TechSpot

BSOD and Windows Explorer crashes

By toppa
Aug 20, 2009
  1. ***Please could somebody move this to the BSOD sub-forum, sorry***

    Hi,

    This is a direct follow-on from my thread 'PC Problems, please help', which had a more detailed write-up of my problem, as follows:

    As I only reinstalled XP yesterday, there seems to be only 1 minidump in the folder, but I have attached it anyway.

    Many thanks for any help.
     
  2. B00kWyrm

    B00kWyrm TechSpot Paladin Posts: 1,554   +18

    The dump is helpful. It was Avast that crashed the system. This is highly unusual.

    It may indicate a conflict with other installed software. Since I have not seen avast conflict with any known good processes (like firewalls, etc), I am concerned that this may be a possible indicator of malware. This IS one of the possible sources of 0x8e BSODs.

    It may be something else, though, since you did just reinstall XP!

    Just to be safe, I would like to suggest that you take a look at the specialized section of Techspot that deals with malware. See here.

    Those members (volunteers who help as time permits!) who are trained to deal with malware will be better able to help you on this question. Once we are sure your system is clean, then we can look for other issues.

    One of our other BSOD helpers may have other ideas, but this is where I would like you to start.
     
  3. toppa

    toppa TS Rookie Topic Starter

    I have just run a full scan with MalwareBytes and got the all-clear.

    I will work my way through the others.

    However, I just this second had another BSOD - I've attached the minidump in case it's different from the last time and if any more clues can be found.

    Thanks again for your help.
     
  4. B00kWyrm

    B00kWyrm TechSpot Paladin Posts: 1,554   +18

    This time your firewall was involved.

    I strongly urge you to follow the 8 steps carefully, and post your results in a new thread in that subforum of Techspot.
    I am not (yet) qualified to help you with malware, but others are.
    And I strongly suspect this is what is giving you problems.

    When you post your logs, you can refer to this thread for background for your helper.
    They will be interested that you attempted to do a clean install and are still experiencing difficulties.
    You should also read the other stickies(by Julio) at the top of that board. They provide additional helpful information.
     
  5. Bobbye

    Bobbye Helper on the Fringe Posts: 16,392   +36

    Windows XP has a great way to find 'causes'- you mentioned it once: finding the Error in the Event Viewer that corresponds with the time of the crash: I don't do the minidumps so rely heavily on this- or information taken for both can be helpful:

    Start> Run> type in eventvwr

    Do this on each the System and the Applications logs:

    • [1]. Click to open the log>
      [2]. Look for the Error>
      [3] .Right click on the Error> Properties>
      [4]. Click on Copy button, top right, below the down arrow >
      [5]. Paste here (Ctrl V)
      [6].NOTES
    • You can ignore Warnings and Information Events.
    • If you have a recurring Error with same ID#, same Source and same Description, only one copy is needed.
    • You don't need to include the lines of code in the box below the Description, if any.
    • Please do not copy the entire Event log.

    Errors are time coded. Check the computer clock on freeze.

    There are 3 parts to the Error: the ID#, the Source and the description. Taking them together can often lead to a resolution. You have obviously done some searching and taken some actions. But it's best to do as much troubleshooting as possible before taking the actions.

    Your Error will look similar to this: (I omitted some info I didn't need)
    Event Error ID# 1003
    Source: System Error
    Description: Error code 1000008e, parameter1,c0000005, parameter2 bf8713ef, parameter3 ef1deb7c, parameter4 00000000.

    Most of the problems leading to this event indicate faulty hardware, bugs in device drivers or incompatible hardware.


    Here's one possibility for 0x8E: http://support.microsoft.com/default.aspx?scid=kb;en-us;894061
    And another: http://support.microsoft.com/default.aspx?scid=kb;en-us;898542
    And another: http://support.microsoft.com/default.aspx?scid=kb;en-us;907966

    These relate to hotfixes for the Windows Sever.

    I suggest you stop reinstalling the OS and look for cause. It sounds like on the reinstall, you are just carrying the problem along with it.

    One other good place to look is in the Device Manager. You will be looking for a yellow triangle with black ! point in it, indicating an Error:
    Start> Run> type in devmgmt.msc
     
  6. toppa

    toppa TS Rookie Topic Starter

    Thanks for your help.

    To B00kWyrm: I tried to run the 8 steps of the malware check, however each time I run one of the checks, Windows Explorer crashes and closes the malware scanner. So it seems I've hit a dead-end with regard to that for the time being!

    I forgot to mention in my first post that since I've reinstalled XP, my DVD trays won't open by clicking the button on my PC button - I can get around this by using the 'eject' feature in My Computer, but I guess this might be a related problem.

