TechSpot

BSOD Memory Problems

By Get a Mac
Nov 14, 2006
  1. Hi,

    I have Windows XP on a Thinkpad with 512 MB RAM preinstalled and one additional 1024 MB RAM chip. The system worked perfectly for over a year. Unfortunately, I suddenly started getting BSODs even though I installed no new hardware or software. I removed the 1024 MB chip and the errors stopped. I then ordered a new chip, but I quickly got the same "memory_corruption" BSODs, so I removed the new faulty 1024 MB chip. Unfortunately, now I get new BSODs about once a day, even with just the one MB chip. I followed all the steps you listed to no avail.

    I am attaching some Bugcheck analyses. Mini111306-01 is a BSOD with both sticks of memory. The remaining errors are with just the 512 MB system RAM. The errors with both RAM chips are usually IRQL_NOT_LESS_OR_EQUAL, and the errors with only the 512 MB chip are usually BAD_POOL_CALLER or KERNEL_MODE_EXCEPTION_NOT_HANDLED_M.

    Thanks so much for all the help! Next time, I'll get a Mac and save me (and you) the trouble.
     

    Attached Files:

  2. xxdanielxx

    xxdanielxx TS Rookie Posts: 1,069

    do as listed below and post results

    kd> .bugcheck[Lists bugcheck data.]
    Bugcheck code 0000000a
    Arguments 00000000 0000001c 00000000 00000000

    kd> kb[Lists the stack trace.]
    ChildEBP RetAddr Args to Child
    8013ed5c 801263ba 00000000 00000000 e12ab000 NT!_DbgBreakPoint
    8013eecc 801389ee 0000000a 00000000 0000001c NT!_KeBugCheckEx+0x194
    8013eecc 00000000 0000000a 00000000 0000001c NT!_KiTrap0E+0x256
    8013ed5c 801263ba 00000000 00000000 e12ab000
    8013ef64 00000246 fe551aa1 ff690268 00000002 NT!_KeBugCheckEx+0x194

    kd> kv[Lists the trap frames.]
    ChildEBP RetAddr Args to Child
    8013ed5c 801263ba 00000000 00000000 e12ab000 NT!_DbgBreakPoint (FPO: [0,0,0])
    8013eecc 801389ee 0000000a 00000000 0000001c NT!_KeBugCheckEx+0x194
    8013eecc 00000000 0000000a 00000000 0000001c NT!_KiTrap0E+0x256 (FPO: [0,0] TrapFrame @ 8013eee8)
    8013ed5c 801263ba 00000000 00000000 e12ab000
    8013ef64 00000246 fe551aa1 ff690268 00000002 NT!_KeBugCheckEx+0x194

    kd> .trap 8013eee8 [Gets the registers for the trap frame at the time of the fault.]
    eax=dec80201 ebx=ffdff420 ecx=8013c71c edx=000003f8 esi=00000000 edi=87038e10
    eip=00000000 esp=8013ef5c ebp=8013ef64 iopl=0 nv up ei pl nz na pe nc
    cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010202
    ErrCode = 00000000
    00000000 ??????????????? [The current instruction pointer is NULL.]

    kd> kb [Gives the stack trace before the fault.]
    ChildEBP RetAddr Args to Child
    8013ef68 fe551aa1 ff690268 00000002 fe5620d2 NT!_DbgBreakPoint
    8013ef74 fe5620d2 fe5620da ff690268 80404690
    NDIS!_EthFilterIndicateReceiveComplete+0x31
    8013ef64 00000246 fe551aa1 ff690268 00000002 elnkii!_ElnkiiRcvInterruptDpc+0x1d0
    __________________
     
  3. Get a Mac

    Get a Mac TS Rookie Topic Starter

    Hi xxdanielxx,

    Here's the data you requested. The first minidump is with both RAM chips, and it looks like a RAM problem. The other two dumps include just the one factory installed RAM chip. I have lots of additional minidumps (unfortunately); if they would be useful, just ask.

    Thanks so much!


