Minidump for BSOD on Shutdowns

My PC crashed a few weeks ago and the maker had a new MB, RAM. CPU and power supply installed. The PC came up OK but when I attached everything to it crashed again. One of the new RAM chips went bad and after firing it up with 512MB, chkdsk ran and repaired a bunch of files. After that XP came up normally but started to throw PAGE_FAULT_IN_NONPAGED_AREA errors on shutdowns. I have tested the RAM, reseated all cards, updated video drivers and uninstalled my AV program. The BSODs are now continuous on any shutdown or restart and the minidump files are almost all identical in content. The PC does not crash in safe mode. I may have to do a complete recovery of the OS but if someone can look at the minidump and give me some idea as to what this is about I would appreciate it.

Microsoft (R) Windows Debugger Version 6.6.0007.5
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\WINDOWS\Minidump\Mini102306-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*C:\program files\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows XP Kernel Version 2600 (Service Pack 2) MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 2600.xpsp_sp2_gdr.050301-1519
Kernel base = 0x804d7000 PsLoadedModuleList = 0x805624a0
Debug session time: Sun Oct 22 23:00:34.093 2006 (GMT-7)
System Uptime: 0 days 0:32:02.793
Loading Kernel Symbols
...................................................................................................................................
Loading User Symbols
Loading unloaded module list
.........
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.
BugCheck 10000050, {e559f000, 1, 805d711a, 1}

Could not read faulting driver name
Probably caused by : ntkrnlmp.exe ( nt!CmpCopyCell+72 )

Followup: MachineOwner
---------
1: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced. This cannot be protected by try-except,
it must be protected by a Probe. Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: e559f000, memory referenced.
Arg2: 00000001, value 0 = read operation, 1 = write operation.
Arg3: 805d711a, If non-zero, the instruction address which referenced the bad memory
address.
Arg4: 00000001, (reserved)

Debugging Details:
------------------
Could not read faulting driver name

WRITE_ADDRESS: e559f000

FAULTING_IP:
nt!CmpCopyCell+72
805d711a f3a5 rep movs dword ptr es:[edi],dword ptr [esi]

MM_INTERNAL_CODE: 1

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: 0x50

PROCESS_NAME: winlogon.exe

LAST_CONTROL_TRANSFER: from 805d71f3 to 805d711a

STACK_TEXT:
baa39b78 805d71f3 00561020 00000004 e52db378 nt!CmpCopyCell+0x72
baa39bac 805d7c60 019d2008 00403080 0055ffe0 nt!CmpCopyValue+0xc0
baa39bf4 805d7d0b e29d2008 00403020 00560020 nt!CmpCopyKeyPartial+0x16f
baa39c34 805d77ed e1063000 00000400 00000007 nt!CmpCopySyncTree2+0x25a
baa39c64 8065b1d5 e29d2008 00000020 e52db378 nt!CmpCopySyncTree+0x4f
baa39c98 8065315f 00000020 000006c4 00000003 nt!CmSaveKey+0xde
baa39cbc 804dd99f e29ac3c8 000006c4 baa39d54 nt!NtSaveKey+0x78
baa39cbc 804e42bf e29ac3c8 000006c4 baa39d54 nt!KiFastCallEntry+0xfc
baa39d3c 8065312c 00000094 000006c4 806530e7 nt!ZwSaveKey+0x11
baa39d54 804dd99f 00000094 000006c4 0006f8b8 nt!NtSaveKey+0x45
baa39d54 7c90eb94 00000094 000006c4 0006f8b8 nt!KiFastCallEntry+0xfc
WARNING: Frame IP not in any known module. Following frames may be wrong.
0006f8b8 00000000 00000000 00000000 00000000 0x7c90eb94

STACK_COMMAND: kb

FOLLOWUP_IP:
nt!CmpCopyCell+72
805d711a f3a5 rep movs dword ptr es:[edi],dword ptr [esi]

SYMBOL_STACK_INDEX: 0

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nt

IMAGE_NAME: ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP: 42250f77

 

Uninstall and disconnect all hardware you added to the base installation of XP. Then add one piece at a time and install.

If Okay, reboot and add one more piece.

By 'dividing and conquering' you will find the hardware device and its driver that is causing the problem.

 

The only hardware items that I added were a USB HP scanner that I uninstalled after the second crash because it may have been a culprit (although there are still some residual registry keys left), a Canon printer and a Sony DVD-RW deck that replaced the original slower Sony DVD-RW deck that came with the PC and didn't require any settings changes. Is it possible that either of the two remaining items may be at fault? They both appear to work normally. I had thought about deleting about those HP keys and the only other thought was the Nvidia GEforce 5950 card. The original crash was a graphics freeze and blackout. The video appears to be OK and the original drivers were reloaded from the PC maker's (MPC) CD. There is also an Audigy 2 sound card, a modem and a firewire port card that came with the PC. Thanks.

 

http://support.microsoft.com/default.aspx?scid=kb;en-us;819017

As a test:

Start, Run, services.msc

Stop the Windows Image Acquisition Service.

Now try the shutdown.

 

Will do Bill. I'll post later tonight. Thanks.

