Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

DRIVER_IRQL_NOT_LESS_OR_EQUAL BsoD


  • Please log in to reply
24 replies to this topic

#1 nice542

nice542

  • Members
  • 20 posts
  • OFFLINE
  •  
  • Local time:06:29 PM

Posted 18 December 2009 - 07:10 PM

Hi guys,
I've been having a bad problem recently. Basically, completely randomly and without warning, with no user input, It BsoDs on me and i get 1 of 2 error messages.
The first is:
DRIVER_IRQL_NOT_LESS_OR_EQUAL
STOP: 0X000000D1 (0XF7AEE230,0X00000002, 0X00000001, 0XF781BBEB)
RNDISMP.SYS ADDRESS F781BBEB base at F7817000 DateStamp 4802 5770

Beginning dump of Physical Memory
Physical Memory dump complete

The second is another similar one, (haven't had a chance to write it down) which is WIN32K.SYS. When this one happens, the graphics interfere with the screen and I get a jumbled mess.
I've been having this for a few days now
I've got a plug and play keyboard and mouse in the rear USB slots, and a BT Voyager 1055 Wireless USB dongle in the front. From reading similar problems, it seems it could be that.
Really want this sorted soon :thumbsup: I am ok at following stuff, and i'm ok with computers
Thanks
Computer: Compaq Presario SR1819UK with Microsoft Windows XP Professional (SP3)
Graphics Card: ATI Radeon HD4350

BC AdBot (Login to Remove)

 


#2 nice542

nice542
  • Topic Starter

  • Members
  • 20 posts
  • OFFLINE
  •  
  • Local time:06:29 PM

Posted 18 December 2009 - 07:26 PM

Here's a minidump bug analysis:

Microsoft ® Windows Debugger Version 6.11.0001.404 X86
Copyright © Microsoft Corporation. All rights reserved.


Loading Dump File [C:\WINDOWS\Minidump\Mini121809-08.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows XP Kernel Version 2600 (Service Pack 3) UP Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 2600.xpsp_sp3_gdr.090804-1435
Machine Name:
Kernel base = 0x804d7000 PsLoadedModuleList = 0x80554040
Debug session time: Fri Dec 18 23:29:40.015 2009 (GMT+0)
System Uptime: 0 days 2:11:20.605
Loading Kernel Symbols
...............................................................
..........................................................
Loading User Symbols
Loading unloaded module list
..............
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 100000D1, {f7b1e3b0, 2, 1, f7823beb}

Probably caused by : RNDISMP.SYS ( RNDISMP!QuerySetCompletionMessage+18d )

Followup: MachineOwner
---------

kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: f7b1e3b0, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000001, value 0 = read operation, 1 = write operation
Arg4: f7823beb, address which referenced memory

Debugging Details:
------------------


WRITE_ADDRESS: f7b1e3b0

CURRENT_IRQL: 2

FAULTING_IP:
RNDISMP!QuerySetCompletionMessage+18d
f7823beb f3a5 rep movs dword ptr es:[edi],dword ptr [esi]

CUSTOMER_CRASH_COUNT: 8

DEFAULT_BUCKET_ID: COMMON_SYSTEM_FAULT

BUGCHECK_STR: 0xD1

PROCESS_NAME: Wow.exe

LAST_CONTROL_TRANSFER: from f7822a93 to f7823beb

STACK_TEXT:
f78a6dd0 f7822a93 89390938 80000004 893b3558 RNDISMP!QuerySetCompletionMessage+0x18d
f78a6e0c f7928ee7 892e5000 893b3558 893c04a0 RNDISMP!RndisMIndicateReceive+0x1d7
f78a6e30 f7927975 893c04a0 00000000 893b3693 usb8023!IndicateRndisMessage+0x43
f78a6e4c 804f06ae 00000000 893b35d8 013c04a0 usb8023!ControlPipeReadCompletion+0x9d
f78a6e7c f6c980d5 893b35d8 88ee5a40 89925028 nt!IopfCompleteRequest+0xa2
f78a6ee4 f6c98d47 89399368 00000000 899257d8 USBPORT!USBPORT_CompleteTransfer+0x373
f78a6f14 f6c99944 026e6f44 899250e0 899250e0 USBPORT!USBPORT_DoneTransfer+0x137
f78a6f4c f6c9b13a 89925028 805426e8 89925230 USBPORT!USBPORT_FlushDoneTransferList+0x16c
f78a6f78 f6ca924b 89925028 805426e8 89925028 USBPORT!USBPORT_DpcWorker+0x224
f78a6fb4 f6ca93c2 89925028 00000001 89607d98 USBPORT!USBPORT_IsrDpcWorker+0x38f
f78a6fd0 80541b9d 8992564c 6b755044 00000000 USBPORT!USBPORT_IsrDpc+0x166
f78a6ff4 8054186a a9784d44 00000000 00000000 nt!KiRetireDpcList+0x46
f78a6ff8 a9784d44 00000000 00000000 00000000 nt!KiDispatchInterrupt+0x2a
WARNING: Frame IP not in any known module. Following frames may be wrong.
8054186a 00000000 00000009 bb835675 00000128 0xa9784d44


