blue screen: driver or memory fault?

Hi,

I get several blue screens per day - probably from the very beginning (since I have this PC), but as I installed a lot of software at once, I don't know whether it's a hardware or software problem.

I post the result of the windbg below.

Some more info:

* When I first run the debugger (blue screen some days ago), the problem seemed to be caused by a driver: wpsdrvnt.sys. I was able to uninstall the software and the driver, but the blue screens went on.

* I get different addresses each time when I have a blue screen. Often the first address is the same, but not always. Examples:

0x0000004E (0x0000008F, 0x000202EF, 0xFFFFFFFF, 0x00000000)
0x0000004E (0xC0000005, 0x8061640B, 0xB7FFE958, 0x00000000)
0x0000004E (0x0000008F, 0x00000B9F, 0XFFFFFFFF, 0x00000000)

etc. Sometimes there is "PFN_LIST_CORRUPT ", sometimes "IRQL_NOT_LESS_OR_EQUAL ".


My questions:

* The log says, "if a kernel debugger is available get the stack trace ". Can anyone recommend a kernel debugger to me?

* I searched for similiar logs in the forum, there seem to be hints that this could be caused by memory fault (RAM, I assume; not driver fault), but I am absolutely not sure (I know almost nothing about this stuff, just a silly user ...). Is anybody able to analyze my log and give me a hint?

Thanks in advance for your support and best regards
Ulrike

Here is the windbg result of the latest blue screen:


Microsoft (R) Windows Debugger Version 6.6.0007.5
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\WINDOWS\MEMORY.DMP]
Kernel Complete Dump File: Full address space is available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows XP Kernel Version 2600 (Service Pack 2) MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 2600.xpsp_sp2_gdr.070227-2254
Kernel base = 0x804d7000 PsLoadedModuleList = 0x805624a0
Debug session time: Wed Apr 18 08:34:24.562 2007 (GMT+2)
System Uptime: 0 days 2:04:44.263
Loading Kernel Symbols
.............................................................................................................................................................
Loading User Symbols

Loading unloaded module list
..............
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 4E, {8f, db9f, ffffffff, 0}

Probably caused by : memory_corruption ( nt!MmZeroPageThread+130 )

Followup: MachineOwner
---------

1: kd> .reload
Loading Kernel Symbols
.............................................................................................................................................................
Loading User Symbols

Loading unloaded module list
..............
1: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

PFN_LIST_CORRUPT (4e)
Typically caused by drivers passing bad memory descriptor lists (ie: calling
MmUnlockPages twice with the same list, etc). If a kernel debugger is
available get the stack trace.
Arguments:
Arg1: 0000008f, The free or zeroed page listhead is corrupt
Arg2: 0000db9f, new page
Arg3: ffffffff, old page
Arg4: 00000000, 0

Debugging Details:
------------------


DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: 0x4E

PROCESS_NAME: System

LAST_CONTROL_TRANSFER: from 8052830d to 8053738a

STACK_TEXT:
f7c45800 8052830d 0000004e 0000008f 0000db9f nt!KeBugCheckEx+0x1b
f7c45840 806ad2bd 867c4548 00000000 00000044 nt!MmZeroPageThread+0x130
f7c45dac 80574128 80087000 00000000 00000000 nt!Phase1Initialization+0x1287
f7c45ddc 804ec781 806ae7cf 80087000 00000000 nt!PspSystemThreadStartup+0x34
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16


STACK_COMMAND: kb

FOLLOWUP_IP:
nt!MmZeroPageThread+130
8052830d cc int 3

SYMBOL_STACK_INDEX: 1

SYMBOL_NAME: nt!MmZeroPageThread+130

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nt

DEBUG_FLR_IMAGE_TIMESTAMP: 45e54690

IMAGE_NAME: memory_corruption

FAILURE_BUCKET_ID: 0x4E_nt!MmZeroPageThread+130

BUCKET_ID: 0x4E_nt!MmZeroPageThread+130

Followup: MachineOwner
---------

 

next blue screen

Hi,

this time I got a bluescreen immediately after restart. Blue screen information:

IRQL_NOT_LESS_OR_EQUAL
0x0000000A (0x80800001, 0x00000002, 0x00000000, 0x804F1F04)

So there seems to be a lot of different error messages, sometimes the same for several blue screens, sometimes something new. Is this a hint for ... ANYTHING? For examle, does it mean that it is probably a hardware (e.g. RAM) fault, not a driver problem? Or is it just normal for "blue screen situations" that there are a lot of different error messages?

