Can't run any update to win XP sp2 - BSOD // DMP file

Hi everybody, I hope someone can help me.

Recently I had a virus/malware/spyware (don't know exctly) infection in my computer. Since then, and after cleaning and running all the anti virus/spyware/malware software available I can't update windows nor run any hotfix without getting a BSOD (blue screen). The error code shown in the screen is not clear, as I doesnt specifically say what type of error it is, just a STOP 0x0000008E. Ive searched online and all the errors Ive found have more information like "DRIVER_NOT_LESS_OR_EQUAL ". But I am not gettin any of these messages, just the "Stop 8E ". I've even tried running the hotfixes in safe mode but I also got a blue screen. What can be causeing a blue screen in safe mode when trying to update windows ? It doesn't seem to be a driver issue... so ? Ideas ?
Thanks a lot.
Roman

PD : How do I fix this -> "Kernel symbols are WRONG. Please fix symbols to do analysis." ?? Or it just doesn't matter ?

THE DMP :

Opened log file 'c:\debuglog.txt'

Microsoft (R) Windows Debugger Version 6.6.0003.5
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\WINDOWS\Minidump\Mini071506-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: C:\WINDOWS;C:\WINDOWS\system32;C:\WINDOWS\system32\drivers
*** ERROR: Symbol file could not be found. Defaulted to export symbols for ntkrnlmp.exe -
Windows XP Kernel Version 2600 (Service Pack 2) MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 2600.xpsp_sp2_gdr.050301-1519
Kernel base = 0x804d7000 PsLoadedModuleList = 0x805624a0
Debug session time: Sat Jul 15 21:45:16.953 2006 (GMT-3)
System Uptime: 0 days 0:05:22.640
*** ERROR: Symbol file could not be found. Defaulted to export symbols for ntkrnlmp.exe -
Loading Kernel Symbols
.....................................................................................................................
Loading User Symbols
Loading unloaded module list
..........
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1000008E, {c0000005, f4e31946, f38bba28, 0}

***** Kernel symbols are WRONG. Please fix symbols to do analysis.

*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
*************************************************************************
Probably caused by : ntkrnlmp.exe ( nt!LsaFreeReturnBuffer+1955e )

Followup: MachineOwner
---------

0: kd> !analyze -v;r;kv;lmtn;.logclose;q
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

KERNEL_MODE_EXCEPTION_NOT_HANDLED_M (1000008e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003. This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG. This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG. This will let us see why this breakpoint is
happening.
Arguments:
Arg1: c0000005, The exception code that was not handled
Arg2: f4e31946, The address that the exception occurred at
Arg3: f38bba28, Trap Frame
Arg4: 00000000

Debugging Details:
------------------

***** Kernel symbols are WRONG. Please fix symbols to do analysis.

*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
*************************************************************************

MODULE_NAME: nt

FAULTING_MODULE: 804d7000 nt

DEBUG_FLR_IMAGE_TIMESTAMP: 42250f77

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - La instrucci n en "0x%08lx" hace referencia a la memoria en "0x%08lx ". La memoria no se puede "%s ".

FAULTING_IP:
+fffffffff4e31946
f4e31946 8a1401 mov dl,[ecx+eax]

TRAP_FRAME: f38bba28 -- (.trap fffffffff38bba28)
.trap fffffffff38bba28
ErrCode = 00000000
eax=00000000 ebx=f4e3750e ecx=0101d000 edx=804e3e2e esi=00001000 edi=0101c000
eip=f4e31946 esp=f38bba9c ebp=f38bbaa8 iopl=0 nv up ei pl nz na po nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010206
f4e31946 8a1401 mov dl,[ecx+eax] ds:0023:0101d000=??
.trap
Resetting default scope

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: 0x8E

LAST_CONTROL_TRANSFER: from f4e33842 to f4e31946

STACK_TEXT:
WARNING: Frame IP not in any known module. Following frames may be wrong.
f38bbaa8 f4e33842 0101c000 0000001e f4e3750e 0xf4e31946
f38bbb80 80603978 000006d0 86390be0 00000001 0xf4e33842
f38bbba0 804e8206 02181000 f38bbbf4 c0008604 nt!LsaFreeReturnBuffer+0x1955e
f38bbbb4 804ea6db 00010000 86390be0 00000006 nt!IoAcquireCancelSpinLock+0x87
f38bbc08 80585387 c0300000 86390be0 00000000 nt!RtlClearBits+0x6e
f38bbc18 805853a9 0006d000 86390be0 c00001b4 nt!ObSetHandleAttributes+0x9a2
00000000 00000000 00000000 00000000 00000000 nt!ObSetHandleAttributes+0x9c4


