Windows XP Pro - Restarting - BSOD [Dump Data]

krhymer · 22nd January 2005

Hello;

I have been experiencing random restarts on Windows XP pro for about 2 months now. I have updated all of the drivers on the system to the most current versions and still haven't solved the issue.
I am including the Dump Data from the crashes. Any assistance/ thoughts would be greatly appreciated.

Kevin

Microsoft (R) Windows Debugger Version 6.3.0017.0
Copyright (c) Microsoft Corporation. All rights reserved.

Loading Dump File [C:\WINDOWS\Minidump\Mini012105-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: C:\WINDOWS\Symbols
Executable search path is: C:\WINDOWS\system32
Windows XP Kernel Version 2600 (Service Pack 2) UP Free x86 compatible
Product: WinNt
Built by: 2600.xpsp_sp2_rtm.040803-2158
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055ab20
Debug session time: Thu Jan 20 19:31:24 2005
System Uptime: 0 days 23:37:32.013
Loading Kernel Symbols
........................................................................... ....................................................
Loading unloaded module list
...............
Loading User Symbols
*************************************************************************** ****
* *
* Bugcheck Analysis *
* *
*************************************************************************** ****

Use !analyze -v to get detailed debugging information.

BugCheck A, {4, 2, 1, 804dc903}

Probably caused by : ntoskrnl.exe ( nt!KiTimerExpiration+86 )

Followup: MachineOwner
---------

kd> !analyze -v
*************************************************************************** ****
* *
* Bugcheck Analysis *
* *
*************************************************************************** ****

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 00000004, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000001, value 0 = read operation, 1 = write operation
Arg4: 804dc903, address which referenced memory

Debugging Details:
------------------

WRITE_ADDRESS: 00000004

CURRENT_IRQL: 2

FAULTING_IP:
nt!KiTimerExpiration+86
804dc903 895f04 mov [edi+0x4],ebx

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: 0xA

LAST_CONTROL_TRANSFER: from 804dc179 to 804dc903

TRAP_FRAME: 80550814 -- (.trap ffffffff80550814)
ErrCode = 00000002
eax=80559c00 ebx=80559c00 ecx=895bb390 edx=000000ff esi=00000000 edi=00000000
eip=804dc903 esp=80550888 ebp=805508ac iopl=0 nv up ei ng nz ac po cy
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010297
nt!KiTimerExpiration+0x86:
804dc903 895f04 mov [edi+0x4],ebx ds:0023:00000004=????????
Resetting default scope

STACK_TEXT:
805508ac 804dc179 80559980 00000000 00530f00 nt!KiTimerExpiration+0x86
805508c0 80559320 ffdffc50 00000000 00000000 nt!KiRetireDpcList+0x46
805508d0 804dc0ed 00000000 0000000e 00000000 nt!KiIdleThread0

