Blue screens

Hi, I have been having this problem for about 2-3 weeks now, my computer then would suddenly restart at random. I then learnt about the 'automatic restart' option that i could turn off, so I did. Since then I've been having blue screens.

It happens totally randomly, when starting my browser, when playing games etc. Sometimes I can play games for hours without anything happening, and sometimes it happens when I first start my browser.

I get varying error messages, some saying nv4_disp.dll is causing the error, some PAGE_FAULT_IN_NONPAGED_AREA, some caused by videoprt.sys etc.

When I first got this, I was running the newest Nvidia drivers (I have a GeForce FX 5950 Ultra). Then I read on a other forum that the newest drivers are buggy, so I downloaded older drivers. The problem wasnt solved, then I completely uninstalled the old drivers, and installed omega drivers. I thought that helped, because I got no errors for a day, but this morning I had another one .

I started googling for the errors, and that's how I came accros this site, in a post with someone having similiar problems (but they don't seem display related). I saw that there are some experienced and willing to help people here, so i decided to post my problem here . I hope anyone of you can take the time to help me out.

My computer knowledge isnt that extensive and english isnt my native language (Im Dutch) so go easy on me please . Also tell me whichadditional info I need to post here (system specs, logs) to help you.

Thx for your time

 

You will need to configure your machine to generate memory dump files when it blue screens. Once you have a memory dump, you can use this tool below to collect information from it.
You should already have several dump files, search for *.dmp files and look at the dates, or use your event viewer to see what it did with the dump files.

http://www.windowsbbs.com/showthread.php?t=33471

Also, only use data from the most current crashes. We want to troublshoot the system in its current state.

 

Ok, i've done that, and Ive gotten anew blue screen since I installed the MS debug prgram, and I've set the dumpfile to memory.dmp, but this file does not exist. I do have a lot of .dmp files in the folder c:\windows\minidump.

Using the tool on the most recent dump, I get this:

Opened log file 'c:\debuglog.txt'
Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols

Microsoft (R) Windows Debugger Version 6.3.0017.0
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\WINDOWS\Minidump\Mini122604-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: C:\WINDOWS;C:\WINDOWS\system32;C:\WINDOWS\system32\drivers
*** ERROR: Symbol file could not be found. Defaulted to export symbols for ntoskrnl.exe -
Windows XP Kernel Version 2600 (Service Pack 2) UP Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 2600.xpsp_sp2_rtm.040803-2158
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055ab20
Debug session time: Sun Dec 26 13:17:44 2004
System Uptime: 0 days 0:07:35.871
*** ERROR: Symbol file could not be found. Defaulted to export symbols for ntoskrnl.exe -
Loading Kernel Symbols
..................................................................................................................................................................................................
Loading unloaded module list
..........
Loading User Symbols
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 10000050, {fa402050, 1, f663bb64, 0}

***** Kernel symbols are WRONG. Please fix symbols to do analysis.

*** ERROR: Module load completed but symbols could not be loaded for nv4_mini.sys
Probably caused by : hardware ( nv4_mini+3cd67 )

Followup: MachineOwner
---------

kd> !analyze -v;r;kv;lmtn;.logclose;q
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced. This cannot be protected by try-except,
it must be protected by a Probe. Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: fa402050, memory referenced.
Arg2: 00000001, value 0 = read operation, 1 = write operation.
Arg3: f663bb64, If non-zero, the instruction address which referenced the bad memory
address.
Arg4: 00000000, (reserved)

Debugging Details:
------------------

***** Kernel symbols are WRONG. Please fix symbols to do analysis.


WRITE_ADDRESS: unable to get nt!MmPoolCodeEnd
unable to get nt!MmSpecialPoolEnd
unable to get nt!MmPagedPoolEnd
unable to get nt!MmNonPagedPoolEnd
unable to get nt!MmNonPagedPoolStart
unable to get nt!MmSpecialPoolStart
unable to get nt!MmPagedPoolStart
unable to get nt!MiSessionPoolStart
unable to get nt!MiSessionPoolEnd
unable to get nt!MmNonPagedPoolExpansionStart
unable to get nt!MmPoolCodeStart
fa402050

FAULTING_IP:
VIDEOPRT!AgpCommitPhysical+56
f663bb64 0085c0894508 add [ebp+0x84589c0],al

MM_INTERNAL_CODE: 0

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: 0x50

MISALIGNED_IP:
VIDEOPRT!AgpCommitPhysical+56
f663bb64 0085c0894508 add [ebp+0x84589c0],al

LAST_CONTROL_TRANSFER: from f6686d67 to f663bb64

STACK_TEXT:
f1fa9690 f6686d67 86865350 e13a6830 00000210 VIDEOPRT!AgpCommitPhysical+0x56
WARNING: Stack unwind information not available. Following frames may be wrong.
864f0dd8 00000000 00000000 00000000 00000000 nv4_mini+0x3cd67


FOLLOWUP_IP:
nv4_mini+3cd67
f6686d67 84c0 test al,al

SYMBOL_STACK_INDEX: 1

FOLLOWUP_NAME: MachineOwner

SYMBOL_NAME: nv4_mini+3cd67

MODULE_NAME: hardware

IMAGE_NAME: hardware

DEBUG_FLR_IMAGE_TIMESTAMP: 0

STACK_COMMAND: kb

BUCKET_ID: IP_MISALIGNED

Followup: MachineOwner
---------

eax=00000000 ebx=00000000 ecx=00000000 edx=84765008 esi=00000021 edi=e1eb7630
eip=f663bb64 esp=f1fa967c ebp=f1fa9690 iopl=0 nv up ei pl nz na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010202
VIDEOPRT!AgpCommitPhysical+0x56:
f663bb64 0085c0894508 add [ebp+0x84589c0],al ss:0010:fa402050=??
ChildEBP RetAddr Args to Child
f1fa9690 f6686d67 86865350 e13a6830 00000210 VIDEOPRT!AgpCommitPhysical+0x56 (FPO: [Non-Fpo])
WARNING: Stack unwind information not available. Following frames may be wrong.
864f0dd8 00000000 00000000 00000000 00000000 nv4_mini+0x3cd67
start end module name
804d7000 806ec880 nt ntoskrnl.exe Wed Aug 04 08:19:48 2004 (41108004)
806ed000 80700d80 hal halacpi.dll Wed Aug 04 07:59:04 2004 (41107B28)
bf800000 bf9c0400 win32k win32k.sys Wed Aug 04 08:17:30 2004 (41107F7A)
bf9c1000 bf9d2580 dxg dxg.sys Wed Aug 04 08:00:51 2004 (41107B93)
bf9d3000 bfd64180 nv4_disp nv4_disp.dll Thu Jul 15 21:13:32 2004 (40F6D75C)
f1418000 f1441f00 kmixer kmixer.sys Wed Aug 04 08:07:46 2004 (41107D32)
f2142000 f2182380 HTTP HTTP.sys Wed Aug 04 08:00:09 2004 (41107B69)
f2313000 f2323760 NAVENG NAVENG.Sys Fri Oct 01 03:59:17 2004 (415CB9F5)
f2324000 f23bc680 NavEx15 NavEx15.Sys Fri Oct 01 04:11:15 2004 (415CBCC3)

What am I doing wrong , and what is an event viewer?

 

You said that you read that the newest Nvidia drivers were buggy. Those were the drivers that came with your computer. Did YOU experience any problems with those drivers?

From what I am reading, you began experiencing problems when you changed the drivers.

If you did not personally experience any problems with the new drivers that came with your machine originally, I recommend you put them back!

 

No that's not what is the case, sorry if that was not clear.

I've had this computer for about 1 year now, and I've never had big problems untill recently. Since the file nv4_disp.dll seemed to play a role in the errors, I checked which drivers I had, and this were the newest drivers. I don't know since when I have these, I get them through the automatic updates.

Then I remembered someone saying they had problems with screen flickerings and such, and that was caused by the new Nvidia drivers. So I checked my dxdiag, and under the display tab I saw this: The file nv4_disp.dll is not digitally signed, which means that it has not been tested by Microsoft's Windows Hardware Quality Labs (WHQL). You may be able to get a WHQL logo'd driver from the hardware manufacturer.

So I figured something had to be wrong with my display drivers. That is why I downloaded the previous version of the Nvidia driver, which should solve my problem if it is indeed my automatically downloaded new drivers that are causing these errors, but the errors kept coming. That's why i came here

 

this last crash was caused by the video card drivers (90%) or the card itself (10%).

