BSOD Dump Interpretation

Recently, I've been having BSOD problems with a laptop running xp pro sp2. Listed in order of frequency, they are Bugchecks: 0a (12x), d1 (5x), 7f (3x), 8e (1x), 50 (1x). I figured it may be the RAM(hence the MEMORY_CORRUPTION, so I ran memtest (although i hear it doesn't always work), 0 errors. Ran verifier.exe, everything looked good. Maybe you could help me interpret what may be the cause here? Any help would be greatly apreciated.



Microsoft (R) Windows Debugger Version 6.6.0007.5
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Documents and Settings\mcomer\Desktop\C340 Minidumps\Mini112606-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: srv*c:\progra~1\websymbols\*http://msdl.microsoft.com/download/symbols
Executable search path is: c:\
Debugger can not determine kernel base address
Windows XP Kernel Version 2600 (Service Pack 2) UP Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
ðßÿ3Û
â„¢p;Æ’Aýÿÿƒùu‹
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055a420
Debug session time: Sun Nov 26 20:39:32.406 2006 (GMT-5)
System Uptime: 0 days 0:39:36.470
Debugger can not determine kernel base address
Loading Kernel Symbols
.Image path too long, possible corrupt data.
.........................................................WARNING: imapi overlaps nic1394
.................................................................................
Loading User Symbols
Loading unloaded module list
..............
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1000000A, {8f14, 2, 1, 804e4326}

Probably caused by : memory_corruption

Followup: memory_corruption
---------

kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 00008f14, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000001, value 0 = read operation, 1 = write operation
Arg4: 804e4326, address which referenced memory

Debugging Details:
------------------


WRITE_ADDRESS: 00008f14

CURRENT_IRQL: 2

FAULTING_IP:
nt!MiDeleteVirtualAddresses+e
804e4326 ff4118 inc dword ptr [ecx+18h]

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: CODE_CORRUPTION

BUGCHECK_STR: 0xA

PROCESS_NAME: Idle

LAST_CONTROL_TRANSFER: from 00010206 to 804e4326

STACK_TEXT:
80550030 00010206 804dbcee 842c8578 842c8580 nt!MiDeleteVirtualAddresses+0xe
WARNING: Frame IP not in any known module. Following frames may be wrong.
80550098 f736fa64 8418fe68 84128628 000007b4 0x10206
80550074 804dc4a8 887d53c0 000000f9 8055019c NDIS!NdisAllocateBuffer+0x32
80550180 804dc378 80558e80 80558c20 ffdff000 nt!KeProfileInterruptWithSource+0x3e
80550188 80558c20 ffdff000 887c9340 00000005 nt!KeUpdateRunTime+0x4e
805501ac 804dbbd4 80559280 00000000 00039ef9 nt!PopWakeTimeoutDpc
805501cc 00000000 804dbb4d 00000000 0000000e nt!KiCallUserMode+0xbc


