TechSpot

Blue screen on Shutdown Stop: 0x00000050

By allsigns
May 23, 2006
Topic Status:
Not open for further replies.
  1. Hi can any one help, i have a Blue screen error on shutdown of log off a certan user error code :

    STOP : 0x00000050 (0xfffffff0, 0x00000000, 0x8054a51a, 0x00000000) PAGE_FAULT_IN_NONPAGED_AREA

    our system is a Dell Optiplex SX280 see spec attached

    i have done a system restore point, general tidy of drive, changed memory, and motherboard, here is a debugger :

    Opened log file 'c:\debuglog.txt'

    Microsoft (R) Windows Debugger Version 6.6.0003.5
    Copyright (c) Microsoft Corporation. All rights reserved.


    Loading Dump File [C:\Documents and Settings\NAME\Desktop\user.dmp]
    User Mini Dump File: Only registers, stack and portions of memory are available

    Comment: 'Dr. Watson generated MiniDump'
    Windows XP Version 2600 (Service Pack 2) UP Free x86 compatible
    Product: WinNt, suite: SingleUserTS
    Debug session time: Tue Sep 27 09:32:40.000 2005 (GMT+1) (Date wrong on pc sorry)
    System Uptime: not available
    Process Uptime: 0 days 0:00:02.000
    Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
    Executable search path is: C:\WINDOWS;C:\WINDOWS\system32;C:\WINDOWS\system32\drivers
    .........................................
    This dump file has an exception of interest stored in it.
    The stored exception information can be accessed via .ecxr.
    (298.2f8): Access violation - code c0000005 (first/second chance not available)
    eax=00000000 ebx=00c40020 ecx=7c91056d edx=00000040 esi=76c630e0 edi=0012926c
    eip=7c91389e esp=00befb08 ebp=00befb0c iopl=0 nv up ei pl zr na po nc
    cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000246
    ntdll!_wcsicmp+0xe:
    7c91389e 668b02 mov ax,[edx] ds:0023:00000040=????
    0:007> !analyze -v;r;kv;lmtn;.logclose;q
    *******************************************************************************
    * *
    * Exception Analysis *
    * *
    *******************************************************************************


    FAULTING_IP:
    ntdll!_wcsicmp+e
    7c91389e 668b02 mov ax,[edx]

    EXCEPTION_RECORD: ffffffff -- (.exr ffffffffffffffff)
    .exr ffffffffffffffff
    ExceptionAddress: 7c91389e (ntdll!_wcsicmp+0x0000000e)
    ExceptionCode: c0000005 (Access violation)
    ExceptionFlags: 00000000
    NumberParameters: 2
    Parameter[0]: 00000000
    Parameter[1]: 00000040
    Attempt to read from address 00000040

    PROCESS_NAME: winlogon.exe

    ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx". The memory could not be "%s".

    READ_ADDRESS: 00000040

    BUGCHECK_STR: ACCESS_VIOLATION

    DEFAULT_BUCKET_ID: NULL_CLASS_PTR_DEREFERENCE

    LAST_CONTROL_TRANSFER: from 76c6c4e4 to 7c91389e

    STACK_TEXT:
    00befb0c 76c6c4e4 00000040 76c630e0 00000000 ntdll!_wcsicmp+0xe
    00befb38 76c6faf7 7c80ac28 00000000 76bb0000 sfc_os!SfcBuildDirectoryWatchList+0x1e9
    00befd78 01030198 00000000 00000000 00000000 sfc_os!SfcInitProt+0x715
    00beffb4 7c80b50b 00000000 00000018 00003000 winlogon!InitializeSfc+0x97
    00beffec 00000000 01030101 00000000 00000000 kernel32!BaseThreadStart+0x37


    STACK_COMMAND: ~7s; .ecxr ; kb

    FOLLOWUP_IP:
    sfc_os!SfcBuildDirectoryWatchList+1e9
    76c6c4e4 85c0 test eax,eax

