[Computer BSOD's and restarts when opening programs]

wbrumfiel · 2009/01/10

My parents' laptop has been having a problem where it will run for a bit but if you try to do anything (like try and run spybot or adaware) it flashes a blue screen of death briefly and restarts. It even blue screened on the first attempt at running the HJT. Here is the log from HJT [Logs deleted by Moderator (not appropriate at this time) and thread moved to Windows XP forum]

PeteC · 2009/01/10

Let's see the error code(s) on the BSOD(s) .....

Set up the computer so that it does not automatically restart on system failure .....

Control Panel > System > Advanced > Startup and Recovery > Settings ....

Under System failure uncheck 'Automatically restart' and under Write debugging information select 'Kernel memory dump' from the dropdown list and OK out.

The computer will now show the BSOD in the event of a System failure giving details of the Stop message and the contents of the memory will be dumped to disk.

Run the dump data through our Dump Data Collection Tool and post the log here (copy/paste).

Unfortunately these logs require expert knowledge to analyze and there are only a few members (who occasionally visit WindowsBBS.com) that have the depth of knowledge necessary. Other members can make observations and suggestions as to how you might proceed toward finding the cause ....

wbrumfiel · 2009/01/11

After struggling with this debug thing I'm at the end of my rope. First I installed the latest version of the debugger (which wasn't downloading from MS site yesterday) but debugwiz said that it wasn't installed. So I went back to one of the earliest non BETA versions and finally debugwiz recognized it. Then I ran the dmp file through it and it pops up with the dos window and the window saying it would save to c:\debuglog.txt but when it finishes there is no debuglog.txt file on the c drive anywhere (I did a search). I've got no clue what to try next.

PeteC · 2009/01/11

Seen that problem before - no debuglog.txt and no resolution.

What is the stop error on the blue screen?

wbrumfiel · 2009/01/11

"PeteC said: ↑

Seen that problem before - no debuglog.txt and no resolution.

What is the stop error on the blue screen?
Click to expand...

PAGE_FAULT_IN_NONPAGED_AREA
STOP: 0x00000050 (0xE1BFD000, 0x00000000, 0x8056A9FA, 0x00000001)

ETA: In the interest of full disclosure I did just recently replace the memory in this laptop and thought that might be causing it so I put the old memory back in. It still BSOD right after the old memory was reinstalled but hasn't done it since. To me that says it wasn't the memory but maybe I'm wrong.

PeteC · 2009/01/12

Description of the Error Code ....

0x00000050: PAGE_FAULT_IN_NONPAGED_AREA
Requested data was not in memory. An invalid system memory address was referenced. Defective memory (including main memory, L2 RAM cache, video RAM) or incompatible software (including remote control and antivirus software) might cause this Stop message, as may other hardware problems (e.g., incorrect SCSI termination or a flawed PCI card).
Click to expand...

To my mind it is likely to be a memory problem - is the laptop still BSOD free?

As the cause of your problems are unlikely to be malware related I have moved the thread to the XP forum with title edit and deleted the log. You can always start a new thread in the Malware & Virus Removal forum later if necessary.

wbrumfiel · 2009/01/12

Thanks for all your help Pete. I guess it does sound like the memory, just seems weird that it blue screened after I put the old memory back in. It has only done it once since the old memory went back in though. I'll try running some things that seemed to kill it before and see what happens.

wbrumfiel · 2009/01/12

I tried running Adaware again and it gave the same stop error (with the old memory in). Is there any way to fix this?

PeteC · 2009/01/12

Is there any way to fix this?
Click to expand...

Hopefully, but you will see from the description of the error code that there are many possible causes.

I have been playing with the Dump Data Collection Tool and discovered that it does not work with the latest version of the Debugging Tools. However it works fine with the version I originally had installed - and have reinstalled .....

http://msdl.microsoft.com/download/symbols/debuggers/dbg_x86_6.6.07.5.exe

It would be helpful if you would have a further go at generating a dump log. Uninstall the Debugging tools through Add/Remove Programs and install the copy from the link above.

The Dump Data Collection tool was written by a MS 'code monkey' who was a member of the Board at the time - sadly no longer.

PeteC · 2009/01/12

I intended to include in my last post ....

Is there anything in Event Viewer at the time the BSOD occurs?

Start > Run > eventvwr.msc > Enter

System & Application ....

To open an Event double click on it and on the icon below the Up/Down arrows to copy to clipboard and paste here.

wbrumfiel · 2009/01/12

I'm pretty sure that is the version I downloaded after the newest version didn't work. However, I uninstalled the version I had and redownloaded from your link and tried running it through the wiz again and it comes up with the dos screen and the screen telling me that the debuglog.txt file will be placed on the C drive but after the window closes there is still no debuglog.txt file anywhere on the machine.

PeteC · 2009/01/12

Anything in Event Viewer - my last post?

wbrumfiel · 2009/01/12

Sorry Pete, I completely missed the first post about the error log. I went and checked around the last time the system BSOD this morning and there was this one in the system piece

The computer has rebooted from a bugcheck. The bugcheck was: 0x0000008e (0xc0000005, 0x80586a80, 0xb05eeb5c, 0x00000000). A dump was saved in: C:\WINDOWS\MEMORY.DMP.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

and this one
The mrtRate service failed to start due to the following error:
The system cannot find the file specified.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

I also went back to yesterdays failure and saw this one which I thought was odd, but its not on todays failure

\Device\ACPIEC: The embedded controller (EC) hardware returned data when none was requested. This may indicate that the BIOS is incorectly trying to access the EC without syncronizing with the OS. The data is being ignored.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

PeteC · 2009/01/12

Were all those Events flagged with a white cross on a red ground or with an exclamation mark on a yellow ground? The red flags are the important ones representing errors rather than warnings.

0x0000008E: KERNEL_MODE_EXCEPTION_NOT_HANDLED
A kernel mode program generated an exception which the error handler didn’t catch. These are nearly always hardware compatibility issues (which sometimes means a driver issue or a need for a BIOS upgrade).
Click to expand...

Another tricky error

Please go .....

Right click My Computer icon > Properties > Advanced > Startup & Recovery - Settings and under System Recovery unckeck 'Overwwrite ......' if checked. Then all subsequent dumps will be retained.

It really would be helpful to see debug logs, so look for a PM from me and email those dump files that you have and I will debug them - hopefully and post the logs here.

Admin. · 2009/01/12

"PeteC said: ↑

Seen that problem before - no debuglog.txt and no resolution
Click to expand...

Not in Windows XP though

Admin. · 2009/01/12

"PeteC said: ↑

It really would be helpful to see debug logs, so look for a PM from me and email those dump files that you have and I will debug them - hopefully and post the logs here.
Click to expand...

1. Depending on how much memory wbrumfiel has installed, that could get you some large files

2. Debugging normally has to be done on the machine that experiences the problem. Debugging on another machine will produce incomplete info.

PeteC · 2009/01/12

Here is the first debug log .....

Opened log file 'c:\debuglog.txt'

Microsoft (R) Windows Debugger Version 6.6.0007.5
Copyright (c) Microsoft Corporation. All rights reserved.

