BSOD on USB removal

I am running W2K SP4 with Rollup 2 for SP4 installed.
Whenever I "safely remove" my USB memory stick I get a bsod. I have been having this problem for months now and so far my research has gotten me nowhere. I have included the memory dump which I have been trying to decipher, with no luck I must add. I would appreciate any help on this


Microsoft (R) Windows Debugger Version 6.6.0007.5
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\WINNT\MEMORY.DMP]
Kernel Complete Dump File: Full address space is available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 2000 Kernel Version 2195 (Service Pack 4) MP (2 procs) Free x86 compatible
Product: WinNt
Kernel base = 0x80400000 PsLoadedModuleList = 0x80485b00
Debug session time: Thu Dec 21 07:24:02.241 2006 (GMT-7)
System Uptime: 0 days 0:03:45.000
Loading Kernel Symbols
..................................................................................................................
Loading User Symbols

Loading unloaded module list
...................
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck C2, {40, 0, 80000000, 0}

Probably caused by : MountMgr.sys ( MountMgr!MountMgrMountedDeviceRemoval+110 )

Followup: MachineOwner
---------

1: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

BAD_POOL_CALLER (c2)
The current thread is making a bad pool request. Typically this is at a bad IRQL level or double freeing the same allocation, etc.
Arguments:
Arg1: 00000040, Attempt to free usermode address to kernel pool
Arg2: 00000000, Starting address
Arg3: 80000000, Start of system address space
Arg4: 00000000, 0

Debugging Details:
------------------


FAULTING_IP:
MountMgr!MountMgrMountedDeviceRemoval+110
eb28c828 53 push ebx

BUGCHECK_STR: 0xc2_40

DEFAULT_BUCKET_ID: INTEL_CPU_MICROCODE_ZERO

PROCESS_NAME: System

LAST_CONTROL_TRANSFER: from 8046e2b1 to 8046f1d9

STACK_TEXT:
eb44fba0 8046e2b1 00000000 8046e142 e5699008 nt!MiFreePoolPages+0x79
eb44fbcc 8046e14d 00000000 00000000 eb28c828 nt!ExFreePoolWithTag+0xe1
eb44fbd8 eb28c828 00000000 eb288900 eb44fc90 nt!ExFreePool+0xb
eb44fbf4 eb28bd93 e5699008 e5699020 8047c3c0 MountMgr!MountMgrMountedDeviceRemoval+0x110
eb44fc0c 804aa83c eb44fc7c e5699008 80536d80 MountMgr!MountMgrTargetDeviceNotification+0x29
eb44fc18 80536d80 eb44fc94 8047c3c0 804019d8 nt!IopPnPHydraCallback+0xc
eb44fc58 804a9b79 eb28bd6a 804aa830 eb44fc94 nt!MmDispatchWin32Callout+0x4e
eb44fcb4 80511c04 804019e8 8514c930 00000000 nt!IopNotifyTargetDeviceChange+0x11b
eb44fd3c 80511fb7 00000003 80065634 e56fa9a8 nt!PiProcessQueryRemoveAndEject+0x746
eb44fd54 80510d3d eb44fd74 84e915c8 80478cfc nt!PiProcessTargetDeviceEvent+0x33
eb44fd78 80417b47 84e915c8 00000000 00000000 nt!PiWalkDeviceList+0xf7
eb44fda8 80457838 84e915c8 00000000 00000000 nt!ExpWorkerThread+0xaf
eb44fddc 8046c8e6 80417a98 00000001 00000000 nt!PspSystemThreadStartup+0x54
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16


