Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

BSOD


  • Please log in to reply
12 replies to this topic

#1 nyb1234567

nyb1234567

  • Members
  • 8 posts
  • OFFLINE
  •  
  • Local time:02:38 PM

Posted 09 July 2010 - 11:14 PM

Debugging a similar problem:
Using WinDbg 6.11 I looked at the minidumps:

Windows XP Kernel Version 2600 (Service Pack 3) MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Machine Name:
Kernel base = 0x804d7000 PsLoadedModuleList = 0x805634c0
Debug session time: Mon Jun 28 19:05:46.671 2010 (GMT-5)
System Uptime: 5 days 12:29:54.419
Unable to load image ntoskrnl.exe, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
Loading Kernel Symbols
...............................................................
................................................................
................................................................
.........................
Loading User Symbols
Loading unloaded module list
..................................................
*** WARNING: Unable to verify timestamp for hal.dll
Unable to load image fltmgr.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for fltmgr.sys
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1000007E, {c0000005, 8070194f, f78eac30, f78ea92c}

Probably caused by : fltmgr.sys ( fltmgr!FltpDeleteAllStreamListCtrls+62 )

Followup: MachineOwner
---------

1: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

SYSTEM_THREAD_EXCEPTION_NOT_HANDLED_M (1000007e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003. This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG. This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG. This will let us see why this breakpoint is
happening.
Arguments:
Arg1: c0000005, The exception code that was not handled
Arg2: 8070194f, The address that the exception occurred at
Arg3: f78eac30, Exception Record Address
Arg4: f78ea92c, Context Record Address

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx". The memory could not be "%s".

FAULTING_IP:
hal!HalAllocateCommonBuffer+43
8070194f f0ff09 lock dec dword ptr [ecx]

EXCEPTION_RECORD: f78eac30 -- (.exr 0xfffffffff78eac30)
ExceptionAddress: 8070194f (hal!HalAllocateCommonBuffer+0x00000043)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 00000001
Parameter[1]: 00730065
Attempt to write to address 00730065

CONTEXT: f78ea92c -- (.cxr 0xfffffffff78ea92c)
eax=0000003d ebx=86b04c1c ecx=00730065 edx=f78ead28 esi=e5c41998 edi=867a2f58
eip=8070194f esp=f78eacf8 ebp=f78ead08 iopl=0 nv up ei pl nz na po nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00210202
hal!HalAllocateCommonBuffer+0x43:
8070194f f0ff09 lock dec dword ptr [ecx] ds:0023:00730065=????????
Resetting default scope

CUSTOMER_CRASH_COUNT: 1

PROCESS_NAME: System

ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx". The memory could not be "%s".

EXCEPTION_PARAMETER1: 00000001

EXCEPTION_PARAMETER2: 00730065

WRITE_ADDRESS: 00730065

FOLLOWUP_IP:
fltmgr!FltpDeleteAllStreamListCtrls+62
f7473b6c ?? ???

BUGCHECK_STR: 0x7E

DEFAULT_BUCKET_ID: STRING_DEREFERENCE

LAST_CONTROL_TRANSFER: from f7473b6c to 8070194f

STACK_TEXT:
f78ead08 f7473b6c e5c41998 86b049c0 e5c41998 hal!HalAllocateCommonBuffer+0x43
f78ead34 f74750ba 86b049c0 87e2a8c0 865cec38 fltmgr!FltpDeleteAllStreamListCtrls+0x62
f78ead50 f74678f7 86b04a44 00000008 87e2a8c0 fltmgr!FltpFreeVolume+0xa4
f78ead68 f746b64e 865cec38 00000008 8056a5fc fltmgr!FltpCleanupDeviceObject+0x61
f78ead7c 804e23d5 87e2a8c0 00000000 8af31020 fltmgr!FltpFastIoDetachDeviceWorker+0x14
f78eadac 80576316 87e2a8c0 00000000 00000000 nt!_pi_by_2_to_61+0x27
f78eadb0 87e2a8c0 00000000 00000000 00000000 nt!ObAssignObjectSecurityDescriptor+0x8
WARNING: Frame IP not in any known module. Following frames may be wrong.
f78eaddc 804ec6f9 804e2311 00000001 00000000 0x87e2a8c0
00000000 00000000 00000000 00000000 00000000 nt!Magic86400000+0x221


SYMBOL_STACK_INDEX: 1

SYMBOL_NAME: fltmgr!FltpDeleteAllStreamListCtrls+62

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: fltmgr

IMAGE_NAME: fltmgr.sys

DEBUG_FLR_IMAGE_TIMESTAMP: 480251da

STACK_COMMAND: .cxr 0xfffffffff78ea92c ; kb

FAILURE_BUCKET_ID: 0x7E_fltmgr!FltpDeleteAllStreamListCtrls+62

BUCKET_ID: 0x7E_fltmgr!FltpDeleteAllStreamListCtrls+62

Followup: MachineOwner
---------

I had seen a number of forums that mentioned CD-ROM being involved. The reply above talking about a game CD in the drive reminded me that I, too, have had a game disc in my laptop drive for most of the times that the system has BSoD'd. It wasn't Quake 4, but Supreme Commander. I don't think that the game is real pertinent.