Loading Dump File [D:\My Documents\BBS Downloads\DMP Files\MEMORY.DMP]
Kernel Summary Dump File: Only kernel address space is available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: C:\WINDOWS;C:\WINDOWS\system32;C:\WINDOWS\system32\drivers
Windows XP Kernel Version 2600 (Service Pack 3) UP Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 2600.xpsp_sp3_gdr.080814-1236
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055b1c0
Debug session time: Sat Jan 10 22:53:03.609 2009 (GMT+0)
System Uptime: 0 days 1:06:39.157
Loading Kernel Symbols
..........................................................................................................................................................
Loading User Symbols
PEB is paged out (Peb.Ldr = 7ffdf00c). Type ".hh dbgerr001" for details
Loading unloaded module list
.......................................
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 50, {e1bfd000, 0, 8056a9fa, 1}

Probably caused by : ntoskrnl.exe ( nt!CmpQueryKeyValueData+2d4 )

Followup: MachineOwner
---------

kd> !analyze -v;r;kv;lmtn;.logclose;q
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced. This cannot be protected by try-except,
it must be protected by a Probe. Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: e1bfd000, memory referenced.
Arg2: 00000000, value 0 = read operation, 1 = write operation.
Arg3: 8056a9fa, If non-zero, the instruction address which referenced the bad memory
address.
Arg4: 00000001, (reserved)

Debugging Details:
------------------

READ_ADDRESS: e1bfd000 Paged pool

FAULTING_IP:
nt!CmpQueryKeyValueData+2d4
8056a9fa f3a5 rep movs dword ptr es:[edi],dword ptr [esi]

MM_INTERNAL_CODE: 1

DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: 0x50

PROCESS_NAME: aawservice.exe

TRAP_FRAME: eda2bbb8 -- (.trap ffffffffeda2bbb8)
.trap ffffffffeda2bbb8
ErrCode = 00000000
eax=04000004 ebx=e1b3a0fc ecx=00fcf440 edx=e1b30030 esi=e1bfd000 edi=1c192f48
eip=8056a9fa esp=eda2bc2c ebp=eda2bc48 iopl=0 nv up ei pl nz na po nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010202
nt!CmpQueryKeyValueData+0x2d4:
8056a9fa f3a5 rep movs dword ptr es:[edi],dword ptr [esi] es:0023:1c192f48=???????? ds:0023:e1bfd000=????????
.trap
Resetting default scope

LAST_CONTROL_TRANSFER: from 805241a0 to 80533806

STACK_TEXT:
eda2bb54 805241a0 00000050 e1bfd000 00000000 nt!KeBugCheckEx+0x1b
eda2bba0 804e1718 00000000 e1bfd000 00000000 nt!MmAccessFault+0x6f5
eda2bba0 8056a9fa 00000000 e1bfd000 00000000 nt!KiTrap0E+0xcc
eda2bc48 80590623 e101b008 e1ad4360 01b3a0f4 nt!CmpQueryKeyValueData+0x2d4
eda2bcb4 8059073c e3517198 00000003 00000001 nt!CmEnumerateValueKey+0x113
eda2bd44 804de7ec 000002c0 00000003 00000001 nt!NtEnumerateValueKey+0x1ea
eda2bd44 7c90e4f4 000002c0 00000003 00000001 nt!KiFastCallEntry+0xf8
WARNING: Frame IP not in any known module. Following frames may be wrong.
045ed0c8 00000000 00000000 00000000 00000000 0x7c90e4f4

STACK_COMMAND: kb

FOLLOWUP_IP:
nt!CmpQueryKeyValueData+2d4
8056a9fa f3a5 rep movs dword ptr es:[edi],dword ptr [esi]

