BSOD fairly often.

I've been getting BSODs pretty regularly on my machine lately. They vary in details, here is the latest one (sorry I only have this one as it is set to overwrite) I think all of them so far have shown the fault to be propably caused by ntkrnlmp.exe. Here is the log from debugwiz. Any help would be appreciated. I can post more logs as it reboots, (usually 1-2 times a day sometimes when I'm not even on it)


Opened log file 'c:\debuglog.txt'
Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols

Microsoft (R) Windows Debugger Version 6.3.0017.0
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\WINDOWS\MEMORY.DMP]
Kernel Summary Dump File: Only kernel address space is available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: C:\WINDOWS;C:\WINDOWS\system32;C:\WINDOWS\system32\drivers
Windows XP Kernel Version 2600 (Service Pack 2) MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 2600.xpsp_sp2_rtm.040803-2158
Kernel base = 0x804d7000 PsLoadedModuleList = 0x805644a0
Debug session time: Wed Oct 06 08:39:50 2004
System Uptime: 0 days 10:30:47.050
Loading Kernel Symbols
..................................................................................................................................
Loading unloaded module list
.....................
Loading User Symbols
PEB is paged out (Peb.Ldr = 7ffd700c). Type ".hh dbgerr001" for details
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck D1, {0, 2, 0, 0}

Probably caused by : ntkrnlmp.exe ( nt!KiTrap0E+238 )

Followup: MachineOwner
---------

0: kd> !analyze -v;r;kv;lmtn;.logclose;q
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: 00000000, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000000, value 0 = read operation, 1 = write operation
Arg4: 00000000, address which referenced memory

Debugging Details:
------------------


READ_ADDRESS: 00000000

CURRENT_IRQL: 2

FAULTING_IP:
+0
00000000 ?? ???

DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: 0xD1

LAST_CONTROL_TRANSFER: from 00000000 to 00000000

STACK_TEXT:
f8bd0cf0 00000000 00000000 00000000 00000000 0x0
b20bf8c4 80570593 b20bf9b8 b20bf9ac b20bf99c nt!KiCallUserMode+0x4
b20bf920 bf8888f9 00000000 e2cf4008 00000400 nt!KeUserModeCallback+0x87
b20bfbf4 bf813ea0 bc6455a0 0000004a 0001014e win32k!SfnCOPYDATA+0x1d3
b20bfc3c bf83c607 006455a0 0000004a 0001014e win32k!xxxSendMessageToClient+0x176
b20bfcac bf801e58 e1f3f318 b20bfd64 00000000 win32k!xxxReceiveMessage+0x2b5
b20bfce8 bf80365e b20bfd14 000025ff 00000000 win32k!xxxRealInternalGetMessage+0x1d7
b20bfd48 804ddf0f 00f8ff28 00000000 00000000 win32k!NtUserPeekMessage+0x40
b20bfd48 7c90eb94 00f8ff28 00000000 00000000 nt!KiFastCallEntry+0xfc
WARNING: Frame IP not in any known module. Following frames may be wrong.
00f8fa98 00000000 00000000 00000000 00000000 0x7c90eb94


FAILED_INSTRUCTION_ADDRESS:
+0
00000000 ?? ???

FOLLOWUP_IP:
nt!KiTrap0E+238
804e106f f7457000000200 test dword ptr [ebp+0x70],0x20000

