Can't figure out this BSOD...

This computer crashes shortly after booting to the desktop (usually a minute or two after).

Booting in safe mode works fine, I've run MemTest86 and everything checks out OK (tried new RAM just to be sure - same thing).


I tried disabling all of the startup programs - also no luck... So I'm guessing it is a driver, but I can't seem to find the culprit!


Any ideas? (I'll post the dump in a moment)

 

Loading Dump File [G:\DUMPS\Mini071806-04.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: C:\Program Files\Debugging Tools for Windows
Executable search path is:
Windows XP Kernel Version 2600 (Service Pack 2) UP Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 2600.xpsp_sp2_gdr.050301-1519
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055a420
Debug session time: Tue Jul 18 10:55:32.109 2006 (GMT-7)
System Uptime: 0 days 0:06:05.686
Loading Kernel Symbols
.............................................................................................................................................................................
Loading User Symbols
Loading unloaded module list
........
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1000008E, {c0000005, ff884b6c, ef1e4a68, 0}

Probably caused by : ntoskrnl.exe ( nt!PspCreateThread+3e3 )

Followup: MachineOwner
---------

kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

KERNEL_MODE_EXCEPTION_NOT_HANDLED_M (1000008e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003. This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG. This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG. This will let us see why this breakpoint is
happening.
Arguments:
Arg1: c0000005, The exception code that was not handled
Arg2: ff884b6c, The address that the exception occurred at
Arg3: ef1e4a68, Trap Frame
Arg4: 00000000

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx ". The memory could not be "%s ".

FAULTING_IP:
+ffffffffff884b6c
ff884b6c 8a1401 mov dl,[ecx+eax]

TRAP_FRAME: ef1e4a68 -- (.trap ffffffffef1e4a68)
ErrCode = 00000000
eax=00000000 ebx=ff88b508 ecx=0101d000 edx=804dd220 esi=00001000 edi=0101c000
eip=ff884b6c esp=ef1e4adc ebp=ef1e4ae8 iopl=0 nv up ei pl nz na po nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010206
ff884b6c 8a1401 mov dl,[ecx+eax] ds:0023:0101d000=??
Resetting default scope

CUSTOMER_CRASH_COUNT: 4

DEFAULT_BUCKET_ID: COMMON_SYSTEM_FAULT

BUGCHECK_STR: 0x8E

LAST_CONTROL_TRANSFER: from ff88620f to ff884b6c

STACK_TEXT:
WARNING: Frame IP not in any known module. Following frames may be wrong.
ef1e4ae8 ff88620f 0101c000 0000001e ff88b508 0xff884b6c
ef1e4b78 805f9351 00000b30 ff0fa870 00000001 0xff88620f
ef1e4b78 805f9351 00000b30 ff0fa870 00000001 nt!PspCreateThread+0x3e3
ef1e4cc4 8057b2a3 00c7ecbc 001f03ff 00000000 nt!PspCreateThread+0x3e3
ef1e4d3c 804de7ec 00c7ecbc 001f03ff 00000000 nt!NtCreateThread+0x118
ef1e4d3c 7c90eb94 00c7ecbc 001f03ff 00000000 nt!KiFastCallEntry+0xf8
00c7f338 00000000 00000000 00000000 00000000 0x7c90eb94


STACK_COMMAND: kb

FOLLOWUP_IP:
nt!PspCreateThread+3e3
805f9351 57 push edi

FAULTING_SOURCE_CODE:


SYMBOL_STACK_INDEX: 3

FOLLOWUP_NAME: MachineOwner

SYMBOL_NAME: nt!PspCreateThread+3e3

MODULE_NAME: nt

IMAGE_NAME: ntoskrnl.exe

DEBUG_FLR_IMAGE_TIMESTAMP: 42250ff9

FAILURE_BUCKET_ID: 0x8E_nt!PspCreateThread+3e3

BUCKET_ID: 0x8E_nt!PspCreateThread+3e3

Followup: MachineOwner
---------

 

No luck.

I updated the BIOS from Dell's website (this is a Dimension 2400), also already ran the memtest (as well as trying with new RAM). Memtest came out clean and the alternate RAM didn't help the problem any.

The eventlog isn't showing me much of anything...
The only error/urgent messages are the system errors/crashes themselves.
The app. log doesn't show anything unusual (it's more than a minute from the last app. log entry to the time of the crash).


I disabled most all of the startup programs and used the Last Good Config. boot option, and everything seemed to work fine... But shortly after starting the install of automatic Windows updates, it crashed again.
Rebooted, seems to be working OK thus far... disabled automatic updates (as this computer will normally be using a dial-up connection) and started installing them via the Windows Update website... The downloading is going smoothly, I'll let you know how the installation goes.

 

Crashed midway through the installations with...


KERNEL_MODE_EXCEPTION_NOT_HANDLED_M (1000008e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003. This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG. This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG. This will let us see why this breakpoint is
happening.
Arguments:
Arg1: c0000005, The exception code that was not handled
Arg2: ff864b6c, The address that the exception occurred at
Arg3: ef6a0a68, Trap Frame
Arg4: 00000000

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx ". The memory could not be "%s ".

FAULTING_IP:
+ffffffffff864b6c
ff864b6c 8a1401 mov dl,[ecx+eax]

TRAP_FRAME: ef6a0a68 -- (.trap ffffffffef6a0a68)
ErrCode = 00000000
eax=00000000 ebx=ff86b508 ecx=0101d000 edx=804dd220 esi=00001000 edi=0101c000
eip=ff864b6c esp=ef6a0adc ebp=ef6a0ae8 iopl=0 nv up ei pl nz na po nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010206
ff864b6c 8a1401 mov dl,[ecx+eax] ds:0023:0101d000=??
Resetting default scope

CUSTOMER_CRASH_COUNT: 3

DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: 0x8E

LAST_CONTROL_TRANSFER: from ff86620f to ff864b6c

STACK_TEXT:
WARNING: Frame IP not in any known module. Following frames may be wrong.
ef6a0ae8 ff86620f 0101c000 0000001e ff86b508 0xff864b6c
ef6a0b78 805f9351 00000a14 ffacf268 00000001 0xff86620f
ef6a0b78 805f9351 00000a14 ffacf268 00000001 nt!PspCreateThread+0x3e3
ef6a0cc4 8057b2a3 00e7ecbc 001f03ff 00000000 nt!PspCreateThread+0x3e3
ef6a0d3c 804de7ec 00e7ecbc 001f03ff 00000000 nt!NtCreateThread+0x118
ef6a0d3c 7c90eb94 00e7ecbc 001f03ff 00000000 nt!KiFastCallEntry+0xf8
00e7f338 00000000 00000000 00000000 00000000 0x7c90eb94


STACK_COMMAND: kb

FOLLOWUP_IP:
nt!PspCreateThread+3e3
805f9351 57 push edi

FAULTING_SOURCE_CODE:


SYMBOL_STACK_INDEX: 3

FOLLOWUP_NAME: MachineOwner

SYMBOL_NAME: nt!PspCreateThread+3e3

MODULE_NAME: nt

IMAGE_NAME: ntoskrnl.exe

DEBUG_FLR_IMAGE_TIMESTAMP: 42250ff9

FAILURE_BUCKET_ID: 0x8E_nt!PspCreateThread+3e3

BUCKET_ID: 0x8E_nt!PspCreateThread+3e3

Followup: MachineOwner
---------


Now with 1 update left, it crashes right away (Windows Malicious Software Removal Tool).

Seems to have installed all the other critical/optional updates.