Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Stop: 0x100000d1, Blue Screen During Bootup


  • Please log in to reply
17 replies to this topic

#1 Andrew Mc

Andrew Mc

  • Members
  • 9 posts
  • OFFLINE
  •  
  • Local time:08:58 AM

Posted 26 August 2008 - 06:16 PM

Hello all .. Been investigating this error for a few weeks now, trying various things, and mainly just "dealing" with it. However, too much is too much, so, looking for some help to narrow down the exact cause of the Stop Error and what can be done to resolve it.

First of all, this is the error that I primarily see during Bootup. There have been a few times where the first Error Code is different (0x1000008E), but the main one is D1.

Event Type: Error
Event Source: System Error
Event Category: (102)
Event ID: 1003
Date: 8/26/2008
Time: 8:25:27 AM
User: N/A
Computer:
Description:
Error code 100000d1, parameter1 00000002, parameter2 00000009, parameter3 00000000, parameter4 00000002.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 53 79 73 74 65 6d 20 45 System E
0008: 72 72 6f 72 20 20 45 72 rror Er
0010: 72 6f 72 20 63 6f 64 65 ror code
0018: 20 31 30 30 30 30 30 64 100000d
0020: 31 20 20 50 61 72 61 6d 1 Param
0028: 65 74 65 72 73 20 30 30 eters 00
0030: 30 30 30 30 30 32 2c 20 000002,
0038: 30 30 30 30 30 30 30 39 00000009
0040: 2c 20 30 30 30 30 30 30 , 000000
0048: 30 30 2c 20 30 30 30 30 00, 0000
0050: 30 30 30 32 0002




The symptoms are... When I reboot the laptop, it will go through the BIOS and initial Windows screens just fine. Then is when the "random" blue screen occurs.
Sometimes it happens immediately as the Windows screen goes away. Other times it will get almost to the login screen before occurring. What really confuses me, is that it is sometimes linked to the keyboard.. in that the VERY first key that I press (no matter what it is) can cause it to blue-screen with this error. I then reboot and it possibly will come up... if I can hit keys with the login prompt visible, then I know it's good and it doesn't Blue-screen after that point...
I've also noticed that the computer "seems" to behave differently if I keep the keyboard "active" from the windows splash screen all the way to the login screen. This may be totally mental, but it seriously feels as though I have better luck if I'm hitting the space-bar or return-key every few seconds during that point of boot-up.
So, my normal routine, is anywhere from 1-6 blue-screen reboots while trying to bootup the computer. But, once it gets to the login screen and I can type without reboot.. then it's good from then on out.

Now, the history... To my best recollection, this all started about the time that I installed Adobe Acrobate 9.0. I can't explain why it would start this, (especially since it seems to be keyboard related). I've also reverted to the Restore point created just prior to installation, and that did not help. Same issue, same frequency.

Since some of the searching I'd previously done suggesting things with Logitech mice.. I've also reinstalled/upgraded the SetPoint software.. However, I haven't actually un-installed it completely yet. (the Mouse and that version of software was working perfectly for more than 6 months prior to the blue-screens starting.

The problem happens both with the laptop by itself, AND with the laptop in a docking station. I obviously use 2 different keyboards for each of those configurations (internal and external), but I do use the same VX Nano Logitech Wireless mouse for both configurations.


What I'm really looking for from these forums, is some help in understanding those Error Codes better, as well as some possible deep-digging into any dump files that might be created.
I've tried looking for files in C:\windows\minidump\... but all of the recent blue-screens are NOT creating anything in that folder.... the dates are very old. So, I'm not sure why mini-dump wouldn't be working.. but maybe you guys can help me there as well.

