Stop:Blue death 0x0000007F

I have now had two major crashes with 'unexpected_kernel_mode_trap'. I tried 'safe mode' (no go), tried repair console (no go). Black screen finally tells me that windows could not start because \winnt\system32\config\system.sav ABSENT OR CORRUPT. After I restored the win2k OS, and reinstalled my programs, I made a copy of this file on another drive. Did me no good the next day when it crashed again, same error messages, same procedure to restore, etc. Anything else I could have or should have done?
Restoring win2k with all of the updates,+ ditto for ms office XP and all of my other programs has taken three days out of my bridge playing! Punchline: All this apparently after reinstalling MSW2004 and then (this is it, I think!) Google Desktop Search. Without this last my Event log is clean, with Google it all those red 'X'. What should I know to prevent a recurrence?

 

Sometimes you can LastKnownGood your way out of that. Or made copies from C:\WINDOWS\repair to get the machine back up without CD work.

The real question is whats going on with your memory, registry and disk that this phenomenon occured. We don't have enough information to know the vector yet. Did you get a MEMORY.DMP? run it through the dump tool in my sig. Otherwise we'd need to play 20 questions to try to figure out whats going on.

 

Last known ng. No memory dump on search, although quick mention of it. Working fine now, as after restoring Google Desktop Search twice with disatrous results, I must deduce that Win2K users ought to approach this other wise time saving program with much trpidation. Also, I could NOT restore registry, backed up and/or exported as file system.stat. Thanks. Been a learning experience. First safe mode didnt let me work with registry, second try ended in system won't start.
Simon

 

Inbound mail from skleeger: (keepin it on the board)
Couldnt find the memory.dmp, but found a drwtson32.log and .dmp Simon. (log) Let me work on it. Thanks.
PS, original problem with NSW just returned, so maybe not Google Desktop after all. New Dr. Watson log. Will get back to you tomorrow. Long Day and night before.

---------------------------------------------------------------------

I was going to be fairly suprised if you didnt report back that it was still happening. User mode apps dont cause bluescreens, only drivers and hardware. This is a feature of NT/XP that a badapp cannot hose your machine, and a good reason to know your kernel drivers.

We don't care nuttin about no DrWatson logs. We need the memory.dmp, or the info from the bluescreen itself.

Let me use my crystal ball of debuggering and predict you had a 7f 0x00000008.
There are two common causes of a double fault:
A kernel stack overflow
A hardware problem.

Based on the whole registry thing, you probably have something seriously wrong with your IO subsystem. Disks, Memory, Motherboard, or CPU, in that order of likelyhood. We need more data to know.

 

bugcheck 0x0000007f of today DUMPDATA

Opened log file 'c:\debuglog.txt'
Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols

Microsoft (R) Windows Debugger Version 6.3.0017.0
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\WINNT\Minidump\Mini122004-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: C:\WINNT;C:\WINNT\system32;C:\WINNT\system32\drivers
Windows 2000 Kernel Version 2195 (Service Pack 4) UP Free x86 compatible
Kernel base = 0x80400000 PsLoadedModuleList = 0x80480780
Debug session time: Mon Dec 20 19:29:30 2004
System Uptime: not available
Loading Kernel Symbols
.................................................................................................
Loading unloaded module list
...............
Loading User Symbols
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 7F, {d, 0, 0, 0}

Probably caused by : ntoskrnl.exe ( nt!KiSystemFatalException+e )

Followup: MachineOwner
---------

kd> !analyze -v;r;kv;lmtn;.logclose;q
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

UNEXPECTED_KERNEL_MODE_TRAP (7f)
This means a trap occurred in kernel mode, and it's a trap of a kind
that the kernel isn't allowed to have/catch (bound trap) or that
is always instant death (double fault). The first number in the
bugcheck params is the number of the trap (8 = double fault, etc)
Consult an Intel x86 family manual to learn more about what these
traps are. Here is a *portion* of those codes:
If kv shows a taskGate
use .tss on the part before the colon, then kv.
Else if kv shows a trapframe
use .trap on that value
Else
.trap on the appropriate frame will show where the trap was taken
(on x86, this will be the ebp that goes with the procedure KiTrap)
Endif
kb will then show the corrected stack.
Arguments:
Arg1: 0000000d, EXCEPTION_GP_FAULT
Arg2: 00000000
Arg3: 00000000
Arg4: 00000000

Debugging Details:
------------------


BUGCHECK_STR: 0x7f_d

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: DRIVER_FAULT

LAST_CONTROL_TRANSFER: from 8042ad05 to 8046744a

STACK_TEXT:
bbaeec6c 8042ad05 8047fb10 81873618 00000016 nt!KiSystemFatalException+0xe
bbaeed04 80523ba1 8144fc01 00000000 bbaeed34 nt!KeDelayExecutionThread+0x57
bbaeed54 80463f64 00000000 0196f8f0 00000000 nt!NtDelayExecution+0x7f
bbaeed54 77f82831 00000000 0196f8f0 00000000 nt!KiSystemService+0xc4
WARNING: Frame IP not in any known module. Following frames may be wrong.
0196f8d8 00000000 00000000 00000000 00000000 0x77f82831


