Weird Windows XP BLUE SCREENs

Hey Everyone,

I am running out of ideas here, okay this is the situation. I have built two IDENTICAL computers (IDENTICAL

HARDWARE). Here is the spec :

-Amd Athlon64 3200+
-Asus A8V motherboard (Socket 939 VIA chipset)
-OCZ 1GB (2x512) DDR 400 RAM
-Seagate 80GB SATA hard drive
-Apacer 15-in-1 card reader
-Pioneer DVR-110 DVD Writer
-Antec computer case and power supply
-ATI RAdeon 9600 with 256MB RAM

Both of these computers have been giving me random blue screens, I am sending a link to the minidumps in

windows. I have analyzed them both both cannot come to a conclusion. Here is what I've tried :

-Changed power supply
-Changed video card
-Changed RAM
-BIOS updated
-Freshly installed XP too many times (Installation of Windows works just fine)

Problem still continues, only thing that has not changed on both computers is motherboard or CPU. Can anyone

else help? I really am out of ideas. Anyone really good at analyzing the minidumps? I've done my best and most

of the time the minidumps direct to .sys files but no way of knowing what's going on here.

Path to the minidump zip file, if you want analyze them and see if you can help ??

http://www.pinksolution.ca/webstat/data/minidumps.zip

 

bbasir, seems to be a driver problem somewhere. I don't think that its a hardware problem as you have 2 identical systems and on both you are facing the same problem.

Does it says about any file in the blue screen? What if you uninstall the drivers for Radeon card and go back to generic drivers or upgrade the drivers to the latest one? Try it only one machine and see what happens.

 

More Info

Okay just wanted to post an update, I will list some onfo from the minidumps for you guys that don't have much time to examine the minidumps.

Blue screen faults:

******************
****Computer 1****
******************

*****************************************************************
1. NTFS_FILE_SYSTEM (24)
Arguments:
Arg1: 001902fe
Arg2: a7384618
Arg3: a7384314
Arg4: f7691fe4

Debugging Details:
------------------


EXCEPTION_RECORD: a7384618 -- (.exr ffffffffa7384618)
ExceptionAddress: f7691fe4 (Ntfs!NtfsCommonCreate+0x0000147b)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 00000000
Parameter[1]: 18a73870
Attempt to read from address 18a73870

CONTEXT: a7384314 -- (.cxr ffffffffa7384314)
eax=00000000 ebx=a7384970 ecx=f7692909 edx=a7384401 esi=18a73848 edi=00780068
eip=f7691fe4 esp=a73846e0 ebp=a738481c iopl=0 nv up ei ng nz ac pe cy
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010293
Ntfs!NtfsCommonCreate+0x147b:
f7691fe4 8b4628 mov eax,[esi+0x28] ds:0023:18a73870=????????
Resetting default scope

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: DRIVER_FAULT

ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx ". The memory

could not be "%s ".

READ_ADDRESS: 18a73870

BUGCHECK_STR: 0x24

LAST_CONTROL_TRANSFER: from f7692ec2 to f7691fe4

STACK_TEXT:
a738481c f7692ec2 a7384840 85117918 a7384970 Ntfs!NtfsCommonCreate+0x147b
a73849c8 f7719f70 85117918 a7384c00 865a4020 Ntfs!NtfsNetworkOpenCreate+0x8a
a73849e8 a99bcdb1 85117918 a7384c00 865a6bc8 sr!SrFastIoQueryOpen+0x40
WARNING: Stack unwind information not available. Following frames may be wrong.
a7384a08 8057168e 85117918 a7384c00 8642b228 SYMEVENT+0x4db1
a7384af4 805632ec 8677de30 00000000 8638f728 nt!IopParseDevice+0x95c
a7384b7c 8056741a 00000000 a7384bbc 00000040 nt!ObpLookupObjectName+0x56a
a7384bd0 80571834 00000000 00000000 a7384c01 nt!ObOpenObjectByName+0xeb
a7384d54 804de7ec 0012f288 0012f260 0012f2b4 nt!NtQueryAttributesFile+0xf1
a7384d54 7c90eb94 0012f288 0012f260 0012f2b4 nt!KiFastCallEntry+0xf8
0012f2b4 00000000 00000000 00000000 00000000 0x7c90eb94


FOLLOWUP_IP:
Ntfs!NtfsCommonCreate+147b
f7691fe4 8b4628 mov eax,[esi+0x28]

SYMBOL_STACK_INDEX: 0

FOLLOWUP_NAME: MachineOwner

SYMBOL_NAME: Ntfs!NtfsCommonCreate+147b

MODULE_NAME: Ntfs

IMAGE_NAME: Ntfs.sys

DEBUG_FLR_IMAGE_TIMESTAMP: 42797de8

STACK_COMMAND: .cxr ffffffffa7384314 ; kb

FAILURE_BUCKET_ID: 0x24_Ntfs!NtfsCommonCreate+147b

BUCKET_ID: 0x24_Ntfs!NtfsCommonCreate+147b
*****************************************************************