I recommend getting the very latest, straight from the horses mouth: http://www.nvidia.com/page/home

If these are the ones you are using now, try going to windows update and seeing what drivers it recommends for you and trying those. If those dont work either, as RayH recommends, get out your CD that came with the card and use those drivers, they are usually the most tested and highly stable.

If it crashes with those, you may have a problem with the hardware. Before we go that route, we'd want to see a new dump running those 'in box' drivers.

 

Ok, installed the latest drivers from the Nvidia site now, no crashes so far, but it would be weird if I had these drivers, because I had these when i got my first errors. Ill post here as soon as I get another crash .

 

Pff, I thought installing the newest drivers fixed it, this are the ones straight from the Nviadia site, and windows update didnt recommend other drivers. But it just got another crash, and for the first time the memory dump was saved into memory.dmp, which is 0.99 GB btw

Anyway here is the debug log:

Opened log file 'c:\debuglog.txt'
Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols

Microsoft (R) Windows Debugger Version 6.3.0017.0
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\WINDOWS\MEMORY.DMP]
Kernel Complete Dump File: Full address space is available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: C:\WINDOWS;C:\WINDOWS\system32;C:\WINDOWS\system32\drivers
*** ERROR: Symbol file could not be found. Defaulted to export symbols for ntoskrnl.exe -
Windows XP Kernel Version 2600 (Service Pack 2) UP Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 2600.xpsp_sp2_rtm.040803-2158
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055ab20
Debug session time: Mon Dec 27 14:16:55 2004
System Uptime: 0 days 2:45:22.916
*** ERROR: Symbol file could not be found. Defaulted to export symbols for ntoskrnl.exe -
Loading Kernel Symbols
...................................................................................................................................................................................................
Loading unloaded module list
...............
Loading User Symbols
................................................................................
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 8E, {c0000005, bfa47929, b99aba50, 0}

***** Kernel symbols are WRONG. Please fix symbols to do analysis.

*** ERROR: Symbol file could not be found. Defaulted to export symbols for nv4_disp.dll -
Probably caused by : nv4_disp.dll ( nv4_disp+74929 )

Followup: MachineOwner
---------

kd> !analyze -v;r;kv;lmtn;.logclose;q
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

KERNEL_MODE_EXCEPTION_NOT_HANDLED (8e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003. This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG. This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG. This will let us see why this breakpoint is
happening.
An exception code of 0x80000002 (STATUS_DATATYPE_MISALIGNMENT) indicates
that an unaligned data reference was encountered. The trap frame will
supply additional information.
Arguments:
Arg1: c0000005, The exception code that was not handled
Arg2: bfa47929, The address that the exception occurred at
Arg3: b99aba50, Trap Frame
Arg4: 00000000

Debugging Details:
------------------

***** Kernel symbols are WRONG. Please fix symbols to do analysis.


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - De instructie op 0x%08lx verwijst naar geheugen op 0x%08lx. De lees- of schrijfbewerking ( "%s ") op het geheugen is mislukt.

FAULTING_IP:
nv4_disp+74929
bfa47929 8930 mov [eax],esi

TRAP_FRAME: b99aba50 -- (.trap ffffffffb99aba50)
.trap ffffffffb99aba50
ErrCode = 00000002
eax=2fa2f8b8 ebx=e2314438 ecx=e2314438 edx=e1e0a800 esi=e25b6e00 edi=e20b0f40
eip=bfa47929 esp=b99abac4 ebp=00000000 iopl=0 nv up ei pl nz na po nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010206
nv4_disp+0x74929:
bfa47929 8930 mov [eax],esi ds:0023:2fa2f8b8=????????
.trap
Resetting default scope

DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: 0x8E

LAST_CONTROL_TRANSFER: from 00000000 to bfa47929

STACK_TEXT:
00000000 00000000 00000000 00000000 00000000 nv4_disp+0x74929


FOLLOWUP_IP:
nv4_disp+74929
bfa47929 8930 mov [eax],esi

SYMBOL_STACK_INDEX: 0

FOLLOWUP_NAME: MachineOwner

SYMBOL_NAME: nv4_disp+74929

MODULE_NAME: nv4_disp

IMAGE_NAME: nv4_disp.dll

DEBUG_FLR_IMAGE_TIMESTAMP: 4182eb4e

STACK_COMMAND: .trap ffffffffb99aba50 ; kb

BUCKET_ID: WRONG_SYMBOLS

Followup: MachineOwner
---------

eax=ffdff13c ebx=bfa47929 ecx=00000000 edx=804dba16 esi=b99ab9fc edi=00000000
eip=805339ae esp=b99ab600 ebp=b99ab618 iopl=0 nv up ei ng nz na po nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00000286
nt!KeBugCheckEx+0x1b:
805339ae 5d pop ebp
ChildEBP RetAddr Args to Child
WARNING: Stack unwind information not available. Following frames may be wrong.
b99ab618 8051dea6 0000008e c0000005 bfa47929 nt!KeBugCheckEx+0x1b
b99ab9e0 804dfada b99ab9fc 00000000 b99aba50 nt!PoSetSystemState+0x58eb
b99aba50 bfa47929 badb0d00 e1e0a800 e25b90c0 nt!Kei386EoiHelper+0x1df
00000000 00000000 00000000 00000000 00000000 nv4_disp+0x74929
start end module name
00400000 02497000 RomeTW RomeTW.exe Tue Sep 07 16:11:43 2004 (413DC19F)
03b10000 03b28000 mssds3d mssds3d.m3d Thu Aug 12 00:55:36 2004 (411AA3E8)
03b60000 03b7b000 mssdsp mssdsp.flt Thu Aug 12 00:55:41 2004 (411AA3ED)
07270000 072a7000 qasf qasf.dll Wed Aug 11 09:45:17 2004 (4119CE8D)
072b0000 072eb000 WMASF WMASF.DLL Wed Aug 11 09:28:24 2004 (4119CA98)
072f0000 07350000 WMADMOD WMADMOD.DLL Wed Aug 11 09:45:13 2004 (4119CE89)
07490000 074d2000 DVobSub DVobSub.ax Wed Dec 11 09:19:59 2002 (3DF6F52F)
094f0000 09734000 wmvcore wmvcore.dll Wed Aug 11 10:37:17 2004 (4119DABD)
09840000 098a1000 vobsub vobsub.dll Wed Dec 11 09:19:32 2002 (3DF6F514)
09d80000 09e56000 WMVDMOD WMVDMOD.DLL Wed Aug 11 09:45:21 2004 (4119CE91)
0ffd0000 0fff8000 rsaenh rsaenh.dll Wed Jul 07 04:17:12 2004 (40EB5D28)
10000000 1002c000 ac3filter ac3filter.cpl Tue Aug 19 09:20:02 2003 (3F41CFA2)
20000000 202d5000 xpsp2res xpsp2res.dll Wed Aug 04 10:04:59 2004 (411098AB)
21100000 21160000 mss32 mss32.dll Thu Aug 12 00:55:32 2004 (411AA3E4)
22300000 2232b000 msseax msseax.m3d Thu Aug 12 00:55:46 2004 (411AA3F2)
22400000 22415000 msssoft msssoft.m3d Thu Aug 12 00:55:51 2004 (411AA3F7)
26f00000 26f29000 mssmp3 mssmp3.asi Thu Aug 12 00:55:49 2004 (411AA3F5)
4d580000 4d5d8000 WINHTTP WINHTTP.dll Wed Aug 04 10:03:24 2004 (4110984C)
4fd10000 4feb6000 d3d9 d3d9.dll Wed Aug 04 10:01:58 2004 (411097F6)
59e70000 59f11000 DBGHELP DBGHELP.dll Wed Aug 04 10:02:05 2004 (411097FD)
5b190000 5b1c8000 uxtheme uxtheme.dll Wed Aug 04 10:02:59 2004 (41109833)
5d4e0000 5d577000 COMCTL32 COMCTL32.dll Wed Aug 04 10:02:26 2004 (41109812)
5f230000 5f247000 OLEPRO32 OLEPRO32.DLL Wed Aug 04 10:03:50 2004 (41109866)
61e00000 61e0e000 MFC42LOC MFC42LOC.DLL Thu Sep 06 22:26:09 2001 (3B97DBE1)
67320000 6734f000 asOEHook asOEHook.dll Thu Sep 16 03:53:28 2004 (4148F218)
68db0000 68db9000 HID HID.DLL Wed Aug 04 10:02:09 2004 (41109801)
6d320000 6d359000 DINPUT8 DINPUT8.dll Wed Aug 04 10:02:27 2004 (41109813)
6deb0000 6deb6000 d3d8thk d3d8thk.dll Wed Aug 04 10:01:57 2004 (411097F5)
6dec0000 6dfe8000 d3d8 d3d8.dll Wed Aug 04 10:01:57 2004 (411097F5)
6ff20000 6ff74000 netapi32 netapi32.dll Wed Aug 04 10:02:33 2004 (41109819)
71a20000 71a28000 WS2HELP WS2HELP.dll Wed Aug 04 10:03:58 2004 (4110986E)
71a30000 71a47000 WS2_32 WS2_32.dll Wed Aug 04 10:03:57 2004 (4110986D)
71a50000 71a5a000 WSOCK32 WSOCK32.dll Wed Aug 04 10:04:10 2004 (4110987A)
72240000 72245000 SensApi SensApi.dll Wed Aug 04 10:02:36 2004 (4110981C)
727a0000 7289e000 MFC42u MFC42u.DLL Wed Aug 04 10:02:21 2004 (4110980D)
72c80000 72c88000 msacm32 msacm32.drv Thu Sep 06 22:24:23 2001 (3B97DB77)
72c90000 72c99000 wdmaud_72c90000 wdmaud.drv Wed Aug 04 10:03:11 2004 (4110983F)
73620000 73627000 msdmo msdmo.dll Wed Aug 04 10:03:52 2004 (41109868)
736d0000 73719000 DDRAW DDRAW.dll Wed Aug 04 10:02:11 2004 (41109803)
738b0000 73980000 D3DIM700 D3DIM700.DLL Wed Aug 04 10:01:59 2004 (411097F7)
73b30000 73b36000 DCIMAN32 DCIMAN32.dll Wed Aug 04 10:02:10 2004 (41109802)
73e50000 73e54000 KsUser KsUser.dll Wed Aug 04 10:02:28 2004 (41109814)
73e80000 73edc000 DSOUND DSOUND.DLL Wed Aug 04 10:03:03 2004 (41109837)
74790000 748fe000 quartz quartz.dll Wed Aug 04 10:02:39 2004 (4110981F)
75b50000 75b71000 MSVFW32 MSVFW32.dll Wed Aug 04 10:05:14 2004 (411098BA)
75d40000 75dd1000 mlang mlang.dll Wed Aug 04 10:02:28 2004 (41109814)
76350000 7639a000 comdlg32 comdlg32.dll Wed Aug 04 10:02:27 2004 (41109813)
76580000 76593000 cryptnet cryptnet.dll Wed Aug 04 10:02:00 2004 (411097F8)
765f0000 76601000 devenum devenum.dll Wed Aug 04 10:02:17 2004 (41109809)
76970000 76a24000 userenv userenv.dll Wed Aug 04 10:02:57 2004 (41109831)
76ad0000 76ae1000 ATL ATL.DLL Wed Aug 04 10:02:49 2004 (41109829)
76af0000 76b1e000 WINMM WINMM.dll Wed Aug 04 10:03:27 2004 (4110984F)
76bf0000 76c1e000 WINTRUST WINTRUST.dll Wed Aug 04 10:03:00 2004 (41109834)
76c50000 76c78000 IMAGEHLP IMAGEHLP.dll Wed Aug 04 10:02:24 2004 (41109810)
76f20000 76f4d000 WLDAP32 WLDAP32.dll Wed Aug 04 10:03:02 2004 (41109836)
76f90000 7700f000 CLBCATQ CLBCATQ.DLL Wed Aug 04 10:02:13 2004 (41109805)
77010000 770dd000 COMRes COMRes.dll Wed Aug 04 10:02:31 2004 (41109817)
770e0000 7716c000 OLEAUT32 OLEAUT32.dll Wed Aug 04 10:03:46 2004 (41109862)
77170000 77217000 WININET WININET.dll Wed Sep 29 20:50:01 2004 (415B03D9)
77220000 772be000 urlmon urlmon.dll Wed Sep 29 20:50:01 2004 (415B03D9)
77390000 77492000 comctl32_77390000 comctl32.dll Wed Aug 04 10:01:49 2004 (411097ED)
774a0000 775dc000 ole32 ole32.dll Wed Aug 04 10:03:45 2004 (41109861)
778e0000 779d7000 SETUPAPI SETUPAPI.DLL Wed Aug 04 10:02:40 2004 (41109820)
77a40000 77ad5000 CRYPT32 CRYPT32.dll Wed Aug 04 10:01:57 2004 (411097F5)
77ae0000 77af2000 MSASN1 MSASN1.dll Wed Aug 04 10:03:22 2004 (4110984A)
77b00000 77b22000 Apphelp Apphelp.dll Wed Aug 04 10:02:30 2004 (41109816)
77ba0000 77ba7000 midimap midimap.dll Wed Aug 04 10:02:24 2004 (41109810)
77bb0000 77bc5000 MSACM32_77bb0000 MSACM32.dll Wed Aug 04 10:03:02 2004 (41109836)
77bd0000 77bd8000 VERSION VERSION.dll Wed Aug 04 10:02:56 2004 (41109830)
77be0000 77c38000 msvcrt msvcrt.dll Wed Aug 04 10:05:13 2004 (411098B9)
77d10000 77da0000 USER32 USER32.dll Wed Aug 04 10:02:56 2004 (41109830)
77da0000 77e31000 RPCRT4 RPCRT4.dll Wed Aug 04 10:02:38 2004 (4110981E)
77e40000 77e86000 GDI32 GDI32.dll Wed Aug 04 10:02:04 2004 (411097FC)
77e90000 77f06000 SHLWAPI SHLWAPI.dll Wed Aug 04 10:02:52 2004 (4110982C)
77f10000 77f21000 secur32 secur32.dll Wed Aug 04 10:02:57 2004 (41109831)
77f40000 77feb000 ADVAPI32 ADVAPI32.dll Wed Aug 04 10:02:17 2004 (41109809)
7c340000 7c396000 MSVCR71 MSVCR71.dll Fri Feb 21 13:42:20 2003 (3E561EAC)
7c800000 7c8fe000 kernel32 kernel32.dll Wed Aug 04 10:02:59 2004 (41109833)
7c900000 7c9b6000 ntdll ntdll.dll Wed Aug 04 10:02:59 2004 (41109833)
7c9c0000 7d1df000 SHELL32 SHELL32.dll Wed Aug 04 10:02:47 2004 (41109827)
804d7000 806ec880 nt ntoskrnl.exe Wed Aug 04 08:19:48 2004 (41108004)
806ed000 80700d80 hal halacpi.dll Wed Aug 04 07:59:04 2004 (41107B28)
b7fff000 b8028f00 kmixer kmixer.sys Wed Aug 04 08:07:46 2004 (41107D32)
bf800000 bf9c0400 win32k win32k.sys Wed Aug 04 08:17:30 2004 (41107F7A)
bf9c1000 bf9d2580 dxg dxg.sys Wed Aug 04 08:00:51 2004 (41107B93)
bf9d3000 bfd63480 nv4_disp nv4_disp.dll Sat Oct 30 03:15:58 2004 (4182EB4E)
bffa0000 bffe5c00 ATMFD ATMFD.DLL Wed Aug 04 10:02:50 2004 (4110982A)
f2561000 f25a1380 HTTP HTTP.sys Wed Aug 04 08:00:09 2004 (41107B69)
f270a000 f271a760 NAVENG NAVENG.Sys Fri Oct 01 03:59:17 2004 (415CB9F5)
f271b000 f27b3680 NavEx15 NavEx15.Sys Fri Oct 01 04:11:15 2004 (415CBCC3)
f27b4000 f280b000 SAVRT SAVRT.SYS Sat Jul 24 04:26:42 2004 (4101C8E2)
f2b7b000 f2bac940 btslbcsp btslbcsp.sys Mon Sep 15 23:58:32 2003 (3F663608)
f2bad000 f2bd9400 mrxdav mrxdav.sys Wed Aug 04 08:00:49 2004 (41107B91)
f2be2000 f2be4b80 secdrv secdrv.sys Thu Nov 14 12:52:30 2002 (3DD38E7E)
f2de7000 f2dfb400 wdmaud wdmaud.sys Wed Aug 04 08:15:03 2004 (41107EE7)
f2e84000 f2e901c0 btwusb btwusb.sys Mon Sep 15 23:44:04 2003 (3F6632A4)

**it doesnt fit in one post, see next **

 

yes, this is a straight up crash in the video drivers again. I agree, lets try the CD drivers.

