1. You are viewing our forum as a guest. For full access please Register. WindowsBBS.com is completely free, paid for by advertisers and donations.

Getting BSOD - attached several dump logs.

Discussion in 'Windows XP' started by bctrueax, 2005/11/25.

  1. 2005/11/25
    bctrueax

    bctrueax Inactive Thread Starter

    Joined:
    2005/03/03
    Messages:
    12
    Likes Received:
    0
    Greetings,
    My pc is experiences the BSOD every other day or so. Here are the last 3 dump logs (I have more). Hopefully someone here can translate this to me! Thanks in advance.
    -Brian

    ---------Log # 1
    Opened log file 'c:\debuglog.txt'

    Microsoft (R) Windows Debugger Version 6.4.0007.2
    Copyright (c) Microsoft Corporation. All rights reserved.


    Loading Dump File [C:\WINDOWS\Minidump\Mini101905-02.dmp]
    Mini Kernel Dump File: Only registers and stack trace are available

    Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
    Executable search path is: C:\WINDOWS;C:\WINDOWS\system32;C:\WINDOWS\system32\drivers
    Windows XP Kernel Version 2600 (Service Pack 2) UP Free x86 compatible
    Product: WinNt, suite: TerminalServer SingleUserTS
    Built by: 2600.xpsp_sp2_gdr.050301-1519
    Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055a420
    Debug session time: Wed Oct 19 17:40:11.671 2005 (GMT-5)
    System Uptime: 0 days 0:17:45.257
    Loading Kernel Symbols
    ..............................................................................................................................................
    Loading unloaded module list
    ..........
    Loading User Symbols
    *******************************************************************************
    * *
    * Bugcheck Analysis *
    * *
    *******************************************************************************

    Use !analyze -v to get detailed debugging information.

    BugCheck 10000050, {b9eb3a15, 1, 804b9fcc, 0}


    Could not read faulting driver name
    Probably caused by : hardware

    Followup: MachineOwner
    ---------
    *** Possible invalid call from 8057bfa0 ( nt!NtDeviceIoControlFile+0x25 )
    *** Expected target 8057986a ( nt!IopXxxControlFile+0x0 )

    kd> !analyze -v;r;kv;lmtn;.logclose;q
    *******************************************************************************
    * *
    * Bugcheck Analysis *
    * *
    *******************************************************************************

    PAGE_FAULT_IN_NONPAGED_AREA (50)
    Invalid system memory was referenced. This cannot be protected by try-except,
    it must be protected by a Probe. Typically the address is just plain bad or it
    is pointing at freed memory.
    Arguments:
    Arg1: b9eb3a15, memory referenced.
    Arg2: 00000001, value 0 = read operation, 1 = write operation.
    Arg3: 804b9fcc, If non-zero, the instruction address which referenced the bad memory
    address.
    Arg4: 00000000, (reserved)

    Debugging Details:
    ------------------


    Could not read faulting driver name

    WRITE_ADDRESS: b9eb3a15

    FAULTING_IP:
    +ffffffff804b9fcc
    804b9fcc c8aff28f enter 0xf2af,0x8f

    MM_INTERNAL_CODE: 0

    CUSTOMER_CRASH_COUNT: 2

    DEFAULT_BUCKET_ID: DRIVER_FAULT

    BUGCHECK_STR: 0x50

    LAST_CONTROL_TRANSFER: from 8057bfa5 to 804b9fcc

    STACK_TEXT:
    WARNING: Frame IP not in any known module. Following frames may be wrong.
    b9ec2d00 8057bfa5 00000774 00000710 00000000 0x804b9fcc
    b9ec2d34 804de7ec 00000774 00000710 00000000 nt!NtDeviceIoControlFile+0x2a
    b9ec2d34 7c90eb94 00000774 00000710 00000000 nt!KiFastCallEntry+0xf8
    0350fc40 7c90d8ef 71a52be9 00000774 00000710 0x7c90eb94
    0350fd50 71ab2e67 00000000 0350fdbc 00000000 0x7c90d8ef
    0350fda0 6af4a910 00000000 0350fdbc 00000000 0x71ab2e67
    0350fec8 6ad691f0 000000fa 0022556c 0148fd1c 0x6af4a910
    0148fd1c 00000000 00000000 00000000 00000000 0x6ad691f0