FOLLOWUP_IP:
nt!KiSystemFatalException+e
8046744a c3 ret

SYMBOL_STACK_INDEX: 0

FOLLOWUP_NAME: MachineOwner

SYMBOL_NAME: nt!KiSystemFatalException+e

MODULE_NAME: nt

IMAGE_NAME: ntoskrnl.exe

DEBUG_FLR_IMAGE_TIMESTAMP: 41773335

STACK_COMMAND: kb

BUCKET_ID: 0x7f_d_nt!KiSystemFatalException+e

Followup: MachineOwner
---------

eax=ffdff13c ebx=0000007f ecx=00000000 edx=bbaeed34 esi=81177020 edi=bbaeed64
eip=8046744a esp=bbaeec58 ebp=bbaeec6c iopl=0 nv up di ng nz na po nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00000086
nt!KiSystemFatalException+0xe:
8046744a c3 ret
ChildEBP RetAddr Args to Child
bbaeec6c 8042ad05 8047fb10 81873618 00000016 nt!KiSystemFatalException+0xe (FPO: [0,0] TrapFrame @ bbaeec6c)
bbaeed04 80523ba1 8144fc01 00000000 bbaeed34 nt!KeDelayExecutionThread+0x57 (FPO: [Non-Fpo])
bbaeed54 80463f64 00000000 0196f8f0 00000000 nt!NtDelayExecution+0x7f (FPO: [Non-Fpo])
bbaeed54 77f82831 00000000 0196f8f0 00000000 nt!KiSystemService+0xc4 (FPO: [0,0] TrapFrame @ bbaeed64)
WARNING: Frame IP not in any known module. Following frames may be wrong.
0196f8d8 00000000 00000000 00000000 00000000 0x77f82831
start end module name
80062000 80072520 hal halacpi.dll Thu Mar 20 21:04:40 2003 (3E7A7338)
80400000 8059a800 nt ntoskrnl.exe Wed Oct 20 23:55:33 2004 (41773335)
a0000000 a018e860 win32k win32k.sys Mon Aug 09 23:51:25 2004 (4118463D)
bb764000 bb777ac0 ipsec ipsec.sys Mon Apr 21 14:19:40 2003 (3EA4363C)
bb778000 bb78ac20 SYMEVENT SYMEVENT.SYS Wed Aug 06 21:32:39 2003 (3F31AC37)
bb8bb000 bb8c3780 NPDRIVER NPDRIVER.SYS Mon Nov 24 13:40:13 2003 (3FC2508D)
bbf06000 bbf41bc0 srv srv.sys Tue Apr 29 19:05:07 2003 (3EAF0523)
bc08a000 bc098fe0 Cdfs Cdfs.SYS Tue Apr 15 23:58:53 2003 (3E9CD4FD)
bc172000 bc183f80 wdmaud wdmaud.sys Wed Apr 16 00:23:02 2003 (3E9CDAA6)
bc1ac000 bc25f000 css_dvp css-dvp.sys Wed Oct 06 23:55:18 2004 (4164BE26)
bc34f000 bc36c4a0 afd afd.sys Wed Apr 30 04:45:29 2003 (3EAF8D29)
bc706000 bca348e0 nv4_disp nv4_disp.dll Tue Jan 15 18:54:43 2002 (3C44C143)
bea45000 bea5a180 dump_atapi dump_atapi.sys Tue Apr 01 13:08:25 2003 (3E89D599)
bea83000 beae6e40 mrxsmb mrxsmb.sys Mon Nov 01 00:24:54 2004 (4185C8A6)
beaf9000 beb22760 rdbss rdbss.sys Fri Oct 15 17:03:40 2004 (41703B2C)
beb23000 beb65dc0 vsdatant vsdatant.sys Sun Nov 28 05:24:51 2004 (41A9A773)
beb66000 beb8de00 netbt netbt.sys Wed Jul 16 15:44:26 2003 (3F15AB1A)
beb8e000 bebdf060 tcpip tcpip.sys Tue Apr 29 19:05:31 2003 (3EAF053B)
bec28000 bec9e1e0 VETMONNT VETMONNT.SYS Wed Nov 17 19:22:13 2004 (419BEB35)
bec9f000 becb82e0 VETFDDNT VETFDDNT.SYS Wed Nov 17 19:22:14 2004 (419BEB36)
bfcb9000 bfce33a0 update update.sys Wed Apr 16 00:22:01 2003 (3E9CDA69)
bfcec000 bfceede0 ws2ifsl ws2ifsl.sys Sat Sep 25 14:41:13 1999 (37ED1749)
bfd0c000 bfd22ba0 ndiswan ndiswan.sys Tue Apr 29 19:05:01 2003 (3EAF051D)
bfd23000 bfd42d00 KS KS.SYS Wed Dec 04 12:09:38 2002 (3DEE36D2)
bfd43000 bfd671e0 portcls portcls.sys Wed Apr 16 00:11:22 2003 (3E9CD7EA)
bfd68000 bfd8f700 vinyl97 vinyl97.sys Mon Sep 06 04:01:53 2004 (413C1971)
bfd90000 bfe22f00 winacpci winacpci.sys Mon Sep 13 17:06:28 1999 (37DD6754)
bfe23000 bfeedd20 nv4_mini nv4_mini.sys Tue Jan 15 18:50:14 2002 (3C44C036)
bff0e000 bff23640 Mup Mup.sys Wed Jan 15 14:54:01 2003 (3E25BC59)
bff24000 bff4daa0 NDIS NDIS.sys Tue Apr 29 19:05:01 2003 (3EAF051D)
bff4e000 bff5f7c0 KSecDD KSecDD.sys Sat Sep 20 20:32:19 2003 (3F6CF193)
bff60000 bff823c0 Fastfat Fastfat.sys Wed Jan 15 14:48:39 2003 (3E25BB17)
bff83000 bff98180 atapi atapi.sys Tue Apr 01 13:08:25 2003 (3E89D599)
bff99000 bffba9c0 dmio dmio.sys Wed Jan 15 14:47:04 2003 (3E25BAB8)
bffbb000 bffd7220 ftdisk ftdisk.sys Mon Mar 31 17:21:58 2003 (3E88BF86)
bffd8000 bffffc20 ACPI ACPI.sys Wed Jan 15 14:44:22 2003 (3E25BA16)
eb400000 eb40e6a0 pci pci.sys Wed Jan 15 14:44:07 2003 (3E25BA07)
eb410000 eb41b680 isapnp isapnp.sys Wed Jan 15 14:43:47 2003 (3E25B9F3)
eb420000 eb428700 CLASSPNP CLASSPNP.SYS Wed Jan 15 14:42:51 2003 (3E25B9BB)
eb450000 eb45c4c0 VIDEOPRT VIDEOPRT.SYS Wed Jan 15 14:47:20 2003 (3E25BAC8)
eb460000 eb46f400 serial serial.sys Wed Apr 16 00:19:39 2003 (3E9CD9DB)
eb470000 eb47b680 i8042prt i8042prt.sys Wed Apr 16 00:00:59 2003 (3E9CD57B)
eb480000 eb48ca80 rasl2tp rasl2tp.sys Tue Apr 29 19:05:06 2003 (3EAF0522)
eb490000 eb49bc40 raspptp raspptp.sys Wed May 14 19:47:00 2003 (3EC2D574)
eb4a0000 eb4aea20 parallel parallel.sys Wed Jan 15 14:47:14 2003 (3E25BAC2)
eb4e0000 eb4e9be0 usbhub usbhub.sys Tue Mar 18 18:30:41 2003 (3E77AC21)
eb4f0000 eb4f9ce0 NDProxy NDProxy.SYS Thu Sep 30 19:25:35 1999 (37F3F16F)
eb500000 eb508fa0 Npfs Npfs.SYS Sat Oct 09 19:58:07 1999 (37FFD68F)
eb510000 eb518680 msgpc msgpc.sys Wed Jan 15 14:54:25 2003 (3E25BC71)
eb520000 eb5281a0 netbios netbios.sys Tue Oct 12 15:34:19 1999 (38038D3B)
eb540000 eb54b8c0 sysaudio sysaudio.sys Wed Apr 16 00:21:44 2003 (3E9CDA58)
eb560000 eb56c000 GRTdiMon GRTdiMon.sys Wed Nov 10 08:43:02 2004 (41921AE6)
eb600000 eb608240 Fips Fips.SYS Tue May 09 11:28:29 2000 (39182E9D)
eb680000 eb685520 PCIIDEX PCIIDEX.SYS Tue Feb 25 13:31:08 2003 (3E5BB66C)
eb688000 eb68f4c0 MountMgr MountMgr.sys Tue Feb 10 14:47:53 2004 (40293569)
eb690000 eb697720 disk disk.sys Wed Jan 15 14:43:05 2003 (3E25B9C9)
eb698000 eb6a0000 GRFILTER GRFILTER.sys Sat Mar 27 17:50:25 2004 (40660531)
eb6b8000 eb6bf0e0 Modem Modem.SYS Wed Jan 15 14:43:48 2003 (3E25B9F4)
eb6c8000 eb6ce980 dlh5x dlh5x.sys Sun Oct 20 08:26:12 2002 (3DB2A0E4)
eb6d8000 eb6dec40 cdrom cdrom.sys Wed Jan 15 14:43:04 2003 (3E25B9C8)
eb6e0000 eb6e7f40 uhcd uhcd.sys Wed Jan 15 14:45:50 2003 (3E25BA6E)
eb6f8000 eb6fcfc0 USBD USBD.SYS Wed Jan 22 12:05:33 2003 (3E2ECF5D)
eb720000 eb721000 fdc fdc.sys unavailable (00000000)
eb738000 eb73e100 parport parport.sys Wed Jan 15 14:47:13 2003 (3E25BAC1)
eb748000 eb74d400 mouclass mouclass.sys Thu Feb 20 11:37:45 2003 (3E550459)
eb758000 eb75dec0 kbdclass kbdclass.sys Thu Feb 20 11:37:30 2003 (3E55044A)
eb778000 eb77c400 ptilink ptilink.sys Wed Jan 15 14:47:15 2003 (3E25BAC3)
eb788000 eb78c0e0 raspti raspti.sys Fri Oct 08 16:45:10 1999 (37FE57D6)
eb7a0000 eb7a4a60 flpydisk flpydisk.sys Wed Jan 15 14:42:52 2003 (3E25B9BC)
eb7b0000 eb7b5460 usbprint usbprint.sys Wed Jan 15 14:44:07 2003 (3E25BA07)
eb7d0000 eb7d4f20 VET_FILT VET-FILT.SYS Wed Nov 17 19:22:12 2004 (419BEB34)
eb7e8000 eb7ed240 Msfs Msfs.SYS Tue Oct 26 19:21:32 1999 (3816377C)
eb808000 eb80fd00 wanarp wanarp.sys Fri Aug 16 08:25:01 2002 (3D5CEF1D)
eb810000 eb812a20 BOOTVID BOOTVID.dll Wed Nov 03 20:24:33 1999 (3820E051)
eb814000 eb816d00 PartMgr PartMgr.sys Wed Jan 15 14:43:07 2003 (3E25B9CB)
eb880000 eb883640 serenum serenum.sys Wed Jan 15 14:47:01 2003 (3E25BAB5)
eb88c000 eb88e540 gameenum gameenum.sys Wed Jan 15 14:45:32 2003 (3E25BA5C)
eb894000 eb8962e0 ndistapi ndistapi.sys Wed Jan 15 14:54:15 2003 (3E25BC67)
eb8a4000 eb8a7e60 TDI TDI.SYS Wed Jan 15 14:56:26 2003 (3E25BCEA)
eb8c8000 eb8cb9e0 VET_REC VET-REC.SYS Wed Nov 17 19:22:12 2004 (419BEB34)
eb8e8000 eb8eb580 vga vga.sys Sat Sep 25 14:37:40 1999 (37ED1674)
eb900000 eb901d20 Diskperf Diskperf.sys Wed Feb 12 16:34:38 2003 (3E4ABDEE)
eb902000 eb903b80 dmload dmload.sys Wed Jan 15 14:47:06 2003 (3E25BABA)
eb90c000 eb90db00 NTIDrvr NTIDrvr.sys Wed Jan 15 12:33:02 2003 (3E259B4E)
eb91c000 eb91dca0 Fs_Rec Fs_Rec.SYS Wed Jan 15 14:53:30 2003 (3E25BC3A)
eb922000 eb923e40 rasacd rasacd.sys Sat Sep 25 14:41:23 1999 (37ED1753)
eb966000 eb967860 ParVdm ParVdm.SYS Mon Sep 27 23:28:16 1999 (37F035D0)
eb9c8000 eb9c8f80 WMILIB WMILIB.SYS Sat Sep 25 14:36:47 1999 (37ED163F)
eb9c9000 eb9c9b00 pciide pciide.sys Wed Jan 15 14:43:03 2003 (3E25B9C7)
eb9ca000 eb9ca4c0 nvDual nvDual.sys Tue Jan 15 18:54:50 2002 (3C44C14A)
eb9ec000 eb9eca00 msmpu401 msmpu401.sys Sat Sep 25 14:35:15 1999 (37ED15E3)
eb9ee000 eb9eea40 audstub audstub.sys Sat Sep 25 14:35:33 1999 (37ED15F5)
eb9f8000 eb9f9000 swenum swenum.sys Wed Dec 04 12:10:07 2002 (3DEE36EF)
eba06000 eba069e0 Null Null.SYS Sat Sep 25 14:34:58 1999 (37ED15D2)
eba08000 eba08ee0 Beep Beep.SYS Wed Oct 20 18:18:59 1999 (380E3FD3)
eba0b000 eba0bf80 mnmdd mnmdd.SYS Sat Sep 25 14:37:40 1999 (37ED1674)
eba38000 eba38f80 dump_WMILIB dump_WMILIB.SYS Sat Sep 25 14:36:47 1999 (37ED163F)
ebac1000 ebac17a0 symlcbrd symlcbrd.sys Wed Oct 16 02:50:27 2002 (3DAD0C33)

