Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

BSOD minidump analysis


  • Please log in to reply
21 replies to this topic

#1 lostduck

lostduck

  • Members
  • 11 posts
  • OFFLINE
  •  
  • Local time:09:42 AM

Posted 21 June 2010 - 10:11 AM

I've had multiple BSODs (for many months now) -- even after a new HD, and several reformat-reinstalls later, I'm still receiving them.
Here is the analysis from the minidump:


Microsoft ® Windows Debugger Version 6.12.0002.633 X86
Copyright © Microsoft Corporation. All rights reserved.


Loading Dump File [C:\WINDOWS\Minidump\Mini062110-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows XP Kernel Version 2600 (Service Pack 3) MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 2600.xpsp_sp3_gdr.100216-1514
Machine Name:
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055d720
Debug session time: Mon Jun 21 08:53:58.656 2010 (UTC - 5:00)
System Uptime: 0 days 0:01:39.390
Loading Kernel Symbols
...............................................................
................................................................
...............
Loading User Symbols
Loading unloaded module list
...........
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1000000A, {0, 2, 1, 80522704}

Probably caused by : memory_corruption ( nt!MiRemovePageByColor+66 )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 00000000, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000001, bitfield :
bit 0 : value 0 = read operation, 1 = write operation
bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: 80522704, address which referenced memory

Debugging Details:
------------------


WRITE_ADDRESS: 00000000

CURRENT_IRQL: 2

FAULTING_IP:
nt!MiRemovePageByColor+66
80522704 ff08 dec dword ptr [eax]

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: 0xA

PROCESS_NAME: avgnsx.exe

LAST_CONTROL_TRANSFER: from 80522a9c to 80522704

STACK_TEXT:
a4ab8cb4 80522a9c 00000001 0000000e c0011158 nt!MiRemovePageByColor+0x66
a4ab8cd0 80514b1b c0600088 c0011158 00000000 nt!MiRemoveZeroPage+0x8a
a4ab8ce8 805205c9 0222b008 c0011158 86f3d020 nt!MiResolveDemandZeroFault+0xc5
a4ab8d4c 805445b0 00000001 0222b008 00000001 nt!MmAccessFault+0xbeb
a4ab8d4c 6dc3eca6 00000001 0222b008 00000001 nt!KiTrap0E+0xd0
WARNING: Frame IP not in any known module. Following frames may be wrong.
010ff518 00000000 00000000 00000000 00000000 0x6dc3eca6


STACK_COMMAND: kb

FOLLOWUP_IP:
nt!MiRemovePageByColor+66
80522704 ff08 dec dword ptr [eax]

SYMBOL_STACK_INDEX: 0

SYMBOL_NAME: nt!MiRemovePageByColor+66

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nt

DEBUG_FLR_IMAGE_TIMESTAMP: 4b7a9cac

IMAGE_NAME: memory_corruption

FAILURE_BUCKET_ID: 0xA_nt!MiRemovePageByColor+66

BUCKET_ID: 0xA_nt!MiRemovePageByColor+66

Followup: MachineOwner
---------


Any, and all help is appreciated. I'm simply lost. If you need more...i have multiple from the past 2 days :thumbsup:
-duck

BC AdBot (Login to Remove)

 


#2 hamluis

hamluis

    Moderator


  • Moderator
  • 56,277 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:Killeen, TX
  • Local time:09:42 AM

Posted 21 June 2010 - 10:17 AM

Try the following, please.

Download/install BlueScreenView, http://www.nirsoft.net/utils/blue_screen_view.html.

Double-click BlueScreenView.exe file.

When scanning is done, Edit/Select All...then File/Save Selected Items.

Save the report as BSOD.txt.

Open BSOD.txt, using Notepad, copy all content and paste it into your next reply.

Louis

#3 lostduck

lostduck
  • Topic Starter

  • Members
  • 11 posts
  • OFFLINE
  •  
  • Local time:09:42 AM

Posted 21 June 2010 - 10:24 AM

==================================================
Dump File : Mini062110-01.dmp
Crash Time : 6/21/2010 9:08:31 AM
Bug Check String : IRQL_NOT_LESS_OR_EQUAL
Bug Check Code : 0x1000000a
Parameter 1 : 0x00000000
Parameter 2 : 0x00000002
Parameter 3 : 0x00000001
Parameter 4 : 0x80522704
Caused By Driver : ntoskrnl.exe
Caused By Address : ntoskrnl.exe+4b704
File Description : NT Kernel & System
Product Name : Microsoft® Windows® Operating System
Company : Microsoft Corporation
File Version : 5.1.2600.5938 (xpsp_sp3_gdr.100216-1514)
Processor : 32-bit
Computer Name :
Full Path : C:\WINDOWS\Minidump\Mini062110-01.dmp
Processors Count : 2
Major Version : 15
Minor Version : 2600
==================================================