    1. IRQL_NOT_LESS_OR_EQUAL (a)

    kd> .bugcheck
    Bugcheck code 1000000A
    Arguments fef7ffff 00000002 00000000 8050a526
    kd> kb
    ChildEBP RetAddr Args to Child
    ba51fd3c 8050af09 8238a350 00064b8c 00000014 nt!MiGatherMappedPages+0x1a
    ba51fd74 80642453 00000000 8a2aab30 00000000 nt!MiModifiedPageWriterWorker+0x1c7
    ba51fdac 805c4a24 00000000 00000000 00000000 nt!MiModifiedPageWriter+0x165
    ba51fddc 80540fb2 806422ee 00000000 00000000 nt!PspSystemThreadStartup+0x34
    00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16
    kd> kv
    ChildEBP RetAddr Args to Child
    ba51fd3c 8050af09 8238a350 00064b8c 00000014 nt!MiGatherMappedPages+0x1a (FPO: [Non-Fpo])
    ba51fd74 80642453 00000000 8a2aab30 00000000 nt!MiModifiedPageWriterWorker+0x1c7 (FPO: [Non-Fpo])
    ba51fdac 805c4a24 00000000 00000000 00000000 nt!MiModifiedPageWriter+0x165 (FPO: [Non-Fpo])
    ba51fddc 80540fb2 806422ee 00000000 00000000 nt!PspSystemThreadStartup+0x34 (FPO: [Non-Fpo])
    00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16
    kd> .trap
    kd> kb
    ChildEBP RetAddr Args to Child
    ba51fd3c 8050af09 8238a350 00064b8c 00000014 nt!MiGatherMappedPages+0x1a
    ba51fd74 80642453 00000000 8a2aab30 00000000 nt!MiModifiedPageWriterWorker+0x1c7
    ba51fdac 805c4a24 00000000 00000000 00000000 nt!MiModifiedPageWriter+0x165
    ba51fddc 80540fb2 806422ee 00000000 00000000 nt!PspSystemThreadStartup+0x34
    00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16


