Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

BOSD Error Codes Help plz


  • Please log in to reply
15 replies to this topic

#1 jon51

jon51

  • Members
  • 57 posts
  • OFFLINE
  •  
  • Local time:10:36 PM

Posted 25 June 2009 - 12:11 AM

I finally got this computer I built up and running. After multiple install attempts with different windows cds (oem, corporate) and various keys. My initial blue screen problem was (as far as I could find) was that some motherboard don't recognize XP disc before SP2. I finally got a Windows Xp Sp1 upgrade disc slipstreamed with SP2 and installed without issue. Upon installing my drivers, getting AVG, Flash, Acrobat and such i began to have BOSD errors flash quickly then restart too fast to read. I found this site and it was a great help to me to find these error codes...now don't know wtf they mean. Computer also seems a bit sluggish considering its a quad core, 4gb ram(i know not all is recognized by xp32). So I am wonder if the sluggish feeling is tied to these errors.

so the first error code is:

Use !analyze -v to get detailed debugging information.

BugCheck 1000008E, {c0000005, bf806745, b5872c44, 0}

Probably caused by : memory_corruption

Followup: memory_corruption
---------

0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

KERNEL_MODE_EXCEPTION_NOT_HANDLED_M (1000008e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003. This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG. This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG. This will let us see why this breakpoint is
happening.
Arguments:
Arg1: c0000005, The exception code that was not handled
Arg2: bf806745, The address that the exception occurred at
Arg3: b5872c44, Trap Frame
Arg4: 00000000

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx". The memory could not be "%s".

FAULTING_IP:
win32k!GreSetBrushOwner+0
bf806745 0000 add byte ptr [eax],al

TRAP_FRAME: b5872c44 -- (.trap 0xffffffffb5872c44)
ErrCode = 00000002
eax=01900010 ebx=bc400530 ecx=00000000 edx=00000001 esi=e17509c8 edi=00000914
eip=bf806745 esp=b5872cb8 ebp=b5872cf0 iopl=0 nv up ei pl zr na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010246
win32k!GreSetBrushOwner:
bf806745 0000 add byte ptr [eax],al ds:0023:01900010=??
Resetting default scope

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: CODE_CORRUPTION

BUGCHECK_STR: 0x8E

PROCESS_NAME: gest.exe

LAST_CONTROL_TRANSFER: from bf8065c0 to bf806745

STACK_TEXT:
b5872cb4 bf8065c0 01900010 80000002 bc668550 win32k!GreSetBrushOwner
b5872cf0 bf804035 80000002 00000914 00000000 win32k!GreSetDCOwnerEx+0x1e9
b5872d30 bf803c96 bc668550 00000000 00010012 win32k!_GetDCEx+0x4d7
b5872d44 bf8044ab bc668550 b5872d64 0012c534 win32k!_GetDC+0x35
b5872d58 8054060c 000501dc 0012c548 7c90eb94 win32k!NtUserGetDC+0x6d
b5872d58 7c90eb94 000501dc 0012c548 7c90eb94 nt!KiFastCallEntry+0xfc
WARNING: Frame IP not in any known module. Following frames may be wrong.
0012c548 00000000 00000000 00000000 00000000 0x7c90eb94


STACK_COMMAND: kb

CHKIMG_EXTENSION: !chkimg -lo 50 -d !win32k
bf806740-bf806773 52 bytes - win32k!GreSetBrushOwner+236
[ 90 90 90 90 90 8b ff 55:00 00 00 00 00 00 00 00 ]
bf806775-bf80677f 11 bytes - win32k!GreSetBrushOwner+30 (+0x35)
[ e8 09 e1 ff ff 8b 45 08:00 00 00 00 00 00 00 00 ]
63 errors : !win32k (bf806740-bf80677f)

MODULE_NAME: memory_corruption

IMAGE_NAME: memory_corruption

FOLLOWUP_NAME: memory_corruption

DEBUG_FLR_IMAGE_TIMESTAMP: 0

MEMORY_CORRUPTOR: LARGE_64

FAILURE_BUCKET_ID: MEMORY_CORRUPTION_LARGE_64

BUCKET_ID: MEMORY_CORRUPTION_LARGE_64

Followup: memory_corruption
---------
Any help is great. If I get a response from someone who knows what this is I'll post the next 3 errors. I disabled auto restart to actually see the codes, so the computer ran stable for the 20-30 min straight while researching debugging codes.