See log below. But I don't know whether the debugging worked correctly - I tried to understand the meaning of the "symbols" but I didn't, so I am not sure what it means when "symbols could not be loaded ": caused by the blue screen itself, or caused by an error in my symbol path so that the debugger could not work correctly? My symbol path is

SRV*c:\symbols*http://msdl.microsoft.com/download/symbols

Any hint is welcome - I am lost. Thanks and best regards
Ulrike


Microsoft (R) Windows Debugger Version 6.6.0007.5
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\WINDOWS\MEMORY.DMP]
Kernel Complete Dump File: Full address space is available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows XP Kernel Version 2600 (Service Pack 2) MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 2600.xpsp_sp2_gdr.070227-2254
Kernel base = 0x804d7000 PsLoadedModuleList = 0x805624a0
Debug session time: Thu Apr 19 06:34:38.671 2007 (GMT+2)
System Uptime: 0 days 0:03:19.365
Loading Kernel Symbols
...........................................................................................................................................................
Loading User Symbols
..........................................................................................
Loading unloaded module list
.........................
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck A, {80800001, 2, 0, 804f1f04}

*** ERROR: Module load completed but symbols could not be loaded for pavdrv51.sys
*** ERROR: Module load completed but symbols could not be loaded for av5flt.sys
*** WARNING: Unable to verify checksum for VCL50.BPL
*** ERROR: Module load completed but symbols could not be loaded for VCL50.BPL
*** WARNING: Unable to verify checksum for LangM5.dll
*** ERROR: Module load completed but symbols could not be loaded for LangM5.dll
*** WARNING: Unable to verify checksum for Config.dll
*** ERROR: Module load completed but symbols could not be loaded for Config.dll
*** WARNING: Unable to verify checksum for CC3250MT.DLL
*** ERROR: Module load completed but symbols could not be loaded for CC3250MT.DLL
*** ERROR: Module load completed but symbols could not be loaded for APVXDWIN.EXE
*** WARNING: Unable to verify checksum for StoreMan.dll
*** ERROR: Symbol file could not be found. Defaulted to export symbols for StoreMan.dll -
Probably caused by : hardware ( pavdrv51+eea )

Followup: MachineOwner
---------

1: kd> .reload
Loading Kernel Symbols
...........................................................................................................................................................
Loading User Symbols
..........................................................................................
Loading unloaded module list
.........................
1: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 80800001, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000000, value 0 = read operation, 1 = write operation
Arg4: 804f1f04, address which referenced memory

Debugging Details:
------------------

*** ERROR: Module load completed but symbols could not be loaded for pavdrv51.sys
*** ERROR: Module load completed but symbols could not be loaded for av5flt.sys
*** WARNING: Unable to verify checksum for VCL50.BPL
*** ERROR: Module load completed but symbols could not be loaded for VCL50.BPL
*** WARNING: Unable to verify checksum for LangM5.dll
*** ERROR: Module load completed but symbols could not be loaded for LangM5.dll
*** WARNING: Unable to verify checksum for Config.dll
*** ERROR: Module load completed but symbols could not be loaded for Config.dll
*** WARNING: Unable to verify checksum for CC3250MT.DLL
*** ERROR: Module load completed but symbols could not be loaded for CC3250MT.DLL
*** ERROR: Module load completed but symbols could not be loaded for APVXDWIN.EXE
*** WARNING: Unable to verify checksum for StoreMan.dll
*** ERROR: Symbol file could not be found. Defaulted to export symbols for StoreMan.dll -

READ_ADDRESS: 80800001

CURRENT_IRQL: 2

FAULTING_IP:
nt!ExpFindCurrentThread+75
804f1f04 8b01 mov eax,dword ptr [ecx]

DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: 0xA

PROCESS_NAME: apvxdwin.exe

TRAP_FRAME: b7b7fac4 -- (.trap ffffffffb7b7fac4)
ErrCode = 00000000
eax=55ff8bcc ebx=d86eece9 ecx=80800001 edx=804dcc51 esi=b7b7fc78 edi=85c3ea28
eip=804f1f04 esp=b7b7fb38 ebp=b7b7fb58 iopl=0 nv up ei ng nz ac pe cy
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010297
nt!ExpFindCurrentThread+0x75:
804f1f04 8b01 mov eax,dword ptr [ecx] ds:0023:80800001=????????
Resetting default scope

MISALIGNED_IP:
nt!ExpFindCurrentThread+75
804f1f04 8b01 mov eax,dword ptr [ecx]