 

No, another crash , I uninstalled the newest drivers, then installed the drivers that came on the CD. Weirdly I got a 'you are installing older versions of a file then is already on your computer' message, and I chose to install over the newer versions. But afterwards I checked and I indeed the CD-drivers were installed. And half an hour ago my sis was playing The sims 2 when it crashed again..

The log:

Opened log file 'c:\debuglog.txt'
Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols

Microsoft (R) Windows Debugger Version 6.3.0017.0
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\WINDOWS\MEMORY.DMP]
Kernel Complete Dump File: Full address space is available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: C:\WINDOWS;C:\WINDOWS\system32;C:\WINDOWS\system32\drivers
*** ERROR: Symbol file could not be found. Defaulted to export symbols for ntoskrnl.exe -
Windows XP Kernel Version 2600 (Service Pack 2) UP Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 2600.xpsp_sp2_rtm.040803-2158
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055ab20
Debug session time: Mon Dec 27 16:28:19 2004
System Uptime: 0 days 1:29:10.801
*** ERROR: Symbol file could not be found. Defaulted to export symbols for ntoskrnl.exe -
Loading Kernel Symbols
..................................................................................................................................................................................................
Loading unloaded module list
............
Loading User Symbols
...................................................................
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 8E, {c0000005, bfa446e1, f5259428, 0}

***** Kernel symbols are WRONG. Please fix symbols to do analysis.

*** ERROR: Symbol file could not be found. Defaulted to export symbols for nv4_disp.dll -
Probably caused by : nv4_disp.dll ( nv4_disp+716e1 )

Followup: MachineOwner
---------

kd> !analyze -v;r;kv;lmtn;.logclose;q
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

KERNEL_MODE_EXCEPTION_NOT_HANDLED (8e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003. This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG. This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG. This will let us see why this breakpoint is
happening.
An exception code of 0x80000002 (STATUS_DATATYPE_MISALIGNMENT) indicates
that an unaligned data reference was encountered. The trap frame will
supply additional information.
Arguments:
Arg1: c0000005, The exception code that was not handled
Arg2: bfa446e1, The address that the exception occurred at
Arg3: f5259428, Trap Frame
Arg4: 00000000

Debugging Details:
------------------

***** Kernel symbols are WRONG. Please fix symbols to do analysis.


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - De instructie op 0x%08lx verwijst naar geheugen op 0x%08lx. De lees- of schrijfbewerking ( "%s ") op het geheugen is mislukt.

FAULTING_IP:
nv4_disp+716e1
bfa446e1 8b13 mov edx,[ebx]

TRAP_FRAME: f5259428 -- (.trap fffffffff5259428)
.trap fffffffff5259428
ErrCode = 00000000
eax=00000400 ebx=00000000 ecx=00000000 edx=00000005 esi=e204a000 edi=e43d3f74
eip=bfa446e1 esp=f525949c ebp=e43d3f74 iopl=0 nv up ei pl nz na po nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010206
nv4_disp+0x716e1:
bfa446e1 8b13 mov edx,[ebx] ds:0023:00000000=????????
.trap
Resetting default scope

DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: 0x8E

LAST_CONTROL_TRANSFER: from 00000000 to bfa446e1

STACK_TEXT:
e43d3f74 00000000 e43d40c0 00000000 00000000 nv4_disp+0x716e1


FOLLOWUP_IP:
nv4_disp+716e1
bfa446e1 8b13 mov edx,[ebx]