Edited by jon51, 25 June 2009 - 12:19 AM.


BC AdBot (Login to Remove)

 


#2 Budapest

Budapest

    Bleepin' Cynic


  • Moderator
  • 23,577 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:03:36 PM

Posted 25 June 2009 - 01:10 AM

Try running a memory diagnostic to test your RAM:

http://www.memtest86.com/
The power of accurate observation is commonly called cynicism by those who haven't got it.

—George Bernard Shaw

#3 hamluis

hamluis

    Moderator


  • Moderator
  • 55,559 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Killeen, TX
  • Local time:12:36 AM

Posted 25 June 2009 - 08:35 AM

Rather than run Memtest86, as suggested...I suggest that you run Memtest86+. See comments under Known Problems at http://en.wikipedia.org/wiki/Memtest86 .

Memtest86+ - Advanced Memory Diagnostic Tool - http://www.memtest.org/#downiso

Icrontic Diagnose with Memtest86+ - http://icrontic.com/articles/diagnose_with_memtest86

Louis

#4 jon51

jon51
  • Topic Starter

  • Members
  • 57 posts
  • OFFLINE
  •  
  • Local time:10:36 PM

Posted 25 June 2009 - 09:35 AM

Thanks for the advice. I had 4 crashes between 8:18 and 9:09. Two of the readouts list memory corruption. The other 2 reports say something different. Would it be helpful to post those also?
Also I am wondering if it is a power/ground issue. Does it matter if every mounting hole is connect to the case standoffs? The ones that came with the case were horribly bad and the MB is only being held on by 3 screws.

Thanks again

#5 Budapest

Budapest

    Bleepin' Cynic


  • Moderator
  • 23,577 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:03:36 PM

Posted 25 June 2009 - 04:30 PM

Yes, post the other reports.
The power of accurate observation is commonly called cynicism by those who haven't got it.

—George Bernard Shaw

#6 jon51

jon51
  • Topic Starter

  • Members
  • 57 posts
  • OFFLINE
  •  
  • Local time:10:36 PM

Posted 25 June 2009 - 06:36 PM

///////////////////This is the second crash\\\\\\\\\\\\\\\\\\\\\\



Use !analyze -v to get detailed debugging information.

BugCheck 1000000A, {ffffff94, 1c, 0, 80536bcb}

Probably caused by : ntkrpamp.exe ( nt!ExpCopyThreadInfo+d )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: ffffff94, memory referenced
Arg2: 0000001c, IRQL
Arg3: 00000000, bitfield :
bit 0 : value 0 = read operation, 1 = write operation
bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: 80536bcb, address which referenced memory

Debugging Details:
------------------


READ_ADDRESS: ffffff94

CURRENT_IRQL: 1c

FAULTING_IP:
nt!ExpCopyThreadInfo+d
80536bcb 8b8744010000 mov eax,dword ptr [edi+144h]

CUSTOMER_CRASH_COUNT: 2

DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: 0xA

PROCESS_NAME: GSvr.exe

LAST_CONTROL_TRANSFER: from 805370bf to 80536bcb

STACK_TEXT:
b5ce7a6c 805370bf b5cf2f48 fffffe50 00000000 nt!ExpCopyThreadInfo+0xd
b5ce7b04 8060ff76 003c0000 00010000 b5ce7d30 nt!ExpGetProcessInformation+0x169
b5ce7d4c 8054060c 00000005 003c0000 00010000 nt!NtQuerySystemInformation+0x796
b5ce7d4c 7c90eb94 00000005 003c0000 00010000 nt!KiFastCallEntry+0xfc
WARNING: Frame IP not in any known module. Following frames may be wrong.
00aefaac 00000000 00000000 00000000 00000000 0x7c90eb94