STACK_COMMAND: kb

CHKIMG_EXTENSION: !chkimg -lo 50 -d !nt
804e4000-804e4009 10 bytes - nt!MiInsertVad+114
[ d3 8b cf e8 07 97 ff ff:88 46 59 c6 46 5b 0f 89 ]
804e400b-804e4029 31 bytes - nt!MiInsertVad+11f (+0x0b)
[ 84 3c 91 03 00 8d 83 a8:85 4e ff ff ff 89 4d 08 ]
804e402c-804e402d 2 bytes - nt!MiInsertVad+176 (+0x21)
[ b2 5d:0a 2f ]
804e4030-804e406a 59 bytes - nt!MiInsertVad+1ba (+0x04)
[ 8b 46 04 8b 3e c1 e8 04:ff 4b 18 8d 4b 10 8b 01 ]
804e406c-804e4081 22 bytes - nt!MiInsertVad+1f6 (+0x3c)
[ 78 38 0f 84 73 e2 00 00:89 78 04 c6 46 2d 05 0f ]
804e4083-804e40a8 38 bytes - nt!MiInsertVad+210 (+0x17)
[ 00 0f 85 fc 90 03 00 8d:c6 46 5b 00 0f 84 8b 72 ]
804e40ab-804e40ad 3 bytes - nt!MiFindEmptyAddressRange (+0x28)
[ 8b ff 55:90 90 90 ]
804e40af-804e40c1 19 bytes - nt!MiFindEmptyAddressRange+4 (+0x04)
[ ec 83 ec 0c 56 57 64 a1:ff 55 8b ec 51 8b 41 04 ]
804e40c3 - nt!MiFindEmptyAddressRange+18 (+0x14)
[ 7d:71 ]
804e40c5-804e40da 22 bytes - nt!MiFindEmptyAddressRange+1a (+0x02)
[ 89 75 fc 0f 85 70 91 03:8d 79 08 3b f7 0f 84 8f ]
804e40dc-804e40e0 5 bytes - nt!MiFindEmptyAddressRange+31 (+0x17)
[ 20 50 c0 8b 1d:39 88 e4 00 00 ]
804e40e2-804e4139 88 bytes - nt!MiFindEmptyAddressRange+37 (+0x06)
[ 20 50 c0 8b c3 83 c8 01:0f 84 a0 bf 01 00 8b 06 ]
804e413b-804e4166 44 bytes - nt!PsChargeProcessNonPagedPoolQuota+4 (+0x59)
[ ec 83 ec 14 8b 45 08 3b:55 0c 8b 4d 08 6a 00 8a ]
804e4168-804e41cb 100 bytes - nt!PsChargeProcessNonPagedPoolQuota+34 (+0x2d)
[ 45 0c 03 c3 3b c3 89 45:ff 55 8b ec 56 8b 75 0c ]
804e41cd-804e41d2 6 bytes - nt!PsChargeProcessNonPagedPoolQuota+ef (+0x65)
[ 00 89 75 fc 3b f0:07 c1 e8 02 24 01 ]
804e41d4-804e41f1 30 bytes - nt!PsChargeProcessNonPagedPoolQuota+104 (+0x07)
[ 45 0c 76 0e 8b 45 0c 8b:5d f4 88 45 e8 74 07 83 ]
804e41f3-804e4211 31 bytes - nt!PsChargeProcessNonPagedPoolQuota+aa (+0x1f)
[ 90 8b ff 55 8b ec 83 ec:0f 84 19 38 04 00 8b 07 ]
804e4213-804e423a 40 bytes - nt!MiDeletePte+1f (+0x20)
[ 7d 55 80 83 65 f8 00 8b:89 4d fc 89 7d ec 8b 45 ]
804e423d-804e4258 28 bytes - nt!MiDeletePte+153 (+0x2a)
[ ff 03 8d 04 49 8d 14 c2:8b f8 81 ff 02 01 00 00 ]
804e425a-804e4260 7 bytes - nt!MiDeletePte+170 (+0x1d)
[ 85 be 98 03 00 83 7a:c1 01 8b 4f 0c 8b 47 ]
804e4262-804e4268 7 bytes - nt!MiDeletePte+17f (+0x08)
[ 01 0f 84 ad 74 01 00:51 89 45 fc 89 4d 08 ]
804e426a-804e428d 36 bytes - nt!MiDeletePte+183 (+0x08)
[ 4a 08 83 4e 04 01 8b cf:d0 81 c3 d4 00 00 00 83 ]
804e428f-804e42ab 29 bytes - nt!MiDeletePte+1b3 (+0x25)
[ 8b 4d 0c e8 9b c0 ff ff:48 02 00 00 08 0f 85 db ]
804e42ad-804e4303 87 bytes - nt!MiDeletePte+1d1 (+0x1e)
[ 8b 7d 14 81 c7 f8 01 00:ff 90 90 90 90 90 8b ff ]
804e4305-804e4325 33 bytes - nt!MiDeletePte+40f (+0x58)
[ 4d 08 89 01 8b 45 f0 5f:4e 14 e8 17 4d ff ff 8b ]
804e4327-804e4351 43 bytes - nt!MiDeleteVirtualAddresses+f (+0x22)
[ ff ff 00 53 56 57 c6 45:41 18 e9 a8 79 ff ff 90 ]
804e4353 - nt!MiDeleteVirtualAddresses+3b (+0x2c)
[ 3f:ff ]
804e4355-804e4356 2 bytes - nt!MiDeleteVirtualAddresses+3d (+0x02)
[ 81 ee:00 00 ]
804e4358-804e436e 23 bytes - nt!MiDeleteVirtualAddresses+40 (+0x03)
[ 00 d0 3f 2d 00 00 00 40:b8 37 5f 80 90 90 90 90 ]
804e4370-804e4394 37 bytes - nt!MiDeleteVirtualAddresses+73 (+0x18)
[ 75 ec 56 e8 03 c0 ff ff:4b 04 75 29 0f b6 43 1d ]
804e4396-804e43dd 72 bytes - nt!MiDeleteVirtualAddresses+95 (+0x26)
[ 45 e8 8b 45 14 85 c0 0f:48 04 89 42 04 89 01 8b ]
804e43df-804e43fd 31 bytes - nt!MiDeleteVirtualAddresses+178 (+0x49)
[ 83 c3 04 f7 c7 ff ff 3f:88 5d 0b 39 1c b5 e0 06 ]
804e43ff-804e4405 7 bytes - nt!MiDeleteVirtualAddresses+19c (+0x20)
[ 00 50 e8 c5 e0 ff ff:9b 00 00 8d 45 0f 50 ]
804e4407-804e4427 33 bytes - nt!MiDeleteVirtualAddresses+1a4 (+0x08)
[ 4d e8 33 c0 66 39 01 0f:d7 8b ce e8 6d 05 00 00 ]
804e4429-804e4432 10 bytes - nt!MiDeleteVirtualAddresses+cd (+0x22)
[ 08 f7 03 01 fc ff ff 0f:90 90 90 90 90 81 f9 00 ]
804e4434-804e446b 56 bytes - nt!MiDeleteVirtualAddresses+d8 (+0x0b)
[ 00 00 a1 bc c7 4d 80 89:0f 83 e5 62 02 00 8b c1 ]
804e446e-804e44c9 92 bytes - nt!PsReturnProcessNonPagedPoolQuota+2e (+0x3a)
[ 01 00 3b d7 89 75 f0 89:f6 c5 02 0f 85 97 62 02 ]
804e44cb-804e451b 81 bytes - nt!PsReturnProcessNonPagedPoolQuota+e2 (+0x5d)
[ 0f 85 ed ae 03 00 5f 5e:85 08 09 55 80 64 a1 24 ]
804e451d-804e4522 6 bytes - nt!MiDeleteVirtualAddresses+e4 (+0x52)
[ 72 58 8b 4d 14 8b:00 3b c6 0f 8c 1d ]
804e4524-804e45ac 137 bytes - nt!MiDeleteVirtualAddresses+eb (+0x07)
[ 8b 49 1c 8b d7 c1 ea 0a:00 00 8b 45 ec 8b 48 10 ]
804e45ae-804e45d9 44 bytes - nt!MiRemoveVad+13 (+0x8a)
[ 08 8b 46 14 bb ff ff 07:d0 e8 1a 01 08 00 3b c6 ]
804e45db-804e4607 45 bytes - nt!MiRemoveVad+40 (+0x2d)
[ 00 00 50 57 e8 4a 7f 00:75 25 80 48 22 01 f6 45 ]
804e4609-804e4615 13 bytes - nt!MiRemoveVad+6e (+0x2e)
[ 01 f6 87 44 02 00 00 10:e1 0f 09 4b 20 f6 43 21 ]
804e4617-804e4667 81 bytes - nt!MiRemoveVad+7e (+0x0e)
[ 29 9f a8 00 00 00 8d 9f:00 8b 48 14 8b 40 1c 3b ]
804e4669-804e466c 4 bytes - nt!MiDeleteFreeVm+2 (+0x52)
[ 55 8b ec 53:56 e8 f2 ef ]
804e466e-804e4675 8 bytes - nt!MiDeleteFreeVm+7 (+0x05)
[ 15 94 06 4d 80 6a 00 6a:ff 84 c0 0f 84 15 db 03 ]
804e4677-804e478e 280 bytes - nt!MiDeleteFreeVm+10 (+0x09)
[ ff 75 0c 8a d8 ff 75 08:8b c7 5f 5e 5b c3 f6 46 ]
804e4790-804e47b6 39 bytes - nt!MmAccessFault+ae6 (+0x119)
[ 75 08 8d 45 e4 57 ff 75:15 9c 76 4d 80 8b 4d 14 ]
804e47b8-804e47bb 4 bytes - nt!MiCheckVirtualAddress+76 (+0x28)
[ 85 f6 8f 01:84 22 de 03 ]
804e47bd-804e47f5 57 bytes - nt!MiCheckVirtualAddress+77 (+0x05)
[ a9 00 00 00 40 0f 84 eb:a1 d8 a3 55 80 8d 88 00 ]
WARNING: !chkimg output was truncated to 50 lines. Invoke !chkimg without '-lo [num_lines]' to view entire output.
8055e920-8055e923 4 bytes - nt!NtWaitForMultipleObjects+101
[ 45 e7 01 8b:94 c1 06 00 ]
8055e928-8055e92b 4 bytes - nt!NtWaitForMultipleObjects+109 (+0x08)
[ 02 8b 84 1d:89 f7 00 00 ]
3982 errors : !nt (804e4000-8055e92b)

