Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Multiple bluescreens


  • Please log in to reply
22 replies to this topic

#1 Kitiara

Kitiara

  • Members
  • 32 posts
  • OFFLINE
  •  
  • Local time:05:10 PM

Posted 20 April 2009 - 04:24 AM

Hi

I am experiencing a problem with several BSOD's in a row, mostly on startup, or when I bring the laptop out of standby. This has been going on for a couple of weeks.

I've run several virus checks, and I'm pretty confident that's not the issue.

The error messages vary. Here is the list so far:

bad pool caller
irql not less or equal
memory managment
pfn list corrupt
page fault in non paged area
and a non-specified one which I think is kernel mode exeption not handled.

I have all the minidumps, and can post analysis if required.

I've run a memtest, with no errors.

As far as I can tell, it's either a driver, or a RAM issue (but am open to other ideas).

All drivers are fully updated through windows update. One won't install, for the smart card reader, but that's been like that for a year and I the reader works if I try to use it. No question marks in device manager.

I have unfortunately no system restore point to restore to...

I hope someone can help!

Thanks
Kitiara

BC AdBot (Login to Remove)

 


#2 woodyblade

woodyblade

  • Members
  • 670 posts
  • OFFLINE
  •  
  • Gender:Not Telling
  • Local time:05:10 PM

Posted 20 April 2009 - 12:10 PM

These are the errors you mentioned with the STOP code, the main possibility with all these different errors is a driver fault since you have tested the RAM the only other thing it could be a buggy software.

Bad Pool Caller - 0xC2
IRQL Not Less Or Equal - 0xA
Memory Management - 0x1A
PFN List Corrupt - 0x4E
Page Fault In Non Paged Area - 0x50
Kernel Mode Exception - 0x8E

Just a question

Have you installed any software recently? Say around the time these blue screens started.

Could you post an analysis of the Minidumps, to see if it cites any particular driver as the cause although I have a feeling it may just point to a Windows Kernel driver in most of them which isn't really much help if it does.

EDIT: Oh by the way I used this as a reference for those STOP codes - http://aumha.org/a/stop.htm

Edited by woodyblade, 20 April 2009 - 12:11 PM.


#3 Kitiara

Kitiara
  • Topic Starter

  • Members
  • 32 posts
  • OFFLINE
  •  
  • Local time:05:10 PM

Posted 20 April 2009 - 01:35 PM

Hi

Here is the last two minidumps analysed:


Microsoft ® Windows Debugger Version 6.11.0001.404 X86
Copyright © Microsoft Corporation. All rights reserved.


Loading Dump File [C:\WINDOWS\Minidump\Mini042009-02.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows XP Kernel Version 2600 (Service Pack 3) MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 2600.xpsp_sp3_gdr.090206-1234
Machine Name:
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055d720
Debug session time: Mon Apr 20 08:06:02.564 2009 (GMT+1)
System Uptime: 0 days 0:03:24.270
Loading Kernel Symbols
...............................................................
................................................................
................................................................
.
Loading User Symbols
Loading unloaded module list
.........................
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1000008E, {c0000005, 8063bdee, 99812de0, 0}

Probably caused by : ntkrpamp.exe ( nt!CmpAllocateKeyControlBlock+70 )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

KERNEL_MODE_EXCEPTION_NOT_HANDLED_M (1000008e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003. This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG. This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG. This will let us see why this breakpoint is
happening.
Arguments:
Arg1: c0000005, The exception code that was not handled
Arg2: 8063bdee, The address that the exception occurred at
Arg3: 99812de0, Trap Frame
Arg4: 00000000

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx". The memory could not be "%s".

