Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

B.S.O.D. on laptop need help with debug results.


  • Please log in to reply
8 replies to this topic

#1 mbb

mbb

  • Members
  • 4 posts
  • OFFLINE
  •  
  • Local time:12:40 PM

Posted 22 December 2008 - 08:44 PM

I have a Lenovo T61 laptop running xp that keeps getting BSOD errors any time I run on battery power and surf the net. I have ran memtest 86 and did not get any errors so I installed and ran windows debugging tool. I need help with what the report means. Any help would be appreciated. Here's are the results.



Microsoft ® Windows Debugger Version 6.9.0003.113 X86
Copyright © Microsoft Corporation. All rights reserved.


Loading Dump File [C:\WINDOWS\MEMORY.DMP]
Kernel Summary Dump File: Only kernel address space is available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows XP Kernel Version 2600 (Service Pack 3) MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 2600.xpsp_sp3_gdr.080814-1236
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055d720
Debug session time: Mon Dec 22 14:34:00.421 2008 (GMT-5)
System Uptime: 0 days 0:04:41.101
Loading Kernel Symbols
......................................................................................................................................
Loading User Symbols
PEB is paged out (Peb.Ldr = 7ffd500c). Type ".hh dbgerr001" for details
Loading unloaded module list
...........
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 50, {ffffffe8, 1, 805264d6, 0}

PEB is paged out (Peb.Ldr = 7ffd500c). Type ".hh dbgerr001" for details
PEB is paged out (Peb.Ldr = 7ffd500c). Type ".hh dbgerr001" for details
Probably caused by : sr.sys ( sr!SrCleanup+b3 )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced. This cannot be protected by try-except,
it must be protected by a Probe. Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: ffffffe8, memory referenced.
Arg2: 00000001, value 0 = read operation, 1 = write operation.
Arg3: 805264d6, If non-zero, the instruction address which referenced the bad memory
address.
Arg4: 00000000, (reserved)

Debugging Details:
------------------

PEB is paged out (Peb.Ldr = 7ffd500c). Type ".hh dbgerr001" for details
PEB is paged out (Peb.Ldr = 7ffd500c). Type ".hh dbgerr001" for details

WRITE_ADDRESS: ffffffe8

FAULTING_IP:
nt!ObfReferenceObject+18
805264d6 f00fc106 lock xadd dword ptr [esi],eax

MM_INTERNAL_CODE: 0

DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: 0x50

PROCESS_NAME: avwsc.exe

TRAP_FRAME: 932c77d4 -- (.trap 0xffffffff932c77d4)
ErrCode = 00000002
eax=00000001 ebx=00000000 ecx=00000000 edx=e1b06000 esi=ffffffe8 edi=00000000
eip=805264d6 esp=932c7848 ebp=932c7850 iopl=0 nv up ei pl nz na po nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010202
nt!ObfReferenceObject+0x18:
805264d6 f00fc106 lock xadd dword ptr [esi],eax ds:0023:ffffffe8=????????
Resetting default scope