SYMBOL_STACK_INDEX: 3

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nt

IMAGE_NAME: ntoskrnl.exe

DEBUG_FLR_IMAGE_TIMESTAMP: 48a404ab

SYMBOL_NAME: nt!CmpQueryKeyValueData+2d4

FAILURE_BUCKET_ID: 0x50_nt!CmpQueryKeyValueData+2d4

BUCKET_ID: 0x50_nt!CmpQueryKeyValueData+2d4

Followup: MachineOwner
---------

eax=ffdff13c ebx=00000000 ecx=00000000 edx=804e20e3 esi=c0386ff4 edi=806f0298
eip=80533806 esp=eda2bb3c ebp=eda2bb54 iopl=0 nv up ei ng nz na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00000286
nt!KeBugCheckEx+0x1b:
80533806 5d pop ebp
ChildEBP RetAddr Args to Child
eda2bb54 805241a0 00000050 e1bfd000 00000000 nt!KeBugCheckEx+0x1b (FPO: [Non-Fpo])
eda2bba0 804e1718 00000000 e1bfd000 00000000 nt!MmAccessFault+0x6f5 (FPO: [Non-Fpo])
eda2bba0 8056a9fa 00000000 e1bfd000 00000000 nt!KiTrap0E+0xcc (FPO: [0,0] TrapFrame @ eda2bbb8)
eda2bc48 80590623 e101b008 e1ad4360 01b3a0f4 nt!CmpQueryKeyValueData+0x2d4 (FPO: [Non-Fpo])
eda2bcb4 8059073c e3517198 00000003 00000001 nt!CmEnumerateValueKey+0x113 (FPO: [Non-Fpo])
eda2bd44 804de7ec 000002c0 00000003 00000001 nt!NtEnumerateValueKey+0x1ea (FPO: [Non-Fpo])
eda2bd44 7c90e4f4 000002c0 00000003 00000001 nt!KiFastCallEntry+0xf8 (FPO: [0,0] TrapFrame @ eda2bd64)
WARNING: Frame IP not in any known module. Following frames may be wrong.
045ed0c8 00000000 00000000 00000000 00000000 0x7c90e4f4
start end module name
804d7000 806ed780 nt ntoskrnl.exe Thu Aug 14 11:10:51 2008 (48A404AB)
806ee000 8070e300 hal halaacpi.dll Sun Apr 13 19:31:27 2008 (4802517F)
bf800000 bf9c2c80 win32k win32k.sys Mon Sep 15 13:12:42 2008 (48CE513A)
bf9c3000 bf9d4600 dxg dxg.sys Sun Apr 13 19:38:27 2008 (48025323)
bf9d5000 bf9e3000 ialmrnt5 ialmrnt5.dll Thu Nov 20 17:26:22 2003 (3FBCF93E)
bf9e3000 bfa05000 ialmdnt5 ialmdnt5.dll Thu Nov 20 17:25:11 2003 (3FBCF8F7)
bfa05000 bfa35680 ialmdev5 ialmdev5.DLL Thu Nov 20 17:25:03 2003 (3FBCF8EF)
bfa36000 bfab2000 ialmdd5 ialmdd5.DLL Thu Nov 20 17:24:37 2003 (3FBCF8D5)
bffa0000 bffe5c00 ATMFD ATMFD.DLL Mon Apr 14 01:09:55 2008 (4802A0D3)
ec5d1000 ec5fb180 kmixer kmixer.sys Sun Apr 13 19:45:07 2008 (480254B3)
ec5fc000 ec60c760 NAVENG NAVENG.Sys Fri Oct 01 02:59:17 2004 (415CB9F5)
ec60d000 ec6a5680 NavEx15 NavEx15.Sys Fri Oct 01 03:11:15 2004 (415CBCC3)
ec6a6000 ec6bd900 dump_atapi dump_atapi.sys Sun Apr 13 19:40:29 2008 (4802539D)
ecfcd000 ed00da80 HTTP HTTP.sys Sun Apr 13 19:53:48 2008 (480256BC)
ed07e000 ed08d900 Cdfs Cdfs.SYS Sun Apr 13 20:14:21 2008 (48025B8D)
ed2da000 ed2dc640 SYMREDRV SYMREDRV.SYS Tue Oct 28 06:57:46 2003 (3F9E136A)
ed41e000 ed46f800 srv srv.sys Mon Sep 08 11:41:40 2008 (48C50164)
ed560000 ed58c180 mrxdav mrxdav.sys Sun Apr 13 19:32:42 2008 (480251CA)
ed773000 ed787480 wdmaud wdmaud.sys Sun Apr 13 20:17:18 2008 (48025C3E)
ed930000 ed93ed80 sysaudio sysaudio.sys Sun Apr 13 20:15:55 2008 (48025BEB)
edc38000 edc63300 SYMTDI SYMTDI.SYS Tue Oct 28 06:57:34 2003 (3F9E135E)
edc64000 edc79880 irda irda.sys Sun Apr 13 19:54:35 2008 (480256EB)
edcca000 edce28c0 tfsnudfa tfsnudfa.sys Wed Jul 14 19:18:18 2004 (40F578EA)
edce3000 edcfb160 tfsnudf tfsnudf.sys Wed Jul 14 19:17:36 2004 (40F578C0)
edcfc000 edd11040 tfsnifs tfsnifs.sys Wed Jul 14 19:17:31 2004 (40F578BB)
edd32000 edd34f00 netdevio netdevio.sys Wed Jan 29 05:34:59 2003 (3E376803)
edd36000 edd39900 ndisuio ndisuio.sys Sun Apr 13 19:55:57 2008 (4802573D)
edd3a000 edd3d760 mdc8021x mdc8021x.sys Fri Nov 21 15:54:18 2003 (3FBE352A)
ede46000 ede498c0 tfsnopio tfsnopio.sys Wed Jul 14 19:17:54 2004 (40F578D2)
ede92000 edf01280 mrxsmb mrxsmb.sys Fri Oct 24 12:21:07 2008 (4901AFA3)
edf02000 edf2ce80 rdbss rdbss.sys Sun Apr 13 20:28:38 2008 (48025EE6)
edf2d000 edf52500 ipnat ipnat.sys Sun Apr 13 19:57:10 2008 (48025786)
edf53000 edf74d00 afd afd.sys Thu Aug 14 11:04:35 2008 (48A40333)
edf75000 edf9cc00 netbt netbt.sys Sun Apr 13 20:20:59 2008 (48025D1B)
edf9d000 edff5480 tcpip tcpip.sys Fri Jun 20 12:51:09 2008 (485B99AD)
edff6000 ee008600 ipsec ipsec.sys Sun Apr 13 20:19:42 2008 (48025CCE)
ee009000 ee019200 Udfs Udfs.SYS Sun Apr 13 19:32:35 2008 (480251C3)
ee01a000 ee030060 meiudf meiudf.sys Fri Jan 30 01:32:30 2004 (4019B42E)
ee17b000 ee1837e0 tfsncofs tfsncofs.sys Wed Jul 14 19:17:50 2004 (40F578CE)
ee19b000 ee1adc20 SYMEVENT SYMEVENT.SYS Thu Aug 07 02:32:39 2003 (3F31AC37)
ee1ae000 ee1ff000 SAVRT SAVRT.SYS Sat Nov 01 11:26:37 2003 (3FA3986D)
ee8bf000 ee8dccc0 ialmsbw ialmsbw.sys Thu Nov 20 17:26:18 2003 (3FBCF93A)
ee8dd000 ee8f5280 ialmkchw ialmkchw.sys Thu Nov 20 17:26:10 2003 (3FBCF932)
f69c4000 f6a21f00 update update.sys Sun Apr 13 19:39:46 2008 (48025372)
f6a22000 f6a32e00 psched psched.sys Sun Apr 13 19:56:36 2008 (48025764)
f6a33000 f6a49580 ndiswan ndiswan.sys Sun Apr 13 20:20:41 2008 (48025D09)
f6a4a000 f6a4c900 Dxapi Dxapi.sys Fri Aug 17 21:53:19 2001 (3B7D843F)
f6a72000 f6ba6ea0 AGRSM AGRSM.sys Fri Feb 20 20:00:41 2004 (40366769)
f6ba7000 f6c08c00 ALCXSENS ALCXSENS.SYS Mon Feb 23 18:11:09 2004 (403A423D)
f6c09000 f6c2ca80 portcls portcls.sys Sun Apr 13 20:19:40 2008 (48025CCC)
f6c2d000 f6cc3700 ALCXWDM ALCXWDM.SYS Mon Jun 21 09:53:19 2004 (40D6A1FF)
f6cc4000 f6ce6700 ks ks.sys Sun Apr 13 20:16:34 2008 (48025C12)
f6ce7000 f6cf74c0 Cdr4_xp Cdr4_xp.SYS Thu Oct 23 04:14:52 2003 (3F9747AC)
f6cf8000 f6d101e0 Apfiltr Apfiltr.sys Sat May 08 12:38:05 2004 (409CC69D)
f6d11000 f6d34200 USBPORT USBPORT.SYS Sun Apr 13 19:45:34 2008 (480254CE)
f6d35000 f6d48f00 VIDEOPRT VIDEOPRT.SYS Sun Apr 13 19:44:39 2008 (48025497)
f6d49000 f6d60520 ialmnt5 ialmnt5.sys Thu Nov 20 17:25:12 2003 (3FBCF8F8)
f7387000 f73a0b80 Mup Mup.sys Sun Apr 13 20:17:05 2008 (48025C31)
f73a1000 f73cd980 NDIS NDIS.sys Sun Apr 13 20:20:35 2008 (48025D03)
f73ce000 f745a600 Ntfs Ntfs.sys Sun Apr 13 20:15:49 2008 (48025BE5)
f745b000 f7471880 KSecDD KSecDD.sys Sun Apr 13 19:31:40 2008 (4802518C)
f7472000 f7486b40 drvmcdb drvmcdb.sys Thu Jun 24 16:24:09 2004 (40DAF219)
f7487000 f7498f00 sr sr.sys Sun Apr 13 19:36:50 2008 (480252C2)
f7499000 f74b9000 fltmgr fltmgr.sys unavailable (FFFFFFFE)
f74b9000 f74d0900 atapi atapi.sys Sun Apr 13 19:40:29 2008 (4802539D)
f74d1000 f74ef880 ftdisk ftdisk.sys Fri Aug 17 21:52:41 2001 (3B7D8419)
f74f0000 f750d580 pcmcia pcmcia.sys Sun Apr 13 19:36:41 2008 (480252B9)
f750e000 f751ea80 pci pci.sys Sun Apr 13 19:36:43 2008 (480252BB)