SYMBOL_STACK_INDEX: 0

FOLLOWUP_NAME: MachineOwner

SYMBOL_NAME: nv4_disp+716e1

MODULE_NAME: nv4_disp

IMAGE_NAME: nv4_disp.dll

DEBUG_FLR_IMAGE_TIMESTAMP: 3f725d4c

STACK_COMMAND: .trap fffffffff5259428 ; kb

BUCKET_ID: WRONG_SYMBOLS

Followup: MachineOwner
---------

eax=ffdff13c ebx=bfa446e1 ecx=00000000 edx=804dba16 esi=f52593d4 edi=00000000
eip=805339ae esp=f5258fd8 ebp=f5258ff0 iopl=0 nv up ei ng nz na po nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00000286
nt!KeBugCheckEx+0x1b:
805339ae 5d pop ebp
ChildEBP RetAddr Args to Child
WARNING: Stack unwind information not available. Following frames may be wrong.
f5258ff0 8051dea6 0000008e c0000005 bfa446e1 nt!KeBugCheckEx+0x1b
f52593b8 804dfada f52593d4 00000000 f5259428 nt!PoSetSystemState+0x58eb
f5259428 bfa446e1 badb0d00 00000005 80202000 nt!Kei386EoiHelper+0x1df
e43d3f74 00000000 e43d40c0 00000000 00000000 nv4_disp+0x716e1
start end module name
00400000 011a3000 Sims2 Sims2.exe Wed Aug 18 05:04:46 2004 (4122C74E)
0ffd0000 0fff8000 rsaenh rsaenh.dll Wed Jul 07 04:17:12 2004 (40EB5D28)
20000000 202d5000 xpsp2res xpsp2res.dll Wed Aug 04 10:04:59 2004 (411098AB)
4d580000 4d5d8000 WINHTTP WINHTTP.dll Wed Aug 04 10:03:24 2004 (4110984C)
4f5c0000 4f7c7000 dxdiagn dxdiagn.dll Wed Aug 04 10:02:02 2004 (411097FA)
4fd10000 4feb6000 D3D9 D3D9.DLL Wed Aug 04 10:01:58 2004 (411097F6)
59e70000 59f11000 DbgHelp DbgHelp.dll Wed Aug 04 10:02:05 2004 (411097FD)
5b190000 5b1c8000 uxtheme uxtheme.dll Wed Aug 04 10:02:59 2004 (41109833)
5d4e0000 5d577000 COMCTL32 COMCTL32.dll Wed Aug 04 10:02:26 2004 (41109812)
60000000 60058000 ijl15 ijl15.dll Wed May 30 23:37:47 2001 (3B15682B)
66700000 6686a000 _df394b ~df394b.tmp Mon Jul 12 13:57:20 2004 (40F27CA0)
67320000 6734f000 asOEHook asOEHook.dll Thu Sep 16 03:53:28 2004 (4148F218)
6de30000 6dea1000 D3DIM D3DIM.DLL Thu Sep 06 22:24:54 2001 (3B97DB96)
6deb0000 6deb6000 d3d8thk d3d8thk.dll Wed Aug 04 10:01:57 2004 (411097F5)
6ff20000 6ff74000 NETAPI32 NETAPI32.dll Wed Aug 04 10:02:33 2004 (41109819)
71a20000 71a28000 WS2HELP WS2HELP.dll Wed Aug 04 10:03:58 2004 (4110986E)
71a30000 71a47000 WS2_32 WS2_32.DLL Wed Aug 04 10:03:57 2004 (4110986D)
72240000 72245000 SensApi SensApi.dll Wed Aug 04 10:02:36 2004 (4110981C)
72c80000 72c88000 msacm32_72c80000 msacm32.drv Thu Sep 06 22:24:23 2001 (3B97DB77)
72c90000 72c99000 wdmaud_72c90000 wdmaud.drv Wed Aug 04 10:03:11 2004 (4110983F)
736d0000 73719000 ddraw ddraw.dll Wed Aug 04 10:02:11 2004 (41109803)
73ac0000 73ad7000 AVIFIL32 AVIFIL32.DLL Wed Aug 04 10:03:01 2004 (41109835)
73b30000 73b36000 DCIMAN32 DCIMAN32.dll Wed Aug 04 10:02:10 2004 (41109802)
73e50000 73e54000 KsUser KsUser.dll Wed Aug 04 10:02:28 2004 (41109814)
73e80000 73edc000 DSOUND DSOUND.DLL Wed Aug 04 10:03:03 2004 (41109837)
74e50000 74e5e000 wbemsvc wbemsvc.dll Wed Aug 04 10:03:08 2004 (4110983C)
74e70000 74e78000 wbemprox wbemprox.dll Wed Aug 04 10:03:07 2004 (4110983B)
75210000 75247000 wbemcomn wbemcomn.dll Wed Aug 04 10:03:01 2004 (41109835)
75620000 75696000 fastprox fastprox.dll Wed Aug 04 10:02:03 2004 (411097FB)
75b50000 75b71000 MSVFW32 MSVFW32.DLL Wed Aug 04 10:05:14 2004 (411098BA)
76020000 76085000 MSVCP60 MSVCP60.dll Wed Aug 04 10:05:12 2004 (411098B8)
76330000 7634d000 IMM32 IMM32.DLL Wed Aug 04 10:02:29 2004 (41109815)
76580000 76593000 cryptnet cryptnet.dll Wed Aug 04 10:02:00 2004 (411097F8)
76750000 76763000 NTDSAPI NTDSAPI.dll Wed Aug 04 10:03:02 2004 (41109836)
76970000 76a24000 userenv userenv.dll Wed Aug 04 10:02:57 2004 (41109831)
76af0000 76b1e000 WINMM WINMM.dll Wed Aug 04 10:03:27 2004 (4110984F)
76bb0000 76bbb000 psapi psapi.dll Wed Aug 04 10:03:05 2004 (41109839)
76bf0000 76c1e000 WINTRUST WINTRUST.dll Wed Aug 04 10:03:00 2004 (41109834)
76c50000 76c78000 IMAGEHLP IMAGEHLP.dll Wed Aug 04 10:02:24 2004 (41109810)
76e40000 76e4e000 rtutils rtutils.dll Wed Aug 04 10:02:44 2004 (41109824)
76e50000 76e62000 rasman rasman.dll Wed Aug 04 10:02:37 2004 (4110981D)
76e70000 76e9f000 TAPI32 TAPI32.dll Wed Aug 04 10:02:52 2004 (4110982C)
76ea0000 76edc000 rasapi32 rasapi32.dll Wed Aug 04 10:02:33 2004 (41109819)
76ee0000 76f07000 DNSAPI DNSAPI.dll Wed Aug 04 10:02:40 2004 (41109820)
76f20000 76f4d000 WLDAP32 WLDAP32.dll Wed Aug 04 10:03:02 2004 (41109836)
76f90000 7700f000 CLBCATQ CLBCATQ.DLL Wed Aug 04 10:02:13 2004 (41109805)
77010000 770dd000 COMRes COMRes.dll Wed Aug 04 10:02:31 2004 (41109817)
770e0000 7716c000 OLEAUT32 OLEAUT32.DLL Wed Aug 04 10:03:46 2004 (41109862)
77390000 77492000 comctl32_77390000 comctl32.dll Wed Aug 04 10:01:49 2004 (411097ED)
774a0000 775dc000 ole32 ole32.dll Wed Aug 04 10:03:45 2004 (41109861)
77a40000 77ad5000 CRYPT32 CRYPT32.dll Wed Aug 04 10:01:57 2004 (411097F5)
77ae0000 77af2000 MSASN1 MSASN1.dll Wed Aug 04 10:03:22 2004 (4110984A)
77b00000 77b22000 Apphelp Apphelp.dll Wed Aug 04 10:02:30 2004 (41109816)
77ba0000 77ba7000 midimap midimap.dll Wed Aug 04 10:02:24 2004 (41109810)
77bb0000 77bc5000 MSACM32 MSACM32.dll Wed Aug 04 10:03:02 2004 (41109836)
77bd0000 77bd8000 VERSION VERSION.DLL Wed Aug 04 10:02:56 2004 (41109830)
77be0000 77c38000 msvcrt msvcrt.dll Wed Aug 04 10:05:13 2004 (411098B9)
77d10000 77da0000 USER32 USER32.dll Wed Aug 04 10:02:56 2004 (41109830)
77da0000 77e31000 RPCRT4 RPCRT4.dll Wed Aug 04 10:02:38 2004 (4110981E)
77e40000 77e86000 GDI32 GDI32.DLL Wed Aug 04 10:02:04 2004 (411097FC)
77e90000 77f06000 SHLWAPI SHLWAPI.dll Wed Aug 04 10:02:52 2004 (4110982C)
77f10000 77f21000 secur32 secur32.dll Wed Aug 04 10:02:57 2004 (41109831)
77f40000 77feb000 ADVAPI32 ADVAPI32.DLL Wed Aug 04 10:02:17 2004 (41109809)
7c340000 7c396000 MSVCR71 MSVCR71.dll Fri Feb 21 13:42:20 2003 (3E561EAC)
7c800000 7c8fe000 kernel32 kernel32.dll Wed Aug 04 10:02:59 2004 (41109833)
7c900000 7c9b6000 ntdll ntdll.dll Wed Aug 04 10:02:59 2004 (41109833)
7c9c0000 7d1df000 SHELL32 SHELL32.dll Wed Aug 04 10:02:47 2004 (41109827)
804d7000 806ec880 nt ntoskrnl.exe Wed Aug 04 08:19:48 2004 (41108004)
806ed000 80700d80 hal halacpi.dll Wed Aug 04 07:59:04 2004 (41107B28)
bf800000 bf9c0400 win32k win32k.sys Wed Aug 04 08:17:30 2004 (41107F7A)
bf9c1000 bf9d2580 dxg dxg.sys Wed Aug 04 08:00:51 2004 (41107B93)
bf9d3000 bfddd980 nv4_disp nv4_disp.dll Thu Sep 25 05:13:16 2003 (3F725D4C)

**see next **

 

Another crash with the CD-drivers, the log:

Opened log file 'c:\debuglog.txt'
Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols

Microsoft (R) Windows Debugger Version 6.3.0017.0
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\WINDOWS\MEMORY.DMP]
Kernel Complete Dump File: Full address space is available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: C:\WINDOWS;C:\WINDOWS\system32;C:\WINDOWS\system32\drivers
*** ERROR: Symbol file could not be found. Defaulted to export symbols for ntoskrnl.exe -
Windows XP Kernel Version 2600 (Service Pack 2) UP Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 2600.xpsp_sp2_rtm.040803-2158
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055ab20
Debug session time: Tue Dec 28 17:38:31 2004
System Uptime: 0 days 0:52:56.578
*** ERROR: Symbol file could not be found. Defaulted to export symbols for ntoskrnl.exe -
Loading Kernel Symbols
..................................................................................................................................................................................................
Loading unloaded module list
............
Loading User Symbols
..........................................................................
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 8E, {c0000005, 43, f2dd7780, 0}

***** Kernel symbols are WRONG. Please fix symbols to do analysis.

*** WARNING: Unable to verify checksum for
*** ERROR: Symbol file could not be found. Defaulted to export symbols for -
*** ERROR: Symbol file could not be found. Defaulted to export symbols for SYMEVENT.SYS -
Probably caused by : SAVRT.SYS ( SAVRT+1a9ff )

Followup: MachineOwner
---------

kd> !analyze -v;r;kv;lmtn;.logclose;q
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

KERNEL_MODE_EXCEPTION_NOT_HANDLED (8e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003. This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG. This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG. This will let us see why this breakpoint is
happening.
An exception code of 0x80000002 (STATUS_DATATYPE_MISALIGNMENT) indicates
that an unaligned data reference was encountered. The trap frame will
supply additional information.
Arguments:
Arg1: c0000005, The exception code that was not handled
Arg2: 00000043, The address that the exception occurred at
Arg3: f2dd7780, Trap Frame
Arg4: 00000000

Debugging Details:
------------------

***** Kernel symbols are WRONG. Please fix symbols to do analysis.


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - De instructie op 0x%08lx verwijst naar geheugen op 0x%08lx. De lees- of schrijfbewerking ( "%s ") op het geheugen is mislukt.

FAULTING_IP:
+43
00000043 ?? ???