    Bobbye - sadly I've had to have Event Viewer as a permanent desktop shortcut recently, such has been the frequency of the errors!

    There have been tens and tens of Application and System errors since I reinstalled XP on Wednesday, but I'll do my best to post up the error logs now:


    System Errors

    -------------------------------------------------------------------------------------------
    Event Type: Error
    Event Source: BITS
    Event ID: 16391
    The BITS job list is not in a recognized format. It may have been created by a different version of BITS. The job list has been cleared.
    -------------------------------------------------------------------------------------------
    Event Type: Error
    Event Source: sr
    Event ID: 1
    The System Restore filter encountered the unexpected error '0xC000000D' while processing the file 'MSI7357c.tmp' on the volume 'HarddiskVolume1'. It has stopped monitoring the volume.
    -------------------------------------------------------------------------------------------
    Event Type: Error
    Event Source: PSched
    Event ID: 14107
    Description:
    QoS [Adapter NDISWANIP]:
    The Packet Scheduler could not initialize the virtual miniport with NDIS.
    -------------------------------------------------------------------------------------------
    Event Type: Error
    Event Source: System Error
    Event Category: (102)
    Event ID: 1003
    Description:
    Error code 1000008e, parameter1 c0000005, parameter2 7e5bbc78, parameter3 b3e38c10, parameter4 00000000.
    -------------------------------------------------------------------------------------------
    **This is only slightly different to the last one.***

    Event Type: Error
    Event Source: System Error
    Event Category: (102)
    Event ID: 1003
    Description:
    Error code 1000008e, parameter1 c0000005, parameter2 7e5bbc78, parameter3 b3b31c10, parameter4 00000000.

    -------------------------------------------------------------------------------------------


    Application Errors


    Event Type: Error
    Event Source: Application Error
    Event Category: (100)
    Event ID: 1000
    Description:
    Faulting application explorer.exe, version 6.0.2900.5512, faulting module unknown, version 0.0.0.0, fault address 0x75f17d6a.

    **This has happened on multiple occasions***
    -------------------------------------------------------------------------------------------
    Event Type: Error
    Event Source: Application Error
    Event Category: (100)
    Event ID: 1000
    Description:
    Faulting application drwtsn32.exe, version 5.1.2600.0, faulting module dbghelp.dll, version 5.1.2600.5512, fault address 0x0001295d.

    **This has happened on multiple occasions***
    -------------------------------------------------------------------------------------------
    Event Type: Error
    Event Source: Application Error
    Event Category: (100)
    Event ID: 1000
    Description:
    Faulting application explorer.exe, version 6.0.2900.5512, faulting module unknown, version 0.0.0.0, fault address 0x75f17d6a.

    **This has happened on multiple occasions***
    -------------------------------------------------------------------------------------------
    Event Type: Error
    Event Source: Application Error
    Event Category: (100)
    Event ID: 1000
    Description:
    Faulting application drwtsn32.exe, version 5.1.2600.0, faulting module dbghelp.dll, version 5.1.2600.5512, fault address 0x0001295d.

    **This has happened on multiple occasions***
    -------------------------------------------------------------------------------------------
    Event Type: Error
    Event Source: Application Error
    Event Category: (100)
    Event ID: 1000
    Description:
    Faulting application taskmgr.exe, version 5.1.2600.5512, faulting module unknown, version 0.0.0.0, fault address 0x75f17d6a.
    -------------------------------------------------------------------------------------------
    Event Type: Error
    Event Source: Application Hang
    Event Category: (101)
    Event ID: 1002
    Description:
    Hanging application taskmgr.exe, version 5.1.2600.5512, hang module hungapp, version 0.0.0.0, hang address 0x00000000.
    -------------------------------------------------------------------------------------------
    Event Type: Error
    Event Source: Application Error
    Event Category: (100)
    Event ID: 1000
    Description:
    Faulting application , version 0.0.0.0, faulting module unknown, version 0.0.0.0, fault address 0x00000000.
    -------------------------------------------------------------------------------------------
    Event Type: Error
    Event Source: Application Error
    Event Category: None
    Event ID: 1000
    Description:
    Faulting application ashavast.exe, version 4.8.1351.0, faulting module unknown, version 0.0.0.0, fault address 0x75f17d6a.
    -------------------------------------------------------------------------------------------
    Event Type: Error
    Event Source: Application Error
    Event Category: None
    Event ID: 1000
    Description:
    Faulting application wmplayer.exe, version 10.0.0.3931, faulting module unknown, version 0.0.0.0, fault address 0x00460029.
    -------------------------------------------------------------------------------------------
    Event Type: Error
    Event Source: Application Error
    Event Category: None
    Event ID: 1000
    Date: 20/08/2009
    Time: 21:49:19
    User: N/A
    Computer: SNA123456789
    Description:
    Faulting application wmplayer.exe, version 10.0.0.3931, faulting module jscript.dll, version 5.8.6001.18702, fault address 0x00025b24.
    -------------------------------------------------------------------------------------------
    Event Type: Error
    Event Source: Application Error
    Event Category: (100)
    Event ID: 1000
    Description:
    Faulting application mspaint.exe, version 5.1.2600.5512, faulting module unknown, version 0.0.0.0, fault address 0x75f17d6a.
    -------------------------------------------------------------------------------------------
    Event Type: Error
    Event Source: Application Hang
    Event Category: (101)
    Event ID: 1002
    Description:
    Hanging application chrome.exe, version 0.0.0.0, hang module hungapp, version 0.0.0.0, hang address 0x00000000.
    -------------------------------------------------------------------------------------------