For complete-ness, here's the Description Error Code text from all of the System Errors which have occurred recently:

8/26/2008 - Error code 100000d1, parameter1 00000002, parameter2 00000009, parameter3 00000000, parameter4 00000002.
8/25/2008 - Error code 100000d1, parameter1 deccfc99, parameter2 00000009, parameter3 00000001, parameter4 00040003.
8/22/2008 - Error code 1000008e, parameter1 c000001d, parameter2 00000007, parameter3 aad57c50, parameter4 00000000.
8/19/2008 - Error code 100000d1, parameter1 13dc2720, parameter2 00000009, parameter3 00000001, parameter4 8981c01a.
8/15/2008 - Error code 100000d1, parameter1 00000003, parameter2 00000009, parameter3 00000000, parameter4 00000003.
8/14/2008 - Error code 1000008e, parameter1 80000004, parameter2 00000005, parameter3 f75f572c, parameter4 00000000.
8/14/2008 - Error code 100000d1, parameter1 00000008, parameter2 00000009, parameter3 00000000, parameter4 00000008.
8/13/2008 - Error code 100000d1, parameter1 c2288b5e, parameter2 00000009, parameter3 00000001, parameter4 8a5a3bae.
8/9/2008 - Error code 100000d1, parameter1 137b9048, parameter2 00000009, parameter3 00000001, parameter4 8918061a.
8/9/2008 - Error code 100000d1, parameter1 7abe7a8d, parameter2 00000009, parameter3 00000001, parameter4 8a5d9270.
8/6/2008 - Error code 1000008e, parameter1 80000004, parameter2 00000005, parameter3 f794e884, parameter4 00000000.
8/6/2008 - Error code 100000d1, parameter1 00000002, parameter2 00000009, parameter3 00000000, parameter4 00000002.
8/6/2008 - Error code 100000d1, parameter1 0000000d, parameter2 00000009, parameter3 00000000, parameter4 0000000d.
8/5/2008 - Error code 1000007f, parameter1 0000000d, parameter2 00000000, parameter3 00000000, parameter4 00000000.
8/5/2008 - Error code 1000008e, parameter1 c000001d, parameter2 8a4eb5f0, parameter3 8055044c, parameter4 00000000.

BC AdBot (Login to Remove)

 


#2 woodyblade

woodyblade

  • Members
  • 670 posts
  • OFFLINE
  •  
  • Gender:Not Telling
  • Local time:02:58 PM

Posted 26 August 2008 - 06:27 PM

Hello Andrew, the 0x8E and 0xD1 Errors are commonly RAM problems but also Device Drivers as well. 0x7F errors are caused by Hardware, Software or Device Drivers.

Try running Memtest86 to start with to test your RAM and post back if it finds any errors.

Memtest86 Instructions
Download the pre-built version of Memtest86 (Link Below) and burn it onto a CD using ISO Recorder (Link Below) other ISO burning software will work as well (E.g. Nero). After this boot off the CD and start the test going and let it run for 3-5 hours (Minimum of 7 Passes) or Overnight which is best.

Memtest86 - http://www.memtest.org/
ISO Recorder - http://isorecorder.alexfeinman.com/isorecorder.htm

Edited by woodyblade, 26 August 2008 - 06:27 PM.


#3 usasma

usasma

    Still visually handicapped (avatar is memory developed by my Dad


  • BSOD Kernel Dump Expert
  • 25,091 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Southeastern CT, USA
  • Local time:09:58 AM

Posted 26 August 2008 - 07:00 PM

To locate your dump files....
Go to Start...Run...and type in "sysdm.cpl" (without the quotes) and press Enter
Click on the Advanced tab
Click on the Startup and Recovery Settings button
Towards the bottom is a section entitled "Write debugging information" - what does it say in the 2 boxes there?

Once you find it, you can run a debug analysis on it using this link: http://forums.majorgeeks.com/showthread.php?t=35246
In the event that the log is too large to post here, try eliminating all the hex stuff (it should be a lot) and posting the remainder. If that's not possible, then change the settings above to record a Small Memory Dump and then wait for the next crash to get a more manageable dump file.

Edited by usasma, 26 August 2008 - 07:01 PM.

My browser caused a flood of traffic, sio my IP address was banned. Hope to fix it soon. Will get back to posting as soon as Im able.

- John  (my website: http://www.carrona.org/ )**If you need a more detailed explanation, please ask for it. I have the Knack. **  If I haven't replied in 48 hours, please send me a message. My eye problems have recently increased and I'm having difficult reading posts. (23 Nov 2017)FYI - I am completely blind in the right eye and ~30% blind in the left eye.<p>If the eye problems get worse suddenly, I may not be able to respond.If that's the case and help is needed, please PM a staff member for assistance.

