XP Shutdown (no blue screen)

Hello!
can anyone help me resolve this issue, i was doing good on my dell optiplex 330 under Windows XP sp3, but i got an shutdown unexpected and a dump was saved on C:\WINDOWS\Minidump \ Mini050309-01.dmp
debugged with winDbg and here are the result:
---------------------------------------------


Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\WINDOWS\Minidump\Mini050309-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows XP Kernel Version 2600 (Service Pack 3) MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 2600.xpsp_sp3_gdr.090206-1234
Machine Name:
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055d720
Debug session time: Sun May 3 17:51:22.859 2009 (GMT+2)
System Uptime: 3 days 1:11:46.583
Loading Kernel Symbols
...............................................................
................................................................
....
Loading User Symbols
Loading unloaded module list
..................................................
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 96, {8a28ad00, 8056485c, 80564820, 80576ac2}

Probably caused by : ntkrpamp.exe ( nt!IopProcessWorkItem+0 )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

INVALID_WORK_QUEUE_ITEM (96)
This message occurs when KeRemoveQueue removes a queue entry whose flink
or blink field is null. This is almost always called by code misusing
worker thread work items, but any queue misuse can cause this. The rule
is that an entry on a queue may only be inserted on the list once. When an
item is removed from a queue, it's flink field is set to NULL. This bugcheck
occurs when remove queue attempts to remove an entry, but the flink or blink
field is NULL. In order to debug this problem, you need to know the queue being
referenced.
In an attempt to help identify the guilty driver, this bugcheck assumes the
queue is a worker queue (ExWorkerQueue) and prints the worker routine as
parameter 4 below.
Arguments:
Arg1: 8a28ad00, The address of the queue entry whose flink/blink field is NULL
Arg2: 8056485c, The address of the queue being references. Usually this is one
of the ExWorkerQueues.
Arg3: 80564820, The base address of the ExWorkerQueue array. This will help determine
if the queue in question is an ExWorkerQueue and if so, the offset from
this parameter will isolate the queue.
Arg4: 80576ac2, If this is an ExWorkerQueue (which it usually is), this is the address
of the worker routine that would have been called if the work item was
valid. This can be used to isolate the driver that is misusing the work
queue.

Debugging Details:
------------------


WORKER_ROUTINE:
nt!IopProcessWorkItem+0
80576ac2 8bff mov edi,edi

FAULTING_IP:
nt!IopProcessWorkItem+0
80576ac2 8bff mov edi,edi

WORK_ITEM: 8a28ad00

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: 0x96

PROCESS_NAME: System

LAST_CONTROL_TRANSFER: from 804fcd80 to 804f9f43

STACK_TEXT:
ba4f7d34 804fcd80 00000096 8a28ad00 8056485c nt!KeBugCheckEx+0x1b
ba4f7d74 8053875a 00000001 00000001 00000000 nt!KeRemoveQueue+0x314
ba4f7dac 805cff70 8a28ad00 00000000 00000000 nt!ExpWorkerThread+0xcc
ba4f7ddc 805460ee 8053868e 00000001 00000000 nt!PspSystemThreadStartup+0x34
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16


STACK_COMMAND: .bugcheck ; kb

FOLLOWUP_IP:
nt!IopProcessWorkItem+0
80576ac2 8bff mov edi,edi

SYMBOL_NAME: nt!IopProcessWorkItem+0

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nt

IMAGE_NAME: ntkrpamp.exe

DEBUG_FLR_IMAGE_TIMESTAMP: 498c11d3

FAILURE_BUCKET_ID: 0x96_nt!IopProcessWorkItem+0

BUCKET_ID: 0x96_nt!IopProcessWorkItem+0

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

INVALID_WORK_QUEUE_ITEM (96)
This message occurs when KeRemoveQueue removes a queue entry whose flink
or blink field is null. This is almost always called by code misusing
worker thread work items, but any queue misuse can cause this. The rule
is that an entry on a queue may only be inserted on the list once. When an
item is removed from a queue, it's flink field is set to NULL. This bugcheck
occurs when remove queue attempts to remove an entry, but the flink or blink
field is NULL. In order to debug this problem, you need to know the queue being
referenced.
In an attempt to help identify the guilty driver, this bugcheck assumes the
queue is a worker queue (ExWorkerQueue) and prints the worker routine as
parameter 4 below.
Arguments:
Arg1: 8a28ad00, The address of the queue entry whose flink/blink field is NULL
Arg2: 8056485c, The address of the queue being references. Usually this is one
of the ExWorkerQueues.
Arg3: 80564820, The base address of the ExWorkerQueue array. This will help determine
if the queue in question is an ExWorkerQueue and if so, the offset from
this parameter will isolate the queue.
Arg4: 80576ac2, If this is an ExWorkerQueue (which it usually is), this is the address
of the worker routine that would have been called if the work item was
valid. This can be used to isolate the driver that is misusing the work
queue.