*****************************************************************
2.IRQL_NOT_LESS_OR_EQUAL (a)
Arguments:
Arg1: 0000000c, memory referenced
Arg2: 000000ff, IRQL
Arg3: 00000000, value 0 = read operation, 1 = write operation
Arg4: 80531bc7, address which referenced memory

Debugging Details:
------------------


READ_ADDRESS: 0000000c

CURRENT_IRQL: ff

FAULTING_IP:
nt!ExAcquireResourceSharedLite+65
80531bc7 66395e0c cmp [esi+0xc],bx

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: 0xA

LAST_CONTROL_TRANSFER: from 805eb492 to 80531bc7

STACK_TEXT:
f5dd4448 805eb492 00000000 00000001 f5dd46b8 nt!ExAcquireResourceSharedLite+0x65
f5dd445c 805b4723 f5dd46d4 867c6040 8621f218 nt!SeLockSubjectContext+0x22
f5dd4484 805b12d3 8621f230 f5dd46b8 00000001 nt!ObCheckObjectAccess+0x51
f5dd4534 805b1991 00000001 867c69c8 8621f230 nt!ObpIncrementHandleCount+0x1f7
f5dd459c 805b0038 00000001 8621f230 867c6040 nt!ObpCreateHandle+0x17d
f5dd466c 805bff39 8621f230 00000200 f5dd46b8 nt!ObOpenObjectByPointer+0xa4
f5dd4770 8053c958 f5dd4848 00000400 f5dd4810 nt!NtOpenProcess+0x229
f5dd4770 804fdd39 f5dd4848 00000400 f5dd4810 nt!KiFastCallEntry+0xf8
f5dd47f8 eb28fb8e f5dd4848 00000400 f5dd4810 nt!ZwOpenProcess+0x11
WARNING: Stack unwind information not available. Following frames may be wrong.
f5dd4830 eb25a954 000002e0 f5dd4848 00000000 SPBBCDrv+0x48b8e
f5dd484c eb25ac9c 00000000 f5dd4864 e2126230 SPBBCDrv+0x13954
f5dd4868 eb25789c 00000000 e2126230 f5dd4c6c SPBBCDrv+0x13c9c
f5dd4964 805da392 00000000 e4463434 00000004 SPBBCDrv+0x1089c
f5dd49a4 8054447e 80559480 80559490 000d1d68 nt!RtlpInheritAcl+0x68
f5dd4a44 80602ad0 e1195358 0000039c f5dd4b24 nt!ExAllocatePoolWithTag+0x27e
f5dd4a78 e1195358 e12a8738 f5dd4b24 000002b4 nt!ExpAllocateHandleTableEntry+0x11e
f5dd4a8c 805c482f 805594b8 80559480 00000000 0xe1195358
f5dd4ac0 805b54b1 00000001 00000006 f5dd4af4 nt!PsReturnSharedPoolQuota+0x1d9
f5dd4af4 805af6db e6332a48 00000000 00000000 nt!ObpFreeObject+0x12f
f5dd4b0c 80521f73 e6332a60 00000000 e6332a60 nt!ObpRemoveObjectRoutine+0xe7
f5dd4b30 805c40cb 00000000 862adabc 00000000 nt!ObfDereferenceObject+0x5f
f5dd4b44 f5dd4ba0 805c437f 00000002 00000000 nt!PsRevertThreadToSelf+0xb1
f5dd4b4c 00000000 00000000 00000004 00000000 0xf5dd4ba0


FOLLOWUP_IP:
SPBBCDrv+48b8e
eb28fb8e ?? ???

SYMBOL_STACK_INDEX: 9

FOLLOWUP_NAME: MachineOwner

SYMBOL_NAME: SPBBCDrv+48b8e

MODULE_NAME: SPBBCDrv

IMAGE_NAME: SPBBCDrv.sys

DEBUG_FLR_IMAGE_TIMESTAMP: 4329f3e4

STACK_COMMAND: kb

FAILURE_BUCKET_ID: 0xA_SPBBCDrv+48b8e

BUCKET_ID: 0xA_SPBBCDrv+48b8e

Followup: MachineOwner
*****************************************************************


*****************************************************************
3.Pretty much the same as #1 NTFS.SYS
*****************************************************************


*****************************************************************
4.PAGE_FAULT_IN_NONPAGED_AREA (50)
Arguments:
Arg1: c4849d38, memory referenced.
Arg2: 00000000, value 0 = read operation, 1 = write operation.
Arg3: f73d226a, If non-zero, the instruction address which referenced the bad memory
address.
Arg4: 00000000, (reserved)

Debugging Details:
------------------


Could not read faulting driver name

READ_ADDRESS: c4849d38

FAULTING_IP:
KSecDD!KSecReferenceListEntry+18
f73d226a 8b4610 mov eax,[esi+0x10]

