BSOD after system setting idle for 8 hours

MitchellCooley · 2008/05/13

Have a friends computer at home to clean up and work on. He has had several crashes (usually while playing monopoly or on the internet). I upgraded the video and ethernet drivers - his were very old. System was fine all day yesterday but crashed when I got home and opened IE7.

System is VIA chipset AMD Athlon 1.7GHz, 512 MB RAM, 80GB HD Runnign XP Home.

Here is the dump file: Hope someone can point me in the right direction

Opened log file 'c:\debuglog.txt'

Microsoft (R) Windows Debugger Version 6.9.0003.113 X86
Copyright (c) Microsoft Corporation. All rights reserved.

Loading Dump File [C:\WINDOWS\Minidump\Mini051308-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: C:\WINDOWS;C:\WINDOWS\system32;C:\WINDOWS\system32\drivers
Windows XP Kernel Version 2600 (Service Pack 2) UP Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 2600.xpsp_sp2_gdr.070227-2254
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055a620
Debug session time: Tue May 13 03:46:40.954 2008 (GMT-5)
System Uptime: 0 days 8:50:40.512
Loading Kernel Symbols
...................................................................................................................
Loading User Symbols
Loading unloaded module list
............
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 19, {20, 83d1b9f8, 83d1c8e0, ffdd0013}

*** ERROR: Module load completed but symbols could not be loaded for aswMon2.SYS
Probably caused by : aswMon2.SYS ( aswMon2+6a1e )

Followup: MachineOwner
---------

kd> !analyze -v;r;kv;lmtn;.logclose;q
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

BAD_POOL_HEADER (19)
The pool is already corrupt at the time of the current request.
This may or may not be due to the caller.
The internal pool links must be walked to figure out a possible cause of
the problem, and then special pool applied to the suspect tags or the driver
verifier to a suspect driver.
Arguments:
Arg1: 00000020, a pool block header size is corrupt.
Arg2: 83d1b9f8, The pool entry we were looking for within the page.
Arg3: 83d1c8e0, The next pool entry.
Arg4: ffdd0013, (reserved)

Debugging Details:
------------------

BUGCHECK_STR: 0x19_20

POOL_ADDRESS: 83d1b9f8

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: DRIVER_FAULT

PROCESS_NAME: System

LAST_CONTROL_TRANSFER: from 8054b941 to 8053354e

STACK_TEXT:
f79ac9d0 8054b941 00000019 00000020 83d1b9f8 nt!KeBugCheckEx+0x1b
f79aca20 f73f84f2 83d1ba00 00000000 f79aca80 nt!ExFreePoolWithTag+0x2be
f79aca34 f7431025 83d1ba00 843349b0 e16ea8e0 Ntfs!NtfsFreeEresource+0x76
f79aca58 f73f83bf 830a47e0 f79aca80 f79aca8b Ntfs!NtfsDeleteFcb+0x4e
f79acaa4 f7419c7c 830a47e0 84334850 e2253988 Ntfs!NtfsTeardownFromLcb+0x1fd
f79acafc f73f47b0 830a47e0 e2253a50 e2253be8 Ntfs!NtfsTeardownStructures+0x125
f79acb28 f74174b5 830a47e0 01253a50 e2253be8 Ntfs!NtfsDecrementCloseCounts+0x9e
f79acbac f7417254 830a47e0 e2253a50 e2253988 Ntfs!NtfsCommonClose+0x397
f79acc4c 804e37f7 84334770 83079008 83079008 Ntfs!NtfsFsdClose+0x21f
f79acc5c f749a09e 83079008 8432a940 830791e0 nt!IopfCallDriver+0x31
f79acc88 804e37f7 83f50d78 83079008 00000000 fltmgr!FltpDispatch+0x152
f79acc98 f116da1e 83079018 83fe52e0 839158c8 nt!IopfCallDriver+0x31
WARNING: Stack unwind information not available. Following frames may be wrong.
f79accbc f116783c 83fc99c0 00079008 804e37f7 aswMon2+0x6a1e
f79acce0 804e37f7 83d9a020 83079008 83079008 aswMon2+0x83c
f79accf0 8056a749 839158b0 00000000 00000000 nt!IopfCallDriver+0x31
f79acd28 80563af7 009158c8 839158b0 00000000 nt!IopDeleteFile+0x132
f79acd44 804e36d5 839158c8 00000000 806ed03c nt!ObpRemoveObjectRoutine+0xdf
f79acd68 804f2da1 8055ecb4 83ee4800 00000000 nt!ObfDereferenceObject+0x5f
f79acd8c 80515ba3 e1e11ad0 00000000 843c66d0 nt!MiSegmentDelete+0xdd
f79acdac 8057d0f1 00000000 00000000 00000000 nt!MiDereferenceSegmentThread+0x9e
f79acddc 804f827a 80506905 00000000 00000000 nt!PspSystemThreadStartup+0x34
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16

STACK_COMMAND: kb

FOLLOWUP_IP:
aswMon2+6a1e
f116da1e eb22 jmp aswMon2+0x6a42 (f116da42)

SYMBOL_STACK_INDEX: c

SYMBOL_NAME: aswMon2+6a1e

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: aswMon2

IMAGE_NAME: aswMon2.SYS

DEBUG_FLR_IMAGE_TIMESTAMP: 47ed2dff

FAILURE_BUCKET_ID: 0x19_20_aswMon2+6a1e

BUCKET_ID: 0x19_20_aswMon2+6a1e

Followup: MachineOwner
---------

eax=ffdff13c ebx=83d1b9f8 ecx=00000000 edx=00000003 esi=83d1b9f8 edi=00000000
eip=8053354e esp=f79ac9b8 ebp=f79ac9d0 iopl=0 nv up ei ng nz na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00000286
nt!KeBugCheckEx+0x1b:
8053354e 5d pop ebp
ChildEBP RetAddr Args to Child
f79ac9d0 8054b941 00000019 00000020 83d1b9f8 nt!KeBugCheckEx+0x1b (FPO: [Non-Fpo])
f79aca20 f73f84f2 83d1ba00 00000000 f79aca80 nt!ExFreePoolWithTag+0x2be (FPO: [Non-Fpo])
f79aca34 f7431025 83d1ba00 843349b0 e16ea8e0 Ntfs!NtfsFreeEresource+0x76 (FPO: [Non-Fpo])
f79aca58 f73f83bf 830a47e0 f79aca80 f79aca8b Ntfs!NtfsDeleteFcb+0x4e (FPO: [Non-Fpo])
f79acaa4 f7419c7c 830a47e0 84334850 e2253988 Ntfs!NtfsTeardownFromLcb+0x1fd (FPO: [Non-Fpo])
f79acafc f73f47b0 830a47e0 e2253a50 e2253be8 Ntfs!NtfsTeardownStructures+0x125 (FPO: [Non-Fpo])
f79acb28 f74174b5 830a47e0 01253a50 e2253be8 Ntfs!NtfsDecrementCloseCounts+0x9e (FPO: [Non-Fpo])
f79acbac f7417254 830a47e0 e2253a50 e2253988 Ntfs!NtfsCommonClose+0x397 (FPO: [Non-Fpo])
f79acc4c 804e37f7 84334770 83079008 83079008 Ntfs!NtfsFsdClose+0x21f (FPO: [Non-Fpo])
f79acc5c f749a09e 83079008 8432a940 830791e0 nt!IopfCallDriver+0x31 (FPO: [0,0,0])
f79acc88 804e37f7 83f50d78 83079008 00000000 fltmgr!FltpDispatch+0x152 (FPO: [Non-Fpo])
f79acc98 f116da1e 83079018 83fe52e0 839158c8 nt!IopfCallDriver+0x31 (FPO: [0,0,0])
WARNING: Stack unwind information not available. Following frames may be wrong.
f79accbc f116783c 83fc99c0 00079008 804e37f7 aswMon2+0x6a1e
f79acce0 804e37f7 83d9a020 83079008 83079008 aswMon2+0x83c
f79accf0 8056a749 839158b0 00000000 00000000 nt!IopfCallDriver+0x31 (FPO: [0,0,0])
f79acd28 80563af7 009158c8 839158b0 00000000 nt!IopDeleteFile+0x132 (FPO: [Non-Fpo])
f79acd44 804e36d5 839158c8 00000000 806ed03c nt!ObpRemoveObjectRoutine+0xdf (FPO: [Non-Fpo])
f79acd68 804f2da1 8055ecb4 83ee4800 00000000 nt!ObfDereferenceObject+0x5f (FPO: [Non-Fpo])
f79acd8c 80515ba3 e1e11ad0 00000000 843c66d0 nt!MiSegmentDelete+0xdd (FPO: [Non-Fpo])
f79acdac 8057d0f1 00000000 00000000 00000000 nt!MiDereferenceSegmentThread+0x9e (FPO: [Non-Fpo])
start end module name
804d7000 806eb500 nt ntoskrnl.exe Wed Feb 28 03:10:41 2007 (45E54711)
806ec000 806ffd80 hal halacpi.dll Wed Aug 04 00:59:04 2004 (41107B28)
bf800000 bf9c2800 win32k win32k.sys Wed Mar 19 04:46:46 2008 (47E0E106)
bf9c3000 bf9d4580 dxg dxg.sys Wed Aug 04 01:00:51 2004 (41107B93)
bf9d5000 bfd20380 vtdisp vtdisp.dll Mon Mar 07 20:50:05 2005 (422D12DD)
f0472000 f049c180 kmixer kmixer.sys Wed Jun 14 03:47:45 2006 (448FCD31)
f06d0000 f06e1f00 sr sr.sys Wed Aug 04 01:06:22 2004 (41107CDE)
f070a000 f074a280 HTTP HTTP.sys Thu Mar 16 19:33:09 2006 (441A03C5)
f0847000 f084ab20 aswRdr aswRdr.SYS Sat Mar 29 13:29:05 2008 (47EE8A71)
f0b5b000 f0bac480 srv srv.sys Mon Aug 14 05:34:39 2006 (44E051BF)
f0c25000 f0c50d80 mrxdav mrxdav.sys Tue Dec 18 03:51:33 2007 (47679825)
f0eff000 f0f13400 wdmaud wdmaud.sys Wed Jun 14 04:00:44 2006 (448FD03C)
f1054000 f1077000 Fastfat Fastfat.SYS Wed Aug 04 01:14:15 2004 (41107EB7)
f112f000 f113dd80 sysaudio sysaudio.sys Wed Aug 04 01:15:54 2004 (41107F1A)
f1167000 f117c700 aswMon2 aswMon2.SYS Fri Mar 28 12:42:23 2008 (47ED2DFF)
f12bd000 f12cd200 EAPPkt EAPPkt.sys Thu Mar 31 21:43:01 2005 (424CB535)
f12ea000 f12ec120 wg6n wg6n.sys Wed Oct 13 18:56:34 2004 (416DC0B2)
f12f2000 f12f4120 wg5n wg5n.sys Wed Oct 13 18:56:33 2004 (416DC0B1)
f1396000 f1398120 wg4n wg4n.sys Wed Oct 13 18:56:32 2004 (416DC0B0)
f13a2000 f13a4120 wg3n wg3n.sys Wed Oct 13 18:56:30 2004 (416DC0AE)
f13fe000 f1401280 ndisuio ndisuio.sys Wed Aug 04 01:03:10 2004 (41107C1E)
f5cfe000 f5d15480 dump_atapi dump_atapi.sys Wed Aug 04 00:59:41 2004 (41107B4D)
f5d16000 f5d2c000 aswSP aswSP.SYS Fri Mar 28 12:40:19 2008 (47ED2D83)
f5d2c000 f5d9aa00 mrxsmb mrxsmb.sys Fri May 05 04:41:42 2006 (445B1DD6)
f5d9b000 f5dc5a00 rdbss rdbss.sys Fri May 05 04:47:55 2006 (445B1F4B)
f5dc6000 f5de7d00 afd afd.sys Wed Aug 04 01:14:13 2004 (41107EB5)
f5de8000 f5e0fc00 netbt netbt.sys Wed Aug 04 01:14:36 2004 (41107ECC)
f5e10000 f5e30f00 ipnat ipnat.sys Wed Sep 29 17:28:36 2004 (415B3714)
f5e59000 f5eb0e80 tcpip tcpip.sys Tue Oct 30 12:20:52 2007 (472767F4)
f5eb1000 f5ec3400 ipsec ipsec.sys Wed Aug 04 01:14:27 2004 (41107EC3)
f5ef8000 f5efa900 Dxapi Dxapi.sys Fri Aug 17 15:53:19 2001 (3B7D843F)
f6f0c000 f6f3f200 update update.sys Wed Aug 04 00:58:32 2004 (41107B08)
f6fd0000 f6fdf900 Cdfs Cdfs.SYS Wed Aug 04 01:14:09 2004 (41107EB1)
f7007000 f7017e00 psched psched.sys Wed Aug 04 01:04:16 2004 (41107C60)
f7018000 f702e680 ndiswan ndiswan.sys Wed Aug 04 01:14:30 2004 (41107EC6)
f702f000 f7042900 parport parport.sys Wed Aug 04 00:59:04 2004 (41107B28)
f7043000 f7066980 portcls portcls.sys Wed Aug 04 01:15:47 2004 (41107F13)
f7067000 f7098b80 vinyl97 vinyl97.sys Sun Oct 08 23:58:46 2006 (4529D706)
f7099000 f70bb680 ks ks.sys Wed Aug 04 01:15:20 2004 (41107EF8)
f70bc000 f70dee80 USBPORT USBPORT.SYS Wed Aug 04 01:08:34 2004 (41107D62)
f70df000 f70f2780 VIDEOPRT VIDEOPRT.SYS Wed Aug 04 01:07:04 2004 (41107D08)
f70f3000 f711d200 vtmini vtmini.sys Mon Mar 07 20:50:15 2005 (422D12E7)
f7122000 f7124f00 ws2ifsl ws2ifsl.sys Fri Aug 17 15:55:58 2001 (3B7D84DE)
f7136000 f7138280 rasacd rasacd.sys Fri Aug 17 15:55:39 2001 (3B7D84CB)
f738d000 f73a7580 Mup Mup.sys Wed Aug 04 01:15:20 2004 (41107EF8)
f73a8000 f73c5000 Teefer Teefer.sys Fri Oct 15 20:17:00 2004 (4170768C)
f73c5000 f73f1a80 NDIS NDIS.sys Wed Aug 04 01:14:27 2004 (41107EC3)
f73f2000 f747e400 Ntfs Ntfs.sys Fri Feb 09 05:10:31 2007 (45CC56A7)
f747f000 f7495780 KSecDD KSecDD.sys Wed Aug 04 00:59:45 2004 (41107B51)
f7496000 f74b5780 fltmgr fltmgr.sys Mon Aug 21 04:14:57 2006 (44E97991)
f74b6000 f74cd480 atapi atapi.sys Wed Aug 04 00:59:41 2004 (41107B4D)
f74ce000 f74ec880 ftdisk ftdisk.sys Fri Aug 17 15:52:41 2001 (3B7D8419)
f74ed000 f74fda80 pci pci.sys Wed Aug 04 01:07:45 2004 (41107D31)
f74fe000 f752bd80 ACPI ACPI.sys Wed Aug 04 01:07:35 2004 (41107D27)
f754d000 f7555c00 isapnp isapnp.sys Fri Aug 17 15:58:01 2001 (3B7D8559)
f755d000 f7567500 MountMgr MountMgr.sys Wed Aug 04 00:58:29 2004 (41107B05)
f756d000 f7579c80 VolSnap VolSnap.sys Wed Aug 04 01:00:14 2004 (41107B6E)
f757d000 f7585e00 disk disk.sys Wed Aug 04 00:59:53 2004 (41107B59)
f758d000 f7599200 CLASSPNP CLASSPNP.SYS Wed Aug 04 01:14:26 2004 (41107EC2)
f759d000 f75a7e80 uagp35 uagp35.sys Wed Aug 04 01:07:43 2004 (41107D2F)
f75cd000 f75d6f00 termdd termdd.sys Wed Aug 04 00:58:52 2004 (41107B1C)
f75dd000 f75eb100 usbhub usbhub.sys Wed Aug 04 01:08:40 2004 (41107D68)
f75ed000 f75f6480 NDProxy NDProxy.SYS Fri Aug 17 15:55:30 2001 (3B7D84C2)
f764d000 f7655360 aswTdi aswTdi.SYS Sat Mar 29 13:27:31 2008 (47EE8A13)
f765d000 f7665700 wanarp wanarp.sys Wed Aug 04 01:04:57 2004 (41107C89)
f766d000 f7676000 wpsdrvnt wpsdrvnt.sys Fri Oct 15 20:18:45 2004 (417076F5)
f767d000 f7685700 netbios netbios.sys Wed Aug 04 01:03:19 2004 (41107C27)
f768d000 f7695880 Fips Fips.SYS Fri Aug 17 20:31:49 2001 (3B7DC585)
f770d000 f7716200 amdk7 amdk7.sys Wed Aug 04 00:59:19 2004 (41107B37)
f771d000 f7729180 cdrom cdrom.sys Wed Aug 04 00:59:52 2004 (41107B58)
f772d000 f773b080 redbook redbook.sys Wed Aug 04 00:59:34 2004 (41107B46)
f773d000 f7747380 imapi imapi.sys Wed Aug 04 01:00:12 2004 (41107B6C)
f774d000 f775bb80 drmk drmk.sys Wed Aug 04 01:07:54 2004 (41107D3A)
f775d000 f7767a00 fetnd5bv fetnd5bv.sys Fri Sep 21 06:24:02 2007 (46F3A9D2)
f776d000 f777cd80 serial serial.sys Wed Aug 04 01:15:51 2004 (41107F17)
f777d000 f7789e00 i8042prt i8042prt.sys Wed Aug 04 01:14:36 2004 (41107ECC)
f778d000 f7799880 rasl2tp rasl2tp.sys Wed Aug 04 01:14:21 2004 (41107EBD)
f779d000 f77a7200 raspppoe raspppoe.sys Wed Aug 04 01:05:06 2004 (41107C92)
f77ad000 f77b8d00 raspptp raspptp.sys Wed Aug 04 01:14:26 2004 (41107EC2)
f77bd000 f77c5900 msgpc msgpc.sys Wed Aug 04 01:04:11 2004 (41107C5B)
f77cd000 f77d3200 PCIIDEX PCIIDEX.SYS Wed Aug 04 00:59:40 2004 (41107B4C)
f77d5000 f77d9900 PartMgr PartMgr.sys Fri Aug 17 20:32:23 2001 (3B7DC5A7)
f781d000 f7822000 usbuhci usbuhci.sys Wed Aug 04 01:08:34 2004 (41107D62)
f7825000 f782b800 usbehci usbehci.sys Wed Aug 04 01:08:34 2004 (41107D62)
f782d000 f782e000 fdc fdc.sys unavailable (00000000)
f7835000 f783aa00 mouclass mouclass.sys Wed Aug 04 00:58:32 2004 (41107B08)
f783d000 f7843000 kbdclass kbdclass.sys Wed Aug 04 00:58:32 2004 (41107B08)
f7845000 f7849880 TDI TDI.SYS Wed Aug 04 01:07:47 2004 (41107D33)
f784d000 f7851580 ptilink ptilink.sys Fri Aug 17 15:49:53 2001 (3B7D8371)
f7855000 f7859080 raspti raspti.sys Fri Aug 17 15:55:32 2001 (3B7D84C4)
f785d000 f7862000 flpydisk flpydisk.sys Wed Aug 04 00:59:24 2004 (41107B3C)
f786d000 f7872200 vga vga.sys Wed Aug 04 01:07:06 2004 (41107D0A)
f7875000 f7879a80 Msfs Msfs.SYS Wed Aug 04 01:00:37 2004 (41107B85)
f787d000 f7884880 Npfs Npfs.SYS Wed Aug 04 01:00:38 2004 (41107B86)
f7895000 f7899a80 Aavmker4 Aavmker4.SYS Sat Mar 29 13:26:48 2008 (47EE89E8)
f78a5000 f78a9500 watchdog watchdog.sys Wed Aug 04 01:07:32 2004 (41107D24)
f78b5000 f78bd000 aswFsBlk aswFsBlk.sys Fri Mar 28 12:42:42 2008 (47ED2E12)
f795d000 f7960000 BOOTVID BOOTVID.dll Fri Aug 17 15:49:09 2001 (3B7D8345)
f7a15000 f7a18c80 serenum serenum.sys Wed Aug 04 00:59:06 2004 (41107B2A)
f7a19000 f7a1b980 gameenum gameenum.sys Wed Aug 04 01:08:20 2004 (41107D54)
f7a1d000 f7a1f580 ndistapi ndistapi.sys Fri Aug 17 15:55:29 2001 (3B7D84C1)
f7a2d000 f7a30c80 mssmbios mssmbios.sys Wed Aug 04 01:07:47 2004 (41107D33)
f7a4d000 f7a4eb80 kdcom kdcom.dll Fri Aug 17 15:49:10 2001 (3B7D8346)
f7a4f000 f7a50100 WMILIB WMILIB.SYS Fri Aug 17 16:07:23 2001 (3B7D878B)
f7a51000 f7a52500 viaide viaide.sys Wed Aug 04 00:59:42 2004 (41107B4E)
f7a69000 f7a6a100 swenum swenum.sys Wed Aug 04 00:58:41 2004 (41107B11)
f7a6b000 f7a6c280 USBD USBD.SYS Fri Aug 17 16:02:58 2001 (3B7D8682)
f7a6d000 f7a6ef00 Fs_Rec Fs_Rec.SYS Fri Aug 17 15:49:37 2001 (3B7D8361)
f7a6f000 f7a70080 Beep Beep.SYS Fri Aug 17 15:47:33 2001 (3B7D82E5)
f7a71000 f7a72080 mnmdd mnmdd.SYS Fri Aug 17 15:57:28 2001 (3B7D8538)
f7a73000 f7a74080 RDPCDD RDPCDD.sys Fri Aug 17 15:46:56 2001 (3B7D82C0)
f7a75000 f7a76100 dump_WMILIB dump_WMILIB.SYS Fri Aug 17 16:07:23 2001 (3B7D878B)
f7aa3000 f7aa4a80 ParVdm ParVdm.SYS Fri Aug 17 15:49:49 2001 (3B7D836D)
f7b6e000 f7b6ec00 audstub audstub.sys Fri Aug 17 15:59:40 2001 (3B7D85BC)
f7bdc000 f7bdcb80 Null Null.SYS Fri Aug 17 15:47:39 2001 (3B7D82EB)
f7c73000 f7c73d00 dxgthk dxgthk.sys Fri Aug 17 15:53:12 2001 (3B7D8438)

Unloaded modules:
f053d000 f0568000 kmixer.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
f053d000 f0568000 kmixer.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
f053d000 f0568000 kmixer.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
f053d000 f0568000 kmixer.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
f0e11000 f0e3c000 kmixer.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
f7ba3000 f7ba4000 drmkaud.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
f10df000 f10ec000 DMusic.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
f10ef000 f10fd000 swmidi.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
f0edc000 f0eff000 aec.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
f7a55000 f7a57000 splitter.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
f7865000 f786a000 Cdaudio.SYS
Timestamp: unavailable (00000000)
Checksum: 00000000
f713a000 f713d000 Sfloppy.SYS
Timestamp: unavailable (00000000)
Checksum: 00000000
Closing open log file c:\debuglog.txt

Thanks

Mitch

PeteC · 2008/05/13

Mitch

As you have probably read elsewhere on the Board ....