FAULTING_IP:
nt!CmpAllocateKeyControlBlock+70
8063bdee 897004 mov dword ptr [eax+4],esi

TRAP_FRAME: 99812de0 -- (.trap 0xffffffff99812de0)
ErrCode = 00000002
eax=00087358 ebx=00000000 ecx=e1091ee8 edx=0000006c esi=8055a140 edi=8055a120
eip=8063bdee esp=99812e54 ebp=99812e78 iopl=0 nv up ei pl nz na po nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010202
nt!CmpAllocateKeyControlBlock+0x70:
8063bdee 897004 mov dword ptr [eax+4],esi ds:0023:0008735c=????????
Resetting default scope

CUSTOMER_CRASH_COUNT: 2

DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: 0x8E

PROCESS_NAME: iexplore.exe

LAST_CONTROL_TRANSFER: from 8063430d to 8063bdee

STACK_TEXT:
99812e58 8063430d d3355084 99813094 00000000 nt!CmpAllocateKeyControlBlock+0x70
99812e78 8062eaa6 e336f758 00054080 d3355084 nt!CmpCreateKeyControlBlock+0x83
99812ec8 8062f492 e336f758 00054080 d3355084 nt!CmpDoOpen+0xf4
998130c0 805bf02d 00054080 00054080 89757480 nt!CmpParseKey+0x558
99813138 805bb9dc 00000630 99813178 00000040 nt!ObpLookupObjectName+0x119
9981318c 80624d31 00000000 8aa63040 ba6c7b01 nt!ObOpenObjectByName+0xea
99813260 8054162c 0210df0c 00020019 0210de70 nt!NtOpenKey+0x1af
99813260 7c90e514 0210df0c 00020019 0210de70 nt!KiFastCallEntry+0xfc
WARNING: Frame IP not in any known module. Following frames may be wrong.
0210deb0 00000000 00000000 00000000 00000000 0x7c90e514


STACK_COMMAND: kb

FOLLOWUP_IP:
nt!CmpAllocateKeyControlBlock+70
8063bdee 897004 mov dword ptr [eax+4],esi

SYMBOL_STACK_INDEX: 0

SYMBOL_NAME: nt!CmpAllocateKeyControlBlock+70

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nt

IMAGE_NAME: ntkrpamp.exe

DEBUG_FLR_IMAGE_TIMESTAMP: 498c11d3

FAILURE_BUCKET_ID: 0x8E_nt!CmpAllocateKeyControlBlock+70

BUCKET_ID: 0x8E_nt!CmpAllocateKeyControlBlock+70

Followup: MachineOwner
---------


Microsoft ® Windows Debugger Version 6.11.0001.404 X86
Copyright © Microsoft Corporation. All rights reserved.


Loading Dump File [C:\WINDOWS\Minidump\Mini042009-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows XP Kernel Version 2600 (Service Pack 3) MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 2600.xpsp_sp3_gdr.090206-1234
Machine Name:
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055d720
Debug session time: Mon Apr 20 08:02:03.724 2009 (GMT+1)
System Uptime: 0 days 8:30:51.003
Loading Kernel Symbols
...............................................................
................................................................
................................................................
.
Loading User Symbols
Loading unloaded module list
.............................
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1A, {41284, 7f6f0001, 41c, c0883000}

Probably caused by : memory_corruption ( nt!MiLocateWsle+c1 )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

MEMORY_MANAGEMENT (1a)
# Any other values for parameter 1 must be individually examined.
Arguments:
Arg1: 00041284, A PTE or the working set list is corrupt.
Arg2: 7f6f0001
Arg3: 0000041c
Arg4: c0883000