SYMBOL_STACK_INDEX: 0

FOLLOWUP_NAME: MachineOwner

SYMBOL_NAME: nt!KiTrap0E+238

MODULE_NAME: nt

IMAGE_NAME: ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP: 41107faa

STACK_COMMAND: .trap fffffffff8bd0c80 ; kb

BUCKET_ID: 0xD1_CODE_AV_BAD_IP_nt!KiTrap0E+238

Followup: MachineOwner
---------

eax=ffdff13c ebx=00000002 ecx=00000000 edx=40000000 esi=00000000 edi=00000000
eip=804e106f esp=f8bd0c68 ebp=f8bd0c80 iopl=0 nv up ei ng nz na po nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00000286
nt!KiTrap0E+0x238:
804e106f f7457000000200 test dword ptr [ebp+0x70],0x20000 ss:0010:f8bd0cf0=00010283
ChildEBP RetAddr Args to Child
f8bd0c80 00000000 badb0d00 00000000 00000000 nt!KiTrap0E+0x238 (FPO: [0,0] TrapFrame @ f8bd0c80)
f8bd0cf0 00000000 00000000 00000000 00000000 0x0
b20bf8c4 80570593 b20bf9b8 b20bf9ac b20bf99c nt!KiCallUserMode+0x4 (FPO: [2,3,4])
b20bf920 bf8888f9 00000000 e2cf4008 00000400 nt!KeUserModeCallback+0x87 (FPO: [Non-Fpo])
b20bfbf4 bf813ea0 bc6455a0 0000004a 0001014e win32k!SfnCOPYDATA+0x1d3 (FPO: [Non-Fpo])
b20bfc3c bf83c607 006455a0 0000004a 0001014e win32k!xxxSendMessageToClient+0x176 (FPO: [Non-Fpo])
b20bfcac bf801e58 e1f3f318 b20bfd64 00000000 win32k!xxxReceiveMessage+0x2b5 (FPO: [Non-Fpo])
b20bfce8 bf80365e b20bfd14 000025ff 00000000 win32k!xxxRealInternalGetMessage+0x1d7 (FPO: [Non-Fpo])
b20bfd48 804ddf0f 00f8ff28 00000000 00000000 win32k!NtUserPeekMessage+0x40 (FPO: [Non-Fpo])
b20bfd48 7c90eb94 00f8ff28 00000000 00000000 nt!KiFastCallEntry+0xfc (FPO: [0,0] TrapFrame @ b20bfd64)
WARNING: Frame IP not in any known module. Following frames may be wrong.
00f8fa98 00000000 00000000 00000000 00000000 0x7c90eb94
start end module name
804d7000 80701000 nt ntkrnlmp.exe Wed Aug 04 01:18:18 2004 (41107FAA)
80701000 80721d00 hal halmacpi.dll Wed Aug 04 00:59:09 2004 (41107B2D)
b1dfd000 b1e3d380 HTTP HTTP.sys Wed Aug 04 01:00:09 2004 (41107B69)
b2113000 b2127400 wdmaud wdmaud.sys Wed Aug 04 01:15:03 2004 (41107EE7)
b21a0000 b22356a0 NAVEX15 NAVEX15.sys Fri Jul 23 12:50:12 2004 (41014FD4)
b2236000 b2274000 NAVAP NAVAP.sys Mon Aug 11 07:39:42 2003 (3F378E8E)
b2274000 b2284a60 SYMEVENT SYMEVENT.SYS Wed May 14 00:45:43 2003 (3EC1D807)
b23f5000 b24045a0 NAVENG NAVENG.sys Fri Jul 23 12:50:57 2004 (41015001)
b248d000 b249bd80 sysaudio sysaudio.sys Wed Aug 04 01:15:54 2004 (41107F1A)
b2555000 b25a7180 srv srv.sys Wed Aug 04 01:14:44 2004 (41107ED4)
b25a8000 b25b9000 NAVAPEL NAVAPEL.SYS Mon Aug 11 07:39:47 2003 (3F378E93)
b25b9000 b2634000 CVPNDRVA CVPNDRVA.sys Thu Apr 10 08:45:29 2003 (3E957579)
b2724000 b2750400 mrxdav mrxdav.sys Wed Aug 04 01:00:49 2004 (41107B91)
b2755000 b2757e80 secdrv secdrv.sys Fri Jan 16 07:16:04 2004 (4007E414)
b2761000 b2764da0 PfModNT PfModNT.sys Tue Mar 04 22:19:28 2003 (3E657AD0)
b2a49000 b2a4c280 ndisuio ndisuio.sys Wed Aug 04 01:03:10 2004 (41107C1E)
b2b61000 b2b78480 dump_atapi dump_atapi.sys Wed Aug 04 00:59:41 2004 (41107B4D)
b2b79000 b2b96380 SaiH053c SaiH053c.sys Fri Sep 10 09:35:19 2004 (4141BBA7)
b2b97000 b2c41000 PRISMUSB PRISMUSB.sys Thu Oct 02 13:47:13 2003 (3F7C72B1)
b2c41000 b2caf380 mrxsmb mrxsmb.sys Wed Aug 04 01:15:14 2004 (41107EF2)
b2cd8000 b2d03180 rdbss rdbss.sys Wed Aug 04 01:20:05 2004 (41108015)
b2da4000 b2dc5d00 afd afd.sys Wed Aug 04 01:14:13 2004 (41107EB5)
b2dc6000 b2de6f00 ipnat ipnat.sys Wed Aug 04 01:04:48 2004 (41107C80)
b2de7000 b2e0ec00 netbt netbt.sys Wed Aug 04 01:14:36 2004 (41107ECC)
b2e0f000 b2e66a80 tcpip tcpip.sys Wed Aug 04 01:14:39 2004 (41107ECF)
b2e67000 b2e79400 ipsec ipsec.sys Wed Aug 04 01:14:27 2004 (41107EC3)
b2eb6000 b2eb8900 Dxapi Dxapi.sys Fri Aug 17 15:53:19 2001 (3B7D843F)
b2f0d000 b2f2b960 ctsfm2k ctsfm2k.sys Thu Jul 18 21:48:21 2002 (3D377DF5)
b2f2c000 b2f441a0 emupia2k emupia2k.sys Thu Jul 18 21:48:31 2002 (3D377DFF)
b2f45000 b2f59ee0 ctac32k ctac32k.sys Thu Jul 18 21:46:27 2002 (3D377D83)
b2f5a000 b2fff020 ha10kx2k ha10kx2k.sys Wed Jul 24 00:52:25 2002 (3D3E4099)
bf800000 bf9c0380 win32k win32k.sys Wed Aug 04 01:17:30 2004 (41107F7A)
bf9c1000 bf9d2580 dxg dxg.sys Wed Aug 04 01:00:51 2004 (41107B93)
bf9d3000 bfa0b000 ati2dvag ati2dvag.dll Wed Aug 25 12:29:01 2004 (412CCC5D)
bfa0b000 bfa45000 ati2cqag ati2cqag.dll Wed Aug 25 12:10:18 2004 (412CC7FA)
bfa45000 bfc67b60 ati3duag ati3duag.dll Wed Aug 25 12:25:53 2004 (412CCBA1)
bfc68000 bfcdc700 ativvaxx ativvaxx.dll Wed Aug 25 12:15:14 2004 (412CC922)
bffa0000 bffe5c00 ATMFD ATMFD.DLL Wed Aug 04 02:56:56 2004 (411096C8)
f81cc000 f81ff200 update update.sys Wed Aug 04 00:58:32 2004 (41107B08)
f8214000 f8216580 hidusb hidusb.sys Fri Aug 17 16:02:16 2001 (3B7D8658)
f8228000 f8258100 rdpdr rdpdr.sys Wed Aug 04 01:01:10 2004 (41107BA6)
f8299000 f82a8900 Cdfs Cdfs.SYS Wed Aug 04 01:14:09 2004 (41107EB1)
f82f9000 f8309e00 psched psched.sys Wed Aug 04 01:04:16 2004 (41107C60)
f830a000 f8320680 ndiswan ndiswan.sys Wed Aug 04 01:14:30 2004 (41107EC6)
f8321000 f833aec0 dne2000 dne2000.sys Mon Aug 26 19:09:40 2002 (3D6AC344)
f833b000 f8353da0 ctoss2k ctoss2k.sys Thu Jul 18 21:48:03 2002 (3D377DE3)
f8354000 f8376680 ks ks.sys Wed Aug 04 01:15:20 2004 (41107EF8)
f8377000 f839a980 portcls portcls.sys Wed Aug 04 01:15:47 2004 (41107F13)
f839b000 f8412460 ctaud2k ctaud2k.sys Thu Jul 18 21:47:51 2002 (3D377DD7)
f8413000 f8435e80 USBPORT USBPORT.SYS Wed Aug 04 01:08:34 2004 (41107D62)
f8436000 f8449780 VIDEOPRT VIDEOPRT.SYS Wed Aug 04 01:07:04 2004 (41107D08)
f844a000 f8525000 ati2mtag ati2mtag.sys Wed Aug 25 12:28:43 2004 (412CCC4B)
f856d000 f8587580 Mup Mup.sys Wed Aug 04 01:15:20 2004 (41107EF8)
f8588000 f85b4a80 NDIS NDIS.sys Wed Aug 04 01:14:27 2004 (41107EC3)
f85b5000 f8641480 Ntfs Ntfs.sys Wed Aug 04 01:15:06 2004 (41107EEA)
f8642000 f8658780 KSecDD KSecDD.sys Wed Aug 04 00:59:45 2004 (41107B51)
f8659000 f8677780 fltmgr fltmgr.sys Wed Aug 04 01:01:17 2004 (41107BAD)
f8678000 f868f480 atapi atapi.sys Wed Aug 04 00:59:41 2004 (41107B4D)
f8690000 f86b5700 dmio dmio.sys Wed Aug 04 01:07:13 2004 (41107D11)
f86b6000 f86d4880 ftdisk ftdisk.sys Fri Aug 17 15:52:41 2001 (3B7D8419)
f86d5000 f86e5a80 pci pci.sys Wed Aug 04 01:07:45 2004 (41107D31)
f86e6000 f8713d80 ACPI ACPI.sys Wed Aug 04 01:07:35 2004 (41107D27)
f8735000 f873dc00 isapnp isapnp.sys Fri Aug 17 15:58:01 2001 (3B7D8559)
f8745000 f8753e80 ohci1394 ohci1394.sys Wed Aug 04 01:10:05 2004 (41107DBD)
f8755000 f8762000 1394BUS 1394BUS.SYS Wed Aug 04 01:10:03 2004 (41107DBB)
f8765000 f876f500 MountMgr MountMgr.sys Wed Aug 04 00:58:29 2004 (41107B05)
f8775000 f8781c80 VolSnap VolSnap.sys Wed Aug 04 01:00:14 2004 (41107B6E)
f8785000 f878de00 disk disk.sys Wed Aug 04 00:59:53 2004 (41107B59)
f8795000 f87a1200 CLASSPNP CLASSPNP.SYS Wed Aug 04 01:14:26 2004 (41107EC2)
f87a5000 f87af580 agp440 agp440.sys Wed Aug 04 01:07:40 2004 (41107D2C)
f87d5000 f87def00 termdd termdd.sys Wed Aug 04 00:58:52 2004 (41107B1C)
f87e5000 f87ee480 NDProxy NDProxy.SYS Fri Aug 17 15:55:30 2001 (3B7D84C2)
f87f5000 f87fdd80 HIDCLASS HIDCLASS.SYS Wed Aug 04 01:08:18 2004 (41107D52)
f8825000 f8833100 usbhub usbhub.sys Wed Aug 04 01:08:40 2004 (41107D68)
f8845000 f8854180 nic1394 nic1394.sys Wed Aug 04 00:58:28 2004 (41107B04)
f8875000 f887d700 wanarp wanarp.sys Wed Aug 04 01:04:57 2004 (41107C89)
f8885000 f888d700 netbios netbios.sys Wed Aug 04 01:03:19 2004 (41107C27)
f88a5000 f88b3d80 arp1394 arp1394.sys Wed Aug 04 00:58:28 2004 (41107B04)
f88b5000 f88bd880 Fips Fips.SYS Fri Aug 17 20:31:49 2001 (3B7DC585)
f8915000 f891dd00 intelppm intelppm.sys Wed Aug 04 00:59:19 2004 (41107B37)
f8925000 f892dd80 AN983 AN983.sys Thu Oct 25 01:42:09 2001 (3BD7B441)
f8935000 f8943b80 drmk drmk.sys Wed Aug 04 01:07:54 2004 (41107D3A)
f8945000 f8951180 cdrom cdrom.sys Wed Aug 04 00:59:52 2004 (41107B58)
f8955000 f8963080 redbook redbook.sys Wed Aug 04 00:59:34 2004 (41107B46)
f8965000 f896f380 imapi imapi.sys Wed Aug 04 01:00:12 2004 (41107B6C)
f8975000 f8981880 rasl2tp rasl2tp.sys Wed Aug 04 01:14:21 2004 (41107EBD)
f8985000 f898f200 raspppoe raspppoe.sys Wed Aug 04 01:05:06 2004 (41107C92)
f8995000 f89a0d00 raspptp raspptp.sys Wed Aug 04 01:14:26 2004 (41107EC2)
f89a5000 f89ad900 msgpc msgpc.sys Wed Aug 04 01:04:11 2004 (41107C5B)
f89b5000 f89bb200 PCIIDEX PCIIDEX.SYS Wed Aug 04 00:59:40 2004 (41107B4C)
f89bd000 f89c1900 PartMgr PartMgr.sys Fri Aug 17 20:32:23 2001 (3B7DC5A7)
f89c5000 f89c9bc0 PxHelp20 PxHelp20.sys Tue Oct 28 12:25:49 2003 (3F9EB4AD)
f8a35000 f8a3a000 usbuhci usbuhci.sys Wed Aug 04 01:08:34 2004 (41107D62)
f8a3d000 f8a43800 usbehci usbehci.sys Wed Aug 04 01:08:34 2004 (41107D62)
f8a45000 f8a49880 TDI TDI.SYS Wed Aug 04 01:07:47 2004 (41107D33)
f8a4d000 f8a51580 ptilink ptilink.sys Fri Aug 17 15:49:53 2001 (3B7D8371)
f8a55000 f8a59080 raspti raspti.sys Fri Aug 17 15:55:32 2001 (3B7D84C4)
f8a5d000 f8a63000 kbdclass kbdclass.sys Wed Aug 04 00:58:32 2004 (41107B08)
f8a65000 f8a6aa00 mouclass mouclass.sys Wed Aug 04 00:58:32 2004 (41107B08)
f8a6d000 f8a73880 SaiNtBus SaiNtBus.sys Fri Sep 10 10:02:26 2004 (4141C202)
f8a75000 f8a7b180 HIDPARSE HIDPARSE.SYS Wed Aug 04 01:08:15 2004 (41107D4F)
f8aa5000 f8aaa200 vga vga.sys Wed Aug 04 01:07:06 2004 (41107D0A)
f8aad000 f8ab1a80 Msfs Msfs.SYS Wed Aug 04 01:00:37 2004 (41107B85)
f8ab5000 f8abc880 Npfs Npfs.SYS Wed Aug 04 01:00:38 2004 (41107B86)
f8ad5000 f8adb500 usbprint usbprint.sys Wed Aug 04 01:01:23 2004 (41107BB3)
f8add000 f8ae4b80 usbccgp usbccgp.sys Wed Aug 04 01:08:45 2004 (41107D6D)
f8afd000 f8b01500 watchdog watchdog.sys Wed Aug 04 01:07:32 2004 (41107D24)
f8b3d000 f8b42980 NIOC NIOC.SYS Fri Sep 27 04:15:02 2002 (3D942196)
f8b45000 f8b48000 BOOTVID BOOTVID.dll Fri Aug 17 15:49:09 2001 (3B7D8345)
f8bc9000 f8bcb280 rasacd rasacd.sys Fri Aug 17 15:55:39 2001 (3B7D84CB)
f8be9000 f8beb980 gameenum gameenum.sys Wed Aug 04 01:08:20 2004 (41107D54)
f8bf9000 f8bfb580 ndistapi ndistapi.sys Fri Aug 17 15:55:29 2001 (3B7D84C1)
f8c0d000 f8c10c80 mssmbios mssmbios.sys Wed Aug 04 01:07:47 2004 (41107D33)
f8c29000 f8c2cd00 SaiMini SaiMini.sys Fri Sep 10 10:02:26 2004 (4141C202)
f8c2d000 f8c2ff80 mouhid mouhid.sys Fri Aug 17 15:47:57 2001 (3B7D82FD)
f8c31000 f8c34a00 kbdhid kbdhid.sys Wed Aug 04 00:58:33 2004 (41107B09)
f8c35000 f8c36b80 kdcom kdcom.dll Fri Aug 17 15:49:10 2001 (3B7D8346)
f8c37000 f8c38100 WMILIB WMILIB.SYS Fri Aug 17 16:07:23 2001 (3B7D878B)
f8c39000 f8c3a700 dmload dmload.sys Fri Aug 17 15:58:15 2001 (3B7D8567)
f8c47000 f8c48600 ctprxy2k ctprxy2k.sys Thu Jul 18 21:48:06 2002 (3D377DE6)
f8c49000 f8c4a100 swenum swenum.sys Wed Aug 04 00:58:41 2004 (41107B11)
f8c4b000 f8c4c280 USBD USBD.SYS Fri Aug 17 16:02:58 2001 (3B7D8682)
f8c4d000 f8c4ef00 Fs_Rec Fs_Rec.SYS Fri Aug 17 15:49:37 2001 (3B7D8361)
f8c4f000 f8c50080 Beep Beep.SYS Fri Aug 17 15:47:33 2001 (3B7D82E5)
f8c51000 f8c52080 mnmdd mnmdd.SYS Fri Aug 17 15:57:28 2001 (3B7D8538)
f8c53000 f8c54080 RDPCDD RDPCDD.sys Fri Aug 17 15:46:56 2001 (3B7D82C0)
f8c63000 f8c64100 dump_WMILIB dump_WMILIB.SYS Fri Aug 17 16:07:23 2001 (3B7D878B)
f8cfd000 f8cfdd00 pciide pciide.sys Fri Aug 17 15:51:49 2001 (3B7D83E5)
f8d9d000 f8d9dd00 dxgthk dxgthk.sys Fri Aug 17 15:53:12 2001 (3B7D8438)
f8db7000 f8db7b80 Null Null.SYS Fri Aug 17 15:47:39 2001 (3B7D82EB)
f8e5d000 f8e5dc00 audstub audstub.sys Fri Aug 17 15:59:40 2001 (3B7D85BC)

Unloaded modules:
b1a61000 b1a8b000 kmixer.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
b1a61000 b1a8b000 kmixer.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
b1a61000 b1a8b000 kmixer.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
b1a61000 b1a8b000 kmixer.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
b1a61000 b1a8b000 kmixer.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
b1a61000 b1a8b000 kmixer.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
b1ab3000 b1add000 kmixer.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
b2026000 b2050000 kmixer.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
f8e5a000 f8e5b000 drmkaud.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
b2d54000 b2d61000 DMusic.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
b20f0000 b2113000 aec.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
b268c000 b269a000 swmidi.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
f8cb3000 f8cb5000 splitter.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
b28c9000 b28d9000 Serial.SYS
Timestamp: unavailable (00000000)
Checksum: 00000000
b26e8000 b26fc000 Parport.SYS
Timestamp: unavailable (00000000)
Checksum: 00000000
f8895000 f889e000 processr.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
f8865000 f8872000 i8042prt.SYS
Timestamp: unavailable (00000000)
Checksum: 00000000
f8a9d000 f8aa2000 Cdaudio.SYS
Timestamp: unavailable (00000000)
Checksum: 00000000
f8525000 f8528000 Sfloppy.SYS
Timestamp: unavailable (00000000)
Checksum: 00000000
f8a95000 f8a9a000 Flpydisk.SYS
Timestamp: unavailable (00000000)
Checksum: 00000000
f8a8d000 f8a94000 Fdc.SYS
Timestamp: unavailable (00000000)
Checksum: 00000000
Closing open log file c:\debuglog.txt

 

Almost certainly a driver issue. We do have one regular who can read these dang logs and if he looks in he will probably be able to give you more specifics.

Meanwhile I can fumble around some.

- have you added new hardware lately or updated any drivers?
- since video is often the cause of these things, you might try getting a fresh copy of the latest drivers and updating your video.

With the BSOD you should get a series of numbers following the fairly useless DRIVER_IRQL_NOT_LESS_OR_EQUAL you see on screen. These can often be used to track down the issue.

Otherwise I think we gotta wait for Joe.

 

here is the latest. Just happened.