MM_INTERNAL_CODE: 0

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: 0x50

LAST_CONTROL_TRANSFER: from f73d1635 to f73d226a

STACK_TEXT:
b7368c88 f73d1635 c4849d28 4d4c544e 00000001 KSecDD!KSecReferenceListEntry+0x18
b7368cac f73cfc24 c4849d28 b7368ce0 b7368ce4 KSecDD!NtLmDeleteKernelContext+0x1e
b7368cc4 f73cf411 e3883f78 b7368cdc e3883f78 KSecDD!DeleteUserModeContext+0x4c
b7368ce4 f73cf461 00000001 e3883f78 b7368d08 KSecDD!DeleteSecurityContextInternal+0x25
b7368cf4 b9829dfc e3883f78 e3883ef8 867c69c8 KSecDD!DeleteSecurityContext+0xf
b7368d08 b9829d08 e3883ef8 85e4e6b0 e3883ef8 srv!SrvFreeSecurityContexts+0x3a
b7368d34 b9829b7a e3883ef8 85e4e6b0 e3ee0c88 srv!SrvFreeSession+0x37
b7368d4c b9829c21 00000000 85d89368 85d89360 srv!SrvDereferenceSession+0x37
b7368d68 b98129c7 85d89368 85d89360 85f27dd8 srv!SrvDereferenceTreeConnect+0x77
b7368d7c b98127c6 85d89360 85f27da0 b9822a98 srv!SrvReleaseContext+0x38
b7368d88 b9822a98 00000000 85c6bda8 00000000 srv!SrvDereferenceWorkItem+0x3b
b7368dac 805c4bc0 85d89360 00000000 00000000 srv!WorkerThread+0x11e
b7368ddc 805410f2 b98229e4 85f27da0 00000000 nt!PspSystemThreadStartup+0x34
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16


FOLLOWUP_IP:
KSecDD!KSecReferenceListEntry+18
f73d226a 8b4610 mov eax,[esi+0x10]

SYMBOL_STACK_INDEX: 0

FOLLOWUP_NAME: MachineOwner

SYMBOL_NAME: KSecDD!KSecReferenceListEntry+18

MODULE_NAME: KSecDD

IMAGE_NAME: KSecDD.sys

DEBUG_FLR_IMAGE_TIMESTAMP: 41107b51

STACK_COMMAND: kb

FAILURE_BUCKET_ID: 0x50_KSecDD!KSecReferenceListEntry+18

BUCKET_ID: 0x50_KSecDD!KSecReferenceListEntry+18

Followup: MachineOwner
*****************************************************************


*****************************************************************
5.KERNEL_MODE_EXCEPTION_NOT_HANDLED_M (1000008e)
Arguments:
Arg1: c0000005, The exception code that was not handled
Arg2: 00ef480d, The address that the exception occurred at
Arg3: aa34d819, Trap Frame
Arg4: 00000000

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx ". The memory

could not be "%s ".

FAULTING_IP:
+ef480d
00ef480d f3f3ff84c074208b45 rep rep inc dword ptr [eax+eax*8+0x458b2074]

TRAP_FRAME: aa34d819 -- (.trap ffffffffaa34d819)
ErrCode = 00000002
eax=00000000 ebx=85b3f25c ecx=f7360be3 edx=00000000 esi=7985b3f2 edi=859e5468
eip=00ef480d esp=aa34d88d ebp=86748bc8 iopl=0 nv up ei ng nz na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010282
00ef480d f3f3ff84c074208b45 rep rep inc dword ptr [eax+eax*8+0x458b2074] ds:0023:458b2074=????????
Resetting default scope

CUSTOMER_CRASH_COUNT: 2

DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: 0x8E

LAST_CONTROL_TRANSFER: from 00000000 to 00ef480d

UNALIGNED_STACK_POINTER: aa34d88d

SYMBOL_ON_RAW_STACK: 1

STACK_TEXT:
86748bc8 00000000 867ca878 867c99b8 861d9ae8 0xef480d


STACK_COMMAND: .trap ffffffffaa34d819; dds @$csp ; kb

FOLLOWUP_IP:
SAVRT+4609f
ef48409f ?? ???

FOLLOWUP_NAME: MachineOwner

SYMBOL_NAME: SAVRT+4609f

MODULE_NAME: SAVRT

IMAGE_NAME: SAVRT.SYS

DEBUG_FLR_IMAGE_TIMESTAMP: 430f857b

FAILURE_BUCKET_ID: 0x8E_SAVRT+4609f

BUCKET_ID: 0x8E_SAVRT+4609f

Followup: MachineOwner
*****************************************************************


*******************
****Computer 2****
*******************


+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
1.DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
Arguments:
Arg1: 00000004, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000001, value 0 = read operation, 1 = write operation
Arg4: f70b8a16, address which referenced memory

Debugging Details:
------------------


WRITE_ADDRESS: 00000004

CURRENT_IRQL: 2

FAULTING_IP:
USBPORT!USBPORT_QueuePendingUrbToEndpoint+70
f70b8a16 894104 mov [ecx+0x4],eax