MODULE_NAME: memory_corruption

IMAGE_NAME: memory_corruption

FOLLOWUP_NAME: memory_corruption

DEBUG_FLR_IMAGE_TIMESTAMP: 0

MEMORY_CORRUPTOR: LARGE

FAILURE_BUCKET_ID: MEMORY_CORRUPTION_LARGE

BUCKET_ID: MEMORY_CORRUPTION_LARGE

Followup: memory_corruption
---------
**********************************************************
NEXT BUGCHECK
**********************************************************
Microsoft (R) Windows Debugger Version 6.6.0007.5
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Documents and Settings\mcomer\Desktop\C340 Minidumps\Mini121906-04.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: srv*c:\progra~1\websymbols\*http://msdl.microsoft.com/download/symbols
Executable search path is: c:\
Windows XP Kernel Version 2600 (Service Pack 2) UP Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 2600.xpsp_sp2_gdr.050301-1519
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055a420
Debug session time: Tue Dec 19 10:09:47.109 2006 (GMT-5)
System Uptime: 0 days 0:21:05.713
Loading Kernel Symbols
..........................................................................................................................................
Loading User Symbols
Loading unloaded module list
..............
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1000000A, {98843f1e, 2, 1, 804dc11d}

*** ERROR: Symbol file could not be found. Defaulted to export symbols for SYMEVENT.SYS -
Probably caused by : SYMEVENT.SYS ( SYMEVENT!SYMEvent_AllocVMData+33a1 )

