TechSpot

Blue screen of death - windos XP pro

By henrique_m
Nov 12, 2007
  1. Hi I have a windows Xp pro machine that constantly crashes. i enclose a minidump, can you help finding out if it is HW or SW problem?
    *****************************************************

    KERNEL_MODE_EXCEPTION_NOT_HANDLED_M (1000008e)
    This is a very common bugcheck. Usually the exception address pinpoints
    the driver/function that caused the problem. Always note this address
    as well as the link date of the driver/image that contains this address.
    Some common problems are exception code 0x80000003. This means a hard
    coded breakpoint or assertion was hit, but this system was booted
    /NODEBUG. This is not supposed to happen as developers should never have
    hardcoded breakpoints in retail code, but ...
    If this happens, make sure a debugger gets connected, and the
    system is booted /DEBUG. This will let us see why this breakpoint is
    happening.
    Arguments:
    Arg1: c0000005, The exception code that was not handled
    Arg2: 8056e2ea, The address that the exception occurred at
    Arg3: f781898c, Trap Frame
    Arg4: 00000000

    Debugging Details:
    ------------------


    EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - A instru o no "0x%08lx" fez refer ncia mem ria no "0x%08lx". A mem ria n o p de ser "%s".

    FAULTING_IP:
    nt!HvpGetCellMapped+5f
    8056e2ea 8b4304 mov eax,dword ptr [ebx+4]

    TRAP_FRAME: f781898c -- (.trap 0xfffffffff781898c)
    .trap 0xfffffffff781898c
    ErrCode = 00000000
    eax=00001ff0 ebx=00001ff0 ecx=823c18f8 edx=000002ef esi=e1035b60 edi=00000fff
    eip=8056e2ea esp=f7818a00 ebp=f7818a48 iopl=0 nv up ei pl zr na pe nc
    cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010246
    nt!HvpGetCellMapped+0x5f:
    8056e2ea 8b4304 mov eax,dword ptr [ebx+4] ds:0023:00001ff4=????????
    .trap
    Resetting default scope

    CUSTOMER_CRASH_COUNT: 7

    DEFAULT_BUCKET_ID: CODE_CORRUPTION

    BUGCHECK_STR: 0x8E

    PROCESS_NAME: services.exe

    LAST_CONTROL_TRANSFER: from 8057903a to 8056e2ea

    STACK_TEXT:
    f7818a48 8057903a e1035b60 5dffffff e1035b60 nt!HvpGetCellMapped+0x5f
    f7818a5c 80578eb5 e1035b60 5dffffff e1035b60 nt!HvpGetHCell+0x10
    f7818a78 805d7cca e1035b60 5dffffff dac2607c nt!HvMarkCellDirty+0x30
    f7818a90 805d7dd7 e1035b60 00365078 dac2607c nt!CmpMarkKeyValuesDirty+0x3d
    f7818aac 805d7b5d e1035b60 00365078 dac2607c nt!CmpFreeKeyValues+0x17
    f7818ae8 805d7ca7 e1035b60 000a12b8 daa222bc nt!CmpSyncKeyValues+0x26
    f7818b2c 805d7955 e130c000 00000400 00000003 nt!CmpCopySyncTree2+0x1f4
    f7818b5c 805d86b1 e1035b60 000001b8 e1035b60 nt!CmpCopySyncTree+0x4f
    f7818ccc 805a2ffb 00010003 f7818d64 f7818ce8 nt!CmpSaveBootControlSet+0x2a7
    f7818cdc 804de7ec 00000005 f7818d64 804dcdfd nt!NtInitializeRegistry+0x5e
    f7818cdc 804dcdfd 00000005 f7818d64 804dcdfd nt!KiFastCallEntry+0xf8
    f7818d58 804de7ec 00000005 0007fe8c 7c91eb94 nt!ZwInitializeRegistry+0x11
    f7818d58 7c91eb94 00000005 0007fe8c 7c91eb94 nt!KiFastCallEntry+0xf8
    WARNING: Frame IP not in any known module. Following frames may be wrong.
    0007fe8c 00000000 00000000 00000000 00000000 0x7c91eb94
     
  2. henrique_m

    henrique_m TS Rookie Topic Starter

    another dump

    *******************************************************************************
    * *
    * Bugcheck Analysis *
    * *
    *******************************************************************************