FOLLOWUP_IP:
nt!KiTimerExpiration+86
804dc903 895f04 mov [edi+0x4],ebx

SYMBOL_STACK_INDEX: 0

FOLLOWUP_NAME: MachineOwner

SYMBOL_NAME: nt!KiTimerExpiration+86

MODULE_NAME: nt

IMAGE_NAME: ntoskrnl.exe

DEBUG_FLR_IMAGE_TIMESTAMP: 41108004

STACK_COMMAND: .trap ffffffff80550814 ; kb

BUCKET_ID: 0xA_W_nt!KiTimerExpiration+86

Followup: MachineOwner
---------

kd> lm t n
start end module name
804d7000 806eb780 nt ntoskrnl.exe Wed Aug 04 01:19:48 2004 (41108004)
806ec000 8070c380 hal halaacpi.dll Wed Aug 04 00:59:05 2004 (41107B29)
b1fc0000 b1fd4400 wdmaud wdmaud.sys Wed Aug 04 01:15:03 2004 (41107EE7)
b2155000 b2163d80 sysaudio sysaudio.sys Wed Aug 04 01:15:54 2004 (41107F1A)
b22bd000 b22c0da0 PfModNT PfModNT.sys Tue Mar 04 22:19:28 2003 (3E657AD0)
b2485000 b249c480 dump_atapi dump_atapi.sys Wed Aug 04 00:59:41 2004 (41107B4D)
b24c5000 b24e5f00 ipnat ipnat.sys Wed Sep 29 17:28:36 2004 (415B3714)
b24e6000 b2553680 mrxsmb mrxsmb.sys Wed Oct 27 20:14:16 2004 (418047E8)
b257c000 b25a6a00 rdbss rdbss.sys Wed Oct 27 20:13:57 2004 (418047D5)
b2647000 b2668d00 afd afd.sys Wed Aug 04 01:14:13 2004 (41107EB5)
b2669000 b2690c00 netbt netbt.sys Wed Aug 04 01:14:36 2004 (41107ECC)
b2691000 b26e8a80 tcpip tcpip.sys Wed Aug 04 01:14:39 2004 (41107ECF)
b26e9000 b26fb400 ipsec ipsec.sys Wed Aug 04 01:14:27 2004 (41107EC3)
b26fc000 b2713000 InCDfs InCDfs.SYS unavailable (00000000)
ba753000 ba7f0720 ctac32k ctac32k.sys Thu Jul 10 04:38:25 2003 (3F0D3411)
ba7f1000 ba80f5a0 ctsfm2k ctsfm2k.sys Thu Jun 19 22:33:39 2003 (3EF28093)
ba810000 ba831560 emupia2k emupia2k.sys Thu Jul 10 04:40:36 2003 (3F0D3494)
ba832000 ba8f65e0 ha10kx2k ha10kx2k.sys Fri Jun 27 03:24:40 2003 (3EFBFF48)
ba8f7000 ba91a7a0 hap16v2k hap16v2k.sys Fri Jun 27 03:24:53 2003 (3EFBFF55)
ba92f000 ba931900 Dxapi Dxapi.sys Fri Aug 17 15:53:19 2001 (3B7D843F)
ba93f000 ba942a00 kbdhid kbdhid.sys Wed Aug 04 00:58:33 2004 (41107B09)
ba943000 ba976200 update update.sys Wed Aug 04 00:58:32 2004 (41107B08)
ba9c7000 ba9f7100 rdpdr rdpdr.sys Wed Aug 04 01:01:10 2004 (41107BA6)
ba9f8000 baa08e00 psched psched.sys Wed Aug 04 01:04:16 2004 (41107C60)
baaa9000 baabf680 ndiswan ndiswan.sys Wed Aug 04 01:14:30 2004 (41107EC6)
baac0000 baac2f80 mouhid mouhid.sys Fri Aug 17 15:47:57 2001 (3B7D82FD)
baac8000 baaca580 hidusb hidusb.sys Fri Aug 17 16:02:16 2001 (3B7D8658)
baad0000 baad3b00 usbscan usbscan.sys Wed Aug 04 00:58:44 2004 (41107B14)
baae8000 baafb900 parport parport.sys Wed Aug 04 00:59:04 2004 (41107B28)
baafc000 bab0f780 VIDEOPRT VIDEOPRT.SYS Wed Aug 04 01:07:04 2004 (41107D08)
bab13000 bab13c00 audstub audstub.sys Fri Aug 17 15:59:40 2001 (3B7D85BC)
bab45000 bac34000 ati2mtag ati2mtag.sys Tue Nov 30 21:13:18 2004 (41AD36CE)
bac34000 bac5efe0 ctoss2k ctoss2k.sys Thu Jun 19 22:33:13 2003 (3EF28079)
bac5f000 bac81680 ks ks.sys Wed Aug 04 01:15:20 2004 (41107EF8)
bac82000 baca5980 portcls portcls.sys Wed Aug 04 01:15:47 2004 (41107F13)
baca6000 bad17980 ctaud2k ctaud2k.sys Thu Jun 19 22:33:00 2003 (3EF2806C)
bad18000 bad29600 el90xbc5 el90xbc5.sys Tue Aug 13 23:27:20 2002 (3D59DC28)
bad2a000 bad4ce80 USBPORT USBPORT.SYS Wed Aug 04 01:08:34 2004 (41107D62)
baf28000 baf2a280 rasacd rasacd.sys Fri Aug 17 15:55:39 2001 (3B7D84CB)