    POSSIBLE_INVALID_CONTROL_TRANSFER: from 8057bfa0 to 8057986a

    FOLLOWUP_NAME: MachineOwner

    MODULE_NAME: hardware

    IMAGE_NAME: hardware

    DEBUG_FLR_IMAGE_TIMESTAMP: 0

    STACK_COMMAND: kb

    BUCKET_ID: CPU_CALL_ERROR

    Followup: MachineOwner
    ---------
    *** Possible invalid call from 8057bfa0 ( nt!NtDeviceIoControlFile+0x25 )
    *** Expected target 8057986a ( nt!IopXxxControlFile+0x0 )

    eax=00000042 ebx=8057bf7b ecx=00000000 edx=0350fc4c esi=0350fc74 edi=8ff4cfc8
    eip=804b9fcc esp=b9ec2d04 ebp=b9ec2d34 iopl=0 nv up ei ng nz na pe cy
    cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010283
    804b9fcc c8aff28f enter 0xf2af,0x8f
    ChildEBP RetAddr Args to Child
    WARNING: Frame IP not in any known module. Following frames may be wrong.
    b9ec2d00 8057bfa5 00000774 00000710 00000000 0x804b9fcc
    b9ec2d34 804de7ec 00000774 00000710 00000000 nt!NtDeviceIoControlFile+0x2a (FPO: [Non-Fpo])
    b9ec2d34 7c90eb94 00000774 00000710 00000000 nt!KiFastCallEntry+0xf8 (FPO: [0,0] TrapFrame @ b9ec2d64)
    0350fc40 7c90d8ef 71a52be9 00000774 00000710 0x7c90eb94
    0350fd50 71ab2e67 00000000 0350fdbc 00000000 0x7c90d8ef
    0350fda0 6af4a910 00000000 0350fdbc 00000000 0x71ab2e67
    0350fec8 6ad691f0 000000fa 0022556c 0148fd1c 0x6af4a910
    0148fd1c 00000000 00000000 00000000 00000000 0x6ad691f0

    ----------------Log #2
    Opened log file 'c:\debuglog.txt'

    Microsoft (R) Windows Debugger Version 6.4.0007.2
    Copyright (c) Microsoft Corporation. All rights reserved.


    Loading Dump File [C:\WINDOWS\Minidump\Mini101905-01.dmp]
    Mini Kernel Dump File: Only registers and stack trace are available

    Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
    Executable search path is: C:\WINDOWS;C:\WINDOWS\system32;C:\WINDOWS\system32\drivers
    Windows XP Kernel Version 2600 (Service Pack 2) UP Free x86 compatible
    Product: WinNt, suite: TerminalServer SingleUserTS
    Built by: 2600.xpsp_sp2_gdr.050301-1519
    Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055a420
    Debug session time: Wed Oct 19 10:03:50.781 2005 (GMT-5)
    System Uptime: 1 days 17:28:08.381
    Loading Kernel Symbols
    ...............................................................................................................................................
    Loading unloaded module list
    ....................
    Loading User Symbols
    *******************************************************************************
    * *
    * Bugcheck Analysis *
    * *
    *******************************************************************************

    Use !analyze -v to get detailed debugging information.

    BugCheck 1000000A, {c00db650, 2, 0, 8067eba3}

    *** ERROR: Module load completed but symbols could not be loaded for SiWinAcc.sys
    *** ERROR: Symbol file could not be found. Defaulted to export symbols for SYMEVENT.SYS -
    Probably caused by : SiWinAcc.sys ( SiWinAcc+325 )

    Followup: MachineOwner
    ---------

    kd> !analyze -v;r;kv;lmtn;.logclose;q
    *******************************************************************************
    * *
    * Bugcheck Analysis *
    * *
    *******************************************************************************

    IRQL_NOT_LESS_OR_EQUAL (a)
    An attempt was made to access a pageable (or completely invalid) address at an
    interrupt request level (IRQL) that is too high. This is usually
    caused by drivers using improper addresses.
    If a kernel debugger is available get the stack backtrace.
    Arguments:
    Arg1: c00db650, memory referenced
    Arg2: 00000002, IRQL
    Arg3: 00000000, value 0 = read operation, 1 = write operation
    Arg4: 8067eba3, address which referenced memory

    Debugging Details:
    ------------------


    READ_ADDRESS: c00db650

    CURRENT_IRQL: 2

    FAULTING_IP:
    nt!MiAllocateSpecialPool+ec
    8067eba3 8b0e mov ecx,[esi]