LAST_CONTROL_TRANSFER: from 8052037a to 804f9f43

STACK_TEXT:
932c7754 8052037a 00000050 ffffffe8 00000001 nt!KeBugCheckEx+0x1b
932c77bc 80544588 00000001 ffffffe8 00000000 nt!MmAccessFault+0x9a8
932c77bc 805264d6 00000001 ffffffe8 00000000 nt!KiTrap0E+0xd0
932c7848 80574a64 932c7a5c b9d92c1a 87edbef8 nt!ObfReferenceObject+0x18
932c7850 b9d92c1a 87edbef8 e1b06130 00000000 nt!IoSetInformation+0x1a
932c7a5c b9d92d4d 932c7a78 87fc1298 89c5a788 Ntfs!NtfsCommonCleanup+0x2555
932c7bd4 804ef19f 8a5ab020 87fc1298 8a61df38 Ntfs!NtfsFsdCleanup+0xcf
932c7be4 b9e15bbf 00000000 87f9f690 932c7c28 nt!IopfCallDriver+0x31
932c7bf4 804ef19f 89c5a6d0 87fc1298 87fc1298 sr!SrCleanup+0xb3
932c7c04 b9e26e9b 899fe020 87fc1298 89b9bc18 nt!IopfCallDriver+0x31
932c7c28 b9e2706b 932c7c48 899fe020 00000000 fltmgr!FltpLegacyProcessingAfterPreCallbacksCompleted+0x20b
932c7c60 804ef19f 899fe020 87fc1298 87fc1298 fltmgr!FltpDispatch+0x11f
932c7c70 80583953 87edbee0 00000070 8a6dc900 nt!IopfCallDriver+0x31
932c7ca0 805bca16 87f5a6f8 899fe020 001200a9 nt!IopCloseFile+0x26b
932c7cd4 805bc33f 87f5a6f8 00000001 8a6dc900 nt!ObpDecrementHandleCount+0xd8
932c7cfc 805bc3dd e2c9b940 87edbef8 00000054 nt!ObpCloseHandleTableEntry+0x14d
932c7d44 805bc515 00000054 00000001 00000000 nt!ObpCloseHandle+0x87
932c7d58 8054162c 00000054 0012d3dc 7c90e4f4 nt!NtClose+0x1d
932c7d58 7c90e4f4 00000054 0012d3dc 7c90e4f4 nt!KiFastCallEntry+0xfc
WARNING: Frame IP not in any known module. Following frames may be wrong.
0012d3dc 00000000 00000000 00000000 00000000 0x7c90e4f4


STACK_COMMAND: kb

FOLLOWUP_IP:
sr!SrCleanup+b3
b9e15bbf 5f pop edi

SYMBOL_STACK_INDEX: 8

SYMBOL_NAME: sr!SrCleanup+b3

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: sr

IMAGE_NAME: sr.sys

DEBUG_FLR_IMAGE_TIMESTAMP: 480252c2

FAILURE_BUCKET_ID: 0x50_W_sr!SrCleanup+b3

BUCKET_ID: 0x50_W_sr!SrCleanup+b3

Followup: MachineOwner
---------

BC AdBot (Login to Remove)

 


#2 hamluis

hamluis

    Moderator


  • Moderator
  • 56,265 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:Killeen, TX
  • Local time:12:40 PM

Posted 22 December 2008 - 09:26 PM

Your report mentions avwsc.exe, which is a Avira AntiVir file/process.

I happen to use Avira AntiVir PE, so if I had any inkling that my AV program was creating BSODs...I would assume that file corruption has occurred and do the uninstall/reinstall routine and see if that solves the situation.

BSODs are often triggered by drivers gone wrong and your AV program certainly has drivers...various software programs have drivers, in addition to hardware components of the system.

<<...that keeps getting BSOD errors any time I run on battery power and surf the net.>>

Does that mean that you don't get the BSODs if you directly connect the laptop to a socket? Does that mean that the BSODs only occur during surfing activity?

Louis

#3 mbb

mbb
  • Topic Starter

  • Members
  • 4 posts
  • OFFLINE
  •  
  • Local time:12:40 PM

Posted 22 December 2008 - 10:11 PM

Your report mentions avwsc.exe, which is a Avira AntiVir file/process.

I happen to use Avira AntiVir PE, so if I had any inkling that my AV program was creating BSODs...I would assume that file corruption has occurred and do the uninstall/reinstall routine and see if that solves the situation.

BSODs are often triggered by drivers gone wrong and your AV program certainly has drivers...various software programs have drivers, in addition to hardware components of the system.

<<...that keeps getting BSOD errors any time I run on battery power and surf the net.>>

Does that mean that you don't get the BSODs if you directly connect the laptop to a socket? Does that mean that the BSODs only occur during surfing activity?

Louis

Thanks for the reply. I only notice it when I run on battery. I can use it plugged in running Quickbooks premier for days and not have any problems. I removed Antivir and rebooted and it BSOD on me with it unplugged while using Google Chrome to test. Here is the next dump report from windows debugger.


Microsoft ® Windows Debugger Version 6.9.0003.113 X86
Copyright © Microsoft Corporation. All rights reserved.