    2. BAD_POOL_CALLER (c2)
    kd> .bugcheck
    Bugcheck code 000000C2
    Arguments 00000040 00000000 80000000 00000000
    kd> kb
    ChildEBP RetAddr Args to Child
    f82eabb0 805429ed 000000c2 00000040 00000000 nt!KeBugCheckEx+0x1b
    f82eabf0 80543b9d 00000000 00000005 e1621518 nt!MiFreePoolPages+0x8b
    f82eac30 80629fd5 00000000 00000000 e1553ef0 nt!ExFreePoolWithTag+0x1b7
    f82eac4c 8062a5e8 e1621518 e1553ef0 e102aba4 nt!CmpCleanUpKcbValueCache+0x3d
    f82eac60 806312a2 e1621518 e1a2e008 806313be nt!CmpCleanUpKcbCacheWithLock+0x1a
    f82eac6c 806313be f82eac80 8062a6de e1553ef0 nt!CmpGetDelayedCloseIndex+0x16
    f82eac74 8062a6de e1553ef0 f82eac8c 8062aac6 nt!CmpAddToDelayedClose+0xa
    f82eac80 8062aac6 e1553ef0 f82eaca4 8062bbc6 nt!CmpDereferenceKeyControlBlockWithLock+0x38
    f82eac8c 8062bbc6 e1553ef0 00000000 e1d670e8 nt!CmpDereferenceKeyControlBlock+0x12
    f82eaca4 805af537 e1d67100 e1d670e8 00000000 nt!CmpDeleteKeyObject+0x92
    f82eacc0 80521e5b e1d67100 00000000 000003f0 nt!ObpRemoveObjectRoutine+0xdf
    f82eace4 805b0537 82c52a10 e14b97a8 82ac3a18 nt!ObfDereferenceObject+0x5f
    f82eacfc 805b05cd e14b97a8 e1d67100 000003f0 nt!ObpCloseHandleTableEntry+0x155
    f82ead44 805b0705 000003f0 00000001 00000000 nt!ObpCloseHandle+0x87
    f82ead58 8053c818 000003f0 00acf1a8 7c90eb94 nt!NtClose+0x1d
    f82ead58 7c90eb94 000003f0 00acf1a8 7c90eb94 nt!KiFastCallEntry+0xf8
    WARNING: Frame IP not in any known module. Following frames may be wrong.
    00acf1a8 00000000 00000000 00000000 00000000 0x7c90eb94
    kd> kv
    ChildEBP RetAddr Args to Child
    f82eabb0 805429ed 000000c2 00000040 00000000 nt!KeBugCheckEx+0x1b (FPO: [Non-Fpo])
    f82eabf0 80543b9d 00000000 00000005 e1621518 nt!MiFreePoolPages+0x8b (FPO: [Non-Fpo])
    f82eac30 80629fd5 00000000 00000000 e1553ef0 nt!ExFreePoolWithTag+0x1b7 (FPO: [Non-Fpo])
    f82eac4c 8062a5e8 e1621518 e1553ef0 e102aba4 nt!CmpCleanUpKcbValueCache+0x3d (FPO: [Non-Fpo])
    f82eac60 806312a2 e1621518 e1a2e008 806313be nt!CmpCleanUpKcbCacheWithLock+0x1a (FPO: [Non-Fpo])
    f82eac6c 806313be f82eac80 8062a6de e1553ef0 nt!CmpGetDelayedCloseIndex+0x16 (FPO: [0,0,0])
    f82eac74 8062a6de e1553ef0 f82eac8c 8062aac6 nt!CmpAddToDelayedClose+0xa (FPO: [Non-Fpo])
    f82eac80 8062aac6 e1553ef0 f82eaca4 8062bbc6 nt!CmpDereferenceKeyControlBlockWithLock+0x38 (FPO: [Non-Fpo])
    f82eac8c 8062bbc6 e1553ef0 00000000 e1d670e8 nt!CmpDereferenceKeyControlBlock+0x12 (FPO: [Non-Fpo])
    f82eaca4 805af537 e1d67100 e1d670e8 00000000 nt!CmpDeleteKeyObject+0x92 (FPO: [Non-Fpo])
    f82eacc0 80521e5b e1d67100 00000000 000003f0 nt!ObpRemoveObjectRoutine+0xdf (FPO: [Non-Fpo])
    f82eace4 805b0537 82c52a10 e14b97a8 82ac3a18 nt!ObfDereferenceObject+0x5f (FPO: [Non-Fpo])
    f82eacfc 805b05cd e14b97a8 e1d67100 000003f0 nt!ObpCloseHandleTableEntry+0x155 (FPO: [Non-Fpo])
    f82ead44 805b0705 000003f0 00000001 00000000 nt!ObpCloseHandle+0x87 (FPO: [Non-Fpo])
    f82ead58 8053c818 000003f0 00acf1a8 7c90eb94 nt!NtClose+0x1d (FPO: [Non-Fpo])
    f82ead58 7c90eb94 000003f0 00acf1a8 7c90eb94 nt!KiFastCallEntry+0xf8 (FPO: [0,0] TrapFrame @ f82ead64)
    WARNING: Frame IP not in any known module. Following frames may be wrong.
    00acf1a8 00000000 00000000 00000000 00000000 0x7c90eb94
    kd> .trap f82ead64
    ErrCode = 00000000
    eax=00000000 ebx=00e5ff78 ecx=00acf0a8 edx=00000063 esi=00acf1bc edi=00000000
    eip=7c90eb94 esp=00acf198 ebp=00acf1a8 iopl=0 nv up ei pl zr na pe nc
    cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000246
    001b:7c90eb94 ?? ???
    kd> kb
    *** Stack trace for last set context - .thread/.cxr resets it
    ChildEBP RetAddr Args to Child
    WARNING: Frame IP not in any known module. Following frames may be wrong.
    00acf1a8 00000000 00000000 00000000 00000000 0x7c90eb94