Followup: MachineOwner
---------

kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 98843f1e, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000001, value 0 = read operation, 1 = write operation
Arg4: 804dc11d, address which referenced memory

Debugging Details:
------------------


WRITE_ADDRESS: 98843f1e

CURRENT_IRQL: 2

FAULTING_IP:
nt!KeWaitForSingleObject+186
804dc11d 8939 mov dword ptr [ecx],edi

CUSTOMER_CRASH_COUNT: 4

DEFAULT_BUCKET_ID: COMMON_SYSTEM_FAULT

BUGCHECK_STR: 0xA

PROCESS_NAME: explorer.exe

LAST_CONTROL_TRANSFER: from 806ed14f to 804dc11d

STACK_TEXT:
f1407320 806ed14f 00000000 00000000 00000000 nt!KeWaitForSingleObject+0x186
f1407340 8054b516 e1916854 f14073a8 84378100 hal!ExAcquireFastMutex+0x27
f140737c f739dd80 00000000 00000000 c1741308 nt!ExFreePoolWithTag+0x4ef
f1407390 f73d99ee f14073a8 f14073e0 f73d98f2 Ntfs!RemoveReferenceSharedSecurityUnsafe+0x1d
f140739c f73d98f2 84378100 e184b658 e1123008 Ntfs!AddCachedSharedSecurityUnsafe+0x49
f14073e0 f73d90cf f14077c8 84378100 00000119 Ntfs!NtfsCacheSharedSecurityBySecurityId+0x103
f1407474 f73cea56 f14077c8 00000001 e1123008 Ntfs!NtfsUpdateFcbInfoFromDisk+0x1d9
f140754c f73cedef f14077c8 83269008 832691e0 Ntfs!NtfsOpenFile+0x2e6
f14077a4 f73c0f72 f14077c8 83269008 f14078f8 Ntfs!NtfsCommonCreate+0x134a
f1407950 f7447f70 83264708 f1407c00 84378020 Ntfs!NtfsNetworkOpenCreate+0x8a
f1407970 f293fdb1 83269008 f1407c00 843796e0 sr!SrFastIoQueryOpen+0x40
WARNING: Stack unwind information not available. Following frames may be wrong.
f1407990 f74550e8 832691e0 f1407c00 84171120 SYMEVENT!SYMEvent_AllocVMData+0x33a1
f14079b0 f7461927 00009008 00000000 f14079e8 fltMgr!FltpPerformFastIoCall+0x300
f1407a08 8057150e 83269008 f1407c00 84257af4 fltMgr!FltpFastIoQueryOpen+0xa1
f1407af4 8056316c 84353bb8 00000000 84294cc0 nt!IopParseDevice+0x95c
f1407b7c 8056729a 00000000 f1407bbc 00000040 nt!ObpLookupObjectName+0x56a
f1407bd0 805716b4 00000000 00000000 8331bb01 nt!ObOpenObjectByName+0xeb
f1407d54 804de7ec 025eeac8 025eeaa0 025eeaf4 nt!NtQueryAttributesFile+0xf1
f1407d54 7c90eb94 025eeac8 025eeaa0 025eeaf4 nt!KiFastCallEntry+0xf8
025eeaf4 00000000 00000000 00000000 00000000 0x7c90eb94


STACK_COMMAND: kb

FOLLOWUP_IP:
SYMEVENT!SYMEvent_AllocVMData+33a1
f293fdb1 8b4d10 mov ecx,dword ptr [ebp+10h]

SYMBOL_STACK_INDEX: b

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: SYMEVENT

IMAGE_NAME: SYMEVENT.SYS

DEBUG_FLR_IMAGE_TIMESTAMP: 43161c03

SYMBOL_NAME: SYMEVENT!SYMEvent_AllocVMData+33a1

FAILURE_BUCKET_ID: 0xA_W_SYMEVENT!SYMEvent_AllocVMData+33a1

BUCKET_ID: 0xA_W_SYMEVENT!SYMEvent_AllocVMData+33a1

Followup: MachineOwner
---------

*********************************************************
NEXT BUGCHECK
*********************************************************

Microsoft (R) Windows Debugger Version 6.6.0007.5
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Documents and Settings\mcomer\Desktop\C340 Minidumps\Mini121806-06.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: srv*c:\progra~1\websymbols\*http://msdl.microsoft.com/download/symbols
Executable search path is: c:\
Windows XP Kernel Version 2600 (Service Pack 2) UP Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 2600.xpsp_sp2_gdr.050301-1519
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055a420
Debug session time: Mon Dec 18 15:53:53.711 2006 (GMT-5)
System Uptime: 0 days 0:54:22.966
Loading Kernel Symbols
......................................................Missing image name, possible paged-out or corrupt data.
....................................................................................
Loading User Symbols
Loading unloaded module list
.............
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1000000A, {3e7d2199, 2, 1, 804dfc6c}

Probably caused by : hardware ( nt!Dr_kit6_a+30 )