    KERNEL_MODE_EXCEPTION_NOT_HANDLED_M (1000008e)
    This is a very common bugcheck. Usually the exception address pinpoints
    the driver/function that caused the problem. Always note this address
    as well as the link date of the driver/image that contains this address.
    Some common problems are exception code 0x80000003. This means a hard
    coded breakpoint or assertion was hit, but this system was booted
    /NODEBUG. This is not supposed to happen as developers should never have
    hardcoded breakpoints in retail code, but ...
    If this happens, make sure a debugger gets connected, and the
    system is booted /DEBUG. This will let us see why this breakpoint is
    happening.
    Arguments:
    Arg1: c0000005, The exception code that was not handled
    Arg2: 8056e2ea, The address that the exception occurred at
    Arg3: f77b898c, Trap Frame
    Arg4: 00000000

    Debugging Details:
    ------------------


    EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - A instru o no "0x%08lx" fez refer ncia mem ria no "0x%08lx". A mem ria n o p de ser "%s".

    FAULTING_IP:
    nt!HvpGetCellMapped+5f
    8056e2ea 8b4304 mov eax,dword ptr [ebx+4]

    TRAP_FRAME: f77b898c -- (.trap 0xfffffffff77b898c)
    .trap 0xfffffffff77b898c
    ErrCode = 00000000
    eax=00001ff0 ebx=00001ff0 ecx=823c18f8 edx=000002ef esi=e1035b60 edi=00000fff
    eip=8056e2ea esp=f77b8a00 ebp=f77b8a48 iopl=0 nv up ei pl zr na pe nc
    cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010246
    nt!HvpGetCellMapped+0x5f:
    8056e2ea 8b4304 mov eax,dword ptr [ebx+4] ds:0023:00001ff4=????????
    .trap
    Resetting default scope

    CUSTOMER_CRASH_COUNT: 8

    DEFAULT_BUCKET_ID: CODE_CORRUPTION

    BUGCHECK_STR: 0x8E

    PROCESS_NAME: services.exe

    LAST_CONTROL_TRANSFER: from 8057903a to 8056e2ea

    STACK_TEXT:
    f77b8a48 8057903a e1035b60 5dffffff e1035b60 nt!HvpGetCellMapped+0x5f
    f77b8a5c 80578eb5 e1035b60 5dffffff e1035b60 nt!HvpGetHCell+0x10
    f77b8a78 805d7cca e1035b60 5dffffff dd2e607c nt!HvMarkCellDirty+0x30
    f77b8a90 805d7dd7 e1035b60 00365078 dd2e607c nt!CmpMarkKeyValuesDirty+0x3d
    f77b8aac 805d7b5d e1035b60 00365078 dd2e607c nt!CmpFreeKeyValues+0x17
    f77b8ae8 805d7ca7 e1035b60 000a12b8 dd0e22bc nt!CmpSyncKeyValues+0x26
    f77b8b2c 805d7955 e1265000 00000400 00000003 nt!CmpCopySyncTree2+0x1f4
    f77b8b5c 805d86b1 e1035b60 000001b8 e1035b60 nt!CmpCopySyncTree+0x4f
    f77b8ccc 805a2ffb 00010003 f77b8d64 f77b8ce8 nt!CmpSaveBootControlSet+0x2a7
    f77b8cdc 804de7ec 00000005 f77b8d64 804dcdfd nt!NtInitializeRegistry+0x5e
    f77b8cdc 804dcdfd 00000005 f77b8d64 804dcdfd nt!KiFastCallEntry+0xf8
    f77b8d58 804de7ec 00000005 0007fe8c 7c91eb94 nt!ZwInitializeRegistry+0x11
    f77b8d58 7c91eb94 00000005 0007fe8c 7c91eb94 nt!KiFastCallEntry+0xf8
    WARNING: Frame IP not in any known module. Following frames may be wrong.
    0007fe8c 00000000 00000000 00000000 00000000 0x7c91eb94
     
  3. peterdiva

    peterdiva TechSpot Ambassador Posts: 1,088

    It's a registry problem. Can by caused by hardware or software. Have you installed anything lately? Check the event viewer for Event Id 1517.
     
  4. henrique_m

    henrique_m TS Rookie Topic Starter

    yes, I found event id 1517, but it dosnt give me any clue about the application that might cause this. (its in portuguese, so i dont post it here). How can i fix this? can you help?
    thanks .
     
  5. peterdiva

    peterdiva TechSpot Ambassador Posts: 1,088

  6. henrique_m

    henrique_m TS Rookie Topic Starter

    Hi! Sorry, didnt help.