    CUSTOMER_CRASH_COUNT: 1

    DEFAULT_BUCKET_ID: DRIVER_FAULT

    BUGCHECK_STR: 0xA

    LAST_CONTROL_TRANSFER: from 8054b9af to 8067eba3

    STACK_TEXT:
    b8c9d5b0 8054b9af 00000134 4146744e 00000011 nt!MiAllocateSpecialPool+0xec
    b8c9d618 bae7ed8d 00000011 00000134 4146744e nt!ExAllocatePoolWithTag+0x77
    b8c9d638 bae7eb28 858c8008 8aa4cd20 00000101 Ntfs!NtfsLookupEntry+0x42
    b8c9d864 bae7bf64 858c8008 85db5008 b8c9d8bc Ntfs!NtfsCommonCreate+0x10c3
    b8c9d944 804e37f7 88e96770 85db5008 85db5198 Ntfs!NtfsFsdCreate+0x1ec
    b8c9d954 f7943325 f7943a1f 8a2bcf00 85db5008 nt!IopfCallDriver+0x31
    WARNING: Stack unwind information not available. Following frames may be wrong.
    b8c9d988 804e37f7 8a2bcf00 88e96770 85842e58 SiWinAcc+0x325
    b8c9d998 baeff876 00000000 88ed2f38 94fd6fa8 nt!IopfCallDriver+0x31
    b8c9d9e4 804e37f7 886f6e88 00000001 b8c9da44 sr!SrCreate+0x150
    b8c9d9f4 eb01fe33 b8c9da44 b804da00 00000000 nt!IopfCallDriver+0x31
    b8c9db50 8056316c 88d6ce30 00000000 85dfa858 SYMEVENT!SYMEvent_GetVMDataPtr+0x1923
    b8c9dbd8 8056729a 00000000 b8c9dc18 00000040 nt!ObpLookupObjectName+0x56a
    b8c9dc2c 80570b73 00000000 00000000 842e3801 nt!ObOpenObjectByName+0xeb
    b8c9dca8 80570c42 0050e218 00100001 0050e1bc nt!IopCreateFile+0x407
    b8c9dd04 80570d0a 0050e218 00100001 0050e1bc nt!IoCreateFile+0x8e
    b8c9dd44 804de7ec 0050e218 00100001 0050e1bc nt!NtOpenFile+0x27
    b8c9dd44 7c90eb94 0050e218 00100001 0050e1bc nt!KiFastCallEntry+0xf8
    0050e18c 00000000 00000000 00000000 00000000 0x7c90eb94


    FOLLOWUP_IP:
    SiWinAcc+325
    f7943325 eb1c jmp SiWinAcc+0x343 (f7943343)

    SYMBOL_STACK_INDEX: 6

    FOLLOWUP_NAME: MachineOwner

    SYMBOL_NAME: SiWinAcc+325

    MODULE_NAME: SiWinAcc

    IMAGE_NAME: SiWinAcc.sys

    DEBUG_FLR_IMAGE_TIMESTAMP: 40acfb39

    STACK_COMMAND: kb

    FAILURE_BUCKET_ID: 0xA_SiWinAcc+325

    BUCKET_ID: 0xA_SiWinAcc+325

    Followup: MachineOwner
    ---------

    eax=00019079 ebx=b8c90000 ecx=000225a4 edx=00000000 esi=c00db650 edi=00000163
    eip=8067eba3 esp=b8c9d590 ebp=b8c9d5b0 iopl=0 nv up ei pl nz na pe nc
    cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010202
    nt!MiAllocateSpecialPool+0xec:
    8067eba3 8b0e mov ecx,[esi] ds:0023:c00db650=????????
    ChildEBP RetAddr Args to Child
    b8c9d5b0 8054b9af 00000134 4146744e 00000011 nt!MiAllocateSpecialPool+0xec (FPO: [Non-Fpo])
    b8c9d618 bae7ed8d 00000011 00000134 4146744e nt!ExAllocatePoolWithTag+0x77 (FPO: [Non-Fpo])
    b8c9d638 bae7eb28 858c8008 8aa4cd20 00000101 Ntfs!NtfsLookupEntry+0x42 (FPO: [Non-Fpo])
    b8c9d864 bae7bf64 858c8008 85db5008 b8c9d8bc Ntfs!NtfsCommonCreate+0x10c3 (FPO: [Non-Fpo])
    b8c9d944 804e37f7 88e96770 85db5008 85db5198 Ntfs!NtfsFsdCreate+0x1ec (FPO: [Non-Fpo])
    b8c9d954 f7943325 f7943a1f 8a2bcf00 85db5008 nt!IopfCallDriver+0x31 (FPO: [0,0,0])
    WARNING: Stack unwind information not available. Following frames may be wrong.
    b8c9d988 804e37f7 8a2bcf00 88e96770 85842e58 SiWinAcc+0x325
    b8c9d998 baeff876 00000000 88ed2f38 94fd6fa8 nt!IopfCallDriver+0x31 (FPO: [0,0,0])
    b8c9d9e4 804e37f7 886f6e88 00000001 b8c9da44 sr!SrCreate+0x150 (FPO: [Non-Fpo])
    b8c9d9f4 eb01fe33 b8c9da44 b804da00 00000000 nt!IopfCallDriver+0x31 (FPO: [0,0,0])
    b8c9db50 8056316c 88d6ce30 00000000 85dfa858 SYMEVENT!SYMEvent_GetVMDataPtr+0x1923
    b8c9dbd8 8056729a 00000000 b8c9dc18 00000040 nt!ObpLookupObjectName+0x56a (FPO: [Non-Fpo])
    b8c9dc2c 80570b73 00000000 00000000 842e3801 nt!ObOpenObjectByName+0xeb (FPO: [Non-Fpo])
    b8c9dca8 80570c42 0050e218 00100001 0050e1bc nt!IopCreateFile+0x407 (FPO: [Non-Fpo])
    b8c9dd04 80570d0a 0050e218 00100001 0050e1bc nt!IoCreateFile+0x8e (FPO: [Non-Fpo])
    b8c9dd44 804de7ec 0050e218 00100001 0050e1bc nt!NtOpenFile+0x27 (FPO: [Non-Fpo])
    b8c9dd44 7c90eb94 0050e218 00100001 0050e1bc nt!KiFastCallEntry+0xf8 (FPO: [0,0] TrapFrame @ b8c9dd64)
    0050e18c 00000000 00000000 00000000 00000000 0x7c90eb94