Unloaded modules:
b8d33000 b8d58000 kmixer.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
bb158000 bb17d000 kmixer.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
bb2e5000 bb30a000 kmixer.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
bb3aa000 bb3cf000 kmixer.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
bb3aa000 bb3cf000 kmixer.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
bb3aa000 bb3cf000 kmixer.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
bb4bf000 bb4e4000 kmixer.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
bbee1000 bbf06000 kmixer.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
bc2e7000 bc2f4000 DMusic.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
bc307000 bc315000 swmidi.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
bca20000 bca35000 VGA.dll
Timestamp: unavailable (00000000)
Checksum: 00000000
bc706000 bca35000 nv4_disp.dll
Timestamp: unavailable (00000000)
Checksum: 00000000
eb530000 eb539000 redbook.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
eb7c0000 eb7c5000 Cdaudio.SYS
Timestamp: unavailable (00000000)
Checksum: 00000000
eb8c0000 eb8c3000 Sfloppy.SYS
Timestamp: unavailable (00000000)
Checksum: 00000000
Closing open log file c:\debuglog.txt

 

debuglog for 0x000000f7 in preceding

I have also done a hardware troubleshooter analysis and disks, memory, etc. all good. Any requests, corrections, analysis would be appreciated. I have been out of it too long to make much of it. All the manuals I have tell me how to get out of it, and getting out of this last one was a snap. But I don't know what caused it. I admit to having installed a program recently, and I did clean up some items in the registry. I restored google desktop and I think it's the greatest thing since crib-sheets and cotton candy. I have the Norton antivirus uninstalled from Norton System Works 2004 and am using the C-A eztrust as part of Zone Alarm. The program I installed recently was provided by my ISP (Cox.net) and I have since removed it (after the crash).

Generally speaking, I have led a good clean life. Smoke too much, but drink hardly atall, so why me? Thanks.

 

ok, once more through the debugger, with the same dump as above, hit the advanced button on the tool and change this section
Old

Code:

 -logo c:\debuglog.txt -c  "!analyze -v;r;kv;lmtn;.logclose;q" 

New

Code:

 -logo c:\debuglog.txt -c  ".trap bbaeec6c;r;kv;.trap bbaeed64;.reload;r;kv.logclose;q" 

 

blue death new dump

Is this better?
Opened log file 'c:\debuglog.txt'
Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols

Microsoft (R) Windows Debugger Version 6.3.0017.0
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\WINNT\Minidump\Mini122104-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: C:\WINNT;C:\WINNT\system32;C:\WINNT\system32\drivers
Windows 2000 Kernel Version 2195 (Service Pack 4) UP Free x86 compatible
Kernel base = 0x80400000 PsLoadedModuleList = 0x80480780
Debug session time: Tue Dec 21 05:31:31 2004
System Uptime: not available
Loading Kernel Symbols
..............................................................................................
Loading unloaded module list
.........
Loading User Symbols
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 7F, {d, 0, 0, 0}

*** ERROR: Symbol file could not be found. Defaulted to export symbols for SYMEVENT.SYS -
Probably caused by : SYMEVENT.SYS ( SYMEVENT!EventObjectCreate+1561 )

Followup: MachineOwner
---------

kd> !analyze -v;r;kv;lmtn;.logclose;q
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

UNEXPECTED_KERNEL_MODE_TRAP (7f)
This means a trap occurred in kernel mode, and it's a trap of a kind
that the kernel isn't allowed to have/catch (bound trap) or that
is always instant death (double fault). The first number in the
bugcheck params is the number of the trap (8 = double fault, etc)
Consult an Intel x86 family manual to learn more about what these
traps are. Here is a *portion* of those codes:
If kv shows a taskGate
use .tss on the part before the colon, then kv.
Else if kv shows a trapframe
use .trap on that value
Else
.trap on the appropriate frame will show where the trap was taken
(on x86, this will be the ebp that goes with the procedure KiTrap)
Endif
kb will then show the corrected stack.
Arguments:
Arg1: 0000000d, EXCEPTION_GP_FAULT
Arg2: 00000000
Arg3: 00000000
Arg4: 00000000

Debugging Details:
------------------


BUGCHECK_STR: 0x7f_d

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: DRIVER_FAULT

LAST_CONTROL_TRANSFER: from 80463ead to 8046744a

STACK_TEXT:
bbf02690 80463ead 804060d8 ffffffff bbf026b4 nt!KiSystemFatalException+0xe
bbf027a4 bbb09461 00000038 00000000 815693f8 nt!KiSystemService+0xd
WARNING: Stack unwind information not available. Following frames may be wrong.
e15a7708 00000000 00000000 00000000 00000000 SYMEVENT!EventObjectCreate+0x1561