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: 0xD1

LAST_CONTROL_TRANSFER: from f70b5c4a to f70b8a16

STACK_TEXT:
80548aa0 f70b5c4a 85ea7918 864b0550 86223008 USBPORT!USBPORT_QueuePendingUrbToEndpoint+0x70
80548acc f70bc1bd 02524974 805419f8 864b0550 USBPORT!USBPORT_QueuePendingTransferIrp+0xf6
80548af8 f70c317a 86469d80 80548b30 f70c2d3e USBPORT!USBPORT_QueueTransferUrb+0x22f
80548b04 f70c2d3e 863f2028 86223008 864b0550 USBPORT!USBPORT_AsyncTransfer+0x30
80548b30 f70c7de2 8622d618 863f2028 00000090 USBPORT!USBPORT_ProcessURB+0x3f4
80548b50 f70b11e2 8622d618 86223008 86223008 USBPORT!USBPORT_PdoInternalDeviceControlIrp+0x7e
80548b74 804edf35 862230e4 8622d770 864b0550 USBPORT!USBPORT_Dispatch+0x148
80548b84 f358150a 80548bac f35853ef 86223008 nt!IopfCallDriver+0x31
80548b8c f35853ef 86223008 8622d618 86223008 usbhub!USBH_PassIrp+0x18
80548bac f3585c4e 86406d50 86223008 86223124 usbhub!USBH_PdoUrbFilter+0xbd
80548bc8 f35832ee 864b0550 86223008 80548c04 usbhub!USBH_PdoDispatch+0x202
80548bd8 804edf35 864945d8 86223008 85ec0708 usbhub!USBH_HubDispatch+0x48
80548be8 f3aed4db 00220003 862230e4 80000000 nt!IopfCallDriver+0x31
80548c04 f3aec76b 85ec05b8 86223008 862c8220 usbccgp!ParentInternalDeviceControl+0xbb
80548c28 f3aec5d3 85ec05b0 86223008 0000000f usbccgp!USBC_InternalDeviceControl+0x3b
80548c64 804edf35 85ec04f8 86223008 85ec0708 usbccgp!USBC_Dispatch+0x183
80548c74 f3aee231 80000000 00000009 00220003 nt!IopfCallDriver+0x31
80548ca4 f3aec786 865eaee0 86223008 865eaee0 usbccgp!FunctionInternalDeviceControl+0x1c1
80548cc8 f3aec5d3 865eaed8 86223008 0000000f usbccgp!USBC_InternalDeviceControl+0x56
80548d04 804edf35 865eae20 86223008 86223148 usbccgp!USBC_Dispatch+0x183
80548d14 f7abcb22 85ec0318 86223008 80548d40 nt!IopfCallDriver+0x31
WARNING: Stack unwind information not available. Following frames may be wrong.
80548d24 f7abd036 85ec0318 86223008 85ec0260 LUsbKbd+0xb22
80548d40 804edf35 85ec0260 86223008 864b0550 LUsbKbd+0x1036
80548d9c 804f048e aab6e2cc 86223008 aab6e22c nt!IopfCallDriver+0x31
80548dc0 aab57e91 85eabcb0 86223008 86223008 nt!IopfCompleteRequest+0xa2
80548dd4 aab59234 85eabcb0 86223008 86223008 HIDCLASS!HidpCallDriver+0x3f
80548df0 aab5909c 85eabd7c 85ea73d8 80548e3b HIDCLASS!HidpSubmitInterruptRead+0x84
80548e28 804f048e 00000000 86223008 00eabd7c HIDCLASS!HidpInterruptReadComplete+0x1d2
80548e58 f70b8ee5 86223008 86247508 863f2028 nt!IopfCompleteRequest+0xa2
80548ec0 f70b9b57 864b0550 00000000 863f27d8 USBPORT!USBPORT_CompleteTransfer+0x373
80548ef0 f70ba754 026e6f44 863f20e0 863f20e0 USBPORT!USBPORT_DoneTransfer+0x137
80548f28 f70bbf4a 863f2028 805419f8 863f2230 USBPORT!USBPORT_FlushDoneTransferList+0x16c
80548f54 f70c9fa5 863f2028 805419f8 863f2028 USBPORT!USBPORT_DpcWorker+0x224
80548f90 f70ca11c 863f2028 00000001 80551d00 USBPORT!USBPORT_IsrDpcWorker+0x38f
80548fac 80540ead 863f264c 6b755044 00000000 USBPORT!USBPORT_IsrDpc+0x166
80548fc0 80551aa0 ffdffc50 00000000 00000000 nt!KiRetireDpcList+0x46
ffdff980 863f2670 f79fc000 0019cdd8 00000001 nt!KiIdleThread0
ffdff984 f79fc000 0019cdd8 00000001 80548fc4 0x863f2670
ffdff988 0019cdd8 00000001 80548fc4 00000001 0xf79fc000
ffdff98c 00000000 80548fc4 00000001 0019cdd6 0x19cdd8


FOLLOWUP_IP:
usbccgp!ParentInternalDeviceControl+bb
f3aed4db 8945f4 mov [ebp-0xc],eax

