Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

BSOD problem after 15 to 20 min of startup


  • Please log in to reply
1 reply to this topic

#1 RAMB

RAMB

  • Members
  • 1 posts
  • OFFLINE
  •  
  • Local time:04:11 PM

Posted 18 October 2009 - 11:32 PM

Hi,

I have Gateway NX560XL and winxp professional is running on this. This laptop has Mcfee security center. Recently it started having BSODs after15-20 min (varies, some times after 3-4 hours) of machine startup. After every BSOD startup, machine runs chkdsk. I also did memory test and didn't see any problem with that. I am posting here last two mini dumps analysis from WinDbg tools. Do you think it is harddisk failure problem? I appreciate yourhelp.

1st Dump:

Microsoft ® Windows Debugger Version 6.11.0001.404 X86
Copyright © Microsoft Corporation. All rights reserved.


Loading Dump File [E:\Gateway Dump\Mini101009-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows XP Kernel Version 2600 (Service Pack 2) MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 2600.xpsp_sp2_qfe.080814-1242
Machine Name:
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055c720
Debug session time: Wed Oct 7 23:09:06.328 2009 (GMT-7)
System Uptime: 0 days 0:10:08.044
Loading Kernel Symbols
...............................................................
................................................................
................................................................
...
Loading User Symbols
Loading unloaded module list
............
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 77, {1, 0, 0, b1136d24}

Probably caused by : memory_corruption ( nt!MmInPageKernelStack+176 )

Followup: MachineOwner
---------

1: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

KERNEL_STACK_INPAGE_ERROR (77)
The requested page of kernel data could not be read in. Caused by
bad block in paging file or disk controller error.
In the case when the first arguments is 0 or 1, the stack signature
in the kernel stack was not found. Again, bad hardware.
An I/O status of c000009c (STATUS_DEVICE_DATA_ERROR) or
C000016AL (STATUS_DISK_OPERATION_FAILED) normally indicates
the data could not be read from the disk due to a bad
block. Upon reboot autocheck will run and attempt to map out the bad
sector. If the status is C0000185 (STATUS_IO_DEVICE_ERROR) and the paging
file is on a SCSI disk device, then the cabling and termination should be
checked. See the knowledge base article on SCSI termination.
Arguments:
Arg1: 00000001, (page was retrieved from disk)
Arg2: 00000000, value found in stack where signature should be
Arg3: 00000000, 0
Arg4: b1136d24, address of signature on kernel stack

Debugging Details:
------------------


ERROR_CODE: (NTSTATUS) 0x1 - STATUS_WAIT_1

BUGCHECK_STR: 0x77_1

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: DRIVER_FAULT

PROCESS_NAME: System

LAST_CONTROL_TRANSFER: from 80512c46 to 804f9f0d

STACK_TEXT:
ba54fd58 80512c46 00000077 00000001 00000000 nt!KeBugCheckEx+0x1b
ba54fd8c 8053fb56 00c14da8 00000000 8a973278 nt!MmInPageKernelStack+0x176
ba54fda4 80540026 89c14e08 805cec9e 00000000 nt!KiInSwapKernelStacks+0x16
ba54fdac 805cec9e 00000000 00000000 00000000 nt!KeSwapProcessOrStack+0x7c
ba54fddc 80545ebe 8053ffaa 00000000 00000000 nt!PspSystemThreadStartup+0x34
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16


STACK_COMMAND: kb

FOLLOWUP_IP:
nt!MmInPageKernelStack+176
80512c46 8a550b mov dl,byte ptr [ebp+0Bh]

SYMBOL_STACK_INDEX: 1

SYMBOL_NAME: nt!MmInPageKernelStack+176

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nt

DEBUG_FLR_IMAGE_TIMESTAMP: 48a3f869

IMAGE_NAME: memory_corruption

FAILURE_BUCKET_ID: 0x77_1_nt!MmInPageKernelStack+176

BUCKET_ID: 0x77_1_nt!MmInPageKernelStack+176

Followup: MachineOwner
---------




2nd dump:
Microsoft ® Windows Debugger Version 6.11.0001.404 X86
Copyright © Microsoft Corporation. All rights reserved.