STACK_COMMAND: kb

FOLLOWUP_IP:
nt!LsaFreeReturnBuffer+1955e
80603978 57 push edi

SYMBOL_STACK_INDEX: 2

FOLLOWUP_NAME: MachineOwner

SYMBOL_NAME: nt!LsaFreeReturnBuffer+1955e

IMAGE_NAME: ntkrnlmp.exe

BUCKET_ID: WRONG_SYMBOLS

Followup: MachineOwner
---------

eax=00000000 ebx=f4e3750e ecx=0101d000 edx=804e3e2e esi=00001000 edi=0101c000
eip=f4e31946 esp=f38bba9c ebp=f38bbaa8 iopl=0 nv up ei pl nz na po nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010206
f4e31946 8a1401 mov dl,[ecx+eax] ds:0023:0101d000=??
ChildEBP RetAddr Args to Child
WARNING: Frame IP not in any known module. Following frames may be wrong.
f38bbaa8 f4e33842 0101c000 0000001e f4e3750e 0xf4e31946
f38bbb80 80603978 000006d0 86390be0 00000001 0xf4e33842
f38bbba0 804e8206 02181000 f38bbbf4 c0008604 nt!LsaFreeReturnBuffer+0x1955e
f38bbbb4 804ea6db 00010000 86390be0 00000006 nt!IoAcquireCancelSpinLock+0x87
f38bbc08 80585387 c0300000 86390be0 00000000 nt!RtlClearBits+0x6e
f38bbc18 805853a9 0006d000 86390be0 c00001b4 nt!ObSetHandleAttributes+0x9a2
00000000 00000000 00000000 00000000 00000000 nt!ObSetHandleAttributes+0x9c4
start end module name
804d7000 806fe000 nt ntkrnlmp.exe Tue Mar 01 21:57:27 2005 (42250F77)
806fe000 8071ed00 hal halmacpi.dll Wed Aug 04 02:59:09 2004 (41107B2D)
bf000000 bf011580 dxg dxg.sys Wed Aug 04 03:00:51 2004 (41107B93)
bf012000 bf425a80 nv4_disp nv4_disp.dll Thu Aug 19 19:40:37 2004 (41252C65)
bf800000 bf9c1200 win32k win32k.sys Wed Oct 05 21:05:44 2005 (43446A58)
f296a000 f29aa100 HTTP HTTP.sys Fri Oct 08 20:48:20 2004 (41672744)
f2b8b000 f2bdc300 srv srv.sys Mon May 09 21:17:49 2005 (427FFDAD)
f2e0d000 f2e39400 mrxdav mrxdav.sys Wed Aug 04 03:00:49 2004 (41107B91)
f2f27000 f2f3b400 wdmaud wdmaud.sys Wed Aug 04 03:15:03 2004 (41107EE7)
f2fe8000 f2fea2a0 Nsynas32 Nsynas32.SYS Mon Apr 09 06:03:56 2001 (3AD17AFC)
f3a60000 f3a63280 ndisuio ndisuio.sys Wed Aug 04 03:03:10 2004 (41107C1E)
f3ae4000 f3af2d80 sysaudio sysaudio.sys Wed Aug 04 03:15:54 2004 (41107F1A)
f4a74000 f4a8b480 dump_atapi dump_atapi.sys Wed Aug 04 02:59:41 2004 (41107B4D)
f4ab4000 f4b40480 Ntfs Ntfs.SYS Wed Aug 04 03:15:06 2004 (41107EEA)
f4b41000 f4bfe7a0 avg7core avg7core.sys Mon May 22 12:18:28 2006 (4471D644)
f4bff000 f4c6da00 mrxsmb mrxsmb.sys Fri May 05 06:41:42 2006 (445B1DD6)
f4c6e000 f4c98a00 rdbss rdbss.sys Fri May 05 06:47:55 2006 (445B1F4B)
f4d39000 f4d5ad00 afd afd.sys Wed Aug 04 03:14:13 2004 (41107EB5)
f4d5b000 f4d82c00 netbt netbt.sys Wed Aug 04 03:14:36 2004 (41107ECC)
f4d83000 f4da3f00 ipnat ipnat.sys Wed Sep 29 19:28:36 2004 (415B3714)
f4da4000 f4dfbd80 tcpip tcpip.sys Thu Apr 20 08:51:47 2006 (444775D3)
f4dfc000 f4e0e400 ipsec ipsec.sys Wed Aug 04 03:14:27 2004 (41107EC3)
f6f69000 f6f9c200 update update.sys Wed Aug 04 02:58:32 2004 (41107B08)
f6fbd000 f6fbf900 Dxapi Dxapi.sys Fri Aug 17 17:53:19 2001 (3B7D843F)
f6fc5000 f6ff5100 rdpdr rdpdr.sys Wed Aug 04 03:01:10 2004 (41107BA6)
f6ff6000 f7006e00 psched psched.sys Wed Aug 04 03:04:16 2004 (41107C60)
f7007000 f701d680 ndiswan ndiswan.sys Wed Aug 04 03:14:30 2004 (41107EC6)
f70be000 f70d1980 parport parport.sys Wed Aug 04 02:59:04 2004 (41107B28)
f70d2000 f70f5800 e100b325 e100b325.sys Tue Mar 04 16:56:25 2003 (3E6504E9)