    3. KERNEL_MODE_EXCEPTION_NOT_HANDLED_M (1000008e)
    kd> .bugcheck
    Bugcheck code 1000008E
    Arguments c0000005 80543e61 f35c6bb0 00000000
    kd> kb
    ChildEBP RetAddr Args to Child
    f35c6c58 80629fd5 e16126b0 00000000 0000067b nt!ExFreePoolWithTag+0x47b
    f35c6c74 8062a5e8 e39f2b00 0000067b e39f2b00 nt!CmpCleanUpKcbValueCache+0x3d
    f35c6c88 8062a71d e39f2b00 e2bfbb60 e27900e0 nt!CmpCleanUpKcbCacheWithLock+0x1a
    f35c6c98 8062a745 e27900e0 f35c6cc0 80627c3e nt!CmpCleanUpKCBCacheTable+0x2d
    f35c6ca4 80627c3e e27900e0 00000000 00000020 nt!CmpSearchForOpenSubKeys+0xb
    f35c6cc0 8061770c e2bfbb60 00000020 e27900e0 nt!CmUnloadKey+0x32
    f35c6d58 8053c818 0006faec 0006fb04 7c90eb94 nt!NtUnloadKey+0x18c
    f35c6d58 7c90eb94 0006faec 0006fb04 7c90eb94 nt!KiFastCallEntry+0xf8
    WARNING: Frame IP not in any known module. Following frames may be wrong.
    0006fb04 00000000 00000000 00000000 00000000 0x7c90eb94
    kd> kv
    ChildEBP RetAddr Args to Child
    f35c6c58 80629fd5 e16126b0 00000000 0000067b nt!ExFreePoolWithTag+0x47b (FPO: [Non-Fpo])
    f35c6c74 8062a5e8 e39f2b00 0000067b e39f2b00 nt!CmpCleanUpKcbValueCache+0x3d (FPO: [Non-Fpo])
    f35c6c88 8062a71d e39f2b00 e2bfbb60 e27900e0 nt!CmpCleanUpKcbCacheWithLock+0x1a (FPO: [Non-Fpo])
    f35c6c98 8062a745 e27900e0 f35c6cc0 80627c3e nt!CmpCleanUpKCBCacheTable+0x2d (FPO: [0,0,0])
    f35c6ca4 80627c3e e27900e0 00000000 00000020 nt!CmpSearchForOpenSubKeys+0xb (FPO: [Non-Fpo])
    f35c6cc0 8061770c e2bfbb60 00000020 e27900e0 nt!CmUnloadKey+0x32 (FPO: [Non-Fpo])
    f35c6d58 8053c818 0006faec 0006fb04 7c90eb94 nt!NtUnloadKey+0x18c (FPO: [Non-Fpo])
    f35c6d58 7c90eb94 0006faec 0006fb04 7c90eb94 nt!KiFastCallEntry+0xf8 (FPO: [0,0] TrapFrame @ f35c6d64)
    WARNING: Frame IP not in any known module. Following frames may be wrong.
    0006fb04 00000000 00000000 00000000 00000000 0x7c90eb94
    kd> .trap f35c6d64
    ErrCode = 00000000
    eax=0006fb1c ebx=00000600 ecx=0006fb1c edx=77e46180 esi=00000000 edi=00000000
    eip=7c90eb94 esp=0006fae0 ebp=0006fb04 iopl=0 nv up ei pl zr na pe nc
    cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000246
    001b:7c90eb94 ?? ???
    kd> kb
    *** Stack trace for last set context - .thread/.cxr resets it
    ChildEBP RetAddr Args to Child
    WARNING: Frame IP not in any known module. Following frames may be wrong.
    0006fb04 00000000 00000000 00000000 00000000 0x7c90eb94
     
  4. xxdanielxx

    xxdanielxx TS Rookie Posts: 1,069

    the first one is bad memory wich is the old ram have you tested the new ram just to be safe download memtest86 from memtest86.com. the next minidump point to 0xc2 wich is most likely bad ram. the last one points to 1x8e wich is the same as 0x8e wich means

    A kernel mode program generated an exception which the error handler didn’t catch. These are nearly always hardware compatibility issues (which sometimes means a driver issue or a need for a BIOS upgrade). look to see if there is an update for your bios and test the rams you have
     
  5. Get a Mac

    Get a Mac TS Rookie Topic Starter

    Thanks for the reply.

    I'm worried it's more than RAM that's the problem.

    1. The first error above is from the new RAM. (I got similar errors with the old RAM.)

    2. I ran MemTest on 3 different DIMMs and found no errors.

    3. I had no problems for over 1 year. I find it difficult to believe that the two original DIMMs as well as one new DIMM all failed within 1 month.