#4 Andrew Mc

Andrew Mc
  • Topic Starter

  • Members
  • 9 posts
  • OFFLINE
  •  
  • Local time:08:58 AM

Posted 26 August 2008 - 07:25 PM

Just want to say you guys are great for replying so fast..

Ok, so, I actually already had WinDbg, but I didn't have the Symbol File Path set (no wonder it was not help originally).
Now with your link I've set it up properly and got the following from the most recent Minidump (thanks usasma, i had forgotten that I changed the path to d:\temp\minidump)


I've looked at all of the recent Minidumps and every single one of them says "Probably caused by : L8042Kbd.sys ( L8042Kbd+1bc3 )".
So, that definitely appears to be the culprit..




Here's the most recent one in all it's glory.


Microsoft ® Windows Debugger Version 6.9.0003.113 X86
Copyright © Microsoft Corporation. All rights reserved.


Loading Dump File [D:\temp\Minidump\Mini082608-02.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows XP Kernel Version 2600 (Service Pack 2) UP Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 2600.xpsp_sp2_qfe.070227-2300
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055a820
Debug session time: Tue Aug 26 18:41:59.328 2008 (GMT-5)
System Uptime: 0 days 0:00:38.890
Loading Kernel Symbols
..............................................................................................................................................................
Loading User Symbols
Loading unloaded module list
...
Unable to load image L8042Kbd.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for L8042Kbd.sys
*** ERROR: Module load completed but symbols could not be loaded for L8042Kbd.sys
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 100000D1, {a120003, 9, 0, a120003}

Probably caused by : L8042Kbd.sys ( L8042Kbd+1bc3 )

Followup: MachineOwner
---------

kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: 0a120003, memory referenced
Arg2: 00000009, IRQL
Arg3: 00000000, value 0 = read operation, 1 = write operation
Arg4: 0a120003, address which referenced memory

Debugging Details:
------------------


READ_ADDRESS: 0a120003

CURRENT_IRQL: 9

FAULTING_IP:
+a120003
0a120003 ?? ???

PROCESS_NAME: Idle

CUSTOMER_CRASH_COUNT: 2

DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: 0xD1

LAST_CONTROL_TRANSFER: from f7980bc3 to 0a120003

FAILED_INSTRUCTION_ADDRESS:
+a120003
0a120003 ?? ???

STACK_TEXT:
WARNING: Frame IP not in any known module. Following frames may be wrong.
805504bc f7980bc3 8a5e45e0 8a51e4f0 8a51e40c 0xa120003
805504e4 f76d8f6b 8a5661d8 8a51e4f0 8a51e40c L8042Kbd+0x1bc3
8055053c 804da915 8a61f838 8a51e238 00010009 i8042prt!I8042KeyboardInterruptService+0x100
8055053c 806f49aa 8a61f838 8a51e238 00010009 nt!KiInterruptDispatch+0x3d
805505d0 804dbb37 00000000 0000000e 00000000 hal!HalProcessorIdle+0x2
805505d4 00000000 0000000e 00000000 00000000 nt!KiIdleLoop+0x10


STACK_COMMAND: kb

FOLLOWUP_IP:
L8042Kbd+1bc3
f7980bc3 ?? ???

SYMBOL_STACK_INDEX: 1

SYMBOL_NAME: L8042Kbd+1bc3

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: L8042Kbd

IMAGE_NAME: L8042Kbd.sys

DEBUG_FLR_IMAGE_TIMESTAMP: 461d6f42

FAILURE_BUCKET_ID: 0xD1_CODE_AV_BAD_IP_L8042Kbd+1bc3

BUCKET_ID: 0xD1_CODE_AV_BAD_IP_L8042Kbd+1bc3

Followup: MachineOwner
---------

kd> lmvm L8042Kbd
start end module name
f797f000 f7982500 L8042Kbd T (no symbols)
Loaded symbol image file: L8042Kbd.sys
Image path: L8042Kbd.sys
Image name: L8042Kbd.sys
Timestamp: Wed Apr 11 18:29:06 2007 (461D6F42)
CheckSum: 00012785
ImageSize: 00003500
Translations: 0000.04b0 0000.04e0 0409.04b0 0409.04e0

#5 woodyblade

woodyblade

  • Members
  • 670 posts
  • OFFLINE
  •  
  • Gender:Not Telling
  • Local time:02:58 PM

Posted 27 August 2008 - 12:09 PM

That Driver you list is a Kaspersky Driver it seems your Kaspersky Software doesn't like Adobe Software you installed when the problems started to occur.