SYMBOL_STACK_INDEX: d

FOLLOWUP_NAME: MachineOwner

SYMBOL_NAME: usbccgp!ParentInternalDeviceControl+bb

MODULE_NAME: usbccgp

IMAGE_NAME: usbccgp.sys

DEBUG_FLR_IMAGE_TIMESTAMP: 42b216bb

STACK_COMMAND: kb

FAILURE_BUCKET_ID: 0xD1_W_usbccgp!ParentInternalDeviceControl+bb

BUCKET_ID: 0xD1_W_usbccgp!ParentInternalDeviceControl+bb

Followup: MachineOwner
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++



+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
2. Pretty much the same as #1 (Comp 2)
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++



+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
3. NTFS_FILE_SYSTEM (24)
Arguments:
Arg1: 001902fe
Arg2: f7a17978
Arg3: f7a17674
Arg4: 805171e7

Debugging Details:
------------------


EXCEPTION_RECORD: f7a17978 -- (.exr fffffffff7a17978)
ExceptionAddress: 805171e7 (nt!MmUnmapViewInSystemCache+0x00000061)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 00000000
Parameter[1]: 00000018
Attempt to read from address 00000018

CONTEXT: f7a17674 -- (.cxr fffffffff7a17674)
eax=00000018 ebx=c06c0000 ecx=00603600 edx=00000000 esi=867b44d0 edi=81164260
eip=805171e7 esp=f7a17a40 ebp=f7a17a74 iopl=0 nv up ei pl zr ac po nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010256
nt!MmUnmapViewInSystemCache+0x61:
805171e7 8b00 mov eax,[eax] ds:0023:00000018=????????
Resetting default scope

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: DRIVER_FAULT

ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx ". The memory

could not be "%s ".

READ_ADDRESS: 00000018

BUGCHECK_STR: 0x24

LAST_CONTROL_TRANSFER: from 8055ee3e to 805171e7

STACK_TEXT:
f7a17a74 8055ee3e d8000000 c490f838 00000000 nt!MmUnmapViewInSystemCache+0x61
f7a17a8c 804e7242 867b44d0 86610ed0 00000000 nt!CcUnmapVacb+0x2a
f7a17ac8 804e44a2 00000004 00000000 86610f34 nt!CcUnmapVacbArray+0x120
f7a17ae4 804e46f0 86610ed0 84797038 86610ed0 nt!CcUnmapAndPurge+0x20
f7a17b10 804e4e1b 00000000 e854f0d0 84797038 nt!CcDeleteSharedCacheMap+0xa6
f7a17b2c f738dc97 00000000 00000000 00000000 nt!CcUninitializeCacheMap+0x127
f7a17b50 f738bc7d e854f0d0 00000000 00000000 Ntfs!NtfsDeleteInternalAttributeStream+0x98
f7a17b6c f7366800 84bf6920 e854f0d0 00000000 Ntfs!NtfsRemoveScb+0x77
f7a17b88 f736a550 84bf6920 e854f008 00000000 Ntfs!NtfsPrepareFcbForRemoval+0x52
f7a17bd8 f738bcde 84bf6920 86772100 e838ecc8 Ntfs!NtfsTeardownFromLcb+0x2bc
f7a17c30 f73667b0 84bf6920 e838ed90 e838ef28 Ntfs!NtfsTeardownStructures+0x125
f7a17c5c f7389535 84bf6920 0138ed90 e838ef28 Ntfs!NtfsDecrementCloseCounts+0x9e
f7a17ce0 f738e445 84bf6920 e838ed90 e838ecc8 Ntfs!NtfsCommonClose+0x397
f7a17d74 80533f22 00000000 00000000 867c5640 Ntfs!NtfsFspClose+0xe3
f7a17dac 805c4bc0 00000000 00000000 00000000 nt!ExpWorkerThread+0x100
f7a17ddc 805410f2 80533e22 00000000 00000000 nt!PspSystemThreadStartup+0x34
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16


FOLLOWUP_IP:
Ntfs!NtfsDeleteInternalAttributeStream+98
f738dc97 8bce mov ecx,esi

SYMBOL_STACK_INDEX: 6

FOLLOWUP_NAME: MachineOwner

SYMBOL_NAME: Ntfs!NtfsDeleteInternalAttributeStream+98

MODULE_NAME: Ntfs

IMAGE_NAME: Ntfs.sys

DEBUG_FLR_IMAGE_TIMESTAMP: 42797de8

STACK_COMMAND: .cxr fffffffff7a17674 ; kb

FAILURE_BUCKET_ID: 0x24_Ntfs!NtfsDeleteInternalAttributeStream+98

BUCKET_ID: 0x24_Ntfs!NtfsDeleteInternalAttributeStream+98

Followup: MachineOwner
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

 

The rest

Here is the rest:


+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
4. DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
Arguments:
Arg1: 7def13cb, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000001, value 0 = read operation, 1 = write operation
Arg4: f61e891e, address which referenced memory

