Dump data of BSOD 0xc0000005

I can't find out the cause of this frequent BSOD on a Dell SX270 desktop.
Both 256MB Ram modules have been tested OK with 18 passes of Memtest.

Here is the log ^^:
Opened log file 'c:\debuglog.txt'

Microsoft (R) Windows Debugger Version 6.8.0004.0 X86
Copyright (c) Microsoft Corporation. All rights reserved.

Loading Dump File [D:\MEMORY.DMP]
Kernel Complete Dump File: Full address space is available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: D:\WINDOWS;D:\WINDOWS\system32;D:\WINDOWS\system32\drivers
Windows XP Kernel Version 2600 (Service Pack 2) UP Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 2600.xpsp_sp2_gdr.070227-2254
Kernel base = 0x804d7000 PsLoadedModuleList = 0x805624a0
Debug session time: Fri Feb 29 09:53:07.856 2008 (GMT+1)
System Uptime: 0 days 0:39:38.805
Loading Kernel Symbols
....................................................................................................................
Loading User Symbols
..................................................................................................................................................................
Loading unloaded module list
................................
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 8E, {c0000005, f8928a30, eebdacb0, 0}

*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: kernel32!pNlsUserInfo ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: kernel32!pNlsUserInfo ***
*** ***
*************************************************************************
Probably caused by : ntkrnlmp.exe ( nt!KiDispatchException+3b1 )

Followup: MachineOwner
---------

kd> !analyze -v;r;kv;lmtn;.logclose;q
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

KERNEL_MODE_EXCEPTION_NOT_HANDLED (8e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003. This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG. This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG. This will let us see why this breakpoint is
happening.
Arguments:
Arg1: c0000005, The exception code that was not handled
Arg2: f8928a30, The address that the exception occurred at
Arg3: eebdacb0, Trap Frame
Arg4: 00000000

Debugging Details:
------------------
************************************************************************

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - L'instruction "0x%08lx" emploie l'adresse m moire "0x%08lx ". La m moire ne peut pas tre "%s ".

FAULTING_IP:
+fffffffff8928a30
f8928a30 033e add edi,dword ptr [esi]

TRAP_FRAME: eebdacb0 -- (.trap 0xffffffffeebdacb0)
.trap 0xffffffffeebdacb0
ErrCode = 00000000
eax=01ca6cf8 ebx=00000000 ecx=f8928927 edx=00000000 esi=01cb56da edi=0000e9e2
eip=f8928a30 esp=eebdad24 ebp=eebdad30 iopl=0 nv up ei pl nz na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010206
f8928a30 033e add edi,dword ptr [esi] ds:0023:01cb56da=????????
.trap
Resetting default scope

DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: 0x8E

PROCESS_NAME: svchost.exe

LAST_CONTROL_TRANSFER: from 80521fed to 8053738a

STACK_TEXT:
eebda878 80521fed 0000008e c0000005 f8928a30 nt!KeBugCheckEx+0x1b
eebdac40 804de403 eebdac5c 00000000 eebdacb0 nt!KiDispatchException+0x3b1
eebdaca8 804de3b4 eebdad30 f8928a30 badb0d00 nt!CommonDispatchException+0x4d
eebdacc0 804e84cc 00000000 00000001 00000000 nt!Kei386EoiHelper+0x18a
eebdad30 804dd99f 00000224 00000000 00000000 nt!KeReleaseMutex+0x14
eebdad30 7c91eb94 00000224 00000000 00000000 nt!KiFastCallEntry+0xfc
00eefab4 7c91df6a 74ff3240 00000224 00000000 ntdll!KiFastSystemCallRet
00eefab8 74ff3240 00000224 00000000 00000000 ntdll!ZwQueryDirectoryFile+0xc
00eefb00 74fef935 01c9b120 01ca4008 00000001 trkwks!CObjIdEnumerator::Find+0xae
00eefb1c 74fefe57 01c9b120 01ca4008 00000000 trkwks!CAllVolumesObjIdEnumerator::FindFirstOnVolume+0x34
00eefb44 74ff0d74 0035d3e0 01c9b120 01ca4008 trkwks!CAllVolumesObjIdEnumerator::FindFirst+0x3c
00eefdb8 74fe75ab 91ec89d0 01c87ab0 00278d00 trkwks!CTrkWksSvc::OnRefreshTimeout+0x133
00eefe08 74fe3a8d 00000006 0035d570 74fe14d4 trkwks!CVolumeManager::Timer+0xe4
00eefe54 74fe1512 0035d570 74fe14d4 00000000 trkwks!CNewTimer:oWork+0x62
00eefe8c 7c937911 0035d570 000f1000 000f10f0 trkwks!ThreadPoolCallbackFunction+0x52
00eefed8 7c948785 74fe14d4 0035d570 000f1000 ntdll!RtlpWaitOrTimerCallout+0x73
00eefef8 7c937545 000f10f0 7c98c3a0 067e5e48 ntdll!RtlpAsyncWaitCallbackCompletion+0x25
00eeff40 7c937583 7c948760 000f10f0 00000000 ntdll!RtlpWorkerCallout+0x70
00eeff60 7c937645 00000000 000f10f0 067e5e48 ntdll!RtlpExecuteWorkerRequest+0x1a
00eeff74 7c93761c 7c937569 00000000 000f10f0 ntdll!RtlpApcCallout+0x11
00eeffb4 7c80b683 00000000 00000000 7ffdcc00 ntdll!RtlpWorkerThread+0x87
00eeffec 00000000 7c920760 00000000 00000000 kernel32!BaseThreadStart+0x37