FOLLOWUP_IP:
SYMEVENT!EventObjectCreate+1561
bbb09461 5f pop edi

SYMBOL_STACK_INDEX: 2

FOLLOWUP_NAME: MachineOwner

SYMBOL_NAME: SYMEVENT!EventObjectCreate+1561

MODULE_NAME: SYMEVENT

IMAGE_NAME: SYMEVENT.SYS

DEBUG_FLR_IMAGE_TIMESTAMP: 3f31ac37

STACK_COMMAND: kb

BUCKET_ID: 0x7f_d_SYMEVENT!EventObjectCreate+1561

Followup: MachineOwner
---------

eax=ffdff13c ebx=0000007f ecx=00000000 edx=bbf027d4 esi=816baa28 edi=81480a08
eip=8046744a esp=bbf0267c ebp=bbf02690 iopl=0 nv up di ng nz na po nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00000086
nt!KiSystemFatalException+0xe:
8046744a c3 ret
ChildEBP RetAddr Args to Child
bbf02690 80463ead 804060d8 ffffffff bbf026b4 nt!KiSystemFatalException+0xe (FPO: [0,0] TrapFrame @ bbf02690)
bbf027a4 bbb09461 00000038 00000000 815693f8 nt!KiSystemService+0xd (FPO: [0,0] TrapFrame @ bbf027a4)
WARNING: Stack unwind information not available. Following frames may be wrong.
e15a7708 00000000 00000000 00000000 00000000 SYMEVENT!EventObjectCreate+0x1561
start end module name
80062000 80072520 hal halacpi.dll Thu Mar 20 21:04:40 2003 (3E7A7338)
80400000 8059a800 nt ntoskrnl.exe Wed Oct 20 23:55:33 2004 (41773335)
a0000000 a018e860 win32k win32k.sys Mon Aug 09 23:51:25 2004 (4118463D)
bbae7000 bbafaac0 ipsec ipsec.sys Mon Apr 21 14:19:40 2003 (3EA4363C)
bbafb000 bbb0dc20 SYMEVENT SYMEVENT.SYS Wed Aug 06 21:32:39 2003 (3F31AC37)
bbf94000 bbf9c780 NPDRIVER NPDRIVER.SYS Mon Nov 24 13:40:13 2003 (3FC2508D)
bc151000 bc15ffe0 Cdfs Cdfs.SYS Tue Apr 15 23:58:53 2003 (3E9CD4FD)
bc1e9000 bc1faf80 wdmaud wdmaud.sys Wed Apr 16 00:23:02 2003 (3E9CDAA6)
bc1fb000 bc236bc0 srv srv.sys Tue Apr 29 19:05:07 2003 (3EAF0523)
bc34f000 bc36c4a0 afd afd.sys Wed Apr 30 04:45:29 2003 (3EAF8D29)
bc3cd000 bc3d5240 Fips Fips.SYS Tue May 09 11:28:29 2000 (39182E9D)
bc706000 bca348e0 nv4_disp nv4_disp.dll Tue Jan 15 18:54:43 2002 (3C44C143)
bea45000 bea5a180 dump_atapi dump_atapi.sys Tue Apr 01 13:08:25 2003 (3E89D599)
bea83000 beae6e40 mrxsmb mrxsmb.sys Mon Nov 01 00:24:54 2004 (4185C8A6)
beaf9000 beb22760 rdbss rdbss.sys Fri Oct 15 17:03:40 2004 (41703B2C)
beb23000 beb65dc0 vsdatant vsdatant.sys Sun Nov 28 05:24:51 2004 (41A9A773)
beb66000 beb8de00 netbt netbt.sys Wed Jul 16 15:44:26 2003 (3F15AB1A)
beb8e000 bebdf060 tcpip tcpip.sys Tue Apr 29 19:05:31 2003 (3EAF053B)
bec28000 bec9e1e0 VETMONNT VETMONNT.SYS Wed Nov 17 19:22:13 2004 (419BEB35)
bec9f000 becb82e0 VETFDDNT VETFDDNT.SYS Wed Nov 17 19:22:14 2004 (419BEB36)
bfcb9000 bfce33a0 update update.sys Wed Apr 16 00:22:01 2003 (3E9CDA69)
bfd0c000 bfd22ba0 ndiswan ndiswan.sys Tue Apr 29 19:05:01 2003 (3EAF051D)
bfd23000 bfd42d00 KS KS.SYS Wed Dec 04 12:09:38 2002 (3DEE36D2)
bfd43000 bfd671e0 portcls portcls.sys Wed Apr 16 00:11:22 2003 (3E9CD7EA)
bfd68000 bfd8f700 vinyl97 vinyl97.sys Mon Sep 06 04:01:53 2004 (413C1971)
bfd90000 bfe22f00 winacpci winacpci.sys Mon Sep 13 17:06:28 1999 (37DD6754)
bfe23000 bfeedd20 nv4_mini nv4_mini.sys Tue Jan 15 18:50:14 2002 (3C44C036)
bff0e000 bff23640 Mup Mup.sys Wed Jan 15 14:54:01 2003 (3E25BC59)
bff24000 bff4daa0 NDIS NDIS.sys Tue Apr 29 19:05:01 2003 (3EAF051D)
bff4e000 bff5f7c0 KSecDD KSecDD.sys Sat Sep 20 20:32:19 2003 (3F6CF193)
bff60000 bff823c0 Fastfat Fastfat.sys Wed Jan 15 14:48:39 2003 (3E25BB17)
bff83000 bff98180 atapi atapi.sys Tue Apr 01 13:08:25 2003 (3E89D599)
bff99000 bffba9c0 dmio dmio.sys Wed Jan 15 14:47:04 2003 (3E25BAB8)
bffbb000 bffd7220 ftdisk ftdisk.sys Mon Mar 31 17:21:58 2003 (3E88BF86)
bffd8000 bffffc20 ACPI ACPI.sys Wed Jan 15 14:44:22 2003 (3E25BA16)
eb400000 eb40e6a0 pci pci.sys Wed Jan 15 14:44:07 2003 (3E25BA07)
eb410000 eb41b680 isapnp isapnp.sys Wed Jan 15 14:43:47 2003 (3E25B9F3)
eb420000 eb428700 CLASSPNP CLASSPNP.SYS Wed Jan 15 14:42:51 2003 (3E25B9BB)
eb450000 eb45c4c0 VIDEOPRT VIDEOPRT.SYS Wed Jan 15 14:47:20 2003 (3E25BAC8)
eb460000 eb46f400 serial serial.sys Wed Apr 16 00:19:39 2003 (3E9CD9DB)
eb470000 eb47b680 i8042prt i8042prt.sys Wed Apr 16 00:00:59 2003 (3E9CD57B)
eb480000 eb48ca80 rasl2tp rasl2tp.sys Tue Apr 29 19:05:06 2003 (3EAF0522)
eb490000 eb49bc40 raspptp raspptp.sys Wed May 14 19:47:00 2003 (3EC2D574)
eb4a0000 eb4aea20 parallel parallel.sys Wed Jan 15 14:47:14 2003 (3E25BAC2)
eb4b0000 eb4bb8c0 sysaudio sysaudio.sys Wed Apr 16 00:21:44 2003 (3E9CDA58)
eb4e0000 eb4e9be0 usbhub usbhub.sys Tue Mar 18 18:30:41 2003 (3E77AC21)
eb4f0000 eb4f9ce0 NDProxy NDProxy.SYS Thu Sep 30 19:25:35 1999 (37F3F16F)
eb500000 eb508fa0 Npfs Npfs.SYS Sat Oct 09 19:58:07 1999 (37FFD68F)
eb510000 eb518680 msgpc msgpc.sys Wed Jan 15 14:54:25 2003 (3E25BC71)
eb520000 eb5281a0 netbios netbios.sys Tue Oct 12 15:34:19 1999 (38038D3B)
eb680000 eb685520 PCIIDEX PCIIDEX.SYS Tue Feb 25 13:31:08 2003 (3E5BB66C)
eb688000 eb68f4c0 MountMgr MountMgr.sys Tue Feb 10 14:47:53 2004 (40293569)
eb690000 eb697720 disk disk.sys Wed Jan 15 14:43:05 2003 (3E25B9C9)
eb6b0000 eb6b70e0 Modem Modem.SYS Wed Jan 15 14:43:48 2003 (3E25B9F4)
eb6c0000 eb6c6980 dlh5x dlh5x.sys Sun Oct 20 08:26:12 2002 (3DB2A0E4)
eb6d0000 eb6d6c40 cdrom cdrom.sys Wed Jan 15 14:43:04 2003 (3E25B9C8)
eb6d8000 eb6dff40 uhcd uhcd.sys Wed Jan 15 14:45:50 2003 (3E25BA6E)
eb6f0000 eb6f4fc0 USBD USBD.SYS Wed Jan 22 12:05:33 2003 (3E2ECF5D)
eb718000 eb719000 fdc fdc.sys unavailable (00000000)
eb730000 eb736100 parport parport.sys Wed Jan 15 14:47:13 2003 (3E25BAC1)
eb740000 eb745400 mouclass mouclass.sys Thu Feb 20 11:37:45 2003 (3E550459)
eb750000 eb755ec0 kbdclass kbdclass.sys Thu Feb 20 11:37:30 2003 (3E55044A)
eb770000 eb774400 ptilink ptilink.sys Wed Jan 15 14:47:15 2003 (3E25BAC3)
eb780000 eb7840e0 raspti raspti.sys Fri Oct 08 16:45:10 1999 (37FE57D6)
eb798000 eb79ca60 flpydisk flpydisk.sys Wed Jan 15 14:42:52 2003 (3E25B9BC)
eb7a8000 eb7ad460 usbprint usbprint.sys Wed Jan 15 14:44:07 2003 (3E25BA07)
eb7c8000 eb7ccf20 VET_FILT VET-FILT.SYS Wed Nov 17 19:22:12 2004 (419BEB34)
eb7e0000 eb7e5240 Msfs Msfs.SYS Tue Oct 26 19:21:32 1999 (3816377C)
eb800000 eb807d00 wanarp wanarp.sys Fri Aug 16 08:25:01 2002 (3D5CEF1D)
eb810000 eb812a20 BOOTVID BOOTVID.dll Wed Nov 03 20:24:33 1999 (3820E051)
eb814000 eb816d00 PartMgr PartMgr.sys Wed Jan 15 14:43:07 2003 (3E25B9CB)
eb880000 eb883640 serenum serenum.sys Wed Jan 15 14:47:01 2003 (3E25BAB5)
eb88c000 eb88e540 gameenum gameenum.sys Wed Jan 15 14:45:32 2003 (3E25BA5C)
eb894000 eb8962e0 ndistapi ndistapi.sys Wed Jan 15 14:54:15 2003 (3E25BC67)
eb8a4000 eb8a7e60 TDI TDI.SYS Wed Jan 15 14:56:26 2003 (3E25BCEA)
eb8cc000 eb8cf9e0 VET_REC VET-REC.SYS Wed Nov 17 19:22:12 2004 (419BEB34)
eb8e4000 eb8e6de0 ws2ifsl ws2ifsl.sys Sat Sep 25 14:41:13 1999 (37ED1749)
eb8ec000 eb8ef580 vga vga.sys Sat Sep 25 14:37:40 1999 (37ED1674)
eb900000 eb901d20 Diskperf Diskperf.sys Wed Feb 12 16:34:38 2003 (3E4ABDEE)
eb902000 eb903b80 dmload dmload.sys Wed Jan 15 14:47:06 2003 (3E25BABA)
eb90c000 eb90db00 NTIDrvr NTIDrvr.sys Wed Jan 15 12:33:02 2003 (3E259B4E)
eb91a000 eb91bca0 Fs_Rec Fs_Rec.SYS Wed Jan 15 14:53:30 2003 (3E25BC3A)
eb920000 eb921e40 rasacd rasacd.sys Sat Sep 25 14:41:23 1999 (37ED1753)
eb962000 eb963860 ParVdm ParVdm.SYS Mon Sep 27 23:28:16 1999 (37F035D0)
eb9c8000 eb9c8f80 WMILIB WMILIB.SYS Sat Sep 25 14:36:47 1999 (37ED163F)
eb9c9000 eb9c9b00 pciide pciide.sys Wed Jan 15 14:43:03 2003 (3E25B9C7)
eb9ca000 eb9ca4c0 nvDual nvDual.sys Tue Jan 15 18:54:50 2002 (3C44C14A)
eb9ec000 eb9eca00 msmpu401 msmpu401.sys Sat Sep 25 14:35:15 1999 (37ED15E3)
eb9ee000 eb9eea40 audstub audstub.sys Sat Sep 25 14:35:33 1999 (37ED15F5)
eb9f8000 eb9f9000 swenum swenum.sys Wed Dec 04 12:10:07 2002 (3DEE36EF)
eba06000 eba069e0 Null Null.SYS Sat Sep 25 14:34:58 1999 (37ED15D2)
eba08000 eba08ee0 Beep Beep.SYS Wed Oct 20 18:18:59 1999 (380E3FD3)
eba0b000 eba0bf80 mnmdd mnmdd.SYS Sat Sep 25 14:37:40 1999 (37ED1674)
eba38000 eba38f80 dump_WMILIB dump_WMILIB.SYS Sat Sep 25 14:36:47 1999 (37ED163F)
ebab0000 ebab07a0 symlcbrd symlcbrd.sys Wed Oct 16 02:50:27 2002 (3DAD0C33)