Followup: MachineOwner
---------

kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 3e7d2199, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000001, value 0 = read operation, 1 = write operation
Arg4: 804dfc6c, address which referenced memory

Debugging Details:
------------------


WRITE_ADDRESS: 3e7d2199

CURRENT_IRQL: 2

FAULTING_IP:
nt!Dr_kit6_a+30
804dfc6c ff895d24894d dec dword ptr [ecx+4D89245Dh]

CUSTOMER_CRASH_COUNT: 6

DEFAULT_BUCKET_ID: COMMON_SYSTEM_FAULT

BUGCHECK_STR: 0xA

PROCESS_NAME: explorer.exe

MISALIGNED_IP:
nt!Dr_kit6_a+30
804dfc6c ff895d24894d dec dword ptr [ecx+4D89245Dh]

LAST_CONTROL_TRANSFER: from 804dc143 to 804dfc6c

STACK_TEXT:
f0f3fc44 804dc143 00000040 e12feb48 00000000 nt!Dr_kit6_a+0x30
84302600 00000000 84302608 8430cb90 84302610 nt!KeWaitForSingleObject+0x1c2


STACK_COMMAND: kb

FOLLOWUP_IP:
nt!Dr_kit6_a+30
804dfc6c ff895d24894d dec dword ptr [ecx+4D89245Dh]

SYMBOL_STACK_INDEX: 0

SYMBOL_NAME: nt!Dr_kit6_a+30

FOLLOWUP_NAME: MachineOwner

IMAGE_NAME: hardware

DEBUG_FLR_IMAGE_TIMESTAMP: 0

MODULE_NAME: hardware

FAILURE_BUCKET_ID: IP_MISALIGNED

BUCKET_ID: IP_MISALIGNED

Followup: MachineOwner

*********************************************************
NEXT BUGCHECK
*********************************************************
Microsoft (R) Windows Debugger Version 6.6.0007.5
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Documents and Settings\mcomer\Desktop\C340 Minidumps\Mini121706-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

DbsSplayTreeRangeMap::Add: ignoring zero-sized range at ?ffffffff`8054c060?
**************************************************************************
THIS DUMP FILE IS PARTIALLY CORRUPT.
KdDebuggerDataBlock is not present or unreadable.
**************************************************************************
Symbol search path is: srv*c:\progra~1\websymbols\*http://msdl.microsoft.com/download/symbols
Executable search path is: c:\
**************************************************************************
THIS DUMP FILE IS PARTIALLY CORRUPT.
KdDebuggerDataBlock is not present or unreadable.
**************************************************************************
**************************************************************************
THIS DUMP FILE IS PARTIALLY CORRUPT.
KdDebuggerDataBlock is not present or unreadable.
**************************************************************************
Windows XP Kernel Version 2600 (Service Pack 2) UP Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055a420
Debug session time: Sun Dec 17 19:40:33.776 2006 (GMT-5)
System Uptime: 0 days 7:26:26.395
**************************************************************************
THIS DUMP FILE IS PARTIALLY CORRUPT.
KdDebuggerDataBlock is not present or unreadable.
**************************************************************************
**************************************************************************
THIS DUMP FILE IS PARTIALLY CORRUPT.
KdDebuggerDataBlock is not present or unreadable.
**************************************************************************
Loading Kernel Symbols
..........................................................................................................................................
Loading User Symbols
Loading unloaded module list
......................
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1000000A, {5c004f, 2, 0, 804dbe7b}

Probably caused by : NDIS.sys ( NDIS!___PchSym_+c )

Followup: MachineOwner
---------

kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 005c004f, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000000, value 0 = read operation, 1 = write operation
Arg4: 804dbe7b, address which referenced memory

Debugging Details:
------------------


READ_ADDRESS: unable to get MmPageSize (0x0) - probably bad symbols
005c004f

CURRENT_IRQL: 2

FAULTING_IP:
nt!KiInsertTimerTable+2f
804dbe7b 3b51fc cmp edx,dword ptr [ecx-4]

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: 0xA

PROCESS_NAME: WINWORD.EXE

LAST_CONTROL_TRANSFER: from 804dbeff to 804dbe7b

STACK_TEXT:
f15e795c 804dbeff fff85ee0 ffffffff 5def8b60 nt!KiInsertTimerTable+0x2f
f15e7978 804e771d fff85ee0 ffffffff 842e49a8 nt!KiInsertTreeTimer+0x7d
f15e79b8 80565a45 00000001 f15e7bec 00000001 nt!KeWaitForMultipleObjects+0x20e
f15e7d48 804d0d00 00000001 0012f87c 00000001 nt!NtWaitForMultipleObjects+0x2a2
WARNING: Frame IP not in any known module. Following frames may be wrong.
f15e7ddc 804fa4da f7375b85 842ae500 00000000 0x804d0d00
f15e7de0 f7375b84 842ae500 00000000 0120127f nt!KiThreadStartup+0x16
f15e7de4 842ae500 00000000 0120127f 01c90000 NDIS!___PchSym_+0xc
f15e7de8 00000000 0120127f 01c90000 3f1137a7 0x842ae500


STACK_COMMAND: kb

FOLLOWUP_IP:
NDIS!___PchSym_+c
f7375b84 90 nop

SYMBOL_STACK_INDEX: 6

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: NDIS

IMAGE_NAME: NDIS.sys

DEBUG_FLR_IMAGE_TIMESTAMP: 41107ec3

SYMBOL_NAME: NDIS!___PchSym_+c

FAILURE_BUCKET_ID: 0xA_VRFK_NDIS!___PchSym_+c

BUCKET_ID: 0xA_VRFK_NDIS!___PchSym_+c

Followup: MachineOwner

 

But wait, there's more....

