Jump to content


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.

Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.


BSOD - Usually Occcurs in Start Menu

  • Please log in to reply
1 reply to this topic

#1 grinder85muc


  • Members
  • 1 posts
  • Local time:09:30 PM

Posted 21 January 2009 - 01:49 PM

I pretty sure this is where I need to be (first time poster) so here goes.

I'm trying to help a guy I work with a blue screen issue.

Background: He was running XP Home SP2 when he caught one of the current malware programs going around. After running Malwarebytes and Spybot plus updating to SP3 things seem much better.

Problem: However, now he receives a blue screen on a regular basis, the most reliable way to reproduce it is by opening Start/All Programs and just mousing around opening up different submenus. Though he did note today opening Internet Explorer would as cause it, but this is not consistent. I have to assume this is something left from the above problem, but I'm stumped as where to go next.

Error Code (Paraphrased): 0x00000050 (0xE29FF000,.....don't have the rest written sorry..)

Any direction would be greatly apprecated!

Also I ran windbg on the minidump file and it gave me this...

kd> !analyze -v
* *
* Bugcheck Analysis *
* *

Invalid system memory was referenced. This cannot be protected by try-except,
it must be protected by a Probe. Typically the address is just plain bad or it
is pointing at freed memory.
Arg1: e12f2000, memory referenced.
Arg2: 00000000, value 0 = read operation, 1 = write operation.
Arg3: f77cb8d6, If non-zero, the instruction address which referenced the bad memory
Arg4: 00000001, (reserved)

Debugging Details:

Could not read faulting driver name

READ_ADDRESS: e12f2000

f77cb8d6 66833c1000 cmp word ptr [eax+edx],0





PROCESS_NAME: iexplore.exe

LAST_CONTROL_TRANSFER: from f77ca255 to f77cb8d6

WARNING: Frame IP not in any known module. Following frames may be wrong.
ee02b660 f77ca255 e12f1ffe 83b968c8 83b968b0 0xf77cb8d6
ee02b6d8 f75c081b 837f5008 ee02b6fc f75c23f4 0xf77ca255
ee02b708 f77ca68c e12f1ef8 00000108 00000000 Ntfs!NtfsReleaseFcb+0x4e
ee02b738 edaa0167 83777b10 83780a10 ee02b808 0xf77ca68c
ee02b80c edaa08be e12f1eb4 83777b10 83780a10 avgntflt+0x4167
ee02b88c edaaab61 e12f1eb4 00000000 ee02b8fc avgntflt+0x48be
ee02b8d8 f7664ef3 e12f1eb4 ee02b8fc 00000000 avgntflt+0xeb61
ee02b940 f7667338 006d7520 00000000 836d7520 fltmgr!FltpPerformPostCallbacks+0x1c5
ee02b954 f7667867 836d7520 838d4008 ee02b994 fltmgr!FltpProcessIoCompletion+0x10
ee02b964 f7667ef9 83490d88 838d4008 836d7520 fltmgr!FltpPassThroughCompletion+0x89
ee02b994 f7674754 ee02b9b4 00000000 00000000 fltmgr!FltpLegacyProcessingAfterPreCallbacksCompleted+0x269
ee02b9d0 804e37f7 83490d88 838d4008 838d4008 fltmgr!FltpCreate+0x26a
ee02b9e0 8056c712 83b90350 8396b47c ee02bb88 nt!IopfCallDriver+0x31
ee02bac0 80563fec 83b90368 00000000 8396b3d8 nt!IopParseDevice+0xa12
ee02bb48 805684da 00000000 ee02bb88 00000040 nt!ObpLookupObjectName+0x56a
ee02bb9c 8056cbeb 00000000 00000000 7894e801 nt!ObOpenObjectByName+0xeb
ee02bc18 8056ccba 018cfb04 80100080 018cfaa4 nt!IopCreateFile+0x407
ee02bc74 f77c7e89 018cfb04 80100080 018cfaa4 nt!IoCreateFile+0x8e
ee02bcb8 8056cdf0 018cfb04 80100080 018cfaa4 0xf77c7e89
ee02bcf8 f77c7da6 018cfb04 80100080 018cfaa4 nt!NtCreateFile+0x30
ee02bd30 804de7ec 018cfb04 80100080 018cfaa4 0xf77c7da6
ee02bd30 7c90e4f4 018cfb04 80100080 018cfaa4 nt!KiFastCallEntry+0xf8
018cfafc 00000000 00000000 00000000 00000000 0x7c90e4f4


edaa0167 ?? ???


SYMBOL_NAME: avgntflt+4167


MODULE_NAME: avgntflt

IMAGE_NAME: avgntflt.sys


FAILURE_BUCKET_ID: 0x50_avgntflt+4167

BUCKET_ID: 0x50_avgntflt+4167

Followup: MachineOwner

BC AdBot (Login to Remove)


#2 hamluis



  • Moderator
  • 56,295 posts
  • Gender:Male
  • Location:Killeen, TX
  • Local time:09:30 PM

Posted 21 January 2009 - 02:36 PM

Best info I have on this:



...and from a standard reference for STOP errors:

Requested data was not in memory. An invalid system memory address was referenced. Defective memory (including main memory, L2 RAM cache, video RAM) or incompatible software (including remote control and antivirus software) might cause this Stop message, as may other hardware problems (e.g., incorrect SCSI termination or a flawed PCI card).

Following are references from the above that may pertain to a given particular circumstance. The circumstances for any STOP error vary, as do the attempted solutions.

Possible Resolutions to STOP 0x0A, 0x01E, and 0x50 Errors, http://support.microsoft.com/kb/183169

How to Use Driver Verifier to Troubleshoot Windows Drivers, http://support.microsoft.com/kb/244617

STOP Error When You Start Windows After You Connect a Scanner, http://support.microsoft.com/kb/310869

A related thread, illustrating the complexity of resolving this: http://aumha.net/viewtopic.php?f=62&t=37200

I myself don't possess the expertise required to troubleshoot this any further, but others here do. I suggest that you take a look at Help Diagnosing BSODs And Crashes (BC) - http://www.bleepingcomputer.com/forums/t/176011/how-to-receive-help-diagnosing-blue-screens-and-windows-crashes/


Edited by hamluis, 21 January 2009 - 02:47 PM.

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users