 

Ok, with the Windows Image Aquisition Service stopped and no AV program running, XP shut down normally. I reinstalled my AV program (CA Anti-Virus) and with it running its Real-Time Protection and its E-mail protection, XP crashed just at the end of the shutdown sequence. The minidump contents were identical to those that I posted. I disabled the e-mail protection and left the RT protection on and XP shutdown and/or restarted normally. I suspected that the prior version of the AV program, EZ Antivirus, also contributed to the crashes. I had tried AVG Antivirus as well with no positive results. That of course was prior to stopping the service. I will admit that I'm pretty confused at this point. The other question is if I get a new scanner how will the Aquisition service figure into its working or not working properly.

 

Try setting the WIA service to Manual.
Start, Run, services.msc
Double click the WIA entry and set its startup to Manual.

In all likeliehood you are using TWAIN anyway with the scanner.

 

Thanks. Any thoughts on the AV issue?

 

Pick one AV application as an actively scanning AV utility.
Uninstall any others that cannot be set to a passive, on-demand, AV scanning role.

Check the web sites and forums if they exist for the AV applications you wish to remove. There often are special utilities required to get a clean uninstallation.

 

It's weird because prior to the original crashes, EZ AV was never a problem running as a resident scanner and e-mail scanner. I really do like the product (and have paid for it). I suppose that I can just leave the mail scanner disabled until I figure something out. It's not perfect but, at the moment, it may be the only option. I'll explore the possibility that the uninstall of EZ (or CA AV as it's now called) isn't absolutely clean. It still seems to me that that there must be some subtle damage to XP for the AV Scanner to cause any problems when none existed previously.

 

I agree.
Perhaps a completely clean uninstall/reinstall sequence will cure the issue.

Remember too that your email will be scanned again if you try to open or save an attachment (or at least it should) even in the absence of an active email scanner.

 

I'll fool around with it. Bill, I can't thank you enough for almost instantly solving a large part of the puzzle with the Aquisition Service. That was a great catch. I'll let you know how this all progresses. I still may have to reload the OS but at least there's some glimmer of hope that I can avoid that for now. Do you think that deleting those orphaned HP Scan registry keys is advisable or should I just leave them alone?

 

Leave them be, as finding them may be quite a chore.
I would not give up completely with the scanner. At least searching the HP site for newer drivers would be worth a try.

Best wishes, and keep as informed as to your progress.

 

Actually the scanner made a very painful power off sound as the PC was crashing so it's probably done for. It was pretty old any way. Thanls for everything Bill.

 

Still having problems Bill. With the Image Acquisition Service not running, and my AV mail scanner turned off, XP shutdown or restarted normally. I got a new Canon scanner and after installing the drivers and toolbox program the PC threw the same old BSOD on restart and then did so on a subsequent shutdown. Once again !analyze -v of the minidump files showed exactly the same content as the one that I originally posted. When I disconnected the scanner and uninstalled the driver and toolbox, XP, once again returned to normal shutdowns. I've got a sinking feeling that the OS may have been damaged in too many subtle ways for it to to be 100% stable. Do you have any other thoughts on the problem? Thanks.

 

Start, Run, Devmgmt.msc

Expand the USB Controller section

Write down the USB Controller details. I am hoping it indicates the USB chipset manufacturer.

Reply back with the information.

 

There are 4 Intel 82801EB USB Universal Host Controllers, 1 Standard to Enhanced PCI to USB Controller and 5 USB Root Hubs all described as "working properly "

The RAID Controller is an Intel 82801ER SATA RAID Controller (2 Seagate Alpine 160MB drives x2 RAID 0 striped) and is, along with everything listed under systems devices "working properly "

One disconcerting note was that even after dumping the scanner install last night and returning the PC to its prior "normal" state, it threw the same BSOD on shutdown this morning.

 

Things have deteriorated a bit. The PC will shut down cleanly at times but will throw the BSOD during a shutdown at other times. When it shuts down normally, the process is fast and clean. When it's going to crash, the "saving your settings" screen begins to linger and then the blue screen come up requiring a quick power down via the power button. One other problem that came up after the original mess is that when I close Outlook 2003 it will, much of time still be running as a task. If I open it again, another instance of outlook.exe will appear in the task list. I use Knockout to kill it but it seems to be another indication that some damage was done to Outlook or MS Office itself. One thing about the USB issue is that all of the ports appear to connect and operate normally. The "new scanner caused" BSOD on shutdown may have been a result of the software install. If I try to uninstall my AV program.the PC will also throw the BSOD as it's restarting. It's all very hard to pin down.

 

This does not indicate a problem.

Some resources to help play detective:

http://support.microsoft.com/defaul...308029t.com/default.aspx?scid=kb;en-us;304040
http://www.aumha.org/win5/a/shtdwnxp.htm
http://www.theeldergeek.com/shutdown_issues_in_xp.htm
http://support.microsoft.com/default.aspx?scid=kb;en-us;305788
http://support.microsoft.com/default.aspx?scid=kb;en-us;307274
http://support.microsoft.com/default.aspx?scid=kb;en-us;314101

 

I've looked at most of those sites and really can't find examples that are comparable to what I have going. With a new MB, RAM, CPU and power supply in the case, I still suspect that the OS took hits in a number of areas and is probably significantly compromised. It may almost be easier to just blow the OS out and reload everything. I've already saved anything important to my external HD. The only remaining decision is whether I want to keep the RAID 0 striping of the two Seagate 160s to 320 GB as they were originally configured or break the RAID array and go with the 160s as separate drives. ( I will run the Seagate diagnostics on the drives before doing anything, of course).