Jump to content


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.

Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.


The Dreaded Blue Screen Of Death

  • Please log in to reply
2 replies to this topic

#1 MadDawg


  • Members
  • 453 posts
  • Gender:Male
  • Location:Houston, TX
  • Local time:03:19 PM

Posted 13 July 2007 - 11:31 PM

This isn't the first time I've had one of these, and I need some help.

Here's my analysis:

Microsoft ® Windows Debugger Version 6.7.0005.0
Copyright © Microsoft Corporation. All rights reserved.

Loading Dump File [C:\WINDOWS\MEMORY.DMP]
Kernel Complete Dump File: Full address space is available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols

Executable search path is:
Windows XP Kernel Version 2600 (Service Pack 2) UP Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 2600.xpsp_sp2_gdr.070227-2254
Kernel base = 0x804d7000 PsLoadedModuleList = 0x805533a0
Debug session time: Fri Jul 13 22:37:37.390 2007 (GMT-5)
System Uptime: 0 days 3:11:14.958
Loading Kernel Symbols
Loading User Symbols
Loading unloaded module list
* *
* Bugcheck Analysis *
* *

Use !analyze -v to get detailed debugging information.

BugCheck 8E, {c0000005, bf80236a, ee081bd4, 0}

*** WARNING: Unable to verify timestamp for BRSkypePlugin.dll
*** ERROR: Module load completed but symbols could not be loaded for BRSkypePlugin.dll
Probably caused by : win32k.sys ( win32k!AllocQEntry+3f )

Followup: MachineOwner

kd> !analyze -v
* *
* Bugcheck Analysis *
* *

This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003. This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG. This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG. This will let us see why this breakpoint is
Arg1: c0000005, The exception code that was not handled
Arg2: bf80236a, The address that the exception occurred at
Arg3: ee081bd4, Trap Frame
Arg4: 00000000

Debugging Details:

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx". The memory could not be "%s".

bf80236a f3ab rep stos dword ptr es:[edi]

TRAP_FRAME: ee081bd4 -- (.trap 0xffffffffee081bd4)
ErrCode = 00000003
eax=00000000 ebx=e28c3788 ecx=0000000c edx=00610074 esi=e28c3788 edi=00610074
eip=bf80236a esp=ee081c48 ebp=ee081c50 iopl=0 nv up ei pl zr na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010246
bf80236a f3ab rep stos dword ptr es:[edi] es:0023:00610074=000c0100
Resetting default scope



PROCESS_NAME: Communications_

LAST_CONTROL_TRANSFER: from 804fcb3f to 804f8aef

ee08179c 804fcb3f 0000008e c0000005 bf80236a nt!KeBugCheckEx+0x1b
ee081b64 8053d471 ee081b80 00000000 ee081bd4 nt!KiDispatchException+0x3b1
ee081bcc 8053d422 ee081c50 bf80236a badb0d00 nt!CommonDispatchException+0x4d
ee081c50 bf808a6d e28c3788 0000c295 bbedeb90 nt!Kei386EoiHelper+0x18a
ee081c50 bf808a6d e28c3788 0000c295 bbedeb90 win32k!_PostMessage+0x14a
ee081c78 bf89d982 00000000 0000c295 000105ba win32k!_PostMessage+0x14a
ee081cf4 bf808937 00000000 0000c295 000105ba win32k!xxxBroadcastMessage+0x39a
ee081d30 bf808b66 ffffffff 0000c295 000105ba win32k!_PostMessage+0x49
ee081d4c 8053ca28 0000ffff 0000c295 000105ba win32k!NtUserPostMessage+0x5a
ee081d4c 7c90eb94 0000ffff 0000c295 000105ba nt!KiFastCallEntry+0xf8
01e0fdcc 7e418b8c 7e41cbd4 0000ffff 0000c295 ntdll!KiFastSystemCallRet
01e0fdf0 01c829d2 0000ffff 0000c295 000105ba USER32!NtUserPostMessage+0xc
WARNING: Stack unwind information not available. Following frames may be wrong.
01e0fe08 01c82ae0 00000113 00000070 00000000 BRSkypePlugin+0x129d2
01e0fea8 7e418816 01480fc0 000105ba 00000113 BRSkypePlugin+0x12ae0
01ca4664 000105ba 01ca4664 00001bcc 00000000 USER32!UserCallWinProcCheckWow+0x150
01ca4688 00000000 00000000 00000000 01ca45d8 0x105ba


bf80236a f3ab rep stos dword ptr es:[edi]


SYMBOL_NAME: win32k!AllocQEntry+3f



IMAGE_NAME: win32k.sys


FAILURE_BUCKET_ID: 0x8E_win32k!AllocQEntry+3f

BUCKET_ID: 0x8E_win32k!AllocQEntry+3f

Followup: MachineOwner

I doubt win32k.sys is the problem, as I was doing a Norton AntiVirus scan at the time. My computer has bluescreened several times, though not all, while I was doing a full system scan.

I've had several other bluescreens. Should I post them as different topics, or can I post them here as well?
A penguin broke my windows with a half-eaten apple!

BC AdBot (Login to Remove)


#2 oldf@rt


  • Members
  • 2,609 posts
  • Gender:Male
  • Location:Avondale, Arizona USA
  • Local time:01:19 PM

Posted 14 July 2007 - 12:19 AM

The info you have given seems to point to a defective or corrupt module inside the ccSvcHst.exe file. If you have the original norton CD, My recommendation would be to disconnect from the internet, uninstall all norton products, and then restart your computer. Once you have done this, use the SymNrt (Symantec/Norton) Removal Tool

This will require another restart.

Then you need to re install all norton products again , then after restart, you can re connect to the internet and update your protection.
The name says it all -- 59 and holding permanently

**WARNING** Links I provide might cause brain damage

#3 usasma


    Still visually handicapped (avatar is memory developed by my Dad

  • BSOD Kernel Dump Expert
  • 25,091 posts
  • Gender:Male
  • Location:Southeastern CT, USA
  • Local time:04:19 PM

Posted 15 July 2007 - 06:24 AM

The STOP 0x8e error is a memory access error - so (IMO) the cause could be a number of things.

As oldf@rt has suggested try repairing your Norton products. I'd also suggest uninstalling and reinstalling Skype - as the product doesn't seem to be properly recognized by the debugger and the Skype plugin may be causing some issues.

Also, run an independent virus scan to ensure that the system is clean. Here's 2 free, online scanners:

Finally, you may want to test your memory (the "Arg1: c0000005" generally refers to a memory access error) with this free tool: http://www.memtest86.com/

Additional dump files shouldn't be necessary unless our suggestions don't fix the issue.
My browser caused a flood of traffic, sio my IP address was banned. Hope to fix it soon. Will get back to posting as soon as Im able.

- John  (my website: http://www.carrona.org/ )**If you need a more detailed explanation, please ask for it. I have the Knack. **  If I haven't replied in 48 hours, please send me a message. My eye problems have recently increased and I'm having difficult reading posts. (23 Nov 2017)FYI - I am completely blind in the right eye and ~30% blind in the left eye.<p>If the eye problems get worse suddenly, I may not be able to respond.If that's the case and help is needed, please PM a staff member for assistance.

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users