baf38000 baf40880 Fips Fips.SYS Fri Aug 17 20:31:49 2001 (3B7DC585)
baf58000 baf60700 netbios netbios.sys Wed Aug 04 01:03:19 2004 (41107C27)
bafa8000 bafb1480 NDProxy NDProxy.SYS Fri Aug 17 15:55:30 2001 (3B7D84C2)
bafb8000 bafc6100 usbhub usbhub.sys Wed Aug 04 01:08:40 2004 (41107D68)
bafc8000 bafd1f00 termdd termdd.sys Wed Aug 04 00:58:52 2004 (41107B1C)
bf800000 bf9c0380 win32k win32k.sys Wed Aug 04 01:17:30 2004 (41107F7A)
bf9c1000 bf9d2580 dxg dxg.sys Wed Aug 04 01:00:51 2004 (41107B93)
bf9d3000 bfa0e000 ati2dvag ati2dvag.dll Tue Nov 30 21:13:41 2004 (41AD36E5)
bfa0e000 bfa4a000 ati2cqag ati2cqag.dll Tue Nov 30 20:28:23 2004 (41AD2C47)
bfa4a000 bfc5b920 ati3duag ati3duag.dll Tue Nov 30 20:50:50 2004 (41AD318A)
bfc5c000 bfcc4920 ativvaxx ativvaxx.dll Tue Nov 30 20:45:12 2004 (41AD3038)
f740d000 f7439a80 NDIS NDIS.sys Wed Aug 04 01:14:27 2004 (41107EC3)
f743a000 f7450780 KSecDD KSecDD.sys Wed Aug 04 00:59:45 2004 (41107B51)
f7451000 f7462f00 sr sr.sys Wed Aug 04 01:06:22 2004 (41107CDE)
f7463000 f7481780 fltmgr fltmgr.sys Wed Aug 04 01:01:17 2004 (41107BAD)
f7482000 f7499800 SCSIPORT SCSIPORT.SYS Wed Aug 04 00:59:39 2004 (41107B4B)
f749a000 f74b1480 atapi atapi.sys Wed Aug 04 00:59:41 2004 (41107B4D)
f74b2000 f74d7700 dmio dmio.sys Wed Aug 04 01:07:13 2004 (41107D11)
f74d8000 f74f6880 ftdisk ftdisk.sys Fri Aug 17 15:52:41 2001 (3B7D8419)
f74f7000 f7500960 Pcouffin Pcouffin.sys Thu Dec 23 08:24:28 2004 (41CAD51C)
f7507000 f750f900 msgpc msgpc.sys Wed Aug 04 01:04:11 2004 (41107C5B)
f7517000 f7522d00 raspptp raspptp.sys Wed Aug 04 01:14:26 2004 (41107EC2)
f7527000 f7531200 raspppoe raspppoe.sys Wed Aug 04 01:05:06 2004 (41107C92)
f7537000 f7543880 rasl2tp rasl2tp.sys Wed Aug 04 01:14:21 2004 (41107EBD)
f7547000 f7556d80 serial serial.sys Wed Aug 04 01:15:51 2004 (41107F17)
f7557000 f7565080 redbook redbook.sys Wed Aug 04 00:59:34 2004 (41107B46)
f7567000 f7573180 cdrom cdrom.sys Wed Aug 04 00:59:52 2004 (41107B58)
f7577000 f7581380 Imapi Imapi.SYS Wed Aug 04 01:00:12 2004 (41107B6C)
f7587000 f7595b80 drmk drmk.sys Wed Aug 04 01:07:54 2004 (41107D3A)
f7597000 f75a7a80 pci pci.sys Wed Aug 04 01:07:45 2004 (41107D31)
f75a8000 f75d5d80 ACPI ACPI.sys Wed Aug 04 01:07:35 2004 (41107D27)
f75f7000 f75ffc00 isapnp isapnp.sys Fri Aug 17 15:58:01 2001 (3B7D8559)
f7607000 f7615e80 ohci1394 ohci1394.sys Wed Aug 04 01:10:05 2004 (41107DBD)
f7617000 f7624000 1394BUS 1394BUS.SYS Wed Aug 04 01:10:03 2004 (41107DBB)
f7627000 f7631500 MountMgr MountMgr.sys Wed Aug 04 00:58:29 2004 (41107B05)
f7637000 f7643c80 VolSnap VolSnap.sys Wed Aug 04 01:00:14 2004 (41107B6E)
f7647000 f764fe00 disk disk.sys Wed Aug 04 00:59:53 2004 (41107B59)
f7657000 f7663200 CLASSPNP CLASSPNP.SYS Wed Aug 04 01:14:26 2004 (41107EC2)
f7697000 f769f700 wanarp wanarp.sys Wed Aug 04 01:04:57 2004 (41107C89)
f76a7000 f76b6900 Cdfs Cdfs.SYS Wed Aug 04 01:14:09 2004 (41107EB1)
f76b7000 f76bfd80 HIDCLASS HIDCLASS.SYS Wed Aug 04 01:08:18 2004 (41107D52)
f76f7000 f7700200 amdk7 amdk7.sys Wed Aug 04 00:59:19 2004 (41107B37)
f7707000 f770d200 PCIIDEX PCIIDEX.SYS Wed Aug 04 00:59:40 2004 (41107B4C)
f770f000 f7713900 PartMgr PartMgr.sys Fri Aug 17 20:32:23 2001 (3B7DC5A7)
