XP Random Crashing [DUMP DATA] [Bad sound card?]

Hi,

I have recently build a new PC. The machine runs fine most of the time but at least once a day it will randomly reboot !

The machine Spec is as follows :-

It has an ECS P4M800Pro-M Motherboard with an intel D 3ghz processor. 1gb of ddr2 533 mhz ram. The video card is an ATI Radeon 1650 Pro.

I have took a look at the dump files with the debug wizard. Initially it mentioned the file ALCXWDM.SYS which relates to the on-board sound card, i updated the drivers and for 2 days it was ok. I thought the problem had gone away, but unfortunately not ! It has also crashed and referenced the tcpip.sys and also win32k.sys. I have attached below two of the dump files - i would appreciate any help you could offer.

Regards

Al.

Microsoft (R) Windows Debugger Version 6.6.0007.5
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\WINDOWS\Minidump\Mini022707-02.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows XP Kernel Version 2600 (Service Pack 2) MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 2600.xpsp_sp2_gdr.050301-1519
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055c700
Debug session time: Tue Feb 27 09:21:28.328 2007 (GMT+0)
System Uptime: 0 days 0:03:14.035
Loading Kernel Symbols
...................................................................................................................
Loading User Symbols
Loading unloaded module list
..........
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 100000D1, {4, 2, 1, aaf5d8f7}

Probably caused by : tcpip.sys ( tcpip!DeleteAO+215 )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: 00000004, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000001, value 0 = read operation, 1 = write operation
Arg4: aaf5d8f7, address which referenced memory

Debugging Details:
------------------


WRITE_ADDRESS: 00000004

CURRENT_IRQL: 2

FAULTING_IP:
tcpip!DeleteAO+215
aaf5d8f7 895804 mov dword ptr [eax+4],ebx

CUSTOMER_CRASH_COUNT: 2

DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: 0xD1

PROCESS_NAME: System

LAST_CONTROL_TRANSFER: from aaf40b15 to aaf5d8f7

STACK_TEXT:
f7a33b1c aaf40b15 863ac734 857ad4c8 857c9f78 tcpip!DeleteAO+0x215
f7a33b3c aaf4047b f7a33b64 857ad538 857ad4c8 tcpip!TdiCloseAddress+0x202
f7a33b78 aaf3fc9e 86543988 857ad4c8 007ad538 tcpip!TCPCleanup+0xa2
f7a33bb4 804eeeb1 86543988 857ad4c8 857ad4c8 tcpip!TCPDispatch+0x91
f7a33bc4 8058260f 857cf5e0 865e7ca0 00000001 nt!IopfCallDriver+0x31
f7a33bf4 805bb3a1 865c4a00 86543988 001f01ff nt!IopCloseFile+0x26b
f7a33c24 805bacf3 865c4a00 017cf5e0 865e7ca0 nt!ObpDecrementHandleCount+0x11b
f7a33c4c 805bad91 e1003e60 857cf5f8 00001530 nt!ObpCloseHandleTableEntry+0x14d
f7a33c94 805baec9 00001530 00000000 00000000 nt!ObpCloseHandle+0x87
f7a33ca8 8054060c 80001530 f7a33d3c 804ff2a5 nt!NtClose+0x1d
f7a33ca8 804ff2a5 80001530 f7a33d3c 804ff2a5 nt!KiFastCallEntry+0xfc
f7a33d24 aaecd6ec 80001530 85839e00 85839d58 nt!ZwClose+0x11
f7a33d3c aaecd851 85839d58 aaecc7a8 f7a33d68 afd!AfdFreeEndpointResources+0xfd
f7a33d4c aaeca86a 85839e00 86241e50 8628df18 afd!AfdFreeEndpoint+0x21
f7a33d68 805758d9 8628df18 00000000 8056375c afd!AfdDoWork+0x51
f7a33d7c 80537757 86241e50 00000000 865c2640 nt!IopProcessWorkItem+0x13
f7a33dac 805ce794 86241e50 00000000 00000000 nt!ExpWorkerThread+0xef
f7a33ddc 805450ce 80537668 00000001 00000000 nt!PspSystemThreadStartup+0x34
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16