Unloaded modules:
bb90a000 bb92f000 kmixer.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
bc034000 bc059000 kmixer.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
bc1a1000 bc1ae000 DMusic.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
bc1b1000 bc1bf000 swmidi.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
bca20000 bca35000 VGA.dll
Timestamp: unavailable (00000000)
Checksum: 00000000
bc706000 bca35000 nv4_disp.dll
Timestamp: unavailable (00000000)
Checksum: 00000000
eb530000 eb539000 redbook.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
eb7b8000 eb7bd000 Cdaudio.SYS
Timestamp: unavailable (00000000)
Checksum: 00000000
eb8c4000 eb8c7000 Sfloppy.SYS
Timestamp: unavailable (00000000)
Checksum: 00000000
Closing open log file c:\debuglog.txt

 

Other dump

Opened log file 'c:\debuglog.txt'
Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols

Microsoft (R) Windows Debugger Version 6.3.0017.0
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\WINNT\Minidump\Mini122004-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: C:\WINNT;C:\WINNT\system32;C:\WINNT\system32\drivers
Windows 2000 Kernel Version 2195 (Service Pack 4) UP Free x86 compatible
Kernel base = 0x80400000 PsLoadedModuleList = 0x80480780
Debug session time: Mon Dec 20 19:29:30 2004
System Uptime: not available
Loading Kernel Symbols
.................................................................................................
Loading unloaded module list
...............
Loading User Symbols
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 7F, {d, 0, 0, 0}

Probably caused by : ntoskrnl.exe ( nt!KiSystemFatalException+e )

Followup: MachineOwner
---------

kd> !analyze -v;r;kv;lmtn;.logclose;q
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

UNEXPECTED_KERNEL_MODE_TRAP (7f)
This means a trap occurred in kernel mode, and it's a trap of a kind
that the kernel isn't allowed to have/catch (bound trap) or that
is always instant death (double fault). The first number in the
bugcheck params is the number of the trap (8 = double fault, etc)
Consult an Intel x86 family manual to learn more about what these
traps are. Here is a *portion* of those codes:
If kv shows a taskGate
use .tss on the part before the colon, then kv.
Else if kv shows a trapframe
use .trap on that value
Else
.trap on the appropriate frame will show where the trap was taken
(on x86, this will be the ebp that goes with the procedure KiTrap)
Endif
kb will then show the corrected stack.
Arguments:
Arg1: 0000000d, EXCEPTION_GP_FAULT
Arg2: 00000000
Arg3: 00000000
Arg4: 00000000

Debugging Details:
------------------


BUGCHECK_STR: 0x7f_d

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: DRIVER_FAULT

LAST_CONTROL_TRANSFER: from 8042ad05 to 8046744a

STACK_TEXT:
bbaeec6c 8042ad05 8047fb10 81873618 00000016 nt!KiSystemFatalException+0xe
bbaeed04 80523ba1 8144fc01 00000000 bbaeed34 nt!KeDelayExecutionThread+0x57
bbaeed54 80463f64 00000000 0196f8f0 00000000 nt!NtDelayExecution+0x7f
bbaeed54 77f82831 00000000 0196f8f0 00000000 nt!KiSystemService+0xc4
WARNING: Frame IP not in any known module. Following frames may be wrong.
0196f8d8 00000000 00000000 00000000 00000000 0x77f82831