STACK_COMMAND: kb

FOLLOWUP_IP:
MountMgr!MountMgrMountedDeviceRemoval+110
eb28c828 53 push ebx

SYMBOL_STACK_INDEX: 3

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: MountMgr

IMAGE_NAME: MountMgr.sys

DEBUG_FLR_IMAGE_TIMESTAMP: 4301a697

SYMBOL_NAME: MountMgr!MountMgrMountedDeviceRemoval+110

FAILURE_BUCKET_ID: 0xc2_40_MountMgr!MountMgrMountedDeviceRemoval+110

BUCKET_ID: 0xc2_40_MountMgr!MountMgrMountedDeviceRemoval+110

Followup: MachineOwner
---------

1: kd> lmvm MountMgr
start end module name
eb288000 eb28f4c0 MountMgr (pdb symbols) c:\symbols\mountmgr.pdb\4301A6971\mountmgr.pdb
Loaded symbol image file: c:\symbols\MountMgr.dbg\4301A69774c0\MountMgr.dbg
Image path: MountMgr.sys
Image name: MountMgr.sys
Timestamp: Tue Aug 16 02:40:55 2005 (4301A697)
CheckSum: 0000B570
ImageSize: 000074C0
File version: 5.0.2195.7063
Product version: 5.0.2195.7063
File flags: 0 (Mask 3F)
File OS: 40004 NT Win32
File type: 3.7 Driver
File date: 00000000.00000000
Translations: 0409.04b0
CompanyName: Microsoft Corporation
ProductName: Microsoft(R) Windows (R) 2000 Operating System
InternalName: mountmgr.sys
OriginalFilename: mountmgr.sys
ProductVersion: 5.00.2195.7063
FileVersion: 5.00.2195.7063
FileDescription: Mount Manager
LegalCopyright: Copyright (C) Microsoft Corp. 1981-1999

 

Hello Marguerite and welcome to the Board

I don't have experience with dump analysis - but until someone comes along that does, try an alternative.

There is no need to "stop" the Flash drive that way unless you want to free up the drive letter it's assigned.

Simply close any explorer window or any process that uses the flash and unplug it.

Lets see if you get a blue screen when doing that.

Regards - Charles

 

I get the same result if I just unplug the Flash drive.

 

Hello Marguerite

A stop gap solution to this would be to add or remove the drive while the computer is off. But this will not always be convenient.

OK this will take a few steps. So do them in the order presented below.

Check the USB drive for a disk error.
To do this click Start-Run
Type
Chkdsk x: /r (use your usb drive letter in place of the X)

It will either start, ask for permission to dismount or require to be run on next restart.

Do which ever it wants.

Depending on the disk speed/size and number of files it could take a while.
When it finishes try removal.

Still have problem:

We will clear all events to reduce clutter and reproduce the error and then recheck the logs immediately to see only errors related to this.

Like this:
Start-Run
Type
Eventvwr.msc
Rt click all categories in the left panel and clear them no need to save

When all are clear try removal, if still BSOD then

Boot back up at desktop (do nothing else first) run Eventvwr.msc again.

But this time do the following for System and Applications only:

Rt click you can get an option to save as

make sure you pick save as type to be *.txt give them a name (example apps and Sys)

they will probably defaut to be saved in My Documents

Browse there open them and copy paste to post them here so I can see the actual events and the event ID numbers.

While I study these do the following. XP has the SC program but 2K does not so we will download and install it. As below:

Download these

http://www.dynawell.com/reskit/microsoft/win2000/sc.zip

http://www.dynawell.com/reskit/micro...000/sclist.zip

Extract them and put the exe files in windows\system32 (you may have Winnt) then wnint\system32

Copy the line below

sclist c:\allserviceslist.txt

then Start-Run and paste it there and click OK.

then

Browse to c:\
open c:\allserviceslist.txt
copy and paste to the BBS post.

Mike

 

Here's the contents of System and Applications Event logs:

System:
1/16/2007 7:41:48 AM Service Control Manager Error None 7026 N/A C2006004 The following boot-start or system-start driver(s) failed to load:
CCDevice
1/16/2007 7:40:04 AM b57w2k Information None 11 N/A C2006004 Broadcom NetXtreme 57xx Gigabit Controller: Network controller configured for 1Gb full-duplex link.
1/16/2007 7:40:01 AM b57w2k Information None 15 N/A C2006004 Broadcom NetXtreme 57xx Gigabit Controller: Driver initialized successfully.
1/16/2007 7:40:35 AM EventLog Information None 6005 N/A C2006004 The Event log service was started.
1/16/2007 7:40:35 AM EventLog Information None 6009 N/A C2006004 Microsoft (R) Windows 2000 (R) 5.0 2195 Service Pack 4 Multiprocessor Free.
1/16/2007 7:40:36 AM Save Dump Information None 1001 N/A C2006004 The computer has rebooted from a bugcheck. The bugcheck was: 0x000000c2 (0x00000040, 0x00000000, 0x80000000, 0x00000000). Microsoft Windows 2000 [v15.2195]. A dump was saved in: C:\WINNT\Minidump\Mini011607-03.dmp.
1/16/2007 7:39:01 AM Removable Storage Service Information None 160 N/A C2006004 Received Handle Query Remove notification.
RSM approved the query remove request.

Applications:
1/16/2007 7:40:57 AM Diskeeper Administrator Information None 0 N/A C2006004 Service started successfully.
1/16/2007 7:40:47 AM Diskeeper Information None 2 N/A C2006004 The Diskeeper Control Center has been started. Diskeeper service started
1/16/2007 7:40:43 AM ATI Smart Information None 105 N/A C2006004 The service was started.

 

When I tried to run sclist c:\allserviceslist.txt I got the following error:
could not open service manager for c:\allserviceslist.txt

 

Uhumm

Are you saying you did the chkdsk and still had the problem.