Do you need the Adobe Software?

Or is it possible for you to preform a Fresh install of both Programs and see if the problem Disappears.

#6 Andrew Mc

Andrew Mc
  • Topic Starter

  • Members
  • 9 posts
  • OFFLINE
  •  
  • Local time:08:58 AM

Posted 27 August 2008 - 12:33 PM

Woody -

You state that the Driver is for Kaspersky >>?? But, I have no such software on my system.
And, the searches that I've done for that driver show it to be related to the Keyboard, and when I view my keyboard in Device Manager, and look at the drivers, this one is on the list, and it's showing to be for Logitech.

As for Adobe Acrobat. I definitely require this for my work, so, that's not an option to remove. The software has already been removed and re-installed, and during the time of it being removed, the blue screens continued.

I made one fatal flaw yesterday, in that I didn't realize how important the L8042Kbd.sys file was for bootup.... I renamed it to L8042Kbd1.sys, and then realized that my PC would no longer bootup at all... I was able to finally get a boot-disk which allowed me to get into the FS and rename the file to it's correct name...

At this time, my system is back to the same problem.

I've also gone ahead and removed the Logitech Setpoint software... blue screens continued after that point.
I've then downloaded and installed the latest version of the software.... still no change.

At this point, I need to understand how to possibly download a new version of that file... or.. debug further to understand why it's causing problems during bootup..

thanks to all for the help...

#7 woodyblade

woodyblade

  • Members
  • 670 posts
  • OFFLINE
  •  
  • Gender:Not Telling
  • Local time:02:58 PM

Posted 27 August 2008 - 02:57 PM

Oh Sorry I only did quick Research on the File probably should have double checked it.

Anyway I was checking your Errors over you listed in the OP and you listed a 0x7F error with the First Parameter as "d" which is normally Hardware related and 50-60% of the time it is found to be RAM when that is seen.

Have you run Memtest86 yet?

#8 Andrew Mc

Andrew Mc
  • Topic Starter

  • Members
  • 9 posts
  • OFFLINE
  •  
  • Local time:08:58 AM

Posted 27 August 2008 - 03:39 PM

Yes, MemTest86+ ran through 10 passes with no errors last night.

#9 Guest_Abacus 7_*

Guest_Abacus 7_*

  • Guests
  • OFFLINE
  •  

Posted 27 August 2008 - 11:51 PM

Could it be a faulty Stick of Ram.

Try removing them one by one.

If it stops the Blue Screen, that could be it?

:thumbsup:

#10 Andrew Mc

Andrew Mc
  • Topic Starter

  • Members
  • 9 posts
  • OFFLINE
  •  

Posted 28 August 2008 - 12:27 AM

This might show my ignorance on the subject.. but, would faulty RAM exhibit itself by appearing to be the exact same L8042Kbd.sys driver for every single failure? Wouldn't a ram problem cause more random failures with various drivers showing up (basically who ever grabs that faulty piece at that time)...

And, why would my computer behave perfectly after logging in? I've seen no blue screens post-login screen...

Maybe there is some correlation that I'm not familiar with...


The laptop does have 2x1Gb of RAM, so, I could try your suggestion,..... just hate that one of the sticks is actually underneath the keyboard, and have to open it up to get at it....

#11 Guest_Abacus 7_*

Guest_Abacus 7_*

  • Guests
  • OFFLINE
  •  

Posted 28 August 2008 - 12:56 AM

This might show my ignorance on the subject.. but, would faulty RAM exhibit itself by appearing to be the exact same L8042Kbd.sys driver for every single failure? Wouldn't a ram problem cause more random failures with various drivers showing up (basically who ever grabs that faulty piece at that time)...