STACK_COMMAND: kb

FOLLOWUP_IP:
RNDISMP!QuerySetCompletionMessage+18d
f7823beb f3a5 rep movs dword ptr es:[edi],dword ptr [esi]

SYMBOL_STACK_INDEX: 0

SYMBOL_NAME: RNDISMP!QuerySetCompletionMessage+18d

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: RNDISMP

IMAGE_NAME: RNDISMP.SYS

DEBUG_FLR_IMAGE_TIMESTAMP: 48025770

FAILURE_BUCKET_ID: 0xD1_RNDISMP!QuerySetCompletionMessage+18d

BUCKET_ID: 0xD1_RNDISMP!QuerySetCompletionMessage+18d

Followup: MachineOwner
---------
Computer: Compaq Presario SR1819UK with Microsoft Windows XP Professional (SP3)
Graphics Card: ATI Radeon HD4350

#3 nice542

nice542
  • Topic Starter

  • Members
  • 20 posts
  • OFFLINE
  •  
  • Local time:06:29 PM

Posted 18 December 2009 - 07:31 PM

And here's the WIN32K one:

Loading Dump File [C:\WINDOWS\Minidump\Mini121809-06.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows XP Kernel Version 2600 (Service Pack 3) UP Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 2600.xpsp_sp3_gdr.090804-1435
Machine Name:
Kernel base = 0x804d7000 PsLoadedModuleList = 0x80554040
Debug session time: Fri Dec 18 19:53:53.218 2009 (GMT+0)
System Uptime: 0 days 0:06:12.810
Loading Kernel Symbols
...............................................................
..........................................................
Loading User Symbols
Loading unloaded module list
................
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1000008E, {c0000005, bf802f39, aab87acc, 0}

Probably caused by : win32k.sys ( win32k!xxxSleepThread+186 )

Followup: MachineOwner
---------

kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

KERNEL_MODE_EXCEPTION_NOT_HANDLED_M (1000008e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003. This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG. This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG. This will let us see why this breakpoint is
happening.
Arguments:
Arg1: c0000005, The exception code that was not handled
Arg2: bf802f39, The address that the exception occurred at
Arg3: aab87acc, Trap Frame
Arg4: 00000000

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx". The memory could not be "%s".

FAULTING_IP:
win32k!xxxSleepThread+186
bf802f39 ffb6a8000000 push dword ptr [esi+0A8h]

TRAP_FRAME: aab87acc -- (.trap 0xffffffffaab87acc)
ErrCode = 00000000
eax=892c3020 ebx=00001000 ecx=892c3054 edx=80010031 esi=00000004 edi=00000004
eip=bf802f39 esp=aab87b40 ebp=aab87b70 iopl=0 nv up ei pl zr na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010246
win32k!xxxSleepThread+0x186:
bf802f39 ffb6a8000000 push dword ptr [esi+0A8h] ds:0023:000000ac=????????
Resetting default scope

