BDOD on startup (with DUMP DATA)

Hi,

BSODs started to happen on the startup of my Windows 2000 installation. It does not happen on every startup and here goes what I got from running debugwiz over the most recent dump generated by Dr. Watson:


Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: C:\WINNT;C:\WINNT\system32;C:\WINNT\system32\drivers
Windows 2000 Version 2195 UP Free x86 compatible
Product: WinNt
Machine Name:
Debug session time: Fri Feb 13 22:33:03.194 2009 (GMT-3)
System Uptime: 0 days 0:01:33.854
Process Uptime: not available
........................................................
(100.31c): Access violation - code c0000005 (!!! second chance !!!)
eax=784af074 ebx=01830000 ecx=00000101 edx=ffffffff esi=7972250d edi=01830000
eip=78495913 esp=0193ff8c ebp=0193ff98 iopl=0 nv up ei pl nz na po nc
cs=001b ss=0023 ds=0023 es=0023 fs=0038 gs=0000 efl=00000202
ntdll!_stricmp+0x23:
78495913 8a27 mov ah,byte ptr [edi] ds:0023:01830000=??
0:008> !analyze -v;r;kv;lmtn;.logclose;q
*******************************************************************************
* *
* Exception Analysis *
* *
*******************************************************************************

*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: ntdll!_PEB ***
*** ***
*************************************************************************
*** ERROR: Symbol file could not be found. Defaulted to export symbols for gbieh.dll -
*** ERROR: Symbol file could not be found. Defaulted to export symbols for gbiehabn.dll -
*** WARNING: symbols timestamp is wrong 0x44ef1374 0x3ef3329d for COMCTL32.dll
*** ERROR: Symbol file could not be found. Defaulted to export symbols for ATL.DLL -
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: IMAGE_NT_HEADERS32 ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: kernel32!pNlsUserInfo ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: kernel32!pNlsUserInfo ***
*** ***
*************************************************************************

FAULTING_IP:
ntdll!_stricmp+23
78495913 8a27 mov ah,byte ptr [edi]

EXCEPTION_RECORD: ffffffff -- (.exr 0xffffffffffffffff)
.exr 0xffffffffffffffff
ExceptionAddress: 78495913 (ntdll!_stricmp+0x00000023)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 00000000
Parameter[1]: 01830000
Attempt to read from address 01830000

FAULTING_THREAD: 0000031c

PROCESS_NAME: winlogon.exe

ERROR_CODE: (NTSTATUS) 0xc0000005 - A instru o no "0x%08lx" fez refer ncia mem ria no "0x%08lx ". A mem ria n o p de ser "%s ".

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - A instru o no "0x%08lx" fez refer ncia mem ria no "0x%08lx ". A mem ria n o p de ser "%s ".

EXCEPTION_PARAMETER1: 00000000

EXCEPTION_PARAMETER2: 01830000

READ_ADDRESS: 01830000

FOLLOWUP_IP:
ntdll!_stricmp+23
78495913 8a27 mov ah,byte ptr [edi]

BUGCHECK_STR: APPLICATION_FAULT_INVALID_POINTER_READ_FILL_PATTERN_ffffffff

PRIMARY_PROBLEM_CLASS: INVALID_POINTER_READ_FILL_PATTERN_ffffffff

DEFAULT_BUCKET_ID: INVALID_POINTER_READ_FILL_PATTERN_ffffffff

LAST_CONTROL_TRANSFER: from 7974028b to 78495913

STACK_TEXT:
0193ff98 7974028b 01830000 7972250c 00000000 ntdll!_stricmp+0x23
0193ffb4 7972b3bc 01830000 00000000 00000000 KERNEL32!LoadLibraryA+0x1e
0193ffec 00000000 7974026d 01830000 00000000 KERNEL32!BaseThreadStart+0x52


SYMBOL_STACK_INDEX: 0

SYMBOL_NAME: ntdll!_stricmp+23

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: ntdll

IMAGE_NAME: ntdll.dll

DEBUG_FLR_IMAGE_TIMESTAMP: 42a0696d

STACK_COMMAND: ~8s ; kb

FAILURE_BUCKET_ID: INVALID_POINTER_READ_FILL_PATTERN_ffffffff_c0000005_ntdll.dll!_stricmp