Loading Dump File [C:\WINDOWS\MEMORY.DMP]
Kernel Summary Dump File: Only kernel address space is available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows XP Kernel Version 2600 (Service Pack 3) MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 2600.xpsp_sp3_gdr.080814-1236
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055d720
Debug session time: Mon Dec 22 21:40:54.578 2008 (GMT-5)
System Uptime: 0 days 0:07:46.265
Loading Kernel Symbols
...................................................................................................................................
Loading User Symbols
PEB is paged out (Peb.Ldr = 7ffd700c). Type ".hh dbgerr001" for details
Loading unloaded module list
...........
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 8E, {c0000005, bf86103e, a715cae8, 0}

PEB is paged out (Peb.Ldr = 7ffd700c). Type ".hh dbgerr001" for details
PEB is paged out (Peb.Ldr = 7ffd700c). Type ".hh dbgerr001" for details
Probably caused by : win32k.sys ( win32k!GreStretchDIBitsInternal+b7 )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

KERNEL_MODE_EXCEPTION_NOT_HANDLED (8e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003. This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG. This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG. This will let us see why this breakpoint is
happening.
Arguments:
Arg1: c0000005, The exception code that was not handled
Arg2: bf86103e, The address that the exception occurred at
Arg3: a715cae8, Trap Frame
Arg4: 00000000

Debugging Details:
------------------

PEB is paged out (Peb.Ldr = 7ffd700c). Type ".hh dbgerr001" for details
PEB is paged out (Peb.Ldr = 7ffd700c). Type ".hh dbgerr001" for details

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx". The memory could not be "%s".

FAULTING_IP:
win32k!GreStretchDIBitsInternal+b7
bf86103e 0fb6783b movzx edi,byte ptr [eax+3Bh]

TRAP_FRAME: a715cae8 -- (.trap 0xffffffffa715cae8)
ErrCode = 00000000
eax=00000028 ebx=033c03a0 ecx=e107a008 edx=000008f4 esi=e29c0458 edi=00000578
eip=bf86103e esp=a715cb5c ebp=a715cca4 iopl=0 nv up ei ng nz na po nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010282
win32k!GreStretchDIBitsInternal+0xb7:
bf86103e 0fb6783b movzx edi,byte ptr [eax+3Bh] ds:0023:00000063=??
Resetting default scope

DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: 0x8E

PROCESS_NAME: chrome.exe

LAST_CONTROL_TRANSFER: from 804fe827 to 804f9f43

STACK_TEXT:
a715c6b0 804fe827 0000008e c0000005 bf86103e nt!KeBugCheckEx+0x1b
a715ca78 80542095 a715ca94 00000000 a715cae8 nt!KiDispatchException+0x3b1
a715cae0 80542046 a715cca4 bf86103e badb0d00 nt!CommonDispatchException+0x4d
a715cb00 bf80558e 000008f5 e107a008 bf908ce0 nt!Kei386EoiHelper+0x18a
a715cb8c 80520b80 050d0000 87f5c798 a715ccc0 win32k!HANDLELOCK::vUnlock+0x20
a715cca4 bf861b52 1901089c 00000515 000000de nt!MmAccessFault+0x11ae
a715cd1c 8054162c 1901089c 00000515 000000de win32k!NtGdiStretchDIBitsInternal+0xd2
a715cd1c 7c90e4f4 1901089c 00000515 000000de nt!KiFastCallEntry+0xfc
WARNING: Frame IP not in any known module. Following frames may be wrong.
0012eb2c 00000000 00000000 00000000 00000000 0x7c90e4f4


STACK_COMMAND: kb

FOLLOWUP_IP:
win32k!GreStretchDIBitsInternal+b7
bf86103e 0fb6783b movzx edi,byte ptr [eax+3Bh]

SYMBOL_STACK_INDEX: 0

SYMBOL_NAME: win32k!GreStretchDIBitsInternal+b7

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: win32k

IMAGE_NAME: win32k.sys

DEBUG_FLR_IMAGE_TIMESTAMP: 48ce513a

FAILURE_BUCKET_ID: 0x8E_win32k!GreStretchDIBitsInternal+b7

BUCKET_ID: 0x8E_win32k!GreStretchDIBitsInternal+b7

Followup: MachineOwner
---------

#4 hamluis

hamluis

    Moderator


  • Moderator
  • 56,265 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:Killeen, TX
  • Local time:12:40 PM

Posted 22 December 2008 - 10:45 PM

FWIW: Some info on PEB is paged out message, http://msdn.microsoft.com/en-us/library/cc267325.aspx

Someone else will have to tell you just what all that may mean :thumbsup:.