Debugging Details:
------------------


WRITE_ADDRESS: 7def13cb

CURRENT_IRQL: 2

FAULTING_IP:
LMouKE+391e
f61e891e c0740d8b45 shl byte ptr [ebp+ecx-0x75],0x45

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: 0xD1

MISALIGNED_IP:
LMouKE+391e
f61e891e c0740d8b45 shl byte ptr [ebp+ecx-0x75],0x45

LAST_CONTROL_TRANSFER: from f61e9f8b to f61e891e

STACK_TEXT:
WARNING: Stack unwind information not available. Following frames may be wrong.
f79fbf04 f61e9f8b 864f54b4 f79fbf38 00000000 LMouKE+0x391e
f79fbf1c f61e5807 864f54b4 f79fbf38 80540630 LMouKE+0x4f8b
f79fbf6c f78140cb 8626ba50 86061068 86061080 LMouKE+0x807
f79fbfd0 80540ead 8626de98 0126dc88 00000000 i8042prt!I8042MouseIsrDpc+0xf0
f79fbff4 80540b7a a10e3d44 00000000 00000000 nt!KiRetireDpcList+0x46
f79fbff8 a10e3d44 00000000 00000000 00000000 nt!KiDispatchInterrupt+0x2a
80540b7a 00000000 00000009 bb835675 00000128 0xa10e3d44


FOLLOWUP_IP:
LMouKE+391e
f61e891e c0740d8b45 shl byte ptr [ebp+ecx-0x75],0x45

SYMBOL_STACK_INDEX: 0

FOLLOWUP_NAME: MachineOwner

SYMBOL_NAME: LMouKE+391e

IMAGE_NAME: hardware

DEBUG_FLR_IMAGE_TIMESTAMP: 0

STACK_COMMAND: kb

MODULE_NAME: hardware

FAILURE_BUCKET_ID: IP_MISALIGNED_LMouKE.Sys

BUCKET_ID: IP_MISALIGNED_LMouKE.Sys

Followup: MachineOwner
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++



+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
5. KERNEL_MODE_EXCEPTION_NOT_HANDLED_M (1000008e)
Arguments:
Arg1: c0000005, The exception code that was not handled
Arg2: bf80fcd3, The address that the exception occurred at
Arg3: a0fcd0e8, Trap Frame
Arg4: 00000000

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx ". The memory

could not be "%s ".

FAULTING_IP:
win32k!divff3_c+5b
bf80fcd3 8903 mov [ebx],eax

TRAP_FRAME: a0fcd0e8 -- (.trap ffffffffa0fcd0e8)
ErrCode = 00000002
eax=60000000 ebx=0000000d ecx=00000002 edx=00000000 esi=fffffffa edi=a0fcd710
eip=bf80fcd3 esp=a0fcd15c ebp=a0fcd164 iopl=0 nv up ei pl nz na po nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010206
win32k!divff3_c+0x5b:
bf80fcd3 8903 mov [ebx],eax ds:0023:0000000d=????????
Resetting default scope

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: 0x8E

LAST_CONTROL_TRANSFER: from bf811ab3 to bf80fcd3

STACK_TEXT:
a0fcd164 bf811ab3 0000000d a0fcd210 a0fcd208 win32k!divff3_c+0x5b
a0fcd258 bf810ea8 a0fcd2c0 e18b5860 a0fcd40c win32k!bGetNtoW_Win31+0xfa
a0fcd388 bf811200 a0fcd3f0 e18b5860 a0fcd40c win32k!bGetNtoD_Win31+0x179
a0fcd3bc bf807393 a0fcd710 e18b5860 a0fcd3f0 win32k!PFEOBJ::bSetFontXform+0x53
a0fcd440 bf80751c e18b5740 00000000 00000002 win32k!RFONTOBJ::bInit+0x1a8
a0fcd458 bf812430 a0fcd710 00000000 00000002 win32k!RFONTOBJ::vInit+0x16
a0fcd6c4 bf823d72 a0fcd710 00000017 0000030b win32k!GreExtTextOutWLocked+0x443
a0fcd708 bf82454d e3b28300 00000017 0000030b win32k!GreExtTextOutWInternal+0x6e
a0fcd858 8053c958 f5010869 00000017 0000030b win32k!NtGdiExtTextOutW+0x2b6
a0fcd858 7c90eb94 f5010869 00000017 0000030b nt!KiFastCallEntry+0xf8
WARNING: Frame IP not in any known module. Following frames may be wrong.
00138644 00000000 00000000 00000000 00000000 0x7c90eb94


FOLLOWUP_IP:
win32k!divff3_c+5b
bf80fcd3 8903 mov [ebx],eax

SYMBOL_STACK_INDEX: 0

FOLLOWUP_NAME: MachineOwner

SYMBOL_NAME: win32k!divff3_c+5b

MODULE_NAME: win32k

IMAGE_NAME: win32k.sys

DEBUG_FLR_IMAGE_TIMESTAMP: 43446b4e

STACK_COMMAND: .trap ffffffffa0fcd0e8 ; kb

FAILURE_BUCKET_ID: 0x8E_win32k!divff3_c+5b

BUCKET_ID: 0x8E_win32k!divff3_c+5b

Followup: MachineOwner
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++



+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
6. DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
Arguments:
Arg1: 010000a8, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000000, value 0 = read operation, 1 = write operation
Arg4: a683f98f, address which referenced memory

