Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

bsod and memory minidump


  • Please log in to reply
8 replies to this topic

#1 I.M. Clueless

I.M. Clueless

  • Members
  • 10 posts
  • OFFLINE
  •  
  • Local time:04:17 PM

Posted 13 June 2009 - 06:46 PM

this is the latest info at the top here. I forgot to mention my system was a custom built with an asus pq5 pro mb, 4 gb of ddr2 sdram, asus radeon 4850 graphics, soundblaster audigy (1st gen card) and a rosewill 450 watt ps.

also randomly avg antivirus will come up showing it needs the license when its the free version

since I posted this the computer hasn't bsod'ed. That just means I don't know when it will. it's random happens during games, surfing, rebooting from a different bsod, or just sitting idle. it actually has happened about 15 times today but I just realized I had error reporting turned off. a few of the bsod's have been recurring but I haven't caught any of those on memory dumps yet.
I have tried running adaware anniversary edition, superantispyware, malwarebytes, avgfree 8.5, and glary utilities. none have had any lasting effect. I thought maybe it could be hardware but I can't get memtest to work as I don't have a floppy and I can't get expressburn or imageburn to burn a cd-r with it. If I remember anything else I'll post it later.


I'll keep this quick still having bsod's.


Loading Dump File [C:\WINDOWS\Minidump\Mini061309-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

WARNING: Whitespace at end of path element
Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols


Executable search path is:
Windows XP Kernel Version 2600 (Service Pack 3) MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 2600.xpsp_sp3_gdr.090206-1234
Machine Name:
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055d720
Debug session time: Sat Jun 13 17:10:58.328 2009 (GMT-5)
System Uptime: 0 days 1:08:50.030
Loading Kernel Symbols
...............................................................
................................................................
.............
Loading User Symbols
Loading unloaded module list
...............
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck F4, {3, 88dae020, 88dae194, 805d297c}

Unable to load image SASKUTIL.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for SASKUTIL.sys
*** ERROR: Module load completed but symbols could not be loaded for SASKUTIL.sys
unable to get nt!KiCurrentEtwBufferOffset
unable to get nt!KiCurrentEtwBufferBase
Probably caused by : csrss.exe

Followup: MachineOwner
---------

1: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

CRITICAL_OBJECT_TERMINATION (f4)
A process or thread crucial to system operation has unexpectedly exited or been
terminated.
Several processes and threads are necessary for the operation of the
system; when they are terminated (for any reason), the system can no
longer function.
Arguments:
Arg1: 00000003, Process
Arg2: 88dae020, Terminating object
Arg3: 88dae194, Process image file name
Arg4: 805d297c, Explanatory message (ascii)

Debugging Details:
------------------

unable to get nt!KiCurrentEtwBufferOffset
unable to get nt!KiCurrentEtwBufferBase

PROCESS_OBJECT: 88dae020

IMAGE_NAME: csrss.exe

DEBUG_FLR_IMAGE_TIMESTAMP: 0

MODULE_NAME: csrss

FAULTING_MODULE: 00000000

PROCESS_NAME: csrss.exe

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx". The memory could not be "%s".

BUGCHECK_STR: 0xF4_C0000005

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: DRIVER_FAULT

STACK_TEXT:
f6bfecd0 805d1ac5 000000f4 00000003 88dae020 nt!KeBugCheckEx+0x1b
f6bfecf4 805d2a27 805d297c 88dae020 88dae194 nt!PspCatchCriticalBreak+0x75
f6bfed24 ae3acfc0 88dae268 c0000005 00000000 nt!NtTerminateProcess+0x7d
WARNING: Stack unwind information not available. Following frames may be wrong.
f6bfed54 8054162c ffffffff c0000005 00d3db78 SASKUTIL+0x8fc0
f6bfed54 7c90e514 ffffffff c0000005 00d3db78 nt!KiFastCallEntry+0xfc
00d3db78 00000000 00000000 00000000 00000000 0x7c90e514