Louis

#5 usasma

usasma

    Still visually handicapped (avatar is memory developed by my Dad


  • BSOD Kernel Dump Expert
  • 25,091 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Southeastern CT, USA
  • Local time:01:40 PM

Posted 23 December 2008 - 07:37 AM

PEB is a condition on your system where the memory has been paged out (by the Windows Memory Manage), so that particular block isn't available for the debugger to look at. As such, the debug analysis may be partially incomplete.

As for your dump files, the first one states it was caused by SR.SYS (which is a process associated with System Restore) when it tried to access an invalid memory address. Since this occurred while SR.SYS was associated with AVWSC.EXE, I'd suspect that it was (as hamluis stated) an issue with your AntiVir software. Uninstall and reinstall a fresh copy to see if that fixes the error.

Since the second BSOD isn't nearly the same as the first - we've gotta consider what's happening here. Either the two are related or they arent' - and this will complicate the diagnosis.

If they are related, then this appears to be a memory issue - and the common factor in that is your memory. Not just RAM, but virtual memory (your pagefile), memory on the CPU (the CPU cache), on the video card (VRAM), etc. Another possible factor is a corruption of the Windows Memory Manager stuff.

If they aren't related, then I'd suggest that the second error is an issue with the Google Chrome browser. The error occurred in memory in WIN32K.SYS while it was associated with CHROME.EXE The likely remedy for this is to uninstall the Google Chrome browser - then reinstall a fresh copy if you want to continue using it.

Edited by usasma, 23 December 2008 - 07:38 AM.

My browser caused a flood of traffic, sio my IP address was banned. Hope to fix it soon. Will get back to posting as soon as Im able.

- John  (my website: http://www.carrona.org/ )**If you need a more detailed explanation, please ask for it. I have the Knack. **  If I haven't replied in 48 hours, please send me a message. My eye problems have recently increased and I'm having difficult reading posts. (23 Nov 2017)FYI - I am completely blind in the right eye and ~30% blind in the left eye.<p>If the eye problems get worse suddenly, I may not be able to respond.If that's the case and help is needed, please PM a staff member for assistance.

#6 mbb

mbb
  • Topic Starter

  • Members
  • 4 posts
  • OFFLINE
  •  
  • Local time:12:40 PM

Posted 23 December 2008 - 09:03 AM

Thanks for the replies. I will try uninstalling Chrome. I was checking virtual memory settings and it was fixed at around 1 gig. I changed it to windows managed to see if maybe it was running out of cache. I will check my device drivers for any needed updates. I if I can't fix it should I just reinstall everything? Again thanks for your replies.

#7 usasma

usasma

    Still visually handicapped (avatar is memory developed by my Dad


  • BSOD Kernel Dump Expert
  • 25,091 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Southeastern CT, USA
  • Local time:01:40 PM

Posted 23 December 2008 - 09:15 AM

How much RAM does the system have? Letting Windows manage the virtual memory is a good idea if you're not doing something special with the system. In those cases, a fixed pagefile on a separate drive is usually gives the best performance.

I've found that virtual memory issues usually revolve around a misbehaving program rather than not having enough virtual memory.
Games are the exception here as I've found that they sometimes require a pagefile (other high-end apps may also do this).
My browser caused a flood of traffic, sio my IP address was banned. Hope to fix it soon. Will get back to posting as soon as Im able.

- John  (my website: http://www.carrona.org/ )**If you need a more detailed explanation, please ask for it. I have the Knack. **  If I haven't replied in 48 hours, please send me a message. My eye problems have recently increased and I'm having difficult reading posts. (23 Nov 2017)FYI - I am completely blind in the right eye and ~30% blind in the left eye.<p>If the eye problems get worse suddenly, I may not be able to respond.If that's the case and help is needed, please PM a staff member for assistance.

#8 mbb

mbb
  • Topic Starter

  • Members
  • 4 posts
  • OFFLINE
  •  
  • Local time:12:40 PM

Posted 23 December 2008 - 10:04 AM

It has 2gig of ram which is shared for video. I have gotten two more errors. Here are the debugg results


Microsoft ® Windows Debugger Version 6.9.0003.113 X86
Copyright © Microsoft Corporation. All rights reserved.