    At the very least, am I safe to assume that this is a hardware issue and not software? I already updated to the latest BIOS, and I don't see any driver issues. Thanks again!
     
  6. xxdanielxx

    xxdanielxx TS Rookie Posts: 1,069

    bsod are caused by hardware problems such as lan card,video card, ram,hdd and so on. the only thing is that your minidumps are pointing to memory coruption wich is ram and also the BC point to ram. You said you have more minidumps can you analyze some of them using the same method above as the first time not the way i ask the way u did them. use the newest minidumps if you have not
     
  7. Get a Mac

    Get a Mac TS Rookie Topic Starter

    Here are two more. Thanks!


    4. BAD_POOL_CALLER (c2)
    kd> .bugcheck
    Bugcheck code 000000C2
    Arguments 00000040 00000000 80000000 00000000
    kd> kb
    ChildEBP RetAddr Args to Child
    efd5bbb0 805429ed 000000c2 00000040 00000000 nt!KeBugCheckEx+0x1b
    efd5bbf0 80543b9d 00000000 0000000b e3ad5830 nt!MiFreePoolPages+0x8b
    efd5bc30 80629fd5 00000000 00000000 e2793a28 nt!ExFreePoolWithTag+0x1b7
    efd5bc4c 8062a5e8 e3ad5830 e2793a28 e102c800 nt!CmpCleanUpKcbValueCache+0x3d
    efd5bc60 806312a2 e3ad5830 e2273b60 806313be nt!CmpCleanUpKcbCacheWithLock+0x1a
    efd5bc6c 806313be efd5bc80 8062a6de e2793a28 nt!CmpGetDelayedCloseIndex+0x16
    efd5bc74 8062a6de e2793a28 efd5bc8c 8062aac6 nt!CmpAddToDelayedClose+0xa
    efd5bc80 8062aac6 e2793a28 efd5bca4 8062bbc6 nt!CmpDereferenceKeyControlBlockWithLock+0x38
    efd5bc8c 8062bbc6 e2793a28 00000000 e36a91b0 nt!CmpDereferenceKeyControlBlock+0x12
    efd5bca4 805af537 e36a91c8 e36a91b0 00000000 nt!CmpDeleteKeyObject+0x92
    efd5bcc0 80521e5b e36a91c8 00000000 00000282 nt!ObpRemoveObjectRoutine+0xdf
    efd5bce4 805b0537 ff073320 e27f5b10 ff5f6870 nt!ObfDereferenceObject+0x5f
    efd5bcfc 805b05cd e27f5b10 e36a91c8 00000282 nt!ObpCloseHandleTableEntry+0x155
    efd5bd44 805b0705 00000282 00000001 00000000 nt!ObpCloseHandle+0x87
    efd5bd58 8053c818 00000282 0012df0c 7c90eb94 nt!NtClose+0x1d
    efd5bd58 7c90eb94 00000282 0012df0c 7c90eb94 nt!KiFastCallEntry+0xf8
    WARNING: Frame IP not in any known module. Following frames may be wrong.
    0012df0c 00000000 00000000 00000000 00000000 0x7c90eb94
    kd> kv
    ChildEBP RetAddr Args to Child
    efd5bbb0 805429ed 000000c2 00000040 00000000 nt!KeBugCheckEx+0x1b (FPO: [Non-Fpo])
    efd5bbf0 80543b9d 00000000 0000000b e3ad5830 nt!MiFreePoolPages+0x8b (FPO: [Non-Fpo])
    efd5bc30 80629fd5 00000000 00000000 e2793a28 nt!ExFreePoolWithTag+0x1b7 (FPO: [Non-Fpo])
    efd5bc4c 8062a5e8 e3ad5830 e2793a28 e102c800 nt!CmpCleanUpKcbValueCache+0x3d (FPO: [Non-Fpo])
    efd5bc60 806312a2 e3ad5830 e2273b60 806313be nt!CmpCleanUpKcbCacheWithLock+0x1a (FPO: [Non-Fpo])
    efd5bc6c 806313be efd5bc80 8062a6de e2793a28 nt!CmpGetDelayedCloseIndex+0x16 (FPO: [0,0,0])
    efd5bc74 8062a6de e2793a28 efd5bc8c 8062aac6 nt!CmpAddToDelayedClose+0xa (FPO: [Non-Fpo])
    efd5bc80 8062aac6 e2793a28 efd5bca4 8062bbc6 nt!CmpDereferenceKeyControlBlockWithLock+0x38 (FPO: [Non-Fpo])
    efd5bc8c 8062bbc6 e2793a28 00000000 e36a91b0 nt!CmpDereferenceKeyControlBlock+0x12 (FPO: [Non-Fpo])
    efd5bca4 805af537 e36a91c8 e36a91b0 00000000 nt!CmpDeleteKeyObject+0x92 (FPO: [Non-Fpo])
    efd5bcc0 80521e5b e36a91c8 00000000 00000282 nt!ObpRemoveObjectRoutine+0xdf (FPO: [Non-Fpo])
    efd5bce4 805b0537 ff073320 e27f5b10 ff5f6870 nt!ObfDereferenceObject+0x5f (FPO: [Non-Fpo])
    efd5bcfc 805b05cd e27f5b10 e36a91c8 00000282 nt!ObpCloseHandleTableEntry+0x155 (FPO: [Non-Fpo])
    efd5bd44 805b0705 00000282 00000001 00000000 nt!ObpCloseHandle+0x87 (FPO: [Non-Fpo])
    efd5bd58 8053c818 00000282 0012df0c 7c90eb94 nt!NtClose+0x1d (FPO: [Non-Fpo])
    efd5bd58 7c90eb94 00000282 0012df0c 7c90eb94 nt!KiFastCallEntry+0xf8 (FPO: [0,0] TrapFrame @ efd5bd64)
    WARNING: Frame IP not in any known module. Following frames may be wrong.
    0012df0c 00000000 00000000 00000000 00000000 0x7c90eb94
    kd> .trap efd5bd64
    ErrCode = 00000000
    eax=00000009 ebx=00000000 ecx=0012dae4 edx=00000005 esi=0012df20 edi=7344475e
    eip=7c90eb94 esp=0012defc ebp=0012df0c iopl=0 nv up ei pl zr na pe nc
    cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00240246
    001b:7c90eb94 ?? ???
    kd> kb
    *** Stack trace for last set context - .thread/.cxr resets it
    ChildEBP RetAddr Args to Child
    WARNING: Frame IP not in any known module. Following frames may be wrong.
    0012df0c 00000000 00000000 00000000 00000000 0x7c90eb94