Debugging Details:
------------------


WORKER_ROUTINE:
nt!IopProcessWorkItem+0
80576ac2 8bff mov edi,edi

FAULTING_IP:
nt!IopProcessWorkItem+0
80576ac2 8bff mov edi,edi

WORK_ITEM: 8a28ad00

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: 0x96

PROCESS_NAME: System

LAST_CONTROL_TRANSFER: from 804fcd80 to 804f9f43

STACK_TEXT:
ba4f7d34 804fcd80 00000096 8a28ad00 8056485c nt!KeBugCheckEx+0x1b
ba4f7d74 8053875a 00000001 00000001 00000000 nt!KeRemoveQueue+0x314
ba4f7dac 805cff70 8a28ad00 00000000 00000000 nt!ExpWorkerThread+0xcc
ba4f7ddc 805460ee 8053868e 00000001 00000000 nt!PspSystemThreadStartup+0x34
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16


STACK_COMMAND: .bugcheck ; kb

FOLLOWUP_IP:
nt!IopProcessWorkItem+0
80576ac2 8bff mov edi,edi

SYMBOL_NAME: nt!IopProcessWorkItem+0

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nt

IMAGE_NAME: ntkrpamp.exe

DEBUG_FLR_IMAGE_TIMESTAMP: 498c11d3

FAILURE_BUCKET_ID: 0x96_nt!IopProcessWorkItem+0

BUCKET_ID: 0x96_nt!IopProcessWorkItem+0

Followup: MachineOwner
---------

0: kd> lmvm nt
start end module name
804d7000 806e4000 nt # (pdb symbols) c:\symbols\ntkrpamp.pdb\909FE6B806E4444B9230BAAF21EC5C271\ntkrpamp.pdb
Loaded symbol image file: ntkrpamp.exe
Mapped memory image file: c:\symbols\ntkrpamp.exe\498C11D320d000\ntkrpamp.exe
Image path: ntkrpamp.exe
Image name: ntkrpamp.exe
Timestamp: Fri Feb 06 11:32:51 2009 (498C11D3)
CheckSum: 001F9D43
ImageSize: 0020D000
File version: 5.1.2600.5755
Product version: 5.1.2600.5755
File flags: 0 (Mask 3F)
File OS: 40004 NT Win32
File type: 1.0 App
File date: 00000000.00000000
Translations: 0405.04b0
CompanyName: Microsoft Corporation
ProductName: Operační systém Microsoft® Windows®
InternalName: ntkrpamp.exe
OriginalFilename: ntkrpamp.exe
ProductVersion: 5.1.2600.5755
FileVersion: 5.1.2600.5755 (xpsp_sp3_gdr.090206-1234)
FileDescription: NT Kernel & System
LegalCopyright: © Microsoft Corporation. VÅ¡echna práva vyhrazena.

-----------------------------------------------------------------------
this is my first death screen "not blue" just turned off like if i did turned off the power or shutdown with button. no idea what have caused it? the logs said DRIVER errors but haven't idea what is the cause, please can anyone can explain what to do, or what have caused it?
ps. sorry if i posted something twice, but i've just copy/paste the debug logs.

Thank you

 

Hi and welcome to the BBS,

If there has only been one shutdown, it may have been a glitch. It's when you start getting a few that you need to investigate. I have a game and started having quite a few blue screens. I knew the game was a little buggy and didn't do anything about it, it seems to have fixed itself

Update any drivers you can at the dell website, use the Service Tag information to find your hardware configuration. Look at the date of the chipset driver updates, if they are several years old, look at getting them from the chipset manufacturer (Intel?).

Has the computer case been cleaned of dust build up?

Matt

 

Hello Matt,
Thank you for the warm-welcome.

It's been one and half year since i've buy this pc "dell optiplex 330" and never got any problem since yesterday that it turned off for the first time (without blue screen message).Also never had problem with virus and spyware, i always use Kaspersky since first day, and Spybot for anti spyware, i check it regulary and never good problem with virus and spyware.

Okay, thank you i'll check service tag this time.

Admin: Please only post Malware logs in the Malware forum