==================================================
Dump File : Mini062010-02.dmp
Crash Time : 6/20/2010 9:06:41 PM
Bug Check String : IRQL_NOT_LESS_OR_EQUAL
Bug Check Code : 0x1000000a
Parameter 1 : 0x00000000
Parameter 2 : 0x00000002
Parameter 3 : 0x00000001
Parameter 4 : 0x80522704
Caused By Driver : ntoskrnl.exe
Caused By Address : ntoskrnl.exe+4b704
File Description : NT Kernel & System
Product Name : Microsoft® Windows® Operating System
Company : Microsoft Corporation
File Version : 5.1.2600.5938 (xpsp_sp3_gdr.100216-1514)
Processor : 32-bit
Computer Name :
Full Path : C:\WINDOWS\Minidump\Mini062010-02.dmp
Processors Count : 2
Major Version : 15
Minor Version : 2600
==================================================

==================================================
Dump File : Mini062010-01.dmp
Crash Time : 6/20/2010 8:17:40 AM
Bug Check String : IRQL_NOT_LESS_OR_EQUAL
Bug Check Code : 0x1000000a
Parameter 1 : 0x00000000
Parameter 2 : 0x00000002
Parameter 3 : 0x00000001
Parameter 4 : 0x80522704
Caused By Driver : ntoskrnl.exe
Caused By Address : ntoskrnl.exe+4b704
File Description : NT Kernel & System
Product Name : Microsoft® Windows® Operating System
Company : Microsoft Corporation
File Version : 5.1.2600.5938 (xpsp_sp3_gdr.100216-1514)
Processor : 32-bit
Computer Name :
Full Path : C:\WINDOWS\Minidump\Mini062010-01.dmp
Processors Count : 2
Major Version : 15
Minor Version : 2600
==================================================

==================================================
Dump File : Mini061510-01.dmp
Crash Time : 6/15/2010 1:48:57 PM
Bug Check String : IRQL_NOT_LESS_OR_EQUAL
Bug Check Code : 0x1000000a
Parameter 1 : 0x00000000
Parameter 2 : 0x00000002
Parameter 3 : 0x00000001
Parameter 4 : 0x80522704
Caused By Driver : ntoskrnl.exe
Caused By Address : ntoskrnl.exe+4b704
File Description : NT Kernel & System
Product Name : Microsoft® Windows® Operating System
Company : Microsoft Corporation
File Version : 5.1.2600.5938 (xpsp_sp3_gdr.100216-1514)
Processor : 32-bit
Computer Name :
Full Path : C:\WINDOWS\Minidump\Mini061510-01.dmp
Processors Count : 2
Major Version : 15
Minor Version : 2600
==================================================

==================================================
Dump File : Mini061410-01.dmp
Crash Time : 6/14/2010 10:07:33 AM
Bug Check String : IRQL_NOT_LESS_OR_EQUAL
Bug Check Code : 0x1000000a
Parameter 1 : 0x00000000
Parameter 2 : 0x00000002
Parameter 3 : 0x00000001
Parameter 4 : 0x80522704
Caused By Driver : ntoskrnl.exe
Caused By Address : ntoskrnl.exe+4b704
File Description : NT Kernel & System
Product Name : Microsoft® Windows® Operating System
Company : Microsoft Corporation
File Version : 5.1.2600.5938 (xpsp_sp3_gdr.100216-1514)
Processor : 32-bit
Computer Name :
Full Path : C:\WINDOWS\Minidump\Mini061410-01.dmp
Processors Count : 2
Major Version : 15
Minor Version : 2600
==================================================



-duck

#4 hamluis

hamluis

    Moderator


  • Moderator
  • 56,277 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:Killeen, TX
  • Local time:09:42 AM

Posted 21 June 2010 - 11:41 AM

I would uninstall any AVG application installed (via Add/Remove Programs)...and then reinstall same...and see if the BSODs cease.

I would also check Event Viewer for any listed error...which may provide clues. I would try to link the errors noted in Event Viewer to the dates/times reflected by the BSODs you posted.