CUSTOMER_CRASH_COUNT: 6

DEFAULT_BUCKET_ID: COMMON_SYSTEM_FAULT

BUGCHECK_STR: 0x8E

PROCESS_NAME: explorer.exe

LAST_CONTROL_TRANSFER: from bf840f3c to bf802f39

STACK_TEXT:
aab87b70 bf840f3c 00000200 aab87b5c 00000000 win32k!xxxSleepThread+0x186
aab87c0c bf8141ba bbe76a20 0000004a 00010106 win32k!xxxInterSendMsgEx+0x7f6
aab87c58 bf8340cd bbe76a20 0000004a 00010106 win32k!xxxSendMessageTimeout+0x11f
aab87cbc bf85c003 bbe76a20 0000004a 00010106 win32k!xxxSendMessageEx+0x7a
aab87d08 bf80eece bbe76a20 0000004a 00010106 win32k!NtUserfnCOPYDATA+0x82
aab87d40 8053d648 00020072 0000004a 00010106 win32k!NtUserMessageCall+0xae
aab87d40 7c90e514 00020072 0000004a 00010106 nt!KiFastCallEntry+0xf8
WARNING: Frame IP not in any known module. Following frames may be wrong.
025df3f4 00000000 00000000 00000000 00000000 0x7c90e514


STACK_COMMAND: kb

FOLLOWUP_IP:
win32k!xxxSleepThread+186
bf802f39 ffb6a8000000 push dword ptr [esi+0A8h]

SYMBOL_STACK_INDEX: 0

SYMBOL_NAME: win32k!xxxSleepThread+186

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: win32k

IMAGE_NAME: win32k.sys

DEBUG_FLR_IMAGE_TIMESTAMP: 4a8564c7

FAILURE_BUCKET_ID: 0x8E_win32k!xxxSleepThread+186

BUCKET_ID: 0x8E_win32k!xxxSleepThread+186

Followup: MachineOwner
---------
Computer: Compaq Presario SR1819UK with Microsoft Windows XP Professional (SP3)
Graphics Card: ATI Radeon HD4350

#4 Ken-in-West-Seattle

Ken-in-West-Seattle

  • Members
  • 518 posts
  • OFFLINE
  •  
  • Local time:11:29 AM

Posted 18 December 2009 - 08:53 PM

http://msdn.microsoft.com/en-us/library/bb500929.aspx

RNDISMP.SYS seems to be old and there are a number of vulnerabilities linked to it.
did you install a driver for a network device recently?

#5 nice542

nice542
  • Topic Starter

  • Members
  • 20 posts
  • OFFLINE
  •  
  • Local time:06:29 PM

Posted 19 December 2009 - 05:08 AM

I'm not aware that I did install any network drivers near to the BSODs, it's all been fine up until now
Computer: Compaq Presario SR1819UK with Microsoft Windows XP Professional (SP3)
Graphics Card: ATI Radeon HD4350

#6 nice542

nice542
  • Topic Starter

  • Members
  • 20 posts
  • OFFLINE
  •  
  • Local time:06:29 PM

Posted 19 December 2009 - 05:12 AM

If this is of any use, this is the system summary:
OS Name Microsoft Windows XP Professional
Version 5.1.2600 Service Pack 3 Build 2600
OS Manufacturer Microsoft Corporation
System Name COMPAQ18
System Manufacturer Compaq Presario 061
System Model ES079AA-ABU SR1819UK GB620
System Type X86-based PC
Processor x86 Family 15 Model 47 Stepping 2 AuthenticAMD ~1790 Mhz
BIOS Version/Date Phoenix Technologies, LTD 3.13, 15/11/2005
SMBIOS Version 2.4
Windows Directory C:\WINDOWS
System Directory C:\WINDOWS\system32
Boot Device \Device\HarddiskVolume1
Locale United Kingdom
Hardware Abstraction Layer Version = "5.1.2600.5512 (xpsp.080413-2111)"
User Name COMPAQ18\Harry
Time Zone GMT Standard Time
Total Physical Memory 1,536.00 MB
Available Physical Memory 925.53 MB
Total Virtual Memory 2.00 GB
Available Virtual Memory 1.96 GB
Page File Space 3.35 GB
Page File C:\pagefile.sys

Is it OK just to delete the driver(s) that are causing this problem? I read a website about slimming XP and rndismp.sys was listed as a driver that can be deleted.

Edited by nice542, 19 December 2009 - 05:22 AM.