Opened log file 'c:\debuglog.txt'
Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols

Microsoft (R) Windows Debugger Version 6.3.0017.0
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\WINDOWS\MEMORY.DMP]
Kernel Summary Dump File: Only kernel address space is available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: C:\WINDOWS;C:\WINDOWS\system32;C:\WINDOWS\system32\drivers
Windows XP Kernel Version 2600 (Service Pack 2) MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 2600.xpsp_sp2_rtm.040803-2158
Kernel base = 0x804d7000 PsLoadedModuleList = 0x805644a0
Debug session time: Wed Oct 06 19:18:57 2004
System Uptime: 0 days 10:37:57.069
Loading Kernel Symbols
....................................................................................................................................
Loading unloaded module list
.................
Loading User Symbols
PEB is paged out (Peb.Ldr = 7ffda00c). Type ".hh dbgerr001" for details
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1A, {41785, c0c00000, c726, 0}

*** ERROR: Module load completed but symbols could not be loaded for NAVAP.sys
*** ERROR: Module load completed but symbols could not be loaded for NAVEX15.sys
Probably caused by : Pool_Corruption ( nt!ExFreePool+f )

Followup: Pool_corruption
---------

1: kd> !analyze -v;r;kv;lmtn;.logclose;q
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

MEMORY_MANAGEMENT (1a)
# Any other values for parameter 1 must be individually examined.
Arguments:
Arg1: 00041785, The working set list is corrupt.
Arg2: c0c00000
Arg3: 0000c726
Arg4: 00000000

Debugging Details:
------------------


BUGCHECK_STR: 0x1a_41785

DEFAULT_BUCKET_ID: DRIVER_FAULT

LAST_CONTROL_TRANSFER: from 8052a38c to 80537832

STACK_TEXT:
b251094c 8052a38c 0000001a 00041785 c0c00000 nt!KeBugCheckEx+0x1b
b2510964 804f02c2 00002355 0000000f 80568900 nt!MiRemoveWsle+0x17
b2510a10 8054e043 c038cd70 00000008 00000300 nt!MiDeleteSystemPagableVm+0xeb
b2510a4c 8055282f 00002363 00000000 fbe7f638 nt!MiFreePoolPages+0x51b
b2510a8c 805523e3 e3355000 00000000 fbe7f63c nt!ExFreePoolWithTag+0x1ba
b2510a9c b1fa3cc0 e3355000 fc1f4190 00000000 nt!ExFreePool+0xf
WARNING: Stack unwind information not available. Following frames may be wrong.
fbe7f63c b1fa2e40 e3355000 b1f9225c e3355008 NAVAP+0x2dcc0
fbe7f68c b1f0373d b1fadbf0 e1f4d368 e1aa3010 NAVAP+0x2ce40
fbe7f714 b1f0391d 00000002 e1f4d368 00000000 NAVEX15+0x2373d
fbe7f778 b1f03ca8 b1fadbf0 e1f4d368 e1aa3010 NAVEX15+0x2391d
fbe7f7ac b1f87d84 b1fadbf0 e1f4d368 e1aa3010 NAVEX15+0x23ca8
00000000 00000000 00000000 00000000 00000000 NAVAP+0x11d84


