help with stop error [KMODE_EXCEPTION_NOT _HANDLED]

here is my crash dump. I can't seem to get the symbols to work. I have posted this every place that I can think of, with no luck. I am getting a stop error message related to this:

STOP: 0x0000001E

KMODE_EXCEPTION_NOT _HANDLED

Address A011B159 base at A0000000, Date Stamp 3eb1ea3c - win32k.sys

 

We can't help you without symbols. Are you connected to the internet when you run this tool? Are you running it on the machine the crash occured on? If you have a firewall, like BlackIce, or other paranoia filter, you must allow cdb.exe access to winsock, so it can retrive the symbols from the internet.

I can look at this dump and tell that its pool corruption from a bad driver though, based on the below stack.

Code:

STACK_TEXT: 
f4c90490 80464a61 f4c904ac 00000000 f4c90500 nt!KeTerminateThread+0xd8c
f4c90608 a000a696 000003c4 f4c90638 00000000 nt!Kei386EoiHelper+0x455
f4c90618 80415718 00000004 a0001ca2 a0001ceb [U][B]win32k+0xa696[/B][/U]
f4c90638 a0109377 00000000 00000000 00000106[U][B] nt!ExAllocateFromPagedLookasideList+0x1a[/B][/U]
f4c9065c a00e2fcb 000003c5 0000aacc 00030000 win32k!EngReleaseSemaphore+0x19618
f4c9067c a000c61f 00000001 f87374c8 00000000 win32k!XLATEOBJ_iXlate+0x7559
f4c906d8 80463f64 4c010a83 00000111 00000092 win32k+0xc61f
f4c906d8 77f71245 4c010a83 00000111 00000092 nt!KiReleaseSpinLock+0xae4
WARNING: Frame IP not in any known module. Following frames may be wrong.
0ad8bd10 00000000 00000000 00000000 00000000 0x77f71245

The bad news is that pool corruption is a big pain in the butt to troubleshoot. Youll need to enable special pool, which will make your machine crash a lot, but will get a C4 or similar crash that shows which driver is doing it.

See this post for my thoughts on special pool.
http://www.windowsbbs.com/showpost.php?p=214246&postcount=2

PLEASE NOTE THIS WILL MAKE IT CRASH MORE, NOT LESS. If you are not comfortable with disaster recovery, or don't have a backup, do NOT proceed.

 

I am on the machine that it is happening on. I don't have a firewall, never did actually. I am also doing it while I am on the internet. I do have AVG7, could this be blocking it possible? I really don't know, lol. Because I've done everything you mentioned above. I don't know of any other filter running. Do you know of any other programs that might be causing the symbols not work? I mean the only thing I can honestly think of is either AVG7 or Reget Deluxe possible. *sigh* How can I do a backup to proceed using the other option?

 

here is a C4 error I got. I enabled special pool and pool tracking using verifier.exe. Maybe you can find the problem here.

 

red herring dump.

someone left a couple of crumbs on the table. This is why its best to use the special pool registry key instead of driver verifier. Too many meanless crashes. This tool was designed for use by driver developers, not people troubleshooting.

 

ok i'll try it that way.

this part is confussing me because it won't let me add this. I already have a PoolTag value in the part of the registry it is mentioning. When I tried to make another one with this information it wouldn't let me. Can someone tell me how to go about adding the info in the registry? I know how to edit in the registry I've done it before, but this one is confussing, just a bit. I need to know exactally what to put in

 

If you already have PoolTag but with different values, just change it to match what Ben posted.

 

what he posted? the ARG number?

 

go into verifier, and undo all you have done.

Then add these two keys per

How to Use the Special Pool Feature to Isolate Pool Damage

 

okay got that done. now what do i do after that, lol?

 

okay I got an stop error 0x000000D5 relating to the driver ATWPKTS.sys.

It said this driver is attempting to access memory after it has been freed.