STACK_COMMAND: kb

FOLLOWUP_IP:
nt!KiDispatchException+3b1
80521fed cc int 3

SYMBOL_STACK_INDEX: 1

SYMBOL_NAME: nt!KiDispatchException+3b1

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nt

IMAGE_NAME: ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP: 45e54690

FAILURE_BUCKET_ID: 0x8E_nt!KiDispatchException+3b1

BUCKET_ID: 0x8E_nt!KiDispatchException+3b1

Followup: MachineOwner
---------

eax=ffdff13c ebx=f8928a30 ecx=00000000 edx=804dc0f4 esi=eebdac5c edi=00000000
eip=8053738a esp=eebda860 ebp=eebda878 iopl=0 nv up ei ng nz na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00000286
nt!KeBugCheckEx+0x1b:
8053738a 5d pop ebp
ChildEBP RetAddr Args to Child
eebda878 80521fed 0000008e c0000005 f8928a30 nt!KeBugCheckEx+0x1b (FPO: [Non-Fpo])
eebdac40 804de403 eebdac5c 00000000 eebdacb0 nt!KiDispatchException+0x3b1 (FPO: [Non-Fpo])
eebdaca8 804de3b4 eebdad30 f8928a30 badb0d00 nt!CommonDispatchException+0x4d (FPO: [0,20,0])
eebdacc0 804e84cc 00000000 00000001 00000000 nt!Kei386EoiHelper+0x18a
eebdad30 804dd99f 00000224 00000000 00000000 nt!KeReleaseMutex+0x14 (FPO: [Non-Fpo])
eebdad30 7c91eb94 00000224 00000000 00000000 nt!KiFastCallEntry+0xfc (FPO: [0,0] TrapFrame @ eebdad64)
00eefab4 7c91df6a 74ff3240 00000224 00000000 ntdll!KiFastSystemCallRet (FPO: [0,0,0])
00eefab8 74ff3240 00000224 00000000 00000000 ntdll!ZwQueryDirectoryFile+0xc (FPO: [11,0,0])
00eefb00 74fef935 01c9b120 01ca4008 00000001 trkwks!CObjIdEnumerator::Find+0xae (FPO: [Non-Fpo])
00eefb1c 74fefe57 01c9b120 01ca4008 00000000 trkwks!CAllVolumesObjIdEnumerator::FindFirstOnVolume+0x34 (FPO: [Non-Fpo])
00eefb44 74ff0d74 0035d3e0 01c9b120 01ca4008 trkwks!CAllVolumesObjIdEnumerator::FindFirst+0x3c (FPO: [Non-Fpo])
00eefdb8 74fe75ab 91ec89d0 01c87ab0 00278d00 trkwks!CTrkWksSvc::OnRefreshTimeout+0x133 (FPO: [Non-Fpo])
00eefe08 74fe3a8d 00000006 0035d570 74fe14d4 trkwks!CVolumeManager::Timer+0xe4 (FPO: [Non-Fpo])
00eefe54 74fe1512 0035d570 74fe14d4 00000000 trkwks!CNewTimer:oWork+0x62 (FPO: [Non-Fpo])
00eefe8c 7c937911 0035d570 000f1000 000f10f0 trkwks!ThreadPoolCallbackFunction+0x52 (FPO: [Non-Fpo])
00eefed8 7c948785 74fe14d4 0035d570 000f1000 ntdll!RtlpWaitOrTimerCallout+0x73 (FPO: [Non-Fpo])
00eefef8 7c937545 000f10f0 7c98c3a0 067e5e48 ntdll!RtlpAsyncWaitCallbackCompletion+0x25 (FPO: [Non-Fpo])
00eeff40 7c937583 7c948760 000f10f0 00000000 ntdll!RtlpWorkerCallout+0x70 (FPO: [Non-Fpo])
00eeff60 7c937645 00000000 000f10f0 067e5e48 ntdll!RtlpExecuteWorkerRequest+0x1a (FPO: [Non-Fpo])
00eeff74 7c93761c 7c937569 00000000 000f10f0 ntdll!RtlpApcCallout+0x11 (FPO: [Non-Fpo])
Closing open log file c:\debuglog.txt

 

Thanks for these answers

I will test the RAM modules your way and post the results back here.