    Phew! Hopefully all of the above can provide some clues as to the problem(s).

    Thanks again, I really appreciate your help.
     
  7. B00kWyrm

    B00kWyrm TechSpot Paladin Posts: 1,554   +18

    :grinthumbGood Points, Bobbye. Thank You.:approve:
    I do not often use Event Viewer, simply because I like the more complete information in the Minidumps.
    There are times when minidumps are not available that the Event Viewer can then be an absolute lifesaver,
    and there are others who are better at dealing with Event Viewer reports. Some here are better with the minidumps too. :rolleyes:

    Absolutely right about
    Since the minidumps specifically pointed to the AV and Firewall, and since these -normally- do not misbehave without malware intrusions, I pointed the OP to the Malware board. I am suspecting that the misbehaving driver is malware, and that the AV and Firewall are what are failing, resulting in BSOD.

    If the minidumps had said something else, I would have pointed in another direction.
    For the sake of the OP, I would love to be wrong on this guess.

    All readers... please note... I am not trying to help resolve a malware issue... :)
    I only suspect that there may be one present, and I am trying to point the OP to the proper help on this board.
     
  8. Bobbye

    Bobbye Helper on the Fringe Posts: 16,392   +36

    B00kWyrm, you can send me one of those animated replies anytime!

    I am still inclined to think the major problem is hardware. He says his RM is good, but it fails the memtest. So the question about bad sockets in the motherboard should be considered. You are at an advantage because I can't open or read minidumps!

    Consider that he has reinstalled Windows XP. He uninstalled then reinstalled 2 browsers- And still has the problem, I'd like to see what shows in the Event Viewer. While you are correct that both antivirus and firewall problems would point to malware, I think he also needs to rule out the hardware problem. If it was 'just malware' the OS reinstall should have handled it.

    Here's a heads up on an Explorer crash. If the files are set to show hidden files and folders and left with that setting, it can cause Explorer to crash- for seemingly an unknown reason.
     
  9. B00kWyrm

    B00kWyrm TechSpot Paladin Posts: 1,554   +18

    hmmm... Good Catch, Bobbye!
    I failed to connect this thread with my two posts in the previous thread... I only read his top post here...

    Okay Toppa... if you are still with us...
    • for now stop chasing the possibility of Malware...
    • We do need to get back to the issue of Failing Memtest.
    Are you still here?

    In the previous thread I had posted...
    You have replied with memory dumps... unfortunately they do not confirm what memtest is telling us. There are other codes that often indicate bad memory. And sometimes WinDbg will specifically spell out "corrupted memory". These did not appear here.

    So... back to the original questions...
    Overclocking? Voltages?
    I have seen failing PSU's cause memory errors. Even if your clock and voltages are set properly in BIOS...
    Sometimes a tool like "Speed Fan" or "Everest" might help isolate a PSU problem.
    Others here are better with those tools.
    When you replaced ram, did you get modules that were listed in the Hardware Compatibility list for your Motherboard?
    Some boards are very picky. And some ram is better than others.
    Route 44 can make some good recommendations here, if he will take a look.
    But, to see if this might be a problem we need to know the maker and model of both MB and RAM.
    Don't just assume that it is bad yet. AND, if it is, you may be able to RMA it.


    Are you using a PCI video card or "on board graphics"?
    Wondering if we might be able to isolate the issue a little further by pulling the video card.
     
  10. B00kWyrm

    B00kWyrm TechSpot Paladin Posts: 1,554   +18

    Sheesh... something weird is going on for me today...
    Only NOW does post 6 show up with all the events.

    Bobbye... What do you think of having him run Driver Verifier? Do you think this would be fruitful at this point?
    Note, I am still concerned about the hardware... PSU seems a distinct possibility...
    Another memory issue recently resolved to bad capacitors on the motherboard.
    Some boards were known for this issue. I don't remember now who was talking about this.
     