STACK_COMMAND: kb

FOLLOWUP_NAME: MachineOwner

FAILURE_BUCKET_ID: 0xF4_C0000005_IMAGE_csrss.exe

BUCKET_ID: 0xF4_C0000005_IMAGE_csrss.exe

Followup: MachineOwner
---------

1: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

CRITICAL_OBJECT_TERMINATION (f4)
A process or thread crucial to system operation has unexpectedly exited or been
terminated.
Several processes and threads are necessary for the operation of the
system; when they are terminated (for any reason), the system can no
longer function.
Arguments:
Arg1: 00000003, Process
Arg2: 88dae020, Terminating object
Arg3: 88dae194, Process image file name
Arg4: 805d297c, Explanatory message (ascii)

Debugging Details:
------------------

unable to get nt!KiCurrentEtwBufferOffset
unable to get nt!KiCurrentEtwBufferBase

PROCESS_OBJECT: 88dae020

IMAGE_NAME: csrss.exe

DEBUG_FLR_IMAGE_TIMESTAMP: 0

MODULE_NAME: csrss

FAULTING_MODULE: 00000000

PROCESS_NAME: csrss.exe

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx". The memory could not be "%s".

BUGCHECK_STR: 0xF4_C0000005

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: DRIVER_FAULT

STACK_TEXT:
f6bfecd0 805d1ac5 000000f4 00000003 88dae020 nt!KeBugCheckEx+0x1b
f6bfecf4 805d2a27 805d297c 88dae020 88dae194 nt!PspCatchCriticalBreak+0x75
f6bfed24 ae3acfc0 88dae268 c0000005 00000000 nt!NtTerminateProcess+0x7d
WARNING: Stack unwind information not available. Following frames may be wrong.
f6bfed54 8054162c ffffffff c0000005 00d3db78 SASKUTIL+0x8fc0
f6bfed54 7c90e514 ffffffff c0000005 00d3db78 nt!KiFastCallEntry+0xfc
00d3db78 00000000 00000000 00000000 00000000 0x7c90e514


STACK_COMMAND: kb

FOLLOWUP_NAME: MachineOwner

FAILURE_BUCKET_ID: 0xF4_C0000005_IMAGE_csrss.exe

BUCKET_ID: 0xF4_C0000005_IMAGE_csrss.exe

Followup: MachineOwner
---------

1: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

CRITICAL_OBJECT_TERMINATION (f4)
A process or thread crucial to system operation has unexpectedly exited or been
terminated.
Several processes and threads are necessary for the operation of the
system; when they are terminated (for any reason), the system can no
longer function.
Arguments:
Arg1: 00000003, Process
Arg2: 88dae020, Terminating object
Arg3: 88dae194, Process image file name
Arg4: 805d297c, Explanatory message (ascii)

Debugging Details:
------------------

unable to get nt!KiCurrentEtwBufferOffset
unable to get nt!KiCurrentEtwBufferBase

PROCESS_OBJECT: 88dae020

IMAGE_NAME: csrss.exe

DEBUG_FLR_IMAGE_TIMESTAMP: 0

MODULE_NAME: csrss

FAULTING_MODULE: 00000000

PROCESS_NAME: csrss.exe

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx". The memory could not be "%s".

BUGCHECK_STR: 0xF4_C0000005

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: DRIVER_FAULT

STACK_TEXT:
f6bfecd0 805d1ac5 000000f4 00000003 88dae020 nt!KeBugCheckEx+0x1b
f6bfecf4 805d2a27 805d297c 88dae020 88dae194 nt!PspCatchCriticalBreak+0x75
f6bfed24 ae3acfc0 88dae268 c0000005 00000000 nt!NtTerminateProcess+0x7d
WARNING: Stack unwind information not available. Following frames may be wrong.
f6bfed54 8054162c ffffffff c0000005 00d3db78 SASKUTIL+0x8fc0
f6bfed54 7c90e514 ffffffff c0000005 00d3db78 nt!KiFastCallEntry+0xfc
00d3db78 00000000 00000000 00000000 00000000 0x7c90e514


STACK_COMMAND: kb

FOLLOWUP_NAME: MachineOwner

FAILURE_BUCKET_ID: 0xF4_C0000005_IMAGE_csrss.exe

BUCKET_ID: 0xF4_C0000005_IMAGE_csrss.exe

Followup: MachineOwner
---------

1: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

CRITICAL_OBJECT_TERMINATION (f4)
A process or thread crucial to system operation has unexpectedly exited or been
terminated.
Several processes and threads are necessary for the operation of the
system; when they are terminated (for any reason), the system can no
longer function.
Arguments:
Arg1: 00000003, Process
Arg2: 88dae020, Terminating object
Arg3: 88dae194, Process image file name
Arg4: 805d297c, Explanatory message (ascii)

Debugging Details:
------------------

unable to get nt!KiCurrentEtwBufferOffset
unable to get nt!KiCurrentEtwBufferBase

PROCESS_OBJECT: 88dae020

IMAGE_NAME: csrss.exe

DEBUG_FLR_IMAGE_TIMESTAMP: 0

MODULE_NAME: csrss

FAULTING_MODULE: 00000000

PROCESS_NAME: csrss.exe

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx". The memory could not be "%s".