TRAP_FRAME: f2dd7780 -- (.trap fffffffff2dd7780)
.trap fffffffff2dd7780
ErrCode = 00000000
eax=00000001 ebx=00000001 ecx=0d110004 edx=0d100003 esi=e1290130 edi=f2dd78a8
eip=00000042 esp=f2dd77f4 ebp=e169d570 iopl=0 nv up ei ng nz na po nc
cs=0008 ss=0010 ds=0022 es=0023 fs=0030 gs=0000 efl=00010286
00000042 ?? ???
.trap
Resetting default scope

DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: 0x8E

LAST_CONTROL_TRANSFER: from f2f049ff to 00000042

STACK_TEXT:
WARNING: Frame IP not in any known module. Following frames may be wrong.
f2dd77f0 f2f049ff e18fef58 00000001 f2f04a49 0x42
00010286 004d0055 00450042 005f0052 0046004f SAVRT+0x1a9ff
e169d570 e1b481f8 f5512460 e2d1bfe8 f5512464 firefox!jpeg_get_large+0x5567e
f5512908 f5518c80 f5518d20 f5519ce0 f5518d70 0xe1b481f8
f551a680 ffffe578 082444f6 56097401 0029fbe8 SYMEVENT+0x6c80
e8f18b56 00000000 00000000 00000000 00000000 0xffffe578


FOLLOWUP_IP:
SAVRT+1a9ff
f2f049ff 1d8502008b sbb eax,0x8b000285

SYMBOL_STACK_INDEX: 1

FOLLOWUP_NAME: MachineOwner

SYMBOL_NAME: SAVRT+1a9ff

MODULE_NAME: SAVRT

IMAGE_NAME: SAVRT.SYS

DEBUG_FLR_IMAGE_TIMESTAMP: 4101c8e2

STACK_COMMAND: .trap fffffffff2dd7780 ; kb

BUCKET_ID: WRONG_SYMBOLS

Followup: MachineOwner
---------

eax=ffdff13c ebx=00000043 ecx=00000000 edx=804dba16 esi=f2dd772c edi=00000000
eip=805339ae esp=f2dd7330 ebp=f2dd7348 iopl=0 nv up ei ng nz na po nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00000286
nt!KeBugCheckEx+0x1b:
805339ae 5d pop ebp
ChildEBP RetAddr Args to Child
WARNING: Stack unwind information not available. Following frames may be wrong.
f2dd7348 8051dea6 0000008e c0000005 00000042 nt!KeBugCheckEx+0x1b
f2dd7710 804dfada f2dd772c 00000000 f2dd7780 nt!PoSetSystemState+0x58eb
f2dd7780 00000043 badb0d00 0d100003 00000001 nt!Kei386EoiHelper+0x1df
start end module name
00400000 00a66000 firefox firefox.exe Sun Nov 07 21:46:59 2004 (418E89C3)
010e0000 01105000 FULLSOFT FULLSOFT.DLL Thu May 29 00:41:47 2003 (3ED53B2B)
01450000 01465000 nl_lsp nl_lsp.dll Wed Mar 31 17:24:50 2004 (406AE2C2)
01470000 01481000 nl_msgc nl_msgc.dll Tue Mar 30 22:47:41 2004 (4069DCED)
02c40000 02dce000 NPSWF32 NPSWF32.dll Mon Dec 08 23:04:44 2003 (3FD4F57C)
10000000 10006000 qfaservices qfaservices.dll Sun Nov 07 21:55:23 2004 (418E8BBB)
20000000 202d5000 xpsp2res xpsp2res.dll Wed Aug 04 10:04:59 2004 (411098AB)
32520000 32532000 msohev msohev.dll Tue Feb 13 02:42:31 2001 (3A889107)
5b190000 5b1c8000 uxtheme uxtheme.dll Wed Aug 04 10:02:59 2004 (41109833)
5f230000 5f247000 OLEPRO32 OLEPRO32.DLL Wed Aug 04 10:03:50 2004 (41109866)
60020000 6002d000 jar50 jar50.dll Sun Nov 07 21:54:34 2004 (418E8B8A)
60070000 600c4000 js3250 js3250.dll Sun Nov 07 21:54:34 2004 (418E8B8A)
60130000 60156000 nspr4 nspr4.dll Sun Nov 07 21:54:35 2004 (418E8B8B)
60160000 601b5000 nss3 nss3.dll Sun Nov 07 21:54:35 2004 (418E8B8B)
601c0000 601f2000 nssckbi nssckbi.dll Sun Nov 07 21:54:35 2004 (418E8B8B)
60200000 60207000 plc4 plc4.dll Sun Nov 07 21:54:35 2004 (418E8B8B)
60210000 60216000 plds4 plds4.dll Sun Nov 07 21:54:35 2004 (418E8B8B)
60230000 6024a000 smime3 smime3.dll Sun Nov 07 21:54:35 2004 (418E8B8B)
60250000 602aa000 softokn3 softokn3.dll Sun Nov 07 21:54:35 2004 (418E8B8B)
602b0000 602cb000 ssl3 ssl3.dll Sun Nov 07 21:54:35 2004 (418E8B8B)
602d0000 60330000 xpcom xpcom.dll Sun Nov 07 21:54:35 2004 (418E8B8B)
60330000 60344000 xpcom_compat xpcom_compat.dll Sun Nov 07 21:54:35 2004 (418E8B8B)
61200000 61259000 hnetcfg hnetcfg.dll Wed Aug 04 10:02:13 2004 (41109805)
67320000 6734f000 asOEHook asOEHook.dll Thu Sep 16 03:53:28 2004 (4148F218)
6d370000 6d37b000 jpins7 jpins7.dll Fri Jun 04 07:05:04 2004 (40C00300)
6d380000 6d396000 jpinsp jpinsp.dll Fri Jun 04 07:05:04 2004 (40C00300)
6d3a0000 6d3b8000 jpishare jpishare.dll Fri Jun 04 07:05:04 2004 (40C00300)
6d470000 6d480000 NPOJI610 NPOJI610.dll Fri Jun 04 07:05:04 2004 (40C00300)
6ff20000 6ff74000 netapi32 netapi32.dll Wed Aug 04 10:02:33 2004 (41109819)
719d0000 71a10000 mswsock mswsock.dll Wed Aug 04 10:05:19 2004 (411098BF)
71a10000 71a18000 wshtcpip wshtcpip.dll Wed Aug 04 10:04:08 2004 (41109878)
71a20000 71a28000 WS2HELP WS2HELP.dll Wed Aug 04 10:03:58 2004 (4110986E)
71a30000 71a47000 WS2_32 WS2_32.dll Wed Aug 04 10:03:57 2004 (4110986D)
71a50000 71a5a000 WSOCK32 WSOCK32.dll Wed Aug 04 10:04:10 2004 (4110987A)
72c80000 72c88000 msacm32 msacm32.drv Thu Sep 06 22:24:23 2001 (3B97DB77)
72c90000 72c99000 wdmaud_72c90000 wdmaud.drv Wed Aug 04 10:03:11 2004 (4110983F)
72f70000 72f96000 WINSPOOL WINSPOOL.DRV Wed Aug 04 10:02:57 2004 (41109831)
74670000 7469a000 msimtf msimtf.dll Wed Aug 04 10:04:32 2004 (41109890)
746a0000 746eb000 MSCTF MSCTF.dll Wed Aug 04 10:03:29 2004 (41109851)
75d40000 75dd1000 mlang mlang.dll Wed Aug 04 10:02:28 2004 (41109814)
76320000 76325000 msimg32 msimg32.dll Wed Aug 04 10:04:30 2004 (4110988E)
76350000 7639a000 comdlg32 comdlg32.dll Wed Aug 04 10:02:27 2004 (41109813)
765a0000 765bd000 CSCDLL CSCDLL.dll Wed Aug 04 10:02:03 2004 (411097FB)
76af0000 76b1e000 WINMM WINMM.dll Wed Aug 04 10:03:27 2004 (4110984F)
76bf0000 76c1e000 WINTRUST WINTRUST.dll Wed Aug 04 10:03:00 2004 (41109834)
76c50000 76c78000 IMAGEHLP IMAGEHLP.dll Wed Aug 04 10:02:24 2004 (41109810)
76ee0000 76f07000 DNSAPI DNSAPI.dll Wed Aug 04 10:02:40 2004 (41109820)
76f20000 76f4d000 WLDAP32 WLDAP32.dll Wed Aug 04 10:03:02 2004 (41109836)
76f70000 76f78000 winrnr winrnr.dll Wed Aug 04 10:02:54 2004 (4110982E)
76f80000 76f86000 rasadhlp rasadhlp.dll Wed Aug 04 10:02:32 2004 (41109818)
76f90000 7700f000 CLBCATQ CLBCATQ.DLL Wed Aug 04 10:02:13 2004 (41109805)
77010000 770dd000 COMRes COMRes.dll Wed Aug 04 10:02:31 2004 (41109817)
770e0000 7716c000 OLEAUT32 OLEAUT32.dll Wed Aug 04 10:03:46 2004 (41109862)
77170000 77217000 WININET WININET.dll Wed Sep 29 20:50:01 2004 (415B03D9)
77390000 77492000 COMCTL32 COMCTL32.dll Wed Aug 04 10:01:49 2004 (411097ED)
774a0000 775dc000 ole32 ole32.dll Wed Aug 04 10:03:45 2004 (41109861)
778e0000 779d7000 SETUPAPI SETUPAPI.dll Wed Aug 04 10:02:40 2004 (41109820)
779e0000 77a36000 cscui cscui.dll Wed Aug 04 10:02:04 2004 (411097FC)
77a40000 77ad5000 CRYPT32 CRYPT32.dll Wed Aug 04 10:01:57 2004 (411097F5)
77ae0000 77af2000 MSASN1 MSASN1.dll Wed Aug 04 10:03:22 2004 (4110984A)
77b00000 77b22000 appHelp appHelp.dll Wed Aug 04 10:02:30 2004 (41109816)
77ba0000 77ba7000 midimap midimap.dll Wed Aug 04 10:02:24 2004 (41109810)
77bb0000 77bc5000 MSACM32_77bb0000 MSACM32.dll Wed Aug 04 10:03:02 2004 (41109836)
77bd0000 77bd8000 VERSION VERSION.dll Wed Aug 04 10:02:56 2004 (41109830)
77be0000 77c38000 msvcrt msvcrt.dll Wed Aug 04 10:05:13 2004 (411098B9)
77d10000 77da0000 USER32 USER32.dll Wed Aug 04 10:02:56 2004 (41109830)
77da0000 77e31000 RPCRT4 RPCRT4.dll Wed Aug 04 10:02:38 2004 (4110981E)
77e40000 77e86000 GDI32 GDI32.dll Wed Aug 04 10:02:04 2004 (411097FC)
77e90000 77f06000 SHLWAPI SHLWAPI.dll Wed Aug 04 10:02:52 2004 (4110982C)
77f40000 77feb000 ADVAPI32 ADVAPI32.dll Wed Aug 04 10:02:17 2004 (41109809)
7c340000 7c396000 MSVCR71 MSVCR71.dll Fri Feb 21 13:42:20 2003 (3E561EAC)
7c800000 7c8fe000 kernel32 kernel32.dll Wed Aug 04 10:02:59 2004 (41109833)
7c900000 7c9b6000 ntdll ntdll.dll Wed Aug 04 10:02:59 2004 (41109833)
7c9c0000 7d1df000 SHELL32 SHELL32.dll Wed Aug 04 10:02:47 2004 (41109827)
804d7000 806ec880 nt ntoskrnl.exe Wed Aug 04 08:19:48 2004 (41108004)
806ed000 80700d80 hal halacpi.dll Wed Aug 04 07:59:04 2004 (41107B28)
bf800000 bf9c0400 win32k win32k.sys Wed Aug 04 08:17:30 2004 (41107F7A)
bf9c1000 bf9d2580 dxg dxg.sys Wed Aug 04 08:00:51 2004 (41107B93)
bf9d3000 bfddd980 nv4_disp nv4_disp.dll Thu Sep 25 05:13:16 2003 (3F725D4C)
f0652000 f067bf00 kmixer kmixer.sys Wed Aug 04 08:07:46 2004 (41107D32)
f2c47000 f2c87380 HTTP HTTP.sys Wed Aug 04 08:00:09 2004 (41107B69)
f2e40000 f2e50760 NAVENG NAVENG.Sys Fri Oct 01 03:59:17 2004 (415CB9F5)
f2e51000 f2ee9680 NavEx15 NavEx15.Sys Fri Oct 01 04:11:15 2004 (415CBCC3)
f2eea000 f2f41000 SAVRT SAVRT.SYS Sat Jul 24 04:26:42 2004 (4101C8E2)
f31e9000 f321a940 btslbcsp btslbcsp.sys Mon Sep 15 23:58:32 2003 (3F663608)
f321b000 f3247400 mrxdav mrxdav.sys Wed Aug 04 08:00:49 2004 (41107B91)
f3455000 f3469400 wdmaud wdmaud.sys Wed Aug 04 08:15:03 2004 (41107EE7)
f3522000 f352e1c0 btwusb btwusb.sys Mon Sep 15 23:44:04 2003 (3F6632A4)
f35c2000 f35d0d80 sysaudio sysaudio.sys Wed Aug 04 08:15:54 2004 (41107F1A)
f35e6000 f35e8b80 secdrv secdrv.sys Thu Nov 14 12:52:30 2002 (3DD38E7E)
f3622000 f3645000 Fastfat Fastfat.SYS Wed Aug 04 08:14:15 2004 (41107EB7)