    SYMBOL_STACK_INDEX: 1

    FOLLOWUP_NAME: MachineOwner

    SYMBOL_NAME: sfc_os!SfcBuildDirectoryWatchList+1e9

    MODULE_NAME: sfc_os

    IMAGE_NAME: sfc_os.dll

    DEBUG_FLR_IMAGE_TIMESTAMP: 411096b3

    FAILURE_BUCKET_ID: ACCESS_VIOLATION_sfc_os!SfcBuildDirectoryWatchList+1e9

    BUCKET_ID: ACCESS_VIOLATION_sfc_os!SfcBuildDirectoryWatchList+1e9

    Followup: MachineOwner
    ---------

    eax=00000000 ebx=00c40020 ecx=7c91056d edx=00000040 esi=76c630e0 edi=0012926c
    eip=7c91389e esp=00befb08 ebp=00befb0c iopl=0 nv up ei pl zr na po nc
    cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000246
    ntdll!_wcsicmp+0xe:
    7c91389e 668b02 mov ax,[edx] ds:0023:00000040=????
    ChildEBP RetAddr Args to Child
    00befb0c 76c6c4e4 00000040 76c630e0 00000000 ntdll!_wcsicmp+0xe (FPO: [Non-Fpo])
    00befb38 76c6faf7 7c80ac28 00000000 76bb0000 sfc_os!SfcBuildDirectoryWatchList+0x1e9 (FPO: [Non-Fpo])
    00befd78 01030198 00000000 00000000 00000000 sfc_os!SfcInitProt+0x715 (FPO: [Non-Fpo])
    00beffb4 7c80b50b 00000000 00000018 00003000 winlogon!InitializeSfc+0x97 (FPO: [Non-Fpo])
    00beffec 00000000 01030101 00000000 00000000 kernel32!BaseThreadStart+0x37 (FPO: [Non-Fpo])
    start end module name
    01000000 01080000 winlogon winlogon.exe Wed Aug 04 07:14:52 2004 (41107EDC)
    20000000 20017000 odbcint odbcint.dll Wed Aug 04 08:57:25 2004 (411096E5)
    5ad70000 5ada8000 uxtheme uxtheme.dll Wed Aug 04 08:56:43 2004 (411096BB)
    5b860000 5b8b4000 netapi32 netapi32.dll Wed Aug 04 08:56:28 2004 (411096AC)
    5d090000 5d127000 comctl32 comctl32.dll Wed Aug 04 08:56:31 2004 (411096AF)
    71aa0000 71aa8000 ws2help ws2help.dll Wed Aug 04 08:57:39 2004 (411096F3)
    71ab0000 71ac7000 ws2_32 ws2_32.dll Wed Aug 04 08:57:38 2004 (411096F2)
    723d0000 723ec000 winscard winscard.dll Wed Aug 04 08:56:36 2004 (411096B4)
    74320000 7435d000 odbc32 odbc32.dll Wed Aug 04 08:57:17 2004 (411096DD)
    75930000 7593a000 profmap profmap.dll Wed Aug 04 08:56:55 2004 (411096C7)
    75940000 75948000 nddeapi nddeapi.dll Wed Aug 04 08:56:24 2004 (411096A8)
    75970000 75a67000 msgina msgina.dll Wed Aug 04 08:58:01 2004 (41109709)
    76360000 76370000 winsta winsta.dll Wed Aug 04 08:56:40 2004 (411096B8)
    763b0000 763f9000 comdlg32 comdlg32.dll Wed Aug 04 08:56:32 2004 (411096B0)
    769c0000 76a73000 userenv userenv.dll Wed Aug 04 08:56:41 2004 (411096B9)
    76bb0000 76bb5000 sfc sfc.dll Wed Aug 04 08:56:34 2004 (411096B2)
    76bc0000 76bcf000 regapi regapi.dll Wed Aug 04 08:56:40 2004 (411096B8)
    76bf0000 76bfb000 psapi psapi.dll Wed Aug 04 08:56:58 2004 (411096CA)
    76c30000 76c5e000 wintrust wintrust.dll Wed Aug 04 08:56:41 2004 (411096B9)
    76c60000 76c8a000 sfc_os sfc_os.dll Wed Aug 04 08:56:35 2004 (411096B3)
    76c90000 76cb8000 imagehlp imagehlp.dll Wed Aug 04 08:56:25 2004 (411096A9)
    76f50000 76f58000 wtsapi32 wtsapi32.dll Wed Aug 04 08:57:55 2004 (41109703)
    773d0000 774d2000 comctl32_773d0000 comctl32.dll Wed Aug 04 08:55:56 2004 (4110968C)
    774e0000 7761c000 ole32 ole32.dll Wed Aug 04 08:57:38 2004 (411096F2)
    776c0000 776d1000 authz authz.dll Wed Aug 04 08:57:05 2004 (411096D1)
    776e0000 77703000 shsvcs shsvcs.dll Wed Aug 04 08:56:47 2004 (411096BF)
    77920000 77a13000 setupapi setupapi.dll Wed Aug 04 08:56:32 2004 (411096B0)
    77a80000 77b14000 crypt32 crypt32.dll Wed Aug 04 08:56:01 2004 (41109691)
    77b20000 77b32000 msasn1 msasn1.dll Wed Aug 04 08:57:23 2004 (411096E3)
    77b40000 77b62000 apphelp apphelp.dll Wed Aug 04 08:56:36 2004 (411096B4)
    77c00000 77c08000 version version.dll Wed Aug 04 08:56:39 2004 (411096B7)
    77c10000 77c68000 msvcrt msvcrt.dll Wed Aug 04 08:59:14 2004 (41109752)
    77d40000 77dd0000 user32 user32.dll Wed Aug 04 08:56:40 2004 (411096B8)
    77dd0000 77e6b000 advapi32 advapi32.dll Wed Aug 04 08:56:23 2004 (411096A7)
    77e70000 77f01000 rpcrt4 rpcrt4.dll Wed Aug 04 08:56:30 2004 (411096AE)
    77f10000 77f56000 gdi32 gdi32.dll Wed Aug 04 08:56:07 2004 (41109697)
    77f60000 77fd6000 shlwapi shlwapi.dll Thu Mar 10 08:02:34 2005 (422FFF1A)
    77fe0000 77ff1000 secur32 secur32.dll Wed Aug 04 08:56:49 2004 (411096C1)
    7c800000 7c8f4000 kernel32 kernel32.dll Wed Aug 04 08:56:36 2004 (411096B4)
    7c900000 7c9b0000 ntdll ntdll.dll Wed Aug 04 08:56:36 2004 (411096B4)
    7c9c0000 7d1d4000 shell32 shell32.dll Wed Aug 04 08:56:39 2004 (411096B7)
    Closing open log file c:\debuglog.txt
     