LAST_CONTROL_TRANSFER: from 804f1f04 to 804e0aac

STACK_TEXT:
b7b7fac4 804f1f04 badb0d00 804dcc51 e23a0020 nt!KiTrap0E+0x238
b7b7fb58 804e19c0 b7b7fb70 b7b5fcd8 e1214d90 nt!ExpFindCurrentThread+0x75
b7b7fb7c f76bac22 b7b7fc78 8057544c e23a0020 nt!ExAcquireResourceSharedLite+0x51
b7b5fbc4 f77459a2 853cbb40 b7b5fcd8 00000005 Ntfs!NtfsCopyReadA+0xa6
b7b5fbec b8ac8eea 853cbb40 b7b5fcd8 00000005 sr!SrFastIoRead+0x40
WARNING: Stack unwind information not available. Following frames may be wrong.
b7b5fc44 b7ada1fe 853cbb40 b7b5fcd8 00000005 pavdrv51+0xeea
b7b5fc9c 80581aae 853cbb40 b7b5fcd8 00000005 av5flt+0x11fe
b7b5fd38 804dd99f 0000042c 00000000 00000000 nt!NtReadFile+0x2c4
b7b5fd38 7c91eb94 0000042c 00000000 00000000 nt!KiFastCallEntry+0xfc
0013edc4 7c91e288 7c801875 0000042c 00000000 ntdll!KiFastSystemCallRet
0013edc8 7c801875 0000042c 00000000 00000000 ntdll!NtReadFile+0xc
0013ee30 4000dad1 0000042c 00e36f68 00000005 kernel32!ReadFile+0x16c
0013eeac 032d1ca9 0013eefc 032d1d0f 0013eeec VCL50+0xdad1
0013eeec 032c7088 000004e4 00000001 0013ef08 LangM5+0x11ca9
0013f13c 032c4525 0013f101 00000002 032c5ebc LangM5+0x7088
0013f174 032c1947 00000004 00000004 00000000 LangM5+0x4525
0013f270 032c2fb1 00000001 0013f201 032c0000 LangM5+0x1947
0013f2b4 3b691f7a 0013f3e0 00000004 00000001 LangM5+0x2fb1
0013f4e4 3b69191b 3b6ff818 ffffffff 00000001 Config+0x1f7a
0013f500 3257e6bb 3b690000 00000001 00000000 Config+0x191b
0013f520 3257e448 3b6918f4 3b690000 00000001 CC3250MT+0x7e6bb
0013f54c 3b6910f4 3b6ff700 7c9111a7 3b690000 CC3250MT+0x7e448
0013f574 7c92cbab 3b691000 3b690000 00000001 Config+0x10f4
0013f67c 7c926178 00000000 c0150008 00000000 ntdll!LdrpRunInitializeRoutines+0x344
0013f928 7c9262da 00000000 001c8078 0013fc1c ntdll!LdrpLoadDll+0x3e5
0013fbd0 7c801bb9 001c8078 0013fc1c 0013fbfc ntdll!LdrLoadDll+0x230
0013fc38 7c801d6e 7ffdfc00 00000000 00000008 kernel32!LoadLibraryExW+0x18e
0013fc4c 3ccb1807 0013fc64 00000000 00000008 kernel32!LoadLibraryExA+0x1f
0013fd68 3cca705e 3cccbb90 00000000 3ccb8932 APVXDWIN+0x11807
0013fd90 3ccb3629 0013ff24 00002d06 00000000 APVXDWIN+0x705e
0013ff34 3ccbbaa0 3cca0000 00000000 00152419 APVXDWIN+0x13629
0013ffc0 7c816fd7 00002d06 00002cec 7ffd4000 APVXDWIN+0x1baa0
0013fff0 00000000 3ccbb9c0 00000000 78746341 kernel32!BaseProcessStart+0x23


STACK_COMMAND: kb

FOLLOWUP_IP:
pavdrv51+eea
b8ac8eea 8845e7 mov byte ptr [ebp-19h],al

SYMBOL_STACK_INDEX: 5

SYMBOL_NAME: pavdrv51+eea

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: hardware

IMAGE_NAME: hardware

DEBUG_FLR_IMAGE_TIMESTAMP: 0

FAILURE_BUCKET_ID: IP_MISALIGNED

BUCKET_ID: IP_MISALIGNED

Followup: MachineOwner
---------

 

While you wait for an expert to answer, have you tried running Memtest? This will help rule out RAM issues. Also, have you tried Microsoft's built in chkdsk?

 

If you are getting different error results each time, it might be more likely to be a hardware problem.

Run the memory diagnostics in my signature. If you have more than one module, you can try running on each individually (this is in the memory diagnostics information).

Try here for updated symbols:
http://www.microsoft.com/whdc/devtools/debugging/symbolpkg.mspx

Matt