FOLLOWUP_IP:
nt!KiSystemFatalException+e
8046744a c3 ret

SYMBOL_STACK_INDEX: 0

FOLLOWUP_NAME: MachineOwner

SYMBOL_NAME: nt!KiSystemFatalException+e

MODULE_NAME: nt

IMAGE_NAME: ntoskrnl.exe

DEBUG_FLR_IMAGE_TIMESTAMP: 41773335

STACK_COMMAND: kb

BUCKET_ID: 0x7f_d_nt!KiSystemFatalException+e

Followup: MachineOwner
---------

eax=ffdff13c ebx=0000007f ecx=00000000 edx=bbaeed34 esi=81177020 edi=bbaeed64
eip=8046744a esp=bbaeec58 ebp=bbaeec6c iopl=0 nv up di ng nz na po nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00000086
nt!KiSystemFatalException+0xe:
8046744a c3 ret
ChildEBP RetAddr Args to Child
bbaeec6c 8042ad05 8047fb10 81873618 00000016 nt!KiSystemFatalException+0xe (FPO: [0,0] TrapFrame @ bbaeec6c)
bbaeed04 80523ba1 8144fc01 00000000 bbaeed34 nt!KeDelayExecutionThread+0x57 (FPO: [Non-Fpo])
bbaeed54 80463f64 00000000 0196f8f0 00000000 nt!NtDelayExecution+0x7f (FPO: [Non-Fpo])
bbaeed54 77f82831 00000000 0196f8f0 00000000 nt!KiSystemService+0xc4 (FPO: [0,0] TrapFrame @ bbaeed64)
WARNING: Frame IP not in any known module. Following frames may be wrong.
0196f8d8 00000000 00000000 00000000 00000000 0x77f82831
start end module name
80062000 80072520 hal halacpi.dll Thu Mar 20 21:04:40 2003 (3E7A7338)
80400000 8059a800 nt ntoskrnl.exe Wed Oct 20 23:55:33 2004 (41773335)
a0000000 a018e860 win32k win32k.sys Mon Aug 09 23:51:25 2004 (4118463D)
bb764000 bb777ac0 ipsec ipsec.sys Mon Apr 21 14:19:40 2003 (3EA4363C)
bb778000 bb78ac20 SYMEVENT SYMEVENT.SYS Wed Aug 06 21:32:39 2003 (3F31AC37)
bb8bb000 bb8c3780 NPDRIVER NPDRIVER.SYS Mon Nov 24 13:40:13 2003 (3FC2508D)
bbf06000 bbf41bc0 srv srv.sys Tue Apr 29 19:05:07 2003 (3EAF0523)
bc08a000 bc098fe0 Cdfs Cdfs.SYS Tue Apr 15 23:58:53 2003 (3E9CD4FD)
bc172000 bc183f80 wdmaud wdmaud.sys Wed Apr 16 00:23:02 2003 (3E9CDAA6)
bc1ac000 bc25f000 css_dvp css-dvp.sys Wed Oct 06 23:55:18 2004 (4164BE26)
bc34f000 bc36c4a0 afd afd.sys Wed Apr 30 04:45:29 2003 (3EAF8D29)
bc706000 bca348e0 nv4_disp nv4_disp.dll Tue Jan 15 18:54:43 2002 (3C44C143)
bea45000 bea5a180 dump_atapi dump_atapi.sys Tue Apr 01 13:08:25 2003 (3E89D599)
bea83000 beae6e40 mrxsmb mrxsmb.sys Mon Nov 01 00:24:54 2004 (4185C8A6)
beaf9000 beb22760 rdbss rdbss.sys Fri Oct 15 17:03:40 2004 (41703B2C)
beb23000 beb65dc0 vsdatant vsdatant.sys Sun Nov 28 05:24:51 2004 (41A9A773)
beb66000 beb8de00 netbt netbt.sys Wed Jul 16 15:44:26 2003 (3F15AB1A)
beb8e000 bebdf060 tcpip tcpip.sys Tue Apr 29 19:05:31 2003 (3EAF053B)
bec28000 bec9e1e0 VETMONNT VETMONNT.SYS Wed Nov 17 19:22:13 2004 (419BEB35)
bec9f000 becb82e0 VETFDDNT VETFDDNT.SYS Wed Nov 17 19:22:14 2004 (419BEB36)
bfcb9000 bfce33a0 update update.sys Wed Apr 16 00:22:01 2003 (3E9CDA69)
bfcec000 bfceede0 ws2ifsl ws2ifsl.sys Sat Sep 25 14:41:13 1999 (37ED1749)
bfd0c000 bfd22ba0 ndiswan ndiswan.sys Tue Apr 29 19:05:01 2003 (3EAF051D)
bfd23000 bfd42d00 KS KS.SYS Wed Dec 04 12:09:38 2002 (3DEE36D2)
bfd43000 bfd671e0 portcls portcls.sys Wed Apr 16 00:11:22 2003 (3E9CD7EA)
bfd68000 bfd8f700 vinyl97 vinyl97.sys Mon Sep 06 04:01:53 2004 (413C1971)
bfd90000 bfe22f00 winacpci winacpci.sys Mon Sep 13 17:06:28 1999 (37DD6754)
bfe23000 bfeedd20 nv4_mini nv4_mini.sys Tue Jan 15 18:50:14 2002 (3C44C036)
bff0e000 bff23640 Mup Mup.sys Wed Jan 15 14:54:01 2003 (3E25BC59)
bff24000 bff4daa0 NDIS NDIS.sys Tue Apr 29 19:05:01 2003 (3EAF051D)
bff4e000 bff5f7c0 KSecDD KSecDD.sys Sat Sep 20 20:32:19 2003 (3F6CF193)
bff60000 bff823c0 Fastfat Fastfat.sys Wed Jan 15 14:48:39 2003 (3E25BB17)
bff83000 bff98180 atapi atapi.sys Tue Apr 01 13:08:25 2003 (3E89D599)
bff99000 bffba9c0 dmio dmio.sys Wed Jan 15 14:47:04 2003 (3E25BAB8)
bffbb000 bffd7220 ftdisk ftdisk.sys Mon Mar 31 17:21:58 2003 (3E88BF86)
bffd8000 bffffc20 ACPI ACPI.sys Wed Jan 15 14:44:22 2003 (3E25BA16)
eb400000 eb40e6a0 pci pci.sys Wed Jan 15 14:44:07 2003 (3E25BA07)
eb410000 eb41b680 isapnp isapnp.sys Wed Jan 15 14:43:47 2003 (3E25B9F3)
eb420000 eb428700 CLASSPNP CLASSPNP.SYS Wed Jan 15 14:42:51 2003 (3E25B9BB)
eb450000 eb45c4c0 VIDEOPRT VIDEOPRT.SYS Wed Jan 15 14:47:20 2003 (3E25BAC8)
eb460000 eb46f400 serial serial.sys Wed Apr 16 00:19:39 2003 (3E9CD9DB)
eb470000 eb47b680 i8042prt i8042prt.sys Wed Apr 16 00:00:59 2003 (3E9CD57B)
eb480000 eb48ca80 rasl2tp rasl2tp.sys Tue Apr 29 19:05:06 2003 (3EAF0522)
eb490000 eb49bc40 raspptp raspptp.sys Wed May 14 19:47:00 2003 (3EC2D574)
eb4a0000 eb4aea20 parallel parallel.sys Wed Jan 15 14:47:14 2003 (3E25BAC2)
eb4e0000 eb4e9be0 usbhub usbhub.sys Tue Mar 18 18:30:41 2003 (3E77AC21)
eb4f0000 eb4f9ce0 NDProxy NDProxy.SYS Thu Sep 30 19:25:35 1999 (37F3F16F)
eb500000 eb508fa0 Npfs Npfs.SYS Sat Oct 09 19:58:07 1999 (37FFD68F)
eb510000 eb518680 msgpc msgpc.sys Wed Jan 15 14:54:25 2003 (3E25BC71)
eb520000 eb5281a0 netbios netbios.sys Tue Oct 12 15:34:19 1999 (38038D3B)
eb540000 eb54b8c0 sysaudio sysaudio.sys Wed Apr 16 00:21:44 2003 (3E9CDA58)
eb560000 eb56c000 GRTdiMon GRTdiMon.sys Wed Nov 10 08:43:02 2004 (41921AE6)
eb600000 eb608240 Fips Fips.SYS Tue May 09 11:28:29 2000 (39182E9D)
eb680000 eb685520 PCIIDEX PCIIDEX.SYS Tue Feb 25 13:31:08 2003 (3E5BB66C)
eb688000 eb68f4c0 MountMgr MountMgr.sys Tue Feb 10 14:47:53 2004 (40293569)
eb690000 eb697720 disk disk.sys Wed Jan 15 14:43:05 2003 (3E25B9C9)
eb698000 eb6a0000 GRFILTER GRFILTER.sys Sat Mar 27 17:50:25 2004 (40660531)
eb6b8000 eb6bf0e0 Modem Modem.SYS Wed Jan 15 14:43:48 2003 (3E25B9F4)
eb6c8000 eb6ce980 dlh5x dlh5x.sys Sun Oct 20 08:26:12 2002 (3DB2A0E4)
eb6d8000 eb6dec40 cdrom cdrom.sys Wed Jan 15 14:43:04 2003 (3E25B9C8)
eb6e0000 eb6e7f40 uhcd uhcd.sys Wed Jan 15 14:45:50 2003 (3E25BA6E)
eb6f8000 eb6fcfc0 USBD USBD.SYS Wed Jan 22 12:05:33 2003 (3E2ECF5D)
eb720000 eb721000 fdc fdc.sys unavailable (00000000)
eb738000 eb73e100 parport parport.sys Wed Jan 15 14:47:13 2003 (3E25BAC1)
eb748000 eb74d400 mouclass mouclass.sys Thu Feb 20 11:37:45 2003 (3E550459)
eb758000 eb75dec0 kbdclass kbdclass.sys Thu Feb 20 11:37:30 2003 (3E55044A)
eb778000 eb77c400 ptilink ptilink.sys Wed Jan 15 14:47:15 2003 (3E25BAC3)
eb788000 eb78c0e0 raspti raspti.sys Fri Oct 08 16:45:10 1999 (37FE57D6)
eb7a0000 eb7a4a60 flpydisk flpydisk.sys Wed Jan 15 14:42:52 2003 (3E25B9BC)
eb7b0000 eb7b5460 usbprint usbprint.sys Wed Jan 15 14:44:07 2003 (3E25BA07)
eb7d0000 eb7d4f20 VET_FILT VET-FILT.SYS Wed Nov 17 19:22:12 2004 (419BEB34)
eb7e8000 eb7ed240 Msfs Msfs.SYS Tue Oct 26 19:21:32 1999 (3816377C)
eb808000 eb80fd00 wanarp wanarp.sys Fri Aug 16 08:25:01 2002 (3D5CEF1D)
eb810000 eb812a20 BOOTVID BOOTVID.dll Wed Nov 03 20:24:33 1999 (3820E051)
eb814000 eb816d00 PartMgr PartMgr.sys Wed Jan 15 14:43:07 2003 (3E25B9CB)
eb880000 eb883640 serenum serenum.sys Wed Jan 15 14:47:01 2003 (3E25BAB5)
eb88c000 eb88e540 gameenum gameenum.sys Wed Jan 15 14:45:32 2003 (3E25BA5C)
eb894000 eb8962e0 ndistapi ndistapi.sys Wed Jan 15 14:54:15 2003 (3E25BC67)
eb8a4000 eb8a7e60 TDI TDI.SYS Wed Jan 15 14:56:26 2003 (3E25BCEA)
eb8c8000 eb8cb9e0 VET_REC VET-REC.SYS Wed Nov 17 19:22:12 2004 (419BEB34)
eb8e8000 eb8eb580 vga vga.sys Sat Sep 25 14:37:40 1999 (37ED1674)
eb900000 eb901d20 Diskperf Diskperf.sys Wed Feb 12 16:34:38 2003 (3E4ABDEE)
eb902000 eb903b80 dmload dmload.sys Wed Jan 15 14:47:06 2003 (3E25BABA)
eb90c000 eb90db00 NTIDrvr NTIDrvr.sys Wed Jan 15 12:33:02 2003 (3E259B4E)
eb91c000 eb91dca0 Fs_Rec Fs_Rec.SYS Wed Jan 15 14:53:30 2003 (3E25BC3A)
eb922000 eb923e40 rasacd rasacd.sys Sat Sep 25 14:41:23 1999 (37ED1753)
eb966000 eb967860 ParVdm ParVdm.SYS Mon Sep 27 23:28:16 1999 (37F035D0)
eb9c8000 eb9c8f80 WMILIB WMILIB.SYS Sat Sep 25 14:36:47 1999 (37ED163F)
eb9c9000 eb9c9b00 pciide pciide.sys Wed Jan 15 14:43:03 2003 (3E25B9C7)
eb9ca000 eb9ca4c0 nvDual nvDual.sys Tue Jan 15 18:54:50 2002 (3C44C14A)
eb9ec000 eb9eca00 msmpu401 msmpu401.sys Sat Sep 25 14:35:15 1999 (37ED15E3)
eb9ee000 eb9eea40 audstub audstub.sys Sat Sep 25 14:35:33 1999 (37ED15F5)
eb9f8000 eb9f9000 swenum swenum.sys Wed Dec 04 12:10:07 2002 (3DEE36EF)
eba06000 eba069e0 Null Null.SYS Sat Sep 25 14:34:58 1999 (37ED15D2)
eba08000 eba08ee0 Beep Beep.SYS Wed Oct 20 18:18:59 1999 (380E3FD3)
eba0b000 eba0bf80 mnmdd mnmdd.SYS Sat Sep 25 14:37:40 1999 (37ED1674)
eba38000 eba38f80 dump_WMILIB dump_WMILIB.SYS Sat Sep 25 14:36:47 1999 (37ED163F)
ebac1000 ebac17a0 symlcbrd symlcbrd.sys Wed Oct 16 02:50:27 2002 (3DAD0C33)