*********************************************************
NEXT BUGCHECK
*********************************************************


Microsoft (R) Windows Debugger Version 6.6.0007.5
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Documents and Settings\mcomer\Desktop\C340 Minidumps\Mini121406-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: srv*c:\progra~1\websymbols\*http://msdl.microsoft.com/download/symbols
Executable search path is: c:\
Windows XP Kernel Version 2600 (Service Pack 2) UP Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 2600.xpsp_sp2_gdr.050301-1519
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055a420
Debug session time: Thu Dec 14 08:06:38.110 2006 (GMT-5)
System Uptime: 264 days 6:26:50.256
Loading Kernel Symbols
..............................................................................................................................................
Loading User Symbols
Loading unloaded module list
...............
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1000000A, {776, 2, 1, 805141d1}

Probably caused by : ntoskrnl.exe ( nt!KiInSwapProcesses+33 )

Followup: MachineOwner
---------

kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 00000776, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000001, value 0 = read operation, 1 = write operation
Arg4: 805141d1, address which referenced memory

Debugging Details:
------------------


WRITE_ADDRESS: 00000776

CURRENT_IRQL: 2

FAULTING_IP:
nt!KiInSwapProcesses+33
805141d1 8910 mov dword ptr [eax],edx

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: 0xA

PROCESS_NAME: System

LAST_CONTROL_TRANSFER: from 8051412a to 805141d1

STACK_TEXT:
f79c4da4 8051412a 84116a54 8057be15 00000000 nt!KiInSwapProcesses+0x33
f79c4dac 8057be15 00000000 00000000 00000000 nt!KeSwapProcessOrStack+0x73
f79c4ddc 804fa4da 804e6a98 00000000 00000000 nt!PspSystemThreadStartup+0x34
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16


STACK_COMMAND: kb

FOLLOWUP_IP:
nt!KiInSwapProcesses+33
805141d1 8910 mov dword ptr [eax],edx

SYMBOL_STACK_INDEX: 0

SYMBOL_NAME: nt!KiInSwapProcesses+33

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nt

IMAGE_NAME: ntoskrnl.exe

DEBUG_FLR_IMAGE_TIMESTAMP: 42250ff9

FAILURE_BUCKET_ID: 0xA_W_nt!KiInSwapProcesses+33

BUCKET_ID: 0xA_W_nt!KiInSwapProcesses+33

Followup: MachineOwner
---------



Microsoft (R) Windows Debugger Version 6.6.0007.5
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Documents and Settings\mcomer\Desktop\C340 Minidumps\Mini103106-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: srv*c:\progra~1\websymbols\*http://msdl.microsoft.com/download/symbols
Executable search path is: c:\
Debugger can not determine kernel base address
Windows XP Kernel Version 2600 (Service Pack 2) UP Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
ðßÿ3Û
â„¢p;Æ’Aýÿÿƒùu‹
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055a420
Debug session time: Tue Oct 31 13:50:43.615 2006 (GMT-5)
System Uptime: 0 days 6:38:16.545
Debugger can not determine kernel base address
Loading Kernel Symbols
.Image path too long, possible corrupt data.
.....WARNING: WMILIB overlaps kdcom
.......WARNING: aliide overlaps kdcom
.....WARNING: dmload overlaps kdcom
.......................................WARNING: nic1394 overlaps i8042prt
Image path too long, possible corrupt data.
................................................................................
Loading User Symbols
Loading unloaded module list
..........................
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1000007F, {d, 0, 0, 0}

*** WARNING: Unable to verify timestamp for HSF_CNXT.sys
*** ERROR: Module load completed but symbols could not be loaded for HSF_CNXT.sys
Probably caused by : memory_corruption

Followup: memory_corruption
---------

kd> !ANALYZE -V

Unknown option '-V'
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1000007F, {d, 0, 0, 0}

Probably caused by : memory_corruption

Followup: memory_corruption
---------

kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

UNEXPECTED_KERNEL_MODE_TRAP_M (1000007f)
This means a trap occurred in kernel mode, and it's a trap of a kind
that the kernel isn't allowed to have/catch (bound trap) or that
is always instant death (double fault). The first number in the
bugcheck params is the number of the trap (8 = double fault, etc)
Consult an Intel x86 family manual to learn more about what these
traps are. Here is a *portion* of those codes:
If kv shows a taskGate
use .tss on the part before the colon, then kv.
Else if kv shows a trapframe
use .trap on that value
Else
.trap on the appropriate frame will show where the trap was taken
(on x86, this will be the ebp that goes with the procedure KiTrap)
Endif
kb will then show the corrected stack.
Arguments:
Arg1: 0000000d, EXCEPTION_GP_FAULT
Arg2: 00000000
Arg3: 00000000
Arg4: 00000000