The callstack shows it is trying to clean up device objects.

The fltmgr!FltpFreeVolume frame has a pointer to memory (86B04A44 in my case)

Looking at the memory for that shows this nearby:

86b04ce0 00 00 00 00 00 00 00 00 5c 00 54 00 66 00 73 00 ........\.T.f.s.
86b04cf0 43 00 64 00 5c 00 46 00 69 00 6c 00 65 00 53 00 C.d.\.F.i.l.e.S.
86b04d00 79 00 73 00 74 00 65 00 6d 00 5c 00 74 00 66 00 y.s.t.e.m.\.t.f.
86b04d10 73 00 6e 00 69 00 66 00 73 00 5c 00 44 00 65 00 s.n.i.f.s.\.D.e.
86b04d20 76 00 69 00 63 00 65 00 5c 00 43 00 64 00 52 00 v.i.c.e.\.C.d.R.
86b04d30 6f 00 6d 00 30 00 01 00 00 00 00 00 3c 4d b0 86 o.m.0.......<M..

or \TfsCd\FileSystem\tfsnifs\Device\CdRom0

My CD drivers are as up to date.

Any theories?

Edited by hamluis, 10 July 2010 - 12:33 PM.
Split from 2007 thread ~ Hamluis.


BC AdBot (Login to Remove)

 


#2 hamluis

hamluis

    Moderator


  • Moderator
  • 55,727 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Killeen, TX
  • Local time:02:38 PM

Posted 10 July 2010 - 12:39 PM

Hi, I split your post from that 2007 thread. The chances of it being identical to that situation...are pretty small, IMO.

Please download/install BlueScreenView, http://www.nirsoft.net/utils/blue_screen_view.html.

Double-click BlueScreenView.exe file.

When scanning is done, Edit/Select All...then File/Save Selected Items.

Save the report as BSOD.txt.

Open BSOD.txt in Notepad, copy all content and paste it into your next reply.

Also...take a look in Event Viewer and post the details for any error indicating a problem with an optical drive or hard drive.

Louis

#3 nyb1234567

nyb1234567
  • Topic Starter

  • Members
  • 8 posts
  • OFFLINE
  •  
  • Local time:02:38 PM

Posted 10 July 2010 - 10:51 PM

Here are the six BSoDs since April. Four are as I described originally, and two different. I had updated my nvidia drivers after the one nvidia-related bsod.
I don't see any system events that appear related to the CD-ROM.

==================================================
Dump File : Mini070910-01.dmp
Crash Time : 7/9/2010 2:04:49 PM
Bug Check String : SYSTEM_THREAD_EXCEPTION_NOT_HANDLED
Bug Check Code : 0x1000007e
Parameter 1 : 0xc0000005
Parameter 2 : 0x8070194f
Parameter 3 : 0xf78dac30
Parameter 4 : 0xf78da92c
Caused By Driver : hal.dll
Caused By Address : hal.dll+294f
File Description : Hardware Abstraction Layer DLL
Product Name : Microsoft® Windows® Operating System
Company : Microsoft Corporation
File Version : 5.1.2600.5512 (xpsp.080413-2111)
Processor : 32-bit
Computer Name :
Full Path : C:\WINDOWS\Minidump\Mini070910-01.dmp
Processors Count : 2
Major Version : 15
Minor Version : 2600
==================================================

==================================================
Dump File : Mini070710-01.dmp
Crash Time : 7/7/2010 12:20:08 PM
Bug Check String : SYSTEM_THREAD_EXCEPTION_NOT_HANDLED
Bug Check Code : 0x1000007e
Parameter 1 : 0xc0000005
Parameter 2 : 0x8070194f
Parameter 3 : 0xf78eac30
Parameter 4 : 0xf78ea92c
Caused By Driver : hal.dll
Caused By Address : hal.dll+294f
File Description : Hardware Abstraction Layer DLL
Product Name : Microsoft® Windows® Operating System
Company : Microsoft Corporation
File Version : 5.1.2600.5512 (xpsp.080413-2111)
Processor : 32-bit
Computer Name :
Full Path : C:\WINDOWS\Minidump\Mini070710-01.dmp
Processors Count : 2
Major Version : 15
Minor Version : 2600
==================================================