f751f000 f754cd80 ACPI ACPI.sys Sun Apr 13 19:36:33 2008 (480252B1)
f756e000 f7577180 isapnp isapnp.sys Sun Apr 13 19:36:40 2008 (480252B8)
f757e000 f758d100 ohci1394 ohci1394.sys Sun Apr 13 19:46:18 2008 (480254FA)
f758e000 f759b080 1394BUS 1394BUS.SYS Sun Apr 13 19:46:18 2008 (480254FA)
f759e000 f75a8580 MountMgr MountMgr.sys Sun Apr 13 19:39:45 2008 (48025371)
f75ae000 f75bac80 VolSnap VolSnap.sys Sun Apr 13 19:41:00 2008 (480253BC)
f75be000 f75c6e00 disk disk.sys Sun Apr 13 19:40:46 2008 (480253AE)
f75ce000 f75da180 CLASSPNP CLASSPNP.SYS Sun Apr 13 20:16:21 2008 (48025C05)
f75de000 f75e8580 agp440 agp440.sys Sun Apr 13 19:36:37 2008 (480252B5)
f75fe000 f760d180 nic1394 nic1394.sys Sun Apr 13 19:51:22 2008 (4802562A)
f760e000 f7617540 drvnddm drvnddm.sys Wed Jul 14 19:24:14 2004 (40F57A4E)
f761e000 f7626e00 intelppm intelppm.sys Sun Apr 13 19:31:31 2008 (48025183)
f762e000 f763df00 Rtlnic51 Rtlnic51.sys Wed Aug 13 08:27:20 2003 (3F39E858)
f763e000 f764ad00 i8042prt i8042prt.sys Sun Apr 13 20:17:59 2008 (48025C67)
f764e000 f7658480 imapi imapi.sys Sun Apr 13 19:40:57 2008 (480253B9)
f765e000 f766d600 cdrom cdrom.sys Sun Apr 13 19:40:45 2008 (480253AD)
f766e000 f767c100 redbook redbook.sys Sun Apr 13 19:40:27 2008 (4802539B)
f767e000 f768cb00 drmk drmk.sys Sun Apr 13 19:45:12 2008 (480254B8)
f768e000 f769a880 rasl2tp rasl2tp.sys Sun Apr 13 20:19:43 2008 (48025CCF)
f769e000 f76a8200 raspppoe raspppoe.sys Sun Apr 13 19:57:31 2008 (4802579B)
f76ae000 f76b9d00 raspptp raspptp.sys Sun Apr 13 20:19:47 2008 (48025CD3)
f76be000 f76c6900 msgpc msgpc.sys Sun Apr 13 19:56:32 2008 (48025760)
f76ce000 f76d7f00 termdd termdd.sys Sun Apr 13 19:38:36 2008 (4802532C)
f76ee000 f76f7e80 NDProxy NDProxy.SYS Sun Apr 13 19:57:28 2008 (48025798)
f772e000 f773c880 usbhub usbhub.sys Sun Apr 13 19:45:36 2008 (480254D0)
f774e000 f775e000 SAVRTPEL SAVRTPEL.SYS Sat Nov 01 11:26:40 2003 (3FA39870)
f775e000 f776a000 wA301a wA301a.sys Thu Nov 20 17:25:18 2003 (3FBCF8FE)
f776e000 f7776780 netbios netbios.sys Sun Apr 13 19:56:01 2008 (48025741)
f777e000 f7788e00 Fips Fips.SYS Sun Apr 13 19:33:27 2008 (480251F7)
f778e000 f7796700 wanarp wanarp.sys Sun Apr 13 19:57:20 2008 (48025790)
f779e000 f77acd80 arp1394 arp1394.sys Sun Apr 13 19:51:22 2008 (4802562A)
f77ee000 f77f4180 PCIIDEX PCIIDEX.SYS Sun Apr 13 19:40:29 2008 (4802539D)
f77f6000 f77fad00 PartMgr PartMgr.sys Sun Apr 13 19:40:48 2008 (480253B0)
f77fe000 f7802de0 PxHelp20 PxHelp20.sys Fri Sep 24 01:24:24 2004 (41536938)
f781e000 f7825880 Npfs Npfs.SYS Sun Apr 13 19:32:38 2008 (480251C6)
f782e000 f7832500 watchdog watchdog.sys Sun Apr 13 19:44:59 2008 (480254AB)
f7836000 f783c440 tfsnboio tfsnboio.sys Wed Jul 14 19:17:38 2004 (40F578C2)
f78ee000 f78f3080 usbuhci usbuhci.sys Sun Apr 13 19:45:34 2008 (480254CE)
f78f6000 f78fd600 usbehci usbehci.sys Sun Apr 13 19:45:34 2008 (480254CE)
f78fe000 f7904000 kbdclass kbdclass.sys Sun Apr 13 19:39:46 2008 (48025372)
f7906000 f790ba00 mouclass mouclass.sys Sun Apr 13 19:39:47 2008 (48025373)
f790e000 f7913300 pfc pfc.sys Sat Sep 20 00:45:46 2003 (3F6B952A)
f7916000 f791ba60 Cdralw2k Cdralw2k.SYS Thu Oct 23 04:14:42 2003 (3F9747A2)
f791e000 f7925580 Modem Modem.SYS Sun Apr 13 20:00:18 2008 (48025842)
f7926000 f792ac80 rasirda rasirda.sys Fri Aug 17 21:51:29 2001 (3B7D83D1)
f792e000 f7932a80 TDI TDI.SYS Sun Apr 13 20:00:04 2008 (48025834)
f7936000 f793a580 ptilink ptilink.sys Fri Aug 17 21:49:53 2001 (3B7D8371)
f793e000 f7942080 raspti raspti.sys Fri Aug 17 21:55:32 2001 (3B7D84C4)
f7946000 f794b020 wanatw4 wanatw4.sys Tue Jul 16 16:23:14 2002 (3D343A62)
f7966000 f796bbc0 ssrtln ssrtln.sys Wed Jul 14 19:28:48 2004 (40F57B60)
f796e000 f7973200 vga vga.sys Sun Apr 13 19:44:40 2008 (48025498)
f7976000 f797aa80 Msfs Msfs.SYS Sun Apr 13 19:32:38 2008 (480251C6)
f797e000 f7981000 BOOTVID BOOTVID.dll Fri Aug 17 21:49:09 2001 (3B7D8345)
f7982000 f7984800 compbatt compbatt.sys Sun Apr 13 19:36:36 2008 (480252B4)
f7986000 f7989780 BATTC BATTC.SYS Sun Apr 13 19:36:32 2008 (480252B0)
f798a000 f798cd80 ACPIEC ACPIEC.sys Fri Aug 17 21:57:55 2001 (3B7D8553)
f7a12000 f7a14280 rasacd rasacd.sys Fri Aug 17 21:55:39 2001 (3B7D84CB)
f7a3e000 f7a41680 CmBatt CmBatt.sys Sun Apr 13 19:36:36 2008 (480252B4)
f7a42000 f7a45f60 DKbFltr DKbFltr.sys Mon Jan 12 09:05:57 2004 (40026375)
f7a5e000 f7a60780 ndistapi ndistapi.sys Sun Apr 13 19:57:27 2008 (48025797)
f7a6a000 f7a6dc80 mssmbios mssmbios.sys Sun Apr 13 19:36:45 2008 (480252BD)
f7a6e000 f7a6fb80 kdcom kdcom.dll Fri Aug 17 21:49:10 2001 (3B7D8346)
f7a70000 f7a71100 WMILIB WMILIB.SYS Fri Aug 17 22:07:23 2001 (3B7D878B)
f7a72000 f7a73580 intelide intelide.sys Sun Apr 13 19:40:29 2008 (4802539D)
f7a88000 f7a89080 hkdrv hkdrv.sys Fri Aug 29 10:27:28 2003 (3F4F1C80)
f7a8a000 f7a8b5c0 sscdbhk5 sscdbhk5.sys Wed Jul 14 19:29:02 2004 (40F57B6E)
f7a8c000 f7a8d100 swenum swenum.sys Sun Apr 13 19:39:52 2008 (48025378)
f7a90000 f7a91280 USBD USBD.SYS Fri Aug 17 22:02:58 2001 (3B7D8682)
f7a94000 f7a96000 Fs_Rec Fs_Rec.SYS unavailable (FFFFFFFE)
f7a96000 f7a97080 Beep Beep.SYS Fri Aug 17 21:47:33 2001 (3B7D82E5)
f7a98000 f7a99080 mnmdd mnmdd.SYS Fri Aug 17 21:57:28 2001 (3B7D8538)
f7a9a000 f7a9b080 RDPCDD RDPCDD.sys Fri Aug 17 21:46:56 2001 (3B7D82C0)
f7aa2000 f7aa3900 TPIoMngr TPIoMngr.sys Fri Jul 30 08:05:04 2004 (4109F320)
f7aa4000 f7aa5900 SSIoMngr SSIoMngr.sys Fri Jul 30 08:05:06 2004 (4109F322)
f7aa6000 f7aa7900 EPIoMngr EPIoMngr.sys Fri Jul 30 08:05:02 2004 (4109F31E)
f7aa8000 f7aa9480 ECioctl ECioctl.sys Thu Aug 19 07:03:06 2004 (4124429A)
f7aaa000 f7aab900 EKIoMngr EKIoMngr.sys Fri Jul 30 08:05:03 2004 (4109F31F)
f7aba000 f7abb100 dump_WMILIB dump_WMILIB.SYS Fri Aug 17 22:07:23 2001 (3B7D878B)
f7ac0000 f7ac1860 TBiosDrv TBiosDrv.sys Wed Jun 11 17:53:21 2003 (3EE75E81)
f7ac2000 f7ac38a0 tfsnpool tfsnpool.sys Wed Jul 14 19:17:32 2004 (40F578BC)
f7b36000 f7b36d00 pciide pciide.sys Fri Aug 17 21:51:49 2001 (3B7D83E5)
f7b37000 f7b37d80 OPRGHDLR OPRGHDLR.SYS Fri Aug 17 21:57:55 2001 (3B7D8553)
f7b6e000 f7b6e880 tfsndres tfsndres.sys Wed Jul 14 19:18:23 2004 (40F578EF)
f7b80000 f7b80fe0 tfsndrct tfsndrct.sys Wed Jul 14 19:17:53 2004 (40F578D1)
f7b8c000 f7b8cc00 audstub audstub.sys Fri Aug 17 21:59:40 2001 (3B7D85BC)
f7bb6000 f7bb6d00 dxgthk dxgthk.sys Fri Aug 17 21:53:12 2001 (3B7D8438)
f7c44000 f7c45000 Null Null.SYS unavailable (FFFFFFFE)