Loading Dump File [C:\WINDOWS\MEMORY.DMP]
Kernel Summary Dump File: Only kernel address space is available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows XP Kernel Version 2600 (Service Pack 3) MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 2600.xpsp_sp3_gdr.080814-1236
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055d720
Debug session time: Tue Dec 23 09:29:42.406 2008 (GMT-5)
System Uptime: 0 days 0:15:01.123
Loading Kernel Symbols
....................................................................................................................................
Loading User Symbols
PEB is paged out (Peb.Ldr = 7ffd900c). Type ".hh dbgerr001" for details
Loading unloaded module list
..........
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 8E, {c0000005, b847996c, 959b0ad8, 0}

*** ERROR: Module load completed but symbols could not be loaded for SynTP.sys
*** ERROR: Module load completed but symbols could not be loaded for rixdptsk.sys
PEB is paged out (Peb.Ldr = 7ffd900c). Type ".hh dbgerr001" for details
PEB is paged out (Peb.Ldr = 7ffd900c). Type ".hh dbgerr001" for details
Probably caused by : hardware ( SynTP+3396c )

Followup: MachineOwner
---------

1: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

KERNEL_MODE_EXCEPTION_NOT_HANDLED (8e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003. This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG. This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG. This will let us see why this breakpoint is
happening.
Arguments:
Arg1: c0000005, The exception code that was not handled
Arg2: b847996c, The address that the exception occurred at
Arg3: 959b0ad8, Trap Frame
Arg4: 00000000

Debugging Details:
------------------

PEB is paged out (Peb.Ldr = 7ffd900c). Type ".hh dbgerr001" for details
PEB is paged out (Peb.Ldr = 7ffd900c). Type ".hh dbgerr001" for details

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx". The memory could not be "%s".

FAULTING_IP:
SynTP+3396c
b847996c a4 movs byte ptr es:[edi],byte ptr [esi]

TRAP_FRAME: 959b0ad8 -- (.trap 0xffffffff959b0ad8)
ErrCode = 00000000
eax=00000000 ebx=00000000 ecx=899ff154 edx=00000057 esi=000dcac4 edi=b84649bf
eip=b847996c esp=959b0b4c ebp=80006004 iopl=0 nv up ei pl zr na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010246
SynTP+0x3396c:
b847996c a4 movs byte ptr es:[edi],byte ptr [esi] es:0023:b84649bf=5f ds:0023:000dcac4=??
Resetting default scope

DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: 0x8E

PROCESS_NAME: SynTPEnh.exe

MISALIGNED_IP:
SynTP+3396c
b847996c a4 movs byte ptr es:[edi],byte ptr [esi]

LAST_CONTROL_TRANSFER: from 804fe827 to 804f9f43

STACK_TEXT:
959b06a0 804fe827 0000008e c0000005 b847996c nt!KeBugCheckEx+0x1b
959b0a68 80542095 959b0a84 00000000 959b0ad8 nt!KiDispatchException+0x3b1
959b0ad0 80542046 80006004 b847996c badb0d00 nt!CommonDispatchException+0x4d
959b0aec 804ff980 806e6ae4 87f4e9c0 b8466cae nt!Kei386EoiHelper+0x18a
959b0b64 b845d531 959b0ba8 010002c7 00000000 nt!KiDeliverApc+0x1e0
WARNING: Stack unwind information not available. Following frames may be wrong.
00000000 00000000 00000000 00000000 00000000 SynTP+0x17531


STACK_COMMAND: kb

FOLLOWUP_IP:
SynTP+3396c
b847996c a4 movs byte ptr es:[edi],byte ptr [esi]

SYMBOL_STACK_INDEX: 0

SYMBOL_NAME: SynTP+3396c

FOLLOWUP_NAME: MachineOwner

IMAGE_NAME: hardware

DEBUG_FLR_IMAGE_TIMESTAMP: 0

MODULE_NAME: hardware

FAILURE_BUCKET_ID: IP_MISALIGNED_SynTP.sys

BUCKET_ID: IP_MISALIGNED_SynTP.sys

Followup: MachineOwner
---------

The next one:

Microsoft ® Windows Debugger Version 6.9.0003.113 X86
Copyright © Microsoft Corporation. All rights reserved.