BUCKET_ID: APPLICATION_FAULT_INVALID_POINTER_READ_FILL_PATTERN_ffffffff_ntdll!_stricmp+23

WATSON_STAGEONE_URL: http://watson.microsoft.com/StageOn...006/42a0696d/c0000005/00035913.htm?Retriage=1

Followup: MachineOwner
---------

eax=784af074 ebx=01830000 ecx=00000101 edx=ffffffff esi=7972250d edi=01830000
eip=78495913 esp=0193ff8c ebp=0193ff98 iopl=0 nv up ei pl nz na po nc
cs=001b ss=0023 ds=0023 es=0023 fs=0038 gs=0000 efl=00000202
ntdll!_stricmp+0x23:
78495913 8a27 mov ah,byte ptr [edi] ds:0023:01830000=??
ChildEBP RetAddr Args to Child
0193ff98 7974028b 01830000 7972250c 00000000 ntdll!_stricmp+0x23
0193ffb4 7972b3bc 01830000 00000000 00000000 KERNEL32!LoadLibraryA+0x1e (FPO: [Non-Fpo])
0193ffec 00000000 7974026d 01830000 00000000 KERNEL32!BaseThreadStart+0x52 (FPO: [Non-Fpo])
start end module name
01000000 01031000 winlogon winlogon.exe Fri Apr 01 22:23:44 2005 (424DF420)
02150000 02214000 gbieh gbieh.dll Thu Aug 14 15:03:31 2008 (48A47373)
02ab0000 02ac1000 wzcdlg wzcdlg.dll Wed Sep 11 21:01:52 2002 (3D7FD970)
02ad0000 02ada000 WZCSAPI WZCSAPI.DLL Wed Sep 11 21:01:51 2002 (3D7FD96F)
10000000 100bb000 gbiehabn gbiehabn.dll Wed May 14 10:53:04 2008 (482AEEC0)
65610000 6561d000 WINSTA WINSTA.dll Fri Jun 20 13:13:59 2003 (3EF332C7)
66600000 66607000 umdmxfrm umdmxfrm.dll Sat Jan 22 20:13:00 2000 (388A397C)
67ee0000 67fd1000 sfcfiles sfcfiles.dll Fri Jun 03 11:30:28 2005 (42A06984)
68070000 68077000 serwvdrv serwvdrv.dll Sat Jan 22 20:12:42 2000 (388A396A)
68fe0000 68feb000 PROFMAP PROFMAP.dll Fri Jun 03 11:30:26 2005 (42A06982)
69af0000 69b0d000 NTMARTA NTMARTA.DLL Fri Jun 20 13:13:47 2003 (3EF332BB)
70a70000 70ad6000 SHLWAPI SHLWAPI.dll Wed Oct 15 18:11:48 2008 (48F65C94)
71710000 71794000 COMCTL32 COMCTL32.dll Fri Aug 25 12:12:52 2006 (44EF1374)
74fd0000 74fd8000 WS2HELP WS2HELP.DLL Sat Jan 22 20:09:56 2000 (388A38C4)
74fe0000 74ff4000 WS2_32 WS2_32.DLL Fri Jun 20 13:13:59 2003 (3EF332C7)
75000000 75009000 WSOCK32 WSOCK32.dll Fri Jun 20 13:13:59 2003 (3EF332C7)
75100000 75110000 SAMLIB SAMLIB.dll Fri Jun 03 11:30:28 2005 (42A06984)
75170000 75176000 NETRAP NETRAP.dll Sat Jan 22 20:09:54 2000 (388A38C2)
75530000 75554000 certcli certcli.dll Fri Jun 20 13:13:22 2003 (3EF332A2)
75980000 75986000 LZ32 LZ32.DLL Fri Jun 20 13:13:21 2003 (3EF332A1)
768f0000 76900000 WlNotify WlNotify.dll Fri Jun 03 11:30:11 2005 (42A06973)
76900000 7692b000 wintrust wintrust.dll Fri Jun 03 11:30:11 2005 (42A06973)
76930000 76947000 WinSCard WinSCard.dll Fri Jun 20 13:13:19 2003 (3EF3329F)
76950000 7696b000 sfc sfc.dll Fri Jun 20 13:13:19 2003 (3EF3329F)
76970000 76977000 NDdeApi NDdeApi.dll Fri Jun 20 13:13:19 2003 (3EF3329F)