And, why would my computer behave perfectly after logging in? I've seen no blue screens post-login screen...

Maybe there is some correlation that I'm not familiar with...


The laptop does have 2x1Gb of RAM, so, I could try your suggestion,..... just hate that one of the sticks is actually underneath the keyboard, and have to open it up to get at it....


As Woody said? "It is pointing to a RAM Problem"

Best way to eliminate that one?

Try removing one, run, then replace and remove the other one, run again.

RAM Sticks can do it without showing up in Mem Test.

just hate that one of the sticks is actually underneath the keyboard, and have to open it up to get at it....


You mentioned a Problem with the KeyBoard earlier?

Check for a Short on the RAM from the KeyBoard? That short would carry on into the Desktop when you linked them, same as the Mouse.

Sometimes Problems can be so simple rather than complex? Try this simple thing to eliminate it. If it doesn't fix it we can delve further for you. I once had a Computer that refused to recognise double sided RAM? It would run but used to do similar to what you have? I went to single sided RAM and it stopped.

Given that there is very limited room in a LapTop just reseating the Ram under the KeyBoard may be all it needs? it only needs to be a couple of Mills up to cause Problems.


:thumbsup:

Edited by Abacus 7, 28 August 2008 - 01:18 AM.


#12 usasma

usasma

    Still visually handicapped (avatar is memory developed by my Dad


  • BSOD Kernel Dump Expert
  • 25,091 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Southeastern CT, USA
  • Local time:08:58 AM

Posted 28 August 2008 - 06:09 AM

The dump file analysis names the Logitech file as where the crash occurred. And the Stack Text seems to support this (it's read from the bottom to the top).

Where the crash occurred is not necessarily the cause of the crash. Something else (like a virus or another program) may have interfered in the execution of the Logitech file. But, it was pointed out by the crash analysis - so it's the logical place to start troubleshooting.

As you're having problems with the keyboard, this seems to be the most likely reason for the crashes. BUT, it's unusual that it wasn't fixed by the reinstallation of the SetPoint software.

I would suggest enabling Driver Verifier in order to further hunt down the culprit. Do do this, go to Start...Run...and type in "verifier.exe" (without the quotes) and press Enter.

In the next screen, click on "Next" to accept the default of "Create standard settings"
In the next screen, click on "Next" to accept the default of "Automatically select unsigned drivers"
In the next screen, click on "Finish" to accept the list of unsigned drivers that Windows detected.
Then, reboot the system and wait for the crash.
Once it crashes, perform an analysis as you did in Post #4.
Once you've analyzed the dump file, go back in to Driver Verifier and select the "Delete existing settings" in the first screen to stop Driver Verifier from running.

In most cases Driver Verifier will have identified the faulty driver, but in some cases it'll just give more clues (and we'll have to do further testing).
My browser caused a flood of traffic, sio my IP address was banned. Hope to fix it soon. Will get back to posting as soon as Im able.

- John  (my website: http://www.carrona.org/ )**If you need a more detailed explanation, please ask for it. I have the Knack. **  If I haven't replied in 48 hours, please send me a message. My eye problems have recently increased and I'm having difficult reading posts. (23 Nov 2017)FYI - I am completely blind in the right eye and ~30% blind in the left eye.<p>If the eye problems get worse suddenly, I may not be able to respond.If that's the case and help is needed, please PM a staff member for assistance.

#13 Andrew Mc

Andrew Mc
  • Topic Starter

  • Members
  • 9 posts
  • OFFLINE
  •  

Posted 28 August 2008 - 10:30 AM

Ok... I've been working hard on ya'lls suggestions...

Regarding the Memory.... I've gone ahead and done the single-memory stick at a time test and no matter which stick is in, I still see this same Stop error during bootup.
Regarding any short from keyboard/memory... There's very good coverage of insulating plastic to keep the keyboard's components from touching anything with the memory... .. i can't see that anything here would be the culprit..


Regarding the Verifier... I may need to do more testing here to rule out coincidence.. but, when I turned this on, I did get a single Stop error for 0xD1 same as I've always got, but, I also saw a few STOP Errors for a new driver. (viexpf2k.sys). However, I did notice a difference here...