f70f6000 f7118680 ks ks.sys Wed Aug 04 03:15:20 2004 (41107EF8)
f7119000 f713c980 portcls portcls.sys Wed Aug 04 03:15:47 2004 (41107F13)
f713d000 f7170d00 echogals echogals.sys Thu Sep 09 16:24:49 2004 (4140AE01)
f7171000 f7188180 DCxxMJPG DCxxMJPG.sys Thu Feb 21 11:01:11 2002 (3C74FDA7)
f7189000 f71abe80 USBPORT USBPORT.SYS Wed Aug 04 03:08:34 2004 (41107D62)
f71ac000 f71bf780 VIDEOPRT VIDEOPRT.SYS Wed Aug 04 03:07:04 2004 (41107D08)
f71c0000 f738f3c0 nv4_mini nv4_mini.sys Wed Apr 07 23:30:48 2004 (4074B958)
f73f6000 f73f6c00 audstub audstub.sys Fri Aug 17 17:59:40 2001 (3B7D85BC)
f746e000 f746ed00 dxgthk dxgthk.sys Fri Aug 17 17:53:12 2001 (3B7D8438)
f7544000 f755e580 Mup Mup.sys Wed Aug 04 03:15:20 2004 (41107EF8)
f755f000 f758ba80 NDIS NDIS.sys Wed Aug 04 03:14:27 2004 (41107EC3)
f758c000 f75a2780 KSecDD KSecDD.sys Wed Aug 04 02:59:45 2004 (41107B51)
f75a3000 f75c6000 Fastfat Fastfat.sys Wed Aug 04 03:14:15 2004 (41107EB7)
f75c6000 f75e4780 fltmgr fltmgr.sys Wed Aug 04 03:01:17 2004 (41107BAD)
f75e5000 f75fc480 atapi atapi.sys Wed Aug 04 02:59:41 2004 (41107B4D)
f75fd000 f7622a80 dmio dmio.sys Wed Aug 04 03:07:13 2004 (41107D11)
f7623000 f7641c00 ftdisk ftdisk.sys Fri Aug 17 17:52:41 2001 (3B7D8419)
f7642000 f7652d80 pci pci.sys Wed Aug 04 03:07:45 2004 (41107D31)
f7653000 f7681280 ACPI ACPI.sys Wed Aug 04 03:07:35 2004 (41107D27)
f76a3000 f76abe00 isapnp isapnp.sys Fri Aug 17 17:58:01 2001 (3B7D8559)
f76b3000 f76c1e80 ohci1394 ohci1394.sys Wed Aug 04 03:10:05 2004 (41107DBD)
f76c3000 f76d0000 1394BUS 1394BUS.SYS Wed Aug 04 03:10:03 2004 (41107DBB)
f76d3000 f76dd500 MountMgr MountMgr.sys Wed Aug 04 02:58:29 2004 (41107B05)
f76e3000 f76f0000 VolSnap VolSnap.sys Wed Aug 04 03:00:14 2004 (41107B6E)
f76f3000 f76fbe00 disk disk.sys Wed Aug 04 02:59:53 2004 (41107B59)
f7703000 f770f200 CLASSPNP CLASSPNP.SYS Wed Aug 04 03:14:26 2004 (41107EC2)
f7713000 f771d580 agp440 agp440.sys Wed Aug 04 03:07:40 2004 (41107D2C)
f7743000 f774be40 SMBios SMBios.sys Thu Sep 11 19:20:22 2003 (3F60F526)
f7763000 f776cd80 intelppm intelppm.sys Wed Aug 04 02:59:19 2004 (41107B37)
f7773000 f777ee80 digi96 digi96.sys Thu Jul 21 13:55:25 2005 (42DFD37D)
f7783000 f7791b80 drmk drmk.sys Wed Aug 04 03:07:54 2004 (41107D3A)
f7793000 f77a2180 nic1394 nic1394.sys Wed Aug 04 02:58:28 2004 (41107B04)
f77a3000 f77b0200 i8042prt i8042prt.sys Wed Aug 04 03:14:36 2004 (41107ECC)
f77b3000 f77bd380 imapi imapi.sys Wed Aug 04 03:00:12 2004 (41107B6C)
f77c3000 f77cf180 cdrom cdrom.sys Wed Aug 04 02:59:52 2004 (41107B58)
f77d3000 f77e1500 redbook redbook.sys Wed Aug 04 02:59:34 2004 (41107B46)
f77e3000 f77ef880 rasl2tp rasl2tp.sys Wed Aug 04 03:14:21 2004 (41107EBD)
f77f3000 f77fd200 raspppoe raspppoe.sys Wed Aug 04 03:05:06 2004 (41107C92)
f7803000 f780ed00 raspptp raspptp.sys Wed Aug 04 03:14:26 2004 (41107EC2)
f7813000 f781b900 msgpc msgpc.sys Wed Aug 04 03:04:11 2004 (41107C5B)
f7823000 f782cf00 termdd termdd.sys Wed Aug 04 02:58:52 2004 (41107B1C)
f7833000 f7841000 cledx cledx.sys Mon May 09 15:08:41 2005 (427FA729)
f7853000 f785c480 NDProxy NDProxy.SYS Fri Aug 17 17:55:30 2001 (3B7D84C2)
f7863000 f7871100 usbhub usbhub.sys Wed Aug 04 03:08:40 2004 (41107D68)