STACK_COMMAND: kb

FOLLOWUP_IP:
tcpip!DeleteAO+215
aaf5d8f7 895804 mov dword ptr [eax+4],ebx

SYMBOL_STACK_INDEX: 0

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: tcpip

IMAGE_NAME: tcpip.sys

DEBUG_FLR_IMAGE_TIMESTAMP: 444775d3

SYMBOL_NAME: tcpip!DeleteAO+215

FAILURE_BUCKET_ID: 0xD1_W_tcpip!DeleteAO+215

BUCKET_ID: 0xD1_W_tcpip!DeleteAO+215

Followup: MachineOwner
---------













Microsoft (R) Windows Debugger Version 6.6.0007.5
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\WINDOWS\Minidump\Mini022807-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows XP Kernel Version 2600 (Service Pack 2) MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 2600.xpsp_sp2_gdr.050301-1519
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055c700
Debug session time: Wed Feb 28 20:35:00.468 2007 (GMT+0)
System Uptime: 0 days 0:17:10.158
Loading Kernel Symbols
......................................................................................................................
Loading User Symbols
Loading unloaded module list
................
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 9C, {0, f7870050, b2000000, 1040080f}

Unable to load image ALCXWDM.SYS, Win32 error 2
*** WARNING: Unable to verify timestamp for ALCXWDM.SYS
*** ERROR: Module load completed but symbols could not be loaded for ALCXWDM.SYS
Probably caused by : ALCXWDM.SYS ( ALCXWDM+389b86 )

Followup: MachineOwner
---------

1: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

MACHINE_CHECK_EXCEPTION (9c)
A fatal Machine Check Exception has occurred.
KeBugCheckEx parameters;
x86 Processors
If the processor has ONLY MCE feature available (For example Intel
Pentium), the parameters are:
1 - Low 32 bits of P5_MC_TYPE MSR
2 - Address of MCA_EXCEPTION structure
3 - High 32 bits of P5_MC_ADDR MSR
4 - Low 32 bits of P5_MC_ADDR MSR
If the processor also has MCA feature available (For example Intel
Pentium Pro), the parameters are:
1 - Bank number
2 - Address of MCA_EXCEPTION structure
3 - High 32 bits of MCi_STATUS MSR for the MCA bank that had the error
4 - Low 32 bits of MCi_STATUS MSR for the MCA bank that had the error
IA64 Processors
1 - Bugcheck Type
1 - MCA_ASSERT
2 - MCA_GET_STATEINFO
SAL returned an error for SAL_GET_STATEINFO while processing MCA.
3 - MCA_CLEAR_STATEINFO
SAL returned an error for SAL_CLEAR_STATEINFO while processing MCA.
4 - MCA_FATAL
FW reported a fatal MCA.
5 - MCA_NONFATAL
SAL reported a recoverable MCA and we don't support currently
support recovery or SAL generated an MCA and then couldn't
produce an error record.
0xB - INIT_ASSERT
0xC - INIT_GET_STATEINFO
SAL returned an error for SAL_GET_STATEINFO while processing INIT event.
0xD - INIT_CLEAR_STATEINFO
SAL returned an error for SAL_CLEAR_STATEINFO while processing INIT event.
0xE - INIT_FATAL
Not used.
2 - Address of log
3 - Size of log
4 - Error code in the case of x_GET_STATEINFO or x_CLEAR_STATEINFO
AMD64 Processors
1 - Bank number
2 - Address of MCA_EXCEPTION structure
3 - High 32 bits of MCi_STATUS MSR for the MCA bank that had the error
4 - Low 32 bits of MCi_STATUS MSR for the MCA bank that had the error
Arguments:
Arg1: 00000000
Arg2: f7870050
Arg3: b2000000
Arg4: 1040080f

Debugging Details:
------------------

NOTE: This is a hardware error. This error was reported by the CPU
via Interrupt 18. This analysis will provide more information about
the specific error. Please contact the manufacturer for additional
information about this error and troubleshooting assistance.

This error is documented in the following publication:

- IA-32 Intel(r) Architecture Software Developer's Manual
Volume 3: System Programming Guide

Bit Mask:

MA Model Specific MCA
O ID Other Information Error Code Error Code
VV SDP ___________|____________ _______|_______ _______|______
AEUECRC| | | |
LRCNVVC| | | |
^^^^^^^| | | |
6 5 4 3 2 1
3210987654321098765432109876543210987654321098765432109876543210
----------------------------------------------------------------
1011001000000000000000000000000000010000010000000000100000001111


VAL - MCi_STATUS register is valid
Indicates that the information contained within the IA32_MCi_STATUS
register is valid. When this flag is set, the processor follows the
rules given for the OVER flag in the IA32_MCi_STATUS register when
overwriting previously valid entries. The processor sets the VAL
flag and software is responsible for clearing it.