  11. Bobbye

    Bobbye Helper on the Fringe Posts: 16,392   +36

    I don't know if we can save it. This error alone is serious: From TechNet:
    Microsoft Technet doesn't even offer informtion on this, let alone a fix!

    Run the System File Checker

    Start> Run type in Go to the Run box on the Start Menu and type in:
    sfc /scannow ( sfc if not recognized) (Note that there is a space between sfc and /scannow)

    This command will immediately initiate the Windows File Protection service to scan all protected files and verify their integrity, replacing any files with which it finds a problem.

    In all likelihood you will be prompted to insert the Windows XP CD so have it handy.

    I'd like you to try to manually set a restore point: All Programs> Accessories> System Tools System Restore> CHECK 'create a new restore point'> next> give it a name> OK. That "might" get SR to kick back in.

    I think we can ignore the faulting and hanging apps for now. But I would take everything off of the Startup menu except the antivirus and touchpad if you have a laptop:

    Start> Run> type in msconfig> enter> Selective Startup> Startup tag> Uncheck all but the AV> Apply> OK.

    NOTE: when you reboot the first time after doing this, you'll get a nag message you can ignore and close after checking 'don't show this message again.' Stay in Selective Startup.

    See how this goes. You have some serious problems and my next suggestion is to take it in to a shop- and I almost never suggest that!

    B00k, feel free to add.
     
     
  12. toppa

    toppa TS Rookie Topic Starter

    Hi guys,

    Still here!

    This doesn't sound good, you're right!

    I'll try to work my way through some of your points.

    The 'show hidden files and folders' option is unchecked, so this can't be the cause. Useful tip though - I'll keep that in mind.

    When I bought my new RAM, I was recommended by many people to use Crucial.com - they have an in-site scanner that scans your motherboard and recommends a specific type of new RAM accordingly. As such, the new RAM I bought was their own brand, 2 x CT12864AA667 1GB, 240-pin DIMM sticks. My motherboard is a Packard Bell Cuba MS-730 - the RAM was automatically selected for me by this site using my MB as a starting point.

    My video card is a nVidia GeForce 8500 GT - so not onboard graphics.

    My system isn't overclocked. I've run SpeedFan, as recommended, and all temperatures are between 40-60 - which seems average according to a quick google search (although I could be wrong!)

    I've changed to selective startup through msconfig and setting a new restore point didn't seem to be a problem.

    Edit: I've just rebooted for the first time using Selective Startup, with no joy. Upon entering XP, I was almost instantly met with the usual 'Windows Explorer has to close' and the Dr. Watson error message. Sigh.
     
  13. Bobbye

    Bobbye Helper on the Fringe Posts: 16,392   +36

    I'd still suggest you run the SFC.

    Another diagnostic option would be Safe Mode: As you probably know, when booting in to Safe Mode, there are processes that do not start. It is one of the diagnostic ways to pinpoint a source of a problem.

    Boot into Safe Mode
    • Restart your computer and start pressing the F8 key on your keyboard.
    • Select the Safe Mode option when the Windows Advanced Options menu appears, and then press ENTER.

    If a symptom does not reappear when you start in safe mode, you can eliminate the default settings and minimum device drivers as possible causes. If a newly added device or a changed driver is causing problems, you can use safe mode to remove the device or reverse the change.

    Using Safe Mode to determine a basic source of a problem:The choices:
    • Safe Mode: Loads the minimum set of device drivers (serial or PS/2 mouse devices, standard keyboards, hard disks, CD-ROM drives, and standard VGA devices)and system services required to start Windows XP/2000/2003.(Event Log, Plug and Play, remote procedure calls (RPCs), and Logical Disk Manager.) User specific startup programs do not run. This is helpful in determining whether problems are due to specific programs.
    • Safe Mode with Networking: Includes the services and drivers needed for network connectivity. Safe mode with networking enables logging on to the network, logon scripts, security, and Group Policy settings. Nonessential services and startup programs not related to networking do not run. Helpful if needed but should be used with caution as the security programs don't load in this mode.
    • Safe Mode with Command Prompt: Starts the computer in safe mode, but displays the command prompt rather than the Windows GUI interface.
    • Last Known Good Configuration, which starts your computer using the registry information that was saved at the last shutdown.

    So by using the different options of Safe Mode, you can sometimes determine what the area of problem is- and isn't.
     
Topic Status:
Not open for further replies.


Add New Comment

TechSpot Members
Login or sign up for free,
it takes about 30 seconds.
You may also...


Get complete access to the TechSpot community. Join thousands of technology enthusiasts that contribute and share knowledge in our forum. Get a private inbox, upload your own photo gallery and more.