Loading Dump File [C:\WINDOWS\MEMORY.DMP]
Kernel Summary Dump File: Only kernel address space is available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows XP Kernel Version 2600 (Service Pack 3) MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 2600.xpsp_sp3_gdr.080814-1236
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055d720
Debug session time: Tue Dec 23 09:29:42.406 2008 (GMT-5)
System Uptime: 0 days 0:15:01.123
Loading Kernel Symbols
....................................................................................................................................
Loading User Symbols
PEB is paged out (Peb.Ldr = 7ffd900c). Type ".hh dbgerr001" for details
Loading unloaded module list
..........
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 8E, {c0000005, b847996c, 959b0ad8, 0}

*** ERROR: Module load completed but symbols could not be loaded for SynTP.sys
*** ERROR: Module load completed but symbols could not be loaded for rixdptsk.sys
PEB is paged out (Peb.Ldr = 7ffd900c). Type ".hh dbgerr001" for details
PEB is paged out (Peb.Ldr = 7ffd900c). Type ".hh dbgerr001" for details
Probably caused by : hardware ( SynTP+3396c )

Followup: MachineOwner
---------

1: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

KERNEL_MODE_EXCEPTION_NOT_HANDLED (8e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003. This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG. This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG. This will let us see why this breakpoint is
happening.
Arguments:
Arg1: c0000005, The exception code that was not handled
Arg2: b847996c, The address that the exception occurred at
Arg3: 959b0ad8, Trap Frame
Arg4: 00000000

Debugging Details:
------------------

PEB is paged out (Peb.Ldr = 7ffd900c). Type ".hh dbgerr001" for details
PEB is paged out (Peb.Ldr = 7ffd900c). Type ".hh dbgerr001" for details

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx". The memory could not be "%s".

FAULTING_IP:
SynTP+3396c
b847996c a4 movs byte ptr es:[edi],byte ptr [esi]

TRAP_FRAME: 959b0ad8 -- (.trap 0xffffffff959b0ad8)
ErrCode = 00000000
eax=00000000 ebx=00000000 ecx=899ff154 edx=00000057 esi=000dcac4 edi=b84649bf
eip=b847996c esp=959b0b4c ebp=80006004 iopl=0 nv up ei pl zr na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010246
SynTP+0x3396c:
b847996c a4 movs byte ptr es:[edi],byte ptr [esi] es:0023:b84649bf=5f ds:0023:000dcac4=??
Resetting default scope

DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: 0x8E

PROCESS_NAME: SynTPEnh.exe

MISALIGNED_IP:
SynTP+3396c
b847996c a4 movs byte ptr es:[edi],byte ptr [esi]

LAST_CONTROL_TRANSFER: from 804fe827 to 804f9f43

STACK_TEXT:
959b06a0 804fe827 0000008e c0000005 b847996c nt!KeBugCheckEx+0x1b
959b0a68 80542095 959b0a84 00000000 959b0ad8 nt!KiDispatchException+0x3b1
959b0ad0 80542046 80006004 b847996c badb0d00 nt!CommonDispatchException+0x4d
959b0aec 804ff980 806e6ae4 87f4e9c0 b8466cae nt!Kei386EoiHelper+0x18a
959b0b64 b845d531 959b0ba8 010002c7 00000000 nt!KiDeliverApc+0x1e0
WARNING: Stack unwind information not available. Following frames may be wrong.
00000000 00000000 00000000 00000000 00000000 SynTP+0x17531


STACK_COMMAND: kb

FOLLOWUP_IP:
SynTP+3396c
b847996c a4 movs byte ptr es:[edi],byte ptr [esi]

SYMBOL_STACK_INDEX: 0

SYMBOL_NAME: SynTP+3396c

FOLLOWUP_NAME: MachineOwner

IMAGE_NAME: hardware

DEBUG_FLR_IMAGE_TIMESTAMP: 0

MODULE_NAME: hardware

FAILURE_BUCKET_ID: IP_MISALIGNED_SynTP.sys

BUCKET_ID: IP_MISALIGNED_SynTP.sys

Followup: MachineOwner
---------

1: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

KERNEL_MODE_EXCEPTION_NOT_HANDLED (8e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003. This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG. This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG. This will let us see why this breakpoint is
happening.
Arguments:
Arg1: c0000005, The exception code that was not handled
Arg2: b847996c, The address that the exception occurred at
Arg3: 959b0ad8, Trap Frame
Arg4: 00000000

Debugging Details:
------------------

PEB is paged out (Peb.Ldr = 7ffd900c). Type ".hh dbgerr001" for details
PEB is paged out (Peb.Ldr = 7ffd900c). Type ".hh dbgerr001" for details

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx". The memory could not be "%s".