f7717000 f771d680 ultra ultra.sys Wed Oct 09 11:29:41 2002 (3DA45975)
f771f000 f7723bc0 PxHelp20 PxHelp20.sys Tue Oct 28 12:25:49 2003 (3F9EB4AD)
f775f000 f7765e00 secdrv secdrv.sys Fri Jan 11 09:39:40 2002 (3C3F073C)
f7787000 f778b280 usbohci usbohci.sys Wed Aug 04 01:08:34 2004 (41107D62)
f778f000 f7795800 usbehci usbehci.sys Wed Aug 04 01:08:34 2004 (41107D62)
f7797000 f779e000 InCDPass InCDPass.sys unavailable (00000000)
f779f000 f77a5b00 fdc fdc.sys Wed Aug 04 00:59:25 2004 (41107B3D)
f77a7000 f77ab880 TDI TDI.SYS Wed Aug 04 01:07:47 2004 (41107D33)
f77af000 f77b3580 ptilink ptilink.sys Fri Aug 17 15:49:53 2001 (3B7D8371)
f77b7000 f77bb080 raspti raspti.sys Fri Aug 17 15:55:32 2001 (3B7D84C4)
f77bf000 f77c5000 kbdclass kbdclass.sys Wed Aug 04 00:58:32 2004 (41107B08)
f77c7000 f77cca00 mouclass mouclass.sys Wed Aug 04 00:58:32 2004 (41107B08)
f77cf000 f77d4000 flpydisk flpydisk.sys Wed Aug 04 00:59:24 2004 (41107B3C)
f77df000 f77e5180 HIDPARSE HIDPARSE.SYS Wed Aug 04 01:08:15 2004 (41107D4F)
f77e7000 f77ec200 vga vga.sys Wed Aug 04 01:07:06 2004 (41107D0A)
f77ef000 f77f3a80 Msfs Msfs.SYS Wed Aug 04 01:00:37 2004 (41107B85)
f77f7000 f77fe880 Npfs Npfs.SYS Wed Aug 04 01:00:38 2004 (41107B86)
f7807000 f780eb80 usbccgp usbccgp.sys Wed Aug 04 01:08:45 2004 (41107D6D)
f780f000 f7815500 usbprint usbprint.sys Wed Aug 04 01:01:23 2004 (41107BB3)
f7817000 f781d780 USBSTOR USBSTOR.SYS Wed Aug 04 01:08:44 2004 (41107D6C)
f781f000 f7823500 watchdog watchdog.sys Wed Aug 04 01:07:32 2004 (41107D24)
f787c000 f7896580 Mup Mup.sys Wed Aug 04 01:15:20 2004 (41107EF8)
f7897000 f789a000 BOOTVID BOOTVID.dll Fri Aug 17 15:49:09 2001 (3B7D8345)
f7923000 f7925980 gameenum gameenum.sys Wed Aug 04 01:08:20 2004 (41107D54)
f792f000 f7932c80 serenum serenum.sys Wed Aug 04 00:59:06 2004 (41107B2A)
f7933000 f7935580 ndistapi ndistapi.sys Fri Aug 17 15:55:29 2001 (3B7D84C1)
f794b000 f794ec80 mssmbios mssmbios.sys Wed Aug 04 01:07:47 2004 (41107D33)
f7987000 f7988b80 kdcom kdcom.dll Fri Aug 17 15:49:10 2001 (3B7D8346)
f7989000 f798a100 WMILIB WMILIB.SYS Fri Aug 17 16:07:23 2001 (3B7D878B)
f798b000 f798c700 dmload dmload.sys Fri Aug 17 15:58:15 2001 (3B7D8567)
f799f000 f79a0600 ctprxy2k ctprxy2k.sys Thu Jun 19 22:33:22 2003 (3EF28082)
f79a3000 f79a4100 swenum swenum.sys Wed Aug 04 00:58:41 2004 (41107B11)
f79a5000 f79a6280 USBD USBD.SYS Fri Aug 17 16:02:58 2001 (3B7D8682)
f79a7000 f79a8f00 Fs_Rec Fs_Rec.SYS Fri Aug 17 15:49:37 2001 (3B7D8361)
f79a9000 f79aa080 Beep Beep.SYS Fri Aug 17 15:47:33 2001 (3B7D82E5)
f79ab000 f79ac080 mnmdd mnmdd.SYS Fri Aug 17 15:57:28 2001 (3B7D8538)
f79ad000 f79ae080 RDPCDD RDPCDD.sys Fri Aug 17 15:46:56 2001 (3B7D82C0)
f79af000 f79b1000 InCDrec InCDrec.SYS unavailable (00000000)
f79b1000 f79b2100 dump_WMILIB dump_WMILIB.SYS Fri Aug 17 16:07:23 2001 (3B7D878B)
f79e1000 f79e2a80 ParVdm ParVdm.SYS Fri Aug 17 15:49:49 2001 (3B7D836D)
f7a4f000 f7a4fd00 pciide pciide.sys Fri Aug 17 15:51:49 2001 (3B7D83E5)
f7a76000 f7a76b80 Null Null.SYS Fri Aug 17 15:47:39 2001 (3B7D82EB)
f7a87000 f7a87d00 dxgthk dxgthk.sys Fri Aug 17 15:53:12 2001 (3B7D8438)
f7a8b000 f7a8ba80 PQNTDrv PQNTDrv.SYS Wed Apr 16 15:21:28 2003 (3E9DBB48)
f7b52000 f7bde480 Ntfs Ntfs.sys Wed Aug 04 01:15:06 2004 (41107EEA)