UC - Error Uncorrected
Indicates that the processor did not or was not able to correct the
error condition. When clear, this flag indicates that the processor
was able to correct the error condition.

EN - Error Enabled
Indicates that the error was enabled by the associated EEj bit of the
IA32_MCi_CTL register.

PCC - Processor Context Corrupt
Indicates that the state of the processor might have been corrupted
by the error condition detected and that reliable restarting of the
processor may not be possible.

BUSCONNERR - Bus and Interconnect Error BUS{LL}_{PP}_{RRRR}_{II}_{T}_err
These errors match the format 0000 1PPT RRRR IILL



Concatenated Error Code:
--------------------------
_VAL_UC_EN_PCC_BUSCONNERR_F

This error code can be reported back to the manufacturer.
They may be able to provide additional information based upon
this error. All questions regarding STOP 0x9C should be
directed to the hardware manufacturer.

BUGCHECK_STR: 0x9C_IA32_GenuineIntel

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: DRIVER_FAULT

PROCESS_NAME: avgcc.exe

LAST_CONTROL_TRANSFER: from 806e7bff to 804f9c37

SYMBOL_ON_RAW_STACK: 1

STACK_ADDR_RAW_STACK_SYMBOL: 17002000010004

STACK_COMMAND: dds F78701C0-0x20 ; kb

STACK_TEXT:
f78701a0 0000ffff
f78701a4 00cf9300
f78701a8 0000ffff
f78701ac 00cffb00
f78701b0 0000ffff
f78701b4 00cff300
f78701b8 cd7020ab
f78701bc f7008b86 ALCXWDM+0x389b86
f78701c0 c0000001
f78701c4 f7c09386
f78701c8 a0000fff
f78701cc 7f40f3fd
f78701d0 0400ffff
f78701d4 0000f200
f78701d8 00000000
f78701dc 00000000
f78701e0 f0800068
f78701e4 f7008986 ALCXWDM+0x389986
f78701e8 f0f00068
f78701ec f7008986 ALCXWDM+0x389986
f78701f0 2f30ffff
f78701f4 00009302
f78701f8 80003fff
f78701fc 0000920b
f7870200 700003ff
f7870204 ff0092ff
f7870208 0000ffff
f787020c 80009a40
f7870210 0000ffff
f7870214 80009240
f7870218 00000000
f787021c 00009200


FOLLOWUP_IP:
ALCXWDM+389b86
f7008b86 ?? ???

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: ALCXWDM

IMAGE_NAME: ALCXWDM.SYS

DEBUG_FLR_IMAGE_TIMESTAMP: 45b86c39

SYMBOL_NAME: ALCXWDM+389b86

FAILURE_BUCKET_ID: 0x9C_IA32_GenuineIntel_ALCXWDM+389b86

BUCKET_ID: 0x9C_IA32_GenuineIntel_ALCXWDM+389b86

Followup: MachineOwner
---------

 

Hello allybaba and welcome to the Board,

Looks to me like you have a bad sound card.

I'm moving this to the Hardware section where the hardware people can advise on steps to take.

Added the sound card being bad to your thread title.

Regards - Charles

 

Hardware problem

The 1st minidump is crashed at TCPIP and it usually caused by faulty ram. The 2nd minidump is crashed with bugcheck code 9C which is related to hardware (ie m/b, CPU, ram, TV card and etc) but I don't think it is hardware problem of sound card.

 

Hi,
I have sinced reseated my memory into the other compatible slot - will see if this resolves that issue. When i ran the second dump through the debug wiz it seemed to point to a sys file which related to the sound card. As i said before i have downloaded the latest drivers from the motherboard manufacturers website. Would it be worth me disabling the on-board card if possible and see if the system then runs more stable ?

Al.

 

Hello allybaba,

To narrow this down, wait to see the results of switching the RAM stick, if no joy, then disable the sound card.

Regards - Charles

 

OK thanks Charles will see how it goes.

Regards

Al.

 

Hi,
I have switched on my PC this evening for it to crash within 5 minutes of switching on ! I have attached another screen dump. I also forgot to mention that i had also ran Memtest but with no errors. I only ran 1 loop. Would you recommend i run for a certain length of time ?