BUGCHECK_STR: 0xF4_C0000005

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: DRIVER_FAULT

STACK_TEXT:
f6bfecd0 805d1ac5 000000f4 00000003 88dae020 nt!KeBugCheckEx+0x1b
f6bfecf4 805d2a27 805d297c 88dae020 88dae194 nt!PspCatchCriticalBreak+0x75
f6bfed24 ae3acfc0 88dae268 c0000005 00000000 nt!NtTerminateProcess+0x7d
WARNING: Stack unwind information not available. Following frames may be wrong.
f6bfed54 8054162c ffffffff c0000005 00d3db78 SASKUTIL+0x8fc0
f6bfed54 7c90e514 ffffffff c0000005 00d3db78 nt!KiFastCallEntry+0xfc
00d3db78 00000000 00000000 00000000 00000000 0x7c90e514


STACK_COMMAND: kb

FOLLOWUP_NAME: MachineOwner

FAILURE_BUCKET_ID: 0xF4_C0000005_IMAGE_csrss.exe

BUCKET_ID: 0xF4_C0000005_IMAGE_csrss.exe

Followup: MachineOwner
---------

Edited by I.M. Clueless, 14 June 2009 - 01:12 PM.


BC AdBot (Login to Remove)

 


#2 I.M. Clueless

I.M. Clueless
  • Topic Starter

  • Members
  • 10 posts
  • OFFLINE
  •  
  • Local time:04:17 PM

Posted 13 June 2009 - 06:52 PM

ok that worked. Ive got a few more to post here hopefully before it shuts down again. Thanks for any help you can give.


Microsoft ® Windows Debugger Version 6.11.0001.404 X86
Copyright © Microsoft Corporation. All rights reserved.


Loading Dump File [C:\WINDOWS\Minidump\Mini061309-02.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

WARNING: Whitespace at end of path element
Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols


Executable search path is:
Windows XP Kernel Version 2600 (Service Pack 3) MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 2600.xpsp_sp3_gdr.090206-1234
Machine Name:
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055d720
Debug session time: Sat Jun 13 18:02:06.046 2009 (GMT-5)
System Uptime: 0 days 0:13:49.736
Loading Kernel Symbols
...............................................................
................................................................
............
Loading User Symbols
Loading unloaded module list
.............
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1000008E, {c0000005, bf806105, ae7fd884, 0}

Probably caused by : hardware ( win32k!GreDeleteObject+52 )

Followup: MachineOwner
---------

1: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

KERNEL_MODE_EXCEPTION_NOT_HANDLED_M (1000008e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003. This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG. This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG. This will let us see why this breakpoint is
happening.
Arguments:
Arg1: c0000005, The exception code that was not handled
Arg2: bf806105, The address that the exception occurred at
Arg3: ae7fd884, Trap Frame
Arg4: 00000000

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx". The memory could not be "%s".

FAULTING_IP:
win32k!GreDeleteObject+52
bf806105 0010 add byte ptr [eax],dl

TRAP_FRAME: ae7fd884 -- (.trap 0xffffffffae7fd884)
ErrCode = 00000002
eax=00000091 ebx=bf80f170 ecx=ae7fd930 edx=00b7e98c esi=00000000 edi=00000001
eip=bf806105 esp=ae7fd8f8 ebp=ae7fd920 iopl=0 nv up ei ng nz ac pe cy
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010297
win32k!GreDeleteObject+0x52:
bf806105 0010 add byte ptr [eax],dl ds:0023:00000091=??
Resetting default scope

