Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

BSOD on shutodwn only XP SP3


  • Please log in to reply
5 replies to this topic

#1 pcguy999

pcguy999

  • Members
  • 4 posts
  • OFFLINE
  •  
  • Local time:06:23 PM

Posted 05 November 2009 - 12:48 AM

Have a XP SP3 machine with 3 GB ram that is BSOD but ONLY on normal shutdown. No BSOD are occurring during daily usage.


Debugger info is:


===============
Microsoft ® Windows Debugger Version 6.11.0001.404 X86
Copyright © Microsoft Corporation. All rights reserved.


Loading Dump File [C:\WINDOWS\Minidump\Mini110409-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows XP Kernel Version 2600 (Service Pack 3) MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 2600.xpsp_sp3_gdr.090804-1435
Machine Name:
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055d720
Debug session time: Wed Nov 4 00:24:49.593 2009 (GMT-6)
System Uptime: 2 days 6:44:09.843
Loading Kernel Symbols
...............................................................
................................................................
.............
Loading User Symbols
Loading unloaded module list
..................................................
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1000007E, {c0000005, 806377ca, ba4e3bd0, ba4e38cc}

Probably caused by : ntkrpamp.exe ( nt!HvShiftCell+10 )

Followup: MachineOwner
---------

1: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

SYSTEM_THREAD_EXCEPTION_NOT_HANDLED_M (1000007e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003. This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG. This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG. This will let us see why this breakpoint is
happening.
Arguments:
Arg1: c0000005, The exception code that was not handled
Arg2: 806377ca, The address that the exception occurred at
Arg3: ba4e3bd0, Exception Record Address
Arg4: ba4e38cc, Context Record Address

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx". The memory could not be "%s".

FAULTING_IP:
nt!HvShiftCell+10
806377ca 8b4804 mov ecx,dword ptr [eax+4]

EXCEPTION_RECORD: ba4e3bd0 -- (.exr 0xffffffffba4e3bd0)
ExceptionAddress: 806377ca (nt!HvShiftCell+0x00000010)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 00000000
Parameter[1]: 00000004
Attempt to read from address 00000004

CONTEXT: ba4e38cc -- (.cxr 0xffffffffba4e38cc)
eax=00000000 ebx=e1095008 ecx=7f00ffff edx=e10950e4 esi=e4cf7bbc edi=e5a35060
eip=806377ca esp=ba4e3c98 ebp=ba4e3c98 iopl=0 nv up ei pl zr na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010246
nt!HvShiftCell+0x10:
806377ca 8b4804 mov ecx,dword ptr [eax+4] ds:0023:00000004=????????
Resetting default scope

CUSTOMER_CRASH_COUNT: 1

PROCESS_NAME: System

ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx". The memory could not be "%s".

EXCEPTION_PARAMETER1: 00000000

EXCEPTION_PARAMETER2: 00000004

READ_ADDRESS: 00000004

FOLLOWUP_IP:
nt!HvShiftCell+10
806377ca 8b4804 mov ecx,dword ptr [eax+4]

BUGCHECK_STR: 0x7E

DEFAULT_BUCKET_ID: NULL_CLASS_PTR_DEREFERENCE

LAST_CONTROL_TRANSFER: from 806355dd to 806377ca

STACK_TEXT:
ba4e3c98 806355dd e1095008 ff00ffff e5a35060 nt!HvShiftCell+0x10
ba4e3cb4 80635b51 e1095008 e1035758 004febb8 nt!CmpShiftKey+0x41
ba4e3ce4 80635cfb e1095008 e1035758 00000006 nt!CmpShiftAllCells2+0x63
ba4e3d0c 80635db4 00000056 e1035758 e1035be0 nt!CmpShiftAllCells+0x97
ba4e3d28 806327c4 e1035758 00974000 00000000 nt!CmpShiftHiveFreeBins+0x94
ba4e3d50 8062ab6a e1035758 80563010 00000001 nt!CmCompressKey+0xba
ba4e3d68 80650acd 80564820 8c8abda8 00000000 nt!CmShutdownSystem+0x6a
ba4e3d7c 8053877d 00000000 00000000 8c8abda8 nt!PopGracefulShutdown+0xdf
ba4e3dac 805cff72 00000000 00000000 00000000 nt!ExpWorkerThread+0xef
ba4e3ddc 805460ee 8053868e 00000000 00000000 nt!PspSystemThreadStartup+0x34
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16


