Unexplained Crashes

Hi,

Despite most of the last 48 hours trying to get the system working I think I've run out of ideas. Any suggestions would be much appreciated.

I'm running XP SP2. When I turn the system on it restarts almost immediately after I logon (usually within 2 minutes). It works well in safe mode but no restore points beyond a couple of days ago seem to exist. When the system does crash in normal startup mode I used the Windows Debugging Tool to have a look at the error messages and get the following ...

BugCheck 1000008E, {c0000005, f5d8cd03, f34dda20, 0}
Probably caused by : ntoskrnl.exe ( nt!PspCreateThread+3e3 )
(ARG3 varies whereas others are consistent between crashes)

Additional fumbling around suggests that the problem is not

1. an Active Virus (scans clean)
2. Video Adaptor (new one installed)
3. Insufficient Memory (plenty GBs free)
4. Caching / Shadowing in BIOS (not on)
5. Services / Startup Options (unchecking in safe mode does not correct)
6. Improper kernel32.dll (replacing it gave rise to a new host of errors)

Any thoughts would be much appreciated.

 

Dump log and analysis from the debugger is below. Thanks for your help.

Executable search path is: c:\windows\i386
Windows XP Kernel Version 2600 (Service Pack 2) UP Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 2600.xpsp_sp2_gdr.050301-1519
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055a420
Debug session time: Sat Nov 4 14:39:25.750 2006 (GMT-8)
System Uptime: 0 days 0:05:54.343
Loading Kernel Symbols
................................................................................
............................................................
Loading User Symbols
Loading unloaded module list
........
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1000008E, {c0000005, f5c0cd03, f1ddea20, 0}

Probably caused by : ntoskrnl.exe ( nt!PspCreateThread+3e3 )

Followup: MachineOwner
---------

kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

KERNEL_MODE_EXCEPTION_NOT_HANDLED_M (1000008e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003. This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG. This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG. This will let us see why this breakpoint is
happening.
Arguments:
Arg1: c0000005, The exception code that was not handled
Arg2: f5c0cd03, The address that the exception occurred at
Arg3: f1ddea20, Trap Frame
Arg4: 00000000

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced
memory at "0x%08lx ". The memory could not be "%s ".

FAULTING_IP:
+fffffffff5c0cd03
f5c0cd03 8a1401 mov dl,byte ptr [ecx+eax]

TRAP_FRAME: f1ddea20 -- (.trap fffffffff1ddea20)
ErrCode = 00000000
eax=00000000 ebx=f5c12ca5 ecx=0101d000 edx=804dd254 esi=00001000 edi=0101c000
eip=f5c0cd03 esp=f1ddea94 ebp=f1ddeaa0 iopl=0 nv up ei pl nz na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010206
f5c0cd03 8a1401 mov dl,byte ptr [ecx+eax] ds:0023:0101d000=??
Resetting default scope

DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: 0x8E

PROCESS_NAME: Windows-KB89083

LAST_CONTROL_TRANSFER: from f5c0ebb3 to f5c0cd03

STACK_TEXT:
WARNING: Frame IP not in any known module. Following frames may be wrong.
f1ddeaa0 f5c0ebb3 0101c000 0000001e f5c12ca5 0xf5c0cd03
f1ddeb78 805f9351 00000ed0 834c28e8 00000001 0xf5c0ebb3
f1ddeb58 f5c0edbc 834c28e8 e100ae28 8351f450 nt!PspCreateThread+0x3e3
f1ddeb78 805f9351 00000ed0 834c28e8 00000001 0xf5c0edbc
f1ddecc4 8057b2a3 00beecbc 001f03ff 00000000 nt!PspCreateThread+0x3e3
f1dded3c 804de7ec 00beecbc 001f03ff 00000000 nt!NtCreateThread+0x118
f1dded3c 7c90eb94 00beecbc 001f03ff 00000000 nt!KiFastCallEntry+0xf8
00bef338 00000000 00000000 00000000 00000000 0x7c90eb94


STACK_COMMAND: kb

FOLLOWUP_IP:
nt!PspCreateThread+3e3
805f9351 57 push edi

SYMBOL_STACK_INDEX: 2

SYMBOL_NAME: nt!PspCreateThread+3e3

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nt

IMAGE_NAME: ntoskrnl.exe

DEBUG_FLR_IMAGE_TIMESTAMP: 42250ff9

FAILURE_BUCKET_ID: 0x8E_nt!PspCreateThread+3e3

BUCKET_ID: 0x8E_nt!PspCreateThread+3e3

Followup: MachineOwner

 

A kernel mode program generated an exception which the error handler didn’t catch. These are nearly always hardware compatibility issues (which sometimes means a driver issue or a need for a BIOS upgrade).

Find the driver that loads in these memory ranges:

f1ddeb58 f5c0edbc 834c28e8 e100ae28 8351f450 nt!PspCreateThread+0x3e3
f1ddeb78 805f9351 00000ed0 834c28e8 00000001 0xf5c0edbc
f1ddecc4 8057b2a3 00beecbc 001f03ff 00000000 nt!PspCreateThread+0x3e3

And find an update for it if you can.

This can also be due to several common viruses; here is one example: http://support.microsoft.com/?scid=kb;en-us;903251

 

Thanks for the suggestion. I'll check this out. I should also add that the problem is almost certainly the result of the "project1" virus transmitted as a photo through MSN messenger. The crashes started immediately after my girlfriend opened this file. Scans are clean but the crashes won't stop.

 

Try at least two online scans:
http://www.mvps.org/sramesh2k/Scanners.htm

My choice would be Panda and Kaspersky.

 

System Crashes

Thanks very much for you help Bill. I'm still working through a variety of virus scans but this seems to be helping. Fingers crossed.