With the 0xD1 failure.. this always happens after Windows Splash Screen and before or at the Windows login prompt.
For the 3 times that I saw viexpf2k.sys, this happened AFTER I logged in, just as Windows was playing the Startup sound. So, this "seems" like it's different and unrelated... although, not entirely sure.

I mean.. all that tells me is that Driver Verifier found another issue with that driver... but, that since it's not in the same sequence as the other failure.. then, doesn't seem to be directly related.

I eventually had to boot into Safemode to disable Verifier in order to get the PC back to a state where I could "possibly" get logged in.


I'll now go to see which minidumps were created over the last few reboots, and see if the viexpf2k.sys is there... as well as see if there was any more detail in the 0xD1 error from when Verifier was active..

Will post this in the next message

#14 Andrew Mc

Andrew Mc
  • Topic Starter

  • Members
  • 9 posts
  • OFFLINE
  •  
  • Local time:09:58 AM

Posted 28 August 2008 - 10:33 AM

Here's one of the debug outputs from viexpf2k.sys
-----------------------------------

Microsoft ® Windows Debugger Version 6.9.0003.113 X86
Copyright © Microsoft Corporation. All rights reserved.


Loading Dump File [D:\temp\Minidump\Mini082808-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows XP Kernel Version 2600 (Service Pack 2) UP Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 2600.xpsp_sp2_qfe.070227-2300
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055a820
Debug session time: Thu Aug 28 09:53:03.812 2008 (GMT-5)
System Uptime: 0 days 0:01:16.359
Loading Kernel Symbols
.....................................................................................................................................................................................
Loading User Symbols
Loading unloaded module list
....
Unable to load image viexca2k.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for viexca2k.sys
*** ERROR: Module load completed but symbols could not be loaded for viexca2k.sys
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 100000D5, {8b050f80, 0, a8a840ef, 0}


Could not read faulting driver name
Unable to load image IPVNMon.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for IPVNMon.sys
*** ERROR: Module load completed but symbols could not be loaded for IPVNMon.sys
Probably caused by : viexca2k.sys ( viexca2k+10ef )

Followup: MachineOwner
---------

kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

DRIVER_PAGE_FAULT_IN_FREED_SPECIAL_POOL (d5)
Memory was referenced after it was freed.
This cannot be protected by try-except.
When possible, the guilty driver's name (Unicode string) is printed on
the bugcheck screen and saved in KiBugCheckDriver.
Arguments:
Arg1: 8b050f80, memory referenced
Arg2: 00000000, value 0 = read operation, 1 = write operation
Arg3: a8a840ef, if non-zero, the address which referenced memory.
Arg4: 00000000, (reserved)

Debugging Details:
------------------


Could not read faulting driver name

READ_ADDRESS: 8b050f80

FAULTING_IP:
viexca2k+10ef
a8a840ef 8b4718 mov eax,dword ptr [edi+18h]

MM_INTERNAL_CODE: 0

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: 0xD5

PROCESS_NAME: pcs.exe

LAST_CONTROL_TRANSFER: from a8a852d7 to a8a840ef

STACK_TEXT:
WARNING: Stack unwind information not available. Following frames may be wrong.
a8736bc8 a8a852d7 8981e648 8b050f68 804e37f7 viexca2k+0x10ef
a8736c08 8056a348 8b050fd8 897d4ee8 8b050f68 viexca2k+0x22d7
a8736c1c 80578c63 8981e648 8b050f68 897d4ee8 nt!IopSynchronousServiceTail+0x60
a8736cc4 8057d15e 00000708 00000000 00000000 nt!IopXxxControlFile+0x611
a8736cf8 bad1d303 00000708 00000000 00000000 nt!NtDeviceIoControlFile+0x2a
a8736d34 804de7ec 00000708 00000000 00000000 IPVNMon+0xa303
a8736d34 7c90eb94 00000708 00000000 00000000 nt!KiFastCallEntry+0xf8
0012e4b8 00000000 00000000 00000000 00000000 0x7c90eb94


STACK_COMMAND: kb

FOLLOWUP_IP:
viexca2k+10ef
a8a840ef 8b4718 mov eax,dword ptr [edi+18h]