Computer: Compaq Presario SR1819UK with Microsoft Windows XP Professional (SP3)
Graphics Card: ATI Radeon HD4350

#7 nice542

nice542
  • Topic Starter

  • Members
  • 20 posts
  • OFFLINE
  •  
  • Local time:06:29 PM

Posted 19 December 2009 - 05:34 AM

I've looked in my device manager under Network Adapters, and Miniports do not appear...
Computer: Compaq Presario SR1819UK with Microsoft Windows XP Professional (SP3)
Graphics Card: ATI Radeon HD4350

#8 nice542

nice542
  • Topic Starter

  • Members
  • 20 posts
  • OFFLINE
  •  
  • Local time:06:29 PM

Posted 19 December 2009 - 11:40 AM

If someone else knows the answer to this problem, please help :thumbsup: it crashed like this 8 times yesterday, it's going the same way today. It's got worse since it started
Computer: Compaq Presario SR1819UK with Microsoft Windows XP Professional (SP3)
Graphics Card: ATI Radeon HD4350

#9 hamluis

hamluis

    Moderator


  • Moderator
  • 55,751 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:Killeen, TX
  • Local time:01:29 PM

Posted 19 December 2009 - 12:03 PM

What are the details of the last three error messages?

Is your network functinging properly right now?

FWIW: http://support.microsoft.com/kb/890927

The driver mentioned is a Windows driver...I suppose that I would try running the sfc /scannow command.

http://www.bleepingcomputer.com/filedb/rndismp.sys-2573.html

Louis

#10 nice542

nice542
  • Topic Starter

  • Members
  • 20 posts
  • OFFLINE
  •  
  • Local time:06:29 PM

Posted 19 December 2009 - 12:14 PM

Details of the last 3 error messages:

Earliest today:

Microsoft ® Windows Debugger Version 6.11.0001.404 X86
Copyright © Microsoft Corporation. All rights reserved.


Loading Dump File [C:\WINDOWS\Minidump\Mini121909-02.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows XP Kernel Version 2600 (Service Pack 3) UP Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 2600.xpsp_sp3_gdr.090804-1435
Machine Name:
Kernel base = 0x804d7000 PsLoadedModuleList = 0x80554040
Debug session time: Sat Dec 19 13:55:29.468 2009 (GMT+0)
System Uptime: 0 days 3:11:07.061
Loading Kernel Symbols
...............................................................
.........................................................
Loading User Symbols
Loading unloaded module list
..............
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 100000D1, {f7a64240, 2, 1, f782bbeb}

Probably caused by : RNDISMP.SYS ( RNDISMP!QuerySetCompletionMessage+18d )

Followup: MachineOwner
---------

kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: f7a64240, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000001, value 0 = read operation, 1 = write operation
Arg4: f782bbeb, address which referenced memory

Debugging Details:
------------------


WRITE_ADDRESS: f7a64240

CURRENT_IRQL: 2

FAULTING_IP:
RNDISMP!QuerySetCompletionMessage+18d
f782bbeb f3a5 rep movs dword ptr es:[edi],dword ptr [esi]

CUSTOMER_CRASH_COUNT: 2

DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: 0xD1

PROCESS_NAME: Wow.exe

LAST_CONTROL_TRANSFER: from f782aa93 to f782bbeb

STACK_TEXT:
f78a6dd0 f782aa93 893b9980 80000004 893c1468 RNDISMP!QuerySetCompletionMessage+0x18d
f78a6e0c f7930ee7 892cf000 893c1468 8935de88 RNDISMP!RndisMIndicateReceive+0x1d7
f78a6e30 f792f975 8935de88 00000000 893cb2cb usb8023!IndicateRndisMessage+0x43
f78a6e4c 804f06ae 00000000 893cb210 0135de88 usb8023!ControlPipeReadCompletion+0x9d
f78a6e7c f6c980d5 893cb210 88fd70c0 89924028 nt!IopfCompleteRequest+0xa2
f78a6ee4 f6c98d47 89354868 00000000 899247d8 USBPORT!USBPORT_CompleteTransfer+0x373
f78a6f14 f6c99944 026e6f44 899240e0 899240e0 USBPORT!USBPORT_DoneTransfer+0x137
f78a6f4c f6c9b13a 89924028 805426e8 89924230 USBPORT!USBPORT_FlushDoneTransferList+0x16c
f78a6f78 f6ca924b 89924028 805426e8 89924028 USBPORT!USBPORT_DpcWorker+0x224
f78a6fb4 f6ca93c2 89924028 00000001 895e6d98 USBPORT!USBPORT_IsrDpcWorker+0x38f
f78a6fd0 80541b9d 8992464c 6b755044 00000000 USBPORT!USBPORT_IsrDpc+0x166
f78a6ff4 8054186a aab856c4 00000000 00000000 nt!KiRetireDpcList+0x46
f78a6ff8 aab856c4 00000000 00000000 00000000 nt!KiDispatchInterrupt+0x2a
WARNING: Frame IP not in any known module. Following frames may be wrong.
8054186a 00000000 00000009 bb835675 00000128 0xaab856c4


