parameters are the exception record and context record. Do a .cxr
on the 3rd parameter and then kb to obtain a more informative stack
trace.
Arguments:
Arg1: 001902fe
Arg2: a903d9dc
Arg3: a903d6d8
Arg4: b9e04dd4

Debugging Details:
------------------


EXCEPTION_RECORD: a903d9dc -- (.exr 0xffffffffa903d9dc)
ExceptionAddress: b9e04dd4 (Ntfs!NtfsCommonQueryInformation+0x0000014a)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 00000001
Parameter[1]: 2fef5c20
Attempt to write to address 2fef5c20

CONTEXT: a903d6d8 -- (.cxr 0xffffffffa903d6d8)
eax=2fef5c20 ebx=a903db6c ecx=0000005c edx=ffffffff esi=e2ae0d91 edi=86eb8108
eip=b9e04dd4 esp=a903daa4 ebp=a903daf4 iopl=0 nv up ei pl nz na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010206
Ntfs!NtfsCommonQueryInformation+0x14a:
b9e04dd4 0000 add byte ptr [eax],al ds:0023:2fef5c20=??
Resetting default scope

CUSTOMER_CRASH_COUNT: 3

DEFAULT_BUCKET_ID: DRIVER_FAULT

PROCESS_NAME: ekrn.exe

ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx". The memory could not be "%s".

WRITE_ADDRESS: 2fef5c20

BUGCHECK_STR: 0x24

MISALIGNED_IP:
nt!KeForceResumeThread+1
804f9deb 5d pop ebp

LAST_CONTROL_TRANSFER: from b9e0329c to b9e04dd4

STACK_TEXT:
a903daf4 b9e0329c a903db6c 88525008 806e4410 Ntfs!NtfsCommonQueryInformation+0x14a
a903db58 b9e032d5 a903db6c 88525008 00000001 Ntfs!NtfsDeleteCcb+0x45
a903dc7c 804ef095 8996e020 88525008 8a624708 Ntfs!NtfsCommonCleanup+0x1ac
a903dc94 804ef095 8996fa08 88525008 a92546cc nt!MiCheckControlArea+0x103
a903dcb0 804ef095 8987f020 88525008 88525008 nt!MiCheckControlArea+0x103
a903dd48 8054086c 00000588 0436dd38 0436dd8c nt!MiCheckControlArea+0x103
a903dd64 7c90eb94 badb0d00 0436dd18 00000000 nt!RtlIpv4StringToAddressExA+0x149
WARNING: Frame IP not in any known module. Following frames may be wrong.
a903dd78 00000000 00000000 00000000 00000000 0x7c90eb94


FOLLOWUP_IP:
Ntfs!NtfsCommonQueryInformation+14a
b9e04dd4 0000 add byte ptr [eax],al

SYMBOL_STACK_INDEX: 0

SYMBOL_NAME: Ntfs!NtfsCommonQueryInformation+14a

FOLLOWUP_NAME: MachineOwner

IMAGE_NAME: hardware

DEBUG_FLR_IMAGE_TIMESTAMP: 0

STACK_COMMAND: .cxr 0xffffffffa903d6d8 ; kb

MODULE_NAME: hardware

FAILURE_BUCKET_ID: IP_MISALIGNED

BUCKET_ID: IP_MISALIGNED

Followup: MachineOwner
---------

0: kd> lmvm hardware
start end module name



Loading Dump File [C:\WINDOWS\Minidump\Mini082708-02.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: C:\WINDOWS\Symbols
Executable search path is:
Unable to load image ntoskrnl.exe, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
Windows XP Kernel Version 2600 (Service Pack 2) MP (4 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055c700
Debug session time: Wed Aug 27 16:49:25.285 2008 (GMT+9)
System Uptime: 0 days 0:14:57.250
Unable to load image ntoskrnl.exe, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
Loading Kernel Symbols
.............................................................................................................................
Loading User Symbols
Loading unloaded module list
.............
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1000000A, {cefc366c, 2, 1, 80515532}

*** WARNING: Unable to verify timestamp for ati2dvag.dll
*** WARNING: Unable to verify timestamp for win32k.sys
Probably caused by : ati2dvag.dll ( ati2dvag!DrvEscape+4f6 )

Followup: MachineOwner
---------

1: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: cefc366c, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000001, bitfield :
bit 0 : value 0 = read operation, 1 = write operation
bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: 80515532, address which referenced memory

Debugging Details:
------------------


WRITE_ADDRESS: cefc366c

CURRENT_IRQL: 2

FAULTING_IP:
nt!_amsg_exit+a9
80515532 ff4008 inc dword ptr [eax+8]