STACK_COMMAND: kb

FOLLOWUP_IP:
nt!ExpCopyThreadInfo+d
80536bcb 8b8744010000 mov eax,dword ptr [edi+144h]

SYMBOL_STACK_INDEX: 0

SYMBOL_NAME: nt!ExpCopyThreadInfo+d

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nt

IMAGE_NAME: ntkrpamp.exe

DEBUG_FLR_IMAGE_TIMESTAMP: 41107b0d

FAILURE_BUCKET_ID: 0xA_nt!ExpCopyThreadInfo+d

BUCKET_ID: 0xA_nt!ExpCopyThreadInfo+d

Followup: MachineOwner


///////////////////3rd crash\\\\\\\\\\\\\\\\\\\\\\\\\\


Use !analyze -v to get detailed debugging information.

BugCheck 1000000A, {95, 2, 0, 804e41bd}

Probably caused by : ntkrpamp.exe ( nt!CcFlushCache+8f )

Followup: MachineOwner
---------

2: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 00000095, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000000, bitfield :
bit 0 : value 0 = read operation, 1 = write operation
bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: 804e41bd, address which referenced memory

Debugging Details:
------------------


READ_ADDRESS: 00000095

CURRENT_IRQL: 2

FAULTING_IP:
nt!CcFlushCache+8f
804e41bd f6466d20 test byte ptr [esi+6Dh],20h

CUSTOMER_CRASH_COUNT: 3

DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: 0xA

PROCESS_NAME: svchost.exe

LAST_CONTROL_TRANSFER: from ba661b75 to 804e41bd

STACK_TEXT:
b5cdc768 ba661b75 8a5f6fac 00000000 00000000 nt!CcFlushCache+0x8f
b5cdc794 ba67b924 8a5b1658 e16e70d0 00000000 Ntfs!NtfsFlushUserStream+0x6c
b5cdc818 ba67bdc9 8a5b1658 8a690100 00000001 Ntfs!NtfsFlushVolume+0x22a
b5cdc8b8 ba66f385 8a5b1658 89a20a20 b5cd0000 Ntfs!NtfsCommonVolumeOpen+0x341
b5cdc990 804eeeb1 8a690020 89a20a20 8994d2b0 Ntfs!NtfsFsdCreate+0x154
b5cdc9a0 ba6df876 00000000 8a6aa8c0 8a4fe750 nt!IopfCallDriver+0x31
b5cdc9ec 804eeeb1 8a691848 00000001 89a20a20 sr!SrCreate+0x150
b5cdc9fc ba6efe67 00000000 89a20a20 00000000 nt!IopfCallDriver+0x31
b5cdca20 ba6fc153 b5cdca40 8a55dcd8 00000000 fltMgr!FltpLegacyProcessingAfterPreCallbacksCompleted+0x20b
b5cdca5c 804eeeb1 8a55dcd8 89a20bd4 89a20a20 fltMgr!FltpCreate+0x1e3
b5cdca6c 80581ec2 8a67e8e8 8a5451bc b5cdcc04 nt!IopfCallDriver+0x31
b5cdcb4c 805bdd10 8a67e900 00000000 8a545118 nt!IopParseDevice+0xa58
b5cdcbc4 805ba398 00000000 b5cdcc04 00000040 nt!ObpLookupObjectName+0x53c
b5cdcc18 80574e4d 00000000 00000000 94d32001 nt!ObOpenObjectByName+0xea
b5cdcc94 805757c4 01fbfcac 80100080 01fbfc4c nt!IopCreateFile+0x407
b5cdccf0 80577e8e 01fbfcac 80100080 01fbfc4c nt!IoCreateFile+0x8e
b5cdcd30 8054060c 01fbfcac 80100080 01fbfc4c nt!NtCreateFile+0x30
b5cdcd30 7c90eb94 01fbfcac 80100080 01fbfc4c nt!KiFastCallEntry+0xfc
WARNING: Frame IP not in any known module. Following frames may be wrong.
01fbfca4 00000000 00000000 00000000 00000000 0x7c90eb94