    The system has Mcafee protection installed, and it has changed the policies; it says that the Administrador has set policies that do not allow the installation of that software.
    Tryed to uninstall Mcafee but got also a blue screen in the process (in safe mode):


    KERNEL_MODE_EXCEPTION_NOT_HANDLED_M (1000008e)
    This is a very common bugcheck. Usually the exception address pinpoints
    the driver/function that caused the problem. Always note this address
    as well as the link date of the driver/image that contains this address.
    Some common problems are exception code 0x80000003. This means a hard
    coded breakpoint or assertion was hit, but this system was booted
    /NODEBUG. This is not supposed to happen as developers should never have
    hardcoded breakpoints in retail code, but ...
    If this happens, make sure a debugger gets connected, and the
    system is booted /DEBUG. This will let us see why this breakpoint is
    happening.
    Arguments:
    Arg1: c0000005, The exception code that was not handled
    Arg2: 8056e2ea, The address that the exception occurred at
    Arg3: f7de9ba4, Trap Frame
    Arg4: 00000000

    Debugging Details:
    ------------------


    EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - A instru o no "0x%08lx" fez refer ncia mem ria no "0x%08lx". A mem ria n o p de ser "%s".

    FAULTING_IP:
    nt!HvpGetCellMapped+5f
    8056e2ea 8b4304 mov eax,dword ptr [ebx+4]

    TRAP_FRAME: f7de9ba4 -- (.trap 0xfffffffff7de9ba4)
    .trap 0xfffffffff7de9ba4
    ErrCode = 00000000
    eax=00001ff0 ebx=00001ff0 ecx=823c1b98 edx=00000377 esi=e1035008 edi=00000fff
    eip=8056e2ea esp=f7de9c18 ebp=f7de9c60 iopl=0 nv up ei pl zr na pe nc
    cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010246
    nt!HvpGetCellMapped+0x5f:
    8056e2ea 8b4304 mov eax,dword ptr [ebx+4] ds:0023:00001ff4=????????
    .trap
    Resetting default scope

    CUSTOMER_CRASH_COUNT: 4

    DEFAULT_BUCKET_ID: COMMON_SYSTEM_FAULT

    BUGCHECK_STR: 0x8E

    PROCESS_NAME: McProxy.exe

    LAST_CONTROL_TRANSFER: from 8057903a to 8056e2ea

    STACK_TEXT:
    f7de9c60 8057903a e1035008 6effffff e1035008 nt!HvpGetCellMapped+0x5f
    f7de9c74 80578eb5 e1035008 6effffff c13663bc nt!HvpGetHCell+0x10
    f7de9c90 805dd012 e1035008 6effffff e1035008 nt!HvMarkCellDirty+0x30
    f7de9cb0 80594e4b e1035008 003653b8 e179ba70 nt!CmpMarkKeyDirty+0x68
    f7de9cc8 80594f6b e1035008 003653b8 00000001 nt!CmpFreeKeyByCell+0x14
    f7de9cf8 805951e3 e1937fb8 f7de9d64 0012f88c nt!CmDeleteKey+0x8c
    f7de9d58 804de7ec 000000d4 0012f8b4 7c91eb94 nt!NtDeleteKey+0x138
    f7de9d58 7c91eb94 000000d4 0012f8b4 7c91eb94 nt!KiFastCallEntry+0xf8
    WARNING: Frame IP not in any known module. Following frames may be wrong.
    0012f8b4 00000000 00000000 00000000 00000000 0x7c91eb94


    STACK_COMMAND: kb

    FOLLOWUP_IP:
    nt!HvpGetCellMapped+5f
    8056e2ea 8b4304 mov eax,dword ptr [ebx+4]

    SYMBOL_STACK_INDEX: 0

    SYMBOL_NAME: nt!HvpGetCellMapped+5f

    FOLLOWUP_NAME: MachineOwner

    MODULE_NAME: nt

    IMAGE_NAME: ntoskrnl.exe

    DEBUG_FLR_IMAGE_TIMESTAMP: 45e54711

    FAILURE_BUCKET_ID: 0x8E_nt!HvpGetCellMapped+5f

    BUCKET_ID: 0x8E_nt!HvpGetCellMapped+5f

    Followup: MachineOwner
    ---------

    eax=00001ff0 ebx=00001ff0 ecx=823c1b98 edx=00000377 esi=e1035008 edi=00000fff
    eip=8056e2ea esp=f7de9c18 ebp=f7de9c60 iopl=0 nv up ei pl zr na pe nc
    cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010246
    nt!HvpGetCellMapped+0x5f:
     
Topic Status:
Not open for further replies.

Similar Topics

Add New Comment

You need to be a member to leave a comment. Join thousands of tech enthusiasts and participate.
TechSpot Account You may also...