CUSTOMER_CRASH_COUNT: 2

DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: 0x8E

PROCESS_NAME: iexplore.exe

MISALIGNED_IP:
win32k!GreDeleteObject+52
bf806105 0010 add byte ptr [eax],dl

LAST_CONTROL_TRANSFER: from 8054162c to bf806105

STACK_TEXT:
ae7fd920 8054162c 08010832 2d040763 00000001 win32k!GreDeleteObject+0x52
ae7fd920 7c90e514 08010832 2d040763 00000001 nt!KiFastCallEntry+0xfc
WARNING: Frame IP not in any known module. Following frames may be wrong.
00b7e980 77f17a79 77f17a88 08010832 2d040763 0x7c90e514
00b7e9ac 031c833d 08010832 2d040763 00000001 0x77f17a79
00b7e9dc 031c89e4 03c96ad0 2d040763 4f040384 0x31c833d
00b7eb18 031c879b 03c85ea8 00000000 03cac518 0x31c89e4
00b7eb2c 031c8713 00b7ebec 00000000 7c8097e0 0x31c879b
00b7ec28 031c85c9 03cac518 01010057 00b7ec88 0x31c8713
00b7ecc4 031c5e3e 0000000f 00000000 00000000 0x31c85c9
00b7ece8 7e418734 00000000 0000000f 00000000 0x31c5e3e
00b7ed14 7e418816 031c5df3 00010256 0000000f 0x7e418734
00b7ed7c 7e428ea0 00000000 031c5df3 00010256 0x7e418816
00b7edd0 7e428eec 006a5418 0000000f 00000000 0x7e428ea0
00b7edf8 7c90e473 00b7ee08 00000018 006a5418 0x7e428eec
00b7ee64 7e418a10 00b7ee8c 00000000 00b7eedc 0x7c90e473
00b7ee74 3e2ecc00 00b7ee8c 7c8097d0 00000000 0x7e418a10
00b7eedc 3e204d05 00000000 03c82ea8 00000000 0x3e2ecc00
00b7ef24 3e1e9e67 00000000 7c8097d0 00182bf0 0x3e204d05
00b7ef44 3e1e9dc4 00182bf0 00000005 7752c799 0x3e1e9e67
00b7ef48 00182bf0 00000005 7752c799 00182bf0 0x3e1e9dc4
00b7ef4c 00000000 7752c799 00182bf0 00000000 0x182bf0


STACK_COMMAND: kb

FOLLOWUP_IP:
win32k!GreDeleteObject+52
bf806105 0010 add byte ptr [eax],dl

SYMBOL_STACK_INDEX: 0

SYMBOL_NAME: win32k!GreDeleteObject+52

FOLLOWUP_NAME: MachineOwner

IMAGE_NAME: hardware

DEBUG_FLR_IMAGE_TIMESTAMP: 0

MODULE_NAME: hardware

FAILURE_BUCKET_ID: IP_MISALIGNED

BUCKET_ID: IP_MISALIGNED

Followup: MachineOwner
---------

#3 I.M. Clueless

I.M. Clueless
  • Topic Starter

  • Members
  • 10 posts
  • OFFLINE
  •  
  • Local time:04:17 PM

Posted 13 June 2009 - 06:55 PM

and the 3rd one...


Microsoft Windows Debugger Version 6.11.0001.404 X86
Copyright Microsoft Corporation. All rights reserved.


Loading Dump File [C:\WINDOWS\Minidump\Mini061309-03.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

WARNING: Whitespace at end of path element
Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols


Executable search path is:
Windows XP Kernel Version 2600 (Service Pack 3) MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 2600.xpsp_sp3_gdr.090206-1234
Machine Name:
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055d720
Debug session time: Sat Jun 13 18:26:32.921 2009 (GMT-5)
System Uptime: 0 days 0:02:07.609
Loading Kernel Symbols
...............................................................
................................................................
................
Loading User Symbols
Loading unloaded module list
......
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1000008E, {c0000005, 4b6d5d39, ab711bec, 0}

Probably caused by : win32k.sys ( win32k!LFONTOBJ::ppfeMapFont+11a )

Followup: MachineOwner
---------

1: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

KERNEL_MODE_EXCEPTION_NOT_HANDLED_M (1000008e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003. This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG. This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG. This will let us see why this breakpoint is
happening.
Arguments:
Arg1: c0000005, The exception code that was not handled
Arg2: 4b6d5d39, The address that the exception occurred at
Arg3: ab711bec, Trap Frame
Arg4: 00000000

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx". The memory could not be "%s".