Unfortunately these logs require expert knowledge to analyze and there are only 2 members (who occasionally visit WindowsBBS.com) that have the depth of knowledge necessary. Other members can make observations and suggestions as to how you might proceed toward finding the cause ....
Click to expand...

The system appears to have crashed on ....

Probably caused by : aswMon2.SYS ( aswMon2+6a1e )
Click to expand...

This is the Avast File System Filter Driver for Windows XP I suggest an update/reinstall of Avast.

MitchellCooley · 2008/05/13

Will do. Will report back

Mitch

MitchellCooley · 2008/05/13

Second Crash

This is a debug log of the second crash I have seen. It seems to say "memory corruption" but I ran memtest and windiag both through five passes and neither indicated any memory errors.

Turned off virtual memory, rebooted, turned it back on in order to replace the paging file - don't know if that was helpful.

Opened log file 'c:\debuglog.txt'

Microsoft (R) Windows Debugger Version 6.9.0003.113 X86
Copyright (c) Microsoft Corporation. All rights reserved.

Loading Dump File [C:\WINDOWS\Minidump\Mini051308-02.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: C:\WINDOWS;C:\WINDOWS\system32;C:\WINDOWS\system32\drivers
Windows XP Kernel Version 2600 (Service Pack 2) UP Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 2600.xpsp_sp2_gdr.070227-2254
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055a620
Debug session time: Tue May 13 04:49:05.870 2008 (GMT-5)
System Uptime: 0 days 0:42:53.429
Loading Kernel Symbols
..................................................................................................................
Loading User Symbols
Loading unloaded module list
.........
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 4E, {99, 1a4da, 0, 0}

Probably caused by : memory_corruption ( nt!MmUnmapViewInSystemCache+3cd )

Followup: MachineOwner
---------

kd> !analyze -v;r;kv;lmtn;.logclose;q
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

PFN_LIST_CORRUPT (4e)
Typically caused by drivers passing bad memory descriptor lists (ie: calling
MmUnlockPages twice with the same list, etc). If a kernel debugger is
available get the stack trace.
Arguments:
Arg1: 00000099, A PTE or PFN is corrupt
Arg2: 0001a4da, page frame number
Arg3: 00000000, current page state
Arg4: 00000000, 0

Debugging Details:
------------------

BUGCHECK_STR: 0x4E_99

CUSTOMER_CRASH_COUNT: 2

DEFAULT_BUCKET_ID: DRIVER_FAULT

PROCESS_NAME: System

LAST_CONTROL_TRANSFER: from 805230e4 to 8053354e

STACK_TEXT:
f7978b20 805230e4 0000004e 00000099 0001a4da nt!KeBugCheckEx+0x1b
f7978b70 80566878 d498d000 83f2d250 00000000 nt!MmUnmapViewInSystemCache+0x3cd
f7978b88 804f6136 843b7f30 841dd1e0 00000001 nt!CcUnmapVacb+0x2a
f7978bb8 804f67d6 00100000 00000001 00000000 nt!CcUnmapVacbArray+0xdf
f7978c3c 804f66c5 841dd1e0 00880000 00000000 nt!CcGetVacbMiss+0x6e
f7978c74 80500fc8 001dd1e0 00880000 00000000 nt!CcGetVirtualAddress+0x94
f7978d2c 80500dd4 843fc038 80561640 843c9da8 nt!CcPerformReadAhead+0x194
f7978d74 804e426b 843fc038 00000000 843c9da8 nt!CcWorkerThread+0x147
f7978dac 8057d0f1 843fc038 00000000 00000000 nt!ExpWorkerThread+0x100
f7978ddc 804f827a 804e4196 00000000 00000000 nt!PspSystemThreadStartup+0x34
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16

STACK_COMMAND: kb

FOLLOWUP_IP:
nt!MmUnmapViewInSystemCache+3cd
805230e4 0039 add byte ptr [ecx],bh

SYMBOL_STACK_INDEX: 1

SYMBOL_NAME: nt!MmUnmapViewInSystemCache+3cd

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nt

DEBUG_FLR_IMAGE_TIMESTAMP: 45e54711

IMAGE_NAME: memory_corruption

FAILURE_BUCKET_ID: 0x4E_99_nt!MmUnmapViewInSystemCache+3cd

BUCKET_ID: 0x4E_99_nt!MmUnmapViewInSystemCache+3cd

Followup: MachineOwner
---------

eax=ffdff13c ebx=0001a4da ecx=00000000 edx=805594b0 esi=812ca470 edi=00000007
eip=8053354e esp=f7978b08 ebp=f7978b20 iopl=0 nv up ei ng nz na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00000286
nt!KeBugCheckEx+0x1b:
8053354e 5d pop ebp
ChildEBP RetAddr Args to Child
f7978b20 805230e4 0000004e 00000099 0001a4da nt!KeBugCheckEx+0x1b (FPO: [Non-Fpo])
f7978b70 80566878 d498d000 83f2d250 00000000 nt!MmUnmapViewInSystemCache+0x3cd (FPO: [Non-Fpo])
f7978b88 804f6136 843b7f30 841dd1e0 00000001 nt!CcUnmapVacb+0x2a (FPO: [Non-Fpo])
f7978bb8 804f67d6 00100000 00000001 00000000 nt!CcUnmapVacbArray+0xdf (FPO: [Non-Fpo])
f7978c3c 804f66c5 841dd1e0 00880000 00000000 nt!CcGetVacbMiss+0x6e (FPO: [Non-Fpo])
f7978c74 80500fc8 001dd1e0 00880000 00000000 nt!CcGetVirtualAddress+0x94 (FPO: [Non-Fpo])
f7978d2c 80500dd4 843fc038 80561640 843c9da8 nt!CcPerformReadAhead+0x194 (FPO: [Non-Fpo])
f7978d74 804e426b 843fc038 00000000 843c9da8 nt!CcWorkerThread+0x147 (FPO: [Non-Fpo])
f7978dac 8057d0f1 843fc038 00000000 00000000 nt!ExpWorkerThread+0x100 (FPO: [Non-Fpo])
f7978ddc 804f827a 804e4196 00000000 00000000 nt!PspSystemThreadStartup+0x34 (FPO: [Non-Fpo])
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16
start end module name
804d7000 806eb500 nt ntoskrnl.exe Wed Feb 28 03:10:41 2007 (45E54711)
806ec000 806ffd80 hal halacpi.dll Wed Aug 04 00:59:04 2004 (41107B28)
bf800000 bf9c2800 win32k win32k.sys Wed Mar 19 04:46:46 2008 (47E0E106)
bf9c3000 bf9d4580 dxg dxg.sys Wed Aug 04 01:00:51 2004 (41107B93)
bf9d5000 bfd20380 vtdisp vtdisp.dll Mon Mar 07 20:50:05 2005 (422D12DD)
f044a000 f0474180 kmixer kmixer.sys Wed Jun 14 03:47:45 2006 (448FCD31)
f0709000 f0749280 HTTP HTTP.sys Thu Mar 16 19:33:09 2006 (441A03C5)
f084e000 f0851b20 aswRdr aswRdr.SYS Sat Mar 29 13:29:05 2008 (47EE8A71)
f0baa000 f0bfb480 srv srv.sys Mon Aug 14 05:34:39 2006 (44E051BF)
f0c24000 f0c4fd80 mrxdav mrxdav.sys Tue Dec 18 03:51:33 2007 (47679825)
f0f26000 f0f3a400 wdmaud wdmaud.sys Wed Jun 14 04:00:44 2006 (448FD03C)
f1093000 f10a1d80 sysaudio sysaudio.sys Wed Aug 04 01:15:54 2004 (41107F1A)
f116b000 f1180700 aswMon2 aswMon2.SYS Fri Mar 28 12:42:23 2008 (47ED2DFF)
f1299000 f12a9200 EAPPkt EAPPkt.sys Thu Mar 31 21:43:01 2005 (424CB535)
f12be000 f12c0120 wg6n wg6n.sys Wed Oct 13 18:56:34 2004 (416DC0B2)
f12c6000 f12c8120 wg5n wg5n.sys Wed Oct 13 18:56:33 2004 (416DC0B1)
f12ca000 f12cc120 wg4n wg4n.sys Wed Oct 13 18:56:32 2004 (416DC0B0)
f1372000 f1374120 wg3n wg3n.sys Wed Oct 13 18:56:30 2004 (416DC0AE)
f13da000 f13dd280 ndisuio ndisuio.sys Wed Aug 04 01:03:10 2004 (41107C1E)
f5c3a000 f5c51480 dump_atapi dump_atapi.sys Wed Aug 04 00:59:41 2004 (41107B4D)
f5cf2000 f5d08000 aswSP aswSP.SYS Fri Mar 28 12:40:19 2008 (47ED2D83)
f5d08000 f5d28f00 ipnat ipnat.sys Wed Sep 29 17:28:36 2004 (415B3714)
f5d29000 f5d97a00 mrxsmb mrxsmb.sys Fri May 05 04:41:42 2006 (445B1DD6)
f5d98000 f5dc2a00 rdbss rdbss.sys Fri May 05 04:47:55 2006 (445B1F4B)
f5dc3000 f5de4d00 afd afd.sys Wed Aug 04 01:14:13 2004 (41107EB5)
f5e0d000 f5e34c00 netbt netbt.sys Wed Aug 04 01:14:36 2004 (41107ECC)
f5e35000 f5e8ce80 tcpip tcpip.sys Tue Oct 30 12:20:52 2007 (472767F4)
f5e8d000 f5e9f400 ipsec ipsec.sys Wed Aug 04 01:14:27 2004 (41107EC3)
f6ee8000 f6f1b200 update update.sys Wed Aug 04 00:58:32 2004 (41107B08)
f6f8c000 f6f9b900 Cdfs Cdfs.SYS Wed Aug 04 01:14:09 2004 (41107EB1)
f6fe3000 f6ff3e00 psched psched.sys Wed Aug 04 01:04:16 2004 (41107C60)
f6ff4000 f700a680 ndiswan ndiswan.sys Wed Aug 04 01:14:30 2004 (41107EC6)
f700b000 f701e900 parport parport.sys Wed Aug 04 00:59:04 2004 (41107B28)
f701f000 f7042980 portcls portcls.sys Wed Aug 04 01:15:47 2004 (41107F13)
f7043000 f7074b80 vinyl97 vinyl97.sys Sun Oct 08 23:58:46 2006 (4529D706)
f7075000 f7097680 ks ks.sys Wed Aug 04 01:15:20 2004 (41107EF8)
f7098000 f70bae80 USBPORT USBPORT.SYS Wed Aug 04 01:08:34 2004 (41107D62)
f70bb000 f70ce780 VIDEOPRT VIDEOPRT.SYS Wed Aug 04 01:07:04 2004 (41107D08)
f70cf000 f70f9200 vtmini vtmini.sys Mon Mar 07 20:50:15 2005 (422D12E7)
f711e000 f7120f00 ws2ifsl ws2ifsl.sys Fri Aug 17 15:55:58 2001 (3B7D84DE)
f737b000 f7395580 Mup Mup.sys Wed Aug 04 01:15:20 2004 (41107EF8)
f7396000 f73b3000 Teefer Teefer.sys Fri Oct 15 20:17:00 2004 (4170768C)
f73b3000 f73dfa80 NDIS NDIS.sys Wed Aug 04 01:14:27 2004 (41107EC3)
f73e0000 f746c400 Ntfs Ntfs.sys Fri Feb 09 05:10:31 2007 (45CC56A7)
f746d000 f7483780 KSecDD KSecDD.sys Wed Aug 04 00:59:45 2004 (41107B51)
f7484000 f7495f00 sr sr.sys Wed Aug 04 01:06:22 2004 (41107CDE)
f7496000 f74b5780 fltmgr fltmgr.sys Mon Aug 21 04:14:57 2006 (44E97991)
f74b6000 f74cd480 atapi atapi.sys Wed Aug 04 00:59:41 2004 (41107B4D)
f74ce000 f74ec880 ftdisk ftdisk.sys Fri Aug 17 15:52:41 2001 (3B7D8419)
f74ed000 f74fda80 pci pci.sys Wed Aug 04 01:07:45 2004 (41107D31)
f74fe000 f752bd80 ACPI ACPI.sys Wed Aug 04 01:07:35 2004 (41107D27)
f754d000 f7555c00 isapnp isapnp.sys Fri Aug 17 15:58:01 2001 (3B7D8559)
f755d000 f7567500 MountMgr MountMgr.sys Wed Aug 04 00:58:29 2004 (41107B05)
f756d000 f7579c80 VolSnap VolSnap.sys Wed Aug 04 01:00:14 2004 (41107B6E)
f757d000 f7585e00 disk disk.sys Wed Aug 04 00:59:53 2004 (41107B59)
f758d000 f7599200 CLASSPNP CLASSPNP.SYS Wed Aug 04 01:14:26 2004 (41107EC2)
f759d000 f75a7e80 uagp35 uagp35.sys Wed Aug 04 01:07:43 2004 (41107D2F)
f75cd000 f75db100 usbhub usbhub.sys Wed Aug 04 01:08:40 2004 (41107D68)
f760d000 f7615360 aswTdi aswTdi.SYS Sat Mar 29 13:27:31 2008 (47EE8A13)
f761d000 f7626000 wpsdrvnt wpsdrvnt.sys Fri Oct 15 20:18:45 2004 (417076F5)
f762d000 f7635700 netbios netbios.sys Wed Aug 04 01:03:19 2004 (41107C27)
f763d000 f7645880 Fips Fips.SYS Fri Aug 17 20:31:49 2001 (3B7DC585)
f768d000 f7695700 wanarp wanarp.sys Wed Aug 04 01:04:57 2004 (41107C89)
f76ed000 f76f6200 amdk7 amdk7.sys Wed Aug 04 00:59:19 2004 (41107B37)
f76fd000 f7709180 cdrom cdrom.sys Wed Aug 04 00:59:52 2004 (41107B58)
f770d000 f771b080 redbook redbook.sys Wed Aug 04 00:59:34 2004 (41107B46)
f771d000 f7727380 imapi imapi.sys Wed Aug 04 01:00:12 2004 (41107B6C)
f772d000 f773bb80 drmk drmk.sys Wed Aug 04 01:07:54 2004 (41107D3A)
f773d000 f7747a00 fetnd5bv fetnd5bv.sys Fri Sep 21 06:24:02 2007 (46F3A9D2)
f774d000 f775cd80 serial serial.sys Wed Aug 04 01:15:51 2004 (41107F17)
f775d000 f7769e00 i8042prt i8042prt.sys Wed Aug 04 01:14:36 2004 (41107ECC)
f776d000 f7779880 rasl2tp rasl2tp.sys Wed Aug 04 01:14:21 2004 (41107EBD)
f777d000 f7787200 raspppoe raspppoe.sys Wed Aug 04 01:05:06 2004 (41107C92)
f778d000 f7798d00 raspptp raspptp.sys Wed Aug 04 01:14:26 2004 (41107EC2)
f779d000 f77a5900 msgpc msgpc.sys Wed Aug 04 01:04:11 2004 (41107C5B)
f77ad000 f77b6f00 termdd termdd.sys Wed Aug 04 00:58:52 2004 (41107B1C)
f77bd000 f77c6480 NDProxy NDProxy.SYS Fri Aug 17 15:55:30 2001 (3B7D84C2)
f77cd000 f77d3200 PCIIDEX PCIIDEX.SYS Wed Aug 04 00:59:40 2004 (41107B4C)
f77d5000 f77d9900 PartMgr PartMgr.sys Fri Aug 17 20:32:23 2001 (3B7DC5A7)
f783d000 f7842000 usbuhci usbuhci.sys Wed Aug 04 01:08:34 2004 (41107D62)
f7845000 f784b800 usbehci usbehci.sys Wed Aug 04 01:08:34 2004 (41107D62)
f784d000 f784e000 fdc fdc.sys unavailable (00000000)
f7855000 f785aa00 mouclass mouclass.sys Wed Aug 04 00:58:32 2004 (41107B08)
f785d000 f7863000 kbdclass kbdclass.sys Wed Aug 04 00:58:32 2004 (41107B08)
f7865000 f7869880 TDI TDI.SYS Wed Aug 04 01:07:47 2004 (41107D33)
f786d000 f7871580 ptilink ptilink.sys Fri Aug 17 15:49:53 2001 (3B7D8371)
f7875000 f7879080 raspti raspti.sys Fri Aug 17 15:55:32 2001 (3B7D84C4)
f787d000 f7882000 flpydisk flpydisk.sys Wed Aug 04 00:59:24 2004 (41107B3C)
f788d000 f7892200 vga vga.sys Wed Aug 04 01:07:06 2004 (41107D0A)
f7895000 f7899a80 Msfs Msfs.SYS Wed Aug 04 01:00:37 2004 (41107B85)
f789d000 f78a4880 Npfs Npfs.SYS Wed Aug 04 01:00:38 2004 (41107B86)
f78b5000 f78b9a80 Aavmker4 Aavmker4.SYS Sat Mar 29 13:26:48 2008 (47EE89E8)
f78c5000 f78c9500 watchdog watchdog.sys Wed Aug 04 01:07:32 2004 (41107D24)
f78cd000 f78d5000 aswFsBlk aswFsBlk.sys Fri Mar 28 12:42:42 2008 (47ED2E12)
f795d000 f7960000 BOOTVID BOOTVID.dll Fri Aug 17 15:49:09 2001 (3B7D8345)
f79e5000 f79e7900 Dxapi Dxapi.sys Fri Aug 17 15:53:19 2001 (3B7D843F)
f79fd000 f7a00c80 serenum serenum.sys Wed Aug 04 00:59:06 2004 (41107B2A)
f7a01000 f7a03980 gameenum gameenum.sys Wed Aug 04 01:08:20 2004 (41107D54)
f7a05000 f7a07580 ndistapi ndistapi.sys Fri Aug 17 15:55:29 2001 (3B7D84C1)
f7a15000 f7a18c80 mssmbios mssmbios.sys Wed Aug 04 01:07:47 2004 (41107D33)
f7a41000 f7a43280 rasacd rasacd.sys Fri Aug 17 15:55:39 2001 (3B7D84CB)
f7a4d000 f7a4eb80 kdcom kdcom.dll Fri Aug 17 15:49:10 2001 (3B7D8346)
f7a4f000 f7a50100 WMILIB WMILIB.SYS Fri Aug 17 16:07:23 2001 (3B7D878B)
f7a51000 f7a52500 viaide viaide.sys Wed Aug 04 00:59:42 2004 (41107B4E)
f7a63000 f7a64100 swenum swenum.sys Wed Aug 04 00:58:41 2004 (41107B11)
f7a65000 f7a66280 USBD USBD.SYS Fri Aug 17 16:02:58 2001 (3B7D8682)
f7a67000 f7a68f00 Fs_Rec Fs_Rec.SYS Fri Aug 17 15:49:37 2001 (3B7D8361)
f7a69000 f7a6a080 Beep Beep.SYS Fri Aug 17 15:47:33 2001 (3B7D82E5)
f7a6b000 f7a6c080 mnmdd mnmdd.SYS Fri Aug 17 15:57:28 2001 (3B7D8538)
f7a6d000 f7a6e080 RDPCDD RDPCDD.sys Fri Aug 17 15:46:56 2001 (3B7D82C0)
f7a6f000 f7a70100 dump_WMILIB dump_WMILIB.SYS Fri Aug 17 16:07:23 2001 (3B7D878B)
f7b0b000 f7b0ca80 ParVdm ParVdm.SYS Fri Aug 17 15:49:49 2001 (3B7D836D)
f7b6c000 f7b6cd00 dxgthk dxgthk.sys Fri Aug 17 15:53:12 2001 (3B7D8438)
f7b88000 f7b88c00 audstub audstub.sys Fri Aug 17 15:59:40 2001 (3B7D85BC)
f7c06000 f7c06b80 Null Null.SYS Fri Aug 17 15:47:39 2001 (3B7D82EB)

Unloaded modules:
f049d000 f04c8000 kmixer.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
f0ed8000 f0f03000 kmixer.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
f7bd1000 f7bd2000 drmkaud.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
f0f03000 f0f26000 aec.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
f1063000 f1070000 DMusic.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
f1073000 f1081000 swmidi.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
f7ae3000 f7ae5000 splitter.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
f7885000 f788a000 Cdaudio.SYS
Timestamp: unavailable (00000000)
Checksum: 00000000
f7a3d000 f7a40000 Sfloppy.SYS
Timestamp: unavailable (00000000)
Checksum: 00000000
Closing open log file c:\debuglog.txt

PeteC · 2008/05/13

Memory corruption is all we have to go on from that dump. Although you have tested the memory it is important to note ....

Memory checking programs are not adequate because they don't test the memory the way that Windows uses it. Most, if not all, memory checkers use read/write cycles when scanning memory. Since Windows is executing code from the memory, it uses execute cycles. Execute cycles are physically different from read/write cycles and are more vulnerable to parity errors. It is possible for memory checking programs to find parity errors if the memory is extremely faulty.
Click to expand...

So now the hard work starts - physically checking the memory ....

If the computer has a single stick of RAM switch it around the slots and see if there is any effect on the BSOD's. If 2 sticks test each one individually in each slot and then as a pair in different pairs of slots if possible. Tedious, but the only reasonably sure way to identify a bad stick or a bad slot.

MitchellCooley · 2008/05/13

Oh how fun. Will report back. Thanks Pete

Mitch

MitchellCooley · 2008/05/14

New BSOD - related to spybot

Switched memory banks. Will drop to just one stick later tonight and will see what happens. In the meantime I will uninstall Spybot, download a new copy and install.

Updated Spybot S&D. Started Spybot S&D and the system crashed. After the system restarted. Started Spybot S&D and the system crashed again. Here is the Dump File:

Opened log file 'c:\debuglog.txt'

Microsoft (R) Windows Debugger Version 6.9.0003.113 X86
Copyright (c) Microsoft Corporation. All rights reserved.