Since my first post I've experienced another of these BSOD: here is the minidump analysis log with correct symbols ;-)



Microsoft (R) Windows Debugger Version 6.8.0004.0 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [D:\Documents and Settings\All Users\Documents\Mini030108-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows XP Kernel Version 2600 (Service Pack 2) UP Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 2600.xpsp_sp2_gdr.070227-2254
Kernel base = 0x804d7000 PsLoadedModuleList = 0x805624a0
Debug session time: Fri Feb 29 23:48:17.974 2008 (GMT+1)
System Uptime: 0 days 1:15:13.234
Loading Kernel Symbols
..................................................................................................................
Loading User Symbols
Loading unloaded module list
...............
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1000008E, {c0000005, f8928a30, ef238cb0, 0}



Probably caused by : ntkrnlmp.exe ( nt!KiFastCallEntry+fc )

Followup: MachineOwner
---------

kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

KERNEL_MODE_EXCEPTION_NOT_HANDLED_M (1000008e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003. This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG. This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG. This will let us see why this breakpoint is
happening.
Arguments:
Arg1: c0000005, The exception code that was not handled
Arg2: f8928a30, The address that the exception occurred at
Arg3: ef238cb0, Trap Frame
Arg4: 00000000

Debugging Details:
------------------




EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - L'instruction "0x%08lx" emploie l'adresse m moire "0x%08lx ". La m moire ne peut pas tre "%s ".

FAULTING_IP:
+fffffffff8928a30
f8928a30 033e add edi,dword ptr [esi]

TRAP_FRAME: ef238cb0 -- (.trap 0xffffffffef238cb0)
ErrCode = 00000000
eax=01b45910 ebx=00000000 ecx=f8928927 edx=00000000 esi=01b542f2 edi=0000e9e2
eip=f8928a30 esp=ef238d24 ebp=ef238d30 iopl=0 nv up ei pl nz na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010206
f8928a30 033e add edi,dword ptr [esi] ds:0023:01b542f2=????????
Resetting default scope

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: 0x8E

PROCESS_NAME: svchost.exe

LAST_CONTROL_TRANSFER: from 804dd99f to f8928a30

STACK_TEXT:
WARNING: Frame IP not in any known module. Following frames may be wrong.
ef238d30 804dd99f 00000554 00000000 00000000 0xf8928a30
ef238d30 7c91eb94 00000554 00000000 00000000 nt!KiFastCallEntry+0xfc
00eafb00 00000000 00000000 00000000 00000000 0x7c91eb94


STACK_COMMAND: kb

FOLLOWUP_IP:
nt!KiFastCallEntry+fc
804dd99f 8be5 mov esp,ebp

SYMBOL_STACK_INDEX: 1

SYMBOL_NAME: nt!KiFastCallEntry+fc

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nt

IMAGE_NAME: ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP: 45e54690

FAILURE_BUCKET_ID: 0x8E_nt!KiFastCallEntry+fc

BUCKET_ID: 0x8E_nt!KiFastCallEntry+fc

Followup: MachineOwner
---------

kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

KERNEL_MODE_EXCEPTION_NOT_HANDLED_M (1000008e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003. This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG. This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG. This will let us see why this breakpoint is
happening.
Arguments:
Arg1: c0000005, The exception code that was not handled
Arg2: f8928a30, The address that the exception occurred at
Arg3: ef238cb0, Trap Frame
Arg4: 00000000

Debugging Details:
------------------




EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - L'instruction "0x%08lx" emploie l'adresse m moire "0x%08lx ". La m moire ne peut pas tre "%s ".

FAULTING_IP:
+fffffffff8928a30
f8928a30 033e add edi,dword ptr [esi]

TRAP_FRAME: ef238cb0 -- (.trap 0xffffffffef238cb0)
ErrCode = 00000000
eax=01b45910 ebx=00000000 ecx=f8928927 edx=00000000 esi=01b542f2 edi=0000e9e2
eip=f8928a30 esp=ef238d24 ebp=ef238d30 iopl=0 nv up ei pl nz na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010206
f8928a30 033e add edi,dword ptr [esi] ds:0023:01b542f2=????????
Resetting default scope

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: 0x8E

PROCESS_NAME: svchost.exe

LAST_CONTROL_TRANSFER: from 804dd99f to f8928a30

STACK_TEXT:
WARNING: Frame IP not in any known module. Following frames may be wrong.
ef238d30 804dd99f 00000554 00000000 00000000 0xf8928a30
ef238d30 7c91eb94 00000554 00000000 00000000 nt!KiFastCallEntry+0xfc
00eafb00 00000000 00000000 00000000 00000000 0x7c91eb94


STACK_COMMAND: kb

FOLLOWUP_IP:
nt!KiFastCallEntry+fc
804dd99f 8be5 mov esp,ebp

SYMBOL_STACK_INDEX: 1

SYMBOL_NAME: nt!KiFastCallEntry+fc

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nt

IMAGE_NAME: ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP: 45e54690

FAILURE_BUCKET_ID: 0x8E_nt!KiFastCallEntry+fc

BUCKET_ID: 0x8E_nt!KiFastCallEntry+fc

Followup: MachineOwner