STACK_COMMAND: kb

FOLLOWUP_IP:
nt!CcFlushCache+8f
804e41bd f6466d20 test byte ptr [esi+6Dh],20h

SYMBOL_STACK_INDEX: 0

SYMBOL_NAME: nt!CcFlushCache+8f

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nt

IMAGE_NAME: ntkrpamp.exe

DEBUG_FLR_IMAGE_TIMESTAMP: 41107b0d

FAILURE_BUCKET_ID: 0xA_nt!CcFlushCache+8f

BUCKET_ID: 0xA_nt!CcFlushCache+8f

Followup: MachineOwner


///////////////4th and final crash\\\\\\\\\\\\\\\


Use !analyze -v to get detailed debugging information.

BugCheck 1000000A, {9ae67968, 2, 1, 80522a55}

Probably caused by : memory_corruption ( nt!MiReleaseConfirmedPageFileSpace+37 )

Followup: MachineOwner
---------

3: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 9ae67968, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000001, bitfield :
bit 0 : value 0 = read operation, 1 = write operation
bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: 80522a55, address which referenced memory

Debugging Details:
------------------


WRITE_ADDRESS: 9ae67968

CURRENT_IRQL: 2

FAULTING_IP:
nt!MiReleaseConfirmedPageFileSpace+37
80522a55 213e and dword ptr [esi],edi

CUSTOMER_CRASH_COUNT: 4

DEFAULT_BUCKET_ID: COMMON_SYSTEM_FAULT

BUGCHECK_STR: 0xA

PROCESS_NAME: System

LAST_CONTROL_TRANSFER: from 80521fff to 80522a55

STACK_TEXT:
bacefc00 80521fff 000004c0 89aa4b00 c0612dd0 nt!MiReleaseConfirmedPageFileSpace+0x37
bacefc28 8051a4ba 899ed6d8 8a6dd088 00000000 nt!MiDecrementShareCount+0x175
bacefc68 805699cc c25ba000 00671af8 00000000 nt!MmUnmapViewInSystemCache+0x20e
bacefc80 804e816d 8a6dd088 899ed6d8 00000000 nt!CcUnmapVacb+0x2a
bacefcb0 804e51ac 00000000 00000000 899ed73c nt!CcUnmapVacbArray+0xe5
bacefccc 804e5467 899ed6d8 806e4a4c 899ed6d8 nt!CcUnmapAndPurge+0x20
bacefcfc 804e4a69 00000001 80558690 899466f8 nt!CcDeleteSharedCacheMap+0xc5
bacefd34 804e7041 8a71a090 80563720 8a6f4a78 nt!CcWriteBehind+0x357
bacefd7c 80537757 8a71a090 00000000 8a6f4a78 nt!CcWorkerThread+0x12f
bacefdac 805ce794 8a71a090 00000000 00000000 nt!ExpWorkerThread+0xef
bacefddc 805450ce 80537668 00000000 00000000 nt!PspSystemThreadStartup+0x34
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16


STACK_COMMAND: kb

FOLLOWUP_IP:
nt!MiReleaseConfirmedPageFileSpace+37
80522a55 213e and dword ptr [esi],edi

SYMBOL_STACK_INDEX: 0

SYMBOL_NAME: nt!MiReleaseConfirmedPageFileSpace+37

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nt

DEBUG_FLR_IMAGE_TIMESTAMP: 41107b0d

IMAGE_NAME: memory_corruption

FAILURE_BUCKET_ID: 0xA_nt!MiReleaseConfirmedPageFileSpace+37

BUCKET_ID: 0xA_nt!MiReleaseConfirmedPageFileSpace+37

Followup: MachineOwner



A friend at work today asked me if my memory timing was correct. I haven't had to change timings before, but just wondering what you guys think about memory timing issue.
Thanks again

#7 jon51

jon51
  • Topic Starter

  • Members
  • 57 posts
  • OFFLINE
  •  
  • Local time:10:36 PM

Posted 25 June 2009 - 06:40 PM

I have not had time yet today to run Memtest. Tonight I will work on it again and run it to see what that comes up with.