 

excellent

no hits in google or msn on that. Whatever it is, it needs to go. You can remove it, disable it, or update it.
to figure out what it is, look in \windows\system32\drivers for it. right click->properties.

Now, you can unwind special pool, and see if that makes your box stable, or you can keep running to see what else is exposed.

 

I know I did a search for it all over as well. I couldn't get anything. I'll check on it and let you know what it was.

I did a search for it where you mentioned and the file didn't come up in the folder. This is really strange.

 

okay I booted up with my windows cd and did a seach for ATWPKTS.SYS. I got ATWPKT2 to come up which turned out be a windows services. I hate those things, now I know why . I disabled it and so far so good. Apparently the driver was from this service. I think the service might have been Routing and Remote Access, but I'm not sure. That is the only thing disabled besides my messenger service. I'm hoping this was issue.

 

I did a clean install of my OS, maybe I can pinpoint the bad drivers this way. I have not installed the updates or updated some of the drivers yet. Let me know if you Guys would like me to do this. The special pool is enbaled at this time. Also sorry about posting the other seperate topic.

here is a stop error I am getting so far:

STOP 0x00000050
PAGEFAULT_IN_NONPAGED_AREA

here is the log:

 

You are frustratrating me in a couple ways

a) i dont know whats wrong with your ISP configuration, and i've pinged some friends with AOL, and they dont have this problem with the symbols not working, and none of the local experts around here have any idea either. I literally cannot interpret the dump spew without good symbols, so thats a show stopper problem i dont know how to fix.

b) after all that work getting special pool working, we find a driver thats malfunctioning, and you reinstalled rather than removing the file and continuing down the troubleshooting path. By so drastically altering the software environment, we are now back at square one in the troubleshooting effort, and have to repeat the whole thing with enabling special pool/PoolTag, collecting and analyzing new dumps in order to move forward.

What do you want to do now?

 

well right now everything is basically back in order except for updates and some programs that need to be installed. 99% of all drivers that need to be installed ARE installed. I have not drastically done anything really. The Special Pool etc IS enabled as of right now. I have basic knowledge of how some of this stuff works, I didn't think doing a clean install would really make a difference. And I have no idea why the symbols are not working, I have no knowledge in that area. Also the driver that came up, that was malfunctioning, has been disabled. I haven't removed it, considering it was part of the windows services, I didn't think it would be safe. I am litterally getting the same stop errors I was getting before and I have less installed then I did before. So by adding more stuff, I would think it would make it more difficult to pinpoint the problem. If I am having the problem now, it has be something that is on here without window updates, updated drivers, etc. I apologize for making things sorta messy

EDIT: Don't know if this is any help, but I ran 2 memory test's with 2 different memory programs and got no errors. I ran them though 1x though. After doing this and rebooting I got stop 0x000000c2 error, Bad Pool Caller. probably no help though.

 

Your machine is an ecosystem, full of software that all interact with each other in a surprisingly organic way. By reinstalling your machine, you've basically moved to a different place, and expected things to be the same, which they may, or may not be. Not to mention that I have this vague sense of 'state' for your machine, from analysis on the earlier dumps which is now all invalid. Remote support like newsgroups, forums and phone support is like talking someone through solving a rubiks cube without being able to see it.

not to be overly harsh, but to be extremely clear: I know what im doing. I troubleshoot this kind of problem for a living all day long. You don't have to listen to my advice, but if you choose a different course of action, you are on your own.

For instance: Also the driver that came up, that was malfunctioning, has been disabled.
From your last dump: f527d000 f5280000 ATWPKT2.SYS I note this driver caught corrupting pool is still loaded into memory on your machine and is still up to no good, and we have made no forward progress.

After you posted the correct file name, i reinvestigated your problem. Thats not a Microsoft file, its the AOL packet driver. I researched this on the web and found lots of problems. They all just rename the file, and the problem goes away. This remains my recommendation to you.

If you need assistance in doing that, I am glad to help you pursue that course of action.