FAULTING_IP:
+11a
4b6d5d39 ?? ???

TRAP_FRAME: ab711bec -- (.trap 0xffffffffab711bec)
ErrCode = 00000010
eax=e1b33da0 ebx=ab711ce0 ecx=e1b33d02 edx=e1b33d98 esi=00000000 edi=e14da6c8
eip=4b6d5d39 esp=ab711c60 ebp=e1b33da0 iopl=0 nv up ei ng nz na po nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010282
4b6d5d39 ?? ???
Resetting default scope

CUSTOMER_CRASH_COUNT: 3

DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: 0x8E

PROCESS_NAME: explorer.exe

LAST_CONTROL_TRANSFER: from bf8107b0 to 4b6d5d39

STACK_TEXT:
WARNING: Frame IP not in any known module. Following frames may be wrong.
ab711c5c bf8107b0 00000000 00000000 bf837b77 0x4b6d5d39
e1b33da0 00000000 00000000 00000000 40000000 win32k!LFONTOBJ::ppfeMapFont+0x11a


STACK_COMMAND: kb

FOLLOWUP_IP:
win32k!LFONTOBJ::ppfeMapFont+11a
bf8107b0 45 inc ebp

SYMBOL_STACK_INDEX: 1

SYMBOL_NAME: win32k!LFONTOBJ::ppfeMapFont+11a

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: win32k

IMAGE_NAME: win32k.sys

DEBUG_FLR_IMAGE_TIMESTAMP: 49e87572

FAILURE_BUCKET_ID: 0x8E_win32k!LFONTOBJ::ppfeMapFont+11a

BUCKET_ID: 0x8E_win32k!LFONTOBJ::ppfeMapFont+11a

Followup: MachineOwner
---------


as I get the other ones I'll post them too....thanks if you can help here

Edited by I.M. Clueless, 13 June 2009 - 06:57 PM.


#4 I.M. Clueless

I.M. Clueless
  • Topic Starter

  • Members
  • 10 posts
  • OFFLINE
  •  
  • Local time:04:17 PM

Posted 14 June 2009 - 10:31 AM

ok I got the latest bsod's including the one I have been looking for. I hope I can get this done before it shuts down again....

hope I can get the rest of these in before it shuts down again.


Microsoft Windows Debugger Version 6.11.0001.404 X86
Copyright Microsoft Corporation. All rights reserved.


Loading Dump File [C:\WINDOWS\Minidump\Mini061409-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

WARNING: Whitespace at end of path element
Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols


Executable search path is:
Windows XP Kernel Version 2600 (Service Pack 3) MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 2600.xpsp_sp3_gdr.090206-1234
Machine Name:
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055d720
Debug session time: Sun Jun 14 10:05:17.625 2009 (GMT-5)
System Uptime: 0 days 0:02:59.312
Loading Kernel Symbols
...............................................................
................................................................
...........
Loading User Symbols
Loading unloaded module list
...........
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 100000D1, {c8, 2, 0, f6c665a9}

*** WARNING: Unable to verify timestamp for ctaud2k.sys
*** ERROR: Module load completed but symbols could not be loaded for ctaud2k.sys
Probably caused by : memory_corruption

Followup: memory_corruption
---------

0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: 000000c8, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000000, value 0 = read operation, 1 = write operation
Arg4: f6c665a9, address which referenced memory

Debugging Details:
------------------


READ_ADDRESS: 000000c8

CURRENT_IRQL: 2

FAULTING_IP:
portcls!CIrpStream::ReleaseMappingIrp+77
f6c665a9 80bfc800000000 cmp byte ptr [edi+0C8h],0