Loading Dump File [C:\WINDOWS\Minidump\Mini051408-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: C:\WINDOWS;C:\WINDOWS\system32;C:\WINDOWS\system32\drivers
Windows XP Kernel Version 2600 (Service Pack 2) UP Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 2600.xpsp_sp2_gdr.070227-2254
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055a620
Debug session time: Wed May 14 23:26:14.319 2008 (GMT-5)
System Uptime: 0 days 0:04:37.870
Loading Kernel Symbols
............................................................................................................
Loading User Symbols
Loading unloaded module list
..........
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 19, {20, e10980e0, e1098568, 7c9130c6}

GetUlongFromAddress: unable to read from 80562b70
Probably caused by : ntoskrnl.exe ( nt!ExFreePoolWithTag+2be )

Followup: MachineOwner
---------

kd> !analyze -v;r;kv;lmtn;.logclose;q
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

BAD_POOL_HEADER (19)
The pool is already corrupt at the time of the current request.
This may or may not be due to the caller.
The internal pool links must be walked to figure out a possible cause of
the problem, and then special pool applied to the suspect tags or the driver
verifier to a suspect driver.
Arguments:
Arg1: 00000020, a pool block header size is corrupt.
Arg2: e10980e0, The pool entry we were looking for within the page.
Arg3: e1098568, The next pool entry.
Arg4: 7c9130c6, (reserved)

Debugging Details:
------------------

GetUlongFromAddress: unable to read from 80562b70

BUGCHECK_STR: 0x19_20

POOL_ADDRESS: e10980e0

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: DRIVER_FAULT

PROCESS_NAME: SpybotSD.exe

LAST_CONTROL_TRANSFER: from 8054b941 to 8053354e

STACK_TEXT:
f04e7be0 8054b941 00000019 00000020 e10980e0 nt!KeBugCheckEx+0x1b
f04e7c30 8058b877 e10980e8 00000000 e1192290 nt!ExFreePoolWithTag+0x2be
f04e7c4c 8058d211 e1034b48 e1192290 e1011ed8 nt!CmpCleanUpKcbValueCache+0x3d
f04e7c60 8058b587 e1034b48 e16ec820 80567ea8 nt!CmpCleanUpKcbCacheWithLock+0x1a
f04e7c6c 80567ea8 f04e7c80 80567e5f e1192290 nt!CmpGetDelayedCloseIndex+0x16
f04e7c74 80567e5f e1192290 f04e7c8c 80567ced nt!CmpAddToDelayedClose+0xa
f04e7c80 80567ced e1192290 f04e7ca4 8056b83a nt!CmpDereferenceKeyControlBlockWithLock+0x38
f04e7c8c 8056b83a e1192290 00000000 e2365958 nt!CmpDereferenceKeyControlBlock+0x12
f04e7ca4 80563af7 e2365970 e2365958 00000000 nt!CmpDeleteKeyObject+0x92
f04e7cc0 804e36d5 e2365970 00000000 00000354 nt!ObpRemoveObjectRoutine+0xdf
f04e7ce4 80566cb3 83f0a020 e123de90 841b6020 nt!ObfDereferenceObject+0x5f
f04e7cfc 80566d1c e123de90 e2365970 00000354 nt!ObpCloseHandleTableEntry+0x155
f04e7d44 80566d66 00000354 00000001 00000000 nt!ObpCloseHandle+0x87
f04e7d58 804de7ec 00000354 0012eeec 7c90eb94 nt!NtClose+0x1d
f04e7d58 7c90eb94 00000354 0012eeec 7c90eb94 nt!KiFastCallEntry+0xf8
WARNING: Frame IP not in any known module. Following frames may be wrong.
0012eeec 00000000 00000000 00000000 00000000 0x7c90eb94

STACK_COMMAND: kb

FOLLOWUP_IP:
nt!ExFreePoolWithTag+2be
8054b941 83f801 cmp eax,1

SYMBOL_STACK_INDEX: 1

SYMBOL_NAME: nt!ExFreePoolWithTag+2be

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nt

IMAGE_NAME: ntoskrnl.exe

DEBUG_FLR_IMAGE_TIMESTAMP: 45e54711

FAILURE_BUCKET_ID: 0x19_20_nt!ExFreePoolWithTag+2be

BUCKET_ID: 0x19_20_nt!ExFreePoolWithTag+2be

Followup: MachineOwner
---------

eax=ffdff13c ebx=e10980e0 ecx=00000000 edx=00000074 esi=e10980e0 edi=00000000
eip=8053354e esp=f04e7bc8 ebp=f04e7be0 iopl=0 nv up ei ng nz na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00000286
nt!KeBugCheckEx+0x1b:
8053354e 5d pop ebp
ChildEBP RetAddr Args to Child
f04e7be0 8054b941 00000019 00000020 e10980e0 nt!KeBugCheckEx+0x1b (FPO: [Non-Fpo])
f04e7c30 8058b877 e10980e8 00000000 e1192290 nt!ExFreePoolWithTag+0x2be (FPO: [Non-Fpo])
f04e7c4c 8058d211 e1034b48 e1192290 e1011ed8 nt!CmpCleanUpKcbValueCache+0x3d (FPO: [Non-Fpo])
f04e7c60 8058b587 e1034b48 e16ec820 80567ea8 nt!CmpCleanUpKcbCacheWithLock+0x1a (FPO: [Non-Fpo])
f04e7c6c 80567ea8 f04e7c80 80567e5f e1192290 nt!CmpGetDelayedCloseIndex+0x16 (FPO: [0,0,0])
f04e7c74 80567e5f e1192290 f04e7c8c 80567ced nt!CmpAddToDelayedClose+0xa (FPO: [Non-Fpo])
f04e7c80 80567ced e1192290 f04e7ca4 8056b83a nt!CmpDereferenceKeyControlBlockWithLock+0x38 (FPO: [Non-Fpo])
f04e7c8c 8056b83a e1192290 00000000 e2365958 nt!CmpDereferenceKeyControlBlock+0x12 (FPO: [Non-Fpo])
f04e7ca4 80563af7 e2365970 e2365958 00000000 nt!CmpDeleteKeyObject+0x92 (FPO: [Non-Fpo])
f04e7cc0 804e36d5 e2365970 00000000 00000354 nt!ObpRemoveObjectRoutine+0xdf (FPO: [Non-Fpo])
f04e7ce4 80566cb3 83f0a020 e123de90 841b6020 nt!ObfDereferenceObject+0x5f (FPO: [Non-Fpo])
f04e7cfc 80566d1c e123de90 e2365970 00000354 nt!ObpCloseHandleTableEntry+0x155 (FPO: [Non-Fpo])
f04e7d44 80566d66 00000354 00000001 00000000 nt!ObpCloseHandle+0x87 (FPO: [Non-Fpo])
f04e7d58 804de7ec 00000354 0012eeec 7c90eb94 nt!NtClose+0x1d (FPO: [Non-Fpo])
f04e7d58 7c90eb94 00000354 0012eeec 7c90eb94 nt!KiFastCallEntry+0xf8 (FPO: [0,0] TrapFrame @ f04e7d64)
WARNING: Frame IP not in any known module. Following frames may be wrong.
0012eeec 00000000 00000000 00000000 00000000 0x7c90eb94
start end module name
804d7000 806eb500 nt ntoskrnl.exe Wed Feb 28 03:10:41 2007 (45E54711)
806ec000 806ffd80 hal halacpi.dll Wed Aug 04 00:59:04 2004 (41107B28)
bf800000 bf9c2800 win32k win32k.sys Wed Mar 19 04:46:46 2008 (47E0E106)
bf9c3000 bf9d4580 dxg dxg.sys Wed Aug 04 01:00:51 2004 (41107B93)
bf9d5000 bfd20380 vtdisp vtdisp.dll Mon Mar 07 20:50:05 2005 (422D12DD)
f03b5000 f03df180 kmixer kmixer.sys Wed Jun 14 03:47:45 2006 (448FCD31)
f0598000 f05d8280 HTTP HTTP.sys Thu Mar 16 19:33:09 2006 (441A03C5)
f06e8000 f06ebb20 aswRdr aswRdr.SYS Mon May 12 11:34:40 2008 (482871A0)
f094c000 f099d480 srv srv.sys Mon Aug 14 05:34:39 2006 (44E051BF)
f0ab6000 f0ae1d80 mrxdav mrxdav.sys Tue Dec 18 03:51:33 2007 (47679825)
f0cc8000 f0cdc400 wdmaud wdmaud.sys Wed Jun 14 04:00:44 2006 (448FD03C)
f0f5d000 f0f72680 aswMon2 aswMon2.SYS Mon May 12 07:18:23 2008 (4828358F)
f1063000 f1073200 EAPPkt EAPPkt.sys Thu Mar 31 21:43:01 2005 (424CB535)
f1178000 f117b280 ndisuio ndisuio.sys Wed Aug 04 01:03:10 2004 (41107C1E)
f5a7c000 f5a93480 dump_atapi dump_atapi.sys Wed Aug 04 00:59:41 2004 (41107B4D)
f5a94000 f5aab000 aswSP aswSP.SYS Mon May 12 07:16:16 2008 (48283510)
f5aab000 f5acbf00 ipnat ipnat.sys Wed Sep 29 17:28:36 2004 (415B3714)
f5acc000 f5b3aa00 mrxsmb mrxsmb.sys Fri May 05 04:41:42 2006 (445B1DD6)
f5b63000 f5b8da00 rdbss rdbss.sys Fri May 05 04:47:55 2006 (445B1F4B)
f5b8e000 f5bafd00 afd afd.sys Wed Aug 04 01:14:13 2004 (41107EB5)
f5bb0000 f5bd7c00 netbt netbt.sys Wed Aug 04 01:14:36 2004 (41107ECC)
f5bd8000 f5c2fe80 tcpip tcpip.sys Tue Oct 30 12:20:52 2007 (472767F4)
f5c30000 f5c42400 ipsec ipsec.sys Wed Aug 04 01:14:27 2004 (41107EC3)
f6cb2000 f6ce5200 update update.sys Wed Aug 04 00:58:32 2004 (41107B08)
f6d06000 f6d14d80 sysaudio sysaudio.sys Wed Aug 04 01:15:54 2004 (41107F1A)
f6d86000 f6d96e00 psched psched.sys Wed Aug 04 01:04:16 2004 (41107C60)
f6d97000 f6dad680 ndiswan ndiswan.sys Wed Aug 04 01:14:30 2004 (41107EC6)
f6dae000 f6dc1900 parport parport.sys Wed Aug 04 00:59:04 2004 (41107B28)
f6dc2000 f6de5980 portcls portcls.sys Wed Aug 04 01:15:47 2004 (41107F13)
f6de6000 f6e17b80 vinyl97 vinyl97.sys Sun Oct 08 23:58:46 2006 (4529D706)
f6e18000 f6e3a680 ks ks.sys Wed Aug 04 01:15:20 2004 (41107EF8)
f6e3b000 f6e5de80 USBPORT USBPORT.SYS Wed Aug 04 01:08:34 2004 (41107D62)
f6e5e000 f6e71780 VIDEOPRT VIDEOPRT.SYS Wed Aug 04 01:07:04 2004 (41107D08)
f6e72000 f6e9c200 vtmini vtmini.sys Mon Mar 07 20:50:15 2005 (422D12E7)
f7398000 f73b2580 Mup Mup.sys Wed Aug 04 01:15:20 2004 (41107EF8)
f73b3000 f73dfa80 NDIS NDIS.sys Wed Aug 04 01:14:27 2004 (41107EC3)
f73e0000 f746c400 Ntfs Ntfs.sys Fri Feb 09 05:10:31 2007 (45CC56A7)
f746d000 f7483780 KSecDD KSecDD.sys Wed Aug 04 00:59:45 2004 (41107B51)
f7484000 f7495f00 sr sr.sys Wed Aug 04 01:06:22 2004 (41107CDE)
f7496000 f74b5780 fltmgr fltmgr.sys Mon Aug 21 04:14:57 2006 (44E97991)
f74b6000 f74cd480 atapi atapi.sys Wed Aug 04 00:59:41 2004 (41107B4D)
f74ce000 f74ec880 ftdisk ftdisk.sys Fri Aug 17 15:52:41 2001 (3B7D8419)
f74ed000 f74fda80 pci pci.sys Wed Aug 04 01:07:45 2004 (41107D31)
f74fe000 f752bd80 ACPI ACPI.sys Wed Aug 04 01:07:35 2004 (41107D27)
f754d000 f7555c00 isapnp isapnp.sys Fri Aug 17 15:58:01 2001 (3B7D8559)
f755d000 f7567500 MountMgr MountMgr.sys Wed Aug 04 00:58:29 2004 (41107B05)
f756d000 f7579c80 VolSnap VolSnap.sys Wed Aug 04 01:00:14 2004 (41107B6E)
f757d000 f7585e00 disk disk.sys Wed Aug 04 00:59:53 2004 (41107B59)
f758d000 f7599200 CLASSPNP CLASSPNP.SYS Wed Aug 04 01:14:26 2004 (41107EC2)
f759d000 f75a7e80 uagp35 uagp35.sys Wed Aug 04 01:07:43 2004 (41107D2F)
f75cd000 f75d5700 netbios netbios.sys Wed Aug 04 01:03:19 2004 (41107C27)
f75dd000 f75e5880 Fips Fips.SYS Fri Aug 17 20:31:49 2001 (3B7DC585)
f75ed000 f75f5700 wanarp wanarp.sys Wed Aug 04 01:04:57 2004 (41107C89)
f763d000 f764c900 Cdfs Cdfs.SYS Wed Aug 04 01:14:09 2004 (41107EB1)
f76ad000 f76b6200 amdk7 amdk7.sys Wed Aug 04 00:59:19 2004 (41107B37)
f76bd000 f76c9180 cdrom cdrom.sys Wed Aug 04 00:59:52 2004 (41107B58)
f76cd000 f76db080 redbook redbook.sys Wed Aug 04 00:59:34 2004 (41107B46)
f76dd000 f76e7380 imapi imapi.sys Wed Aug 04 01:00:12 2004 (41107B6C)
f76ed000 f76fbb80 drmk drmk.sys Wed Aug 04 01:07:54 2004 (41107D3A)
f76fd000 f7707a00 fetnd5bv fetnd5bv.sys Fri Sep 21 06:24:02 2007 (46F3A9D2)
f770d000 f771cd80 serial serial.sys Wed Aug 04 01:15:51 2004 (41107F17)
f771d000 f7729e00 i8042prt i8042prt.sys Wed Aug 04 01:14:36 2004 (41107ECC)
f772d000 f7739880 rasl2tp rasl2tp.sys Wed Aug 04 01:14:21 2004 (41107EBD)
f773d000 f7747200 raspppoe raspppoe.sys Wed Aug 04 01:05:06 2004 (41107C92)
f774d000 f7758d00 raspptp raspptp.sys Wed Aug 04 01:14:26 2004 (41107EC2)
f775d000 f7765900 msgpc msgpc.sys Wed Aug 04 01:04:11 2004 (41107C5B)
f776d000 f7776f00 termdd termdd.sys Wed Aug 04 00:58:52 2004 (41107B1C)
f777d000 f7786480 NDProxy NDProxy.SYS Fri Aug 17 15:55:30 2001 (3B7D84C2)
f778d000 f779b100 usbhub usbhub.sys Wed Aug 04 01:08:40 2004 (41107D68)
f77bd000 f77c5360 aswTdi aswTdi.SYS Mon May 12 11:33:35 2008 (4828715F)
f77cd000 f77d3200 PCIIDEX PCIIDEX.SYS Wed Aug 04 00:59:40 2004 (41107B4C)
f77d5000 f77d9900 PartMgr PartMgr.sys Fri Aug 17 20:32:23 2001 (3B7DC5A7)
f783d000 f7842000 usbuhci usbuhci.sys Wed Aug 04 01:08:34 2004 (41107D62)
f7845000 f784b800 usbehci usbehci.sys Wed Aug 04 01:08:34 2004 (41107D62)
f784d000 f784e000 fdc fdc.sys unavailable (00000000)
f7855000 f785aa00 mouclass mouclass.sys Wed Aug 04 00:58:32 2004 (41107B08)
f785d000 f7863000 kbdclass kbdclass.sys Wed Aug 04 00:58:32 2004 (41107B08)
f7865000 f7869880 TDI TDI.SYS Wed Aug 04 01:07:47 2004 (41107D33)
f786d000 f7871580 ptilink ptilink.sys Fri Aug 17 15:49:53 2001 (3B7D8371)
f7875000 f7879080 raspti raspti.sys Fri Aug 17 15:55:32 2001 (3B7D84C4)
f787d000 f7882000 flpydisk flpydisk.sys Wed Aug 04 00:59:24 2004 (41107B3C)
f788d000 f7892200 vga vga.sys Wed Aug 04 01:07:06 2004 (41107D0A)
f7895000 f7899a80 Msfs Msfs.SYS Wed Aug 04 01:00:37 2004 (41107B85)
f789d000 f78a4880 Npfs Npfs.SYS Wed Aug 04 01:00:38 2004 (41107B86)
f78b5000 f78b9a80 Aavmker4 Aavmker4.SYS Mon May 12 11:33:16 2008 (4828714C)
f78cd000 f78d1500 watchdog watchdog.sys Wed Aug 04 01:07:32 2004 (41107D24)
f790d000 f7915000 aswFsBlk aswFsBlk.sys Mon May 12 07:18:42 2008 (482835A2)
f795d000 f7960000 BOOTVID BOOTVID.dll Fri Aug 17 15:49:09 2001 (3B7D8345)
f79d9000 f79db900 Dxapi Dxapi.sys Fri Aug 17 15:53:19 2001 (3B7D843F)
f79fd000 f7a00c80 serenum serenum.sys Wed Aug 04 00:59:06 2004 (41107B2A)
f7a01000 f7a03980 gameenum gameenum.sys Wed Aug 04 01:08:20 2004 (41107D54)
f7a05000 f7a07580 ndistapi ndistapi.sys Fri Aug 17 15:55:29 2001 (3B7D84C1)
f7a15000 f7a18c80 mssmbios mssmbios.sys Wed Aug 04 01:07:47 2004 (41107D33)
f7a41000 f7a43280 rasacd rasacd.sys Fri Aug 17 15:55:39 2001 (3B7D84CB)
f7a49000 f7a4bf00 ws2ifsl ws2ifsl.sys Fri Aug 17 15:55:58 2001 (3B7D84DE)
f7a4d000 f7a4eb80 kdcom kdcom.dll Fri Aug 17 15:49:10 2001 (3B7D8346)
f7a4f000 f7a50100 WMILIB WMILIB.SYS Fri Aug 17 16:07:23 2001 (3B7D878B)
f7a51000 f7a52500 viaide viaide.sys Wed Aug 04 00:59:42 2004 (41107B4E)
f7a61000 f7a62100 swenum swenum.sys Wed Aug 04 00:58:41 2004 (41107B11)
f7a63000 f7a64280 USBD USBD.SYS Fri Aug 17 16:02:58 2001 (3B7D8682)
f7a65000 f7a66f00 Fs_Rec Fs_Rec.SYS Fri Aug 17 15:49:37 2001 (3B7D8361)
f7a67000 f7a68080 Beep Beep.SYS Fri Aug 17 15:47:33 2001 (3B7D82E5)
f7a69000 f7a6a080 mnmdd mnmdd.SYS Fri Aug 17 15:57:28 2001 (3B7D8538)
f7a6b000 f7a6c080 RDPCDD RDPCDD.sys Fri Aug 17 15:46:56 2001 (3B7D82C0)
f7a71000 f7a72100 dump_WMILIB dump_WMILIB.SYS Fri Aug 17 16:07:23 2001 (3B7D878B)
f7ac5000 f7ac6a80 ParVdm ParVdm.SYS Fri Aug 17 15:49:49 2001 (3B7D836D)
f7b53000 f7b53d00 dxgthk dxgthk.sys Fri Aug 17 15:53:12 2001 (3B7D8438)
f7b91000 f7b91c00 audstub audstub.sys Fri Aug 17 15:59:40 2001 (3B7D85BC)
f7be2000 f7be2b80 Null Null.SYS Fri Aug 17 15:47:39 2001 (3B7D82EB)

Unloaded modules:
f06a1000 f06cc000 kmixer.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
f0741000 f076c000 kmixer.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
f0bda000 f0c05000 kmixer.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
f7b1e000 f7b1f000 drmkaud.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
f0f83000 f0f90000 DMusic.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
f0ca5000 f0cc8000 aec.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
f0ea5000 f0eb3000 swmidi.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
f7a97000 f7a99000 splitter.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
f7885000 f788a000 Cdaudio.SYS
Timestamp: unavailable (00000000)
Checksum: 00000000
f7a3d000 f7a40000 Sfloppy.SYS
Timestamp: unavailable (00000000)
Checksum: 00000000
Closing open log file c:\debuglog.txt

MitchellCooley · 2008/05/15

While Spybot was running a bot check

Here is another one: Going to remove one stick of memory now.

Opened log file 'c:\debuglog.txt'

Microsoft (R) Windows Debugger Version 6.9.0003.113 X86
Copyright (c) Microsoft Corporation. All rights reserved.