76980000 769dc000 msgina msgina.dll Fri Jun 03 11:30:11 2005 (42A06973)
769e0000 769e5000 mscat32 mscat32.dll Sat Jan 22 20:09:30 2000 (388A38AA)
770a0000 770c3000 cscdll cscdll.dll Fri Jun 20 13:13:18 2003 (3EF3329E)
77120000 7718f000 RPCRT4 RPCRT4.dll Tue Jul 17 03:42:17 2007 (469C64C9)
773c0000 773d5000 ATL ATL.DLL Fri Jun 20 13:13:18 2003 (3EF3329E)
77410000 77421000 MSASN1 MSASN1.dll Fri Jun 03 11:30:09 2005 (42A06971)
77540000 77548000 wdmaud wdmaud.drv Fri Jun 20 13:13:18 2003 (3EF3329E)
77550000 77581000 WINMM WINMM.dll Sat Jan 22 20:09:18 2000 (388A389E)
77800000 7781e000 WINSPOOL WINSPOOL.DRV Fri Jun 20 13:13:18 2003 (3EF3329E)
77820000 77827000 VERSION VERSION.dll Fri Jun 20 13:13:18 2003 (3EF3329E)
77850000 7788e000 cscui cscui.dll Fri Jun 20 13:13:18 2003 (3EF3329E)
77920000 77943000 IMAGEHLP IMAGEHLP.dll Fri Jun 20 13:13:18 2003 (3EF3329E)
77950000 7797c000 WLDAP32 WLDAP32.DLL Fri Apr 08 08:54:29 2005 (425670F5)
77980000 779a4000 DNSAPI DNSAPI.DLL Wed Jun 25 06:41:24 2008 (486212C4)
779b0000 77a4c000 oleaut32 oleaut32.dll Wed Dec 05 07:39:23 2007 (47567FDB)
77bf0000 77c01000 NTDSAPI NTDSAPI.dll Fri Jun 20 13:13:17 2003 (3EF3329D)
77e10000 77e6f000 USER32 USER32.dll Tue Mar 06 08:17:10 2007 (45ED4DB6)
77f40000 77f7d000 GDI32 GDI32.dll Thu Oct 23 02:27:14 2008 (49000B32)
78000000 78045000 MSVCRT MSVCRT.dll Tue Mar 11 15:55:17 2003 (3E6E3115)
783c0000 78450000 setupapi setupapi.dll Fri Jun 20 13:13:18 2003 (3EF3329E)
78460000 784e0000 ntdll ntdll.dll Fri Jun 03 11:30:05 2005 (42A0696D)
790d0000 79135000 USERENV USERENV.dll Fri Jun 03 11:30:06 2005 (42A0696E)
792d0000 79335000 ADVAPI32 ADVAPI32.dll Fri Jun 03 11:30:05 2005 (42A0696D)
793b0000 793bf000 Secur32 Secur32.dll Fri Jun 20 13:13:17 2003 (3EF3329D)
79720000 797db000 KERNEL32 KERNEL32.dll Mon Apr 16 09:43:37 2007 (46236F79)
797f0000 79801000 MPR MPR.DLL Mon Apr 16 09:43:37 2007 (46236F79)
79910000 7999d000 CRYPT32 CRYPT32.dll Fri Jun 03 11:30:09 2005 (42A06971)
7ca00000 7ca23000 rsaenh rsaenh.dll Fri Oct 18 03:17:02 2002 (3DAFA75E)
7ce00000 7ce50000 NETAPI32 NETAPI32.dll Fri Oct 17 14:41:27 2008 (48F8CE47)
7ce60000 7cf4f000 ole32 ole32.dll Mon Sep 05 05:17:20 2005 (431BFF10)
7cf70000 7d1bb000 SHELL32 SHELL32.dll Thu Jul 13 04:08:48 2006 (44B5F180)


Does anyone have a clue of what might have caused the error ? I can post the Dr. Watson log, if need be.

Thanks

 

Yeah, I had also seen those messages regarding symbols. However, I had already downloaded all the installables from http://www.microsoft.com/whdc/DevTools/Debugging/symbolpkg.mspx before running debugwiz. Not sure what is happening :-(