==================================================
Dump File : Mini062810-01.dmp
Crash Time : 6/28/2010 7:07:42 PM
Bug Check String : SYSTEM_THREAD_EXCEPTION_NOT_HANDLED
Bug Check Code : 0x1000007e
Parameter 1 : 0xc0000005
Parameter 2 : 0x8070194f
Parameter 3 : 0xf78eac30
Parameter 4 : 0xf78ea92c
Caused By Driver : hal.dll
Caused By Address : hal.dll+294f
File Description : Hardware Abstraction Layer DLL
Product Name : Microsoft® Windows® Operating System
Company : Microsoft Corporation
File Version : 5.1.2600.5512 (xpsp.080413-2111)
Processor : 32-bit
Computer Name :
Full Path : C:\WINDOWS\Minidump\Mini062810-01.dmp
Processors Count : 2
Major Version : 15
Minor Version : 2600
==================================================

==================================================
Dump File : Mini062210-01.dmp
Crash Time : 6/22/2010 10:19:44 PM
Bug Check String : THREAD_STUCK_IN_DEVICE_DRIVER
Bug Check Code : 0x100000ea
Parameter 1 : 0x87664148
Parameter 2 : 0x86360910
Parameter 3 : 0xf78cecbc
Parameter 4 : 0x00000001
Caused By Driver : nv4_mini.sys
Caused By Address : nv4_mini.sys+7640b
File Description : NVIDIA Compatible Windows 2000 Miniport Driver, Version 178.74
Product Name : NVIDIA Compatible Windows 2000 Miniport Driver, Version 178.74
Company : NVIDIA Corporation
File Version : 6.14.11.7874
Processor : 32-bit
Computer Name :
Full Path : C:\WINDOWS\Minidump\Mini062210-01.dmp
Processors Count : 2
Major Version : 15
Minor Version : 2600
==================================================

==================================================
Dump File : Mini051510-01.dmp
Crash Time : 5/15/2010 8:59:18 AM
Bug Check String : SYSTEM_THREAD_EXCEPTION_NOT_HANDLED
Bug Check Code : 0x1000007e
Parameter 1 : 0xc0000005
Parameter 2 : 0x8070194f
Parameter 3 : 0xf78e6c30
Parameter 4 : 0xf78e692c
Caused By Driver : hal.dll
Caused By Address : hal.dll+294f
File Description : Hardware Abstraction Layer DLL
Product Name : Microsoft® Windows® Operating System
Company : Microsoft Corporation
File Version : 5.1.2600.5512 (xpsp.080413-2111)
Processor : 32-bit
Computer Name :
Full Path : C:\WINDOWS\Minidump\Mini051510-01.dmp
Processors Count : 2
Major Version : 15
Minor Version : 2600
==================================================

==================================================
Dump File : Mini042310-01.dmp
Crash Time : 4/23/2010 7:04:38 PM
Bug Check String : IRQL_NOT_LESS_OR_EQUAL
Bug Check Code : 0x1000000a
Parameter 1 : 0x00000008
Parameter 2 : 0x0000001c
Parameter 3 : 0x00000000
Parameter 4 : 0x804dc6fc
Caused By Driver : ntoskrnl.exe
Caused By Address : ntoskrnl.exe+56fc
File Description : NT Kernel & System
Product Name : Microsoft® Windows® Operating System
Company : Microsoft Corporation
File Version : 5.1.2600.5938 (xpsp_sp3_gdr.100216-1514)
Processor : 32-bit
Computer Name :
Full Path : C:\WINDOWS\Minidump\Mini042310-01.dmp
Processors Count : 2
Major Version : 15
Minor Version : 2600
==================================================

#4 hamluis

hamluis

    Moderator


  • Moderator
  • 55,727 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Killeen, TX
  • Local time:02:38 PM

Posted 11 July 2010 - 08:47 AM

Somewhat Related Thread

I would take the approach that it's a hardware problem, many errors involving hal.dll are just that. To me, that means it could be a driver, could be the hardware itself.

System manufacturer and model?

Can you post the errors (not information items, not warnings) which are reflected in Event Viewer on 7 Jul 10? I'd like the source, Event ID, and description for each.

Louis

#5 nyb1234567

nyb1234567
  • Topic Starter

  • Members
  • 8 posts
  • OFFLINE
  •  
  • Local time:02:38 PM

Posted 11 July 2010 - 09:56 AM

The only Error event on that day is an apparently unrelated service failure.

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7034
Date: 7/7/2010
Time: 5:22:44 PM
User: N/A
Computer: PISTON
Description:
The IBM AFS Client service terminated unexpectedly. It has done this 1 time(s).

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

---------------------------------------------------------------------------

This brings to mind another ongoing issue, which is that of running low on available memory. I have work applications that I am convinced are memory pigs/leakers. Performance metrics regularly show these apps taking up huge memory (virtual and otherwise) footprints. In your estimation, could low memory conditions lead to the hal.dll errors?