    -------------Log #3
    Opened log file 'c:\debuglog.txt'

    Microsoft (R) Windows Debugger Version 6.4.0007.2
    Copyright (c) Microsoft Corporation. All rights reserved.


    Loading Dump File [C:\WINDOWS\Minidump\Mini102905-03.dmp]
    Mini Kernel Dump File: Only registers and stack trace are available

    Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
    Executable search path is: C:\WINDOWS;C:\WINDOWS\system32;C:\WINDOWS\system32\drivers
    Windows XP Kernel Version 2600 (Service Pack 2) UP Free x86 compatible
    Product: WinNt, suite: TerminalServer SingleUserTS
    Built by: 2600.xpsp_sp2_gdr.050301-1519
    Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055a420
    Debug session time: Sat Oct 29 07:52:02.812 2005 (GMT-5)
    System Uptime: 0 days 0:01:59.413
    Loading Kernel Symbols
    ..............................................................................................................................................
    Loading unloaded module list
    ..........
    Loading User Symbols
    *******************************************************************************
    * *
    * Bugcheck Analysis *
    * *
    *******************************************************************************

    Use !analyze -v to get detailed debugging information.

    BugCheck 100000C5, {4, 2, 1, 8054ae34}

    *** WARNING: Unable to verify timestamp for SAVRT.SYS
    *** ERROR: Module load completed but symbols could not be loaded for SAVRT.SYS
    Probably caused by : SAVRT.SYS ( SAVRT+4610f )

    Followup: MachineOwner
    ---------

    kd> !analyze -v;r;kv;lmtn;.logclose;q
    *******************************************************************************
    * *
    * Bugcheck Analysis *
    * *
    *******************************************************************************

    DRIVER_CORRUPTED_EXPOOL (c5)
    An attempt was made to access a pageable (or completely invalid) address at an
    interrupt request level (IRQL) that is too high. This is
    caused by drivers that have corrupted the system pool. Run the driver
    verifier against any new (or suspect) drivers, and if that doesn't turn up
    the culprit, then use gflags to enable special pool.
    Arguments:
    Arg1: 00000004, memory referenced
    Arg2: 00000002, IRQL
    Arg3: 00000001, value 0 = read operation, 1 = write operation
    Arg4: 8054ae34, address which referenced memory

    Debugging Details:
    ------------------


    BUGCHECK_STR: 0xC5_2

    CURRENT_IRQL: 2

    FAULTING_IP:
    nt!ExAllocatePoolWithTag+673
    8054ae34 897104 mov [ecx+0x4],esi