Then cleared the event logs reproduced the error rebooted and this is immediately after reboot?

If so now I need the SCLIST.

Mike

 

Ok do this

Hilite and copy the following line
sc query type= service state= all > c:\allserviceslist.txt

then

Start-Run
type
cmd
then paste the above to the command prompt

hit enter

then type
exit

Then open notepad or wordpad and browse to the root c:\

open allserviceslist.txt
Copy and paste back to the BBS

This will allow me to see all the services you are running and what their state is.

 

OK Marg

Sorry

I learned something myself
I always run these by actually opening a command prompt. Never realized they have a problem running from Start-Run

Additionally I forgot to put the redirection character (>)also

Highlight and copy the line below
sclist >c:\sclist.txt

then
Start-Run
type
cmd

then paste the line and hit enter

close command prompt

then browse to c:\ open sclist.txt and paste to us.

The same will work with the sc query but we will wait to do that if needed.

Mike

 

Here's the sclist:


--------------------------------------------
- Service list for Local Machine
--------------------------------------------
running AClient Altiris Client Service
running AeXNSClient Altiris Agent
running Alerter Alerter
stopped AppMgmt Application Management
stopped aspnet_state ASP.NET State Service
running Ati HotKey Poller Ati HotKey Poller
stopped ATI Smart ATI Smart
stopped BITS Background Intelligent Transfer Service
stopped Browser Computer Browser
running CA_LIC_CLNT CA License Client
stopped CA_LIC_SRVR CA License Server
running cisvc Indexing Service
stopped ClipSrv ClipBook
running cusrvc Client Update Service for Novell
running Dhcp DHCP Client
running Diskeeper Diskeeper
running Diskeeper Administrator Diskeeper Administrator
stopped dmadmin Logical Disk Manager Administrative Service
running dmserver Logical Disk Manager
running Dnscache DNS Client
running Eventlog Event Log
running EventSystem COM+ Event System
stopped Fax Fax Service
running HidServ HID Input Service
stopped IDriverT InstallDriver Table Manager
running iGateway iTechnology iGateway 4.0
running InoRPC eTrust ITM RPC Service
running InoRT eTrust ITM Realtime Service
running InoTask eTrust ITM Job Service
running lanmanserver Server
running lanmanworkstation Workstation
running LmHosts TCP/IP NetBIOS Helper Service
running LogWatch Event Log Watch
running MDM Machine Debug Manager
running Messenger Messenger
stopped mnmsrvc NetMeeting Remote Desktop Sharing
stopped MSDTC Distributed Transaction Coordinator
stopped MSIServer Windows Installer
stopped NetDDE Network DDE
stopped NetDDEdsdm Network DDE DSDM
running Netlogon Net Logon
running Netman Network Connections
stopped NtLmSsp NT LM Security Support Provider
running NtmsSvc Removable Storage
stopped OracleOraHome81ClientCache OracleOraHome81ClientCache
stopped ose Office Source Engine
running PlugPlay Plug and Play
running PolicyAgent IPSEC Policy Agent
running ProtectedStorage Protected Storage
stopped RasAuto Remote Access Auto Connection Manager
running RasMan Remote Access Connection Manager
stopped RemoteAccess Routing and Remote Access
running RemoteRegistry Remote Registry Service
stopped RpcLocator Remote Procedure Call (RPC) Locator
running RpcSs Remote Procedure Call (RPC)
stopped RSVP QoS RSVP
running SamSs Security Accounts Manager
stopped SCardDrv Smart Card Helper
running SCardSvr Smart Card
running Schedule Task Scheduler
running seclogon RunAs Service
running SENS System Event Notification
stopped SharedAccess Internet Connection Sharing
running Spooler Print Spooler
stopped SysmonLog Performance Logs and Alerts
running TapiSrv Telephony
stopped TlntSvr Telnet
running TrkWks Distributed Link Tracking Client
stopped UPS Uninterruptible Power Supply
stopped UtilMan Utility Manager
running W32Time Windows Time
running WinMgmt Windows Management Instrumentation
stopped WmdmPmSN Portable Media Serial Number Service
running Wmi Windows Management Instrumentation Driver Extensions
running wuauserv Automatic Updates
running WZCSVC Wireless Configuration

 

Hi Marg

Do a search for MountMgr.sys. Once found rt click then properties then version and post version number back here.

Mike

 

The version is 5.0.2195.7063

 

Hey Marguerite

I need additional info on your system. It is trying to be tough but I am trying.

Go here and download
http://www.gtopala.com/siw.exe

Then run it:

Then on left panel go down to "Mother board" and click it, when it populates the right center then click the top line it will become highlighted, then do a CtrlA to highlight it all. While highlighted right click and copy it and paste back to here.