Debugging Details:
------------------


BUGCHECK_STR: 0x1a_41284

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: DRIVER_FAULT

PROCESS_NAME: dwwin.exe

LAST_CONTROL_TRANSFER: from 80523319 to 804f9f43

STACK_TEXT:
98f70a4c 80523319 0000001a 00041284 7f6f0001 nt!KeBugCheckEx+0x1b
98f70a84 80523b9f 0000041c 7f6f0000 c0601fd8 nt!MiLocateWsle+0xc1
98f70ab8 80523fb8 c03fb780 7f6f0000 00000000 nt!MiDeletePte+0x1fd
98f70b80 8051a1dd e280f048 7f7effff 00000000 nt!MiDeleteVirtualAddresses+0x164
98f70c30 80513563 870e9508 86e60f78 870e9640 nt!MiRemoveMappedView+0x237
98f70c68 805d2712 010e9508 86e67020 86e67268 nt!MmCleanProcessAddressSpace+0x1ff
98f70d08 805d28d4 00000000 86e67020 00000000 nt!PspExitThread+0x680
98f70d28 805d2aaf 86e67020 00000000 98f70d64 nt!PspTerminateThreadByPointer+0x52
98f70d54 8054162c 00000000 00000000 0013ff5c nt!NtTerminateProcess+0x105
98f70d54 7c90e514 00000000 00000000 0013ff5c nt!KiFastCallEntry+0xfc
WARNING: Frame IP not in any known module. Following frames may be wrong.
0013ff5c 00000000 00000000 00000000 00000000 0x7c90e514


STACK_COMMAND: kb

FOLLOWUP_IP:
nt!MiLocateWsle+c1
80523319 2b45f0 sub eax,dword ptr [ebp-10h]

SYMBOL_STACK_INDEX: 1

SYMBOL_NAME: nt!MiLocateWsle+c1

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nt

DEBUG_FLR_IMAGE_TIMESTAMP: 498c11d3

IMAGE_NAME: memory_corruption

FAILURE_BUCKET_ID: 0x1a_41284_nt!MiLocateWsle+c1

BUCKET_ID: 0x1a_41284_nt!MiLocateWsle+c1

Followup: MachineOwner
---------



I've about 25 others, if they are of interest...


There was no installation of software or hardware. I've been trying to think if I'd done anything different, but I don't remember doing anything unusual before it started happening.

#4 woodyblade

woodyblade

  • Members
  • 670 posts
  • OFFLINE
  •  
  • Gender:Not Telling
  • Local time:05:10 PM

Posted 20 April 2009 - 04:06 PM

Not really much conclusive stuff in those, The NT Kernel Driver is cited in the first one and the second one cites memory corruption which is normally seen when there is a Driver error.

Try looking at a few more if possible and attach a couple in Notepad in your next reply, if there doesn't seem to be anything sticking out other than Windows Drivers you may have to try updating the Drivers again, although I think you might find something in 25 minidumps that points to a certain or rough estimate at a cause.

Edited by woodyblade, 20 April 2009 - 04:07 PM.


#5 Kitiara

Kitiara
  • Topic Starter

  • Members
  • 32 posts
  • OFFLINE
  •  
  • Local time:05:10 PM

Posted 20 April 2009 - 04:55 PM

Here's the first half. Had to split it to get it all attached. They're in chronological order.

hmm. can't attach the second half, as I now have no more attachment space....?

Attached Files



#6 woodyblade

woodyblade

  • Members
  • 670 posts
  • OFFLINE
  •  
  • Gender:Not Telling
  • Local time:05:10 PM

Posted 20 April 2009 - 05:23 PM

They are fine Kitiara, They were a lot more helpful they specifically mention 2 things;

1. NETw5x32.sys - This is an Intel Wireless Driver from what I can tell searching on Google, This seemed to occur while running Windows Media Player nothing in that really but just thought I'd mention it.
2. ati3duag.dll - This is related to the ATI Catalyst Control Centre and I think from what I have read is used with the Anti-Aliasing feature.

I would suggest you try rolling the Drivers back for your Graphics card and your Network Card, Just an assumption but did the BSOD's become more frequent when you updated the Drivers?

And see if that stabilises the system, if it doesn't stabilise the system try uninstalling Catalyst and the Graphics Drivers and reinstalling them fresh something like Driver Cleaner Pro is good for removing the Drivers, although hopefully it might stabilise because they look to be the only things mentioned other than Windows System Files and Kernel Files, Catalyst has never caused me any problems although I've only been using this Laptop I'm on for about 4 months, I have the latest drivers and have no problems at all, but then again they say "If it ain't broke don't fix it".