  2. nork

    nork TS Maniac Posts: 631

  3. nork

    nork TS Maniac Posts: 631

  4. allsigns

    allsigns TS Rookie Topic Starter Posts: 42

    Hi Nork

    thanks for your help, ill have a look at those links, i did run a memtest and all was well....
     
  5. nork

    nork TS Maniac Posts: 631

    I also found this:
    http://support.microsoft.com/?kbid=811270
    The "unhandled exception" is the same as what is in the debug info, althought it may or may not apply to your pc. Do you have that Delfin media viewer installed?
    If you dont know look in add\remove software and also do a search of c: drive for the word delfin.
    Im still looking for more info.
     
  6. allsigns

    allsigns TS Rookie Topic Starter Posts: 42

    thanks nork,:) ill have a look at that link, we dont have delfin, but i will look...
     
  7. nork

    nork TS Maniac Posts: 631

  8. allsigns

    allsigns TS Rookie Topic Starter Posts: 42

    Hi nork, no its an office pc, it apparantly used to do i before i worked here and they changed the ram, but i have done all that and still no joy, probarley the last software would be updates and stuff like that.... just trying to zip my mini dumps to upload may be you can look and see anything in them? i dont know how to read them...
     
  9. allsigns

    allsigns TS Rookie Topic Starter Posts: 42

    cant open that link you gave me nork? i have uploaded so Zip mini dumps...
     
  10. nork

    nork TS Maniac Posts: 631

  11. allsigns

    allsigns TS Rookie Topic Starter Posts: 42

    nothing came up on Delfin....
     
     
  12. nork

    nork TS Maniac Posts: 631

    By the way, i am NOT the best person to analyze this debug sesson. I am mainly guessing here, so someone else with more knowledge is welcome to get in here, lol.

    Using these lines as reference:

    FAULTING_IP:
    ntdll!_wcsicmp+e
    7c91389e 668b02 mov ax,[edx]

    I googled ntdll and found this. You can download a fresh ntdll file here and place the file where it belongs in your windows folders. You could take the original and simply rename it, then put this one it its place, see if it takes care of your blue screen, if not then delete it and change the original dll back to its proper name.
    http://www.dll-files.com/dllindex/dll-files.shtml?ntdll

    The only thing is that i dont know if changing that ntdll file will cause your system to not boot or some other problem. I dont think so, but thats only a guess.
    Anyone else?
     