f7873000 f787b700 wanarp wanarp.sys Wed Aug 04 03:04:57 2004 (41107C89)
f7883000 f7891d80 arp1394 arp1394.sys Wed Aug 04 02:58:28 2004 (41107B04)
f7893000 f789b700 netbios netbios.sys Wed Aug 04 03:03:19 2004 (41107C27)
f78b3000 f78bb900 Fips Fips.SYS Fri Aug 17 22:31:49 2001 (3B7DC585)
f78d3000 f78e2900 Cdfs Cdfs.SYS Wed Aug 04 03:14:09 2004 (41107EB1)
f7923000 f7929200 PCIIDEX PCIIDEX.SYS Wed Aug 04 02:59:40 2004 (41107B4C)
f792b000 f792f900 PartMgr PartMgr.sys Fri Aug 17 22:32:23 2001 (3B7DC5A7)
f796b000 f7970000 usbuhci usbuhci.sys Wed Aug 04 03:08:34 2004 (41107D62)
f7973000 f7979800 usbehci usbehci.sys Wed Aug 04 03:08:34 2004 (41107D62)
f797b000 f7981200 kbdclass kbdclass.sys Wed Aug 04 02:58:32 2004 (41107B08)
f7983000 f7988c00 mouclass mouclass.sys Wed Aug 04 02:58:32 2004 (41107B08)
f798b000 f798c000 fdc fdc.sys unavailable (00000000)
f7993000 f799b000 Asapi Asapi.SYS Sat Jan 08 14:22:34 2000 (3877725A)
f799b000 f79a0200 MotuPar MotuPar.sys Fri Sep 17 18:35:33 2004 (414B58A5)
f79a3000 f79a7880 TDI TDI.SYS Wed Aug 04 03:07:47 2004 (41107D33)
f79ab000 f79af580 ptilink ptilink.sys Fri Aug 17 17:49:53 2001 (3B7D8371)
f79b3000 f79b7080 raspti raspti.sys Fri Aug 17 17:55:32 2001 (3B7D84C4)
f79bb000 f79c0000 flpydisk flpydisk.sys Wed Aug 04 02:59:24 2004 (41107B3C)
f79d3000 f79d8200 vga vga.sys Wed Aug 04 03:07:06 2004 (41107D0A)
f79db000 f79dfa80 Msfs Msfs.SYS Wed Aug 04 03:00:37 2004 (41107B85)
f79e3000 f79ea880 Npfs Npfs.SYS Wed Aug 04 03:00:38 2004 (41107B86)
f79eb000 f79f1500 usbprint usbprint.sys Wed Aug 04 03:01:23 2004 (41107BB3)
f79f3000 f79f9880 MotuMidi MotuMidi.sys Wed Jul 21 14:57:39 2004 (40FEAE93)
f79fb000 f7a01c80 avg7rsxp avg7rsxp.sys Wed Feb 22 21:40:37 2006 (43FD0485)
f7a03000 f7a07500 watchdog watchdog.sys Wed Aug 04 03:07:32 2004 (41107D24)
f7ab3000 f7ab6000 BOOTVID BOOTVID.dll Fri Aug 17 17:49:09 2001 (3B7D8345)
f7b37000 f7b3ac80 MotuBus MotuBus.sys Thu Jul 10 12:02:36 2003 (3F0D800C)
f7b3b000 f7b3d580 ndistapi ndistapi.sys Fri Aug 17 17:55:29 2001 (3B7D84C1)
f7b57000 f7b5ac80 mssmbios mssmbios.sys Wed Aug 04 03:07:47 2004 (41107D33)
f7b8b000 f7b8d280 rasacd rasacd.sys Fri Aug 17 17:55:39 2001 (3B7D84CB)
f7ba3000 f7ba4b80 kdcom kdcom.dll Fri Aug 17 17:49:10 2001 (3B7D8346)
f7ba5000 f7ba6100 WMILIB WMILIB.SYS Fri Aug 17 18:07:23 2001 (3B7D878B)
f7ba7000 f7ba8700 dmload dmload.sys Fri Aug 17 17:58:15 2001 (3B7D8567)
f7ba9000 f7baa100 swenum swenum.sys Wed Aug 04 02:58:41 2004 (41107B11)
f7baf000 f7bb0280 USBD USBD.SYS Fri Aug 17 18:02:58 2001 (3B7D8682)
f7bb1000 f7bb2f00 Fs_Rec Fs_Rec.SYS Fri Aug 17 17:49:37 2001 (3B7D8361)
f7bb3000 f7bb4080 Beep Beep.SYS Fri Aug 17 17:47:33 2001 (3B7D82E5)
f7bb5000 f7bb6080 mnmdd mnmdd.SYS Fri Aug 17 17:57:28 2001 (3B7D8538)
f7bb7000 f7bb8080 RDPCDD RDPCDD.sys Fri Aug 17 17:46:56 2001 (3B7D82C0)
f7bb9000 f7bba0c0 avg7rsw avg7rsw.sys Sun Sep 18 21:09:31 2005 (432E01BB)
f7bbd000 f7bbe100 dump_WMILIB dump_WMILIB.SYS Fri Aug 17 18:07:23 2001 (3B7D878B)
f7bf3000 f7bf4b80 ParVdm ParVdm.SYS Fri Aug 17 17:49:49 2001 (3B7D836D)
f7bf9000 f7bfa380 avgtdi avgtdi.sys Sat Sep 03 21:38:58 2005 (431A4222)
f7c6b000 f7c6bd80 pciide pciide.sys Fri Aug 17 17:51:49 2001 (3B7D83E5)
f7d1e000 f7d1eb80 Null Null.SYS Fri Aug 17 17:47:39 2001 (3B7D82EB)