FOLLOWUP_IP:
nt!ExFreePool+f
805523e3 5d pop ebp

SYMBOL_STACK_INDEX: 5

FOLLOWUP_NAME: Pool_corruption

SYMBOL_NAME: nt!ExFreePool+f

MODULE_NAME: Pool_Corruption

IMAGE_NAME: Pool_Corruption

DEBUG_FLR_IMAGE_TIMESTAMP: 0

STACK_COMMAND: kb

BUCKET_ID: 0x1a_41785_nt!ExFreePool+f

Followup: Pool_corruption
---------

eax=f89cd13c ebx=c0c00000 ecx=00000000 edx=c0c00000 esi=81abe728 edi=0000c726
eip=80537832 esp=b2510934 ebp=b251094c iopl=0 nv up ei ng nz na po nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00000286
nt!KeBugCheckEx+0x1b:
80537832 5d pop ebp
ChildEBP RetAddr Args to Child
b251094c 8052a38c 0000001a 00041785 c0c00000 nt!KeBugCheckEx+0x1b (FPO: [Non-Fpo])
b2510964 804f02c2 00002355 0000000f 80568900 nt!MiRemoveWsle+0x17 (FPO: [0,0,0])
b2510a10 8054e043 c038cd70 00000008 00000300 nt!MiDeleteSystemPagableVm+0xeb (FPO: [Non-Fpo])
b2510a4c 8055282f 00002363 00000000 fbe7f638 nt!MiFreePoolPages+0x51b (FPO: [Non-Fpo])
b2510a8c 805523e3 e3355000 00000000 fbe7f63c nt!ExFreePoolWithTag+0x1ba (FPO: [Non-Fpo])
b2510a9c b1fa3cc0 e3355000 fc1f4190 00000000 nt!ExFreePool+0xf (FPO: [Non-Fpo])
WARNING: Stack unwind information not available. Following frames may be wrong.
fbe7f63c b1fa2e40 e3355000 b1f9225c e3355008 NAVAP+0x2dcc0
fbe7f68c b1f0373d b1fadbf0 e1f4d368 e1aa3010 NAVAP+0x2ce40
fbe7f714 b1f0391d 00000002 e1f4d368 00000000 NAVEX15+0x2373d
fbe7f778 b1f03ca8 b1fadbf0 e1f4d368 e1aa3010 NAVEX15+0x2391d
fbe7f7ac b1f87d84 b1fadbf0 e1f4d368 e1aa3010 NAVEX15+0x23ca8
00000000 00000000 00000000 00000000 00000000 NAVAP+0x11d84
start end module name
804d7000 80701000 nt ntkrnlmp.exe Wed Aug 04 01:18:18 2004 (41107FAA)
80701000 80721d00 hal halmacpi.dll Wed Aug 04 00:59:09 2004 (41107B2D)
b181b000 b1844f00 kmixer kmixer.sys Wed Aug 04 01:07:46 2004 (41107D32)
b1b8d000 b1bcd380 HTTP HTTP.sys Wed Aug 04 01:00:09 2004 (41107B69)
b1e2b000 b1e3f400 wdmaud wdmaud.sys Wed Aug 04 01:15:03 2004 (41107EE7)
b1ee0000 b1f756a0 NAVEX15 NAVEX15.sys Fri Jul 23 12:50:12 2004 (41014FD4)
b1f76000 b1fb4000 NAVAP NAVAP.sys Mon Aug 11 07:39:42 2003 (3F378E8E)
b1fb4000 b1fc4a60 SYMEVENT SYMEVENT.SYS Wed May 14 00:45:43 2003 (3EC1D807)
b226d000 b22bf180 srv srv.sys Wed Aug 04 01:14:44 2004 (41107ED4)
b22e8000 b22f9000 NAVAPEL NAVAPEL.SYS Mon Aug 11 07:39:47 2003 (3F378E93)
b22f9000 b2374000 CVPNDRVA CVPNDRVA.sys Thu Apr 10 08:45:29 2003 (3E957579)
b23ac000 b23bad80 sysaudio sysaudio.sys Wed Aug 04 01:15:54 2004 (41107F1A)
b2464000 b2490400 mrxdav mrxdav.sys Wed Aug 04 01:00:49 2004 (41107B91)
b2535000 b2538da0 PfModNT PfModNT.sys Tue Mar 04 22:19:28 2003 (3E657AD0)
b2581000 b25905a0 NAVENG NAVENG.sys Fri Jul 23 12:50:57 2004 (41015001)
b263d000 b263fe80 secdrv secdrv.sys Fri Jan 16 07:16:04 2004 (4007E414)
b2781000 b2784280 ndisuio ndisuio.sys Wed Aug 04 01:03:10 2004 (41107C1E)
b28a1000 b28b8480 dump_atapi dump_atapi.sys Wed Aug 04 00:59:41 2004 (41107B4D)
b28b9000 b28d6380 SaiH053c SaiH053c.sys Fri Sep 10 09:35:19 2004 (4141BBA7)
b28ff000 b29a9000 PRISMUSB PRISMUSB.sys Thu Oct 02 13:47:13 2003 (3F7C72B1)
b29a9000 b2a17380 mrxsmb mrxsmb.sys Wed Aug 04 01:15:14 2004 (41107EF2)
b2a18000 b2a43180 rdbss rdbss.sys Wed Aug 04 01:20:05 2004 (41108015)
b2ae4000 b2b05d00 afd afd.sys Wed Aug 04 01:14:13 2004 (41107EB5)
b2b06000 b2b26f00 ipnat ipnat.sys Wed Aug 04 01:04:48 2004 (41107C80)
b2b27000 b2b4ec00 netbt netbt.sys Wed Aug 04 01:14:36 2004 (41107ECC)
b2b4f000 b2ba6a80 tcpip tcpip.sys Wed Aug 04 01:14:39 2004 (41107ECF)
b2ba7000 b2bb9400 ipsec ipsec.sys Wed Aug 04 01:14:27 2004 (41107EC3)
b2f0d000 b2f2b960 ctsfm2k ctsfm2k.sys Thu Jul 18 21:48:21 2002 (3D377DF5)
b2f2c000 b2f441a0 emupia2k emupia2k.sys Thu Jul 18 21:48:31 2002 (3D377DFF)
b2f45000 b2f59ee0 ctac32k ctac32k.sys Thu Jul 18 21:46:27 2002 (3D377D83)
b2f5a000 b2fff020 ha10kx2k ha10kx2k.sys Wed Jul 24 00:52:25 2002 (3D3E4099)
bf800000 bf9c0380 win32k win32k.sys Wed Aug 04 01:17:30 2004 (41107F7A)
bf9c1000 bf9d2580 dxg dxg.sys Wed Aug 04 01:00:51 2004 (41107B93)
bf9d3000 bfa0b000 ati2dvag ati2dvag.dll Wed Aug 25 12:29:01 2004 (412CCC5D)
bfa0b000 bfa45000 ati2cqag ati2cqag.dll Wed Aug 25 12:10:18 2004 (412CC7FA)
bfa45000 bfc67b60 ati3duag ati3duag.dll Wed Aug 25 12:25:53 2004 (412CCBA1)
bfc68000 bfcdc700 ativvaxx ativvaxx.dll Wed Aug 25 12:15:14 2004 (412CC922)
bffa0000 bffe5c00 ATMFD ATMFD.DLL Wed Aug 04 02:56:56 2004 (411096C8)
f81b1000 f81e4200 update update.sys Wed Aug 04 00:58:32 2004 (41107B08)
f8210000 f8212580 hidusb hidusb.sys Fri Aug 17 16:02:16 2001 (3B7D8658)
f8228000 f8258100 rdpdr rdpdr.sys Wed Aug 04 01:01:10 2004 (41107BA6)
f8279000 f8288900 Cdfs Cdfs.SYS Wed Aug 04 01:14:09 2004 (41107EB1)
f82f9000 f8309e00 psched psched.sys Wed Aug 04 01:04:16 2004 (41107C60)
f830a000 f8320680 ndiswan ndiswan.sys Wed Aug 04 01:14:30 2004 (41107EC6)
f8321000 f833aec0 dne2000 dne2000.sys Mon Aug 26 19:09:40 2002 (3D6AC344)
f833b000 f8353da0 ctoss2k ctoss2k.sys Thu Jul 18 21:48:03 2002 (3D377DE3)
f8354000 f8376680 ks ks.sys Wed Aug 04 01:15:20 2004 (41107EF8)
f8377000 f839a980 portcls portcls.sys Wed Aug 04 01:15:47 2004 (41107F13)
f839b000 f8412460 ctaud2k ctaud2k.sys Thu Jul 18 21:47:51 2002 (3D377DD7)
f8413000 f8435e80 USBPORT USBPORT.SYS Wed Aug 04 01:08:34 2004 (41107D62)
f8436000 f8449780 VIDEOPRT VIDEOPRT.SYS Wed Aug 04 01:07:04 2004 (41107D08)
f844a000 f8525000 ati2mtag ati2mtag.sys Wed Aug 25 12:28:43 2004 (412CCC4B)
f8541000 f8544a00 kbdhid kbdhid.sys Wed Aug 04 00:58:33 2004 (41107B09)
f8545000 f8547f80 mouhid mouhid.sys Fri Aug 17 15:47:57 2001 (3B7D82FD)
f8549000 f854cd00 SaiMini SaiMini.sys Fri Sep 10 10:02:26 2004 (4141C202)
f856d000 f8587580 Mup Mup.sys Wed Aug 04 01:15:20 2004 (41107EF8)
f8588000 f85b4a80 NDIS NDIS.sys Wed Aug 04 01:14:27 2004 (41107EC3)
f85b5000 f8641480 Ntfs Ntfs.sys Wed Aug 04 01:15:06 2004 (41107EEA)
f8642000 f8658780 KSecDD KSecDD.sys Wed Aug 04 00:59:45 2004 (41107B51)
f8659000 f8678000 fltmgr fltmgr.sys unavailable (FFFFFFFE)
f8678000 f868f480 atapi atapi.sys Wed Aug 04 00:59:41 2004 (41107B4D)
f8690000 f86b5700 dmio dmio.sys Wed Aug 04 01:07:13 2004 (41107D11)
f86b6000 f86d4880 ftdisk ftdisk.sys Fri Aug 17 15:52:41 2001 (3B7D8419)
f86d5000 f86e5a80 pci pci.sys Wed Aug 04 01:07:45 2004 (41107D31)
f86e6000 f8713d80 ACPI ACPI.sys Wed Aug 04 01:07:35 2004 (41107D27)
f8735000 f873dc00 isapnp isapnp.sys Fri Aug 17 15:58:01 2001 (3B7D8559)
f8745000 f8753e80 ohci1394 ohci1394.sys Wed Aug 04 01:10:05 2004 (41107DBD)
f8755000 f8762000 1394BUS 1394BUS.SYS Wed Aug 04 01:10:03 2004 (41107DBB)
f8765000 f876f500 MountMgr MountMgr.sys Wed Aug 04 00:58:29 2004 (41107B05)
f8775000 f8781c80 VolSnap VolSnap.sys Wed Aug 04 01:00:14 2004 (41107B6E)
f8785000 f878de00 disk disk.sys Wed Aug 04 00:59:53 2004 (41107B59)
f8795000 f87a1200 CLASSPNP CLASSPNP.SYS Wed Aug 04 01:14:26 2004 (41107EC2)
f87a5000 f87af580 agp440 agp440.sys Wed Aug 04 01:07:40 2004 (41107D2C)
f87d5000 f87e1880 rasl2tp rasl2tp.sys Wed Aug 04 01:14:21 2004 (41107EBD)
f87e5000 f87ef200 raspppoe raspppoe.sys Wed Aug 04 01:05:06 2004 (41107C92)
f87f5000 f8800d00 raspptp raspptp.sys Wed Aug 04 01:14:26 2004 (41107EC2)
f8805000 f880d900 msgpc msgpc.sys Wed Aug 04 01:04:11 2004 (41107C5B)
f8815000 f881ef00 termdd termdd.sys Wed Aug 04 00:58:52 2004 (41107B1C)
f8825000 f882e480 NDProxy NDProxy.SYS Fri Aug 17 15:55:30 2001 (3B7D84C2)
f8835000 f883dd80 HIDCLASS HIDCLASS.SYS Wed Aug 04 01:08:18 2004 (41107D52)
f8855000 f8864180 nic1394 nic1394.sys Wed Aug 04 00:58:28 2004 (41107B04)
f8875000 f8883100 usbhub usbhub.sys Wed Aug 04 01:08:40 2004 (41107D68)
f88a5000 f88ad700 wanarp wanarp.sys Wed Aug 04 01:04:57 2004 (41107C89)
f88b5000 f88bd700 netbios netbios.sys Wed Aug 04 01:03:19 2004 (41107C27)
f88d5000 f88e3d80 arp1394 arp1394.sys Wed Aug 04 00:58:28 2004 (41107B04)
f88e5000 f88ed880 Fips Fips.SYS Fri Aug 17 20:31:49 2001 (3B7DC585)
f8945000 f894dd00 intelppm intelppm.sys Wed Aug 04 00:59:19 2004 (41107B37)
f8965000 f896dd80 AN983 AN983.sys Thu Oct 25 01:42:09 2001 (3BD7B441)
f8975000 f8983b80 drmk drmk.sys Wed Aug 04 01:07:54 2004 (41107D3A)
f8985000 f8991180 cdrom cdrom.sys Wed Aug 04 00:59:52 2004 (41107B58)
f8995000 f89a3080 redbook redbook.sys Wed Aug 04 00:59:34 2004 (41107B46)
f89a5000 f89af380 imapi imapi.sys Wed Aug 04 01:00:12 2004 (41107B6C)
f89b5000 f89bb200 PCIIDEX PCIIDEX.SYS Wed Aug 04 00:59:40 2004 (41107B4C)
f89bd000 f89c1900 PartMgr PartMgr.sys Fri Aug 17 20:32:23 2001 (3B7DC5A7)
f89c5000 f89c9bc0 PxHelp20 PxHelp20.sys Tue Oct 28 12:25:49 2003 (3F9EB4AD)
f8a25000 f8a2a980 NIOC NIOC.SYS Fri Sep 27 04:15:02 2002 (3D942196)
f8a3d000 f8a42000 usbuhci usbuhci.sys Wed Aug 04 01:08:34 2004 (41107D62)
f8a45000 f8a4b800 usbehci usbehci.sys Wed Aug 04 01:08:34 2004 (41107D62)
f8a4d000 f8a51880 TDI TDI.SYS Wed Aug 04 01:07:47 2004 (41107D33)
f8a55000 f8a59580 ptilink ptilink.sys Fri Aug 17 15:49:53 2001 (3B7D8371)
f8a5d000 f8a61080 raspti raspti.sys Fri Aug 17 15:55:32 2001 (3B7D84C4)
f8a65000 f8a6b000 kbdclass kbdclass.sys Wed Aug 04 00:58:32 2004 (41107B08)
f8a6d000 f8a72a00 mouclass mouclass.sys Wed Aug 04 00:58:32 2004 (41107B08)
f8a75000 f8a7b880 SaiNtBus SaiNtBus.sys Fri Sep 10 10:02:26 2004 (4141C202)
f8a7d000 f8a83180 HIDPARSE HIDPARSE.SYS Wed Aug 04 01:08:15 2004 (41107D4F)
f8aad000 f8ab2200 vga vga.sys Wed Aug 04 01:07:06 2004 (41107D0A)
f8ab5000 f8aba000 Msfs Msfs.SYS unavailable (FFFFFFFE)
f8abd000 f8ac4880 Npfs Npfs.SYS Wed Aug 04 01:00:38 2004 (41107B86)
f8add000 f8ae3500 usbprint usbprint.sys Wed Aug 04 01:01:23 2004 (41107BB3)
f8ae5000 f8aecb80 usbccgp usbccgp.sys Wed Aug 04 01:08:45 2004 (41107D6D)
f8b25000 f8b29500 watchdog watchdog.sys Wed Aug 04 01:07:32 2004 (41107D24)
f8b45000 f8b48000 BOOTVID BOOTVID.dll Fri Aug 17 15:49:09 2001 (3B7D8345)
f8bcd000 f8bcf900 Dxapi Dxapi.sys Fri Aug 17 15:53:19 2001 (3B7D843F)
f8bd1000 f8bd3280 rasacd rasacd.sys Fri Aug 17 15:55:39 2001 (3B7D84CB)
f8bf5000 f8bf7980 gameenum gameenum.sys Wed Aug 04 01:08:20 2004 (41107D54)
f8c05000 f8c07580 ndistapi ndistapi.sys Fri Aug 17 15:55:29 2001 (3B7D84C1)
f8c19000 f8c1cc80 mssmbios mssmbios.sys Wed Aug 04 01:07:47 2004 (41107D33)
f8c35000 f8c36b80 kdcom kdcom.dll Fri Aug 17 15:49:10 2001 (3B7D8346)
f8c37000 f8c38100 WMILIB WMILIB.SYS Fri Aug 17 16:07:23 2001 (3B7D878B)
f8c39000 f8c3b000 dmload dmload.sys unavailable (FFFFFFFE)
f8c45000 f8c46600 ctprxy2k ctprxy2k.sys Thu Jul 18 21:48:06 2002 (3D377DE6)
f8c47000 f8c48100 swenum swenum.sys Wed Aug 04 00:58:41 2004 (41107B11)
f8c49000 f8c4a280 USBD USBD.SYS Fri Aug 17 16:02:58 2001 (3B7D8682)
f8c4b000 f8c4d000 Fs_Rec Fs_Rec.SYS unavailable (FFFFFFFE)
f8c4d000 f8c4e080 Beep Beep.SYS Fri Aug 17 15:47:33 2001 (3B7D82E5)
f8c4f000 f8c50080 mnmdd mnmdd.SYS Fri Aug 17 15:57:28 2001 (3B7D8538)
f8c51000 f8c52080 RDPCDD RDPCDD.sys Fri Aug 17 15:46:56 2001 (3B7D82C0)
f8c89000 f8c8a100 dump_WMILIB dump_WMILIB.SYS Fri Aug 17 16:07:23 2001 (3B7D878B)
f8c97000 f8c98900 splitter splitter.sys Wed Aug 04 01:07:46 2004 (41107D32)
f8cfd000 f8cfdd00 pciide pciide.sys Fri Aug 17 15:51:49 2001 (3B7D83E5)
f8d8e000 f8d8f000 Null Null.SYS unavailable (FFFFFFFE)
f8dc7000 f8dc7d00 dxgthk dxgthk.sys Fri Aug 17 15:53:12 2001 (3B7D8438)
f8e4e000 f8e4ec00 audstub audstub.sys Fri Aug 17 15:59:40 2001 (3B7D85BC)

Unloaded modules:
b181b000 b1845000 kmixer.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
b181b000 b1845000 kmixer.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
b181b000 b1845000 kmixer.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
b1dde000 b1e08000 kmixer.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
b1e08000 b1e2b000 aec.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
f8db8000 f8db9000 drmkaud.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
b25e1000 b25ee000 DMusic.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
b225d000 b226b000 swmidi.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
f8ca5000 f8ca7000 splitter.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
b2601000 b2611000 Serial.SYS
Timestamp: unavailable (00000000)
Checksum: 00000000
b2428000 b243c000 Parport.SYS
Timestamp: unavailable (00000000)
Checksum: 00000000
f88c5000 f88ce000 processr.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
f8895000 f88a2000 i8042prt.SYS
Timestamp: unavailable (00000000)
Checksum: 00000000
f8aa5000 f8aaa000 Cdaudio.SYS
Timestamp: unavailable (00000000)
Checksum: 00000000
f8bcd000 f8bd0000 Sfloppy.SYS
Timestamp: unavailable (00000000)
Checksum: 00000000
f8a9d000 f8aa2000 Flpydisk.SYS
Timestamp: unavailable (00000000)
Checksum: 00000000
f8a95000 f8a9c000 Fdc.SYS
Timestamp: unavailable (00000000)
Checksum: 00000000
Closing open log file c:\debuglog.txt

 

I'm guessing you have your PC set to automatically reboot after a stop error so you aren't seeing the blue screen long enough to copy down the numbers. If so, you can change a setting so it will stop on that screen until you reboot. Right-click on My Computer, left-click on Properties, then do as shown in the pictures.

Otherwise, I still can't peel open one of those dump files and we are back waiting for Joe Hobart to take a look. I'll email him from home later this evening but no idea when he will have time to look.

 

here is my latest. They have been happening when I'm away from my computer, so I never get a chance to look at the blue screen.