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: CODE_CORRUPTION

BUGCHECK_STR: 0xD1

PROCESS_NAME: System

LAST_CONTROL_TRANSFER: from f6c66b5d to f6c665a9

STACK_TEXT:
aa76ab0c f6c66b5d 88bb8308 88e1d558 00000001 portcls!CIrpStream::ReleaseMappingIrp+0x77
aa76ab50 806e96e8 8b19c668 00000000 00000000 portcls!CIrpStream::ReleaseLockedRegion+0x221
aa76ab7c 804eeef2 88c23a98 8b19c69c 00000001 hal!HalAllocateAdapterChannel+0x126
aa76ab94 f6c66dae 88c23a98 8b19c668 00000001 nt!IoAllocateAdapterChannel+0x2a
aa76abd0 f6c668fd 02bf23b4 88e1c4a8 aa76ac24 portcls!CIrpStream::GetMapping+0x166
aa76abf8 f6c900ad 8a478b1c 88e1c4a8 aa76ac24 portcls!CPortPinWavePci::GetMapping+0x2d
WARNING: Stack unwind information not available. Following frames may be wrong.
aa76ac40 f6c902c7 88e1d558 8a478b20 88e1d588 ctaud2k+0x70ad
aa76ac64 f6c75a99 8a478b20 88bb8308 00000001 ctaud2k+0x72c7
aa76ac9c f6c771ea 00000000 88bb8308 00000001 portcls!CIrpStream::TransferKsIrp+0x32d
aa76acd0 f6c7574d 00000000 8b19c668 88bb8308 portcls!CPortPinWavePci::DeviceIoControl+0xee
aa76acec f6c4af1f 8b19c668 88bb8308 aa76ad14 portcls!DispatchDeviceIoControl+0x49
aa76acfc f6c758c0 8b19c668 88bb8308 88da8828 ks!KsDispatchIrp+0x126
aa76ad14 f6c75881 8b19c668 88bb8308 aa76ad54 portcls!KsoDispatchIrp+0x43
aa76ad24 f6cde51f 8b19c668 88bb8308 8a47e3f8 portcls!PcDispatchIrp+0x5f
aa76ad54 aa597f07 88da8828 88d6e428 00000000 ctaud2k+0x5551f
aa76ad84 aa5982a7 00d6e370 00000000 00000000 kmixer!MxWorker+0x227
aa76adac 805cff70 88d6e370 00000000 00000000 kmixer!MxPrivateWorkerThread+0xb7
aa76addc 805460ee aa5981f0 88d6e370 00000000 nt!PspSystemThreadStartup+0x34
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16


STACK_COMMAND: kb

CHKIMG_EXTENSION: !chkimg -lo 50 -d !portcls
f6c665aa - portcls!CIrpStream::ReleaseMappingIrp+78
[ be:bf ]
1 error : !portcls (f6c665aa)

MODULE_NAME: memory_corruption

IMAGE_NAME: memory_corruption

FOLLOWUP_NAME: memory_corruption

DEBUG_FLR_IMAGE_TIMESTAMP: 0

MEMORY_CORRUPTOR: ONE_BIT

FAILURE_BUCKET_ID: MEMORY_CORRUPTION_ONE_BIT

BUCKET_ID: MEMORY_CORRUPTION_ONE_BIT

Followup: memory_corruption
---------

ok now the next one:


Microsoft Windows Debugger Version 6.11.0001.404 X86
Copyright Microsoft Corporation. All rights reserved.


Loading Dump File [C:\WINDOWS\Minidump\Mini061409-02.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

WARNING: Whitespace at end of path element
Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols


Executable search path is:
Windows XP Kernel Version 2600 (Service Pack 3) MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 2600.xpsp_sp3_gdr.090206-1234
Machine Name:
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055d720
Debug session time: Sun Jun 14 10:14:39.187 2009 (GMT-5)
System Uptime: 0 days 0:08:47.750
Loading Kernel Symbols
...............................................................
................................................................
...........
Loading User Symbols
Loading unloaded module list
............
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1000000A, {3a904260, 1c, 0, 805023aa}

Probably caused by : memory_corruption

Followup: memory_corruption
---------

0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 3a904260, memory referenced
Arg2: 0000001c, IRQL
Arg3: 00000000, bitfield :
bit 0 : value 0 = read operation, 1 = write operation
bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: 805023aa, address which referenced memory

Debugging Details:
------------------


READ_ADDRESS: 3a904260

CURRENT_IRQL: 1c

FAULTING_IP:
nt!KiInsertTimerTable+72
805023aa f722 mul eax,dword ptr [edx]