    CUSTOMER_CRASH_COUNT: 3

    DEFAULT_BUCKET_ID: DRIVER_FAULT

    LAST_CONTROL_TRANSFER: from 804f9701 to 8054ae34

    STACK_TEXT:
    b9010704 804f9701 00000000 00000001 20707249 nt!ExAllocatePoolWithTag+0x673
    b9010754 804e884f 0000000a 00000000 86399340 nt!IopAllocateIrpPrivate+0x147
    b901077c 8056a87d 0000000a 86399328 87460e70 nt!IopAllocateIrpMustSucceed+0x1b
    b90107b4 80566901 9906eda0 90d04f10 00100080 nt!IopCloseFile+0x211
    b90107e4 80566aab 9906eda0 86399340 87460e70 nt!ObpDecrementHandleCount+0x119
    b901080c 80566b1c 99092fb8 86399340 000004b0 nt!ObpCloseHandleTableEntry+0x14d
    b9010854 80566b66 000004b0 00000000 00000000 nt!ObpCloseHandle+0x87
    b9010868 804de7ec 000004b0 b9010914 804dc8c1 nt!NtClose+0x1d
    b9010868 804dc8c1 000004b0 b9010914 804dc8c1 nt!KiFastCallEntry+0xf8
    b90108e4 b790d10f 000004b0 00000001 a6f7cfcd nt!ZwClose+0x11
    WARNING: Stack unwind information not available. Following frames may be wrong.
    b9010914 b78ddaa5 ab470f38 a6f7cf78 b78db35c SAVRT+0x4610f
    8a8d2fc0 00000000 00000000 00000000 00000000 SAVRT+0x16aa5


    FOLLOWUP_IP:
    SAVRT+4610f
    b790d10f ?? ???

    SYMBOL_STACK_INDEX: a

    FOLLOWUP_NAME: MachineOwner

    SYMBOL_NAME: SAVRT+4610f

    MODULE_NAME: SAVRT

    IMAGE_NAME: SAVRT.SYS

    DEBUG_FLR_IMAGE_TIMESTAMP: 41ba0a1f

    STACK_COMMAND: kb

    FAILURE_BUCKET_ID: 0xC5_2_SAVRT+4610f

    BUCKET_ID: 0xC5_2_SAVRT+4610f

    Followup: MachineOwner
    ---------

    eax=82561d20 ebx=80561940 ecx=00000000 edx=0000003c esi=80561d20 edi=000001ff
    eip=8054ae34 esp=b90106b0 ebp=b9010704 iopl=0 nv up ei pl nz na po nc
    cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010206
    nt!ExAllocatePoolWithTag+0x673:
    8054ae34 897104 mov [ecx+0x4],esi ds:0023:00000004=????????
    ChildEBP RetAddr Args to Child
    b9010704 804f9701 00000000 00000001 20707249 nt!ExAllocatePoolWithTag+0x673 (FPO: [Non-Fpo])
    b9010754 804e884f 0000000a 00000000 86399340 nt!IopAllocateIrpPrivate+0x147 (FPO: [Non-Fpo])
    b901077c 8056a87d 0000000a 86399328 87460e70 nt!IopAllocateIrpMustSucceed+0x1b (FPO: [Non-Fpo])
    b90107b4 80566901 9906eda0 90d04f10 00100080 nt!IopCloseFile+0x211 (FPO: [Non-Fpo])
    b90107e4 80566aab 9906eda0 86399340 87460e70 nt!ObpDecrementHandleCount+0x119 (FPO: [Non-Fpo])
    b901080c 80566b1c 99092fb8 86399340 000004b0 nt!ObpCloseHandleTableEntry+0x14d (FPO: [Non-Fpo])
    b9010854 80566b66 000004b0 00000000 00000000 nt!ObpCloseHandle+0x87 (FPO: [Non-Fpo])
    b9010868 804de7ec 000004b0 b9010914 804dc8c1 nt!NtClose+0x1d (FPO: [Non-Fpo])
    b9010868 804dc8c1 000004b0 b9010914 804dc8c1 nt!KiFastCallEntry+0xf8 (FPO: [0,0] TrapFrame @ b9010874)
    b90108e4 b790d10f 000004b0 00000001 a6f7cfcd nt!ZwClose+0x11 (FPO: [1,0,0])
    WARNING: Stack unwind information not available. Following frames may be wrong.
    b9010914 b78ddaa5 ab470f38 a6f7cf78 b78db35c SAVRT+0x4610f
    8a8d2fc0 00000000 00000000 00000000 00000000 SAVRT+0x16aa5
     
    bctrueax,
    #1
  2. 2005/11/26
    cpc2004

    cpc2004 Inactive

    Joined:
    2005/07/08
    Messages:
    366
    Likes Received:
    0
    Hi,

    Your windows is crashed with "POSSIBLE_INVALID_CONTROL_TRANSFER" and they are symptom of hardware error. I resolved similar problem at another forum. According to the record, 5 cases are faulty motherboard, 1 case is faulty video card and 1 case is inadequate PSU.

    Hope it can help you,
    cpc2004
     
    cpc2004,
    #2


  3. to hide this advert.

Share This Page

  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Accept Learn More...