Opened log file 'c:\debuglog.txt'
Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols

Microsoft (R) Windows Debugger Version 6.3.0017.0
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\WINDOWS\MEMORY.DMP]
Kernel Summary Dump File: Only kernel address space is available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: C:\WINDOWS;C:\WINDOWS\system32;C:\WINDOWS\system32\drivers
Windows XP Kernel Version 2600 (Service Pack 2) MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 2600.xpsp_sp2_rtm.040803-2158
Kernel base = 0x804d7000 PsLoadedModuleList = 0x805644a0
Debug session time: Thu Oct 07 13:47:00 2004
System Uptime: 0 days 12:32:09.391
Loading Kernel Symbols
..................................................................................................................................
Loading unloaded module list
........................
Loading User Symbols
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 7F, {8, f89cdd70, 0, 0}

Probably caused by : ntkrnlmp.exe ( nt!KiIdleLoop+36 )

Followup: MachineOwner
---------

1: kd> !analyze -v;r;kv;lmtn;.logclose;q
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

UNEXPECTED_KERNEL_MODE_TRAP (7f)
This means a trap occurred in kernel mode, and it's a trap of a kind
that the kernel isn't allowed to have/catch (bound trap) or that
is always instant death (double fault). The first number in the
bugcheck params is the number of the trap (8 = double fault, etc)
Consult an Intel x86 family manual to learn more about what these
traps are. Here is a *portion* of those codes:
If kv shows a taskGate
use .tss on the part before the colon, then kv.
Else if kv shows a trapframe
use .trap on that value
Else
.trap on the appropriate frame will show where the trap was taken
(on x86, this will be the ebp that goes with the procedure KiTrap)
Endif
kb will then show the corrected stack.
Arguments:
Arg1: 00000008, EXCEPTION_DOUBLE_FAULT
Arg2: f89cdd70
Arg3: 00000000
Arg4: 00000000

Debugging Details:
------------------


BUGCHECK_STR: 0x7f_8

TSS: 00000028 -- (.tss 28)
.tss 28
eax=f89cdcd0 ebx=f89cd000 ecx=0000001c edx=00000000 esi=f89cfe20 edi=80562f00
eip=804dd159 esp=f8bdcd58 ebp=f89cd980 iopl=0 nv up di ng nz na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010082
nt!KiIdleLoop+0x36:
804dd159 ff1500804d80 call dword ptr [nt!_imp_KfRaiseIrql (804d8000)]{hal!KfRaiseIrql (807033b8)} ds:0023:804d8000=807033b8
.trap
Resetting default scope

DEFAULT_BUCKET_ID: DRIVER_FAULT

LAST_CONTROL_TRANSFER: from 804eed86 to 804dd159

STACK_TEXT:
f8bdcddc 804eed86 f858eb85 ffad7790 00000000 nt!KiIdleLoop+0x36
f8bdcde4 ffad7790 00000000 0000027f 00150000 nt!KiThreadStartup+0x16
WARNING: Frame IP not in any known module. Following frames may be wrong.
f858eb85 08458bec 3bf63356 840f57c6 00006fb1 0xffad7790
f858eb85 08458bec 3bf63356 840f57c6 00006fb1 0x8458bec
8b55ff8b 00000000 00000000 00000000 00000000 0x8458bec


FOLLOWUP_IP:
nt!KiIdleLoop+36
804dd159 ff1500804d80 call dword ptr [nt!_imp_KfRaiseIrql (804d8000)]

SYMBOL_STACK_INDEX: 0

FOLLOWUP_NAME: MachineOwner

SYMBOL_NAME: nt!KiIdleLoop+36

MODULE_NAME: nt

IMAGE_NAME: ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP: 41107faa

STACK_COMMAND: .tss 28 ; kb

BUCKET_ID: 0x7f_8_nt!KiIdleLoop+36

Followup: MachineOwner
---------

eax=f89cd13c ebx=f89cdd70 ecx=00000000 edx=00000000 esi=00000000 edi=00000000
eip=804dfea6 esp=f89d1144 ebp=00000000 iopl=0 nv up di ng nz na po nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00000086
nt!KiTrap08+0x48:
804dfea6 ebee jmp nt!KiTrap08+0x38 (804dfe96)
ChildEBP RetAddr Args to Child
00000000 804dd159 00000000 00000000 00000000 nt!KiTrap08+0x48 (FPO: TaskGate 28:0)
f8bdcddc 804eed86 f858eb85 ffad7790 00000000 nt!KiIdleLoop+0x36 (FPO: [0,0,0])
f8bdcde4 ffad7790 00000000 0000027f 00150000 nt!KiThreadStartup+0x16
WARNING: Frame IP not in any known module. Following frames may be wrong.
f858eb85 08458bec 3bf63356 840f57c6 00006fb1 0xffad7790
f858eb85 08458bec 3bf63356 840f57c6 00006fb1 0x8458bec
8b55ff8b 00000000 00000000 00000000 00000000 0x8458bec
start end module name
804d7000 80701000 nt ntkrnlmp.exe Wed Aug 04 01:18:18 2004 (41107FAA)
80701000 80721d00 hal halmacpi.dll Wed Aug 04 00:59:09 2004 (41107B2D)
b181b000 b1844f00 kmixer kmixer.sys Wed Aug 04 01:07:46 2004 (41107D32)
b1b8d000 b1bcd380 HTTP HTTP.sys Wed Aug 04 01:00:09 2004 (41107B69)
b1e2b000 b1e3f400 wdmaud wdmaud.sys Wed Aug 04 01:15:03 2004 (41107EE7)
b1ee0000 b1f756a0 NAVEX15 NAVEX15.sys Fri Jul 23 12:50:12 2004 (41014FD4)
b1f76000 b1fb4000 NAVAP NAVAP.sys Mon Aug 11 07:39:42 2003 (3F378E8E)
b1fb4000 b1fc4a60 SYMEVENT SYMEVENT.SYS Wed May 14 00:45:43 2003 (3EC1D807)
b2125000 b21345a0 NAVENG NAVENG.sys Fri Jul 23 12:50:57 2004 (41015001)
b222d000 b223bd80 sysaudio sysaudio.sys Wed Aug 04 01:15:54 2004 (41107F1A)
b226d000 b22bf180 srv srv.sys Wed Aug 04 01:14:44 2004 (41107ED4)
b22e8000 b22f9000 NAVAPEL NAVAPEL.SYS Mon Aug 11 07:39:47 2003 (3F378E93)
b22f9000 b2374000 CVPNDRVA CVPNDRVA.sys Thu Apr 10 08:45:29 2003 (3E957579)
b2460000 b2462e80 secdrv secdrv.sys Fri Jan 16 07:16:04 2004 (4007E414)
b2464000 b2490400 mrxdav mrxdav.sys Wed Aug 04 01:00:49 2004 (41107B91)
b2641000 b2644da0 PfModNT PfModNT.sys Tue Mar 04 22:19:28 2003 (3E657AD0)
b2791000 b2794280 ndisuio ndisuio.sys Wed Aug 04 01:03:10 2004 (41107C1E)
b28a1000 b28b8480 dump_atapi dump_atapi.sys Wed Aug 04 00:59:41 2004 (41107B4D)
b28e1000 b28fe380 SaiH053c SaiH053c.sys Fri Sep 10 09:35:19 2004 (4141BBA7)
b28ff000 b29a9000 PRISMUSB PRISMUSB.sys Thu Oct 02 13:47:13 2003 (3F7C72B1)
b29a9000 b2a17380 mrxsmb mrxsmb.sys Wed Aug 04 01:15:14 2004 (41107EF2)
b2a18000 b2a43180 rdbss rdbss.sys Wed Aug 04 01:20:05 2004 (41108015)
b2ae4000 b2b05d00 afd afd.sys Wed Aug 04 01:14:13 2004 (41107EB5)
b2b06000 b2b26f00 ipnat ipnat.sys Wed Aug 04 01:04:48 2004 (41107C80)
b2b27000 b2b4ec00 netbt netbt.sys Wed Aug 04 01:14:36 2004 (41107ECC)
b2b4f000 b2ba6a80 tcpip tcpip.sys Wed Aug 04 01:14:39 2004 (41107ECF)
b2ba7000 b2bb9400 ipsec ipsec.sys Wed Aug 04 01:14:27 2004 (41107EC3)
b2bfa000 b2bfc900 Dxapi Dxapi.sys Fri Aug 17 15:53:19 2001 (3B7D843F)
b2f0d000 b2f2b960 ctsfm2k ctsfm2k.sys Thu Jul 18 21:48:21 2002 (3D377DF5)
b2f2c000 b2f441a0 emupia2k emupia2k.sys Thu Jul 18 21:48:31 2002 (3D377DFF)
b2f45000 b2f59ee0 ctac32k ctac32k.sys Thu Jul 18 21:46:27 2002 (3D377D83)
b2f5a000 b2fff020 ha10kx2k ha10kx2k.sys Wed Jul 24 00:52:25 2002 (3D3E4099)
bf800000 bf9c0380 win32k win32k.sys Wed Aug 04 01:17:30 2004 (41107F7A)
bf9c1000 bf9d2580 dxg dxg.sys Wed Aug 04 01:00:51 2004 (41107B93)
bf9d3000 bfa0b000 ati2dvag ati2dvag.dll Wed Aug 25 12:29:01 2004 (412CCC5D)
bfa0b000 bfa45000 ati2cqag ati2cqag.dll Wed Aug 25 12:10:18 2004 (412CC7FA)
bfa45000 bfc67b60 ati3duag ati3duag.dll Wed Aug 25 12:25:53 2004 (412CCBA1)
bfc68000 bfcdc700 ativvaxx ativvaxx.dll Wed Aug 25 12:15:14 2004 (412CC922)
f81b1000 f81e4200 update update.sys Wed Aug 04 00:58:32 2004 (41107B08)
f81e5000 f8215100 rdpdr rdpdr.sys Wed Aug 04 01:01:10 2004 (41107BA6)
f8256000 f8265900 Cdfs Cdfs.SYS Wed Aug 04 01:14:09 2004 (41107EB1)
f82b6000 f82c6e00 psched psched.sys Wed Aug 04 01:04:16 2004 (41107C60)
f82e3000 f82e5580 hidusb hidusb.sys Fri Aug 17 16:02:16 2001 (3B7D8658)
f830a000 f8320680 ndiswan ndiswan.sys Wed Aug 04 01:14:30 2004 (41107EC6)
f8321000 f833aec0 dne2000 dne2000.sys Mon Aug 26 19:09:40 2002 (3D6AC344)
f833b000 f8353da0 ctoss2k ctoss2k.sys Thu Jul 18 21:48:03 2002 (3D377DE3)
f8354000 f8376680 ks ks.sys Wed Aug 04 01:15:20 2004 (41107EF8)
f8377000 f839a980 portcls portcls.sys Wed Aug 04 01:15:47 2004 (41107F13)
f839b000 f8412460 ctaud2k ctaud2k.sys Thu Jul 18 21:47:51 2002 (3D377DD7)
f8413000 f8435e80 USBPORT USBPORT.SYS Wed Aug 04 01:08:34 2004 (41107D62)
f8436000 f8449780 VIDEOPRT VIDEOPRT.SYS Wed Aug 04 01:07:04 2004 (41107D08)
f844a000 f8525000 ati2mtag ati2mtag.sys Wed Aug 25 12:28:43 2004 (412CCC4B)
f8545000 f8548a00 kbdhid kbdhid.sys Wed Aug 04 00:58:33 2004 (41107B09)
f8549000 f854bf80 mouhid mouhid.sys Fri Aug 17 15:47:57 2001 (3B7D82FD)
f856d000 f8587580 Mup Mup.sys Wed Aug 04 01:15:20 2004 (41107EF8)
f8588000 f85b4a80 NDIS NDIS.sys Wed Aug 04 01:14:27 2004 (41107EC3)
f85b5000 f8641480 Ntfs Ntfs.sys Wed Aug 04 01:15:06 2004 (41107EEA)
f8642000 f8658780 KSecDD KSecDD.sys Wed Aug 04 00:59:45 2004 (41107B51)
f8659000 f8677780 fltmgr fltmgr.sys Wed Aug 04 01:01:17 2004 (41107BAD)
f8678000 f868f480 atapi atapi.sys Wed Aug 04 00:59:41 2004 (41107B4D)
f8690000 f86b5700 dmio dmio.sys Wed Aug 04 01:07:13 2004 (41107D11)
f86b6000 f86d4880 ftdisk ftdisk.sys Fri Aug 17 15:52:41 2001 (3B7D8419)
f86d5000 f86e5a80 pci pci.sys Wed Aug 04 01:07:45 2004 (41107D31)
f86e6000 f8713d80 ACPI ACPI.sys Wed Aug 04 01:07:35 2004 (41107D27)
f8735000 f873dc00 isapnp isapnp.sys Fri Aug 17 15:58:01 2001 (3B7D8559)
f8745000 f8753e80 ohci1394 ohci1394.sys Wed Aug 04 01:10:05 2004 (41107DBD)
f8755000 f8762000 1394BUS 1394BUS.SYS Wed Aug 04 01:10:03 2004 (41107DBB)
f8765000 f876f500 MountMgr MountMgr.sys Wed Aug 04 00:58:29 2004 (41107B05)
f8775000 f8781c80 VolSnap VolSnap.sys Wed Aug 04 01:00:14 2004 (41107B6E)
f8785000 f878de00 disk disk.sys Wed Aug 04 00:59:53 2004 (41107B59)
f8795000 f87a1200 CLASSPNP CLASSPNP.SYS Wed Aug 04 01:14:26 2004 (41107EC2)
f87a5000 f87af580 agp440 agp440.sys Wed Aug 04 01:07:40 2004 (41107D2C)
f87d5000 f87def00 termdd termdd.sys Wed Aug 04 00:58:52 2004 (41107B1C)
f87e5000 f87ee480 NDProxy NDProxy.SYS Fri Aug 17 15:55:30 2001 (3B7D84C2)
f87f5000 f87fdd80 HIDCLASS HIDCLASS.SYS Wed Aug 04 01:08:18 2004 (41107D52)
f8825000 f8833100 usbhub usbhub.sys Wed Aug 04 01:08:40 2004 (41107D68)
f8845000 f8854180 nic1394 nic1394.sys Wed Aug 04 00:58:28 2004 (41107B04)
f8865000 f886d700 wanarp wanarp.sys Wed Aug 04 01:04:57 2004 (41107C89)
f8875000 f887d700 netbios netbios.sys Wed Aug 04 01:03:19 2004 (41107C27)
f8895000 f88a3d80 arp1394 arp1394.sys Wed Aug 04 00:58:28 2004 (41107B04)
f88a5000 f88ad880 Fips Fips.SYS Fri Aug 17 20:31:49 2001 (3B7DC585)
f8915000 f891dd00 intelppm intelppm.sys Wed Aug 04 00:59:19 2004 (41107B37)
f8925000 f892dd80 AN983 AN983.sys Thu Oct 25 01:42:09 2001 (3BD7B441)
f8935000 f8943b80 drmk drmk.sys Wed Aug 04 01:07:54 2004 (41107D3A)
f8945000 f8951180 cdrom cdrom.sys Wed Aug 04 00:59:52 2004 (41107B58)
f8955000 f8963080 redbook redbook.sys Wed Aug 04 00:59:34 2004 (41107B46)
f8965000 f896f380 imapi imapi.sys Wed Aug 04 01:00:12 2004 (41107B6C)
f8975000 f8981880 rasl2tp rasl2tp.sys Wed Aug 04 01:14:21 2004 (41107EBD)
f8985000 f898f200 raspppoe raspppoe.sys Wed Aug 04 01:05:06 2004 (41107C92)
f8995000 f89a0d00 raspptp raspptp.sys Wed Aug 04 01:14:26 2004 (41107EC2)
f89a5000 f89ad900 msgpc msgpc.sys Wed Aug 04 01:04:11 2004 (41107C5B)
f89b5000 f89bb200 PCIIDEX PCIIDEX.SYS Wed Aug 04 00:59:40 2004 (41107B4C)
f89bd000 f89c1900 PartMgr PartMgr.sys Fri Aug 17 20:32:23 2001 (3B7DC5A7)
f89c5000 f89c9bc0 PxHelp20 PxHelp20.sys Tue Oct 28 12:25:49 2003 (3F9EB4AD)
f8a25000 f8a2a980 NIOC NIOC.SYS Fri Sep 27 04:15:02 2002 (3D942196)
f8a3d000 f8a42000 usbuhci usbuhci.sys Wed Aug 04 01:08:34 2004 (41107D62)
f8a45000 f8a4b800 usbehci usbehci.sys Wed Aug 04 01:08:34 2004 (41107D62)
f8a4d000 f8a51880 TDI TDI.SYS Wed Aug 04 01:07:47 2004 (41107D33)
f8a55000 f8a59580 ptilink ptilink.sys Fri Aug 17 15:49:53 2001 (3B7D8371)
f8a5d000 f8a61080 raspti raspti.sys Fri Aug 17 15:55:32 2001 (3B7D84C4)
f8a65000 f8a6b000 kbdclass kbdclass.sys Wed Aug 04 00:58:32 2004 (41107B08)
f8a6d000 f8a72a00 mouclass mouclass.sys Wed Aug 04 00:58:32 2004 (41107B08)
f8a75000 f8a7b880 SaiNtBus SaiNtBus.sys Fri Sep 10 10:02:26 2004 (4141C202)
f8a7d000 f8a83180 HIDPARSE HIDPARSE.SYS Wed Aug 04 01:08:15 2004 (41107D4F)
f8aad000 f8ab2200 vga vga.sys Wed Aug 04 01:07:06 2004 (41107D0A)
f8ab5000 f8ab9a80 Msfs Msfs.SYS Wed Aug 04 01:00:37 2004 (41107B85)
f8abd000 f8ac4880 Npfs Npfs.SYS Wed Aug 04 01:00:38 2004 (41107B86)
f8add000 f8ae3500 usbprint usbprint.sys Wed Aug 04 01:01:23 2004 (41107BB3)
f8ae5000 f8aecb80 usbccgp usbccgp.sys Wed Aug 04 01:08:45 2004 (41107D6D)
f8b1d000 f8b21500 watchdog watchdog.sys Wed Aug 04 01:07:32 2004 (41107D24)
f8b45000 f8b48000 BOOTVID BOOTVID.dll Fri Aug 17 15:49:09 2001 (3B7D8345)
f8bc9000 f8bcb280 rasacd rasacd.sys Fri Aug 17 15:55:39 2001 (3B7D84CB)
f8bf1000 f8bf3980 gameenum gameenum.sys Wed Aug 04 01:08:20 2004 (41107D54)
f8bfd000 f8bff580 ndistapi ndistapi.sys Fri Aug 17 15:55:29 2001 (3B7D84C1)
f8c15000 f8c18c80 mssmbios mssmbios.sys Wed Aug 04 01:07:47 2004 (41107D33)
f8c31000 f8c34d00 SaiMini SaiMini.sys Fri Sep 10 10:02:26 2004 (4141C202)
f8c35000 f8c36b80 kdcom kdcom.dll Fri Aug 17 15:49:10 2001 (3B7D8346)
f8c37000 f8c38100 WMILIB WMILIB.SYS Fri Aug 17 16:07:23 2001 (3B7D878B)
f8c39000 f8c3a700 dmload dmload.sys Fri Aug 17 15:58:15 2001 (3B7D8567)
f8c4b000 f8c4c600 ctprxy2k ctprxy2k.sys Thu Jul 18 21:48:06 2002 (3D377DE6)
f8c4d000 f8c4e100 swenum swenum.sys Wed Aug 04 00:58:41 2004 (41107B11)
f8c4f000 f8c50280 USBD USBD.SYS Fri Aug 17 16:02:58 2001 (3B7D8682)
f8c51000 f8c52f00 Fs_Rec Fs_Rec.SYS Fri Aug 17 15:49:37 2001 (3B7D8361)
f8c53000 f8c54080 Beep Beep.SYS Fri Aug 17 15:47:33 2001 (3B7D82E5)
f8c55000 f8c56080 mnmdd mnmdd.SYS Fri Aug 17 15:57:28 2001 (3B7D8538)
f8c57000 f8c58080 RDPCDD RDPCDD.sys Fri Aug 17 15:46:56 2001 (3B7D82C0)
f8c85000 f8c86100 dump_WMILIB dump_WMILIB.SYS Fri Aug 17 16:07:23 2001 (3B7D878B)
f8cfd000 f8cfdd00 pciide pciide.sys Fri Aug 17 15:51:49 2001 (3B7D83E5)
f8d54000 f8d54c00 audstub audstub.sys Fri Aug 17 15:59:40 2001 (3B7D85BC)
f8e18000 f8e18b80 Null Null.SYS Fri Aug 17 15:47:39 2001 (3B7D82EB)
f8e22000 f8e22d00 dxgthk dxgthk.sys Fri Aug 17 15:53:12 2001 (3B7D8438)