Loading Dump File [C:\WINDOWS\Minidump\Mini051508-02.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: C:\WINDOWS;C:\WINDOWS\system32;C:\WINDOWS\system32\drivers
Windows XP Kernel Version 2600 (Service Pack 2) UP Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 2600.xpsp_sp2_gdr.070227-2254
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055a620
Debug session time: Thu May 15 00:28:34.980 2008 (GMT-5)
System Uptime: 0 days 0:22:36.536
Loading Kernel Symbols
............................................................................................................
Loading User Symbols
Loading unloaded module list
..........
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 100000D1, {575c3a46, d, 1, f74bbbf7}

Probably caused by : atapi.sys ( atapi!IdeResetBusSynchronized+ab )

Followup: MachineOwner
---------

kd> !analyze -v;r;kv;lmtn;.logclose;q
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: 575c3a46, memory referenced
Arg2: 0000000d, IRQL
Arg3: 00000001, value 0 = read operation, 1 = write operation
Arg4: f74bbbf7, address which referenced memory

Debugging Details:
------------------

WRITE_ADDRESS: 575c3a46

CURRENT_IRQL: d

FAULTING_IP:
atapi!IdeResetBusSynchronized+ab
f74bbbf7 884f03 mov byte ptr [edi+3],cl

CUSTOMER_CRASH_COUNT: 2

DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: 0xD1

PROCESS_NAME: Idle

LAST_CONTROL_TRANSFER: from 804da6ed to f74bbbf7

STACK_TEXT:
80550204 804da6ed 80550234 00000002 00000000 atapi!IdeResetBusSynchronized+0xab
80550244 804e3f3b 843d5030 00000000 804e3ef7 nt!KeSynchronizeExecution+0x17
80550264 804dc4fd 80557f40 00000000 85464ab0 nt!IopTimerDispatch+0x42
80550380 804dc378 80559080 80558e20 ffdff000 nt!KiTimerListExpire+0x122
805503ac 804dbbd4 80559480 00000000 00021122 nt!KiTimerExpiration+0xaf
805503d0 804dbb4d 00000000 0000000e 00000000 nt!KiRetireDpcList+0x46
805503d4 00000000 0000000e 00000000 00000000 nt!KiIdleLoop+0x26

STACK_COMMAND: kb

FOLLOWUP_IP:
atapi!IdeResetBusSynchronized+ab
f74bbbf7 884f03 mov byte ptr [edi+3],cl

SYMBOL_STACK_INDEX: 0

SYMBOL_NAME: atapi!IdeResetBusSynchronized+ab

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: atapi

IMAGE_NAME: atapi.sys

DEBUG_FLR_IMAGE_TIMESTAMP: 41107b4d

FAILURE_BUCKET_ID: 0xD1_W_atapi!IdeResetBusSynchronized+ab

BUCKET_ID: 0xD1_W_atapi!IdeResetBusSynchronized+ab

Followup: MachineOwner
---------

eax=00000000 ebx=00000000 ecx=843d5104 edx=575c3a43 esi=843d50e8 edi=575c3a43
eip=f74bbbf7 esp=805501f4 ebp=80550204 iopl=0 nv up ei pl nz na po nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010202
atapi!IdeResetBusSynchronized+0xab:
f74bbbf7 884f03 mov byte ptr [edi+3],cl ds:0023:575c3a46=??
ChildEBP RetAddr Args to Child
80550204 804da6ed 80550234 00000002 00000000 atapi!IdeResetBusSynchronized+0xab (FPO: [Non-Fpo])
80550244 804e3f3b 843d5030 00000000 804e3ef7 nt!KeSynchronizeExecution+0x17
80550264 804dc4fd 80557f40 00000000 85464ab0 nt!IopTimerDispatch+0x42 (FPO: [Non-Fpo])
80550380 804dc378 80559080 80558e20 ffdff000 nt!KiTimerListExpire+0x122 (FPO: [Non-Fpo])
805503ac 804dbbd4 80559480 00000000 00021122 nt!KiTimerExpiration+0xaf (FPO: [Non-Fpo])
805503d0 804dbb4d 00000000 0000000e 00000000 nt!KiRetireDpcList+0x46 (FPO: [0,0,0])
805503d4 00000000 0000000e 00000000 00000000 nt!KiIdleLoop+0x26 (FPO: [0,0,0])
start end module name
804d7000 806eb500 nt ntoskrnl.exe Wed Feb 28 03:10:41 2007 (45E54711)
806ec000 806ffd80 hal halacpi.dll Wed Aug 04 00:59:04 2004 (41107B28)
bf800000 bf9c2800 win32k win32k.sys Wed Mar 19 04:46:46 2008 (47E0E106)
bf9c3000 bf9d4580 dxg dxg.sys Wed Aug 04 01:00:51 2004 (41107B93)
bf9d5000 bfd20380 vtdisp vtdisp.dll Mon Mar 07 20:50:05 2005 (422D12DD)
f027f000 f02a9180 kmixer kmixer.sys Wed Jun 14 03:47:45 2006 (448FCD31)
f0502000 f0542280 HTTP HTTP.sys Thu Mar 16 19:33:09 2006 (441A03C5)
f066a000 f066db20 aswRdr aswRdr.SYS Mon May 12 11:34:40 2008 (482871A0)
f08de000 f092f480 srv srv.sys Mon Aug 14 05:34:39 2006 (44E051BF)
f0980000 f09abd80 mrxdav mrxdav.sys Tue Dec 18 03:51:33 2007 (47679825)
f0b92000 f0ba6400 wdmaud wdmaud.sys Wed Jun 14 04:00:44 2006 (448FD03C)
f0e9f000 f0eb4680 aswMon2 aswMon2.SYS Mon May 12 07:18:23 2008 (4828358F)
f0fcd000 f0fdd200 EAPPkt EAPPkt.sys Thu Mar 31 21:43:01 2005 (424CB535)
f10f2000 f10f5280 ndisuio ndisuio.sys Wed Aug 04 01:03:10 2004 (41107C1E)
f59e6000 f59fd480 dump_atapi dump_atapi.sys Wed Aug 04 00:59:41 2004 (41107B4D)
f59fe000 f5a15000 aswSP aswSP.SYS Mon May 12 07:16:16 2008 (48283510)
f5a15000 f5a35f00 ipnat ipnat.sys Wed Sep 29 17:28:36 2004 (415B3714)
f5a36000 f5aa4a00 mrxsmb mrxsmb.sys Fri May 05 04:41:42 2006 (445B1DD6)
f5acd000 f5af7a00 rdbss rdbss.sys Fri May 05 04:47:55 2006 (445B1F4B)
f5af8000 f5b19d00 afd afd.sys Wed Aug 04 01:14:13 2004 (41107EB5)
f5b1a000 f5b41c00 netbt netbt.sys Wed Aug 04 01:14:36 2004 (41107ECC)
f5b42000 f5b99e80 tcpip tcpip.sys Tue Oct 30 12:20:52 2007 (472767F4)
f5b9a000 f5bac400 ipsec ipsec.sys Wed Aug 04 01:14:27 2004 (41107EC3)
f6c1c000 f6c4f200 update update.sys Wed Aug 04 00:58:32 2004 (41107B08)
f6c50000 f6c5ed80 sysaudio sysaudio.sys Wed Aug 04 01:15:54 2004 (41107F1A)
f6cf0000 f6d00e00 psched psched.sys Wed Aug 04 01:04:16 2004 (41107C60)
f6d01000 f6d17680 ndiswan ndiswan.sys Wed Aug 04 01:14:30 2004 (41107EC6)
f6d18000 f6d2b900 parport parport.sys Wed Aug 04 00:59:04 2004 (41107B28)
f6d2c000 f6d4f980 portcls portcls.sys Wed Aug 04 01:15:47 2004 (41107F13)
f6d50000 f6d81b80 vinyl97 vinyl97.sys Sun Oct 08 23:58:46 2006 (4529D706)
f6d82000 f6da4680 ks ks.sys Wed Aug 04 01:15:20 2004 (41107EF8)
f6da5000 f6dc7e80 USBPORT USBPORT.SYS Wed Aug 04 01:08:34 2004 (41107D62)
f6dc8000 f6ddb780 VIDEOPRT VIDEOPRT.SYS Wed Aug 04 01:07:04 2004 (41107D08)
f6ddc000 f6e06200 vtmini vtmini.sys Mon Mar 07 20:50:15 2005 (422D12E7)
f7398000 f73b2580 Mup Mup.sys Wed Aug 04 01:15:20 2004 (41107EF8)
f73b3000 f73dfa80 NDIS NDIS.sys Wed Aug 04 01:14:27 2004 (41107EC3)
f73e0000 f746c400 Ntfs Ntfs.sys Fri Feb 09 05:10:31 2007 (45CC56A7)
f746d000 f7483780 KSecDD KSecDD.sys Wed Aug 04 00:59:45 2004 (41107B51)
f7484000 f7495f00 sr sr.sys Wed Aug 04 01:06:22 2004 (41107CDE)
f7496000 f74b5780 fltmgr fltmgr.sys Mon Aug 21 04:14:57 2006 (44E97991)
f74b6000 f74cd480 atapi atapi.sys Wed Aug 04 00:59:41 2004 (41107B4D)
f74ce000 f74ec880 ftdisk ftdisk.sys Fri Aug 17 15:52:41 2001 (3B7D8419)
f74ed000 f74fda80 pci pci.sys Wed Aug 04 01:07:45 2004 (41107D31)
f74fe000 f752bd80 ACPI ACPI.sys Wed Aug 04 01:07:35 2004 (41107D27)
f754d000 f7555c00 isapnp isapnp.sys Fri Aug 17 15:58:01 2001 (3B7D8559)
f755d000 f7567500 MountMgr MountMgr.sys Wed Aug 04 00:58:29 2004 (41107B05)
f756d000 f7579c80 VolSnap VolSnap.sys Wed Aug 04 01:00:14 2004 (41107B6E)
f757d000 f7585e00 disk disk.sys Wed Aug 04 00:59:53 2004 (41107B59)
f758d000 f7599200 CLASSPNP CLASSPNP.SYS Wed Aug 04 01:14:26 2004 (41107EC2)
f759d000 f75a7e80 uagp35 uagp35.sys Wed Aug 04 01:07:43 2004 (41107D2F)
f75cd000 f75d5700 wanarp wanarp.sys Wed Aug 04 01:04:57 2004 (41107C89)
f75ed000 f75fc900 Cdfs Cdfs.SYS Wed Aug 04 01:14:09 2004 (41107EB1)
f769d000 f76a6200 amdk7 amdk7.sys Wed Aug 04 00:59:19 2004 (41107B37)
f76ad000 f76b9180 cdrom cdrom.sys Wed Aug 04 00:59:52 2004 (41107B58)
f76bd000 f76cb080 redbook redbook.sys Wed Aug 04 00:59:34 2004 (41107B46)
f76cd000 f76d7380 imapi imapi.sys Wed Aug 04 01:00:12 2004 (41107B6C)
f76dd000 f76ebb80 drmk drmk.sys Wed Aug 04 01:07:54 2004 (41107D3A)
f76ed000 f76f7a00 fetnd5bv fetnd5bv.sys Fri Sep 21 06:24:02 2007 (46F3A9D2)
f76fd000 f770cd80 serial serial.sys Wed Aug 04 01:15:51 2004 (41107F17)
f770d000 f7719e00 i8042prt i8042prt.sys Wed Aug 04 01:14:36 2004 (41107ECC)
f771d000 f7729880 rasl2tp rasl2tp.sys Wed Aug 04 01:14:21 2004 (41107EBD)
f772d000 f7737200 raspppoe raspppoe.sys Wed Aug 04 01:05:06 2004 (41107C92)
f773d000 f7748d00 raspptp raspptp.sys Wed Aug 04 01:14:26 2004 (41107EC2)
f774d000 f7755900 msgpc msgpc.sys Wed Aug 04 01:04:11 2004 (41107C5B)
f775d000 f7766f00 termdd termdd.sys Wed Aug 04 00:58:52 2004 (41107B1C)
f776d000 f7776480 NDProxy NDProxy.SYS Fri Aug 17 15:55:30 2001 (3B7D84C2)
f777d000 f778b100 usbhub usbhub.sys Wed Aug 04 01:08:40 2004 (41107D68)
f779d000 f77a5360 aswTdi aswTdi.SYS Mon May 12 11:33:35 2008 (4828715F)
f77ad000 f77b5700 netbios netbios.sys Wed Aug 04 01:03:19 2004 (41107C27)
f77bd000 f77c5880 Fips Fips.SYS Fri Aug 17 20:31:49 2001 (3B7DC585)
f77cd000 f77d3200 PCIIDEX PCIIDEX.SYS Wed Aug 04 00:59:40 2004 (41107B4C)
f77d5000 f77d9900 PartMgr PartMgr.sys Fri Aug 17 20:32:23 2001 (3B7DC5A7)
f783d000 f7842000 usbuhci usbuhci.sys Wed Aug 04 01:08:34 2004 (41107D62)
f7845000 f784b800 usbehci usbehci.sys Wed Aug 04 01:08:34 2004 (41107D62)
f784d000 f784e000 fdc fdc.sys unavailable (00000000)
f7855000 f785aa00 mouclass mouclass.sys Wed Aug 04 00:58:32 2004 (41107B08)
f785d000 f7863000 kbdclass kbdclass.sys Wed Aug 04 00:58:32 2004 (41107B08)
f7865000 f7869880 TDI TDI.SYS Wed Aug 04 01:07:47 2004 (41107D33)
f786d000 f7871580 ptilink ptilink.sys Fri Aug 17 15:49:53 2001 (3B7D8371)
f7875000 f7879080 raspti raspti.sys Fri Aug 17 15:55:32 2001 (3B7D84C4)
f787d000 f7882000 flpydisk flpydisk.sys Wed Aug 04 00:59:24 2004 (41107B3C)
f788d000 f7892200 vga vga.sys Wed Aug 04 01:07:06 2004 (41107D0A)
f7895000 f7899a80 Msfs Msfs.SYS Wed Aug 04 01:00:37 2004 (41107B85)
f789d000 f78a4880 Npfs Npfs.SYS Wed Aug 04 01:00:38 2004 (41107B86)
f78ad000 f78b1a80 Aavmker4 Aavmker4.SYS Mon May 12 11:33:16 2008 (4828714C)
f78bd000 f78c1500 watchdog watchdog.sys Wed Aug 04 01:07:32 2004 (41107D24)
f78c5000 f78cd000 aswFsBlk aswFsBlk.sys Mon May 12 07:18:42 2008 (482835A2)
f795d000 f7960000 BOOTVID BOOTVID.dll Fri Aug 17 15:49:09 2001 (3B7D8345)
f79dd000 f79df900 Dxapi Dxapi.sys Fri Aug 17 15:53:19 2001 (3B7D843F)
f79f9000 f79fcc80 serenum serenum.sys Wed Aug 04 00:59:06 2004 (41107B2A)
f79fd000 f79ff980 gameenum gameenum.sys Wed Aug 04 01:08:20 2004 (41107D54)
f7a01000 f7a03580 ndistapi ndistapi.sys Fri Aug 17 15:55:29 2001 (3B7D84C1)
f7a11000 f7a14c80 mssmbios mssmbios.sys Wed Aug 04 01:07:47 2004 (41107D33)
f7a41000 f7a43280 rasacd rasacd.sys Fri Aug 17 15:55:39 2001 (3B7D84CB)
f7a49000 f7a4bf00 ws2ifsl ws2ifsl.sys Fri Aug 17 15:55:58 2001 (3B7D84DE)
f7a4d000 f7a4eb80 kdcom kdcom.dll Fri Aug 17 15:49:10 2001 (3B7D8346)
f7a4f000 f7a50100 WMILIB WMILIB.SYS Fri Aug 17 16:07:23 2001 (3B7D878B)
f7a51000 f7a52500 viaide viaide.sys Wed Aug 04 00:59:42 2004 (41107B4E)
f7a69000 f7a6a100 swenum swenum.sys Wed Aug 04 00:58:41 2004 (41107B11)
f7a6b000 f7a6c280 USBD USBD.SYS Fri Aug 17 16:02:58 2001 (3B7D8682)
f7a6d000 f7a6ef00 Fs_Rec Fs_Rec.SYS Fri Aug 17 15:49:37 2001 (3B7D8361)
f7a6f000 f7a70080 Beep Beep.SYS Fri Aug 17 15:47:33 2001 (3B7D82E5)
f7a71000 f7a72080 mnmdd mnmdd.SYS Fri Aug 17 15:57:28 2001 (3B7D8538)
f7a73000 f7a74080 RDPCDD RDPCDD.sys Fri Aug 17 15:46:56 2001 (3B7D82C0)
f7a77000 f7a78100 dump_WMILIB dump_WMILIB.SYS Fri Aug 17 16:07:23 2001 (3B7D878B)
f7ac1000 f7ac2a80 ParVdm ParVdm.SYS Fri Aug 17 15:49:49 2001 (3B7D836D)
f7b5b000 f7b5bb80 Null Null.SYS Fri Aug 17 15:47:39 2001 (3B7D82EB)
f7c58000 f7c58d00 dxgthk dxgthk.sys Fri Aug 17 15:53:12 2001 (3B7D8438)
f7c89000 f7c89c00 audstub audstub.sys Fri Aug 17 15:59:40 2001 (3B7D85BC)

Unloaded modules:
f027f000 f02aa000 kmixer.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
f0633000 f065e000 kmixer.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
f0b44000 f0b6f000 kmixer.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
f7b7b000 f7b7c000 drmkaud.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
f0d07000 f0d14000 DMusic.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
f0b6f000 f0b92000 aec.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
f0d17000 f0d25000 swmidi.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
f7aff000 f7b01000 splitter.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
f7885000 f788a000 Cdaudio.SYS
Timestamp: unavailable (00000000)
Checksum: 00000000
f7a3d000 f7a40000 Sfloppy.SYS
Timestamp: unavailable (00000000)
Checksum: 00000000
Closing open log file c:\debuglog.txt

PeteC · 2008/05/15

Even more fun trying to analyse these dump logs without the necessary background/expertise

I see I didn't post the usual reder re. dump logs .....

Unfortunately these logs require expert knowledge to analyze and there are only 2 members (who occasionally visit WindowsBBS.com) that have the depth of knowledge necessary. Other members can make observations and suggestions as to how you might proceed toward finding the cause ....
Click to expand...

Soldiering on ......

From the first dump .....

0x00000019: BAD_POOL_HEADER
(Click to consult the online MSDN article.)
A pool header issue is a problem with Windows memory allocation. Device driver issues are probably the msot common, but this can have diverse causes including bad sectors or other disk write issues, and problems with some routers. (By theory, RAM problems would be suspect for memory pool issues, but I haven’t been able to confirm this as a cause.)
Click to expand...

And from the second ....

0x000000D1: DRIVER_IRQL_NOT_LESS_OR_EQUAL
(Click to consult the online Win XP Resource Kit article.)
The system attempted to access pageable memory using a kernel process IRQL that was too high. The most typical cause is a bad device driver (one that uses improper addresses). It can also be caused by caused by faulty or mismatched RAM, or a damaged pagefile.
Click to expand...

I still suspect RAM or the RAM slots on the motherboard, but in the light of the Bad Pool Header it would not harm to run chkdsk and the drive manufacturer's disk diagnostic software .....

ExcelStore ....
http://www.excelstor.com/en/download.asp
Hitachi .....
http://www.hitachigst.com/hdd/support/download.htm
Samsung ....
http://www.samsung.com/global/business/hdd/support/utilities/Support_HUTIL.html
Seagate, Maxtor, Quantum .....
http://www.seagate.com/www/en-us/support/downloads/
Western Digital ....
http://support.wdc.com/download/

MitchellCooley · 2008/05/15

Thanks Pete, I will run a hard drive diagnostic today..

Took out one memory stick and ran the system for three or four hours. Disconnected it and reconnected mine so I could do some things. This morning I reconnected the errant machine and started a few programs it had been crashing on and it crashed when I started SpyBot S&D. Here is the dump

Opened log file 'c:\debuglog.txt'

Microsoft (R) Windows Debugger Version 6.9.0003.113 X86
Copyright (c) Microsoft Corporation. All rights reserved.

Loading Dump File [C:\WINDOWS\Minidump\Mini051508-03.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: C:\WINDOWS;C:\WINDOWS\system32;C:\WINDOWS\system32\drivers
Windows XP Kernel Version 2600 (Service Pack 2) UP Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 2600.xpsp_sp2_gdr.070227-2254
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055a620
Debug session time: Thu May 15 11:50:50.670 2008 (GMT-5)
System Uptime: 0 days 0:14:50.222
Loading Kernel Symbols
............................................................................................................
Loading User Symbols
Loading unloaded module list
.........
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1A, {41284, 7fdd7001, 1c58, c0503000}

Probably caused by : memory_corruption ( nt!MiLocateWsle+c0 )

Followup: MachineOwner
---------

kd> !analyze -v;r;kv;lmtn;.logclose;q
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

MEMORY_MANAGEMENT (1a)
# Any other values for parameter 1 must be individually examined.
Arguments:
Arg1: 00041284, A PTE or the working set list is corrupt.
Arg2: 7fdd7001
Arg3: 00001c58
Arg4: c0503000

Debugging Details:
------------------

BUGCHECK_STR: 0x1a_41284

CUSTOMER_CRASH_COUNT: 3

DEFAULT_BUCKET_ID: DRIVER_FAULT

PROCESS_NAME: SpybotSD.exe

LAST_CONTROL_TRANSFER: from 80524df7 to 8053354e

STACK_TEXT:
f4338b58 80524df7 0000001a 00041284 7fdd7001 nt!KeBugCheckEx+0x1b
f4338b90 804ead87 00001c58 7fdd7000 c03007fc nt!MiLocateWsle+0xc0
f4338bc0 804eb07e c01ff75c 7fdd7000 00000000 nt!MiDeletePte+0x1bb
f4338c84 804eb174 000001dc 7fe4ffff 00000000 nt!MiDeleteVirtualAddresses+0x162
f4338ca0 80568a9d 7fd60000 7fe4ffff f4338d64 nt!MiDeleteFreeVm+0x1d
f4338d4c 804de7ec ffffffff 0012f520 0012f524 nt!NtFreeVirtualMemory+0x431
f4338d4c 7c90eb94 ffffffff 0012f520 0012f524 nt!KiFastCallEntry+0xf8
WARNING: Frame IP not in any known module. Following frames may be wrong.
0012f514 00000000 00000000 00000000 00000000 0x7c90eb94