 

This last one is some awful form of stack corruption. We are going to pretend it didnt happen, since its very difficult to crack those out (especially over the internet).
Get us one more dump (you can strip off everything below start end module name, so we dont get all that driver info list)

 

It took a while, but here is the next , that it took this long is because I haven't been home much lately btw.

Opened log file 'c:\debuglog.txt'
Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols

Microsoft (R) Windows Debugger Version 6.3.0017.0
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\WINDOWS\MEMORY.DMP]
Kernel Complete Dump File: Full address space is available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: C:\WINDOWS;C:\WINDOWS\system32;C:\WINDOWS\system32\drivers
*** ERROR: Symbol file could not be found. Defaulted to export symbols for ntoskrnl.exe -
Windows XP Kernel Version 2600 (Service Pack 2) UP Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 2600.xpsp_sp2_rtm.040803-2158
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055ab20
Debug session time: Thu Dec 30 12:13:37 2004
System Uptime: 0 days 0:09:51.430
*** ERROR: Symbol file could not be found. Defaulted to export symbols for ntoskrnl.exe -
Loading Kernel Symbols
..................................................................................................................................................................................................
Loading unloaded module list
............
Loading User Symbols
..........................................................................................
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 50, {c8e27773, 0, bf845801, 0}

***** Kernel symbols are WRONG. Please fix symbols to do analysis.

*** ERROR: Symbol file could not be found. Defaulted to export symbols for -
Probably caused by : win32k.sys ( win32k!DestroyThreadsTimers+13 )

Followup: MachineOwner
---------

kd> !analyze -v;r;kv;lmtn;.logclose;q
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced. This cannot be protected by try-except,
it must be protected by a Probe. Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: c8e27773, memory referenced.
Arg2: 00000000, value 0 = read operation, 1 = write operation.
Arg3: bf845801, If non-zero, the instruction address which referenced the bad memory
address.
Arg4: 00000000, (reserved)

Debugging Details:
------------------

***** Kernel symbols are WRONG. Please fix symbols to do analysis.


READ_ADDRESS: unable to get nt!MmPoolCodeEnd
unable to get nt!MmSpecialPoolEnd
unable to get nt!MmPagedPoolEnd
unable to get nt!MmNonPagedPoolEnd
unable to get nt!MmNonPagedPoolStart
unable to get nt!MmSpecialPoolStart
unable to get nt!MmPagedPoolStart
unable to get nt!MiSessionPoolStart
unable to get nt!MiSessionPoolEnd
unable to get nt!MmNonPagedPoolExpansionStart
unable to get nt!MmPoolCodeStart
c8e27773

FAULTING_IP:
win32k!DestroyThreadsTimers+13
bf845801 397810 cmp [eax+0x10],edi

MM_INTERNAL_CODE: 0

DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: 0x50

LAST_CONTROL_TRANSFER: from 805246fb to 805339ae

STACK_TEXT:
WARNING: Stack unwind information not available. Following frames may be wrong.
f1af56f4 805246fb 00000050 c8e27773 00000000 nt!KeBugCheckEx+0x1b
f1af5740 804e1ff1 00000000 c8e27773 00000000 nt!PoSetSystemState+0xc140
f1af5758 bf845801 badb0d00 86840006 00000000 nt!Kei386EoiHelper+0x26f6
f1af57d4 bf846038 e324e008 84d66da8 00000000 win32k!DestroyThreadsTimers+0x13
f1af57fc bf80ef6e 00000001 f1af5824 bf80f032 win32k!xxxDestroyThreadInfo+0x1a4
f1af5808 bf80f032 84d66da8 00000001 00000000 win32k!UserThreadCallout+0x4b
f1af5824 8056a932 84d66da8 00000001 867d78f8 win32k!W32pThreadCallout+0x3d
f1af58d0 8058b342 c0000005 f1af592c 804e6851 nt!ObCloseHandle+0x30
f1af58dc 804e6851 867d78f8 f1af5928 f1af591c nt!ExRundownCompleted+0x3b8
f1af592c 804df0d4 00000001 00000000 f1af5944 nt!KeInitializeDpc+0x85b
f1af5944 7c90eacf badb0d00 f1af5d64 84f0f9f8 nt!ZwYieldExecution+0xbff
026aff78 76af4e3d 026aff98 00000000 00000000 ntdll!KiUserApcDispatcher+0xf
026affb4 7c80b50b 00000720 00000200 0000002b WINMM!mciwindow+0x80
026affec 00000000 76af4dd6 00000720 00000000 kernel32!GetModuleFileNameA+0x1b4


FOLLOWUP_IP:
win32k!DestroyThreadsTimers+13
bf845801 397810 cmp [eax+0x10],edi

SYMBOL_STACK_INDEX: 3

FOLLOWUP_NAME: MachineOwner

SYMBOL_NAME: win32k!DestroyThreadsTimers+13

MODULE_NAME: win32k

IMAGE_NAME: win32k.sys

DEBUG_FLR_IMAGE_TIMESTAMP: 41107f7a

STACK_COMMAND: kb

BUCKET_ID: WRONG_SYMBOLS

Followup: MachineOwner
---------


Is this something completely different again?
I am still running the video drivers from the CD btw.