Debugging Details:
------------------


BUGCHECK_STR: 0x7f_d

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: CODE_CORRUPTION

PROCESS_NAME: Idle

MISALIGNED_IP:
ptilink!PtiReceivePacket+210
f787f290 17 pop ss

LAST_CONTROL_TRANSFER: from 8055019c to f787f290

STACK_TEXT:
80550080 8055019c 84181c38 f6fd1048 841818d8 ptilink!PtiReceivePacket+0x210
80550090 84181ca0 f6fdf926 8418f8fc f27811e0 nt!CmpRegistryLock+0x3c
WARNING: Frame IP not in any known module. Following frames may be wrong.
80550094 f6fdf926 8418f8fc f27811e0 f2777385 0x84181ca0
80550098 8418f8fc f27811e0 f2777385 00000000 HSF_CNXT+0x9a926
8055009c f27811e0 f2777385 00000000 842118d8 0x8418f8fc
805500a0 f2777384 00000000 842118d8 f78753f0 rdbss!s_RxTimerDpc
805500a4 00000000 842118d8 f78753f0 84211038 rdbss!RxShouldRequestBeThrottled <PERF> (rdbss+0x384)


STACK_COMMAND: kb

CHKIMG_EXTENSION: !chkimg -lo 50 -db !nt
8 errors : !nt (8055e920-8055e92b)
8055e920 *94 *c1 *06 *00 5d d4 c1 e3 *0a *79 *01 *00 a4 fc ff ff ....]....y......

MODULE_NAME: memory_corruption

IMAGE_NAME: memory_corruption

FOLLOWUP_NAME: memory_corruption

DEBUG_FLR_IMAGE_TIMESTAMP: 0

MEMORY_CORRUPTOR: STRIDE

FAILURE_BUCKET_ID: MEMORY_CORRUPTION_STRIDE

BUCKET_ID: MEMORY_CORRUPTION_STRIDE

Followup: memory_corruption

--------
Microsoft (R) Windows Debugger Version 6.6.0007.5
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Documents and Settings\mcomer\Desktop\C340 Minidumps\Mini103106-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: srv*c:\progra~1\websymbols\*http://msdl.microsoft.com/download/symbols
Executable search path is: c:\
Debugger can not determine kernel base address
Windows XP Kernel Version 2600 (Service Pack 2) UP Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
ðßÿ3Û
â„¢p;Æ’Aýÿÿƒùu‹
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055a420
Debug session time: Tue Oct 31 13:50:43.615 2006 (GMT-5)
System Uptime: 0 days 6:38:16.545
Debugger can not determine kernel base address
Loading Kernel Symbols
.Image path too long, possible corrupt data.
.....WARNING: WMILIB overlaps kdcom
.......WARNING: aliide overlaps kdcom
.....WARNING: dmload overlaps kdcom
.......................................WARNING: nic1394 overlaps i8042prt
Image path too long, possible corrupt data.
................................................................................
Loading User Symbols
Loading unloaded module list
..........................
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1000007F, {d, 0, 0, 0}

*** WARNING: Unable to verify timestamp for HSF_CNXT.sys
*** ERROR: Module load completed but symbols could not be loaded for HSF_CNXT.sys
Probably caused by : memory_corruption

Followup: memory_corruption
---------

kd> !ANALYZE -V

Unknown option '-V'
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1000007F, {d, 0, 0, 0}

Probably caused by : memory_corruption

Followup: memory_corruption
---------

kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

UNEXPECTED_KERNEL_MODE_TRAP_M (1000007f)
This means a trap occurred in kernel mode, and it's a trap of a kind
that the kernel isn't allowed to have/catch (bound trap) or that
is always instant death (double fault). The first number in the
bugcheck params is the number of the trap (8 = double fault, etc)
Consult an Intel x86 family manual to learn more about what these
traps are. Here is a *portion* of those codes:
If kv shows a taskGate
use .tss on the part before the colon, then kv.
Else if kv shows a trapframe
use .trap on that value
Else
.trap on the appropriate frame will show where the trap was taken
(on x86, this will be the ebp that goes with the procedure KiTrap)
Endif
kb will then show the corrected stack.
Arguments:
Arg1: 0000000d, EXCEPTION_GP_FAULT
Arg2: 00000000
Arg3: 00000000
Arg4: 00000000