SYMBOL_STACK_INDEX: 0

SYMBOL_NAME: nt!HvShiftCell+10

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nt

IMAGE_NAME: ntkrpamp.exe

DEBUG_FLR_IMAGE_TIMESTAMP: 4a784394

STACK_COMMAND: .cxr 0xffffffffba4e38cc ; kb

FAILURE_BUCKET_ID: 0x7E_nt!HvShiftCell+10

BUCKET_ID: 0x7E_nt!HvShiftCell+10

Followup: MachineOwner
---------

BC AdBot (Login to Remove)

 


#2 LarsonPC

LarsonPC

  • Members
  • 6 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Los Angeles
  • Local time:03:23 PM

Posted 05 November 2009 - 01:17 AM

I'm guessing you have 3 sticks of 1GB RAM correct? Turn off your PC and unplug it, and press the power button a few times to make sure all the electricity is out of your system, then take two of the sticks out leaving the stick in closest to your CPU, and turn on your PC again.

Keep testing each stick one at a time. This error seems to be a memory related problem. It may just be one bad stick. Please keep us updated.

#3 pcguy999

pcguy999
  • Topic Starter

  • Members
  • 4 posts
  • OFFLINE
  •  
  • Local time:06:23 PM

Posted 05 November 2009 - 11:13 AM

If it was memory related would the computer not BSOD when I use it for 12 hours a day doing database work? It does not. It only BSOD when I shut down windows. The machine is scanned daily with NOD32. Also have scanned it with Malwarebytes antimalware and SuperAntispyware.

Edited by pcguy999, 05 November 2009 - 11:15 AM.


#4 hamluis

hamluis

    Moderator


  • Moderator
  • 56,562 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:Killeen, TX
  • Local time:05:23 PM

Posted 05 November 2009 - 11:44 AM

Most irritating STOP errors happen at boot, not shutdown. Very strange situation you have.

Have you tried to do a repair install of XP? Have you always had these errors? If not, what is the possible key to the start of such?

If a repair install of XP brings no joy, I would go to hardware for suspects.

http://support.microsoft.com/kb/308029

See 7E in left column for routine guidance on STOP 7E errors: http://www.aumha.org/a/stop.htm

If you want to do more extensive testing of RAM, Memtest86+ - Advanced Memory Diagnostic Tool - http://www.memtest.org/#downiso.

Louis

#5 sundavis

sundavis

  • Malware Response Team
  • 2,708 posts
  • OFFLINE
  •  
  • Gender:Not Telling
  • Local time:06:23 PM

Posted 05 November 2009 - 12:11 PM

0x50 - Probable Cause "ntkrpamp.exe" - Normally caused by Defective Memory (L2 Cache, RAM, Video RAM) or Incompatible Software including Anti-Virus software.


http://forums.techarena.in/operating-systems/1028413.htm

Sometimes, it seemed to have defective memory on your system. If that's not the case, Did you install some new softwares before BSOD appears? If yes, uninstall it and check what happen.

If still no joy, have you ever tried to uninstall all antimalware and antivirus programs? Unplug your internet access before proceeding. Hope it helps.

#6 pcguy999

pcguy999
  • Topic Starter

  • Members
  • 4 posts
  • OFFLINE
  •  
  • Local time:06:23 PM

Posted 16 November 2009 - 03:13 PM

Most irritating STOP errors happen at boot, not shutdown. Very strange situation you have.

Have you tried to do a repair install of XP? Have you always had these errors? If not, what is the possible key to the start of such?

If a repair install of XP brings no joy, I would go to hardware for suspects.


Repair install BSOD with the same error. Previously had tried running Memtest for 3+ hours with no errors.

http://support.microsoft.com/kb/308029

See 7E in left column for routine guidance on STOP 7E errors: http://www.aumha.org/a/stop.htm

If you want to do more extensive testing of RAM, Memtest86+ - Advanced Memory Diagnostic Tool - http://www.memtest.org/#downiso.

Louis


Looked at that microsft page but none of what I could see is applicable in this case.




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users