Unloaded modules:
f7d8d000 f7d8e000 drmkaud.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
f2eda000 f2f04000 kmixer.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
f388c000 f3899000 DMusic.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
f2f04000 f2f27000 aec.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
f389c000 f38aa000 swmidi.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
f7bd5000 f7bd7000 splitter.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
f78a3000 f78ad000 processr.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
f4c88000 f4c99000 serial.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
f79c3000 f79c8000 Cdaudio.SYS
Timestamp: unavailable (00000000)
Checksum: 00000000
f7b87000 f7b8a000 Sfloppy.SYS
Timestamp: unavailable (00000000)
Checksum: 00000000
Closing open log file c:\debuglog.txt

 

Hi,

I did download the symbol package, (maybe I downloadad the wrong -smaller- version) and nothing changed. Once I donwload the symbol package, besides installing it as usual., is there anything else I need to do (like conigure the debugging application ?)
Thanks
Roman

PD : Is there anyhting u can tell me from from watching the dmp file ?

 

Hi, Arie and thanks for your help.

I followed your suggestions (update BIOS, run Memtest) but I had no luck, I am still getting every time the exact same bsod as soon as I run any downloaded update or hotfix to windows. Neither I saw any event in the event viewer linked to the BSOD. I still believe that the fact that it also occurs in safe mode tells about a very low level conflict. Hardware is working ok... maybe a corrupted OS file ? When I am working with the pc I never get BSOD's... JUST when I try to update... so what happens immediately after the upgrade is executed ?
There HAS to be a way to track this down.... please....
Regards
R