Debugging Details:
------------------


READ_ADDRESS: 010000a8

CURRENT_IRQL: 2

FAULTING_IP:
tcpip!IPRcvPacket+2d1
a683f98f 8b0b mov ecx,[ebx]

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: 0xD1

LAST_CONTROL_TRANSFER: from a683f362 to a683f98f

STACK_TEXT:
f7c7ecac a683f362 8621ed08 f7c7ed24 00000030 tcpip!IPRcvPacket+0x2d1
f7c7ed58 f7b573e4 a6871300 8621ed08 a6871310 tcpip!LoopXmitRtn+0x195
f7c7ed74 804e426b 8621ed08 00000000 867c4640 TDI!CTEpEventHandler+0x32
f7c7edac 8057bf95 a6871300 00000000 00000000 nt!ExpWorkerThread+0x100
f7c7eddc 804f94b2 804e4196 00000001 00000000 nt!PspSystemThreadStartup+0x34
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16


FOLLOWUP_IP:
TDI!CTEpEventHandler+32
f7b573e4 5f pop edi

SYMBOL_STACK_INDEX: 2

FOLLOWUP_NAME: MachineOwner

SYMBOL_NAME: TDI!CTEpEventHandler+32

MODULE_NAME: TDI

IMAGE_NAME: TDI.SYS

DEBUG_FLR_IMAGE_TIMESTAMP: 41107d33

STACK_COMMAND: kb

FAILURE_BUCKET_ID: 0xD1_TDI!CTEpEventHandler+32

BUCKET_ID: 0xD1_TDI!CTEpEventHandler+32

Followup: MachineOwner
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++


+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
7. Pretty much the same as #6 above
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++


+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
8. NTFS_FILE_SYSTEM (24)
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++


Hope that helps anyone. Very puzzling problem

 

Can’t help with the dump data – all gibberish to me, but personally I’d start in the bios and make sure everything is as it should be, particularly with regard to graphics and memory. http://www.rojakpot.com/freebog.aspx

Then I’d try all the latest hardware drivers, especially the chipset and graphics.

 

Good news ?

Just to give you guys an update, so since my very last visit it looks like the blue screens have decreased quite a bit. There was only 1 blue screen on 1 of the computers in 3 days. What I had done is updated the BIOS to latest BETA, disbaled everything not needed (including APM) and thats it. Here is the latest blue screen error, different than others. Any Ideas ?

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 00000028, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000000, value 0 = read operation, 1 = write operation
Arg4: 8051eb03, address which referenced memory

Debugging Details:
------------------


READ_ADDRESS: 00000028

CURRENT_IRQL: 2

FAULTING_IP:
nt!MiReleasePageFileSpace+3d
8051eb03 8b7828 mov edi,[eax+0x28]

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: 0xA

LAST_CONTROL_TRANSFER: from 8050c86a to 8051eb03

STACK_TEXT:
a7a6590c 8050c86a 00007bcc 00000f83 00000001 nt!MiReleasePageFileSpace+0x3d
a7a659c8 80543086 00018eb1 00000001 00000300 nt!MiDeleteSystemPagableVm+0x1e4
a7a65a0c 80543afd 00000019 867ee050 e4d61dc8 nt!MiFreePoolPages+0x5a4
a7a65a58 80543fef e4d4da68 e4d02b70 a7a65bbc nt!ExDeferredFreePool+0x277
a7a65a98 805b9533 e4d61dd0 00000000 e1494c18 nt!ExFreePoolWithTag+0x489
a7a65af4 805b37ce e1494c30 00000000 84c9e3e8 nt!ObpParseSymbolicLink+0x30f
a7a65b7c 805afcaf 00000000 a7a65bbc 00000040 nt!ObpLookupObjectName+0x56a
a7a65bd0 8056b255 00000000 00000000 8410ca01 nt!ObOpenObjectByName+0xeb
a7a65d54 8053c958 0113d1e4 0113d1bc 0113d210 nt!NtQueryAttributesFile+0xf1
a7a65d54 7c90eb94 0113d1e4 0113d1bc 0113d210 nt!KiFastCallEntry+0xf8
WARNING: Frame IP not in any known module. Following frames may be wrong.
0113d210 00000000 00000000 00000000 00000000 0x7c90eb94


FOLLOWUP_IP:
nt!ExDeferredFreePool+277
80543afd 85ff test edi,edi

SYMBOL_STACK_INDEX: 3

FOLLOWUP_NAME: Pool_corruption

SYMBOL_NAME: nt!ExDeferredFreePool+277

MODULE_NAME: Pool_Corruption

IMAGE_NAME: Pool_Corruption

DEBUG_FLR_IMAGE_TIMESTAMP: 0

STACK_COMMAND: kb

FAILURE_BUCKET_ID: 0xA_nt!ExDeferredFreePool+277

BUCKET_ID: 0xA_nt!ExDeferredFreePool+277

Followup: Pool_corruption
---------

Thanks all I will be leaving the stations alone for a few more days to see if they get any more blue screens.