Unloaded modules:
ec5fc000 ec60d000 NAVENG.Sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ec60d000 ec6a6000 NavEx15.Sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ec5fc000 ec60d000 NAVENG.Sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ec60d000 ec6a6000 NavEx15.Sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ec5fc000 ec60d000 NAVENG.Sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ec60d000 ec6a6000 NavEx15.Sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ec5fc000 ec60d000 NAVENG.Sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ec60d000 ec6a6000 NavEx15.Sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ec5fc000 ec60d000 NAVENG.Sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ec60d000 ec6a6000 NavEx15.Sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ec768000 ec793000 kmixer.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ec6be000 ec6cf000 NAVENG.Sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ec6cf000 ec768000 NavEx15.Sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ede52000 ede6a000 dump_atapi.s
Timestamp: unavailable (00000000)
Checksum: 00000000
ec6be000 ec6cf000 NAVENG.Sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ec6cf000 ec768000 NavEx15.Sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ec793000 ec7a4000 NAVENG.Sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ec7a4000 ec83d000 NavEx15.Sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ec97d000 ec9a8000 kmixer.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ec793000 ec7a4000 NAVENG.Sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ec7a4000 ec83d000 NavEx15.Sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ec793000 ec7a4000 NAVENG.Sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ec7a4000 ec83d000 NavEx15.Sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ec9a8000 ec9b9000 NAVENG.Sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ec9b9000 eca52000 NavEx15.Sys
Timestamp: unavailable (00000000)
Checksum: 00000000
eca52000 eca7d000 kmixer.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ee051000 ee062000 NAVENG.Sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ee062000 ee0fb000 NavEx15.Sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ed685000 ed6b0000 kmixer.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
f7c59000 f7c5a000 drmkaud.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ed910000 ed91d000 DMusic.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ed750000 ed773000 aec.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ed920000 ed92e000 swmidi.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
f7b0c000 f7b0e000 splitter.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ed8d0000 ed8e0000 Serial.SYS
Timestamp: unavailable (00000000)
Checksum: 00000000
f795e000 f7963000 Cdaudio.SYS
Timestamp: unavailable (00000000)
Checksum: 00000000
f7a0a000 f7a0d000 Sfloppy.SYS
Timestamp: unavailable (00000000)
Checksum: 00000000
f7956000 f795b000 Flpydisk.SYS
Timestamp: unavailable (00000000)
Checksum: 00000000
f794e000 f7955000 Fdc.SYS
Timestamp: unavailable (00000000)
Checksum: 00000000
Closing open log file c:\debuglog.txt