CUSTOMER_CRASH_COUNT: 2

DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: 0xA

PROCESS_NAME: explorer.exe

LAST_CONTROL_TRANSFER: from 80515855 to 80515532

STACK_TEXT:
a97b7708 80515855 00000000 bf02df66 c05f8168 nt!_amsg_exit+0xa9
a97b7724 a97b77ec 00000000 c05f8168 00000100 nt!RotBarInit+0x8c
WARNING: Frame IP not in any known module. Following frames may be wrong.
a97b778c 8051f525 b87552da bf02df66 c05f8168 0xa97b77ec
a97b77f8 805437c8 00000008 bf02df66 00000000 nt!MmProbeAndLockPages+0x5c2
a97b7810 bf02df66 badb0d00 e1d70e90 a97b786c nt!`string'
a97b7b40 bf05856e e1d70e90 e2a78530 a97b7c00 ati2dvag!DrvEscape+0x4f6
a97b7b80 bf83b8c9 e1d70e90 e2a78530 a97b7c00 ati2dvag!_NULL_IMPORT_DESCRIPTOR <PERF> (ati2dvag+0x4656e)
a97b7bd0 bf842875 e1d70e90 e2a78530 a97b7c00 win32k!xxxMakeWindowForegroundWithState+0xd1
a97b7dcc 8054086c 030108ad 00000000 e1af0788 win32k!xxxSystemParametersInfo+0x311
a97b7e04 7c90eb94 badb0d00 0007e8a0 00000000 nt!RtlIpv4StringToAddressExA+0x149
a97b7e18 a97b7e5c 896e7da8 ba340120 00001f80 0x7c90eb94
00000000 00000000 00000000 00000000 00000000 0xa97b7e5c


STACK_COMMAND: kb

FOLLOWUP_IP:
ati2dvag!DrvEscape+4f6
bf02df66 ?? ???

SYMBOL_STACK_INDEX: 5

SYMBOL_NAME: ati2dvag!DrvEscape+4f6

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: ati2dvag

IMAGE_NAME: ati2dvag.dll

DEBUG_FLR_IMAGE_TIMESTAMP: 486d97c1

FAILURE_BUCKET_ID: 0xA_W_ati2dvag!DrvEscape+4f6

BUCKET_ID: 0xA_W_ati2dvag!DrvEscape+4f6

Followup: MachineOwner
---------

1: kd> lmvm ati2dvag
start end module name
bf012000 bf061000 ati2dvag M (pdb symbols) C:\WINDOWS\Symbols\dll\ati2dvag.pdb
Loaded symbol image file: ati2dvag.dll
Image path: ati2dvag.dll
Image name: ati2dvag.dll
Timestamp: Fri Jul 04 12:53:45 2008 (486D97C1)
CheckSum: 0005A174
ImageSize: 0004F000
Translations: 0000.04b0 0000.04e0 0409.04b0 0409.04e0

Loading Dump File [C:\WINDOWS\Minidump\Mini082708-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: C:\WINDOWS\Symbols
Executable search path is:
Unable to load image ntoskrnl.exe, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
Windows XP Kernel Version 2600 (Service Pack 2) MP (4 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055c700
Debug session time: Wed Aug 27 13:11:40.964 2008 (GMT+10)
System Uptime: 0 days 19:17:28.807
Unable to load image ntoskrnl.exe, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
Loading Kernel Symbols
.....................................................................................................................................
Loading User Symbols
Loading unloaded module list
..................................................
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1000008E, {c0000005, 805bfdc2, ac11fba4, 0}

Probably caused by : ntoskrnl.exe ( nt!IoReadPartitionTable+3a9 )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

KERNEL_MODE_EXCEPTION_NOT_HANDLED_M (1000008e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003. This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG. This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG. This will let us see why this breakpoint is
happening.
Arguments:
Arg1: c0000005, The exception code that was not handled
Arg2: 805bfdc2, The address that the exception occurred at
Arg3: ac11fba4, Trap Frame
Arg4: 00000000

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx". The memory could not be "%s".

FAULTING_IP:
nt!IoReadPartitionTable+3a9
805bfdc2 698a5445524d34000000 imul ecx,dword ptr [edx+4D524554h],34h

TRAP_FRAME: ac11fba4 -- (.trap 0xffffffffac11fba4)
ErrCode = 00000000
eax=ac11fc59 ebx=00000000 ecx=000000c4 edx=153c0002 esi=8a71a8f0 edi=8783dbb0
eip=805bfdc2 esp=ac11fc18 ebp=ac11fc60 iopl=0 nv up ei ng nz na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010286
nt!IoReadPartitionTable+0x3a9:
805bfdc2 698a5445524d34000000 imul ecx,dword ptr [edx+4D524554h],34h ds:0023:628e4556=????????
Resetting default scope