How To Use Event Viewer - http://www.bleepingcomputer.com/forums/t/40108/how-to-use-event-viewer/

Louis

#5 lostduck

lostduck
  • Topic Starter

  • Members
  • 11 posts
  • OFFLINE
  •  
  • Local time:09:42 AM

Posted 21 June 2010 - 12:36 PM

I looked through the Event viewer, and i debugged each minidump. they're non-specific to a program, however as you see from my last post above it keeps referencing back to ntoskrnl.exe
In the other minidumps, one was listed to firefox, one was listed to system...each time it is the same blue-screen

With that said, here's the information from the even viewer:
Event Type: Error
Event Source: System Error
Event Category: (102)
Event ID: 1003
Date: 6/21/2010
Time: 9:09:11 AM
User: N/A
Computer: ELLIOT
Description:
Error code 1000000a, parameter1 00000000, parameter2 00000002, parameter3 00000001, parameter4 80522704.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 53 79 73 74 65 6d 20 45 System E
0008: 72 72 6f 72 20 20 45 72 rror Er
0010: 72 6f 72 20 63 6f 64 65 ror code
0018: 20 31 30 30 30 30 30 30 1000000
0020: 61 20 20 50 61 72 61 6d a Param
0028: 65 74 65 72 73 20 30 30 eters 00
0030: 30 30 30 30 30 30 2c 20 000000,
0038: 30 30 30 30 30 30 30 32 00000002
0040: 2c 20 30 30 30 30 30 30 , 000000
0048: 30 31 2c 20 38 30 35 32 01, 8052
0050: 32 37 30 34 2704
--------------------------------------------------------------

Event Type: Error
Event Source: System Error
Event Category: (102)
Event ID: 1003
Date: 6/20/2010
Time: 9:07:16 PM
User: N/A
Computer: ELLIOT
Description:
Error code 1000000a, parameter1 00000000, parameter2 00000002, parameter3 00000001, parameter4 80522704.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 53 79 73 74 65 6d 20 45 System E
0008: 72 72 6f 72 20 20 45 72 rror Er
0010: 72 6f 72 20 63 6f 64 65 ror code
0018: 20 31 30 30 30 30 30 30 1000000
0020: 61 20 20 50 61 72 61 6d a Param
0028: 65 74 65 72 73 20 30 30 eters 00
0030: 30 30 30 30 30 30 2c 20 000000,
0038: 30 30 30 30 30 30 30 32 00000002
0040: 2c 20 30 30 30 30 30 30 , 000000
0048: 30 31 2c 20 38 30 35 32 01, 8052
0050: 32 37 30 34 2704
-------------------------------------------------------

Event Type: Error
Event Source: System Error
Event Category: (102)
Event ID: 1003
Date: 6/20/2010
Time: 8:18:15 AM
User: N/A
Computer: ELLIOT
Description:
Error code 1000000a, parameter1 00000000, parameter2 00000002, parameter3 00000001, parameter4 80522704.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 53 79 73 74 65 6d 20 45 System E
0008: 72 72 6f 72 20 20 45 72 rror Er
0010: 72 6f 72 20 63 6f 64 65 ror code
0018: 20 31 30 30 30 30 30 30 1000000
0020: 61 20 20 50 61 72 61 6d a Param
0028: 65 74 65 72 73 20 30 30 eters 00
0030: 30 30 30 30 30 30 2c 20 000000,
0038: 30 30 30 30 30 30 30 32 00000002
0040: 2c 20 30 30 30 30 30 30 , 000000
0048: 30 31 2c 20 38 30 35 32 01, 8052
0050: 32 37 30 34 2704
---------------------------------------------------------------

#6 tenz

tenz

  • Members
  • 105 posts
  • ONLINE
  •  
  • Local time:10:42 AM

Posted 21 June 2010 - 01:22 PM

Looking back at your orig post, i came across this:

"*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1000000A, {0, 2, 1, 80522704}

Probably caused by : memory_corruption( nt!MiRemovePageByColor+66 )

Followup: MachineOwner
---------"

Maybe you should run a memory test or swap out your Ram sticks if you have spare ones.

Tenz

#7 hamluis

hamluis

    Moderator


  • Moderator
  • 56,277 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:Killeen, TX
  • Local time:09:42 AM

Posted 21 June 2010 - 01:32 PM

In all honesty...that part of the message tends to be a bit misleading, IMO.

Generally speaking, most BSODs become noticeable when something goes wrong with memory management. If you take a look at the various BSODs, you will see this.

IMO, it's not that memory is the cause of the crash...rather, memory management is the scene of the accident where Windows realizes that there is a problem.