CUSTOMER_CRASH_COUNT: 2

DEFAULT_BUCKET_ID: CODE_CORRUPTION

BUGCHECK_STR: 0xA

PROCESS_NAME: Idle

LAST_CONTROL_TRANSFER: from 8050245b to 805023aa

STACK_TEXT:
8055125c 8050245b ffb15267 ffffffff 3a904260 nt!KiInsertTimerTable+0x72
80551278 804fa0c5 ffb15267 ffffffff 8a3b1028 nt!KiInsertTreeTimer+0x7d
80551298 804fa16c 003b1730 ffb15267 ffffffff nt!KeSetTimerEx+0x4d
805512b4 f6d088e9 8a3b1730 ffb15267 ffffffff nt!KeSetTimer+0x18
805512e0 8050220f 8a3b170c 8a3b1028 d5f1b5b8 USBPORT!USBPORT_DM_TimerDpc+0x20d
805513fc 8050232b 8055c0c0 ffdff9c0 ffdff000 nt!KiTimerListExpire+0x14b
80551428 80545e7f 8055c4c0 00000000 000083ef nt!KiTimerExpiration+0xb1
80551440 8055be60 ffdffc50 00000000 8055be60 nt!KiRetireDpcList+0x61
80551450 80545d64 00000000 0000000e 00000000 nt!KiIdleThread0
80551454 00000000 0000000e 00000000 00000000 nt!KiIdleLoop+0x28


STACK_COMMAND: kb

CHKIMG_EXTENSION: !chkimg -lo 50 -d !nt
805023aa - nt!KiInsertTimerTable+72
[ 77:f7 ]
1 error : !nt (805023aa)

MODULE_NAME: memory_corruption

IMAGE_NAME: memory_corruption

FOLLOWUP_NAME: memory_corruption

DEBUG_FLR_IMAGE_TIMESTAMP: 0

MEMORY_CORRUPTOR: ONE_BIT

FAILURE_BUCKET_ID: MEMORY_CORRUPTION_ONE_BIT

BUCKET_ID: MEMORY_CORRUPTION_ONE_BIT

Followup: memory_corruption
---------

Edited by I.M. Clueless, 14 June 2009 - 10:41 AM.


#5 hamluis

hamluis

    Moderator


  • Moderator
  • 56,127 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:Killeen, TX
  • Local time:04:17 PM

Posted 14 June 2009 - 10:50 AM

You need to run Memtest86+ - Advanced Memory Diagnostic Tool - http://www.memtest.org/#downiso

I don't understand your comment re the inability to burn the .iso to CD. Try Active@ ISO Burner - http://www.ntfs.com/iso_burner_free.htm

Louis

#6 I.M. Clueless

I.M. Clueless
  • Topic Starter

  • Members
  • 10 posts
  • OFFLINE
  •  
  • Local time:04:17 PM

Posted 14 June 2009 - 01:20 PM

Thanks louis, I realized that when I just used Active isoburner that the cd-r I was trying to use was not blank. but Ive got it done now. will run memtest and reply

reply: here's something weird, I ran memtest86 2.11 and the first time it came up with 13 memory errors. however while it was running I noticed that the fsb was 400 and my ddr2 800 memory was running at 333. So I figured out that was from a previous attempt at overclocking which was way back and not part of my current problem, except for those two things. After I switched the fsb to 333 and the memory to 400, I ran memtest again and got no errors. so we will see if that fixes it. if not I'll be back. and thanks again for your help louis.

Edited by I.M. Clueless, 14 June 2009 - 02:58 PM.


#7 hamluis

hamluis

    Moderator


  • Moderator
  • 56,127 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:Killeen, TX
  • Local time:04:17 PM

Posted 14 June 2009 - 03:57 PM

Let us know how it turns out.

Louis

#8 I.M. Clueless

I.M. Clueless
  • Topic Starter

  • Members
  • 10 posts
  • OFFLINE
  •  
  • Local time:04:17 PM

Posted 14 June 2009 - 08:54 PM

Great news! problem solved! strange how it was the two busses being wrong rather than something broken. I'm relieved and happy. It's interesting how help comes from completely different areas than you are looking at. but if you hadn't told me about that active burn program this whole waterfall of info wouldn't have come together to fix my computer :thumbsup: thanks again Louis.

Edited by I.M. Clueless, 14 June 2009 - 08:55 PM.


#9 hamluis

hamluis

    Moderator


  • Moderator
  • 56,127 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:Killeen, TX
  • Local time:04:17 PM

Posted 14 June 2009 - 09:16 PM

Luck will take each of us farther...than any individual skills we might have :thumbsup:, happy computing.

Louis




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users