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: 0x8E

PROCESS_NAME: services.exe

LAST_CONTROL_TRANSFER: from 805a342c to 805bfdc2

STACK_TEXT:
ac11fc60 805a342c 00000001 8a71a8f0 00000000 nt!IoReadPartitionTable+0x3a9
ac11fd44 8054086c 000e4168 b7390021 000b0a68 nt!PspSetPrimaryToken+0x82
ac11fd64 7c90eb94 badb0d00 0074fe04 00000000 nt!RtlIpv4StringToAddressExA+0x149
WARNING: Frame IP not in any known module. Following frames may be wrong.
ac11fd78 00000000 00000000 00000000 00000000 0x7c90eb94


STACK_COMMAND: kb

FOLLOWUP_IP:
nt!IoReadPartitionTable+3a9
805bfdc2 698a5445524d34000000 imul ecx,dword ptr [edx+4D524554h],34h

SYMBOL_STACK_INDEX: 0

SYMBOL_NAME: nt!IoReadPartitionTable+3a9

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nt

IMAGE_NAME: ntoskrnl.exe

DEBUG_FLR_IMAGE_TIMESTAMP: 45e53f9d

FAILURE_BUCKET_ID: 0x8E_nt!IoReadPartitionTable+3a9

BUCKET_ID: 0x8E_nt!IoReadPartitionTable+3a9

Followup: MachineOwner
---------

0: kd> lmvm nt
start end module name
804d7000 806e2000 nt M (pdb symbols) C:\WINDOWS\Symbols\exe\ntoskrnl.pdb
Loaded symbol image file: ntoskrnl.exe
Image path: ntoskrnl.exe
Image name: ntoskrnl.exe
Timestamp: Wed Feb 28 19:08:53 2007 (45E53F9D)
CheckSum: 001F873F
ImageSize: 0020B000
Translations: 0000.04b0 0000.04e0 0409.04b0 0409.04e0

#13 usasma

usasma

    Still visually handicapped (avatar is memory developed by my Dad


  • BSOD Kernel Dump Expert
  • 25,091 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Southeastern CT, USA
  • Local time:06:15 PM

Posted 28 August 2008 - 06:32 AM

There are indications of problems with the following things in your dump files:
nod32
usb drivers
ntoskrnl.exe
explorer.exe
ati drivers
ntfs file system
services.exe

I'd first suggest performing a hard drive diagnostic (usually available from the manufacturer of your hard drive). Links to the major manufacturers are located here: http://www.bleepingcomputer.com/forums/t/28744/hard-drive-installation-and-diagnostic-tools/

If the drive passes the test, then I'd run chkdsk /r. Go to Start...Run...and type in "cmd.exe" (without the quotes) and press Enter.
In the black window that opens up, type "chkdsk /r" (without the quotes) and press Enter - it'll tell you it can't run right now and will ask if you'd like to schedule it for the next reboot. Answer Y (for Yes) and press Enter - then reboot. It'll run as the system boots, and when it's done it'll boot into Windows. Let us know if it finds any errors.

After this, I'd perform a couple of these free, online scans to ensure that malware has not gotten by your current protection:
(Be advised that some of these scanners will pickup things in "quarantine" from other anti-virus programs - so review the results carefully)

http://housecall.trendmicro.com
http://www.pandasecurity.com/homeusers/solutions/activescan/
http://www.kaspersky.com/virusscanner Scan Only - no removal
http://www.bitdefender.com/scan8/ie.html
http://support.f-secure.com/enu/home/ols.shtml
http://us.mcafee.com/root/mfs/default.asp
http://onlinescan.avast.com/
http://ca.com/us/securityadvisor/virusinfo/scan.aspx
http://www.eset.com/onlinescan/



Let us know the results of all of the above and we can move on with further tests to isolate the problem.

Edited by usasma, 28 August 2008 - 06:33 AM.

My browser caused a flood of traffic, sio my IP address was banned. Hope to fix it soon. Will get back to posting as soon as Im able.

- John  (my website: http://www.carrona.org/ )**If you need a more detailed explanation, please ask for it. I have the Knack. **  If I haven't replied in 48 hours, please send me a message. My eye problems have recently increased and I'm having difficult reading posts. (23 Nov 2017)FYI - I am completely blind in the right eye and ~30% blind in the left eye.<p>If the eye problems get worse suddenly, I may not be able to respond.If that's the case and help is needed, please PM a staff member for assistance.

#14 micoa

micoa
  • Topic Starter

  • Members
  • 54 posts
  • OFFLINE
  •  
  • Local time:08:45 AM

Posted 05 September 2008 - 05:32 AM

The problem seems to have ceased now

i found that the drivers needed updating, and i am using ATI cataylst 8.8 with ATI video driver 8.7
the combination seems to have kept the system from blue screening.

Thank you for your help :thumbsup:




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users