Thanks for your assistance
Al.

Microsoft (R) Windows Debugger Version 6.6.0007.5
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\WINDOWS\Minidump\Mini030107-02.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows XP Kernel Version 2600 (Service Pack 2) MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 2600.xpsp_sp2_gdr.050301-1519
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055c700
Debug session time: Thu Mar 1 18:13:58.500 2007 (GMT+0)
System Uptime: 0 days 0:00:35.073
Loading Kernel Symbols
.........................................................................................................................
Loading User Symbols
Loading unloaded module list
....
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 6, {0, 0, 0, 0}

Probably caused by : ntkrpamp.exe ( nt!KeUnstackDetachProcess+119 )

Followup: MachineOwner
---------

1: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

INVALID_PROCESS_DETACH_ATTEMPT (6)
Arguments:
Arg1: 00000000
Arg2: 00000000
Arg3: 00000000
Arg4: 00000000

Debugging Details:
------------------


CUSTOMER_CRASH_COUNT: 2

DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: 0x6

PROCESS_NAME: svchost.exe

LAST_CONTROL_TRANSFER: from 804f84f1 to 804f9c12

STACK_TEXT:
a7d7fcf0 804f84f1 00000006 00000000 8659dda8 nt!KeBugCheck+0x14
a7d7fd10 805badc1 a7d7fce8 a7d7fd64 0072fc90 nt!KeUnstackDetachProcess+0x119
a7d7fd04 86870009 00870009 a7d7fd04 805badc1 nt!ObpCloseHandle+0xb7
WARNING: Frame IP not in any known module. Following frames may be wrong.
a7d7fd44 805baec9 000002ac 00000001 00000000 0x86870009
a7d7fd58 8054060c 000002ac 0072fc94 7c90eb94 nt!NtClose+0x1d
a7d7fd58 7c90eb94 000002ac 0072fc94 7c90eb94 nt!KiFastCallEntry+0xfc
0072fc94 00000000 00000000 00000000 00000000 0x7c90eb94


STACK_COMMAND: kb

FOLLOWUP_IP:
nt!KeUnstackDetachProcess+119
804f84f1 cc int 3

SYMBOL_STACK_INDEX: 1

SYMBOL_NAME: nt!KeUnstackDetachProcess+119

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nt

IMAGE_NAME: ntkrpamp.exe

DEBUG_FLR_IMAGE_TIMESTAMP: 42250a1e

FAILURE_BUCKET_ID: 0x6_nt!KeUnstackDetachProcess+119

BUCKET_ID: 0x6_nt!KeUnstackDetachProcess+119

Followup: MachineOwner
---------

 

Hi Al,

An error involving ntkrpamp.exe does point to a RAM problem, AMD CPU's I think. The CPU also may be a problem.

An other idea, if you have hardware DEP enabled, disable it. Right click on My Computer > properties > Advanced tab > Performance section > Settings > Data Execution Prevention tab > tick for essential Windows programs.

If you haven't done so already, disable the sound card so it can be eliminated as the source one way or the other.

Regards - Charles

 

Run the memory diagnostics in my signature.

I would agree that because you are getting several different error/debug causes it would be due to basic hardware, not periferal hardware.

RAM would be most likely.

Look at the "monitors" section in the BIOS settings/configuration at startup. Are the voltages close and the temperatures reasonable?

Do you have a reasonable power supply?

Matt

 

Hi Charles / Mattman,

I have checked the DEP setting, it was already set to essential programs only.
I have looked in the hardware monitor section of the motherboard bios. Here is the info:-

CPU Temp 47 degrees c
Sys Temp 36 degrees c

Voltages

Vcore 1.184v
Vivdd 3.392v
Vdimm 1.792v
Vcc5v 5.080v
Sb3v 3.168v
Vbat 3.248v

I will post the power supply details later once i have had a look !

Let me know what you think guys.
Many Thanks

Al.

 

Downloads at the ECS website (yours is an M478?):
http://www.ecs.com.tw/ECSWebSite/Do...ver&DetailDesc=&CategoryID=1&MenuID=6&LanID=0
Install the updated VIA HyperionPro drivers if you have not done so already.