SYMBOL_STACK_INDEX: 0

SYMBOL_NAME: viexca2k+10ef

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: viexca2k

IMAGE_NAME: viexca2k.sys

DEBUG_FLR_IMAGE_TIMESTAMP: 428cfc35

FAILURE_BUCKET_ID: 0xD5_viexca2k+10ef

BUCKET_ID: 0xD5_viexca2k+10ef

Followup: MachineOwner
---------

kd> lmvm viexca2k
start end module name
a8a83000 a8a8d000 viexca2k T (no symbols)
Loaded symbol image file: viexca2k.sys
Image path: viexca2k.sys
Image name: viexca2k.sys
Timestamp: Thu May 19 15:51:01 2005 (428CFC35)
CheckSum: 0000FC3B
ImageSize: 0000A000
Translations: 0000.04b0 0000.04e0 0409.04b0 0409.04e0

#15 Andrew Mc

Andrew Mc
  • Topic Starter

  • Members
  • 9 posts
  • OFFLINE
  •  
  • Local time:08:58 AM

Posted 28 August 2008 - 10:36 AM

And I do believe this is the fault from L8042Kbd.sys (0xD1) from when Driver Verifier was active.
------------------------------------------------------------------------------



Loading Dump File [D:\temp\Minidump\Mini082808-02.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows XP Kernel Version 2600 (Service Pack 2) UP Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 2600.xpsp_sp2_qfe.070227-2300
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055a820
Debug session time: Thu Aug 28 09:58:48.984 2008 (GMT-5)
System Uptime: 0 days 0:00:43.531
Loading Kernel Symbols
............................................................................................................................................................
Loading User Symbols
Loading unloaded module list
....
Unable to load image L8042Kbd.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for L8042Kbd.sys
*** ERROR: Module load completed but symbols could not be loaded for L8042Kbd.sys
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 100000D1, {2, 9, 0, 2}

*** WARNING: Unable to verify timestamp for savrt.sys
*** ERROR: Module load completed but symbols could not be loaded for savrt.sys
*** WARNING: Unable to verify timestamp for SYMEVENT.SYS
*** ERROR: Module load completed but symbols could not be loaded for SYMEVENT.SYS
Probably caused by : L8042Kbd.sys ( L8042Kbd+1bc3 )

Followup: MachineOwner
---------

kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: 00000002, memory referenced
Arg2: 00000009, IRQL
Arg3: 00000000, value 0 = read operation, 1 = write operation
Arg4: 00000002, address which referenced memory

Debugging Details:
------------------


READ_ADDRESS: 00000002

CURRENT_IRQL: 9

FAULTING_IP:
+2
00000002 ?? ???

PROCESS_NAME: System

CUSTOMER_CRASH_COUNT: 2

DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: 0xD1

LAST_CONTROL_TRANSFER: from f7958bc3 to 00000002

FAILED_INSTRUCTION_ADDRESS:
+2
00000002 ?? ???