    5. KERNEL_MODE_EXCEPTION_NOT_HANDLED_M (1000008e)
    kd> .bugcheck
    Bugcheck code 1000008E
    Arguments c0000005 80543e61 eeb6ab78 00000000
    kd> kb
    ChildEBP RetAddr Args to Child
    eeb6ac20 805b5373 e1a14270 e56b6f54 82db6cf0 nt!ExFreePoolWithTag+0x47b
    eeb6ac44 805af53f e1a14280 00000000 00000000 nt!ObpFreeObject+0x18d
    eeb6ac5c 80521e5b e1a14298 00000000 0000064c nt!ObpRemoveObjectRoutine+0xe7
    eeb6ac80 805b0537 e1a14281 0000064c e423ac98 nt!ObfDereferenceObject+0x5f
    eeb6ac98 805b6ceb e1c1bd58 e1a14298 0000064c nt!ObpCloseHandleTableEntry+0x155
    eeb6acb8 80602c6b e423ac98 0000064c eeb6ad20 nt!ObpCloseHandleProcedure+0x1f
    eeb6ace8 805b6d4d e1c1bd58 805b6ccc eeb6ad20 nt!ExSweepHandleTable+0x4f
    eeb6ad2c 805c75fa 82031830 eeb6ad64 00b2ffa0 nt!ObClearProcessHandleTable+0x57
    eeb6ad54 8053c818 00000000 c0000005 00b2ffa0 nt!NtTerminateProcess+0x136
    eeb6ad54 7c90eb94 00000000 c0000005 00b2ffa0 nt!KiFastCallEntry+0xf8
    WARNING: Frame IP not in any known module. Following frames may be wrong.
    00b2ffa0 00000000 00000000 00000000 00000000 0x7c90eb94
    kd> kv
    ChildEBP RetAddr Args to Child
    eeb6ac20 805b5373 e1a14270 e56b6f54 82db6cf0 nt!ExFreePoolWithTag+0x47b (FPO: [Non-Fpo])
    eeb6ac44 805af53f e1a14280 00000000 00000000 nt!ObpFreeObject+0x18d (FPO: [Non-Fpo])
    eeb6ac5c 80521e5b e1a14298 00000000 0000064c nt!ObpRemoveObjectRoutine+0xe7 (FPO: [Non-Fpo])
    eeb6ac80 805b0537 e1a14281 0000064c e423ac98 nt!ObfDereferenceObject+0x5f (FPO: [Non-Fpo])
    eeb6ac98 805b6ceb e1c1bd58 e1a14298 0000064c nt!ObpCloseHandleTableEntry+0x155 (FPO: [Non-Fpo])
    eeb6acb8 80602c6b e423ac98 0000064c eeb6ad20 nt!ObpCloseHandleProcedure+0x1f (FPO: [Non-Fpo])
    eeb6ace8 805b6d4d e1c1bd58 805b6ccc eeb6ad20 nt!ExSweepHandleTable+0x4f (FPO: [Non-Fpo])
    eeb6ad2c 805c75fa 82031830 eeb6ad64 00b2ffa0 nt!ObClearProcessHandleTable+0x57 (FPO: [Non-Fpo])
    eeb6ad54 8053c818 00000000 c0000005 00b2ffa0 nt!NtTerminateProcess+0x136 (FPO: [Non-Fpo])
    eeb6ad54 7c90eb94 00000000 c0000005 00b2ffa0 nt!KiFastCallEntry+0xf8 (FPO: [0,0] TrapFrame @ eeb6ad64)
    WARNING: Frame IP not in any known module. Following frames may be wrong.
    00b2ffa0 00000000 00000000 00000000 00000000 0x7c90eb94
    kd> .trap eeb6ad64
    ErrCode = 00000000
    eax=010036cd ebx=00034e40 ecx=00000000 edx=00000000 esi=00034e40 edi=000004f4
    eip=7c90eb94 esp=00b2ff90 ebp=00b2ffa0 iopl=0 nv up ei pl nz na po nc
    cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000202
    001b:7c90eb94 ?? ???
    kd> kb
    *** Stack trace for last set context - .thread/.cxr resets it
    ChildEBP RetAddr Args to Child
    WARNING: Frame IP not in any known module. Following frames may be wrong.
    00b2ffa0 00000000 00000000 00000000 00000000 0x7c90eb94
     