In any case, it won't hurt to run a memory diagnostic.

Icrontic » Diagnose with Memtest86+ - http://icrontic.com/articles/diagnose_with_memtest86

Memtest86+ - Advanced Memory Diagnostic Tool - http://www.memtest.org/#downiso

How to write a CD-DVD image or ISO - http://www.bleepingcomputer.com/tutorials/write-a-cd-dvd-image-or-iso/

Louis

#8 keyboardNinja

keyboardNinja

    Bleepin' Ninja


  • Members
  • 4,815 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:teh interwebz
  • Local time:08:42 AM

Posted 21 June 2010 - 01:32 PM

***** A. If you have more than one RAM module installed, try starting computer with one RAM stick at a time.

NOTE Keep in mind, the manual check listed above is always superior to the software check, listed below. DO NOT proceed with memtest, if you can go with option A

B. If you have only one RAM stick installed...
...run memtest...

1. Download - Pre-Compiled Bootable ISO (.zip)
2. Unzip downloaded memtest86+-....iso.zip file.
3. Inside, you'll find memtest86+-....iso file.
4. Download, and install ImgBurn: http://www.imgburn.com/
5. Insert blank CD into your CD drive.
6. Open ImgBurn, and click on Write image file to disc
7. Click on Browse for a file... icon:

Posted Image

8. Locate memtest86+-....iso file, and click Open button.
9. Click on ImgBurn green arrow to start burning bootable memtest86 CD:

Posted Image

10. Once the CD is created, boot from it, and memtest will automatically start to run.

The running program will look something like this depending on the size and number of ram modules installed:


Posted Image

It's recommended to run 5-6 passes. Each pass contains very same 8 tests.

This will show the progress of the test. It can take a while. Be patient, or leave it running overnight.

Posted Image

The following image is the test results area:

Posted Image

The most important item here is the “errors” line. If you see ANY errors, even one, most likely, you have bad RAM.
PICNIC - Problem In Chair, Not In Computer

Posted Image Posted Image

20 Things I Learned About Browsers and the Web

#9 lostduck

lostduck
  • Topic Starter

  • Members
  • 11 posts
  • OFFLINE
  •  
  • Local time:09:42 AM

Posted 21 June 2010 - 01:52 PM

Alright, thanks! Due to this being a recurring problem with my rig, I already have run memtest this afternoon and it made it through 2 passes with no errors. I'll finish up a little more work then send it back for 5-6 more passes to see if anything turns up.

#10 lostduck

lostduck
  • Topic Starter

  • Members
  • 11 posts
  • OFFLINE
  •  
  • Local time:09:42 AM

Posted 22 June 2010 - 09:35 AM

After running memtest with 5 consecutive passes, no dice. Zero errors occurred. :thumbsup:

#11 hamluis

hamluis

    Moderator


  • Moderator
  • 56,277 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:Killeen, TX
  • Local time:09:42 AM

Posted 22 June 2010 - 01:19 PM

Did you uninstall AVG?

Louis

#12 lostduck

lostduck
  • Topic Starter

  • Members
  • 11 posts
  • OFFLINE
  •  
  • Local time:09:42 AM

Posted 23 June 2010 - 09:20 AM

So i tried that, and this morning i'm met with this jewel:
all typed information is bolded so it doesn't get lost in the other ish


Microsoft ® Windows Debugger Version 6.12.0002.633 X86
Copyright © Microsoft Corporation. All rights reserved.


Loading Dump File [C:\WINDOWS\Minidump\Mini062310-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows XP Kernel Version 2600 (Service Pack 3) MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 2600.xpsp_sp3_gdr.100216-1514
Machine Name:
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055d720
Debug session time: Wed Jun 23 09:03:24.796 2010 (UTC - 5:00)
System Uptime: 0 days 0:01:21.406
Loading Kernel Symbols
...............................................................
................................................................
.................
Loading User Symbols
Loading unloaded module list
..........
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 4E, {2, 1eeb1, 7fedf, 1}

*** WARNING: Unable to verify timestamp for SiWinAcc.sys
*** ERROR: Module load completed but symbols could not be loaded for SiWinAcc.sys
Probably caused by : memory_corruption ( nt!MiUnlinkPageFromList+40 )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

