Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Blue Screen, Would like to know cause


  • Please log in to reply
5 replies to this topic

#1 Nyt Wolf

Nyt Wolf

  • Members
  • 3 posts
  • OFFLINE
  •  
  • Local time:02:00 PM

Posted 11 July 2012 - 11:46 AM

I am working on a computer remote that is blue screening. It is used only as a billboard type display. It's is running Windows XP and only two pieces of software run on it at all times: VNC and PowerPoint.

I have transferred the memory dump to my local computer and am debugging it here. It is a Windows 7 computer. I am unsure if this will affect the outcome of the debugger. I followed the advice on how to run the debugger using this web page:
http://www.bleepingcomputer.com/forums/topic176011.html

Here is the result of the debug:

Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\User\Desktop\Mini071112-02.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows XP Kernel Version 2600 (Service Pack 3) MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 2600.xpsp_sp3_gdr.120504-1619
Machine Name:
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055d720
Debug session time: Wed Jul 11 10:35:27.185 2012 (UTC - 5:00)
System Uptime: 0 days 0:02:59.781
Loading Kernel Symbols
...............................................................
....................................................
Loading User Symbols
Loading unloaded module list
.......
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 10000050, {ffe253ab, 0, f7390deb, 0}

Unable to load image ati2mtag.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ati2mtag.sys
*** ERROR: Module load completed but symbols could not be loaded for ati2mtag.sys

Could not read faulting driver name
*** WARNING: Unable to verify timestamp for ati2cqag.dll
*** ERROR: Module load completed but symbols could not be loaded for ati2cqag.dll
Probably caused by : pci.sys ( pci!PciExternalReadDeviceConfig+85 )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced.  This cannot be protected by try-except,
it must be protected by a Probe.  Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: ffe253ab, memory referenced.
Arg2: 00000000, value 0 = read operation, 1 = write operation.
Arg3: f7390deb, If non-zero, the instruction address which referenced the bad memory
	address.
Arg4: 00000000, (reserved)

Debugging Details:
------------------


Could not read faulting driver name

READ_ADDRESS:  ffe253ab 

FAULTING_IP: 
pci!PciExternalReadDeviceConfig+85
f7390deb f3a5            rep movs dword ptr es:[edi],dword ptr [esi]

MM_INTERNAL_CODE:  0

CUSTOMER_CRASH_COUNT:  2

DEFAULT_BUCKET_ID:  DRIVER_FAULT

BUGCHECK_STR:  0x50

PROCESS_NAME:  bomgar-scc.exe

LAST_CONTROL_TRANSFER:  from f7393c28 to f7390deb

STACK_TEXT:  
aae254b0 f7393c28 86f8bc90 aae255cc ffffffff pci!PciExternalReadDeviceConfig+0x85
aae254d4 f7390323 86f8bc90 00000000 aae255cc pci!PciReadDeviceSpace+0x5e
aae254f4 f6cad1a2 86f8bc90 00000000 aae255cc pci!PciPnpReadConfig+0x1d
aae25510 f6ccbfd4 86e59350 00000004 00000000 VIDEOPRT!VideoPortGetBusData+0x3a
WARNING: Stack unwind information not available. Following frames may be wrong.
aae2554c f6e18f31 86e59350 aae25568 00000004 ati2mtag+0xbfd4
aae255a8 f6e11f6a 86e62c90 00000000 ffffffff ati2mtag+0x158f31
aae255d0 f6e12935 86e62c90 00000010 86e62c90 ati2mtag+0x151f6a
aae255ec f6e11895 86e62c90 00000000 00000001 ati2mtag+0x152935
aae25630 f6e11969 86e62c90 86e62da8 00000200 ati2mtag+0x151895
aae25660 f6cca44f e177b820 86e59350 86e59350 ati2mtag+0x151969
aae25674 f6ccb019 86e59350 00000000 e5000c00 ati2mtag+0xa44f
aae25688 bf08ceb7 86e59350 86e59350 aae256b0 ati2mtag+0xb019
aae2568c 86e59350 86e59350 aae256b0 7fffffff ati2cqag+0x2aeb7
aae25690 86e59350 aae256b0 7fffffff e4e00000 0x86e59350
aae25694 aae256b0 7fffffff e4e00000 e4e00414 0x86e59350
aae25698 7fffffff e4e00000 e4e00414 00000000 0xaae256b0
aae256b0 aae256bc aae2581c 00000160 00007e00 0x7fffffff
aae256b4 aae2581c 00000160 00007e00 0c000000 0xaae256bc
aae256bc 00000000 0c000000 0bbdc000 c0000000 0xaae2581c


STACK_COMMAND:  kb

FOLLOWUP_IP: 
pci!PciExternalReadDeviceConfig+85
f7390deb f3a5            rep movs dword ptr es:[edi],dword ptr [esi]

SYMBOL_STACK_INDEX:  0

SYMBOL_NAME:  pci!PciExternalReadDeviceConfig+85

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: pci

IMAGE_NAME:  pci.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  480252bb

FAILURE_BUCKET_ID:  0x50_pci!PciExternalReadDeviceConfig+85

BUCKET_ID:  0x50_pci!PciExternalReadDeviceConfig+85

Followup: MachineOwner
---------


BC AdBot (Login to Remove)

 


#2 hamluis

hamluis

    Moderator


  • Moderator
  • 55,414 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:Killeen, TX
  • Local time:02:00 PM

Posted 11 July 2012 - 12:11 PM

http://www.bomgar.com/docs/content/support/ports-firewalls.htm

I would disable the above, uninstall any related software...and see if the problems continue.

I would also uninstall/reinstall the video drivers.

Louis

#3 Nyt Wolf

Nyt Wolf
  • Topic Starter

  • Members
  • 3 posts
  • OFFLINE
  •  
  • Local time:02:00 PM

Posted 11 July 2012 - 12:14 PM

That is our remote desktop software. It has blue screened since I've been connected to the computer, but has also blue screened before I connected. Before I connect, this software does not run on the computer, it is pushed from a server when logging in, then is removed when I disconnect.

#4 hamluis

hamluis

    Moderator


  • Moderator
  • 55,414 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:Killeen, TX
  • Local time:02:00 PM

Posted 11 July 2012 - 12:25 PM

Just giving you my best guess...

Louis

#5 Nyt Wolf

Nyt Wolf
  • Topic Starter

  • Members
  • 3 posts
  • OFFLINE
  •  
  • Local time:02:00 PM

Posted 11 July 2012 - 12:27 PM

Which is much appreciated! I didn't mean to come off sounding negative. I'm sure in that case that particular process was the culprit. Could I confidently deduce there is probably an issue with RAM?

#6 hamluis

hamluis

    Moderator


  • Moderator
  • 55,414 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:Killeen, TX
  • Local time:02:00 PM

Posted 11 July 2012 - 01:59 PM

Well...you posted one error message. I would say that it's dangerous to deduce anything coclusively...based on one BSOD error message.

It uaually is a pattern of some sort...which provides any real clues...and a pattern cannot be deduced from one error message, IMO.

If you have had more than one STOP error...I would suggest that you try the following:

Download/install BlueScreenView, http://www.nirsoft.net/utils/blue_screen_view.html .

Double-click BlueScreenView.exe file.

When autoscan is done (screen comes up), click Edit/Select All...then File/Save Selected Items.

Save the report as BSOD.txt.

Open BSOD.txt, copy all content and paste it into your next reply.

Louis




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users