STACK_COMMAND: kb

FOLLOWUP_IP:
RNDISMP!QuerySetCompletionMessage+18d
f782bbeb f3a5 rep movs dword ptr es:[edi],dword ptr [esi]

SYMBOL_STACK_INDEX: 0

SYMBOL_NAME: RNDISMP!QuerySetCompletionMessage+18d

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: RNDISMP

IMAGE_NAME: RNDISMP.SYS

DEBUG_FLR_IMAGE_TIMESTAMP: 48025770

FAILURE_BUCKET_ID: 0xD1_RNDISMP!QuerySetCompletionMessage+18d

BUCKET_ID: 0xD1_RNDISMP!QuerySetCompletionMessage+18d

Followup: MachineOwner
---------





Second today:

Microsoft ® Windows Debugger Version 6.11.0001.404 X86
Copyright © Microsoft Corporation. All rights reserved.


Loading Dump File [C:\WINDOWS\Minidump\Mini121909-03.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows XP Kernel Version 2600 (Service Pack 3) UP Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 2600.xpsp_sp3_gdr.090804-1435
Machine Name:
Kernel base = 0x804d7000 PsLoadedModuleList = 0x80554040
Debug session time: Sat Dec 19 14:54:12.156 2009 (GMT+0)
System Uptime: 0 days 0:07:30.739
Loading Kernel Symbols
...............................................................
.........................................................
Loading User Symbols
Loading unloaded module list
...............
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 100000D1, {f7b19208, 2, 1, f7823beb}

Probably caused by : RNDISMP.SYS ( RNDISMP!QuerySetCompletionMessage+18d )

Followup: MachineOwner
---------

kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: f7b19208, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000001, value 0 = read operation, 1 = write operation
Arg4: f7823beb, address which referenced memory

Debugging Details:
------------------


WRITE_ADDRESS: f7b19208

CURRENT_IRQL: 2

FAULTING_IP:
RNDISMP!QuerySetCompletionMessage+18d
f7823beb f3a5 rep movs dword ptr es:[edi],dword ptr [esi]

CUSTOMER_CRASH_COUNT: 3

DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: 0xD1

PROCESS_NAME: wltray.exe

LAST_CONTROL_TRANSFER: from f7822a93 to f7823beb

STACK_TEXT:
f78a6dd0 f7822a93 89bd6cf8 80000004 89e0dbd8 RNDISMP!QuerySetCompletionMessage+0x18d
f78a6e0c f7928ee7 89b1e000 89e0dbd8 89c4aa50 RNDISMP!RndisMIndicateReceive+0x1d7
f78a6e30 f7927975 89c4aa50 00000000 89c6a98b usb8023!IndicateRndisMessage+0x43
f78a6e4c 804f06ae 00000000 89c6a8d0 01c4aa50 usb8023!ControlPipeReadCompletion+0x9d
f78a6e7c f6c980d5 89c6a8d0 896c9750 8a1a3028 nt!IopfCompleteRequest+0xa2
f78a6ee4 f6c98d47 89c4a9e8 00000000 8a1a37d8 USBPORT!USBPORT_CompleteTransfer+0x373
f78a6f14 f6c99944 026e6f44 8a1a30e0 8a1a30e0 USBPORT!USBPORT_DoneTransfer+0x137
f78a6f4c f6c9b13a 8a1a3028 805426e8 8a1a3230 USBPORT!USBPORT_FlushDoneTransferList+0x16c
f78a6f78 f6ca924b 8a1a3028 805426e8 8a1a3028 USBPORT!USBPORT_DpcWorker+0x224
f78a6fb4 f6ca93c2 8a1a3028 00000001 806d2866 USBPORT!USBPORT_IsrDpcWorker+0x38f
f78a6fd0 80541b9d 8a1a364c 6b755044 00000000 USBPORT!USBPORT_IsrDpc+0x166
f78a6ff4 8054186a aae40a04 00000000 00000000 nt!KiRetireDpcList+0x46
f78a6ff8 aae40a04 00000000 00000000 00000000 nt!KiDispatchInterrupt+0x2a
WARNING: Frame IP not in any known module. Following frames may be wrong.
8054186a 00000000 00000009 bb835675 00000128 0xaae40a04