Unloaded modules:
b181b000 b1845000 kmixer.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
b181b000 b1845000 kmixer.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
b181b000 b1845000 kmixer.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
b181b000 b1845000 kmixer.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
b181b000 b1845000 kmixer.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
b181b000 b1845000 kmixer.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
b181b000 b1845000 kmixer.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
b181b000 b1845000 kmixer.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
b181b000 b1845000 kmixer.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
b181b000 b1845000 kmixer.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
b1dde000 b1e08000 kmixer.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
b1e08000 b1e2b000 aec.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
f8dd0000 f8dd1000 drmkaud.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
b20c5000 b20d2000 DMusic.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
b20a5000 b20b3000 swmidi.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
f8cc9000 f8ccb000 splitter.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
b25c1000 b25d1000 Serial.SYS
Timestamp: unavailable (00000000)
Checksum: 00000000
b2388000 b239c000 Parport.SYS
Timestamp: unavailable (00000000)
Checksum: 00000000
f8885000 f888e000 processr.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
f8855000 f8862000 i8042prt.SYS
Timestamp: unavailable (00000000)
Checksum: 00000000
f8aa5000 f8aaa000 Cdaudio.SYS
Timestamp: unavailable (00000000)
Checksum: 00000000
f8525000 f8528000 Sfloppy.SYS
Timestamp: unavailable (00000000)
Checksum: 00000000
f8a9d000 f8aa2000 Flpydisk.SYS
Timestamp: unavailable (00000000)
Checksum: 00000000
f8a95000 f8a9c000 Fdc.SYS
Timestamp: unavailable (00000000)
Checksum: 00000000
Closing open log file c:\debuglog.txt

 

If you make the settings changes from post #4 then the blue screen will wait for weeks unless the PC loses power.

The dump files you have posted are plenty for now.

 

I did make uncheck the box you showed. When I get home from work its always at the login screen.

 

You've got something messing with your memory. two possible vectors, bad driver or bad ram. Lets talk bad driver isolation first

Driver isolation:
1) You need to update everything you can find, driver wise. In the debug spew you can see a list of all loaded .sys files. Try to find updates to as many as you can

2) run driver verifier to enable 'Special Pool'
run verifier.exe
'create custom settings'
'select individual settings from a list'
'special pool'
'auto select unsigned drivers'
'finish' and reboot and wait for a whammie
it will bluescreen again, post results (you can skip pasting everything below 'start end module name')
(also note, same tool in reverse to disable once we are done troubleshooting)

If that doesnt get it, you will need to give microsoft a call to discuss how to isolate the bad driver..


Bad RAM
Note this tool is NOT conslusive in eliminating bad ram, but it can sometimes find it.
http://oca.microsoft.com/en/windiag.asp
The Windows Memory Diagnostic tests the Random Access Memory (RAM) on your computer for errors. The diagnostic includes a comprehensive set of memory tests. If you are experiencing problems while running Windows, you can use the diagnostic to determine whether the problems are caused by failing hardware, such as RAM or the memory system of your motherboard. Windows Memory Diagnostic is designed to be easy and fast. On most configurations, you can download the diagnostic, read the documentation, run the test and complete the first test pass in less than 30 minutes.



Sorry, this one isnt going to go easy...

 

Drivers all up to date. Haven't had time for the memory test just yet, but I did do number 2.