  8. xxdanielxx

    xxdanielxx TS Rookie Posts: 1,069

    if you see you still get the same bugcheck code of 8e and c2 when you bought the ram i know this is going to sound stupid but did you make sure the ram works on your mobo
     
  9. Get a Mac

    Get a Mac TS Rookie Topic Starter

    I know I got the right type of RAM (PC4200 DDR2 SODIMM). Do I also need to check if a particular brand of RAM works with a mobo?

    Moreover, the 0xc2 and 1x8e errors continue with just the factory installed RAM (but not the IRQL errors). I'm thinking I might send the laptop in for warranty repair when I don't need it for a week.

    Thanks again!
     
  10. Get a Mac

    Get a Mac TS Rookie Topic Starter

    New Error

    I just got an error I never saw before. That's not good news. :( I'm posting the minidump below.

    Do you know what is the significance of the string "7c90eb94"? It appeared in all my previous dumps and reappeared here. Thanks!


    DRIVER_CORRUPTED_EXPOOL (c5)
    An attempt was made to access a pageable (or completely invalid) address at an
    interrupt request level (IRQL) that is too high. This is
    caused by drivers that have corrupted the system pool. Run the driver
    verifier against any new (or suspect) drivers, and if that doesn't turn up
    the culprit, then use gflags to enable special pool.
    Arguments:
    Arg1: 0a100005, memory referenced
    Arg2: 00000002, IRQL
    Arg3: 00000000, value 0 = read operation, 1 = write operation
    Arg4: 805437b2, address which referenced memory