#7 Kitiara

Kitiara
  • Topic Starter

  • Members
  • 32 posts
  • OFFLINE
  •  
  • Local time:05:10 PM

Posted 21 April 2009 - 04:12 AM

I rolled back the driver for the wireless and uninstalled the ati mobility radeon graphics card (it had no earlier driver - laptop only 1,5 year old). Rebooted - and bluescreened.... Had to go through several. Then got it starting, and the graphics card reinstalled itself automatically.

#8 woodyblade

woodyblade

  • Members
  • 670 posts
  • OFFLINE
  •  
  • Gender:Not Telling
  • Local time:05:10 PM

Posted 21 April 2009 - 12:34 PM

Ok good, Does it seem to have stabilised a bit or have you had more bluescreens since you reinstalled the ATI Driver and Rolled back the Wireless Driver?

#9 Kitiara

Kitiara
  • Topic Starter

  • Members
  • 32 posts
  • OFFLINE
  •  
  • Local time:05:10 PM

Posted 21 April 2009 - 02:40 PM

No difference. Still bluescreening as much as before...

#10 woodyblade

woodyblade

  • Members
  • 670 posts
  • OFFLINE
  •  
  • Gender:Not Telling
  • Local time:05:10 PM

Posted 21 April 2009 - 03:46 PM

Well at least it has probably ruled out the ATI stuff and Network drivers, The amount of Memory Corruption and Pool Corruption errors cited in the previous lot of logs still leaves me thinking a Driver is the cause possibly some Software but since you can't think of any software you have installed recently it looks to be a Driver/s possibly.

Can you post some more logs in a text file again, Thanks

#11 Kitiara

Kitiara
  • Topic Starter

  • Members
  • 32 posts
  • OFFLINE
  •  
  • Local time:05:10 PM

Posted 21 April 2009 - 04:12 PM

I'm not allowed to attach more files... (it says I've used most of the space, for what I do not know...)

I haven't installed anything recently. Might have updated drivers if they have come through windows update, but I don't pay much attention to that, I just install what it tells me to. Don't recall that happening right before this started, but it still might have.

Is there any significance in that it happens only (with one exception) when coming out of standby, or when rebooting?

#12 Kitiara

Kitiara
  • Topic Starter

  • Members
  • 32 posts
  • OFFLINE
  •  
  • Local time:05:10 PM

Posted 21 April 2009 - 04:14 PM

Managed to clear attachments from an old issue. Here are more minidump analysis. Haven't included the last few from today.

Attached Files



#13 woodyblade

woodyblade

  • Members
  • 670 posts
  • OFFLINE
  •  
  • Gender:Not Telling
  • Local time:05:10 PM

Posted 21 April 2009 - 04:29 PM

That lot of logs indicates 2 files, other than the Windows files

FSfilter.sys - Related to Kaspersky Anti-Virus

sptd.sys - It is either part of Daemon Tools or software called Alcohol

If you have Kaspersky can you possibly try uninstalling it for a while and see if it stops the BSOD's, And if you have Daemon Tools or Alcohol remove it for now as well, I seen a few times where that sptd.sys file has caused BSOD's.

We'll see if that helps, as for the BSOD's occuring when coming out of Standby most people suggest using the Windows Repair Disc at this point but for now just remove the software and see if you can put it in Standby and bring it out successfully without the BSOD.

Edited by woodyblade, 21 April 2009 - 04:29 PM.


#14 FaNmaN82

FaNmaN82

  • Members
  • 4 posts
  • OFFLINE
  •  
  • Local time:12:10 PM

Posted 21 April 2009 - 04:31 PM

Have you checked the ram voltage in bios? That could be causing corruption as well

#15 Kitiara

Kitiara
  • Topic Starter

  • Members
  • 32 posts
  • OFFLINE
  •  
  • Local time:05:10 PM

Posted 22 April 2009 - 02:58 AM

I uninstalled Daemon - still bluescreening. Kapersky I had once upon a time, but not anymore. Could the file belong to another program, or could I just delete it?

With four completely different files implicated, is using RAM possibly what they all have in common? As in it's more likely to look at what they all have in common than their individual funcions?

How do I check the ram voltage? I couldn't see it in the bios. I have a HP/Compaq 8510p laptop.




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users