STACK_COMMAND: kb

FOLLOWUP_IP:
nt!MiLocateWsle+c0
80524df7 006a00 add byte ptr [edx],ch

SYMBOL_STACK_INDEX: 1

SYMBOL_NAME: nt!MiLocateWsle+c0

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nt

DEBUG_FLR_IMAGE_TIMESTAMP: 45e54711

IMAGE_NAME: memory_corruption

FAILURE_BUCKET_ID: 0x1a_41284_nt!MiLocateWsle+c0

BUCKET_ID: 0x1a_41284_nt!MiLocateWsle+c0

Followup: MachineOwner
---------

eax=ffdff13c ebx=7fdd7001 ecx=00000000 edx=fffff001 esi=c0503000 edi=c050bffc
eip=8053354e esp=f4338b40 ebp=f4338b58 iopl=0 nv up ei ng nz na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00000286
nt!KeBugCheckEx+0x1b:
8053354e 5d pop ebp
ChildEBP RetAddr Args to Child
f4338b58 80524df7 0000001a 00041284 7fdd7001 nt!KeBugCheckEx+0x1b (FPO: [Non-Fpo])
f4338b90 804ead87 00001c58 7fdd7000 c03007fc nt!MiLocateWsle+0xc0 (FPO: [Non-Fpo])
f4338bc0 804eb07e c01ff75c 7fdd7000 00000000 nt!MiDeletePte+0x1bb (FPO: [Non-Fpo])
f4338c84 804eb174 000001dc 7fe4ffff 00000000 nt!MiDeleteVirtualAddresses+0x162 (FPO: [Non-Fpo])
f4338ca0 80568a9d 7fd60000 7fe4ffff f4338d64 nt!MiDeleteFreeVm+0x1d (FPO: [Non-Fpo])
f4338d4c 804de7ec ffffffff 0012f520 0012f524 nt!NtFreeVirtualMemory+0x431 (FPO: [Non-Fpo])
f4338d4c 7c90eb94 ffffffff 0012f520 0012f524 nt!KiFastCallEntry+0xf8 (FPO: [0,0] TrapFrame @ f4338d64)
WARNING: Frame IP not in any known module. Following frames may be wrong.
0012f514 00000000 00000000 00000000 00000000 0x7c90eb94
start end module name
804d7000 806eb500 nt ntoskrnl.exe Wed Feb 28 03:10:41 2007 (45E54711)
806ec000 806ffd80 hal halacpi.dll Wed Aug 04 00:59:04 2004 (41107B28)
bf800000 bf9c2800 win32k win32k.sys Wed Mar 19 04:46:46 2008 (47E0E106)
bf9c3000 bf9d4580 dxg dxg.sys Wed Aug 04 01:00:51 2004 (41107B93)
bf9d5000 bfd20380 vtdisp vtdisp.dll Mon Mar 07 20:50:05 2005 (422D12DD)
f3eb2000 f3edc180 kmixer kmixer.sys Wed Jun 14 03:47:45 2006 (448FCD31)
f4135000 f4175280 HTTP HTTP.sys Thu Mar 16 19:33:09 2006 (441A03C5)
f43d1000 f4422480 srv srv.sys Mon Aug 14 05:34:39 2006 (44E051BF)
f44c3000 f44eed80 mrxdav mrxdav.sys Tue Dec 18 03:51:33 2007 (47679825)
f46d5000 f46e9400 wdmaud wdmaud.sys Wed Jun 14 04:00:44 2006 (448FD03C)
f4802000 f4810d80 sysaudio sysaudio.sys Wed Aug 04 01:15:54 2004 (41107F1A)
f4a0a000 f4a1f680 aswMon2 aswMon2.SYS Mon May 12 07:18:23 2008 (4828358F)
f4b10000 f4b20200 EAPPkt EAPPkt.sys Thu Mar 31 21:43:01 2005 (424CB535)
f4c1d000 f4c20280 ndisuio ndisuio.sys Wed Aug 04 01:03:10 2004 (41107C1E)
f9529000 f9540480 dump_atapi dump_atapi.sys Wed Aug 04 00:59:41 2004 (41107B4D)
f9549000 f954cb20 aswRdr aswRdr.SYS Mon May 12 11:34:40 2008 (482871A0)
f9569000 f9580000 aswSP aswSP.SYS Mon May 12 07:16:16 2008 (48283510)
f9580000 f95eea00 mrxsmb mrxsmb.sys Fri May 05 04:41:42 2006 (445B1DD6)
f95ef000 f9619a00 rdbss rdbss.sys Fri May 05 04:47:55 2006 (445B1F4B)
f961a000 f963bd00 afd afd.sys Wed Aug 04 01:14:13 2004 (41107EB5)
f963c000 f9663c00 netbt netbt.sys Wed Aug 04 01:14:36 2004 (41107ECC)
f9664000 f9684f00 ipnat ipnat.sys Wed Sep 29 17:28:36 2004 (415B3714)
f96ad000 f9704e80 tcpip tcpip.sys Tue Oct 30 12:20:52 2007 (472767F4)
f9705000 f9717400 ipsec ipsec.sys Wed Aug 04 01:14:27 2004 (41107EC3)
f97c8000 f97ca900 Dxapi Dxapi.sys Fri Aug 17 15:53:19 2001 (3B7D843F)
fa7d8000 fa80b200 update update.sys Wed Aug 04 00:58:32 2004 (41107B08)
fa8ac000 fa8bce00 psched psched.sys Wed Aug 04 01:04:16 2004 (41107C60)
fa8bd000 fa8d3680 ndiswan ndiswan.sys Wed Aug 04 01:14:30 2004 (41107EC6)
fa8d4000 fa8e7900 parport parport.sys Wed Aug 04 00:59:04 2004 (41107B28)
fa8e8000 fa90b980 portcls portcls.sys Wed Aug 04 01:15:47 2004 (41107F13)
fa918000 fa91af00 ws2ifsl ws2ifsl.sys Fri Aug 17 15:55:58 2001 (3B7D84DE)
fa934000 fa965b80 vinyl97 vinyl97.sys Sun Oct 08 23:58:46 2006 (4529D706)
fa966000 fa988680 ks ks.sys Wed Aug 04 01:15:20 2004 (41107EF8)
fa989000 fa9abe80 USBPORT USBPORT.SYS Wed Aug 04 01:08:34 2004 (41107D62)
fa9ac000 fa9bf780 VIDEOPRT VIDEOPRT.SYS Wed Aug 04 01:07:04 2004 (41107D08)
fa9c0000 fa9ea200 vtmini vtmini.sys Mon Mar 07 20:50:15 2005 (422D12E7)
faa0b000 faa25580 Mup Mup.sys Wed Aug 04 01:15:20 2004 (41107EF8)
faa26000 faa52a80 NDIS NDIS.sys Wed Aug 04 01:14:27 2004 (41107EC3)
faa53000 faadf400 Ntfs Ntfs.sys Fri Feb 09 05:10:31 2007 (45CC56A7)
faae0000 faaf6780 KSecDD KSecDD.sys Wed Aug 04 00:59:45 2004 (41107B51)
faaf7000 fab08f00 sr sr.sys Wed Aug 04 01:06:22 2004 (41107CDE)
fab09000 fab28780 fltmgr fltmgr.sys Mon Aug 21 04:14:57 2006 (44E97991)
fab29000 fab40480 atapi atapi.sys Wed Aug 04 00:59:41 2004 (41107B4D)
fab41000 fab5f880 ftdisk ftdisk.sys Fri Aug 17 15:52:41 2001 (3B7D8419)
fab60000 fab70a80 pci pci.sys Wed Aug 04 01:07:45 2004 (41107D31)
fab71000 fab9ed80 ACPI ACPI.sys Wed Aug 04 01:07:35 2004 (41107D27)
fabc0000 fabc8c00 isapnp isapnp.sys Fri Aug 17 15:58:01 2001 (3B7D8559)
fabd0000 fabda500 MountMgr MountMgr.sys Wed Aug 04 00:58:29 2004 (41107B05)
fabe0000 fabecc80 VolSnap VolSnap.sys Wed Aug 04 01:00:14 2004 (41107B6E)
fabf0000 fabf8e00 disk disk.sys Wed Aug 04 00:59:53 2004 (41107B59)
fac00000 fac0c200 CLASSPNP CLASSPNP.SYS Wed Aug 04 01:14:26 2004 (41107EC2)
fac10000 fac1ae80 uagp35 uagp35.sys Wed Aug 04 01:07:43 2004 (41107D2F)
fac40000 fac49200 amdk7 amdk7.sys Wed Aug 04 00:59:19 2004 (41107B37)
fac50000 fac5c180 cdrom cdrom.sys Wed Aug 04 00:59:52 2004 (41107B58)
fac60000 fac6e080 redbook redbook.sys Wed Aug 04 00:59:34 2004 (41107B46)
fac70000 fac7a380 imapi imapi.sys Wed Aug 04 01:00:12 2004 (41107B6C)
fac80000 fac8eb80 drmk drmk.sys Wed Aug 04 01:07:54 2004 (41107D3A)
fac90000 fac9aa00 fetnd5bv fetnd5bv.sys Fri Sep 21 06:24:02 2007 (46F3A9D2)
faca0000 facafd80 serial serial.sys Wed Aug 04 01:15:51 2004 (41107F17)
facb0000 facbce00 i8042prt i8042prt.sys Wed Aug 04 01:14:36 2004 (41107ECC)
facc0000 faccc880 rasl2tp rasl2tp.sys Wed Aug 04 01:14:21 2004 (41107EBD)
facd0000 facda200 raspppoe raspppoe.sys Wed Aug 04 01:05:06 2004 (41107C92)
face0000 facebd00 raspptp raspptp.sys Wed Aug 04 01:14:26 2004 (41107EC2)
facf0000 facf8900 msgpc msgpc.sys Wed Aug 04 01:04:11 2004 (41107C5B)
fad00000 fad09f00 termdd termdd.sys Wed Aug 04 00:58:52 2004 (41107B1C)
fad10000 fad19480 NDProxy NDProxy.SYS Fri Aug 17 15:55:30 2001 (3B7D84C2)
fad20000 fad2e100 usbhub usbhub.sys Wed Aug 04 01:08:40 2004 (41107D68)
fad40000 fad48360 aswTdi aswTdi.SYS Mon May 12 11:33:35 2008 (4828715F)
fad50000 fad58700 wanarp wanarp.sys Wed Aug 04 01:04:57 2004 (41107C89)
fad60000 fad68700 netbios netbios.sys Wed Aug 04 01:03:19 2004 (41107C27)
fad70000 fad78880 Fips Fips.SYS Fri Aug 17 20:31:49 2001 (3B7DC585)
fad90000 fad9f900 Cdfs Cdfs.SYS Wed Aug 04 01:14:09 2004 (41107EB1)
fae40000 fae46200 PCIIDEX PCIIDEX.SYS Wed Aug 04 00:59:40 2004 (41107B4C)
fae48000 fae4c900 PartMgr PartMgr.sys Fri Aug 17 20:32:23 2001 (3B7DC5A7)
fae68000 fae6d000 usbuhci usbuhci.sys Wed Aug 04 01:08:34 2004 (41107D62)
fae70000 fae76800 usbehci usbehci.sys Wed Aug 04 01:08:34 2004 (41107D62)
fae98000 fae99000 fdc fdc.sys unavailable (00000000)
faea8000 faeada00 mouclass mouclass.sys Wed Aug 04 00:58:32 2004 (41107B08)
faeb0000 faeb6000 kbdclass kbdclass.sys Wed Aug 04 00:58:32 2004 (41107B08)
faed0000 faed4880 TDI TDI.SYS Wed Aug 04 01:07:47 2004 (41107D33)
faee0000 faee4580 ptilink ptilink.sys Fri Aug 17 15:49:53 2001 (3B7D8371)
faef0000 faef4080 raspti raspti.sys Fri Aug 17 15:55:32 2001 (3B7D84C4)
faf00000 faf05000 flpydisk flpydisk.sys Wed Aug 04 00:59:24 2004 (41107B3C)
faf18000 faf1d200 vga vga.sys Wed Aug 04 01:07:06 2004 (41107D0A)
faf20000 faf28000 aswFsBlk aswFsBlk.sys Mon May 12 07:18:42 2008 (482835A2)
faf28000 faf2ca80 Msfs Msfs.SYS Wed Aug 04 01:00:37 2004 (41107B85)
faf38000 faf3f880 Npfs Npfs.SYS Wed Aug 04 01:00:38 2004 (41107B86)
faf58000 faf5ca80 Aavmker4 Aavmker4.SYS Mon May 12 11:33:16 2008 (4828714C)
faf98000 faf9c500 watchdog watchdog.sys Wed Aug 04 01:07:32 2004 (41107D24)
fafd0000 fafd3000 BOOTVID BOOTVID.dll Fri Aug 17 15:49:09 2001 (3B7D8345)
fb050000 fb052280 rasacd rasacd.sys Fri Aug 17 15:55:39 2001 (3B7D84CB)
fb060000 fb063c80 serenum serenum.sys Wed Aug 04 00:59:06 2004 (41107B2A)
fb06c000 fb06e980 gameenum gameenum.sys Wed Aug 04 01:08:20 2004 (41107D54)
fb074000 fb076580 ndistapi ndistapi.sys Fri Aug 17 15:55:29 2001 (3B7D84C1)
fb088000 fb08bc80 mssmbios mssmbios.sys Wed Aug 04 01:07:47 2004 (41107D33)
fb0c0000 fb0c1b80 kdcom kdcom.dll Fri Aug 17 15:49:10 2001 (3B7D8346)
fb0c2000 fb0c3100 WMILIB WMILIB.SYS Fri Aug 17 16:07:23 2001 (3B7D878B)
fb0c4000 fb0c5500 viaide viaide.sys Wed Aug 04 00:59:42 2004 (41107B4E)
fb0cc000 fb0cd100 swenum swenum.sys Wed Aug 04 00:58:41 2004 (41107B11)
fb0d2000 fb0d3280 USBD USBD.SYS Fri Aug 17 16:02:58 2001 (3B7D8682)
fb0d6000 fb0d7f00 Fs_Rec Fs_Rec.SYS Fri Aug 17 15:49:37 2001 (3B7D8361)
fb0da000 fb0db080 Beep Beep.SYS Fri Aug 17 15:47:33 2001 (3B7D82E5)
fb0de000 fb0df080 mnmdd mnmdd.SYS Fri Aug 17 15:57:28 2001 (3B7D8538)
fb0e2000 fb0e3080 RDPCDD RDPCDD.sys Fri Aug 17 15:46:56 2001 (3B7D82C0)
fb0e8000 fb0e9100 dump_WMILIB dump_WMILIB.SYS Fri Aug 17 16:07:23 2001 (3B7D878B)
fb14e000 fb14f000 ParVdm ParVdm.SYS unavailable (00000000)
fb19b000 fb19bd00 dxgthk dxgthk.sys Fri Aug 17 15:53:12 2001 (3B7D8438)
fb21c000 fb21cc00 audstub audstub.sys Fri Aug 17 15:59:40 2001 (3B7D85BC)
fb24c000 fb24d000 Null Null.SYS unavailable (00000000)

Unloaded modules:
f4176000 f41a1000 kmixer.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
f4687000 f46b2000 kmixer.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
fb222000 fb223000 drmkaud.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
f4902000 f490f000 DMusic.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
f46b2000 f46d5000 aec.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
f4932000 f4940000 swmidi.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
fb124000 fb126000 splitter.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
faf10000 faf15000 Cdaudio.SYS
Timestamp: unavailable (00000000)
Checksum: 00000000
fb048000 fb04b000 Sfloppy.SYS
Timestamp: unavailable (00000000)
Checksum: 00000000
Closing open log file c:\debuglog.txt

MitchellCooley · 2008/05/15

Another crash I found

Here is another crash I found which happened after the one in my previous post. Must have happened when I went to get coffee.

Ran the hard drive diagnostic (extended test) - it passed.

Opened log file 'c:\debuglog.txt'

Microsoft (R) Windows Debugger Version 6.9.0003.113 X86
Copyright (c) Microsoft Corporation. All rights reserved.

Loading Dump File [C:\WINDOWS\Minidump\Mini051508-02.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: C:\WINDOWS;C:\WINDOWS\system32;C:\WINDOWS\system32\drivers
Windows XP Kernel Version 2600 (Service Pack 2) UP Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 2600.xpsp_sp2_gdr.070227-2254
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055a620
Debug session time: Thu May 15 00:28:34.980 2008 (GMT-5)
System Uptime: 0 days 0:22:36.536
Loading Kernel Symbols
............................................................................................................
Loading User Symbols
Loading unloaded module list
..........
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 100000D1, {575c3a46, d, 1, f74bbbf7}

Probably caused by : atapi.sys ( atapi!IdeResetBusSynchronized+ab )

Followup: MachineOwner
---------

kd> !analyze -v;r;kv;lmtn;.logclose;q
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: 575c3a46, memory referenced
Arg2: 0000000d, IRQL
Arg3: 00000001, value 0 = read operation, 1 = write operation
Arg4: f74bbbf7, address which referenced memory

Debugging Details:
------------------

WRITE_ADDRESS: 575c3a46

CURRENT_IRQL: d

FAULTING_IP:
atapi!IdeResetBusSynchronized+ab
f74bbbf7 884f03 mov byte ptr [edi+3],cl

CUSTOMER_CRASH_COUNT: 2

DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: 0xD1

PROCESS_NAME: Idle

LAST_CONTROL_TRANSFER: from 804da6ed to f74bbbf7

STACK_TEXT:
80550204 804da6ed 80550234 00000002 00000000 atapi!IdeResetBusSynchronized+0xab
80550244 804e3f3b 843d5030 00000000 804e3ef7 nt!KeSynchronizeExecution+0x17
80550264 804dc4fd 80557f40 00000000 85464ab0 nt!IopTimerDispatch+0x42
80550380 804dc378 80559080 80558e20 ffdff000 nt!KiTimerListExpire+0x122
805503ac 804dbbd4 80559480 00000000 00021122 nt!KiTimerExpiration+0xaf
805503d0 804dbb4d 00000000 0000000e 00000000 nt!KiRetireDpcList+0x46
805503d4 00000000 0000000e 00000000 00000000 nt!KiIdleLoop+0x26

STACK_COMMAND: kb

FOLLOWUP_IP:
atapi!IdeResetBusSynchronized+ab
f74bbbf7 884f03 mov byte ptr [edi+3],cl