System info:
OS Name Microsoft Windows XP Professional
Version 5.1.2600 Service Pack 3 Build 2600
OS Manufacturer Microsoft Corporation
System Manufacturer LENOVO
System Model 6457C34
System Type X86-based PC
Processor x86 Family 6 Model 15 Stepping 11 GenuineIntel ~2394 Mhz
BIOS Version/Date LENOVO xxxxxxxx (2.27 ), 4/8/2010
SMBIOS Version 2.4
Windows Directory C:\WINDOWS
System Directory C:\WINDOWS\system32
Boot Device \Device\HarddiskVolume1
Locale United States
Hardware Abstraction Layer Version = "5.1.2600.5512 (xpsp.080413-2111)"
Total Physical Memory 4,096.00 MB
Available Physical Memory 1.70 GB
Total Virtual Memory 2.00 GB
Available Virtual Memory 1.96 GB
Page File Space 5.84 GB
Page File C:\pagefile.sys

Thanks for the responses, so far.

#6 hamluis

hamluis

    Moderator


  • Moderator
  • 55,727 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Killeen, TX
  • Local time:02:38 PM

Posted 11 July 2010 - 11:18 AM

With 4GB of RAM...you shoulld not be getting low memory notifications.

As for speculation on what hal.dll errors mean...depends on the context...like everything else.

Some are due to file damage, some might be indcative of registry problems, some are indicative of hardware problems...IMO. I don't claim to actually know, just going by the situations that I've seen come up. I also imagine that system overheating can always cause a problem which flags hal.dll as the culprit.

Some Info on Hal.dll Problems

Louis

#7 nyb1234567

nyb1234567
  • Topic Starter

  • Members
  • 8 posts
  • OFFLINE
  •  
  • Local time:02:38 PM

Posted 12 July 2010 - 08:07 PM

Well... just BSoD'd again. Few apps running, so mem was not an issue. I had come out of standby a couple minutes before. No problems until I popped my CD tray out, and popped the Supreme Commander CD in. The drive spun up, and then the system died. Same hal.dll failure as the four other hal failures. I have my CD and USBs set up to not run autorun stuff, so I don't know how it could be specific to this CD. I'll try testing with some other CDs. I'll let you know....

#8 hamluis

hamluis

    Moderator


  • Moderator
  • 55,727 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Killeen, TX
  • Local time:02:38 PM

Posted 12 July 2010 - 08:50 PM

I would try a different drive...and cable.

Louis

#9 nyb1234567

nyb1234567
  • Topic Starter

  • Members
  • 8 posts
  • OFFLINE
  •  
  • Local time:02:38 PM

Posted 13 July 2010 - 11:56 AM

It just died again without a disc in the drive... confirmed same hal.dll failure. I'll see if I can get a new drive. It's a drive that locks into the side media slot.

Thanks for your ideas so far, Louis.

#10 nyb1234567

nyb1234567
  • Topic Starter

  • Members
  • 8 posts
  • OFFLINE
  •  
  • Local time:02:38 PM

Posted 15 July 2010 - 10:44 PM

I haven't had another failure (yet). Since I didn't have cables to check, I reseated the CD drive (Safely Removed it, and then pulled, blew the contacts clear, and re-inserted the drive).
If that was it, it's kind of frustrating that the system didn't call out a bad connection to the CD drive. Time will tell.

Thanks again for the assistance.

Edited by nyb1234567, 15 July 2010 - 10:57 PM.


#11 nyb1234567

nyb1234567
  • Topic Starter

  • Members
  • 8 posts
  • OFFLINE
  •  
  • Local time:02:38 PM

Posted 15 July 2010 - 10:52 PM

For searchability: STOP: 0x0000007E (0xC0000005, 0x8070194F, 0xF78DAC30, 0xF78DA92C)

Edited by nyb1234567, 15 July 2010 - 10:55 PM.


#12 hamluis

hamluis

    Moderator


  • Moderator
  • 55,727 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Killeen, TX
  • Local time:02:38 PM

Posted 16 July 2010 - 08:32 AM

Usually...connection problems result in input/output errors in Event Viewer for a given drive. I'd keep my eye out for a couple of days.

Louis

#13 nyb1234567

nyb1234567
  • Topic Starter

  • Members
  • 8 posts
  • OFFLINE
  •  
  • Local time:02:38 PM

Posted 26 July 2010 - 04:56 PM

Update: No BSoD since reseating the CD drive. However, my laptop battery hard-failed last week. Not sure if that is interesting at all. I had this laptop's battery replaced (due to age/wear) ~ 2 months ago. When calling in on this recent battery fail, the tech said it could be due to a motherboard failure, and we should keep an eye on it. If the new battery dies in next few months, we'll replace the motherboard.

Perhaps this is all related. Don't know.




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users