STACK_COMMAND: kb

FOLLOWUP_IP:
RNDISMP!QuerySetCompletionMessage+18d
f7823beb f3a5 rep movs dword ptr es:[edi],dword ptr [esi]

SYMBOL_STACK_INDEX: 0

SYMBOL_NAME: RNDISMP!QuerySetCompletionMessage+18d

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: RNDISMP

IMAGE_NAME: RNDISMP.SYS

DEBUG_FLR_IMAGE_TIMESTAMP: 48025770

FAILURE_BUCKET_ID: 0xD1_RNDISMP!QuerySetCompletionMessage+18d

BUCKET_ID: 0xD1_RNDISMP!QuerySetCompletionMessage+18d

Followup: MachineOwner
---------




Third today:

Loading Dump File [C:\WINDOWS\Minidump\Mini121909-04.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows XP Kernel Version 2600 (Service Pack 3) UP Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 2600.xpsp_sp3_gdr.090804-1435
Machine Name:
Kernel base = 0x804d7000 PsLoadedModuleList = 0x80554040
Debug session time: Sat Dec 19 16:27:22.921 2009 (GMT+0)
System Uptime: 0 days 1:32:47.503
Loading Kernel Symbols
...............................................................
.........................................................
Loading User Symbols
Loading unloaded module list
................
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 100000D1, {f7a9a3a8, 2, 1, f780bbeb}

Probably caused by : RNDISMP.SYS ( RNDISMP!QuerySetCompletionMessage+18d )

Followup: MachineOwner
---------

kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: f7a9a3a8, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000001, value 0 = read operation, 1 = write operation
Arg4: f780bbeb, address which referenced memory

Debugging Details:
------------------


WRITE_ADDRESS: f7a9a3a8

CURRENT_IRQL: 2

FAULTING_IP:
RNDISMP!QuerySetCompletionMessage+18d
f780bbeb f3a5 rep movs dword ptr es:[edi],dword ptr [esi]

CUSTOMER_CRASH_COUNT: 4

DEFAULT_BUCKET_ID: COMMON_SYSTEM_FAULT

BUGCHECK_STR: 0xD1

PROCESS_NAME: java.exe

LAST_CONTROL_TRANSFER: from f780aa93 to f780bbeb

STACK_TEXT:
f78a6dd0 f780aa93 8a0bb180 80000004 8a2945a0 RNDISMP!QuerySetCompletionMessage+0x18d
f78a6e0c f7918ee7 89acf000 8a2945a0 8a251c68 RNDISMP!RndisMIndicateReceive+0x1d7
f78a6e30 f7917975 8a251c68 00000000 8a23089b usb8023!IndicateRndisMessage+0x43
f78a6e4c 804f06ae 00000000 8a2307e0 01251c68 usb8023!ControlPipeReadCompletion+0x9d
f78a6e7c f6c980d5 8a2307e0 897886a8 8a1ab028 nt!IopfCompleteRequest+0xa2
f78a6ee4 f6c98d47 8a241908 00000000 8a1ab7d8 USBPORT!USBPORT_CompleteTransfer+0x373
f78a6f14 f6c99944 026e6f44 8a1ab0e0 8a1ab0e0 USBPORT!USBPORT_DoneTransfer+0x137
f78a6f4c f6c9b13a 8a1ab028 805426e8 8a1ab230 USBPORT!USBPORT_FlushDoneTransferList+0x16c
f78a6f78 f6ca924b 8a1ab028 805426e8 8a1ab028 USBPORT!USBPORT_DpcWorker+0x224
f78a6fb4 f6ca93c2 8a1ab028 00000001 89e57b20 USBPORT!USBPORT_IsrDpcWorker+0x38f
f78a6fd0 80541b9d 8a1ab64c 6b755044 00000000 USBPORT!USBPORT_IsrDpc+0x166
f78a6ff4 8054186a aab06d44 00000000 00000000 nt!KiRetireDpcList+0x46
f78a6ff8 aab06d44 00000000 00000000 00000000 nt!KiDispatchInterrupt+0x2a
WARNING: Frame IP not in any known module. Following frames may be wrong.
8054186a 00000000 00000009 bb835675 00000128 0xaab06d44