Unloaded modules:
b8d33000 b8d58000 kmixer.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
bb158000 bb17d000 kmixer.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
bb2e5000 bb30a000 kmixer.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
bb3aa000 bb3cf000 kmixer.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
bb3aa000 bb3cf000 kmixer.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
bb3aa000 bb3cf000 kmixer.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
bb4bf000 bb4e4000 kmixer.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
bbee1000 bbf06000 kmixer.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
bc2e7000 bc2f4000 DMusic.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
bc307000 bc315000 swmidi.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
bca20000 bca35000 VGA.dll
Timestamp: unavailable (00000000)
Checksum: 00000000
bc706000 bca35000 nv4_disp.dll
Timestamp: unavailable (00000000)
Checksum: 00000000
eb530000 eb539000 redbook.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
eb7c0000 eb7c5000 Cdaudio.SYS
Timestamp: unavailable (00000000)
Checksum: 00000000
eb8c0000 eb8c3000 Sfloppy.SYS
Timestamp: unavailable (00000000)
Checksum: 00000000
Closing open log file c:\debuglog.txt

 

I've attached a screen shot to explain better what i wanted you to do.

Step 1) browse to the same dump as before C:\WINNT\Minidump\Mini122004-01.dmp
Step 2) click the advanced button
Step 3) edit that string so it looks like the picture (cut n paste from my post above)
Step 4) gen a new log and post it.

 

Something is radically wrong with what I am doing:
Under advanced, if I modify the instruction with:
-logo c:\debuglog.txt -c ".trap bbaeec6c;r;kv;.trap bbaeed64;.reload;r;kv.logclose;q"
the contents of the file debuglog.txt (only 1k) is:

Opened log file 'c:\debuglog.txt'

I have reinstalled the debugging tools. I know how to cut and paste (I use clipmate, so I have a record of what I have done).

The program works (size of debuglog.txt is 13 kb) only if I don't try to modify it. I can see the correct line (see above) that I have pasted. What am I doing wrong?

Do I need a new copy of the MSInstaller? I can see the DOS screen, but cannot read it.

 

debuglog for 0x000000f7 in preceding DUMP

Opened log file 'c:\debuglog.txt'
Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols

Microsoft (R) Windows Debugger Version 6.3.0017.0
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\WINNT\Minidump\Mini122104-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: C:\WINNT;C:\WINNT\system32;C:\WINNT\system32\drivers
Windows 2000 Kernel Version 2195 (Service Pack 4) UP Free x86 compatible
Kernel base = 0x80400000 PsLoadedModuleList = 0x80480780
Debug session time: Tue Dec 21 05:31:31 2004
System Uptime: not available
Loading Kernel Symbols
..............................................................................................
Loading unloaded module list
.........
Loading User Symbols
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 7F, {d, 0, 0, 0}

*** ERROR: Symbol file could not be found. Defaulted to export symbols for SYMEVENT.SYS -
Probably caused by : SYMEVENT.SYS ( SYMEVENT!EventObjectCreate+1561 )