 

Hi,

Yours windows are crashed with different bugcheck code and it is the sign of hardware problem. Probably it is faulty ram. Run memtest to stress test the ram. Your windows also installs Norton AV and you had better upgrade Norton AV to latest patches as Norton AV caused a lot of BSOD.

 

Hey thanks for your feedback, as mentioned above it it defenitely not the RAM, I've ran continues loop of tests on the RAM and they all passes no problem. I've also tried diffrent high end RAM same issue, so it must be something else.

I've asked the PC users to notify me when or if they get anymore blue screens. Yes Norton AV 2006 might be causing some problems, although they are fully updated and running liveupdate shows that there are currently nothing to update.

I will wait to see what other blue screens they will get if any.

 

Hi,

Your windows are crashed with different bugcheck codes. Probably the culprit Norton AV. Maybe it is conflicit with some of the device drivers (ie some device drivers and Norton AV use the working storage). De-install Norton AV and install AVG may resolve the problem.


Debug report Comp 1
Mini011206-01.dmp BugCheck 24, {1902fe, a7384618, a7384314, f7691fe4}
Probably caused by : Ntfs.sys ( Ntfs!NtfsCommonCreate+147b )
STACK_TEXT:
a738481c f7692ec2 a7384840 85117918 a7384970 Ntfs!NtfsCommonCreate+0x147b
a73849c8 f7719f70 85117918 a7384c00 865a4020 Ntfs!NtfsNetworkOpenCreate+0x8a
a73849e8 a99bcdb1 85117918 a7384c00 865a6bc8 sr!SrFastIoQueryOpen+0x40
WARNING: Stack unwind information not available. Following frames may be wrong.
a7384a08 8057168e 85117918 a7384c00 8642b228 SYMEVENT+0x4db1<- Norton AV
a7384af4 805632ec 8677de30 00000000 8638f728 nt!IopParseDevice+0x95c
a7384b7c 8056741a 00000000 a7384bbc 00000040 nt!ObpLookupObjectName+0x56a
a7384bd0 80571834 00000000 00000000 a7384c01 nt!ObOpenObjectByName+0xeb
a7384d54 804de7ec 0012f288 0012f260 0012f2b4 nt!NtQueryAttributesFile+0xf1
a7384d54 7c90eb94 0012f288 0012f260 0012f2b4 nt!KiFastCallEntry+0xf8
0012f2b4 00000000 00000000 00000000 00000000 0x7c90eb94

Mini011306-01.dmp BugCheck 1000000A, {c, ff, 0, 80531bc7}
Probably caused by : SPBBCDrv.sys ( SPBBCDrv+48b8e )

Mini011306-02.dmp BugCheck 24, {1902fe, f7a0b480, f7a0b17c, 804e6265}
Probably caused by : Ntfs.sys ( Ntfs!LfsGetLbcb+5b )

Mini011406-01.dmp BugCheck 10000050, {c4849d38, 0, f73d226a, 0}
Probably caused by : KSecDD.sys ( KSecDD!KSecReferenceListEntry+18 )

Mini011406-02.dmp BugCheck 1000008E, {c0000005, ef480d, aa34d819, 0}
Probably caused by : SAVRT.SYS ( SAVRT+4609f ) <--- Norton AV


Debug report of Comp 2
Mini010606-01.dmp BugCheck 100000D1, {4, 2, 1, f70b8a16}
Probably caused by : usbccgp.sys ( usbccgp!ParentInternalDeviceControl+bb )

Mini010606-02.dmp BugCheck 100000D1, {4, 2, 1, f70b8a16}
Probably caused by : usbccgp.sys ( usbccgp!ParentInternalDeviceControl+bb )

Mini010706-01.dmp BugCheck 24, {1902fe, f7a17978, f7a17674, 805171e7}
Probably caused by : Ntfs.sys ( Ntfs!NtfsDeleteInternalAttributeStream+98 )

Mini010906-01.dmp BugCheck 100000D1, {7def13cb, 2, 1, f61e891e}
Probably caused by : hardware ( LMouKE+391e )

Mini011106-01.dmp BugCheck 1000008E, {c0000005, bf80fcd3, a0fcd0e8, 0}
Probably caused by : win32k.sys ( win32k!divff3_c+5b )

Mini011306-01.dmp BugCheck 100000D1, {10000a8, 2, 0, a683f98f}
Probably caused by : TDI.SYS ( TDI!CTEpEventHandler+32 )

Mini011406-01.dmp BugCheck 100000D1, {10000a8, 2, 0, a5a1298f}
Probably caused by : TDI.SYS ( TDI!CTEpEventHandler+32 )

Mini123105-01.dmp BugCheck 24, {1902fe, f7a17978, f7a17674, 805171e7}
Probably caused by : Ntfs.sys ( Ntfs!NtfsDeleteInternalAttributeStream+98 )