SYMBOL_STACK_INDEX: 0

SYMBOL_NAME: atapi!IdeResetBusSynchronized+ab

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: atapi

IMAGE_NAME: atapi.sys

DEBUG_FLR_IMAGE_TIMESTAMP: 41107b4d

FAILURE_BUCKET_ID: 0xD1_W_atapi!IdeResetBusSynchronized+ab

BUCKET_ID: 0xD1_W_atapi!IdeResetBusSynchronized+ab

Followup: MachineOwner
---------

eax=00000000 ebx=00000000 ecx=843d5104 edx=575c3a43 esi=843d50e8 edi=575c3a43
eip=f74bbbf7 esp=805501f4 ebp=80550204 iopl=0 nv up ei pl nz na po nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010202
atapi!IdeResetBusSynchronized+0xab:
f74bbbf7 884f03 mov byte ptr [edi+3],cl ds:0023:575c3a46=??
ChildEBP RetAddr Args to Child
80550204 804da6ed 80550234 00000002 00000000 atapi!IdeResetBusSynchronized+0xab (FPO: [Non-Fpo])
80550244 804e3f3b 843d5030 00000000 804e3ef7 nt!KeSynchronizeExecution+0x17
80550264 804dc4fd 80557f40 00000000 85464ab0 nt!IopTimerDispatch+0x42 (FPO: [Non-Fpo])
80550380 804dc378 80559080 80558e20 ffdff000 nt!KiTimerListExpire+0x122 (FPO: [Non-Fpo])
805503ac 804dbbd4 80559480 00000000 00021122 nt!KiTimerExpiration+0xaf (FPO: [Non-Fpo])
805503d0 804dbb4d 00000000 0000000e 00000000 nt!KiRetireDpcList+0x46 (FPO: [0,0,0])
805503d4 00000000 0000000e 00000000 00000000 nt!KiIdleLoop+0x26 (FPO: [0,0,0])
start end module name
804d7000 806eb500 nt ntoskrnl.exe Wed Feb 28 03:10:41 2007 (45E54711)
806ec000 806ffd80 hal halacpi.dll Wed Aug 04 00:59:04 2004 (41107B28)
bf800000 bf9c2800 win32k win32k.sys Wed Mar 19 04:46:46 2008 (47E0E106)
bf9c3000 bf9d4580 dxg dxg.sys Wed Aug 04 01:00:51 2004 (41107B93)
bf9d5000 bfd20380 vtdisp vtdisp.dll Mon Mar 07 20:50:05 2005 (422D12DD)
f027f000 f02a9180 kmixer kmixer.sys Wed Jun 14 03:47:45 2006 (448FCD31)
f0502000 f0542280 HTTP HTTP.sys Thu Mar 16 19:33:09 2006 (441A03C5)
f066a000 f066db20 aswRdr aswRdr.SYS Mon May 12 11:34:40 2008 (482871A0)
f08de000 f092f480 srv srv.sys Mon Aug 14 05:34:39 2006 (44E051BF)
f0980000 f09abd80 mrxdav mrxdav.sys Tue Dec 18 03:51:33 2007 (47679825)
f0b92000 f0ba6400 wdmaud wdmaud.sys Wed Jun 14 04:00:44 2006 (448FD03C)
f0e9f000 f0eb4680 aswMon2 aswMon2.SYS Mon May 12 07:18:23 2008 (4828358F)
f0fcd000 f0fdd200 EAPPkt EAPPkt.sys Thu Mar 31 21:43:01 2005 (424CB535)
f10f2000 f10f5280 ndisuio ndisuio.sys Wed Aug 04 01:03:10 2004 (41107C1E)
f59e6000 f59fd480 dump_atapi dump_atapi.sys Wed Aug 04 00:59:41 2004 (41107B4D)
f59fe000 f5a15000 aswSP aswSP.SYS Mon May 12 07:16:16 2008 (48283510)
f5a15000 f5a35f00 ipnat ipnat.sys Wed Sep 29 17:28:36 2004 (415B3714)
f5a36000 f5aa4a00 mrxsmb mrxsmb.sys Fri May 05 04:41:42 2006 (445B1DD6)
f5acd000 f5af7a00 rdbss rdbss.sys Fri May 05 04:47:55 2006 (445B1F4B)
f5af8000 f5b19d00 afd afd.sys Wed Aug 04 01:14:13 2004 (41107EB5)
f5b1a000 f5b41c00 netbt netbt.sys Wed Aug 04 01:14:36 2004 (41107ECC)
f5b42000 f5b99e80 tcpip tcpip.sys Tue Oct 30 12:20:52 2007 (472767F4)
f5b9a000 f5bac400 ipsec ipsec.sys Wed Aug 04 01:14:27 2004 (41107EC3)
f6c1c000 f6c4f200 update update.sys Wed Aug 04 00:58:32 2004 (41107B08)
f6c50000 f6c5ed80 sysaudio sysaudio.sys Wed Aug 04 01:15:54 2004 (41107F1A)
f6cf0000 f6d00e00 psched psched.sys Wed Aug 04 01:04:16 2004 (41107C60)
f6d01000 f6d17680 ndiswan ndiswan.sys Wed Aug 04 01:14:30 2004 (41107EC6)
f6d18000 f6d2b900 parport parport.sys Wed Aug 04 00:59:04 2004 (41107B28)
f6d2c000 f6d4f980 portcls portcls.sys Wed Aug 04 01:15:47 2004 (41107F13)
f6d50000 f6d81b80 vinyl97 vinyl97.sys Sun Oct 08 23:58:46 2006 (4529D706)
f6d82000 f6da4680 ks ks.sys Wed Aug 04 01:15:20 2004 (41107EF8)
f6da5000 f6dc7e80 USBPORT USBPORT.SYS Wed Aug 04 01:08:34 2004 (41107D62)
f6dc8000 f6ddb780 VIDEOPRT VIDEOPRT.SYS Wed Aug 04 01:07:04 2004 (41107D08)
f6ddc000 f6e06200 vtmini vtmini.sys Mon Mar 07 20:50:15 2005 (422D12E7)
f7398000 f73b2580 Mup Mup.sys Wed Aug 04 01:15:20 2004 (41107EF8)
f73b3000 f73dfa80 NDIS NDIS.sys Wed Aug 04 01:14:27 2004 (41107EC3)
f73e0000 f746c400 Ntfs Ntfs.sys Fri Feb 09 05:10:31 2007 (45CC56A7)
f746d000 f7483780 KSecDD KSecDD.sys Wed Aug 04 00:59:45 2004 (41107B51)
f7484000 f7495f00 sr sr.sys Wed Aug 04 01:06:22 2004 (41107CDE)
f7496000 f74b5780 fltmgr fltmgr.sys Mon Aug 21 04:14:57 2006 (44E97991)
f74b6000 f74cd480 atapi atapi.sys Wed Aug 04 00:59:41 2004 (41107B4D)
f74ce000 f74ec880 ftdisk ftdisk.sys Fri Aug 17 15:52:41 2001 (3B7D8419)
f74ed000 f74fda80 pci pci.sys Wed Aug 04 01:07:45 2004 (41107D31)
f74fe000 f752bd80 ACPI ACPI.sys Wed Aug 04 01:07:35 2004 (41107D27)
f754d000 f7555c00 isapnp isapnp.sys Fri Aug 17 15:58:01 2001 (3B7D8559)
f755d000 f7567500 MountMgr MountMgr.sys Wed Aug 04 00:58:29 2004 (41107B05)
f756d000 f7579c80 VolSnap VolSnap.sys Wed Aug 04 01:00:14 2004 (41107B6E)
f757d000 f7585e00 disk disk.sys Wed Aug 04 00:59:53 2004 (41107B59)
f758d000 f7599200 CLASSPNP CLASSPNP.SYS Wed Aug 04 01:14:26 2004 (41107EC2)
f759d000 f75a7e80 uagp35 uagp35.sys Wed Aug 04 01:07:43 2004 (41107D2F)
f75cd000 f75d5700 wanarp wanarp.sys Wed Aug 04 01:04:57 2004 (41107C89)
f75ed000 f75fc900 Cdfs Cdfs.SYS Wed Aug 04 01:14:09 2004 (41107EB1)
f769d000 f76a6200 amdk7 amdk7.sys Wed Aug 04 00:59:19 2004 (41107B37)
f76ad000 f76b9180 cdrom cdrom.sys Wed Aug 04 00:59:52 2004 (41107B58)
f76bd000 f76cb080 redbook redbook.sys Wed Aug 04 00:59:34 2004 (41107B46)
f76cd000 f76d7380 imapi imapi.sys Wed Aug 04 01:00:12 2004 (41107B6C)
f76dd000 f76ebb80 drmk drmk.sys Wed Aug 04 01:07:54 2004 (41107D3A)
f76ed000 f76f7a00 fetnd5bv fetnd5bv.sys Fri Sep 21 06:24:02 2007 (46F3A9D2)
f76fd000 f770cd80 serial serial.sys Wed Aug 04 01:15:51 2004 (41107F17)
f770d000 f7719e00 i8042prt i8042prt.sys Wed Aug 04 01:14:36 2004 (41107ECC)
f771d000 f7729880 rasl2tp rasl2tp.sys Wed Aug 04 01:14:21 2004 (41107EBD)
f772d000 f7737200 raspppoe raspppoe.sys Wed Aug 04 01:05:06 2004 (41107C92)
f773d000 f7748d00 raspptp raspptp.sys Wed Aug 04 01:14:26 2004 (41107EC2)
f774d000 f7755900 msgpc msgpc.sys Wed Aug 04 01:04:11 2004 (41107C5B)
f775d000 f7766f00 termdd termdd.sys Wed Aug 04 00:58:52 2004 (41107B1C)
f776d000 f7776480 NDProxy NDProxy.SYS Fri Aug 17 15:55:30 2001 (3B7D84C2)
f777d000 f778b100 usbhub usbhub.sys Wed Aug 04 01:08:40 2004 (41107D68)
f779d000 f77a5360 aswTdi aswTdi.SYS Mon May 12 11:33:35 2008 (4828715F)
f77ad000 f77b5700 netbios netbios.sys Wed Aug 04 01:03:19 2004 (41107C27)
f77bd000 f77c5880 Fips Fips.SYS Fri Aug 17 20:31:49 2001 (3B7DC585)
f77cd000 f77d3200 PCIIDEX PCIIDEX.SYS Wed Aug 04 00:59:40 2004 (41107B4C)
f77d5000 f77d9900 PartMgr PartMgr.sys Fri Aug 17 20:32:23 2001 (3B7DC5A7)
f783d000 f7842000 usbuhci usbuhci.sys Wed Aug 04 01:08:34 2004 (41107D62)
f7845000 f784b800 usbehci usbehci.sys Wed Aug 04 01:08:34 2004 (41107D62)
f784d000 f784e000 fdc fdc.sys unavailable (00000000)
f7855000 f785aa00 mouclass mouclass.sys Wed Aug 04 00:58:32 2004 (41107B08)
f785d000 f7863000 kbdclass kbdclass.sys Wed Aug 04 00:58:32 2004 (41107B08)
f7865000 f7869880 TDI TDI.SYS Wed Aug 04 01:07:47 2004 (41107D33)
f786d000 f7871580 ptilink ptilink.sys Fri Aug 17 15:49:53 2001 (3B7D8371)
f7875000 f7879080 raspti raspti.sys Fri Aug 17 15:55:32 2001 (3B7D84C4)
f787d000 f7882000 flpydisk flpydisk.sys Wed Aug 04 00:59:24 2004 (41107B3C)
f788d000 f7892200 vga vga.sys Wed Aug 04 01:07:06 2004 (41107D0A)
f7895000 f7899a80 Msfs Msfs.SYS Wed Aug 04 01:00:37 2004 (41107B85)
f789d000 f78a4880 Npfs Npfs.SYS Wed Aug 04 01:00:38 2004 (41107B86)
f78ad000 f78b1a80 Aavmker4 Aavmker4.SYS Mon May 12 11:33:16 2008 (4828714C)
f78bd000 f78c1500 watchdog watchdog.sys Wed Aug 04 01:07:32 2004 (41107D24)
f78c5000 f78cd000 aswFsBlk aswFsBlk.sys Mon May 12 07:18:42 2008 (482835A2)
f795d000 f7960000 BOOTVID BOOTVID.dll Fri Aug 17 15:49:09 2001 (3B7D8345)
f79dd000 f79df900 Dxapi Dxapi.sys Fri Aug 17 15:53:19 2001 (3B7D843F)
f79f9000 f79fcc80 serenum serenum.sys Wed Aug 04 00:59:06 2004 (41107B2A)
f79fd000 f79ff980 gameenum gameenum.sys Wed Aug 04 01:08:20 2004 (41107D54)
f7a01000 f7a03580 ndistapi ndistapi.sys Fri Aug 17 15:55:29 2001 (3B7D84C1)
f7a11000 f7a14c80 mssmbios mssmbios.sys Wed Aug 04 01:07:47 2004 (41107D33)
f7a41000 f7a43280 rasacd rasacd.sys Fri Aug 17 15:55:39 2001 (3B7D84CB)
f7a49000 f7a4bf00 ws2ifsl ws2ifsl.sys Fri Aug 17 15:55:58 2001 (3B7D84DE)
f7a4d000 f7a4eb80 kdcom kdcom.dll Fri Aug 17 15:49:10 2001 (3B7D8346)
f7a4f000 f7a50100 WMILIB WMILIB.SYS Fri Aug 17 16:07:23 2001 (3B7D878B)
f7a51000 f7a52500 viaide viaide.sys Wed Aug 04 00:59:42 2004 (41107B4E)
f7a69000 f7a6a100 swenum swenum.sys Wed Aug 04 00:58:41 2004 (41107B11)
f7a6b000 f7a6c280 USBD USBD.SYS Fri Aug 17 16:02:58 2001 (3B7D8682)
f7a6d000 f7a6ef00 Fs_Rec Fs_Rec.SYS Fri Aug 17 15:49:37 2001 (3B7D8361)
f7a6f000 f7a70080 Beep Beep.SYS Fri Aug 17 15:47:33 2001 (3B7D82E5)
f7a71000 f7a72080 mnmdd mnmdd.SYS Fri Aug 17 15:57:28 2001 (3B7D8538)
f7a73000 f7a74080 RDPCDD RDPCDD.sys Fri Aug 17 15:46:56 2001 (3B7D82C0)
f7a77000 f7a78100 dump_WMILIB dump_WMILIB.SYS Fri Aug 17 16:07:23 2001 (3B7D878B)
f7ac1000 f7ac2a80 ParVdm ParVdm.SYS Fri Aug 17 15:49:49 2001 (3B7D836D)
f7b5b000 f7b5bb80 Null Null.SYS Fri Aug 17 15:47:39 2001 (3B7D82EB)
f7c58000 f7c58d00 dxgthk dxgthk.sys Fri Aug 17 15:53:12 2001 (3B7D8438)
f7c89000 f7c89c00 audstub audstub.sys Fri Aug 17 15:59:40 2001 (3B7D85BC)

Unloaded modules:
f027f000 f02aa000 kmixer.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
f0633000 f065e000 kmixer.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
f0b44000 f0b6f000 kmixer.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
f7b7b000 f7b7c000 drmkaud.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
f0d07000 f0d14000 DMusic.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
f0b6f000 f0b92000 aec.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
f0d17000 f0d25000 swmidi.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
f7aff000 f7b01000 splitter.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
f7885000 f788a000 Cdaudio.SYS
Timestamp: unavailable (00000000)
Checksum: 00000000
f7a3d000 f7a40000 Sfloppy.SYS
Timestamp: unavailable (00000000)
Checksum: 00000000
Closing open log file c:\debuglog.txt

MitchellCooley · 2008/05/15

Additional Information about this system

Ok, have some additional information about this system.

This was originally a Dell Computer. The computer was hit by lightning (through a modem add on card) and the motherboard had to be replaced. Orginally an Intel system now an AMD. The hard drive is the original hard drive. The computer was not used much after the repair until another computer was purchased to replace it then this one was moved to another room and connected to Clearwire for internet access. The computer, now being used regularly, begins to crash.

The only things not replaced after the shock was the powersupply and the hard drive.

Don't know if it relates but thought it might be important.

Mitch

PeteC · 2008/05/15

The hard drive would seem to be OK on the basis of your testing - see if you can checkout the voltages supplied to the motherboard.

Everest should to the trick - look under Computer > Sensor in the left hand pane.

Post your findings.

MitchellCooley · 2008/05/16

On the second stick of RAM, no crashes yet......

Senser Information:

Sensor Properties:
Sensor Type ITE IT8712F (ISA 290h)

Temperatures:
Motherboard 32 °C (90 °F)
CPU 21 °C (70 °F)
Aux 45 °C (113 °F)

Cooling Fans:
CPU 3835 RPM

Voltage Values:
CPU Core 1.58 V
+2.5 V 2.43 V
+3.3 V 3.18 V
+5 V 4.84 V
+12 V 11.78 V
+5 V Standby 4.78 V
VBAT Battery 2.93 V
Debug Info F 2C FF FF
Debug Info T 45 32 21
Debug Info V 63 98 C7 B4 B8 C8 3F (F7)

MitchellCooley · 2008/05/16

Well, thought I was on a roll here. No crashes all day yesterday on the second stick of ram. But the true test was to turn the computer, wait a while, then try again. I turned it off this morning before I went to bed. Turned it on just a little while ago. Started Spybot S&D - crashed.

Opened log file 'c:\debuglog.txt'

Microsoft (R) Windows Debugger Version 6.9.0003.113 X86
Copyright (c) Microsoft Corporation. All rights reserved.

Loading Dump File [C:\WINDOWS\Minidump\Mini051608-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: C:\WINDOWS;C:\WINDOWS\system32;C:\WINDOWS\system32\drivers
Windows XP Kernel Version 2600 (Service Pack 2) UP Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 2600.xpsp_sp2_gdr.070227-2254
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055a620
Debug session time: Fri May 16 10:31:13.261 2008 (GMT-5)
System Uptime: 0 days 0:01:24.816
Loading Kernel Symbols
...............................................................................................................
Loading User Symbols
Loading unloaded module list
..
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1000000A, {bf651510, 2, 1, 804e6655}

Probably caused by : memory_corruption ( nt!MiRemovePageByColor+aa )

Followup: MachineOwner
---------

kd> !analyze -v;r;kv;lmtn;.logclose;q
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: bf651510, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000001, bitfield :
bit 0 : value 0 = read operation, 1 = write operation
bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: 804e6655, address which referenced memory

Debugging Details:
------------------

WRITE_ADDRESS: bf651510

CURRENT_IRQL: 2

FAULTING_IP:
nt!MiRemovePageByColor+aa
804e6655 890cc2 mov dword ptr [edx+eax*8],ecx

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: 0xA

PROCESS_NAME: SpybotSD.exe

LAST_CONTROL_TRANSFER: from 80505ecd to 804e6655

STACK_TEXT:
f4358d14 80505ecd 7ff17008 05c203c0 7ff10010 nt!MiRemovePageByColor+0xaa
f4358d4c 804e1718 00000001 7ff17008 01000001 nt!MmAccessFault+0xa4c
f4358d4c 00401642 00000001 7ff17008 01000001 nt!KiTrap0E+0xcc
WARNING: Frame IP not in any known module. Following frames may be wrong.
7ff10010 00000000 00000000 00000000 00000000 0x401642

STACK_COMMAND: kb

FOLLOWUP_IP:
nt!MiRemovePageByColor+aa
804e6655 890cc2 mov dword ptr [edx+eax*8],ecx

SYMBOL_STACK_INDEX: 0

SYMBOL_NAME: nt!MiRemovePageByColor+aa

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nt

DEBUG_FLR_IMAGE_TIMESTAMP: 45e54711

IMAGE_NAME: memory_corruption

FAILURE_BUCKET_ID: 0xA_W_nt!MiRemovePageByColor+aa

BUCKET_ID: 0xA_W_nt!MiRemovePageByColor+aa

Followup: MachineOwner
---------

eax=87cca2a2 ebx=00000002 ecx=00008a84 edx=81000000 esi=81051930 edi=00000003
eip=804e6655 esp=f4358cf8 ebp=f4358d14 iopl=0 nv up ei pl nz ac po cy
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00210213
nt!MiRemovePageByColor+0xaa:
804e6655 890cc2 mov dword ptr [edx+eax*8],ecx ds:0023:bf651510=????????
ChildEBP RetAddr Args to Child
f4358d14 80505ecd 7ff17008 05c203c0 7ff10010 nt!MiRemovePageByColor+0xaa (FPO: [Non-Fpo])
f4358d4c 804e1718 00000001 7ff17008 01000001 nt!MmAccessFault+0xa4c (FPO: [Non-Fpo])
f4358d4c 00401642 00000001 7ff17008 01000001 nt!KiTrap0E+0xcc (FPO: [0,0] TrapFrame @ f4358d64)
WARNING: Frame IP not in any known module. Following frames may be wrong.
7ff10010 00000000 00000000 00000000 00000000 0x401642
start end module name
804d7000 806eb500 nt ntoskrnl.exe Wed Feb 28 03:10:41 2007 (45E54711)
806ec000 806ffd80 hal halacpi.dll Wed Aug 04 00:59:04 2004 (41107B28)
bf800000 bf9c2800 win32k win32k.sys Wed Mar 19 04:46:46 2008 (47E0E106)
bf9c3000 bf9d4580 dxg dxg.sys Wed Aug 04 01:00:51 2004 (41107B93)
bf9d5000 bfd20380 vtdisp vtdisp.dll Mon Mar 07 20:50:05 2005 (422D12DD)
f43d1000 f4422480 srv srv.sys Mon Aug 14 05:34:39 2006 (44E051BF)
f44eb000 f4516d80 mrxdav mrxdav.sys Tue Dec 18 03:51:33 2007 (47679825)
f4687000 f46b1180 kmixer kmixer.sys Wed Jun 14 03:47:45 2006 (448FCD31)
f46b2000 f46d4c80 aec aec.sys Fri Oct 01 12:00:21 2004 (415D8D25)
f46d5000 f46e9400 wdmaud wdmaud.sys Wed Jun 14 04:00:44 2006 (448FD03C)
f483a000 f4848d80 sysaudio sysaudio.sys Wed Aug 04 01:15:54 2004 (41107F1A)
f4912000 f491ee80 DMusic DMusic.sys Wed Aug 04 01:07:37 2004 (41107D29)
f4972000 f497f400 swmidi swmidi.sys Fri Aug 17 16:00:42 2001 (3B7D85FA)
f4a0a000 f4a1f680 aswMon2 aswMon2.SYS Mon May 12 07:18:23 2008 (4828358F)
f4b10000 f4b20200 EAPPkt EAPPkt.sys Thu Mar 31 21:43:01 2005 (424CB535)
f4c11000 f4c14280 ndisuio ndisuio.sys Wed Aug 04 01:03:10 2004 (41107C1E)
f9529000 f9540480 dump_atapi dump_atapi.sys Wed Aug 04 00:59:41 2004 (41107B4D)
f9569000 f9580000 aswSP aswSP.SYS Mon May 12 07:16:16 2008 (48283510)
f9580000 f95eea00 mrxsmb mrxsmb.sys Fri May 05 04:41:42 2006 (445B1DD6)
f95ef000 f9619a00 rdbss rdbss.sys Fri May 05 04:47:55 2006 (445B1F4B)
f961a000 f963bd00 afd afd.sys Wed Aug 04 01:14:13 2004 (41107EB5)
f963c000 f9663c00 netbt netbt.sys Wed Aug 04 01:14:36 2004 (41107ECC)
f9664000 f9684f00 ipnat ipnat.sys Wed Sep 29 17:28:36 2004 (415B3714)
f96ad000 f9704e80 tcpip tcpip.sys Tue Oct 30 12:20:52 2007 (472767F4)
f9705000 f9717400 ipsec ipsec.sys Wed Aug 04 01:14:27 2004 (41107EC3)
f97c8000 f97ca900 Dxapi Dxapi.sys Fri Aug 17 15:53:19 2001 (3B7D843F)
fa7d8000 fa80b200 update update.sys Wed Aug 04 00:58:32 2004 (41107B08)
fa8ac000 fa8bce00 psched psched.sys Wed Aug 04 01:04:16 2004 (41107C60)
fa8bd000 fa8d3680 ndiswan ndiswan.sys Wed Aug 04 01:14:30 2004 (41107EC6)
fa8d4000 fa8e7900 parport parport.sys Wed Aug 04 00:59:04 2004 (41107B28)
fa8e8000 fa90b980 portcls portcls.sys Wed Aug 04 01:15:47 2004 (41107F13)
fa918000 fa91af00 ws2ifsl ws2ifsl.sys Fri Aug 17 15:55:58 2001 (3B7D84DE)
fa934000 fa965b80 vinyl97 vinyl97.sys Sun Oct 08 23:58:46 2006 (4529D706)
fa966000 fa988680 ks ks.sys Wed Aug 04 01:15:20 2004 (41107EF8)
fa989000 fa9abe80 USBPORT USBPORT.SYS Wed Aug 04 01:08:34 2004 (41107D62)
fa9ac000 fa9bf780 VIDEOPRT VIDEOPRT.SYS Wed Aug 04 01:07:04 2004 (41107D08)
fa9c0000 fa9ea200 vtmini vtmini.sys Mon Mar 07 20:50:15 2005 (422D12E7)
faa0b000 faa25580 Mup Mup.sys Wed Aug 04 01:15:20 2004 (41107EF8)
faa26000 faa52a80 NDIS NDIS.sys Wed Aug 04 01:14:27 2004 (41107EC3)
faa53000 faadf400 Ntfs Ntfs.sys Fri Feb 09 05:10:31 2007 (45CC56A7)
faae0000 faaf6780 KSecDD KSecDD.sys Wed Aug 04 00:59:45 2004 (41107B51)
faaf7000 fab08f00 sr sr.sys Wed Aug 04 01:06:22 2004 (41107CDE)
fab09000 fab28780 fltmgr fltmgr.sys Mon Aug 21 04:14:57 2006 (44E97991)
fab29000 fab40480 atapi atapi.sys Wed Aug 04 00:59:41 2004 (41107B4D)
fab41000 fab5f880 ftdisk ftdisk.sys Fri Aug 17 15:52:41 2001 (3B7D8419)
fab60000 fab70a80 pci pci.sys Wed Aug 04 01:07:45 2004 (41107D31)
fab71000 fab9ed80 ACPI ACPI.sys Wed Aug 04 01:07:35 2004 (41107D27)
fabc0000 fabc8c00 isapnp isapnp.sys Fri Aug 17 15:58:01 2001 (3B7D8559)
fabd0000 fabda500 MountMgr MountMgr.sys Wed Aug 04 00:58:29 2004 (41107B05)
fabe0000 fabecc80 VolSnap VolSnap.sys Wed Aug 04 01:00:14 2004 (41107B6E)
fabf0000 fabf8e00 disk disk.sys Wed Aug 04 00:59:53 2004 (41107B59)
fac00000 fac0c200 CLASSPNP CLASSPNP.SYS Wed Aug 04 01:14:26 2004 (41107EC2)
fac10000 fac1ae80 uagp35 uagp35.sys Wed Aug 04 01:07:43 2004 (41107D2F)
fac40000 fac49200 amdk7 amdk7.sys Wed Aug 04 00:59:19 2004 (41107B37)
fac50000 fac5c180 cdrom cdrom.sys Wed Aug 04 00:59:52 2004 (41107B58)
fac60000 fac6e080 redbook redbook.sys Wed Aug 04 00:59:34 2004 (41107B46)
fac70000 fac7a380 imapi imapi.sys Wed Aug 04 01:00:12 2004 (41107B6C)
fac80000 fac8eb80 drmk drmk.sys Wed Aug 04 01:07:54 2004 (41107D3A)
fac90000 fac9aa00 fetnd5bv fetnd5bv.sys Fri Sep 21 06:24:02 2007 (46F3A9D2)
faca0000 facafd80 serial serial.sys Wed Aug 04 01:15:51 2004 (41107F17)
facb0000 facbce00 i8042prt i8042prt.sys Wed Aug 04 01:14:36 2004 (41107ECC)
facc0000 faccc880 rasl2tp rasl2tp.sys Wed Aug 04 01:14:21 2004 (41107EBD)
facd0000 facda200 raspppoe raspppoe.sys Wed Aug 04 01:05:06 2004 (41107C92)
face0000 facebd00 raspptp raspptp.sys Wed Aug 04 01:14:26 2004 (41107EC2)
facf0000 facf8900 msgpc msgpc.sys Wed Aug 04 01:04:11 2004 (41107C5B)
fad00000 fad09f00 termdd termdd.sys Wed Aug 04 00:58:52 2004 (41107B1C)
fad10000 fad19480 NDProxy NDProxy.SYS Fri Aug 17 15:55:30 2001 (3B7D84C2)
fad20000 fad2e100 usbhub usbhub.sys Wed Aug 04 01:08:40 2004 (41107D68)
fad40000 fad48360 aswTdi aswTdi.SYS Mon May 12 11:33:35 2008 (4828715F)
fad50000 fad58700 wanarp wanarp.sys Wed Aug 04 01:04:57 2004 (41107C89)
fad60000 fad68700 netbios netbios.sys Wed Aug 04 01:03:19 2004 (41107C27)
fad70000 fad78880 Fips Fips.SYS Fri Aug 17 20:31:49 2001 (3B7DC585)
fad90000 fad9f900 Cdfs Cdfs.SYS Wed Aug 04 01:14:09 2004 (41107EB1)
fae40000 fae46200 PCIIDEX PCIIDEX.SYS Wed Aug 04 00:59:40 2004 (41107B4C)
fae48000 fae4c900 PartMgr PartMgr.sys Fri Aug 17 20:32:23 2001 (3B7DC5A7)
fae68000 fae6d000 usbuhci usbuhci.sys Wed Aug 04 01:08:34 2004 (41107D62)
fae70000 fae76800 usbehci usbehci.sys Wed Aug 04 01:08:34 2004 (41107D62)
fae98000 fae99000 fdc fdc.sys unavailable (00000000)
faea8000 faeada00 mouclass mouclass.sys Wed Aug 04 00:58:32 2004 (41107B08)
faeb0000 faeb6000 kbdclass kbdclass.sys Wed Aug 04 00:58:32 2004 (41107B08)
faed0000 faed4880 TDI TDI.SYS Wed Aug 04 01:07:47 2004 (41107D33)
faee0000 faee4580 ptilink ptilink.sys Fri Aug 17 15:49:53 2001 (3B7D8371)
faef0000 faef4080 raspti raspti.sys Fri Aug 17 15:55:32 2001 (3B7D84C4)
faf00000 faf05000 flpydisk flpydisk.sys Wed Aug 04 00:59:24 2004 (41107B3C)
faf18000 faf1d200 vga vga.sys Wed Aug 04 01:07:06 2004 (41107D0A)
faf20000 faf28000 aswFsBlk aswFsBlk.sys Mon May 12 07:18:42 2008 (482835A2)
faf28000 faf2ca80 Msfs Msfs.SYS Wed Aug 04 01:00:37 2004 (41107B85)
faf38000 faf3f880 Npfs Npfs.SYS Wed Aug 04 01:00:38 2004 (41107B86)
faf58000 faf5ca80 Aavmker4 Aavmker4.SYS Mon May 12 11:33:16 2008 (4828714C)
faf98000 faf9c500 watchdog watchdog.sys Wed Aug 04 01:07:32 2004 (41107D24)
fafd0000 fafd3000 BOOTVID BOOTVID.dll Fri Aug 17 15:49:09 2001 (3B7D8345)
fb050000 fb052280 rasacd rasacd.sys Fri Aug 17 15:55:39 2001 (3B7D84CB)
fb060000 fb063c80 serenum serenum.sys Wed Aug 04 00:59:06 2004 (41107B2A)
fb06c000 fb06e980 gameenum gameenum.sys Wed Aug 04 01:08:20 2004 (41107D54)
fb074000 fb076580 ndistapi ndistapi.sys Fri Aug 17 15:55:29 2001 (3B7D84C1)
fb088000 fb08bc80 mssmbios mssmbios.sys Wed Aug 04 01:07:47 2004 (41107D33)
fb0c0000 fb0c1b80 kdcom kdcom.dll Fri Aug 17 15:49:10 2001 (3B7D8346)
fb0c2000 fb0c3100 WMILIB WMILIB.SYS Fri Aug 17 16:07:23 2001 (3B7D878B)
fb0c4000 fb0c5500 viaide viaide.sys Wed Aug 04 00:59:42 2004 (41107B4E)
fb0cc000 fb0cd100 swenum swenum.sys Wed Aug 04 00:58:41 2004 (41107B11)
fb0d2000 fb0d3280 USBD USBD.SYS Fri Aug 17 16:02:58 2001 (3B7D8682)
fb0d6000 fb0d7f00 Fs_Rec Fs_Rec.SYS Fri Aug 17 15:49:37 2001 (3B7D8361)
fb0da000 fb0db080 Beep Beep.SYS Fri Aug 17 15:47:33 2001 (3B7D82E5)
fb0de000 fb0df080 mnmdd mnmdd.SYS Fri Aug 17 15:57:28 2001 (3B7D8538)
fb0e2000 fb0e3080 RDPCDD RDPCDD.sys Fri Aug 17 15:46:56 2001 (3B7D82C0)
fb0e8000 fb0e9100 dump_WMILIB dump_WMILIB.SYS Fri Aug 17 16:07:23 2001 (3B7D878B)
fb13a000 fb13b900 splitter splitter.sys Wed Jun 14 03:47:46 2006 (448FCD32)
fb174000 fb175a80 ParVdm ParVdm.SYS Fri Aug 17 15:49:49 2001 (3B7D836D)
fb199000 fb199d00 dxgthk dxgthk.sys Fri Aug 17 15:53:12 2001 (3B7D8438)
fb21d000 fb21dc00 audstub audstub.sys Fri Aug 17 15:59:40 2001 (3B7D85BC)
fb24e000 fb24f000 Null Null.SYS unavailable (00000000)
fb258000 fb258b80 drmkaud drmkaud.sys Wed Aug 04 01:07:56 2004 (41107D3C)