PFN_LIST_CORRUPT (4e)
Typically caused by drivers passing bad memory descriptor lists (ie: calling
MmUnlockPages twice with the same list, etc). If a kernel debugger is
available get the stack trace.
Arguments:
Arg1: 00000002, A list entry was corrupt
Arg2: 0001eeb1, entry in list being removed
Arg3: 0007fedf, highest physical page number
Arg4: 00000001, reference count of entry being removed

Debugging Details:
------------------


BUGCHECK_STR: 0x4E_2

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: DRIVER_FAULT

PROCESS_NAME: svchost.exe

LAST_CONTROL_TRANSFER: from 80521c54 to 804f9f43

STACK_TEXT:
a1181560 80521c54 0000004e 00000002 0001eeb1 nt!KeBugCheckEx+0x1b
a1181588 8050efe9 8a338938 87023da8 89edb470 nt!MiUnlinkPageFromList+0x40
a118165c 8050fab0 e1c3b000 e1c84400 e1c408b8 nt!MiFlushSectionInternal+0x353
a1181698 804e439b 8a338968 00000000 00000000 nt!MmFlushSection+0x1f2
a1181720 b7e411f3 8a3421ac 00000000 00000000 nt!CcFlushCache+0x1e7
a118174c b7e449d0 88062858 e17c6d90 00000000 Ntfs!NtfsFlushUserStream+0x6c
a11817d0 b7e44d28 88062858 8a351100 00000001 Ntfs!NtfsFlushVolume+0x22a
a1181870 b7e3203b 88062858 870e2b50 a1180000 Ntfs!NtfsCommonVolumeOpen+0x341
a118194c 804ef19f 8a351020 870e2b50 8702d990 Ntfs!NtfsFsdCreate+0x14d
a118195c b7eaa876 00000000 8a267968 870e2b50 nt!IopfCallDriver+0x31
a11819a8 804ef19f 8a292c80 00000001 8a295030 sr!SrCreate+0x150
a11819b8 b84bc4ba a11819ec b84bccc4 8a320ae8 nt!IopfCallDriver+0x31
WARNING: Stack unwind information not available. Following frames may be wrong.
a11819c0 b84bccc4 8a320ae8 870e2b50 89f39a98 SiWinAcc+0x4ba
a11819ec 804ef19f 8a320ae8 8a292bc8 870e2b50 SiWinAcc+0xcc4
a11819fc b7ebae9b 00000000 870e2b50 870e2d4c nt!IopfCallDriver+0x31
a1181a20 b7ec7754 a1181a40 88054ee8 00000000 fltmgr!FltpLegacyProcessingAfterPreCallbacksCompleted+0x20b
a1181a5c 804ef19f 88054ee8 870e2b50 870e2b50 fltmgr!FltpCreate+0x26a
a1181a6c 805831fa 8a333758 86cbadac a1181c04 nt!IopfCallDriver+0x31
a1181b4c 805bf434 8a333770 00000000 86cbad08 nt!IopParseDevice+0xa12
a1181bc4 805bb9c0 00000000 a1181c04 00000040 nt!ObpLookupObjectName+0x53c
a1181c18 80576033 00000000 00000000 ec686701 nt!ObOpenObjectByName+0xea
a1181c94 805769aa 0241f7bc 80100080 0241f75c nt!IopCreateFile+0x407
a1181cf0 805790b4 0241f7bc 80100080 0241f75c nt!IoCreateFile+0x8e
a1181d30 8054163c 0241f7bc 80100080 0241f75c nt!NtCreateFile+0x30
a1181d30 7c90e514 0241f7bc 80100080 0241f75c nt!KiFastCallEntry+0xfc
0241f7b4 00000000 00000000 00000000 00000000 0x7c90e514


STACK_COMMAND: kb

FOLLOWUP_IP:
nt!MiUnlinkPageFromList+40
80521c54 8b460c mov eax,dword ptr [esi+0Ch]

SYMBOL_STACK_INDEX: 1

SYMBOL_NAME: nt!MiUnlinkPageFromList+40

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nt

DEBUG_FLR_IMAGE_TIMESTAMP: 4b7a9cac

IMAGE_NAME: memory_corruption

FAILURE_BUCKET_ID: 0x4E_2_nt!MiUnlinkPageFromList+40

BUCKET_ID: 0x4E_2_nt!MiUnlinkPageFromList+40

Followup: MachineOwner
---------



here's the event from BlueScreenView:

==================================================
Dump File : Mini062310-01.dmp
Crash Time : 6/23/2010 9:05:20 AM
Bug Check String : PFN_LIST_CORRUPT
Bug Check Code : 0x0000004e
Parameter 1 : 0x00000002
Parameter 2 : 0x0001eeb1
Parameter 3 : 0x0007fedf
Parameter 4 : 0x00000001
Caused By Driver : ntoskrnl.exe
Caused By Address : ntoskrnl.exe+22f43
File Description : NT Kernel & System
Product Name : Microsoft® Windows® Operating System
Company : Microsoft Corporation
File Version : 5.1.2600.5938 (xpsp_sp3_gdr.100216-1514)
Processor : 32-bit
Computer Name :
Full Path : C:\WINDOWS\Minidump\Mini062310-01.dmp
Processors Count : 2
Major Version : 15
Minor Version : 2600
==================================================

and lastly, the information from the eventviewer

Event Type: Error
Event Source: System Error
Event Category: (102)
Event ID: 1003
Date: 6/23/2010
Time: 9:05:59 AM
User: N/A
Computer: ELLIOT
Description:
Error code 0000004e, parameter1 00000002, parameter2 0001eeb1, parameter3 0007fedf, parameter4 00000001.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 53 79 73 74 65 6d 20 45 System E
0008: 72 72 6f 72 20 20 45 72 rror Er
0010: 72 6f 72 20 63 6f 64 65 ror code
0018: 20 30 30 30 30 30 30 34 0000004
0020: 65 20 20 50 61 72 61 6d e Param
0028: 65 74 65 72 73 20 30 30 eters 00
0030: 30 30 30 30 30 32 2c 20 000002,
0038: 30 30 30 31 65 65 62 31 0001eeb1
0040: 2c 20 30 30 30 37 66 65 , 0007fe
0048: 64 66 2c 20 30 30 30 30 df, 0000
0050: 30 30 30 31 0001

------------------------------------------------------------------ plus
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7031
Date: 6/23/2010
Time: 9:06:31 AM
User: N/A
Computer: ELLIOT
Description:
The Remote Procedure Call (RPC) service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Reboot the machine.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

and lastly
Event Type: Error
Event Source: Application Error
Event Category: (100)
Event ID: 1000
Date: 6/23/2010
Time: 9:06:28 AM
User: N/A
Computer: ELLIOT
Description:
Faulting application svchost.exe, version 5.1.2600.5512, faulting module rpcss.dll, version 5.1.2600.5755, fault address 0x0000cc34.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 41 70 70 6c 69 63 61 74 Applicat
0008: 69 6f 6e 20 46 61 69 6c ion Fail
0010: 75 72 65 20 20 73 76 63 ure svc
0018: 68 6f 73 74 2e 65 78 65 host.exe
0020: 20 35 2e 31 2e 32 36 30 5.1.260
0028: 30 2e 35 35 31 32 20 69 0.5512 i
0030: 6e 20 72 70 63 73 73 2e n rpcss.
0038: 64 6c 6c 20 35 2e 31 2e dll 5.1.
0040: 32 36 30 30 2e 35 37 35 2600.575
0048: 35 20 61 74 20 6f 66 66 5 at off
0050: 73 65 74 20 30 30 30 30 set 0000
0058: 63 63 33 34 cc34

#13 lostduck

lostduck
  • Topic Starter

  • Members
  • 11 posts
  • OFFLINE
  •  
  • Local time:09:42 AM

Posted 25 June 2010 - 09:05 AM

Anymore possible ideas? It happened again this morning. At this point, I'm about ready to turn this bleeping computer into a fully-functioning bleeping boat anchor.

(I get roughly 2 BSODs a day -- thankfully none have come during online testing)

#14 joseibarra

joseibarra

  • Members
  • 1,258 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:Downstairs
  • Local time:10:42 AM

Posted 25 June 2010 - 06:36 PM

Do you have Daemon Tools installed?

If yes, would it be a terrible burden to uninstall Daemon Tools, reboot and try your system again?

Is your system using SATA drives and if yes, are the drivers up to date?

Any Panda products?

L-o-o-o-n-g shot! (after some Googling)

Edited by joseibarra, 25 June 2010 - 08:25 PM.

The mediocre teacher tells. The good teacher explains. The superior teacher demonstrates.


#15 hamluis

hamluis

    Moderator


  • Moderator
  • 56,277 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:Killeen, TX
  • Local time:09:42 AM

Posted 25 June 2010 - 06:55 PM

How about a hard drive diagnostic?

You could also look at all Event Viewer errors...looking for a pattern. Those .dmp files indicate a problem but don't really provide any clues as to cause.

You've eliminated RAM...that only leaves everything else vital.

Louis




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users