  13. nork

    nork TS Maniac Posts: 631

    Sorry, i didnt even notice you were answering my posts, lol. I will go back and check them out better.

    Which link is no good?
    I will look at those dumps.
    thanks
     
  14. allsigns

    allsigns TS Rookie Topic Starter Posts: 42

    Lol thats ok, i dont have much else to do so i tend to bombard people with emails (makes me look busy ;) ) lol
     
  15. nork

    nork TS Maniac Posts: 631

    I d\loaded those dumps and unzipped them but i cant find anything to open them with. You seem to have opened them, right? How?
    Lol, this is like the blind leading the blind.

    Is there a microsoft or other reader that i can download to read these files?
     
  16. altheman

    altheman TS Rookie Posts: 541

    4 crashes at "ntkrpamp.exe" with a Bugcheck of 50:

    try installing the latest updates for all components, and update your windows files using windows update, and then use "sfc /scannow" (without quotes) from command prompt to verify your system files are not modified versions.

    you wrote you ran memtest, but if you didnt let if run for atleast 7 passes, then do it again.
     
  17. nork

    nork TS Maniac Posts: 631

    altheman, thanks for the rescue, lol.
    I didnt notice the slip up about checking to see how many passes allsigns did with memtest. That could be important as it still could be a memory problem.

    Also, couldnt allsigns go to computer management\event viewer\system and report on red error messages?
     
  18. nork

    nork TS Maniac Posts: 631

    p.S. I tried all the links that i gave you and they all work for me.
    Which link didnt work for you?
     
  19. allsigns

    allsigns TS Rookie Topic Starter Posts: 42

    Hi altheman, thanks for ya help, i left memtest running over night from 4pm till 11pm the next day!! would that be long enough? it didnt show any errors,
    i have installed all the updates there are no more coming up to install, ill try the SFC scan and get back to you... :)
     
  20. allsigns

    allsigns TS Rookie Topic Starter Posts: 42

    Hi altheman, right i done the sfc /scannow went though but when it finished it went back to the dos prompt but no list or messages were given!! :(
     
  21. allsigns

    allsigns TS Rookie Topic Starter Posts: 42

    new minidumps attached, as im worried i gave you the old ones from a year ago, these 2 are for 23/5/06 (cant find the ones its done today?)
     
  22. altheman

    altheman TS Rookie Posts: 541

    Both dumps reference "ntkrpamp.exe."

    Im not sure what the problem is, but on another post here: http://www.techspot.com/vb/topic42942.html, another person had crashes with the same file.

    try these suggestions:

    Try running your system with just one stick of ram.

    Make sure your ram is compatible with your mobo.

    Try putting your ram into a different dimm slot.

    Update your video card drivers.


    It could be a pagefile problem, so so this to clear and set a new pagefile:

    -Open System Properties-> Advanced->Performance settings->Advanced

    - Under virtual memory, click "Change"

    -For all drives click "No paging file", and then "Set."

    -Reboot and then change the values to what they previously were.

    -Reboot again.


    If that doesnt work, then im not sure what the problem is.
     
  23. allsigns

    allsigns TS Rookie Topic Starter Posts: 42

    Hi altheman

    i had already done the to list other than update the video drivers (will do that next) i saw in a forum that your not ment to fiddle with the Pagefile, so im a bit worried about doing that one, but ill give it ago.... thanks for your help... ill email you and let you know how i get on!! :)

    sorry what do you mean by : -Reboot and then change the values to what they previously were. how do i no what the values are?do you mean put them back to the same amount before i changed them?
     
  24. allsigns

    allsigns TS Rookie Topic Starter Posts: 42

    ok done the video drivers still no joy!!, dont know if its of any help but its a DELL SX280 bit worried about doing the no paging file bit?
     
  25. altheman

    altheman TS Rookie Posts: 541

    im sure it wont cause problems, its only temporary, and you'll set it back to normal after reboot.

    Source (Under Problems with Virtual memory)

    To see the page file, you'll need to go to Folder Options->View->"Show Hidden Files" and "Show Protected OS Files."
     
Topic Status:
Not open for further replies.


Add New Comment

TechSpot Members
Login or sign up for free,
it takes about 30 seconds.
You may also...


Get complete access to the TechSpot community. Join thousands of technology enthusiasts that contribute and share knowledge in our forum. Get a private inbox, upload your own photo gallery and more.