Unloaded modules:
b1af9000 b1b23000 kmixer.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
b1af9000 b1b23000 kmixer.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
b1af9000 b1b23000 kmixer.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
b1af9000 b1b23000 kmixer.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
b1f73000 b1f9d000 kmixer.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
bab1d000 bab1e000 drmkaud.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
b2135000 b2142000 DMusic.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
b2145000 b2153000 swmidi.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
b1f9d000 b1fc0000 aec.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
f79a1000 f79a3000 splitter.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
baf48000 baf51000 processr.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
baf2c000 baf30000 kbdhid.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
baf68000 baf75000 i8042prt.SYS
Timestamp: unavailable (00000000)
Checksum: 00000000
f77d7000 f77dc000 Cdaudio.SYS
Timestamp: unavailable (00000000)
Checksum: 00000000
baf30000 baf33000 Sfloppy.SYS
Timestamp: unavailable (00000000)
Checksum: 00000000

**JoeHobart** · 22nd January 2005

The machine is crashing because of bad data on the timer list.This is caused either by pool corruption, or a misbehaving driver that is freeing a timer's memory out from under the object.

This one will take some effort to isolate, since there isnt a lot of guarding around this area. You could try using verifier to special pool all your third party drivers. This would probably catch it, but without debugging the dump itself, its hard to say for sure if thats the case.