STACK_TEXT:
WARNING: Frame IP not in any known module. Following frames may be wrong.
b9a150fc f7958bc3 b9d90c08 8a4caf40 8a4cae5c 0x2
b9a15124 f76e8f6b 8a4c4448 8a4caf40 8a4cae5c L8042Kbd+0x1bc3
b9a1517c 804da915 8a67ed08 8a4cac88 00010009 i8042prt!I8042KeyboardInterruptService+0x100
b9a1517c 80673294 8a67ed08 8a4cac88 00010009 nt!KiInterruptDispatch+0x3d
b9a1522c 8054ba0d 8a66dc88 00000001 8a66cc90 nt!VfDeadlockDeleteMemoryRange+0xdb
b9a15270 80563c85 8a66cc88 e56c6946 8a79a5b0 nt!ExFreePoolWithTag+0xad
b9a15294 80563cff 8a66cca0 00000000 00000000 nt!ObpFreeObject+0x18d
b9a152ac 804e36d5 8a66ccb8 00000000 00000adc nt!ObpRemoveObjectRoutine+0xe7
b9a152d0 80566eb3 8a726530 e1001b08 8a48d7a8 nt!ObfDereferenceObject+0x5f
b9a152e8 80566f1c e1001b08 8a66ccb8 00000adc nt!ObpCloseHandleTableEntry+0x155
b9a15330 80566f66 00000adc 00000000 00000000 nt!ObpCloseHandle+0x87
b9a15344 804de7ec 80000adc b9a153f0 804dc8c1 nt!NtClose+0x1d
b9a15344 804dc8c1 80000adc b9a153f0 804dc8c1 nt!KiFastCallEntry+0xf8
b9a153c0 a978f78f 80000adc 00000001 e1ffad65 nt!ZwClose+0x11
b9a153f0 a975f92a e13a91b0 e1ffad10 00000001 savrt+0x4678f
b9a15438 a9736904 e4ded258 e1f13948 e4ded250 savrt+0x1692a
b9a15458 a9736ab3 e4ded250 b9a154b8 e1f13968 SYMEVENT+0xf904
b9a1546c a972d1ff b9a154b8 e21d500c e1f13968 SYMEVENT+0xfab3
b9a15480 a97357a8 b9a154b8 8a4831f0 b9a154b8 SYMEVENT+0x61ff
b9a1549c a972e8b9 b9a154b8 804e8a41 a972e97a SYMEVENT+0xe7a8
b9a154d8 804e37f7 8a4831f0 8bd22de0 806ee2e8 SYMEVENT+0x78b9
b9a154e8 8066a5c5 00000000 8bd22de0 8a4abc40 nt!IopfCallDriver+0x31
b9a1550c bae42e67 00000000 8bd22de0 00000000 nt!IovCallDriver+0xa0
b9a15530 bae4f153 b9a15550 8a50f7d0 00000000 fltMgr!FltpLegacyProcessingAfterPreCallbacksCompleted+0x20b
b9a1556c 804e37f7 8a50f7d0 8bd22fdc 806ee2e8 fltMgr!FltpCreate+0x1e3
b9a1557c 8066a5c5 8bd22df0 8bd22de0 8a66edb0 nt!IopfCallDriver+0x31
b9a155a0 80570a29 8a6dc8e8 8a5323f4 b9a15748 nt!IovCallDriver+0xa0
b9a15680 8056356c 8a6dc900 00000000 8a532350 nt!IopParseDevice+0xa12
b9a15708 8056769a 00000000 b9a15748 00000040 nt!ObpLookupObjectName+0x56a
b9a1575c 80570f03 00000000 00000000 00000001 nt!ObOpenObjectByName+0xeb
b9a157d8 80570fd2 0007ec10 00100020 0007ebe4 nt!IopCreateFile+0x407
b9a15834 8057109a 0007ec10 00100020 0007ebe4 nt!IoCreateFile+0x8e
b9a15874 804de7ec 0007ec10 00100020 0007ebe4 nt!NtOpenFile+0x27
b9a15874 7c90eb94 0007ec10 00100020 0007ebe4 nt!KiFastCallEntry+0xf8
0007ec04 00000000 00000000 00000000 00000000 0x7c90eb94


STACK_COMMAND: kb

FOLLOWUP_IP:
L8042Kbd+1bc3
f7958bc3 ?? ???

SYMBOL_STACK_INDEX: 1

SYMBOL_NAME: L8042Kbd+1bc3

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: L8042Kbd

IMAGE_NAME: L8042Kbd.sys

DEBUG_FLR_IMAGE_TIMESTAMP: 461d6f42

FAILURE_BUCKET_ID: 0xD1_CODE_AV_BAD_IP_L8042Kbd+1bc3

BUCKET_ID: 0xD1_CODE_AV_BAD_IP_L8042Kbd+1bc3

Followup: MachineOwner
---------

kd> lmvm L8042Kbd
start end module name
f7957000 f795a500 L8042Kbd T (no symbols)
Loaded symbol image file: L8042Kbd.sys
Image path: L8042Kbd.sys
Image name: L8042Kbd.sys
Timestamp: Wed Apr 11 18:29:06 2007 (461D6F42)
CheckSum: 00012785
ImageSize: 00003500
Translations: 0000.04b0 0000.04e0 0409.04b0 0409.04e0




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users