Opened log file 'c:\debuglog.txt'
Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols

Microsoft (R) Windows Debugger Version 6.3.0017.0
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Documents and Settings\Administrator.BIG-CHIEF\Desktop\MEMORY.DMP]
Kernel Summary Dump File: Only kernel address space is available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: C:\WINDOWS;C:\WINDOWS\system32;C:\WINDOWS\system32\drivers
Windows XP Kernel Version 2600 (Service Pack 2) UP Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 2600.xpsp_sp2_rtm.040803-2158
Kernel base = 0x804d7000 PsLoadedModuleList = 0x805644a0
Debug session time: Fri Oct 08 17:02:26 2004
System Uptime: 0 days 0:04:51.328
WARNING: Process directory table base 1E482000 doesn't match CR3 00039000
WARNING: Process directory table base 1E482000 doesn't match CR3 00039000
Loading Kernel Symbols
...............................................................................................................................
Loading unloaded module list
..............
Loading User Symbols
PEB is paged out (Peb.Ldr = 7ffd700c). Type ".hh dbgerr001" for details
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 7F, {8, 80042000, 0, 0}

Probably caused by : ntkrnlmp.exe ( nt!PspDereferenceQuotaBlock+6d )

Followup: MachineOwner
---------

kd> !analyze -v;r;kv;lmtn;.logclose;q
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

UNEXPECTED_KERNEL_MODE_TRAP (7f)
This means a trap occurred in kernel mode, and it's a trap of a kind
that the kernel isn't allowed to have/catch (bound trap) or that
is always instant death (double fault). The first number in the
bugcheck params is the number of the trap (8 = double fault, etc)
Consult an Intel x86 family manual to learn more about what these
traps are. Here is a *portion* of those codes:
If kv shows a taskGate
use .tss on the part before the colon, then kv.
Else if kv shows a trapframe
use .trap on that value
Else
.trap on the appropriate frame will show where the trap was taken
(on x86, this will be the ebp that goes with the procedure KiTrap)
Endif
kb will then show the corrected stack.
Arguments:
Arg1: 00000008, EXCEPTION_DOUBLE_FAULT
Arg2: 80042000
Arg3: 00000000
Arg4: 00000000

Debugging Details:
------------------


BUGCHECK_STR: 0x7f_8

TSS: 00000028 -- (.tss 28)
.tss 28
eax=ff5bc4c8 ebx=00000000 ecx=00000894 edx=00000074 esi=ff5bc4a0 edi=0016e6d4
eip=804e847a esp=eeeb5c68 ebp=eee35c84 iopl=0 nv up ei pl nz ac po cy
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010217
nt!PspDereferenceQuotaBlock+0x6d:
804e847a c20400 ret 0x4
.trap
Resetting default scope

DEFAULT_BUCKET_ID: DRIVER_FAULT

LAST_CONTROL_TRANSFER: from 8056e6db to 804e847a

STACK_TEXT:
eee35c84 8056e6db ff5bc490 00000074 00000000 nt!PspDereferenceQuotaBlock+0x6d
eee35cb4 8056e797 00000000 e163e5a0 e163e5b8 nt!ObpFreeObject+0x129
eee35ccc 804e1f77 e163e5b8 00000000 00000444 nt!ObpRemoveObjectRoutine+0xe7
eee35ce4 80570dde febf8b98 e20d2208 febf8920 nt!ObfDereferenceObject+0x4c
eee35cfc 80570cfc e20d2208 e163e5b8 00000444 nt!ObpCloseHandleTableEntry+0x155
eee35d44 80570d46 00000444 00000001 00000000 nt!ObpCloseHandle+0x87
eee35d58 804ddf0f 00000444 0012f45c 7c90eb94 nt!NtClose+0x1d
eee35d58 7c90eb94 00000444 0012f45c 7c90eb94 nt!KiFastCallEntry+0xfc
WARNING: Frame IP not in any known module. Following frames may be wrong.
0012f448 00000000 00000000 00000000 00000000 0x7c90eb94


FOLLOWUP_IP:
nt!PspDereferenceQuotaBlock+6d
804e847a c20400 ret 0x4

SYMBOL_STACK_INDEX: 0

FOLLOWUP_NAME: MachineOwner

SYMBOL_NAME: nt!PspDereferenceQuotaBlock+6d

MODULE_NAME: nt

IMAGE_NAME: ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP: 41107faa

STACK_COMMAND: .tss 28 ; kb

BUCKET_ID: 0x7f_8_nt!PspDereferenceQuotaBlock+6d

Followup: MachineOwner
---------

eax=ffdff13c ebx=80042000 ecx=00000000 edx=00000000 esi=00000000 edi=00000000
eip=804dfea6 esp=805556e4 ebp=00000000 iopl=0 nv up di ng nz na po nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00000086
nt!KiTrap08+0x48:
804dfea6 ebee jmp nt!KiTrap08+0x38 (804dfe96)
ChildEBP RetAddr Args to Child
00000000 804e847a 00000000 00000000 00000000 nt!KiTrap08+0x48 (FPO: TaskGate 28:0)
eee35c84 8056e6db ff5bc490 00000074 00000000 nt!PspDereferenceQuotaBlock+0x6d (FPO: [Non-Fpo])
eee35cb4 8056e797 00000000 e163e5a0 e163e5b8 nt!ObpFreeObject+0x129 (FPO: [Non-Fpo])
eee35ccc 804e1f77 e163e5b8 00000000 00000444 nt!ObpRemoveObjectRoutine+0xe7 (FPO: [Non-Fpo])
eee35ce4 80570dde febf8b98 e20d2208 febf8920 nt!ObfDereferenceObject+0x4c (FPO: [0,0,0])
eee35cfc 80570cfc e20d2208 e163e5b8 00000444 nt!ObpCloseHandleTableEntry+0x155 (FPO: [Non-Fpo])
eee35d44 80570d46 00000444 00000001 00000000 nt!ObpCloseHandle+0x87 (FPO: [Non-Fpo])
eee35d58 804ddf0f 00000444 0012f45c 7c90eb94 nt!NtClose+0x1d (FPO: [Non-Fpo])
eee35d58 7c90eb94 00000444 0012f45c 7c90eb94 nt!KiFastCallEntry+0xfc (FPO: [0,0] TrapFrame @ eee35d64)
WARNING: Frame IP not in any known module. Following frames may be wrong.
0012f448 00000000 00000000 00000000 00000000 0x7c90eb94

 

This is another double fault. unfortunatly, we are no closer to our goal, we need one of the other kinds to happen to catch the bad guy.
Lets give it a couple more tries before we move on to the next step. We may need to do some other drivers in special pool to catch this bugger.

This is definiatly looking like pool corruption, but i'd like to see the memory test run anyhow.

 

memtest came out fine. Which error are we looking for, because I can get just about any of them to come up eventually.

 

this more help?


Opened log file 'c:\debuglog.txt'
Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols

Microsoft (R) Windows Debugger Version 6.3.0017.0
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Documents and Settings\Administrator.BIG-CHIEF\Desktop\MEMORY.DMP]
Kernel Summary Dump File: Only kernel address space is available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: C:\WINDOWS;C:\WINDOWS\system32;C:\WINDOWS\system32\drivers
Windows XP Kernel Version 2600 (Service Pack 2) UP Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 2600.xpsp_sp2_rtm.040803-2158
Kernel base = 0x804d7000 PsLoadedModuleList = 0x805644a0
Debug session time: Sat Oct 09 08:59:58 2004
System Uptime: 0 days 0:51:32.620
WARNING: Process directory table base 156E6000 doesn't match CR3 00039000
WARNING: Process directory table base 156E6000 doesn't match CR3 00039000
Loading Kernel Symbols
..............................................................................................................................
Loading unloaded module list
................



Loading User Symbols
PEB is paged out (Peb.Ldr = 7ffd500c). Type ".hh dbgerr001" for details
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 7F, {8, 80042000, 0, 0}

Probably caused by : ntkrnlmp.exe ( nt!ExAllocatePoolWithTag+940 )

Followup: MachineOwner
---------

kd> !analyze -v;r;kv;lmtn;.logclose;q
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

UNEXPECTED_KERNEL_MODE_TRAP (7f)
This means a trap occurred in kernel mode, and it's a trap of a kind
that the kernel isn't allowed to have/catch (bound trap) or that
is always instant death (double fault). The first number in the
bugcheck params is the number of the trap (8 = double fault, etc)
Consult an Intel x86 family manual to learn more about what these
traps are. Here is a *portion* of those codes:
If kv shows a taskGate
use .tss on the part before the colon, then kv.
Else if kv shows a trapframe
use .trap on that value
Else
.trap on the appropriate frame will show where the trap was taken
(on x86, this will be the ebp that goes with the procedure KiTrap)
Endif
kb will then show the corrected stack.
Arguments:
Arg1: 00000008, EXCEPTION_DOUBLE_FAULT
Arg2: 80042000
Arg3: 00000000
Arg4: 00000000

Debugging Details:
------------------


BUGCHECK_STR: 0x7f_8

TSS: 00000028 -- (.tss 28)
.tss 28
eax=e1dc0718 ebx=efc79924 ecx=00000008 edx=ce300002 esi=4346744e edi=000001ff
eip=805520ef esp=efcf972c ebp=efc7977c iopl=0 nv up ei pl zr na po nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010246
nt!ExAllocatePoolWithTag+0x940:
805520ef 5f pop edi
.trap
Resetting default scope

DEFAULT_BUCKET_ID: DRIVER_FAULT

LAST_CONTROL_TRANSFER: from 804e96b9 to 805520ef

STACK_TEXT:
efcf9788 804e96b9 e1f59000 c0387d64 00000000 nt!ExAllocatePoolWithTag+0x940
efcf97f8 80568c60 00000111 00000000 80568994 nt!MiDispatchFault+0x129
0000526b 00000000 00000000 00000000 00000000 nt!MmSystemCacheWs


FOLLOWUP_IP:
nt!ExAllocatePoolWithTag+940
805520ef 5f pop edi

SYMBOL_STACK_INDEX: 0

FOLLOWUP_NAME: MachineOwner

SYMBOL_NAME: nt!ExAllocatePoolWithTag+940

MODULE_NAME: nt

IMAGE_NAME: ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP: 41107faa

STACK_COMMAND: .tss 28 ; kb

BUCKET_ID: 0x7f_8_nt!ExAllocatePoolWithTag+940

Followup: MachineOwner
---------

eax=ffdff13c ebx=80042000 ecx=00000000 edx=00000000 esi=00000000 edi=00000000
eip=804dfea6 esp=805556e4 ebp=00000000 iopl=0 nv up di ng nz na po nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00000086
nt!KiTrap08+0x48:
804dfea6 ebee jmp nt!KiTrap08+0x38 (804dfe96)
ChildEBP RetAddr Args to Child
00000000 805520ef 00000000 00000000 00000000 nt!KiTrap08+0x48 (FPO: TaskGate 28:0)
efcf9788 804e96b9 e1f59000 c0387d64 00000000 nt!ExAllocatePoolWithTag+0x940 (FPO: [Non-Fpo])
efcf97f8 80568c60 00000111 00000000 80568994 nt!MiDispatchFault+0x129 (FPO: [Non-Fpo])
0000526b 00000000 00000000 00000000 00000000 nt!MmSystemCacheWs

 

We are looking for one that is NOT a double fault.

Arguments:
Arg1: 00000008, EXCEPTION_DOUBLE_FAULT <---------
Arg2: 80042000
Arg3: 00000000
Arg4: 00000000


Let me know if you get frustrated trying to catch it yet, and we can move to more invasive (read: scary) methods.

 

Heres one thats not a double fault. If you want to go into more invasive stuff, I'm up for that.