PeteC · 2009/01/12

And the second .....

Opened log file 'c:\debuglog.txt'

Microsoft (R) Windows Debugger Version 6.6.0007.5
Copyright (c) Microsoft Corporation. All rights reserved.

Loading Dump File [D:\My Documents\BBS Downloads\DMP Files\Mini011009-06.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: C:\WINDOWS;C:\WINDOWS\system32;C:\WINDOWS\system32\drivers
Windows XP Kernel Version 2600 (Service Pack 3) UP Free x86 compatible
Product: WinNt
Built by: 2600.xpsp_sp3_gdr.080814-1236
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055b1c0
Debug session time: Sat Jan 10 22:53:03.609 2009 (GMT+0)
System Uptime: 0 days 1:06:39.157
Loading Kernel Symbols
..........................................................................................................................................................
Loading User Symbols
Loading unloaded module list
.......................................
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 50, {e1bfd000, 0, 8056a9fa, 1}

Could not read faulting driver name
Probably caused by : ntoskrnl.exe ( nt!CmpQueryKeyValueData+2d4 )

Followup: MachineOwner
---------

kd> !analyze -v;r;kv;lmtn;.logclose;q
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced. This cannot be protected by try-except,
it must be protected by a Probe. Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: e1bfd000, memory referenced.
Arg2: 00000000, value 0 = read operation, 1 = write operation.
Arg3: 8056a9fa, If non-zero, the instruction address which referenced the bad memory
address.
Arg4: 00000001, (reserved)

Debugging Details:
------------------

Could not read faulting driver name

READ_ADDRESS: e1bfd000

FAULTING_IP:
nt!CmpQueryKeyValueData+2d4
8056a9fa f3a5 rep movs dword ptr es:[edi],dword ptr [esi]

MM_INTERNAL_CODE: 1

CUSTOMER_CRASH_COUNT: 6

DEFAULT_BUCKET_ID: COMMON_SYSTEM_FAULT

BUGCHECK_STR: 0x50

TRAP_FRAME: eda2bbb8 -- (.trap ffffffffeda2bbb8)
.trap ffffffffeda2bbb8
ErrCode = 00000000
eax=04000004 ebx=e1b3a0fc ecx=00fcf440 edx=e1b30030 esi=e1bfd000 edi=1c192f48
eip=8056a9fa esp=eda2bc2c ebp=eda2bc48 iopl=0 nv up ei pl nz na po nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010202
nt!CmpQueryKeyValueData+0x2d4:
8056a9fa f3a5 rep movs dword ptr es:[edi],dword ptr [esi] es:0023:1c192f48=???????? ds:0023:e1bfd000=????????
.trap
Resetting default scope

LAST_CONTROL_TRANSFER: from 805241a0 to 80533806

STACK_TEXT:
eda2bb54 805241a0 00000050 e1bfd000 00000000 nt!KeBugCheckEx+0x1b
eda2bba0 804e1718 00000000 e1bfd000 00000000 nt!MmAccessFault+0x6f5
eda2bba0 8056a9fa 00000000 e1bfd000 00000000 nt!KiTrap0E+0xcc
eda2bc48 80590623 e101b008 e1ad4360 01b3a0f4 nt!CmpQueryKeyValueData+0x2d4
eda2bcb4 8059073c e3517198 00000003 00000001 nt!CmEnumerateValueKey+0x113
eda2bd44 804de7ec 000002c0 00000003 00000001 nt!NtEnumerateValueKey+0x1ea
eda2bd44 7c90e4f4 000002c0 00000003 00000001 nt!KiFastCallEntry+0xf8
WARNING: Frame IP not in any known module. Following frames may be wrong.
045ed0c8 00000000 00000000 00000000 00000000 0x7c90e4f4

STACK_COMMAND: kb

FOLLOWUP_IP:
nt!CmpQueryKeyValueData+2d4
8056a9fa f3a5 rep movs dword ptr es:[edi],dword ptr [esi]