Loading Dump File [E:\Gateway Dump\Mini100709-02.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows XP Kernel Version 2600 (Service Pack 2) MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 2600.xpsp_sp2_qfe.080814-1242
Machine Name:
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055c720
Debug session time: Wed Oct 7 20:16:14.734 2009 (GMT-7)
System Uptime: 0 days 0:11:43.421
Loading Kernel Symbols
...............................................................
................................................................
................................................................
.
Loading User Symbols
Loading unloaded module list
..............
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck F4, {3, 89ab1da0, 89ab1f14, 805d164c}

Unable to load image mfehidk.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for mfehidk.sys
*** ERROR: Module load completed but symbols could not be loaded for mfehidk.sys
unable to get nt!KiCurrentEtwBufferOffset
unable to get nt!KiCurrentEtwBufferBase
Probably caused by : hardware_disk

Followup: MachineOwner
---------

1: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

CRITICAL_OBJECT_TERMINATION (f4)
A process or thread crucial to system operation has unexpectedly exited or been
terminated.
Several processes and threads are necessary for the operation of the
system; when they are terminated (for any reason), the system can no
longer function.
Arguments:
Arg1: 00000003, Process
Arg2: 89ab1da0, Terminating object
Arg3: 89ab1f14, Process image file name
Arg4: 805d164c, Explanatory message (ascii)

Debugging Details:
------------------

unable to get nt!KiCurrentEtwBufferOffset
unable to get nt!KiCurrentEtwBufferBase

PROCESS_OBJECT: 89ab1da0

IMAGE_NAME: hardware_disk

DEBUG_FLR_IMAGE_TIMESTAMP: 0

FAULTING_MODULE: 00000000

PROCESS_NAME: csrss.exe

EXCEPTION_RECORD: adc549d8 -- (.exr 0xffffffffadc549d8)
ExceptionAddress: 7c936bd1
ExceptionCode: c0000006 (In-page I/O error)
ExceptionFlags: 00000000
NumberParameters: 3
Parameter[0]: 00000000
Parameter[1]: 7c99a3d8
Parameter[2]: c000000e
Inpage operation failed at 7c99a3d8, due to I/O error c000000e

EXCEPTION_CODE: (NTSTATUS) 0xc0000006 - The instruction at "0x%08lx" referenced memory at "0x%08lx". The required data was not placed into memory because of an I/O error status of "0x%08lx".

CUSTOMER_CRASH_COUNT: 2

DEFAULT_BUCKET_ID: DRIVER_FAULT

ERROR_CODE: (NTSTATUS) 0xc0000006 - The instruction at "0x%08lx" referenced memory at "0x%08lx". The required data was not placed into memory because of an I/O error status of "0x%08lx".

EXCEPTION_PARAMETER1: 00000000

EXCEPTION_PARAMETER2: 7c99a3d8

EXCEPTION_PARAMETER3: c000000e

IO_ERROR: (NTSTATUS) 0xc000000e - A device which does not exist was specified.

EXCEPTION_STR: 0xc0000006_c000000e

FAULTING_IP:
+fc
7c936bd1 ?? ???

BUGCHECK_STR: 0xF4_IOERR_C000000E

CHKIMG_EXTENSION: !chkimg -lo 50 -d !nt
805d167a-805d167e 5 bytes - nt!NtTerminateProcess
[ 8b ff 55 8b ec:e9 de ce 92 30 ]
5 errors : !nt (805d167a-805d167e)

FOLLOWUP_IP:
+3a5952f015adfdc
7c99a3d8 ?? ???

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: hardware_disk

STACK_COMMAND: kb

FAILURE_BUCKET_ID: 0xF4_IOERR_C000000E_IMAGE_hardware_disk

BUCKET_ID: 0xF4_IOERR_C000000E_IMAGE_hardware_disk

Followup: MachineOwner
---------

BC AdBot (Login to Remove)

 


#2 AustrAlien

AustrAlien

    Inquisitor


  • Members
  • 6,772 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Cowra NSW Australia
  • Local time:09:11 AM

Posted 19 October 2009 - 01:30 AM

The first thing that you should do is to check that your hard drive is not failing.

Download the diagnostic utility from the hard drive manufacturer's website to create a bootable floppy or CD. Boot with it, and run the short/quick test and then the long/extended test, and check the S.M.A.R.T. attributes. If the hard drive tests show no problems with the hard drive, then it is safe to proceed with more work to rectify the problem with the Windows system.

Firstly, you need to find the brand name of your hard drive. You will find this info on the label of the hard drive (most likely you will have to remove the hard drive from the box to read the label). You will also find sufficient info to identify the drive (the model number) by looking in the BIOS Setup Menu. Another alternative is to use something like Everest or Belarc Advisor.

EVEREST Free Edition 2.20
http://majorgeeks.com/download4181.html

Belarc Advisor - Free Personal PC Audit (Version 8.1b)
http://www.belarc.com/free_download.html

Hard Drive Diagnostics Tools and Utilities
http://www.tacktech.com/display.cfm?ttid=287
AustrAlien
Google is my friend. Make Google your friend too.

Posted Image




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users