Debugging Details:
------------------


BUGCHECK_STR: 0x7f_d

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: CODE_CORRUPTION

PROCESS_NAME: Idle

MISALIGNED_IP:
ptilink!PtiReceivePacket+210
f787f290 17 pop ss

LAST_CONTROL_TRANSFER: from 8055019c to f787f290

STACK_TEXT:
80550080 8055019c 84181c38 f6fd1048 841818d8 ptilink!PtiReceivePacket+0x210
80550090 84181ca0 f6fdf926 8418f8fc f27811e0 nt!CmpRegistryLock+0x3c
WARNING: Frame IP not in any known module. Following frames may be wrong.
80550094 f6fdf926 8418f8fc f27811e0 f2777385 0x84181ca0
80550098 8418f8fc f27811e0 f2777385 00000000 HSF_CNXT+0x9a926
8055009c f27811e0 f2777385 00000000 842118d8 0x8418f8fc
805500a0 f2777384 00000000 842118d8 f78753f0 rdbss!s_RxTimerDpc
805500a4 00000000 842118d8 f78753f0 84211038 rdbss!RxShouldRequestBeThrottled <PERF> (rdbss+0x384)


STACK_COMMAND: kb

CHKIMG_EXTENSION: !chkimg -lo 50 -db !nt
8 errors : !nt (8055e920-8055e92b)
8055e920 *94 *c1 *06 *00 5d d4 c1 e3 *0a *79 *01 *00 a4 fc ff ff ....]....y......

MODULE_NAME: memory_corruption

IMAGE_NAME: memory_corruption

FOLLOWUP_NAME: memory_corruption

DEBUG_FLR_IMAGE_TIMESTAMP: 0

MEMORY_CORRUPTOR: STRIDE

FAILURE_BUCKET_ID: MEMORY_CORRUPTION_STRIDE

BUCKET_ID: MEMORY_CORRUPTION_STRIDE

Followup: memory_corruption
---------

 

The first minidump has over 3000 memory corruption and this is symptom of corrupted paging space. Probably the ram is faulty and corrupt the paging space. The first minidump of the second post also have memory corruption and it is the symptom of faulty ram.

Suggestion
1. Run chkdsk /r and re-allocate the paging space.
2. Run memtest to stress the ram

 

I figured that MEMORY_CORRUPTION_LARGE probably indicated bad RAM. It's hard to test the RAM, though, since the BSOD only happens about once a week. I Ran memtest overnight for 15 hours- zero errors (although i hear it doesn't always work). Ran chkdsk /r, no bad sectors and no errors. How do I reallocate the paging space? I'm assuming it's a registry setting? What settings should I use? Computer has a P4 2.66 GHz with 512 RAM, if that matters. Also I see IRQL_NOT_LESS_OR_EQUAL (a) in all the 0a bugchecks. What does this mean?

 

To reallocate the paging file, try these steps:
1) Go to Start...Run...and type in "sysdm.cpl" (without the quotes) and press Enter
2) Click on the Advanced Tab
3) Click on the Performance Settings Button
4) Click on the next Advanced Tab
5) Click on the Virtual Memory Change Button
6) Note the settings on this page (so you can restore them later)
7) Click on the No Paging File Radio Button, then click on the Set Button
8) Click on OK 3 times to exit the dialog.
9) Reboot the system
10) Do steps 1 to 5 again
11) Re-enter the old settings for the paging file into the dialog spaces there, then click on the Set Button
12) Click on OK 3 times to exit the dialog
13) Reboot the system again

This will delete your paging file, and then will rebuild a new one for you.

The other BSOD errors can be caused by many things - but most likely are a result of the memory corruption that cpc2004 has mentioned. Try fixing the memory issues and then seeing if the other errors disappear.

 

still getting errors

Well, I've tried reallocating the paging file, tested 5 different sticks of RAM in various combinations, and I still get blue screens. chkdsk /r returned no errors. It also freezes when it enters standby after idling for a while, and won't accept any input to wake it up. Half the time, it won't even generate dumps when it crashes. I'm running out of ideas here. Any other suggestions?

 

Hardware Problem

No minidump is usually related to hardware problem. It may be ram, motherboard or PSU. Check your motherboard and look for bulgy capacitors. What is the output capacity of the Power Supply Unit?

 

sonofa#@%^$! Still getting bluescreens.

Well, here's where I'm at now: Laptop is an hp/compaq nx9010 (90W PSU)

Reinstalled XP Pro (Build 2600 SP2).
Reseated all hardware right down to the CPU.
Tried various combinations of 5 diferent sticks of pc2700 RAM.
Reallocated Paging file space.
Checked motherboard- no bulgy capacitors.
Ran Memtest86- no errors.
Ran Windows Memory Diagnostics- no errors.
Ran CPU stability test- no errors.
No antivirus SW running.

Now when the system crashes (once every other day), it will only generate corrupt dumps. Bugchecks are still predominantly 0a and d1 per the system log. I think i'm gonna toss this thing out the window......

 

When windows crashes, windows recovery routine takes a minidump. During dump taking, another hardware error occurs. Windows recovery routine takes control as recovery is in progress, winodws will reboot to avoid recursive recovery loop. Corrupt minidump is the symptom of severe hardware (ie RAM, PSU and etc).

Corrupt minidump is the symptom of hardware error.