Then do the same for PCI. But only the top panel. Put in another separate post.

It will wrap on the BBS but I will copy it to an editor to unwrap the lines to read it normally.

Thanks,
Mike

 

Hey Mike, glad somebody else likes SIW

Regards - Charles

 

OK now Charles

This propellerhead don't get it??

Mike

 

I'm the propeller head - left a few words out

Edited the post.

 

Oh 10-4

Yeah it is pretty neat, used it for 2-3 years.

Left words out, yes I definatly understand, I am the worst.

Mike

 

Results of Motherboard:

Property Value
Manufacturer Dell Inc.
Model 0F8101
Serial Number ..CN6986161M07AE.

Chipset Vendor Intel Corporation
Chipset Model 945G Processor to I/O Controller
South Bridge 82801GB/GR (ICH7 Family) LPC Interface Controller
SMBus Intel Corporation 82801G (ICH7 Family) SMBus Controller @E8A0h

CPU Intel Pentium 4 HT
Cpu Socket LGA775
Processor Upgrade ZIF Socket
Max CPU Speed 4000 MHz

System Slots 1 PCI

OnBoard devices
Video (Disabled) Intel Graphics Media Accelerator 950
Ethernet (Enabled) Broadcom 5751 NetXtreme Gigabit Controller
Sound (Enabled) AC'97 Audio Controller

Memory Summary
Location System board or motherboard
Maximum Capacity 4096 MBytes
Memory Slots 4
Error Correction None
Use System memory

Warning! Accuracy of DMI data cannot be guaranteed

 

Results of PCI:

Bus/Dev./Func. Type Class Type Manufacturer Device Name Sub System Device Vendor Sub System Device Name
00 / 00 / 00 PCI PCI to HOST Bridge Intel Corporation 945G Processor to I/O Controller Dell Computer Corp
00 / 01 / 00 PCI-X PCI to PCI Bridge Intel Corporation 82945G/GZ/P/PL PCI Express Root Port
00 / 1c / 00 PCI-X PCI to PCI Bridge Intel Corporation 82801G (ICH7 Family) PCI Express Root Port
00 / 1c / 01 PCI-X PCI to PCI Bridge Intel Corporation 82801G (ICH7 Family) PCI Express Root Port
00 / 1d / 00 PCI USB (UHCI) Intel Corporation 82801G (ICH7 Family) USB Universal Host Controller Dell Computer Corp
00 / 1d / 01 PCI USB (UHCI) Intel Corporation 82801G (ICH7 Family) USB Universal Host Controller Dell Computer Corp
00 / 1d / 02 PCI USB (UHCI) Intel Corporation 82801G (ICH7 Family) USB Universal Host Controller Dell Computer Corp
00 / 1d / 03 PCI USB (UHCI) Intel Corporation 82801G (ICH7 Family) USB Universal Host Controller Dell Computer Corp
00 / 1d / 07 PCI USB 2.0 (EHCI) Intel Corporation 82801G (ICH7 Family) USB 2.0 Enhanced Host Controller Dell Computer Corp
00 / 1e / 00 PCI PCI to PCI Bridge (Subtractive Decode) Intel Corporation 801GB Hub Interface to PCI Bridge (ICH7 A1 step)
00 / 1e / 02 PCI Audio Device Intel Corporation 82801GB I/O Controller Hub AC'97 Audio Dell Computer Corp
00 / 1f / 00 PCI PCI to ISA Bridge Intel Corporation 82801GB/GR (ICH7 Family) LPC Interface Controller
00 / 1f / 01 PCI Bus Master IDE controller Intel Corporation 82801G (ICH7 Family) Ultra ATA Storage Controller Dell Computer Corp
00 / 1f / 02 PCI IDE (ATA) Intel Corporation 82801GB/GR/GH (ICH7 Family) Serial ATA Storage Controller Dell Computer Corp
00 / 1f / 03 PCI SMBus Controller Intel Corporation 82801G (ICH7 Family) SMBus Controller Dell Computer Corp
01 / 00 / 00 PCI-X VGA Controller ATI Technologies Inc Radeon X600 Series ATI Technologies Inc
01 / 00 / 01 PCI-X Other Display Controller ATI Technologies Inc Radeon X600 Series - Secondary ATI Technologies Inc
02 / 00 / 00 PCI-X Ethernet Broadcom Corp BCM5750A1 NetXtreme Gigabit Ethernet PCI Express Dell Computer Corp

 

Thanks Marguerite

Good job!

I see you are online

Now I have a couple more possible solutions to look into.

But now I have few errands to do so later this evening.

Mike