#8 Budapest

Budapest

    Bleepin' Cynic


  • Moderator
  • 23,577 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:03:36 PM

Posted 25 June 2009 - 06:44 PM

Those crash debugs don't point to anything conclusive. Memory timings could be a problem. Have you run the Memtest86+ scan yet?
The power of accurate observation is commonly called cynicism by those who haven't got it.

—George Bernard Shaw

#9 jon51

jon51
  • Topic Starter

  • Members
  • 57 posts
  • OFFLINE
  •  
  • Local time:10:36 PM

Posted 27 June 2009 - 03:59 PM

Sorry it took so long for me to get my reply. I have been too busy to fuss with the computer for a few days.

So upon getting Memtest86+ up and running it found no errors in memory. However when it trys to boot to windows as soon as it gets past the windows Xp loading screen I get the error:


Stop: C0000221 {Bad Image Checksum}
The image SHDOCVW.DLL is possibly corrupt

Last time I used the computer it was running alright and allowed me to get my BOSD error reports. Not sure why it won't even boot now.
Fresh windows install maybe? My memory defualts according to the info given by Newegg's specs say the memory voltage is 2.1. The motherboard default is set at 1.8V currently. Since I did memtest with no errors is this worth adjusting.

Again any help is most apreciated. Thanks to those that have posted.

Edited by jon51, 27 June 2009 - 04:10 PM.


#10 Budapest

Budapest

    Bleepin' Cynic


  • Moderator
  • 23,577 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:03:36 PM

Posted 27 June 2009 - 05:44 PM

If memtest didn't show any errors I think the memory timing are probably okay. How long did you run memtest for? You should let it run overnight.

Can you boot into Safe Mode?
The power of accurate observation is commonly called cynicism by those who haven't got it.

—George Bernard Shaw

#11 jon51

jon51
  • Topic Starter

  • Members
  • 57 posts
  • OFFLINE
  •  
  • Local time:10:36 PM

Posted 27 June 2009 - 07:39 PM

Oh I just let it run for like 30 min. It said it was finished so I just ended the program, didn't realize that it needed to run for a while.

I did not attempt a safe mode boot because I ran out of time to work on it, but tonight I will let it run overnight and see what happens with memtest.

#12 jon51

jon51
  • Topic Starter

  • Members
  • 57 posts
  • OFFLINE
  •  
  • Local time:10:36 PM

Posted 28 June 2009 - 04:59 PM

Ok I attempted a boot into safe mode with the same error posted above. I'm starting Memtest at 3pm and I will check the status tonight and possibly let it run all night just to be sure.

#13 jon51

jon51
  • Topic Starter

  • Members
  • 57 posts
  • OFFLINE
  •  
  • Local time:10:36 PM

Posted 28 June 2009 - 10:03 PM

Well......I guess its a memory problem. After letting Memtest run for 5 hours straight it finally showed some errors. The first thing I'm going to do is test each module and find out if both are bad or whether a MB slot has an issue. Actually now that I think about it the memtest instructions says to under voltage to the memory could be a problem. So I will attempt the voltage increase first I guess

Thanks again for the help.

#14 Budapest

Budapest

    Bleepin' Cynic


  • Moderator
  • 23,577 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:03:36 PM

Posted 28 June 2009 - 10:05 PM

Keep us posted.
The power of accurate observation is commonly called cynicism by those who haven't got it.

—George Bernard Shaw

#15 jon51

jon51
  • Topic Starter

  • Members
  • 57 posts
  • OFFLINE
  •  
  • Local time:10:36 PM

Posted 01 July 2009 - 11:44 AM

Well after changing the memory voltage after about 6 hours I got another error code. So I will RMA the memory back to Corsair this week. I guess it corrupted windows so I will need to reinstall that also.

Thanks for the help.




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users