SYMBOL_STACK_INDEX: 3

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nt

IMAGE_NAME: ntoskrnl.exe

DEBUG_FLR_IMAGE_TIMESTAMP: 48a404ab

SYMBOL_NAME: nt!CmpQueryKeyValueData+2d4

FAILURE_BUCKET_ID: 0x50_nt!CmpQueryKeyValueData+2d4

BUCKET_ID: 0x50_nt!CmpQueryKeyValueData+2d4

Followup: MachineOwner
---------

eax=ffdff13c ebx=00000000 ecx=00000000 edx=804e20e3 esi=c0386ff4 edi=806f0298
eip=80533806 esp=eda2bb3c ebp=eda2bb54 iopl=0 nv up ei ng nz na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00000286
nt!KeBugCheckEx+0x1b:
80533806 5d pop ebp
ChildEBP RetAddr Args to Child
eda2bb54 805241a0 00000050 e1bfd000 00000000 nt!KeBugCheckEx+0x1b (FPO: [Non-Fpo])
eda2bba0 804e1718 00000000 e1bfd000 00000000 nt!MmAccessFault+0x6f5 (FPO: [Non-Fpo])
eda2bba0 8056a9fa 00000000 e1bfd000 00000000 nt!KiTrap0E+0xcc (FPO: [0,0] TrapFrame @ eda2bbb8)
eda2bc48 80590623 e101b008 e1ad4360 01b3a0f4 nt!CmpQueryKeyValueData+0x2d4 (FPO: [Non-Fpo])
eda2bcb4 8059073c e3517198 00000003 00000001 nt!CmEnumerateValueKey+0x113 (FPO: [Non-Fpo])
eda2bd44 804de7ec 000002c0 00000003 00000001 nt!NtEnumerateValueKey+0x1ea (FPO: [Non-Fpo])
eda2bd44 7c90e4f4 000002c0 00000003 00000001 nt!KiFastCallEntry+0xf8 (FPO: [0,0] TrapFrame @ eda2bd64)
WARNING: Frame IP not in any known module. Following frames may be wrong.
045ed0c8 00000000 00000000 00000000 00000000 0x7c90e4f4
start end module name
804d7000 806ed780 nt ntoskrnl.exe Thu Aug 14 11:10:51 2008 (48A404AB)
806ee000 8070e300 hal halaacpi.dll Sun Apr 13 19:31:27 2008 (4802517F)
bf800000 bf9c2c80 win32k win32k.sys Mon Sep 15 13:12:42 2008 (48CE513A)
bf9c3000 bf9d4600 dxg dxg.sys Sun Apr 13 19:38:27 2008 (48025323)
bf9d5000 bf9e3000 ialmrnt5 ialmrnt5.dll Thu Nov 20 17:26:22 2003 (3FBCF93E)
bf9e3000 bfa05000 ialmdnt5 ialmdnt5.dll Thu Nov 20 17:25:11 2003 (3FBCF8F7)
bfa05000 bfa35680 ialmdev5 ialmdev5.DLL Thu Nov 20 17:25:03 2003 (3FBCF8EF)
bfa36000 bfab2000 ialmdd5 ialmdd5.DLL Thu Nov 20 17:24:37 2003 (3FBCF8D5)
bffa0000 bffe5c00 ATMFD ATMFD.DLL Mon Apr 14 01:09:55 2008 (4802A0D3)
ec5d1000 ec5fb180 kmixer kmixer.sys Sun Apr 13 19:45:07 2008 (480254B3)
ec5fc000 ec60c760 NAVENG NAVENG.Sys Fri Oct 01 02:59:17 2004 (415CB9F5)
ec60d000 ec6a5680 NavEx15 NavEx15.Sys Fri Oct 01 03:11:15 2004 (415CBCC3)
ec6a6000 ec6bd900 dump_atapi dump_atapi.sys Sun Apr 13 19:40:29 2008 (4802539D)
ecfcd000 ed00da80 HTTP HTTP.sys Sun Apr 13 19:53:48 2008 (480256BC)
ed07e000 ed08d900 Cdfs Cdfs.SYS Sun Apr 13 20:14:21 2008 (48025B8D)
ed2da000 ed2dc640 SYMREDRV SYMREDRV.SYS Tue Oct 28 06:57:46 2003 (3F9E136A)
ed41e000 ed46f800 srv srv.sys Mon Sep 08 11:41:40 2008 (48C50164)
ed560000 ed58c180 mrxdav mrxdav.sys Sun Apr 13 19:32:42 2008 (480251CA)
ed773000 ed787480 wdmaud wdmaud.sys Sun Apr 13 20:17:18 2008 (48025C3E)
ed930000 ed93ed80 sysaudio sysaudio.sys Sun Apr 13 20:15:55 2008 (48025BEB)
edc38000 edc63300 SYMTDI SYMTDI.SYS Tue Oct 28 06:57:34 2003 (3F9E135E)
edc64000 edc79880 irda irda.sys Sun Apr 13 19:54:35 2008 (480256EB)
edcca000 edce28c0 tfsnudfa tfsnudfa.sys Wed Jul 14 19:18:18 2004 (40F578EA)
edce3000 edcfb160 tfsnudf tfsnudf.sys Wed Jul 14 19:17:36 2004 (40F578C0)
edcfc000 edd11040 tfsnifs tfsnifs.sys Wed Jul 14 19:17:31 2004 (40F578BB)
edd32000 edd34f00 netdevio netdevio.sys Wed Jan 29 05:34:59 2003 (3E376803)
edd36000 edd39900 ndisuio ndisuio.sys Sun Apr 13 19:55:57 2008 (4802573D)
edd3a000 edd3d760 mdc8021x mdc8021x.sys Fri Nov 21 15:54:18 2003 (3FBE352A)
ede46000 ede498c0 tfsnopio tfsnopio.sys Wed Jul 14 19:17:54 2004 (40F578D2)
ede92000 edf01280 mrxsmb mrxsmb.sys Fri Oct 24 12:21:07 2008 (4901AFA3)
edf02000 edf2ce80 rdbss rdbss.sys Sun Apr 13 20:28:38 2008 (48025EE6)
edf2d000 edf52500 ipnat ipnat.sys Sun Apr 13 19:57:10 2008 (48025786)
edf53000 edf74d00 afd afd.sys Thu Aug 14 11:04:35 2008 (48A40333)
edf75000 edf9cc00 netbt netbt.sys Sun Apr 13 20:20:59 2008 (48025D1B)
edf9d000 edff5480 tcpip tcpip.sys Fri Jun 20 12:51:09 2008 (485B99AD)
edff6000 ee008600 ipsec ipsec.sys Sun Apr 13 20:19:42 2008 (48025CCE)
ee009000 ee019200 Udfs Udfs.SYS Sun Apr 13 19:32:35 2008 (480251C3)
ee01a000 ee030060 meiudf meiudf.sys Fri Jan 30 01:32:30 2004 (4019B42E)
ee17b000 ee1837e0 tfsncofs tfsncofs.sys Wed Jul 14 19:17:50 2004 (40F578CE)
ee19b000 ee1adc20 SYMEVENT SYMEVENT.SYS Thu Aug 07 02:32:39 2003 (3F31AC37)
ee1ae000 ee1ff000 SAVRT SAVRT.SYS Sat Nov 01 11:26:37 2003 (3FA3986D)
ee8bf000 ee8dccc0 ialmsbw ialmsbw.sys Thu Nov 20 17:26:18 2003 (3FBCF93A)
ee8dd000 ee8f5280 ialmkchw ialmkchw.sys Thu Nov 20 17:26:10 2003 (3FBCF932)
f69c4000 f6a21f00 update update.sys Sun Apr 13 19:39:46 2008 (48025372)
f6a22000 f6a32e00 psched psched.sys Sun Apr 13 19:56:36 2008 (48025764)
f6a33000 f6a49580 ndiswan ndiswan.sys Sun Apr 13 20:20:41 2008 (48025D09)
f6a4a000 f6a4c900 Dxapi Dxapi.sys Fri Aug 17 21:53:19 2001 (3B7D843F)
f6a72000 f6ba6ea0 AGRSM AGRSM.sys Fri Feb 20 20:00:41 2004 (40366769)
f6ba7000 f6c08c00 ALCXSENS ALCXSENS.SYS Mon Feb 23 18:11:09 2004 (403A423D)
f6c09000 f6c2ca80 portcls portcls.sys Sun Apr 13 20:19:40 2008 (48025CCC)
f6c2d000 f6cc3700 ALCXWDM ALCXWDM.SYS Mon Jun 21 09:53:19 2004 (40D6A1FF)
f6cc4000 f6ce6700 ks ks.sys Sun Apr 13 20:16:34 2008 (48025C12)
f6ce7000 f6cf74c0 Cdr4_xp Cdr4_xp.SYS Thu Oct 23 04:14:52 2003 (3F9747AC)
f6cf8000 f6d101e0 Apfiltr Apfiltr.sys Sat May 08 12:38:05 2004 (409CC69D)
f6d11000 f6d34200 USBPORT USBPORT.SYS Sun Apr 13 19:45:34 2008 (480254CE)
f6d35000 f6d48f00 VIDEOPRT VIDEOPRT.SYS Sun Apr 13 19:44:39 2008 (48025497)
f6d49000 f6d60520 ialmnt5 ialmnt5.sys Thu Nov 20 17:25:12 2003 (3FBCF8F8)
f7387000 f73a0b80 Mup Mup.sys Sun Apr 13 20:17:05 2008 (48025C31)
f73a1000 f73cd980 NDIS NDIS.sys Sun Apr 13 20:20:35 2008 (48025D03)
f73ce000 f745a600 Ntfs Ntfs.sys Sun Apr 13 20:15:49 2008 (48025BE5)
f745b000 f7471880 KSecDD KSecDD.sys Sun Apr 13 19:31:40 2008 (4802518C)
f7472000 f7486b40 drvmcdb drvmcdb.sys Thu Jun 24 16:24:09 2004 (40DAF219)
f7487000 f7498f00 sr sr.sys Sun Apr 13 19:36:50 2008 (480252C2)
f7499000 f74b9000 fltmgr fltmgr.sys unavailable (00000000)
f74b9000 f74d0900 atapi atapi.sys Sun Apr 13 19:40:29 2008 (4802539D)
f74d1000 f74ef880 ftdisk ftdisk.sys Fri Aug 17 21:52:41 2001 (3B7D8419)
f74f0000 f750d580 pcmcia pcmcia.sys Sun Apr 13 19:36:41 2008 (480252B9)
f750e000 f751ea80 pci pci.sys Sun Apr 13 19:36:43 2008 (480252BB)
f751f000 f754cd80 ACPI ACPI.sys Sun Apr 13 19:36:33 2008 (480252B1)
f756e000 f7577180 isapnp isapnp.sys Sun Apr 13 19:36:40 2008 (480252B8)
f757e000 f758d100 ohci1394 ohci1394.sys Sun Apr 13 19:46:18 2008 (480254FA)
f758e000 f759b080 1394BUS 1394BUS.SYS Sun Apr 13 19:46:18 2008 (480254FA)
f759e000 f75a8580 MountMgr MountMgr.sys Sun Apr 13 19:39:45 2008 (48025371)
f75ae000 f75bac80 VolSnap VolSnap.sys Sun Apr 13 19:41:00 2008 (480253BC)
f75be000 f75c6e00 disk disk.sys Sun Apr 13 19:40:46 2008 (480253AE)
f75ce000 f75da180 CLASSPNP CLASSPNP.SYS Sun Apr 13 20:16:21 2008 (48025C05)
f75de000 f75e8580 agp440 agp440.sys Sun Apr 13 19:36:37 2008 (480252B5)
f75fe000 f760d180 nic1394 nic1394.sys Sun Apr 13 19:51:22 2008 (4802562A)
f760e000 f7617540 drvnddm drvnddm.sys Wed Jul 14 19:24:14 2004 (40F57A4E)
f761e000 f7626e00 intelppm intelppm.sys Sun Apr 13 19:31:31 2008 (48025183)
f762e000 f763df00 Rtlnic51 Rtlnic51.sys Wed Aug 13 08:27:20 2003 (3F39E858)
f763e000 f764ad00 i8042prt i8042prt.sys Sun Apr 13 20:17:59 2008 (48025C67)
f764e000 f7658480 imapi imapi.sys Sun Apr 13 19:40:57 2008 (480253B9)
f765e000 f766d600 cdrom cdrom.sys Sun Apr 13 19:40:45 2008 (480253AD)
f766e000 f767c100 redbook redbook.sys Sun Apr 13 19:40:27 2008 (4802539B)
f767e000 f768cb00 drmk drmk.sys Sun Apr 13 19:45:12 2008 (480254B8)
f768e000 f769a880 rasl2tp rasl2tp.sys Sun Apr 13 20:19:43 2008 (48025CCF)
f769e000 f76a8200 raspppoe raspppoe.sys Sun Apr 13 19:57:31 2008 (4802579B)
f76ae000 f76b9d00 raspptp raspptp.sys Sun Apr 13 20:19:47 2008 (48025CD3)
f76be000 f76c6900 msgpc msgpc.sys Sun Apr 13 19:56:32 2008 (48025760)
f76ce000 f76d7f00 termdd termdd.sys Sun Apr 13 19:38:36 2008 (4802532C)
f76ee000 f76f7e80 NDProxy NDProxy.SYS Sun Apr 13 19:57:28 2008 (48025798)
f772e000 f773c880 usbhub usbhub.sys Sun Apr 13 19:45:36 2008 (480254D0)
f774e000 f775e000 SAVRTPEL SAVRTPEL.SYS Sat Nov 01 11:26:40 2003 (3FA39870)
f775e000 f776a000 wA301a wA301a.sys Thu Nov 20 17:25:18 2003 (3FBCF8FE)
f776e000 f7776780 netbios netbios.sys Sun Apr 13 19:56:01 2008 (48025741)
f777e000 f7788e00 Fips Fips.SYS Sun Apr 13 19:33:27 2008 (480251F7)
f778e000 f7796700 wanarp wanarp.sys Sun Apr 13 19:57:20 2008 (48025790)
f779e000 f77acd80 arp1394 arp1394.sys Sun Apr 13 19:51:22 2008 (4802562A)
f77ee000 f77f4180 PCIIDEX PCIIDEX.SYS Sun Apr 13 19:40:29 2008 (4802539D)
f77f6000 f77fad00 PartMgr PartMgr.sys Sun Apr 13 19:40:48 2008 (480253B0)
f77fe000 f7802de0 PxHelp20 PxHelp20.sys Fri Sep 24 01:24:24 2004 (41536938)
f781e000 f7825880 Npfs Npfs.SYS Sun Apr 13 19:32:38 2008 (480251C6)
f782e000 f7832500 watchdog watchdog.sys Sun Apr 13 19:44:59 2008 (480254AB)
f7836000 f783c440 tfsnboio tfsnboio.sys Wed Jul 14 19:17:38 2004 (40F578C2)
f78ee000 f78f3080 usbuhci usbuhci.sys Sun Apr 13 19:45:34 2008 (480254CE)
f78f6000 f78fd600 usbehci usbehci.sys Sun Apr 13 19:45:34 2008 (480254CE)
f78fe000 f7904000 kbdclass kbdclass.sys Sun Apr 13 19:39:46 2008 (48025372)
f7906000 f790ba00 mouclass mouclass.sys Sun Apr 13 19:39:47 2008 (48025373)
f790e000 f7914000 pfc pfc.sys unavailable (00000000)
f7916000 f791ba60 Cdralw2k Cdralw2k.SYS Thu Oct 23 04:14:42 2003 (3F9747A2)
f791e000 f7925580 Modem Modem.SYS Sun Apr 13 20:00:18 2008 (48025842)
f7926000 f792ac80 rasirda rasirda.sys Fri Aug 17 21:51:29 2001 (3B7D83D1)
f792e000 f7932a80 TDI TDI.SYS Sun Apr 13 20:00:04 2008 (48025834)
f7936000 f793a580 ptilink ptilink.sys Fri Aug 17 21:49:53 2001 (3B7D8371)
f793e000 f7942080 raspti raspti.sys Fri Aug 17 21:55:32 2001 (3B7D84C4)
f7946000 f794b020 wanatw4 wanatw4.sys Tue Jul 16 16:23:14 2002 (3D343A62)
f7966000 f796bbc0 ssrtln ssrtln.sys Wed Jul 14 19:28:48 2004 (40F57B60)
f796e000 f7973200 vga vga.sys Sun Apr 13 19:44:40 2008 (48025498)
f7976000 f797aa80 Msfs Msfs.SYS Sun Apr 13 19:32:38 2008 (480251C6)
f797e000 f7981000 BOOTVID BOOTVID.dll Fri Aug 17 21:49:09 2001 (3B7D8345)
f7982000 f7984800 compbatt compbatt.sys Sun Apr 13 19:36:36 2008 (480252B4)
f7986000 f7989780 BATTC BATTC.SYS Sun Apr 13 19:36:32 2008 (480252B0)
f798a000 f798cd80 ACPIEC ACPIEC.sys Fri Aug 17 21:57:55 2001 (3B7D8553)
f7a12000 f7a14280 rasacd rasacd.sys Fri Aug 17 21:55:39 2001 (3B7D84CB)
f7a3e000 f7a41680 CmBatt CmBatt.sys Sun Apr 13 19:36:36 2008 (480252B4)
f7a42000 f7a45f60 DKbFltr DKbFltr.sys Mon Jan 12 09:05:57 2004 (40026375)
f7a5e000 f7a60780 ndistapi ndistapi.sys Sun Apr 13 19:57:27 2008 (48025797)
f7a6a000 f7a6dc80 mssmbios mssmbios.sys Sun Apr 13 19:36:45 2008 (480252BD)
f7a6e000 f7a6fb80 kdcom kdcom.dll Fri Aug 17 21:49:10 2001 (3B7D8346)
f7a70000 f7a71100 WMILIB WMILIB.SYS Fri Aug 17 22:07:23 2001 (3B7D878B)
f7a72000 f7a73580 intelide intelide.sys Sun Apr 13 19:40:29 2008 (4802539D)
f7a88000 f7a89080 hkdrv hkdrv.sys Fri Aug 29 10:27:28 2003 (3F4F1C80)
f7a8a000 f7a8b5c0 sscdbhk5 sscdbhk5.sys Wed Jul 14 19:29:02 2004 (40F57B6E)
f7a8c000 f7a8d100 swenum swenum.sys Sun Apr 13 19:39:52 2008 (48025378)
f7a90000 f7a91280 USBD USBD.SYS Fri Aug 17 22:02:58 2001 (3B7D8682)
f7a94000 f7a96000 Fs_Rec Fs_Rec.SYS unavailable (00000000)
f7a96000 f7a97080 Beep Beep.SYS Fri Aug 17 21:47:33 2001 (3B7D82E5)
f7a98000 f7a99080 mnmdd mnmdd.SYS Fri Aug 17 21:57:28 2001 (3B7D8538)
f7a9a000 f7a9b080 RDPCDD RDPCDD.sys Fri Aug 17 21:46:56 2001 (3B7D82C0)
f7aa2000 f7aa3900 TPIoMngr TPIoMngr.sys Fri Jul 30 08:05:04 2004 (4109F320)
f7aa4000 f7aa5900 SSIoMngr SSIoMngr.sys Fri Jul 30 08:05:06 2004 (4109F322)
f7aa6000 f7aa7900 EPIoMngr EPIoMngr.sys Fri Jul 30 08:05:02 2004 (4109F31E)
f7aa8000 f7aa9480 ECioctl ECioctl.sys Thu Aug 19 07:03:06 2004 (4124429A)
f7aaa000 f7aab900 EKIoMngr EKIoMngr.sys Fri Jul 30 08:05:03 2004 (4109F31F)
f7aba000 f7abb100 dump_WMILIB dump_WMILIB.SYS Fri Aug 17 22:07:23 2001 (3B7D878B)
f7ac0000 f7ac1860 TBiosDrv TBiosDrv.sys Wed Jun 11 17:53:21 2003 (3EE75E81)
f7ac2000 f7ac38a0 tfsnpool tfsnpool.sys Wed Jul 14 19:17:32 2004 (40F578BC)
f7b36000 f7b36d00 pciide pciide.sys Fri Aug 17 21:51:49 2001 (3B7D83E5)
f7b37000 f7b37d80 OPRGHDLR OPRGHDLR.SYS Fri Aug 17 21:57:55 2001 (3B7D8553)
f7b6e000 f7b6e880 tfsndres tfsndres.sys Wed Jul 14 19:18:23 2004 (40F578EF)
f7b80000 f7b80fe0 tfsndrct tfsndrct.sys Wed Jul 14 19:17:53 2004 (40F578D1)
f7b8c000 f7b8cc00 audstub audstub.sys Fri Aug 17 21:59:40 2001 (3B7D85BC)
f7bb6000 f7bb6d00 dxgthk dxgthk.sys Fri Aug 17 21:53:12 2001 (3B7D8438)
f7c44000 f7c45000 Null Null.SYS unavailable (00000000)