STACK_COMMAND: kb

FOLLOWUP_IP:
RNDISMP!QuerySetCompletionMessage+18d
f780bbeb f3a5 rep movs dword ptr es:[edi],dword ptr [esi]

SYMBOL_STACK_INDEX: 0

SYMBOL_NAME: RNDISMP!QuerySetCompletionMessage+18d

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: RNDISMP

IMAGE_NAME: RNDISMP.SYS

DEBUG_FLR_IMAGE_TIMESTAMP: 48025770

FAILURE_BUCKET_ID: 0xD1_RNDISMP!QuerySetCompletionMessage+18d

BUCKET_ID: 0xD1_RNDISMP!QuerySetCompletionMessage+18d

Followup: MachineOwner
---------




Network is functioning properly, I am currently using the computer in question.
Couldn't get the scannow function to work; I don't have the cd with me.
Computer: Compaq Presario SR1819UK with Microsoft Windows XP Professional (SP3)
Graphics Card: ATI Radeon HD4350

#11 nice542

nice542
  • Topic Starter

  • Members
  • 20 posts
  • OFFLINE
  •  
  • Local time:06:29 PM

Posted 19 December 2009 - 12:22 PM

Just BSOD 3 minutes ago, this is the minidump report:


Microsoft ® Windows Debugger Version 6.11.0001.404 X86
Copyright © Microsoft Corporation. All rights reserved.


Loading Dump File [C:\WINDOWS\Minidump\Mini121909-05.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows XP Kernel Version 2600 (Service Pack 3) UP Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 2600.xpsp_sp3_gdr.090804-1435
Machine Name:
Kernel base = 0x804d7000 PsLoadedModuleList = 0x80554040
Debug session time: Sat Dec 19 17:17:44.312 2009 (GMT+0)
System Uptime: 0 days 1:00:18.991
Loading Kernel Symbols
...............................................................
.........................................................
Loading User Symbols
Loading unloaded module list
..............
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 100000D1, {f7ade230, 2, 1, f780bbeb}

Probably caused by : RNDISMP.SYS ( RNDISMP!QuerySetCompletionMessage+18d )

Followup: MachineOwner
---------

kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: f7ade230, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000001, value 0 = read operation, 1 = write operation
Arg4: f780bbeb, address which referenced memory

Debugging Details:
------------------


WRITE_ADDRESS: f7ade230

CURRENT_IRQL: 2

FAULTING_IP:
RNDISMP!QuerySetCompletionMessage+18d
f780bbeb f3a5 rep movs dword ptr es:[edi],dword ptr [esi]