Opened log file 'c:\debuglog.txt'
Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols

Microsoft (R) Windows Debugger Version 6.3.0017.0
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Documents and Settings\Brandon\Desktop\MEMORY.DMP]
Kernel Summary Dump File: Only kernel address space is available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: C:\WINDOWS;C:\WINDOWS\system32;C:\WINDOWS\system32\drivers
Windows XP Kernel Version 2600 (Service Pack 2) MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 2600.xpsp_sp2_rtm.040803-2158
Kernel base = 0x804d7000 PsLoadedModuleList = 0x805644a0
Debug session time: Sun Oct 10 08:30:31 2004
System Uptime: 0 days 0:12:18.870
Loading Kernel Symbols
.................................................................................................................................
Loading unloaded module list
..............
Loading User Symbols
PEB is paged out (Peb.Ldr = 7ffda00c). Type ".hh dbgerr001" for details
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck A, {817ffff4, 2, 0, 804e85bc}

Probably caused by : memory_corruption ( nt!MiRemovePageByColor+19 )

Followup: MachineOwner
---------

1: kd> !analyze -v;r;kv;lmtn;.logclose;q
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 817ffff4, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000000, value 0 = read operation, 1 = write operation
Arg4: 804e85bc, address which referenced memory

Debugging Details:
------------------


READ_ADDRESS: 817ffff4

CURRENT_IRQL: 2

FAULTING_IP:
nt!MiRemovePageByColor+19
804e85bc 8b7e0c mov edi,[esi+0xc]

DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: 0xA

LAST_CONTROL_TRANSFER: from 805746e3 to 805524d5

TRAP_FRAME: ef8206d0 -- (.trap ffffffffef8206d0)
.trap ffffffffef8206d0
ErrCode = 00000000
eax=fffffffd ebx=0000000a ecx=ffffffff edx=81800000 esi=817fffe8 edi=00000000
eip=804e85bc esp=ef820744 ebp=ef820760 iopl=0 nv up ei ng nz na po nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010286
nt!MiRemovePageByColor+0x19:
804e85bc 8b7e0c mov edi,[esi+0xc] ds:0023:817ffff4=????????
.trap
Resetting default scope

STACK_TEXT:
ef82091c 805746e3 00000001 00000000 7153624f nt!ExAllocatePoolWithTag+0x863
ef820940 8056ea5b e1e2d250 ef820968 ef82095c nt!ObGetObjectSecurity+0x53
ef82096c 80574958 e1e2d250 82a8d008 00000001 nt!ObCheckObjectAccess+0x29
ef8209b8 80573c4a e1037008 0008abc0 00000000 nt!CmpDoOpen+0x256
ef820bb0 80574152 0008abc0 00000000 82a8d008 nt!CmpParseKey+0x558
ef820c28 805715e8 00000048 ef820c68 00000040 nt!ObpLookupObjectName+0x119
ef820c7c 8057401f 00000000 82ad3558 e1668f01 nt!ObOpenObjectByName+0xea
ef820d50 804ddf0f 00cef5dc 00020019 00cef524 nt!NtOpenKey+0x1af
ef820d50 7c90eb94 00cef5dc 00020019 00cef524 nt!KiFastCallEntry+0xfc
WARNING: Frame IP not in any known module. Following frames may be wrong.
00cef500 00000000 00000000 00000000 00000000 0x7c90eb94


FOLLOWUP_IP:
nt!MiRemovePageByColor+19
804e85bc 8b7e0c mov edi,[esi+0xc]

SYMBOL_STACK_INDEX: 0

FOLLOWUP_NAME: MachineOwner

SYMBOL_NAME: nt!MiRemovePageByColor+19

MODULE_NAME: nt

DEBUG_FLR_IMAGE_TIMESTAMP: 41107faa

STACK_COMMAND: .trap ffffffffef8206d0 ; kb

IMAGE_NAME: memory_corruption

BUCKET_ID: 0xA_VRF_nt!MiRemovePageByColor+19

Followup: MachineOwner
---------

eax=f873713c ebx=00000002 ecx=00000000 edx=00092163 esi=804e85bc edi=817ffff4
eip=804e106f esp=ef8206b8 ebp=ef8206d0 iopl=0 nv up ei ng nz na po nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00000286
nt!KiTrap0E+0x238:
804e106f f7457000000200 test dword ptr [ebp+0x70],0x20000 ss:0010:ef820740=00010286
ChildEBP RetAddr Args to Child
ef8206d0 804e85bc badb0d00 81800000 8056eaee nt!KiTrap0E+0x238 (FPO: [0,0] TrapFrame @ ef8206d0)
ef820760 804eac8e c038b610 00000000 00000001 nt!MiRemovePageByColor+0x19 (FPO: [Non-Fpo])
ef820778 804e96b9 e2d84000 c038b610 00000000 nt!MiResolveDemandZeroFault+0xd9 (FPO: [Non-Fpo])
ef8207e8 804e9fcb 00000001 e2d84000 c038b610 nt!MiDispatchFault+0x129 (FPO: [Non-Fpo])
ef82083c 804e0f07 00000001 e2d84000 00000000 nt!MmAccessFault+0x642 (FPO: [Non-Fpo])
ef82083c 805524d5 00000001 e2d84000 00000000 nt!KiTrap0E+0xd0 (FPO: [0,0] TrapFrame @ ef820854)
ef82091c 805746e3 00000001 00000000 7153624f nt!ExAllocatePoolWithTag+0x863 (FPO: [Non-Fpo])
ef820940 8056ea5b e1e2d250 ef820968 ef82095c nt!ObGetObjectSecurity+0x53 (FPO: [Non-Fpo])
ef82096c 80574958 e1e2d250 82a8d008 00000001 nt!ObCheckObjectAccess+0x29 (FPO: [Non-Fpo])
ef8209b8 80573c4a e1037008 0008abc0 00000000 nt!CmpDoOpen+0x256 (FPO: [Non-Fpo])
ef820bb0 80574152 0008abc0 00000000 82a8d008 nt!CmpParseKey+0x558 (FPO: [Non-Fpo])
ef820c28 805715e8 00000048 ef820c68 00000040 nt!ObpLookupObjectName+0x119 (FPO: [Non-Fpo])
ef820c7c 8057401f 00000000 82ad3558 e1668f01 nt!ObOpenObjectByName+0xea (FPO: [Non-Fpo])
ef820d50 804ddf0f 00cef5dc 00020019 00cef524 nt!NtOpenKey+0x1af (FPO: [Non-Fpo])
ef820d50 7c90eb94 00cef5dc 00020019 00cef524 nt!KiFastCallEntry+0xfc (FPO: [0,0] TrapFrame @ ef820d64)
WARNING: Frame IP not in any known module. Following frames may be wrong.
00cef500 00000000 00000000 00000000 00000000 0x7c90eb94

 

ok this is a good one.

 

note to self: ask people if they are overclocking thier ram before debugging memory corruption issues.

Pending testing with a known good stick at factory specs.

 

tested today with 128mb PC2100 (had to underclock my 875P board) crucial stick. Hasn't been used in probably 18 months, but was good when I replaced it. Wow does winXP run like **** on only128mb. Anyways same thing happened. The errors have been becoming more frequent, mostly being those 7f codes. I am now trying to get a version of Knoppix that will see my network card so I can test to see if its a windows problem.

 

Did some playing around with Knoppix 3.7 (runs off CD) Still got hard freezes once in a while. So is this then pointing to my motherboard I am guessing?

 

Same problem here

Still looking at it.
Would appreciate any status.
Multi-p kernel on a Hyperthreaded XP (1p) (Soyo)

BTW is the machine running VIA 8237 SATA or ATI Radeon? I hope to eliminate these.

Joe

*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

KERNEL_MODE_EXCEPTION_NOT_HANDLED_M (1000008e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003. This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG. This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG. This will let us see why this breakpoint is
happening.
An exception code of 0x80000002 (STATUS_DATATYPE_MISALIGNMENT) indicates
that an unaligned data reference was encountered. The trap frame will
supply additional information.
Arguments:
Arg1: c0000005, The exception code that was not handled
Arg2: 80552ae5, The address that the exception occurred at
Arg3: af46fc70, Trap Frame
Arg4: 00000000

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx ". The memory could not be "%s ".

FAULTING_IP:
nt!ExDeferredFreePool+107
80552ae5 893b mov [ebx],edi

TRAP_FRAME: af46fc70 -- (.trap ffffffffaf46fc70)
Unable to read trap frame at af46fc70

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: 0x8E

LAST_CONTROL_TRANSFER: from 80552aca to 80552ae5

STACK_TEXT:
af46fd24 80552aca 00000001 00000000 e1efb008 nt!ExDeferredFreePool+0x107
af46fd64 bf8029ef e2b53a10 00000000 af47040c nt!ExFreePoolWithTag+0x47f
af46fd74 bf853e43 e2b53a10 00000000 00000000 win32k!HeavyFreePool+0xbb
af47040c bf903cfd e1efb018 af470548 e14c47e8 win32k!EngTextOut+0x844
af470458 bf903e90 bf8537bd af4704dc e1efb018 win32k!OffTextOut+0x71
af4704ec bf81263e e1efb018 af470548 e14c47e8 win32k!SpTextOut+0x9d
af470774 bf81c619 af4707c0 e278b7dc e278b838 win32k!GreExtTextOutWLocked+0xfbf
af4707b8 bf82a454 e278b308 0000000c 00000148 win32k!GreExtTextOutWInternal+0x6e
af470908 804ddf0f 01010719 0000000c 00000148 win32k!NtGdiExtTextOutW+0x2b6
af470908 7c90eb94 01010719 0000000c 00000148 nt!KiFastCallEntry+0xfc
WARNING: Frame IP not in any known module. Following frames may be wrong.
00139a30 00000000 00000000 00000000 00000000 0x7c90eb94


STACK_COMMAND: .bugcheck ; kb

FOLLOWUP_IP:
nt!ExDeferredFreePool+107
80552ae5 893b mov [ebx],edi

SYMBOL_STACK_INDEX: 0

FOLLOWUP_NAME: Pool_corruption

SYMBOL_NAME: nt!ExDeferredFreePool+107

MODULE_NAME: Pool_Corruption

IMAGE_NAME: Pool_Corruption

DEBUG_FLR_IMAGE_TIMESTAMP: 0

BUCKET_ID: 0x8E_nt!ExDeferredFreePool+107

Followup: Pool_corruption
---------

kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

KERNEL_MODE_EXCEPTION_NOT_HANDLED_M (1000008e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003. This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG. This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG. This will let us see why this breakpoint is
happening.
An exception code of 0x80000002 (STATUS_DATATYPE_MISALIGNMENT) indicates
that an unaligned data reference was encountered. The trap frame will
supply additional information.
Arguments:
Arg1: c0000005, The exception code that was not handled
Arg2: 80552ae5, The address that the exception occurred at
Arg3: af46fc70, Trap Frame
Arg4: 00000000

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx ". The memory could not be "%s ".

FAULTING_IP:
nt!ExDeferredFreePool+107
80552ae5 893b mov [ebx],edi

TRAP_FRAME: af46fc70 -- (.trap ffffffffaf46fc70)
Unable to read trap frame at af46fc70

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: 0x8E

LAST_CONTROL_TRANSFER: from 80552aca to 80552ae5

STACK_TEXT:
af46fd24 80552aca 00000001 00000000 e1efb008 nt!ExDeferredFreePool+0x107
af46fd64 bf8029ef e2b53a10 00000000 af47040c nt!ExFreePoolWithTag+0x47f
af46fd74 bf853e43 e2b53a10 00000000 00000000 win32k!HeavyFreePool+0xbb
af47040c bf903cfd e1efb018 af470548 e14c47e8 win32k!EngTextOut+0x844
af470458 bf903e90 bf8537bd af4704dc e1efb018 win32k!OffTextOut+0x71
af4704ec bf81263e e1efb018 af470548 e14c47e8 win32k!SpTextOut+0x9d
af470774 bf81c619 af4707c0 e278b7dc e278b838 win32k!GreExtTextOutWLocked+0xfbf
af4707b8 bf82a454 e278b308 0000000c 00000148 win32k!GreExtTextOutWInternal+0x6e
af470908 804ddf0f 01010719 0000000c 00000148 win32k!NtGdiExtTextOutW+0x2b6
af470908 7c90eb94 01010719 0000000c 00000148 nt!KiFastCallEntry+0xfc
WARNING: Frame IP not in any known module. Following frames may be wrong.
00139a30 00000000 00000000 00000000 00000000 0x7c90eb94


STACK_COMMAND: .bugcheck ; kb

FOLLOWUP_IP:
nt!ExDeferredFreePool+107
80552ae5 893b mov [ebx],edi

SYMBOL_STACK_INDEX: 0

FOLLOWUP_NAME: Pool_corruption

SYMBOL_NAME: nt!ExDeferredFreePool+107

MODULE_NAME: Pool_Corruption

IMAGE_NAME: Pool_Corruption

DEBUG_FLR_IMAGE_TIMESTAMP: 0

BUCKET_ID: 0x8E_nt!ExDeferredFreePool+107

Followup: Pool_corruption
---------

 

wireman, please start a new thread, so we dont get confused.

You said you are having the same problem, we need a better history and problem statement, to understand the context of the phenomenon.

You need to enable pool tagging and collect a new dump. See this article for instructions: http://support.microsoft.com/kb/177415/EN-US/