Unloaded modules:
ec5fc000 ec60d000 NAVENG.Sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ec60d000 ec6a6000 NavEx15.Sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ec5fc000 ec60d000 NAVENG.Sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ec60d000 ec6a6000 NavEx15.Sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ec5fc000 ec60d000 NAVENG.Sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ec60d000 ec6a6000 NavEx15.Sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ec5fc000 ec60d000 NAVENG.Sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ec60d000 ec6a6000 NavEx15.Sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ec5fc000 ec60d000 NAVENG.Sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ec60d000 ec6a6000 NavEx15.Sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ec768000 ec793000 kmixer.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ec6be000 ec6cf000 NAVENG.Sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ec6cf000 ec768000 NavEx15.Sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ede52000 ede6a000 dump_atapi.s
Timestamp: unavailable (00000000)
Checksum: 00000000
ec6be000 ec6cf000 NAVENG.Sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ec6cf000 ec768000 NavEx15.Sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ec793000 ec7a4000 NAVENG.Sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ec7a4000 ec83d000 NavEx15.Sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ec97d000 ec9a8000 kmixer.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ec793000 ec7a4000 NAVENG.Sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ec7a4000 ec83d000 NavEx15.Sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ec793000 ec7a4000 NAVENG.Sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ec7a4000 ec83d000 NavEx15.Sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ec9a8000 ec9b9000 NAVENG.Sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ec9b9000 eca52000 NavEx15.Sys
Timestamp: unavailable (00000000)
Checksum: 00000000
eca52000 eca7d000 kmixer.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ee051000 ee062000 NAVENG.Sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ee062000 ee0fb000 NavEx15.Sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ed685000 ed6b0000 kmixer.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
f7c59000 f7c5a000 drmkaud.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ed910000 ed91d000 DMusic.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ed750000 ed773000 aec.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ed920000 ed92e000 swmidi.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
f7b0c000 f7b0e000 splitter.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ed8d0000 ed8e0000 Serial.SYS
Timestamp: unavailable (00000000)
Checksum: 00000000
f795e000 f7963000 Cdaudio.SYS
Timestamp: unavailable (00000000)
Checksum: 00000000
f7a0a000 f7a0d000 Sfloppy.SYS
Timestamp: unavailable (00000000)
Checksum: 00000000
f7956000 f795b000 Flpydisk.SYS
Timestamp: unavailable (00000000)
Checksum: 00000000
f794e000 f7955000 Fdc.SYS
Timestamp: unavailable (00000000)
Checksum: 00000000
Closing open log file c:\debuglog.txt

PeteC · 2009/01/12

Debugging normally has to be done on the machine that experiences the problem. Debugging on another machine will produce incomplete info.
Click to expand...

I was not aware of that - have had success in the past though with that method.

I have to log off now - a 300+ mile round trip to my Aunt's funeral tomorrow.

PeteC · 2009/01/14

I am really struggling here - the 2 dump files you sent are to all extents and purposes identical - same time, etc. The MEMORY dump, the larger, has a little more info in it which indicates that Ad-Aware (aawservice.exe) was running at the time.

Before I attempt to go any further can you confirm if it is only security related programs which cause a BSOD?

Log in or Sign up

[Computer BSOD's and restarts when opening programs]

wbrumfiel Inactive Thread Starter

PeteC SuperGeek Staff

wbrumfiel Inactive Thread Starter

PeteC SuperGeek Staff

wbrumfiel Inactive Thread Starter

PeteC SuperGeek Staff

wbrumfiel Inactive Thread Starter

wbrumfiel Inactive Thread Starter

PeteC SuperGeek Staff

PeteC SuperGeek Staff

wbrumfiel Inactive Thread Starter

PeteC SuperGeek Staff

wbrumfiel Inactive Thread Starter

PeteC SuperGeek Staff

Admin. Administrator Administrator Staff

Admin. Administrator Administrator Staff

PeteC SuperGeek Staff

PeteC SuperGeek Staff

PeteC SuperGeek Staff

PeteC SuperGeek Staff

Share This Page

Log in or Sign up

[Computer BSOD's and restarts when opening programs]

wbrumfiel Inactive Thread Starter

PeteC SuperGeek Staff

wbrumfiel Inactive Thread Starter

PeteC SuperGeek Staff

wbrumfiel Inactive Thread Starter

PeteC SuperGeek Staff

wbrumfiel Inactive Thread Starter

wbrumfiel Inactive Thread Starter

PeteC SuperGeek Staff

PeteC SuperGeek Staff

wbrumfiel Inactive Thread Starter

PeteC SuperGeek Staff

wbrumfiel Inactive Thread Starter

PeteC SuperGeek Staff

Admin. Administrator Administrator Staff

Admin. Administrator Administrator Staff

PeteC SuperGeek Staff

PeteC SuperGeek Staff

PeteC SuperGeek Staff

PeteC SuperGeek Staff

Share This Page

Useful Searches