 

Your symbol is wrong for NTOSKRNL(and have been all along). We cant tell whats going on in this last one since its inside that module.

What is the date and version for your NTOSKRNL.EXE?

 

version is 5.1.2600.2180
and date is 10 december 2002.

Should I get an newer version?

 

804d7000 806ec880 nt ntoskrnl.exe Wed Aug 04 08:19:48 2004 (41108004)

where did you get that timestamp and version..

 

I don't understand your question, I can see that in the debug log, but before this I had never heard of ntoskrnl.exe. So what do you mean where I got that? I guess it came with windows right?

 

New year, new crash

Opened log file 'c:\debuglog.txt'
Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols

Microsoft (R) Windows Debugger Version 6.3.0017.0
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\WINDOWS\MEMORY.DMP]
Kernel Complete Dump File: Full address space is available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: C:\WINDOWS;C:\WINDOWS\system32;C:\WINDOWS\system32\drivers
*** ERROR: Symbol file could not be found. Defaulted to export symbols for ntoskrnl.exe -
Windows XP Kernel Version 2600 (Service Pack 2) UP Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 2600.xpsp_sp2_rtm.040803-2158
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055ab20
Debug session time: Sun Jan 02 20:14:20 2005
System Uptime: 0 days 0:02:12.170
*** ERROR: Symbol file could not be found. Defaulted to export symbols for ntoskrnl.exe -
Loading Kernel Symbols
...................................................................................................................................................................................................
Loading unloaded module list
..........
Loading User Symbols
.............
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 8E, {c0000005, bf8010fd, f54b3a48, 0}

***** Kernel symbols are WRONG. Please fix symbols to do analysis.

Probably caused by : win32k.sys ( win32k!TimersProc+45 )

Followup: MachineOwner
---------

kd> !analyze -v;r;kv;lmtn;.logclose;q
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

KERNEL_MODE_EXCEPTION_NOT_HANDLED (8e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003. This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG. This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG. This will let us see why this breakpoint is
happening.
An exception code of 0x80000002 (STATUS_DATATYPE_MISALIGNMENT) indicates
that an unaligned data reference was encountered. The trap frame will
supply additional information.
Arguments:
Arg1: c0000005, The exception code that was not handled
Arg2: bf8010fd, The address that the exception occurred at
Arg3: f54b3a48, Trap Frame
Arg4: 00000000

Debugging Details:
------------------

***** Kernel symbols are WRONG. Please fix symbols to do analysis.


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - De instructie op 0x%08lx verwijst naar geheugen op 0x%08lx. De lees- of schrijfbewerking ( "%s ") op het geheugen is mislukt.

FAULTING_IP:
win32k!TimersProc+45
bf8010fd 8b4624 mov eax,[esi+0x24]

TRAP_FRAME: f54b3a48 -- (.trap fffffffff54b3a48)
.trap fffffffff54b3a48
ErrCode = 00000000
eax=9000004b ebx=000000be ecx=9000004b edx=00000204 esi=18e21678 edi=0000003d
eip=bf8010fd esp=f54b3abc ebp=f54b3ad4 iopl=0 nv up ei pl nz na po nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010206
win32k!TimersProc+0x45:
bf8010fd 8b4624 mov eax,[esi+0x24] ds:0023:18e2169c=????????
.trap
Resetting default scope

DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: 0x8E

LAST_CONTROL_TRANSFER: from bf8aec95 to bf8010fd

STACK_TEXT:
f54b3ad4 bf8aec95 00000022 006dfff4 bf800fd1 win32k!TimersProc+0x45
f54b3d30 bf8c8594 f54c34a8 00000002 f54b3d54 win32k!RawInputThread+0x634
f54b3d40 bf800ff4 f54c34a8 f54b3d64 006dfff4 win32k!xxxCreateSystemThreads+0x60
f54b3d54 804df06b 00000000 00000022 00000000 win32k!NtUserCallOneParam+0x23
WARNING: Stack unwind information not available. Following frames may be wrong.
f54b3d64 7c90eb93 badb0d00 006dffec fff0bdc0 nt!ZwYieldExecution+0xb96
00000000 f000ef6f f000e2c3 f000ef6f f000ef6f ntdll!KiFastSystemCallRet+0x4
30000000 00000000 00000000 00000000 00000000 0xf000ef6f


FOLLOWUP_IP:
win32k!TimersProc+45
bf8010fd 8b4624 mov eax,[esi+0x24]

SYMBOL_STACK_INDEX: 0

FOLLOWUP_NAME: MachineOwner

SYMBOL_NAME: win32k!TimersProc+45

MODULE_NAME: win32k

IMAGE_NAME: win32k.sys

DEBUG_FLR_IMAGE_TIMESTAMP: 41107f7a

STACK_COMMAND: .trap fffffffff54b3a48 ; kb

BUCKET_ID: WRONG_SYMBOLS

Followup: MachineOwner
---------

eax=ffdff13c ebx=bf8010fd ecx=00000000 edx=804dba16 esi=f54b39f4 edi=00000000
eip=805339ae esp=f54b35f8 ebp=f54b3610 iopl=0 nv up ei ng nz na po nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00000286
nt!KeBugCheckEx+0x1b:
805339ae 5d pop ebp
ChildEBP RetAddr Args to Child
WARNING: Stack unwind information not available. Following frames may be wrong.
f54b3610 8051dea6 0000008e c0000005 bf8010fd nt!KeBugCheckEx+0x1b
f54b39d8 804dfada f54b39f4 00000000 f54b3a48 nt!PoSetSystemState+0x58eb
f54b3a48 bf8010fd badb0d00 00000204 ffffffff nt!Kei386EoiHelper+0x1df
f54b3ad4 bf8aec95 00000022 006dfff4 bf800fd1 win32k!TimersProc+0x45 (FPO: [Non-Fpo])
f54b3d30 bf8c8594 f54c34a8 00000002 f54b3d54 win32k!RawInputThread+0x634 (FPO: [Non-Fpo])
f54b3d40 bf800ff4 f54c34a8 f54b3d64 006dfff4 win32k!xxxCreateSystemThreads+0x60 (FPO: [Non-Fpo])
f54b3d54 804df06b 00000000 00000022 00000000 win32k!NtUserCallOneParam+0x23 (FPO: [Non-Fpo])
f54b3d64 7c90eb93 badb0d00 006dffec fff0bdc0 nt!ZwYieldExecution+0xb96
00000000 f000ef6f f000e2c3 f000ef6f f000ef6f ntdll!KiFastSystemCallRet+0x4
30000000 00000000 00000000 00000000 00000000 0xf000ef6f
start end module name
4a680000 4a685000 csrss csrss.exe Wed Aug 04 08:03:11 2004 (41107C1F)

And I still need an answer to my last question, didnt know what you meant. Oh, and happy new year to all of you

 

My question was to ask which file and its location for where you obtained the version and timestamp you posted. Since it didnt match the debugger, i think you got the information from the wrong file.

I am not sure why your symbols are not lining up. The debugger should go out to the internet and get the correct ones. You must have some firewall or NAT device that is interfering with it.

You can try downloading the flat http://www.microsoft.com/whdc/devtools/debugging/symbolpkg.mspx and pointing the debugger to these

in the tool, after you select a dump, point it to the extracted symbols by changing the 'advanced' line

from: -y SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
to: -y SRV*c:\symbols*http://msdl.microsoft.com/download/symbols;C:\extracted\symbols

 

I just did a search on ntoskrnl.exe and found the file in C:\WINDOWS\system32, so I looked up the properties of that file and it said:
Made: tuesday 10 december 2002, 18:11:12
Changed: wednesday 4 august 2004, 8:58:29
and the version number is: 5.1.2600.2180

I obviously looked at the wrong date, should have been the changed date.

I'm downloading the symbols at the moment, will take a while (45 mins) Ill make a new log then. Could be my firewall, although it sounds that Norton would block such updates.