CPU temp might be something to watch. 47*C sounds OK at idle. There are programs that can let you monitor the temps from Windows (SpeedFan I think is one). If you have a small tower the temps can rise quickly if there is not enough movement of air through it. Intel have temperature cutout systems, just watch that these are not causing the restarts. Was the CPU "out of the box" when you installed it, with it's own thermal pad or did you use thermal paste to install the heatsink/fan?

I don't know the correct voltages for an Intel. If it was an AMD processor I might think the Vcore voltage was a little low. Maybe if someone has similar Pentium they might check theirs. Intel have some information and (I think) diagnostics for CPUs at their website. [If you are looking for things to try, look for a "Setup Defaults" setting/menu in the BIOS and see if the system becomes stable using that.]

Power supply, 300 Watts is the bare minimum for a system like that (without many pieces of added hardware). That 300W would need to be a good brand. If it was a generic brand PSU, 500W or more.

Did you get to check the RAM and disable the soundcard as suggested?

Matt

 

Hi Mattman,

Just to let you know the last day or so i have had no hangs but i downloaded the speedfan program as you suggested i installed it and have been playing a game and hopping in and out of it to see what is happening. The CPU temp seems to rise to about 55 and the hard disk about 50. To answer your other question the intel d processor i bought already had a fan bolted on so i did not need to do anything.

Let me know if you think the temps are too high. The tower i have is only a mini it has two 5 1/4 inch bays. Do you think i need to install another case fan ?

Regards

Al.

 

Those temps don't seem bad. An extra fan only costs a few dollars, just try to get a quiet one or you might find the noise distracting. You can try it, if it does not fix the problem you can keep it for if you might need it later. Another method is to leave the tower's cover off and direct a desk fan into it, then stress the system with the things you think might cause the restart.

Don't stray too far from the original suggestions though, we have all mentioned RAM as our first point. I know you might want it to be something quick and simple (I always wish that as well ). Get round to the RAM tests as soon as you can. Disable the soundcard.

I might be jumping ahead by suggesting the other tests and I don't want to distract you from the main ones.

Get an extra fan, especially if it would ease your mind that temperature might be a problem. As I said, they are not expensive.

Matt

 

OK,
Thanks Mattman - i will try the memory test program you suggested. I will have to bite the bullet at disable the card for a couple of days as well. Like you said i was kinda hoping it would be something simple

Thanks for all your help so far, will let you know how i get on.

 

Hi,

The other thing i have started to notice is that the random reboots have started to occur mainly during startup and shutdown of windows.

Any significance ?

Al.

 

I have ran the mem test as suggested, performed several loops no errors. Should i run for a longer length of time ?

Also i disabled the on-board sound card - as soon as i restarted the PC rebooted !

Let me know what you think

Thanks

Al.

 

If you have Hibernation enabled, disable it. Other than that rude interruption, its back to Matt's fine guidance.

 

Hi,

Just to let you know i have checked the hibernation setting and it is disabled.
Another thought........i don't think i mentioned in my original post that i have a sata drive 160gb. Is there a possibility this could be to blame ? Can you guys suggest any software to test ?

Thanks

Al.

 

Did you install the HyperionPro drivers? You mention the drive, these include the drive (SATA) controller drivers. The ECS website also have the VIA 4 in 1 drivers (IDE controller drivers) listed. These should be included on the drivers disk that came with the motherboard, so check if they have been installed.

Yes, startup and shutdown will be when data is read from and saved to, the HDD. Run Error Checking (chkdsk), see Help and Support, if you have more than one partition you will need to run the test on one partition/drive at a time.

Check what programs might be running at startup. Disable the antivirus for a few startups and shutdowns (reenable it when you go onto the internet). If you only have one antispyware program, get another like Spybot or Adaware and run it occasionally. If you think it might be due to a "junk" program trying to access the drive or the internet, post a Hijack This log in the Win XP forum or Security forum (if you think it is malicious) and ask if they could tell you what programs you can stop/get rid of.

Memtest has not shown problems so far, use the memory diagnostics in my signature. Try to set up the run for overnight or several hours while you are out.

Matt

 

Hi Mattman,

Sorry for long delay - not had chance to investigate further until now !

Updated hyperion drivers - no difference
Ran mem software in your signature - no errors found

Also swapped SATA to other channel on motherboard - no better !
Also installed IDE drive which used for short time until bought SATA - still the same ( so i guess we can rule out the hard disk !)

Regards

Al.