Followup: MachineOwner
---------

kd> .trap bbaeec6c;r;kv;.trap bbaeed64;.reload;r;kv.logclose;q
ErrCode = 666c4e8b
eax=8b144889 ebx=6610e9c1 ecx=644e8b10 edx=48895c4e esi=6c4e8b28 edi=4889684e
eip=8b2e4889 esp=00000216 ebp=662c4889 iopl=2 vif nv dn ei pl nz na pe nc
cs=784e ss=8966 ds=0000 es=0f04 fs=4889 gs=1889 efl=8e8b6608
784e:4889 ?? ???
Last set context:
eax=8b144889 ebx=6610e9c1 ecx=644e8b10 edx=48895c4e esi=6c4e8b28 edi=4889684e
eip=8b2e4889 esp=00000216 ebp=662c4889 iopl=2 vif nv dn ei pl nz na pe nc
cs=784e ss=8966 ds=0000 es=0f04 fs=4889 gs=1889 efl=8e8b6608
784e:4889 ?? ???
*** Stack trace for last set context - .thread/.cxr resets it
ChildEBP RetAddr Args to Child
WARNING: Frame IP not in any known module. Following frames may be wrong.
00000212 00000000 00000000 00000000 00000000 0x8b2e4889
ErrCode = 5d390000
eax=af73a815 ebx=000103bf ecx=ffbbaf7d edx=091d88bb esi=fffffe56 edi=e8575300
eip=ff21740c esp=b910558a ebp=00dbe900 iopl=3 vif nv dn di ng nz ac pe nc
cs=0c75 ss=7d04 ds=04b9 es=0048 fs=ece9 gs=c710 efl=bbaf7498
0c75:740c ?? ???
Loading Kernel Symbols
..............................................................................................
Loading unloaded module list
.........
Loading User Symbols
Last set context:
eax=af73a815 ebx=000103bf ecx=ffbbaf7d edx=091d88bb esi=fffffe56 edi=e8575300
eip=ff21740c esp=b910558a ebp=00dbe900 iopl=3 vif nv dn di ng nz ac pe nc
cs=0c75 ss=7d04 ds=04b9 es=0048 fs=ece9 gs=c710 efl=bbaf7498
0c75:740c ?? ???
*** ERROR: Symbol file could not be found. Defaulted to export symbols for SYMEVENT.SYS -

 

you got it that time, unfortunatly, you ran it on the wrong dump.

C:\WINNT\Minidump\Mini122004-01.dmp is the dump i need you to run it on, you ran it against 122104-01

 

dump for 1220

Not sent in error, thought you might want to see the next days blue death, also. Here is 12-20-04:
Opened log file 'c:\debuglog.txt'

Microsoft (R) Windows Debugger Version 6.3.0017.0
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\WINNT\Minidump\Mini122004-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: C:\WINNT;C:\WINNT\system32;C:\WINNT\system32\drivers
Windows 2000 Kernel Version 2195 (Service Pack 4) UP Free x86 compatible
Kernel base = 0x80400000 PsLoadedModuleList = 0x80480780
Debug session time: Mon Dec 20 19:29:30 2004
System Uptime: not available
Loading Kernel Symbols
.................................................................................................
Loading unloaded module list
...............
Loading User Symbols
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 7F, {d, 0, 0, 0}

Probably caused by : ntoskrnl.exe ( nt!KiSystemFatalException+e )

Followup: MachineOwner
---------

kd> .trap bbaeec6c;r;kv;.trap bbaeed64;.reload;r;kv.logclose;q
ErrCode = 00000000
eax=bbaeed34 ebx=811770d4 ecx=00000000 edx=0196f8e0 esi=81177020 edi=bbaeed64
eip=8042ad05 esp=bbaeece0 ebp=bbaeed04 iopl=0 nv up ei pl zr na po nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010246
nt!KeDelayExecutionThread+0x57:
8042ad05 2e000f add cs:[edi],cl cs:0008:bbaeed64=00
Last set context:
eax=bbaeed34 ebx=811770d4 ecx=00000000 edx=0196f8e0 esi=81177020 edi=bbaeed64
eip=8042ad05 esp=bbaeece0 ebp=bbaeed04 iopl=0 nv up ei pl zr na po nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010246
nt!KeDelayExecutionThread+0x57:
8042ad05 2e000f add cs:[edi],cl cs:0008:bbaeed64=00
*** Stack trace for last set context - .thread/.cxr resets it
ChildEBP RetAddr Args to Child
bbaeed04 80523ba1 8144fc01 00000000 bbaeed34 nt!KeDelayExecutionThread+0x57 (FPO: [Non-Fpo])
bbaeed54 80463f64 00000000 0196f8f0 00000000 nt!NtDelayExecution+0x7f (FPO: [Non-Fpo])
bbaeed54 77f82831 00000000 0196f8f0 00000000 nt!KiSystemService+0xc4 (FPO: [0,0] TrapFrame @ bbaeed64)
WARNING: Frame IP not in any known module. Following frames may be wrong.
0196f8d8 00000000 00000000 00000000 00000000 0x77f82831
ErrCode = 00000000
eax=00000000 ebx=00d534ab ecx=000000c0 edx=00000000 esi=77f82826 edi=0196f8f0
eip=77f82831 esp=0196f8dc ebp=0196f8f8 iopl=0 nv up ei pl nz na po nc
cs=001b ss=0023 ds=0023 es=0023 fs=0038 gs=0000 efl=00000206
001b:77f82831 ?? ???
Loading Kernel Symbols
.................................................................................................
Loading unloaded module list
...............
Loading User Symbols
Last set context:
eax=00000000 ebx=00d534ab ecx=000000c0 edx=00000000 esi=77f82826 edi=0196f8f0
eip=77f82831 esp=0196f8dc ebp=0196f8f8 iopl=0 nv up ei pl nz na po nc
cs=001b ss=0023 ds=0023 es=0023 fs=0038 gs=0000 efl=00000206
001b:77f82831 ?? ???
*** ERROR: Symbol file could not be found. Defaulted to export symbols for SYMEVENT.SYS -
*** WARNING: Unable to verify timestamp for css-dvp.sys
*** ERROR: Module load completed but symbols could not be loaded for css-dvp.sys
*** ERROR: Module load completed but symbols could not be loaded for nv4_disp.dll
*** ERROR: Module load completed but symbols could not be loaded for vsdatant.sys
*** ERROR: Module load completed but symbols could not be loaded for VETMONNT.SYS
*** ERROR: Module load completed but symbols could not be loaded for VETFDDNT.SYS
*** ERROR: Module load completed but symbols could not be loaded for vinyl97.sys
*** ERROR: Module load completed but symbols could not be loaded for nv4_mini.sys
*** ERROR: Module load completed but symbols could not be loaded for serial.sys
*** WARNING: Unable to verify timestamp for GRTdiMon.sys
*** ERROR: Module load completed but symbols could not be loaded for GRTdiMon.sys
*** WARNING: Unable to verify timestamp for GRFILTER.sys
*** ERROR: Module load completed but symbols could not be loaded for GRFILTER.sys
*** ERROR: Module load completed but symbols could not be loaded for dlh5x.sys
*** WARNING: Unable to verify timestamp for fdc.sys
*** ERROR: Module load completed but symbols could not be loaded for fdc.sys
*** ERROR: Symbol file could not be found. Defaulted to export symbols for VET-FILT.SYS -
*** ERROR: Symbol file could not be found. Defaulted to export symbols for VET-REC.SYS -
*** ERROR: Module load completed but symbols could not be loaded for NTIDrvr.sys

 

Ok, thats the data i needed.

Hmm. this isnt making sense. Its crashing on an area that it really shouldnt ever be in. The thing that concerns me is that its the same place in both dumps, so something else is up.

Change your setup to collect a Full Memory dump, just in case we need to explore.

 

Blue Death

My computer has been down for a while, due to pilot error. I decided that the 0x000000f7 errors were not software related, other than they came about following installation of Service Pack 4. Thought I would upgrade the bios with a flash upgrade. This went well on screen, saving old bios as a .bin file. However on reset, the system became inoperable. Removed mother board, attempted to replace bios chip, and noted there were expanded, wet electrolytic capacitors in a number of places. Also I now lack the physical dexterity to pop in the replacement bios chip. Time for a new motherboard. Which is where I am now, with new mother board (with 'crashless bios chip') with everything working well. I will reset system dump debug defaults to full kernel dump. Yes? Then I will remove all remnants of Norton programs and reinstall NSW 2004. I have little experience with system crashes on win2k, but find them challenging and definitely a learning experience. I feel many weeks younger.
Thanks, and (hic! soon!) Happy New Year to all!

 

Blue Death 0x0000007f follow-up

After all that investigating, turned out to be in the mother-board after all. Only item changed (same processor, drives, memory, etc.). New bios chip to go with new motherboard (since I ruined the old one). Everything works fine. NSW2004 works with google desktop and ALL of my other programs, Nice to look at Events Log without seeing ANY colors. My thanks to all.