FAULTING_IP:
SynTP+3396c
b847996c a4 movs byte ptr es:[edi],byte ptr [esi]

TRAP_FRAME: 959b0ad8 -- (.trap 0xffffffff959b0ad8)
ErrCode = 00000000
eax=00000000 ebx=00000000 ecx=899ff154 edx=00000057 esi=000dcac4 edi=b84649bf
eip=b847996c esp=959b0b4c ebp=80006004 iopl=0 nv up ei pl zr na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010246
SynTP+0x3396c:
b847996c a4 movs byte ptr es:[edi],byte ptr [esi] es:0023:b84649bf=5f ds:0023:000dcac4=??
Resetting default scope

DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: 0x8E

PROCESS_NAME: SynTPEnh.exe

MISALIGNED_IP:
SynTP+3396c
b847996c a4 movs byte ptr es:[edi],byte ptr [esi]

LAST_CONTROL_TRANSFER: from 804fe827 to 804f9f43

STACK_TEXT:
959b06a0 804fe827 0000008e c0000005 b847996c nt!KeBugCheckEx+0x1b
959b0a68 80542095 959b0a84 00000000 959b0ad8 nt!KiDispatchException+0x3b1
959b0ad0 80542046 80006004 b847996c badb0d00 nt!CommonDispatchException+0x4d
959b0aec 804ff980 806e6ae4 87f4e9c0 b8466cae nt!Kei386EoiHelper+0x18a
959b0b64 b845d531 959b0ba8 010002c7 00000000 nt!KiDeliverApc+0x1e0
WARNING: Stack unwind information not available. Following frames may be wrong.
00000000 00000000 00000000 00000000 00000000 SynTP+0x17531


STACK_COMMAND: kb

FOLLOWUP_IP:
SynTP+3396c
b847996c a4 movs byte ptr es:[edi],byte ptr [esi]

SYMBOL_STACK_INDEX: 0

SYMBOL_NAME: SynTP+3396c

FOLLOWUP_NAME: MachineOwner

IMAGE_NAME: hardware

DEBUG_FLR_IMAGE_TIMESTAMP: 0

MODULE_NAME: hardware

FAILURE_BUCKET_ID: IP_MISALIGNED_SynTP.sys

BUCKET_ID: IP_MISALIGNED_SynTP.sys

Followup: MachineOwner
---------

#9 usasma

usasma

    Still visually handicapped (avatar is memory developed by my Dad


  • BSOD Kernel Dump Expert
  • 25,091 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Southeastern CT, USA
  • Local time:01:40 PM

Posted 23 December 2008 - 12:40 PM

With 2 gB of RAM, 1 gB should have been adequate - but Windows managed is still better.

These errors are all related to your Synaptics Touchpad. Uninstall the Synaptics Touchpad software from the Add/Remove Programs applet in Control Panel.

FWIW - with this number of errors it's critical to know what you've done in between which crashes - and when (approximately) each crash occurred. This may let us find a pattern that may not be readily discernable from a single dump or two.

FWIW2 - I've seen a couple of this type of Synaptic issue recently - so I'm hoping that this will be the root cause of your BSOD's and that the steps below will fix it. I'd suspect a Windows Update that the Synaptics software isn't capable of dealing with.

Then, check to make sure that it's removed from the list of devices in Device Manager (Start...Run...type in "devmgmt.msc" (without the quotes) and press Enter).

Reboot

Download a fresh copy from the website of the manufacturer of your system (link to Lenovo Support site for the T61: http://www-307.ibm.com/pc/support/site.wss...p;validate=true ) and install the new driver.
My browser caused a flood of traffic, sio my IP address was banned. Hope to fix it soon. Will get back to posting as soon as Im able.

- John  (my website: http://www.carrona.org/ )**If you need a more detailed explanation, please ask for it. I have the Knack. **  If I haven't replied in 48 hours, please send me a message. My eye problems have recently increased and I'm having difficult reading posts. (23 Nov 2017)FYI - I am completely blind in the right eye and ~30% blind in the left eye.<p>If the eye problems get worse suddenly, I may not be able to respond.If that's the case and help is needed, please PM a staff member for assistance.




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users