Unloaded modules:
faf10000 faf15000 Cdaudio.SYS
Timestamp: unavailable (00000000)
Checksum: 00000000
fb048000 fb04b000 Sfloppy.SYS
Timestamp: unavailable (00000000)
Checksum: 00000000
Closing open log file c:\debuglog.txt

MitchellCooley · 2008/05/16

Stick two in Bank two

Will have to put in stick one to test it now. Here is a new dump log. If the system crashes with the next stick in, would that tend to indicate both sticks of ram are no good or the RAM banks or mother board are failing?

Thanks Mitch

Opened log file 'c:\debuglog.txt'

Microsoft (R) Windows Debugger Version 6.9.0003.113 X86
Copyright (c) Microsoft Corporation. All rights reserved.

Loading Dump File [C:\WINDOWS\Minidump\Mini051608-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: C:\WINDOWS;C:\WINDOWS\system32;C:\WINDOWS\system32\drivers
Windows XP Kernel Version 2600 (Service Pack 2) UP Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 2600.xpsp_sp2_gdr.070227-2254
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055a620
Debug session time: Fri May 16 14:46:40.163 2008 (GMT-5)
System Uptime: 0 days 0:38:24.722
Loading Kernel Symbols
...........................................................................................................
Loading User Symbols
Loading unloaded module list
..........
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 4E, {99, 8772, 1, 0}

Probably caused by : memory_corruption ( nt!MiRestoreTransitionPte+161 )

Followup: MachineOwner
---------

kd> !analyze -v;r;kv;lmtn;.logclose;q
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

PFN_LIST_CORRUPT (4e)
Typically caused by drivers passing bad memory descriptor lists (ie: calling
MmUnlockPages twice with the same list, etc). If a kernel debugger is
available get the stack trace.
Arguments:
Arg1: 00000099, A PTE or PFN is corrupt
Arg2: 00008772, page frame number
Arg3: 00000001, current page state
Arg4: 00000000, 0

Debugging Details:
------------------

BUGCHECK_STR: 0x4E_99

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: DRIVER_FAULT

PROCESS_NAME: iexplore.exe

LAST_CONTROL_TRANSFER: from 80522378 to 8053354e

STACK_TEXT:
f403dcac 80522378 0000004e 00000099 00008772 nt!KeBugCheckEx+0x1b
f403dccc 80515b54 00000000 ffffffff 00000001 nt!MiRestoreTransitionPte+0x161
f403dce4 805159e7 00000001 804f91a0 c0300034 nt!MiRemovePageFromList+0xd5
f403dcec 804f91a0 c0300034 c000d030 ffb07930 nt!MiRemoveAnyPage+0x56
f403dd04 804e9475 0340c4e7 c000d030 ffb07930 nt!MiResolveDemandZeroFault+0xa5
f403dd4c 804e1718 00000001 0340c4e7 00000001 nt!MmAccessFault+0x7e8
f403dd4c 7c932397 00000001 0340c4e7 00000001 nt!KiTrap0E+0xcc
WARNING: Frame IP not in any known module. Following frames may be wrong.
02d5fbc4 00000000 00000000 00000000 00000000 0x7c932397

STACK_COMMAND: kb

FOLLOWUP_IP:
nt!MiRestoreTransitionPte+161
80522378 e88455fcff call nt!MiDecrementShareCount (804e7901)

SYMBOL_STACK_INDEX: 1

SYMBOL_NAME: nt!MiRestoreTransitionPte+161

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nt

DEBUG_FLR_IMAGE_TIMESTAMP: 45e54711

IMAGE_NAME: memory_corruption

FAILURE_BUCKET_ID: 0x4E_99_nt!MiRestoreTransitionPte+161

BUCKET_ID: 0x4E_99_nt!MiRestoreTransitionPte+161

Followup: MachineOwner
---------

eax=ffdff13c ebx=00008772 ecx=00000000 edx=810cb2b0 esi=8103c390 edi=80550880
eip=8053354e esp=f403dc94 ebp=f403dcac iopl=0 nv up ei ng nz na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00000286
nt!KeBugCheckEx+0x1b:
8053354e 5d pop ebp
ChildEBP RetAddr Args to Child
f403dcac 80522378 0000004e 00000099 00008772 nt!KeBugCheckEx+0x1b (FPO: [Non-Fpo])
f403dccc 80515b54 00000000 ffffffff 00000001 nt!MiRestoreTransitionPte+0x161 (FPO: [Non-Fpo])
f403dce4 805159e7 00000001 804f91a0 c0300034 nt!MiRemovePageFromList+0xd5 (FPO: [Non-Fpo])
f403dcec 804f91a0 c0300034 c000d030 ffb07930 nt!MiRemoveAnyPage+0x56 (FPO: [0,0,0])
f403dd04 804e9475 0340c4e7 c000d030 ffb07930 nt!MiResolveDemandZeroFault+0xa5 (FPO: [Non-Fpo])
f403dd4c 804e1718 00000001 0340c4e7 00000001 nt!MmAccessFault+0x7e8 (FPO: [Non-Fpo])
f403dd4c 7c932397 00000001 0340c4e7 00000001 nt!KiTrap0E+0xcc (FPO: [0,0] TrapFrame @ f403dd64)
WARNING: Frame IP not in any known module. Following frames may be wrong.
02d5fbc4 00000000 00000000 00000000 00000000 0x7c932397
start end module name
804d7000 806eb500 nt ntoskrnl.exe Wed Feb 28 03:10:41 2007 (45E54711)
806ec000 806ffd80 hal halacpi.dll Wed Aug 04 00:59:04 2004 (41107B28)
bf800000 bf9c2800 win32k win32k.sys Wed Mar 19 04:46:46 2008 (47E0E106)
bf9c3000 bf9d4580 dxg dxg.sys Wed Aug 04 01:00:51 2004 (41107B93)
bf9d5000 bfd20380 vtdisp vtdisp.dll Mon Mar 07 20:50:05 2005 (422D12DD)
f3b80000 f3bc0280 HTTP HTTP.sys Thu Mar 16 19:33:09 2006 (441A03C5)
f3cad000 f3cb0b20 aswRdr aswRdr.SYS Mon May 12 11:34:40 2008 (482871A0)
f3f34000 f3f85480 srv srv.sys Mon Aug 14 05:34:39 2006 (44E051BF)
f41b6000 f41e1d80 mrxdav mrxdav.sys Tue Dec 18 03:51:33 2007 (47679825)
f4300000 f4314400 wdmaud wdmaud.sys Wed Jun 14 04:00:44 2006 (448FD03C)
f4495000 f44a3d80 sysaudio sysaudio.sys Wed Aug 04 01:15:54 2004 (41107F1A)
f460d000 f4622680 aswMon2 aswMon2.SYS Mon May 12 07:18:23 2008 (4828358F)
f4673000 f4683200 EAPPkt EAPPkt.sys Thu Mar 31 21:43:01 2005 (424CB535)
f47ac000 f47af280 ndisuio ndisuio.sys Wed Aug 04 01:03:10 2004 (41107C1E)
f90b4000 f90cb480 dump_atapi dump_atapi.sys Wed Aug 04 00:59:41 2004 (41107B4D)
f90cc000 f90e3000 aswSP aswSP.SYS Mon May 12 07:16:16 2008 (48283510)
f90e3000 f9103f00 ipnat ipnat.sys Wed Sep 29 17:28:36 2004 (415B3714)
f9104000 f9172a00 mrxsmb mrxsmb.sys Fri May 05 04:41:42 2006 (445B1DD6)
f9173000 f919da00 rdbss rdbss.sys Fri May 05 04:47:55 2006 (445B1F4B)
f919e000 f91bfd00 afd afd.sys Wed Aug 04 01:14:13 2004 (41107EB5)
f91c0000 f91e7c00 netbt netbt.sys Wed Aug 04 01:14:36 2004 (41107ECC)
f91e8000 f923fe80 tcpip tcpip.sys Tue Oct 30 12:20:52 2007 (472767F4)
f9240000 f9252400 ipsec ipsec.sys Wed Aug 04 01:14:27 2004 (41107EC3)
f932b000 f932d900 Dxapi Dxapi.sys Fri Aug 17 15:53:19 2001 (3B7D843F)
fa362000 fa395200 update update.sys Wed Aug 04 00:58:32 2004 (41107B08)
fa436000 fa446e00 psched psched.sys Wed Aug 04 01:04:16 2004 (41107C60)
fa447000 fa45d680 ndiswan ndiswan.sys Wed Aug 04 01:14:30 2004 (41107EC6)
fa45e000 fa471900 parport parport.sys Wed Aug 04 00:59:04 2004 (41107B28)
fa472000 fa495980 portcls portcls.sys Wed Aug 04 01:15:47 2004 (41107F13)
fa496000 fa4c7b80 vinyl97 vinyl97.sys Sun Oct 08 23:58:46 2006 (4529D706)
fa4c8000 fa4ea680 ks ks.sys Wed Aug 04 01:15:20 2004 (41107EF8)
fa4eb000 fa50de80 USBPORT USBPORT.SYS Wed Aug 04 01:08:34 2004 (41107D62)
fa50e000 fa521780 VIDEOPRT VIDEOPRT.SYS Wed Aug 04 01:07:04 2004 (41107D08)
fa522000 fa54c200 vtmini vtmini.sys Mon Mar 07 20:50:15 2005 (422D12E7)
fa565000 fa567f00 ws2ifsl ws2ifsl.sys Fri Aug 17 15:55:58 2001 (3B7D84DE)
fa56d000 fa56f280 rasacd rasacd.sys Fri Aug 17 15:55:39 2001 (3B7D84CB)
faa0b000 faa25580 Mup Mup.sys Wed Aug 04 01:15:20 2004 (41107EF8)
faa26000 faa52a80 NDIS NDIS.sys Wed Aug 04 01:14:27 2004 (41107EC3)
faa53000 faadf400 Ntfs Ntfs.sys Fri Feb 09 05:10:31 2007 (45CC56A7)
faae0000 faaf6780 KSecDD KSecDD.sys Wed Aug 04 00:59:45 2004 (41107B51)
faaf7000 fab08f00 sr sr.sys Wed Aug 04 01:06:22 2004 (41107CDE)
fab09000 fab28780 fltmgr fltmgr.sys Mon Aug 21 04:14:57 2006 (44E97991)
fab29000 fab40480 atapi atapi.sys Wed Aug 04 00:59:41 2004 (41107B4D)
fab41000 fab5f880 ftdisk ftdisk.sys Fri Aug 17 15:52:41 2001 (3B7D8419)
fab60000 fab70a80 pci pci.sys Wed Aug 04 01:07:45 2004 (41107D31)
fab71000 fab9ed80 ACPI ACPI.sys Wed Aug 04 01:07:35 2004 (41107D27)
fabc0000 fabc8c00 isapnp isapnp.sys Fri Aug 17 15:58:01 2001 (3B7D8559)
fabd0000 fabda500 MountMgr MountMgr.sys Wed Aug 04 00:58:29 2004 (41107B05)
fabe0000 fabecc80 VolSnap VolSnap.sys Wed Aug 04 01:00:14 2004 (41107B6E)
fabf0000 fabf8e00 disk disk.sys Wed Aug 04 00:59:53 2004 (41107B59)
fac00000 fac0c200 CLASSPNP CLASSPNP.SYS Wed Aug 04 01:14:26 2004 (41107EC2)
fac10000 fac1ae80 uagp35 uagp35.sys Wed Aug 04 01:07:43 2004 (41107D2F)
fac40000 fac48880 Fips Fips.SYS Fri Aug 17 20:31:49 2001 (3B7DC585)
fac50000 fac58700 wanarp wanarp.sys Wed Aug 04 01:04:57 2004 (41107C89)
faca0000 facaf900 Cdfs Cdfs.SYS Wed Aug 04 01:14:09 2004 (41107EB1)
fad10000 fad19200 amdk7 amdk7.sys Wed Aug 04 00:59:19 2004 (41107B37)
fad20000 fad2c180 cdrom cdrom.sys Wed Aug 04 00:59:52 2004 (41107B58)
fad30000 fad3e080 redbook redbook.sys Wed Aug 04 00:59:34 2004 (41107B46)
fad40000 fad4a380 imapi imapi.sys Wed Aug 04 01:00:12 2004 (41107B6C)
fad50000 fad5eb80 drmk drmk.sys Wed Aug 04 01:07:54 2004 (41107D3A)
fad60000 fad6aa00 fetnd5bv fetnd5bv.sys Fri Sep 21 06:24:02 2007 (46F3A9D2)
fad70000 fad7fd80 serial serial.sys Wed Aug 04 01:15:51 2004 (41107F17)
fad80000 fad8ce00 i8042prt i8042prt.sys Wed Aug 04 01:14:36 2004 (41107ECC)
fad90000 fad9c880 rasl2tp rasl2tp.sys Wed Aug 04 01:14:21 2004 (41107EBD)
fada0000 fadaa200 raspppoe raspppoe.sys Wed Aug 04 01:05:06 2004 (41107C92)
fadb0000 fadbbd00 raspptp raspptp.sys Wed Aug 04 01:14:26 2004 (41107EC2)
fadc0000 fadc8900 msgpc msgpc.sys Wed Aug 04 01:04:11 2004 (41107C5B)
fadd0000 fadd9f00 termdd termdd.sys Wed Aug 04 00:58:52 2004 (41107B1C)
fade0000 fade9480 NDProxy NDProxy.SYS Fri Aug 17 15:55:30 2001 (3B7D84C2)
fadf0000 fadfe100 usbhub usbhub.sys Wed Aug 04 01:08:40 2004 (41107D68)
fae20000 fae28360 aswTdi aswTdi.SYS Mon May 12 11:33:35 2008 (4828715F)
fae30000 fae38700 netbios netbios.sys Wed Aug 04 01:03:19 2004 (41107C27)
fae40000 fae46200 PCIIDEX PCIIDEX.SYS Wed Aug 04 00:59:40 2004 (41107B4C)
fae48000 fae4c900 PartMgr PartMgr.sys Fri Aug 17 20:32:23 2001 (3B7DC5A7)
fae90000 fae95000 usbuhci usbuhci.sys Wed Aug 04 01:08:34 2004 (41107D62)
fae98000 fae9e800 usbehci usbehci.sys Wed Aug 04 01:08:34 2004 (41107D62)
faea0000 faea1000 fdc fdc.sys unavailable (00000000)
faea8000 faeada00 mouclass mouclass.sys Wed Aug 04 00:58:32 2004 (41107B08)
faeb0000 faeb6000 kbdclass kbdclass.sys Wed Aug 04 00:58:32 2004 (41107B08)
faeb8000 faebc880 TDI TDI.SYS Wed Aug 04 01:07:47 2004 (41107D33)
faec0000 faec4580 ptilink ptilink.sys Fri Aug 17 15:49:53 2001 (3B7D8371)
faec8000 faecc080 raspti raspti.sys Fri Aug 17 15:55:32 2001 (3B7D84C4)
faed0000 faed5000 flpydisk flpydisk.sys Wed Aug 04 00:59:24 2004 (41107B3C)
faee0000 faee5200 vga vga.sys Wed Aug 04 01:07:06 2004 (41107D0A)
faee8000 faeeca80 Msfs Msfs.SYS Wed Aug 04 01:00:37 2004 (41107B85)
faef0000 faef7880 Npfs Npfs.SYS Wed Aug 04 01:00:38 2004 (41107B86)
faf00000 faf04a80 Aavmker4 Aavmker4.SYS Mon May 12 11:33:16 2008 (4828714C)
faf30000 faf34500 watchdog watchdog.sys Wed Aug 04 01:07:32 2004 (41107D24)
faf50000 faf58000 aswFsBlk aswFsBlk.sys Mon May 12 07:18:42 2008 (482835A2)
fafd0000 fafd3000 BOOTVID BOOTVID.dll Fri Aug 17 15:49:09 2001 (3B7D8345)
fb074000 fb077c80 serenum serenum.sys Wed Aug 04 00:59:06 2004 (41107B2A)
fb078000 fb07a980 gameenum gameenum.sys Wed Aug 04 01:08:20 2004 (41107D54)
fb07c000 fb07e580 ndistapi ndistapi.sys Fri Aug 17 15:55:29 2001 (3B7D84C1)
fb08c000 fb08fc80 mssmbios mssmbios.sys Wed Aug 04 01:07:47 2004 (41107D33)
fb0c0000 fb0c1b80 kdcom kdcom.dll Fri Aug 17 15:49:10 2001 (3B7D8346)
fb0c2000 fb0c3100 WMILIB WMILIB.SYS Fri Aug 17 16:07:23 2001 (3B7D878B)
fb0c4000 fb0c5500 viaide viaide.sys Wed Aug 04 00:59:42 2004 (41107B4E)
fb0de000 fb0df100 swenum swenum.sys Wed Aug 04 00:58:41 2004 (41107B11)
fb0e0000 fb0e1280 USBD USBD.SYS Fri Aug 17 16:02:58 2001 (3B7D8682)
fb0e2000 fb0e3f00 Fs_Rec Fs_Rec.SYS Fri Aug 17 15:49:37 2001 (3B7D8361)
fb0e4000 fb0e5080 Beep Beep.SYS Fri Aug 17 15:47:33 2001 (3B7D82E5)
fb0e6000 fb0e7080 mnmdd mnmdd.SYS Fri Aug 17 15:57:28 2001 (3B7D8538)
fb0e8000 fb0e9080 RDPCDD RDPCDD.sys Fri Aug 17 15:46:56 2001 (3B7D82C0)
fb0f4000 fb0f5100 dump_WMILIB dump_WMILIB.SYS Fri Aug 17 16:07:23 2001 (3B7D878B)
fb11a000 fb11b000 ParVdm ParVdm.SYS unavailable (00000000)
fb1c6000 fb1c6d00 dxgthk dxgthk.sys Fri Aug 17 15:53:12 2001 (3B7D8438)
fb1e2000 fb1e2c00 audstub audstub.sys Fri Aug 17 15:59:40 2001 (3B7D85BC)
fb253000 fb254000 Null Null.SYS unavailable (00000000)

Unloaded modules:
f39ed000 f3a18000 kmixer.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
f3cb1000 f3cdc000 kmixer.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
f42b2000 f42dd000 kmixer.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
fb1c2000 fb1c3000 drmkaud.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
f4465000 f4472000 DMusic.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
f42dd000 f4300000 aec.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
f4485000 f4493000 swmidi.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
fb0f8000 fb0fa000 splitter.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
faed8000 faedd000 Cdaudio.SYS
Timestamp: unavailable (00000000)
Checksum: 00000000
fa571000 fa574000 Sfloppy.SYS
Timestamp: unavailable (00000000)
Checksum: 00000000
Closing open log file c:\debuglog.txt

mattman · 2008/05/16

MitchellCooley said:

I upgraded the video and ethernet drivers - his were very old.
Click to expand...