CUSTOMER_CRASH_COUNT: 5

DEFAULT_BUCKET_ID: COMMON_SYSTEM_FAULT

BUGCHECK_STR: 0xD1

PROCESS_NAME: wltray.exe

LAST_CONTROL_TRANSFER: from f780aa93 to f780bbeb

STACK_TEXT:
f78a6dd0 f780aa93 89c2dae8 80000004 89c56680 RNDISMP!QuerySetCompletionMessage+0x18d
f78a6e0c f7940ee7 89ba5000 89c56680 89c45290 RNDISMP!RndisMIndicateReceive+0x1d7
f78a6e30 f793f975 89c45290 00000000 89c2d90b usb8023!IndicateRndisMessage+0x43
f78a6e4c 804f06ae 00000000 89c2d850 01c45290 usb8023!ControlPipeReadCompletion+0x9d
f78a6e7c f6c980d5 89c2d850 896b1008 8a1a3028 nt!IopfCompleteRequest+0xa2
f78a6ee4 f6c98d47 89c33330 00000000 8a1a37d8 USBPORT!USBPORT_CompleteTransfer+0x373
f78a6f14 f6c99944 026e6f44 8a1a30e0 8a1a30e0 USBPORT!USBPORT_DoneTransfer+0x137
f78a6f4c f6c9b13a 8a1a3028 805426e8 8a1a3230 USBPORT!USBPORT_FlushDoneTransferList+0x16c
f78a6f78 f6ca924b 8a1a3028 805426e8 8a1a3028 USBPORT!USBPORT_DpcWorker+0x224
f78a6fb4 f6ca93c2 8a1a3028 00000001 89e087f8 USBPORT!USBPORT_IsrDpcWorker+0x38f
f78a6fd0 80541b9d 8a1a364c 6b755044 00000000 USBPORT!USBPORT_IsrDpc+0x166
f78a6ff4 8054186a a9b429f4 00000000 00000000 nt!KiRetireDpcList+0x46
f78a6ff8 a9b429f4 00000000 00000000 00000000 nt!KiDispatchInterrupt+0x2a
WARNING: Frame IP not in any known module. Following frames may be wrong.
8054186a 00000000 00000009 bb835675 00000128 0xa9b429f4


STACK_COMMAND: kb

FOLLOWUP_IP:
RNDISMP!QuerySetCompletionMessage+18d
f780bbeb f3a5 rep movs dword ptr es:[edi],dword ptr [esi]

SYMBOL_STACK_INDEX: 0

SYMBOL_NAME: RNDISMP!QuerySetCompletionMessage+18d

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: RNDISMP

IMAGE_NAME: RNDISMP.SYS

DEBUG_FLR_IMAGE_TIMESTAMP: 48025770

FAILURE_BUCKET_ID: 0xD1_RNDISMP!QuerySetCompletionMessage+18d

BUCKET_ID: 0xD1_RNDISMP!QuerySetCompletionMessage+18d

Followup: MachineOwner
---------
Computer: Compaq Presario SR1819UK with Microsoft Windows XP Professional (SP3)
Graphics Card: ATI Radeon HD4350

#12 hamluis

hamluis

    Moderator


  • Moderator
  • 55,751 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:Killeen, TX
  • Local time:01:29 PM

Posted 19 December 2009 - 12:55 PM

Seems clear to me...you need to replace the rndismp.sys file.

Repair install or run sfc /scannow.

http://www.bleepingcomputer.com/forums/topic75067.html#, related post.

Louis

#13 nice542

nice542
  • Topic Starter

  • Members
  • 20 posts
  • OFFLINE
  •  
  • Local time:06:29 PM

Posted 19 December 2009 - 01:01 PM

And what about the win32 one? It's certainly not as frequent as the RNDISMP one, but I dunno how to solve that or what's causing it.

I appreciate all your help :thumbsup:
Computer: Compaq Presario SR1819UK with Microsoft Windows XP Professional (SP3)
Graphics Card: ATI Radeon HD4350

#14 hamluis

hamluis

    Moderator


  • Moderator
  • 55,751 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:Killeen, TX
  • Local time:01:29 PM

Posted 19 December 2009 - 01:31 PM

IMO...I really don't know, but I try to interpret...errors denoting win32k.sys are just the scene of the crime, the point where Windows feels like it's time to draw the line. I have the feeling (not the knowledge) that a driver causing problems will sometimes result in win32k.sys being pointed out as the violatior, rather than the violated.

Even if win32k.sys is the actual culprit (because it is damaged), running sfc /scannow or conducting a repair install will take care of that, since it will be replaced.

The basic STOP error is supposed to point the finger at the offending driver, that's the data in the main message ("probably caused by...") but, like anything else, it can be inaccurate. I choose to try the obvious first.

Louis

#15 nice542

nice542
  • Topic Starter

  • Members
  • 20 posts
  • OFFLINE
  •  
  • Local time:06:29 PM

Posted 19 December 2009 - 01:41 PM

I think my dad has the windows cd, so I'll have to ask him for it, but the real problem is the RNDISMP. The win32 one isn't nearly as frequent, it's just the RNDISMP BSODs are getting really frequent now, roughly one every half an hour. I'll do as you suggest - just need the cd for the scannow function to work.
Computer: Compaq Presario SR1819UK with Microsoft Windows XP Professional (SP3)
Graphics Card: ATI Radeon HD4350




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users