Before upgrading video drivers, I upgrade the motherboard/chipset drivers. Find updates for the chipset drivers.

Where did you get the video drivers from? Windows Updates, the graphics adapter manufacturer's website or the graphics chipset manufacturer's website? I prefer the adapter manufacturer's drivers.

Do a good clean-up of the drives. Go to Control Panel -> Internet Options delete the TIFs (don't rely on Disk Cleanup) and reset the size of the TIF folder to the suggested minimum.

Page File is also a form of memory. The paging file could be badly fragmented. After clean-up, run Error Checking (chkdsk) on the drive/s, including a disk surface check, then run the disk defragmenter.

Check the startup/background programs. They may be overloading the RAM and spilling over into Page File. Does disk activity stop quickly after logon? You can check the page file usage and free physical memory in Task Manager.

Is the inside of the machine free of dust build-up (heatsinks, air vents, etc)? Are all the fans spinning freely?

There's one or two checks for you Mitch

Matt

MitchellCooley · 2008/05/16

Matt,

I got the driver upgrades from VIA's website. Looked for the chipset drivers while I was there but didn't see them (Via's website isn't that friendly).

Ran checkdisk twice already. Defragmented couple of days ago (very fragmented).

will check the TIF. Inside is a bit dusty. Fans seem to be spinning ok but will buy a can of air and blow it out (Jim says he blew it out a few weeks ago) - pretty dusty for a few weeks.

Will check task manager and report back later today.

Thanks

Mitch

PeteC · 2008/05/17

If the system crashes with the next stick in, would that tend to indicate both sticks of ram are no good or the RAM banks or mother board are failing?
Click to expand...

The only way of differentiating between mobo and memory is to try a compatible, known to be good memory module.

Via chipset drivers are incorporated into a single package covering all chips. Start here ....

http://www.viaarena.com/?PageID=2

MitchellCooley · 2008/05/17

Crashed with stick one in bank two. Dump file follows.

Pete, I got the new chipset drivers and installed. So far so good. Both sticks of RAM are back in.

Did you get a chance to look at the sensor data?

Here is the dump log from last night:

Opened log file 'c:\debuglog.txt'

Microsoft (R) Windows Debugger Version 6.9.0003.113 X86
Copyright (c) Microsoft Corporation. All rights reserved.

Loading Dump File [C:\WINDOWS\Minidump\Mini051608-03.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: C:\WINDOWS;C:\WINDOWS\system32;C:\WINDOWS\system32\drivers
Windows XP Kernel Version 2600 (Service Pack 2) UP Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 2600.xpsp_sp2_gdr.070227-2254
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055a620
Debug session time: Fri May 16 20:51:44.806 2008 (GMT-5)
System Uptime: 0 days 0:53:37.356
Loading Kernel Symbols
...........................................................................................................
Loading User Symbols
Loading unloaded module list
........
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 100000D1, {3a003a00, 2, 1, 10005}

Probably caused by : win32k.sys ( win32k!xxxSleepThread+192 )

Followup: MachineOwner
---------

kd> !analyze -v;r;kv;lmtn;.logclose;q
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: 3a003a00, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000001, value 0 = read operation, 1 = write operation
Arg4: 00010005, address which referenced memory

Debugging Details:
------------------

WRITE_ADDRESS: 3a003a00

CURRENT_IRQL: 2

FAULTING_IP:
+10005
00010005 003d003a003a add byte ptr ds:[3A003A00h],bh

PROCESS_NAME: ashDisp.exe

CUSTOMER_CRASH_COUNT: 3

DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: 0xD1

LAST_CONTROL_TRANSFER: from bf802f60 to 00010005

STACK_TEXT:
WARNING: Frame IP not in any known module. Following frames may be wrong.
f4617c6c bf802f60 00000001 0000000d 00000001 0x10005
f4617ca8 bf801b40 000025ff 00000000 00000001 win32k!xxxSleepThread+0x192
f4617cec bf819fb8 f4617d18 000025ff 00000000 win32k!xxxRealInternalGetMessage+0x418
f4617d4c 804de7ec 011eff9c 00000000 00000000 win32k!NtUserGetMessage+0x27
f4617d4c 7c90eb94 011eff9c 00000000 00000000 nt!KiFastCallEntry+0xf8
011eff74 00000000 00000000 00000000 00000000 0x7c90eb94

STACK_COMMAND: kb

FOLLOWUP_IP:
win32k!xxxSleepThread+192
bf802f60 8945fc mov dword ptr [ebp-4],eax

SYMBOL_STACK_INDEX: 1

SYMBOL_NAME: win32k!xxxSleepThread+192

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: win32k

IMAGE_NAME: win32k.sys

DEBUG_FLR_IMAGE_TIMESTAMP: 47e0e106

FAILURE_BUCKET_ID: 0xD1_W_win32k!xxxSleepThread+192

BUCKET_ID: 0xD1_W_win32k!xxxSleepThread+192

Followup: MachineOwner
---------

eax=00000000 ebx=00000001 ecx=f4617d3c edx=80010031 esi=00000000 edi=00000001
eip=00010005 esp=f4617c40 ebp=f4617c6c iopl=0 nv up ei ng nz na pe cy
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010287
00010005 003d003a003a add byte ptr ds:[3A003A00h],bh ds:0023:3a003a00=??
ChildEBP RetAddr Args to Child
WARNING: Frame IP not in any known module. Following frames may be wrong.
f4617c6c bf802f60 00000001 0000000d 00000001 0x10005
f4617ca8 bf801b40 000025ff 00000000 00000001 win32k!xxxSleepThread+0x192 (FPO: [Non-Fpo])
f4617cec bf819fb8 f4617d18 000025ff 00000000 win32k!xxxRealInternalGetMessage+0x418 (FPO: [Non-Fpo])
f4617d4c 804de7ec 011eff9c 00000000 00000000 win32k!NtUserGetMessage+0x27 (FPO: [Non-Fpo])
f4617d4c 7c90eb94 011eff9c 00000000 00000000 nt!KiFastCallEntry+0xf8 (FPO: [0,0] TrapFrame @ f4617d64)
011eff74 00000000 00000000 00000000 00000000 0x7c90eb94
start end module name
804d7000 806eb500 nt ntoskrnl.exe Wed Feb 28 03:10:41 2007 (45E54711)
806ec000 806ffd80 hal halacpi.dll Wed Aug 04 00:59:04 2004 (41107B28)
bf800000 bf9c2800 win32k win32k.sys Wed Mar 19 04:46:46 2008 (47E0E106)
bf9c3000 bf9d4580 dxg dxg.sys Wed Aug 04 01:00:51 2004 (41107B93)
bf9d5000 bfd20380 vtdisp vtdisp.dll Mon Mar 07 20:50:05 2005 (422D12DD)
f3b2f000 f3b6f280 HTTP HTTP.sys Thu Mar 16 19:33:09 2006 (441A03C5)
f3c50000 f3c53b20 aswRdr aswRdr.SYS Mon May 12 11:34:40 2008 (482871A0)
f3eb8000 f3f09480 srv srv.sys Mon Aug 14 05:34:39 2006 (44E051BF)
f404a000 f4075d80 mrxdav mrxdav.sys Tue Dec 18 03:51:33 2007 (47679825)
f425c000 f4270400 wdmaud wdmaud.sys Wed Jun 14 04:00:44 2006 (448FD03C)
f43b9000 f43c7d80 sysaudio sysaudio.sys Wed Aug 04 01:15:54 2004 (41107F1A)
f44c9000 f44de680 aswMon2 aswMon2.SYS Mon May 12 07:18:23 2008 (4828358F)
f45cf000 f45df200 EAPPkt EAPPkt.sys Thu Mar 31 21:43:01 2005 (424CB535)
f4708000 f470b280 ndisuio ndisuio.sys Wed Aug 04 01:03:10 2004 (41107C1E)
f9010000 f9027480 dump_atapi dump_atapi.sys Wed Aug 04 00:59:41 2004 (41107B4D)
f9028000 f903f000 aswSP aswSP.SYS Mon May 12 07:16:16 2008 (48283510)
f903f000 f905ff00 ipnat ipnat.sys Wed Sep 29 17:28:36 2004 (415B3714)
f9060000 f90cea00 mrxsmb mrxsmb.sys Fri May 05 04:41:42 2006 (445B1DD6)
f90cf000 f90f9a00 rdbss rdbss.sys Fri May 05 04:47:55 2006 (445B1F4B)
f90fa000 f911bd00 afd afd.sys Wed Aug 04 01:14:13 2004 (41107EB5)
f911c000 f9143c00 netbt netbt.sys Wed Aug 04 01:14:36 2004 (41107ECC)
f9144000 f919be80 tcpip tcpip.sys Tue Oct 30 12:20:52 2007 (472767F4)
f919c000 f91ae400 ipsec ipsec.sys Wed Aug 04 01:14:27 2004 (41107EC3)
fa2be000 fa2f1200 update update.sys Wed Aug 04 00:58:32 2004 (41107B08)
fa392000 fa3a2e00 psched psched.sys Wed Aug 04 01:04:16 2004 (41107C60)
fa3a3000 fa3b9680 ndiswan ndiswan.sys Wed Aug 04 01:14:30 2004 (41107EC6)
fa3ba000 fa3cd900 parport parport.sys Wed Aug 04 00:59:04 2004 (41107B28)
fa3ce000 fa3f1980 portcls portcls.sys Wed Aug 04 01:15:47 2004 (41107F13)
fa3f2000 fa423b80 vinyl97 vinyl97.sys Sun Oct 08 23:58:46 2006 (4529D706)
fa424000 fa446680 ks ks.sys Wed Aug 04 01:15:20 2004 (41107EF8)
fa447000 fa469e80 USBPORT USBPORT.SYS Wed Aug 04 01:08:34 2004 (41107D62)
fa46a000 fa47d780 VIDEOPRT VIDEOPRT.SYS Wed Aug 04 01:07:04 2004 (41107D08)
fa47e000 fa4a8200 vtmini vtmini.sys Mon Mar 07 20:50:15 2005 (422D12E7)
fa4c5000 fa4c7f00 ws2ifsl ws2ifsl.sys Fri Aug 17 15:55:58 2001 (3B7D84DE)
fa4cd000 fa4cf280 rasacd rasacd.sys Fri Aug 17 15:55:39 2001 (3B7D84CB)
faa0b000 faa25580 Mup Mup.sys Wed Aug 04 01:15:20 2004 (41107EF8)
faa26000 faa52a80 NDIS NDIS.sys Wed Aug 04 01:14:27 2004 (41107EC3)
faa53000 faadf400 Ntfs Ntfs.sys Fri Feb 09 05:10:31 2007 (45CC56A7)
faae0000 faaf6780 KSecDD KSecDD.sys Wed Aug 04 00:59:45 2004 (41107B51)
faaf7000 fab08f00 sr sr.sys Wed Aug 04 01:06:22 2004 (41107CDE)
fab09000 fab28780 fltmgr fltmgr.sys Mon Aug 21 04:14:57 2006 (44E97991)
fab29000 fab40480 atapi atapi.sys Wed Aug 04 00:59:41 2004 (41107B4D)
fab41000 fab5f880 ftdisk ftdisk.sys Fri Aug 17 15:52:41 2001 (3B7D8419)
fab60000 fab70a80 pci pci.sys Wed Aug 04 01:07:45 2004 (41107D31)
fab71000 fab9ed80 ACPI ACPI.sys Wed Aug 04 01:07:35 2004 (41107D27)
fabc0000 fabc8c00 isapnp isapnp.sys Fri Aug 17 15:58:01 2001 (3B7D8559)
fabd0000 fabda500 MountMgr MountMgr.sys Wed Aug 04 00:58:29 2004 (41107B05)
fabe0000 fabecc80 VolSnap VolSnap.sys Wed Aug 04 01:00:14 2004 (41107B6E)
fabf0000 fabf8e00 disk disk.sys Wed Aug 04 00:59:53 2004 (41107B59)
fac00000 fac0c200 CLASSPNP CLASSPNP.SYS Wed Aug 04 01:14:26 2004 (41107EC2)
fac10000 fac1ae80 uagp35 uagp35.sys Wed Aug 04 01:07:43 2004 (41107D2F)
fac50000 fac5f900 Cdfs Cdfs.SYS Wed Aug 04 01:14:09 2004 (41107EB1)
fad00000 fad09200 amdk7 amdk7.sys Wed Aug 04 00:59:19 2004 (41107B37)
fad10000 fad1c180 cdrom cdrom.sys Wed Aug 04 00:59:52 2004 (41107B58)
fad20000 fad2e080 redbook redbook.sys Wed Aug 04 00:59:34 2004 (41107B46)
fad30000 fad3a380 imapi imapi.sys Wed Aug 04 01:00:12 2004 (41107B6C)
fad40000 fad4eb80 drmk drmk.sys Wed Aug 04 01:07:54 2004 (41107D3A)
fad50000 fad5aa00 fetnd5bv fetnd5bv.sys Fri Sep 21 06:24:02 2007 (46F3A9D2)
fad60000 fad6fd80 serial serial.sys Wed Aug 04 01:15:51 2004 (41107F17)
fad70000 fad7ce00 i8042prt i8042prt.sys Wed Aug 04 01:14:36 2004 (41107ECC)
fad80000 fad8c880 rasl2tp rasl2tp.sys Wed Aug 04 01:14:21 2004 (41107EBD)
fad90000 fad9a200 raspppoe raspppoe.sys Wed Aug 04 01:05:06 2004 (41107C92)
fada0000 fadabd00 raspptp raspptp.sys Wed Aug 04 01:14:26 2004 (41107EC2)
fadb0000 fadb8900 msgpc msgpc.sys Wed Aug 04 01:04:11 2004 (41107C5B)
fadc0000 fadc9f00 termdd termdd.sys Wed Aug 04 00:58:52 2004 (41107B1C)
fadd0000 fadd9480 NDProxy NDProxy.SYS Fri Aug 17 15:55:30 2001 (3B7D84C2)
fade0000 fadee100 usbhub usbhub.sys Wed Aug 04 01:08:40 2004 (41107D68)
fae00000 fae08360 aswTdi aswTdi.SYS Mon May 12 11:33:35 2008 (4828715F)
fae10000 fae18700 netbios netbios.sys Wed Aug 04 01:03:19 2004 (41107C27)
fae20000 fae28880 Fips Fips.SYS Fri Aug 17 20:31:49 2001 (3B7DC585)
fae30000 fae38700 wanarp wanarp.sys Wed Aug 04 01:04:57 2004 (41107C89)
fae40000 fae46200 PCIIDEX PCIIDEX.SYS Wed Aug 04 00:59:40 2004 (41107B4C)
fae48000 fae4c900 PartMgr PartMgr.sys Fri Aug 17 20:32:23 2001 (3B7DC5A7)
faeb0000 faeb5000 usbuhci usbuhci.sys Wed Aug 04 01:08:34 2004 (41107D62)
faeb8000 faebe800 usbehci usbehci.sys Wed Aug 04 01:08:34 2004 (41107D62)
faec0000 faec1000 fdc fdc.sys unavailable (00000000)
faec8000 faecda00 mouclass mouclass.sys Wed Aug 04 00:58:32 2004 (41107B08)
faed0000 faed6000 kbdclass kbdclass.sys Wed Aug 04 00:58:32 2004 (41107B08)
faed8000 faedc880 TDI TDI.SYS Wed Aug 04 01:07:47 2004 (41107D33)
faee0000 faee4580 ptilink ptilink.sys Fri Aug 17 15:49:53 2001 (3B7D8371)
faee8000 faeec080 raspti raspti.sys Fri Aug 17 15:55:32 2001 (3B7D84C4)
faef0000 faef5000 flpydisk flpydisk.sys Wed Aug 04 00:59:24 2004 (41107B3C)
faf00000 faf05200 vga vga.sys Wed Aug 04 01:07:06 2004 (41107D0A)
faf08000 faf0ca80 Msfs Msfs.SYS Wed Aug 04 01:00:37 2004 (41107B85)
faf10000 faf17880 Npfs Npfs.SYS Wed Aug 04 01:00:38 2004 (41107B86)
faf28000 faf2ca80 Aavmker4 Aavmker4.SYS Mon May 12 11:33:16 2008 (4828714C)
faf48000 faf4c500 watchdog watchdog.sys Wed Aug 04 01:07:32 2004 (41107D24)
faf50000 faf58000 aswFsBlk aswFsBlk.sys Mon May 12 07:18:42 2008 (482835A2)
fafd0000 fafd3000 BOOTVID BOOTVID.dll Fri Aug 17 15:49:09 2001 (3B7D8345)
fb058000 fb05a900 Dxapi Dxapi.sys Fri Aug 17 15:53:19 2001 (3B7D843F)
fb070000 fb073c80 serenum serenum.sys Wed Aug 04 00:59:06 2004 (41107B2A)
fb074000 fb076980 gameenum gameenum.sys Wed Aug 04 01:08:20 2004 (41107D54)
fb078000 fb07a580 ndistapi ndistapi.sys Fri Aug 17 15:55:29 2001 (3B7D84C1)
fb088000 fb08bc80 mssmbios mssmbios.sys Wed Aug 04 01:07:47 2004 (41107D33)
fb0c0000 fb0c1b80 kdcom kdcom.dll Fri Aug 17 15:49:10 2001 (3B7D8346)
fb0c2000 fb0c3100 WMILIB WMILIB.SYS Fri Aug 17 16:07:23 2001 (3B7D878B)
fb0c4000 fb0c5500 viaide viaide.sys Wed Aug 04 00:59:42 2004 (41107B4E)
fb0d6000 fb0d7100 swenum swenum.sys Wed Aug 04 00:58:41 2004 (41107B11)
fb0d8000 fb0d9280 USBD USBD.SYS Fri Aug 17 16:02:58 2001 (3B7D8682)
fb0da000 fb0dbf00 Fs_Rec Fs_Rec.SYS Fri Aug 17 15:49:37 2001 (3B7D8361)
fb0dc000 fb0dd080 Beep Beep.SYS Fri Aug 17 15:47:33 2001 (3B7D82E5)
fb0de000 fb0df080 mnmdd mnmdd.SYS Fri Aug 17 15:57:28 2001 (3B7D8538)
fb0e0000 fb0e1080 RDPCDD RDPCDD.sys Fri Aug 17 15:46:56 2001 (3B7D82C0)
fb0e2000 fb0e3100 dump_WMILIB dump_WMILIB.SYS Fri Aug 17 16:07:23 2001 (3B7D878B)
fb130000 fb131000 ParVdm ParVdm.SYS unavailable (00000000)
fb1f3000 fb1f3c00 audstub audstub.sys Fri Aug 17 15:59:40 2001 (3B7D85BC)
fb264000 fb265000 Null Null.SYS unavailable (00000000)
fb26f000 fb26fd00 dxgthk dxgthk.sys Fri Aug 17 15:53:12 2001 (3B7D8438)

Unloaded modules:
f420e000 f4239000 kmixer.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
fb290000 fb291000 drmkaud.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
f4239000 f425c000 aec.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
f4389000 f4396000 DMusic.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
f43a9000 f43b7000 swmidi.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
fb0ca000 fb0cc000 splitter.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
faef8000 faefd000 Cdaudio.SYS
Timestamp: unavailable (00000000)
Checksum: 00000000
fb0bc000 fb0bf000 Sfloppy.SYS
Timestamp: unavailable (00000000)
Checksum: 00000000
Closing open log file c:\debuglog.txt

Log in or Sign up

BSOD after system setting idle for 8 hours

MitchellCooley Inactive Thread Starter

PeteC SuperGeek Staff

MitchellCooley Inactive Thread Starter

MitchellCooley Inactive Thread Starter

PeteC SuperGeek Staff

MitchellCooley Inactive Thread Starter

MitchellCooley Inactive Thread Starter

MitchellCooley Inactive Thread Starter

PeteC SuperGeek Staff

MitchellCooley Inactive Thread Starter

MitchellCooley Inactive Thread Starter

MitchellCooley Inactive Thread Starter

PeteC SuperGeek Staff

MitchellCooley Inactive Thread Starter

MitchellCooley Inactive Thread Starter

MitchellCooley Inactive Thread Starter

mattman Inactive Alumni

MitchellCooley Inactive Thread Starter

PeteC SuperGeek Staff

MitchellCooley Inactive Thread Starter

Share This Page

Log in or Sign up

BSOD after system setting idle for 8 hours

MitchellCooley Inactive Thread Starter

PeteC SuperGeek Staff

MitchellCooley Inactive Thread Starter

MitchellCooley Inactive Thread Starter

PeteC SuperGeek Staff

MitchellCooley Inactive Thread Starter

MitchellCooley Inactive Thread Starter

MitchellCooley Inactive Thread Starter

PeteC SuperGeek Staff

MitchellCooley Inactive Thread Starter

MitchellCooley Inactive Thread Starter

MitchellCooley Inactive Thread Starter

PeteC SuperGeek Staff

MitchellCooley Inactive Thread Starter

MitchellCooley Inactive Thread Starter

MitchellCooley Inactive Thread Starter

mattman Inactive Alumni

MitchellCooley Inactive Thread Starter

PeteC SuperGeek Staff

MitchellCooley Inactive Thread Starter

Share This Page

Useful Searches