    Debugging Details:
    ------------------


    BUGCHECK_STR: 0xC5_2

    CURRENT_IRQL: 2

    FAULTING_IP:
    nt!ExDeferredFreePool+ac
    805437b2 8b08 mov ecx,dword ptr [eax]

    CUSTOMER_CRASH_COUNT: 1

    DEFAULT_BUCKET_ID: DRIVER_FAULT

    PROCESS_NAME: explorer.exe

    LAST_CONTROL_TRANSFER: from 80543e6f to 805437b2

    STACK_TEXT:
    f08be104 80543e6f 0a100005 000000f8 e31bd200 nt!ExDeferredFreePool+0xac
    f08be144 80629fd5 e5392e30 00000000 d792c34c nt!ExFreePoolWithTag+0x489
    f08be160 80627bb3 e31bd200 e5709a80 00000000 nt!CmpCleanUpKcbValueCache+0x3d
    f08be1c4 806174e0 e31bd200 f08be21c 00000001 nt!CmSetValueKey+0x231
    f08be258 f388010e 00001658 029ae1b8 00000000 nt!NtSetValueKey+0x228
    WARNING: Stack unwind information not available. Following frames may be wrong.
    f08be334 8053c818 00001658 029ae1b8 00000000 SYMEVENT+0x1410e
    f08be334 7c90eb94 00001658 029ae1b8 00000000 nt!KiFastCallEntry+0xf8
    029ae190 00000000 00000000 00000000 00000000 0x7c90eb94


    STACK_COMMAND: kb

    FOLLOWUP_IP:
    nt!ExDeferredFreePool+ac
    805437b2 8b08 mov ecx,dword ptr [eax]

    SYMBOL_STACK_INDEX: 0

    FOLLOWUP_NAME: Pool_corruption

    IMAGE_NAME: Pool_Corruption

    DEBUG_FLR_IMAGE_TIMESTAMP: 0

    SYMBOL_NAME: nt!ExDeferredFreePool+ac

    MODULE_NAME: Pool_Corruption

    FAILURE_BUCKET_ID: 0xC5_2_nt!ExDeferredFreePool+ac

    BUCKET_ID: 0xC5_2_nt!ExDeferredFreePool+ac

    Followup: Pool_corruption
    ---------

    kd> .bugcheck
    Bugcheck code 100000C5
    Arguments 0a100005 00000002 00000000 805437b2

    kd> kb
    ChildEBP RetAddr Args to Child
    f08be104 80543e6f 0a100005 000000f8 e31bd200 nt!ExDeferredFreePool+0xac
    f08be144 80629fd5 e5392e30 00000000 d792c34c nt!ExFreePoolWithTag+0x489
    f08be160 80627bb3 e31bd200 e5709a80 00000000 nt!CmpCleanUpKcbValueCache+0x3d
    f08be1c4 806174e0 e31bd200 f08be21c 00000001 nt!CmSetValueKey+0x231
    f08be258 f388010e 00001658 029ae1b8 00000000 nt!NtSetValueKey+0x228
    WARNING: Stack unwind information not available. Following frames may be wrong.
    f08be334 8053c818 00001658 029ae1b8 00000000 SYMEVENT+0x1410e
    f08be334 7c90eb94 00001658 029ae1b8 00000000 nt!KiFastCallEntry+0xf8
    029ae190 00000000 00000000 00000000 00000000 0x7c90eb94

    kd> kv
    ChildEBP RetAddr Args to Child
    f08be104 80543e6f 0a100005 000000f8 e31bd200 nt!ExDeferredFreePool+0xac (FPO: [Non-Fpo])
    f08be144 80629fd5 e5392e30 00000000 d792c34c nt!ExFreePoolWithTag+0x489 (FPO: [Non-Fpo])
    f08be160 80627bb3 e31bd200 e5709a80 00000000 nt!CmpCleanUpKcbValueCache+0x3d (FPO: [Non-Fpo])
    f08be1c4 806174e0 e31bd200 f08be21c 00000001 nt!CmSetValueKey+0x231 (FPO: [Non-Fpo])
    f08be258 f388010e 00001658 029ae1b8 00000000 nt!NtSetValueKey+0x228 (FPO: [Non-Fpo])
    WARNING: Stack unwind information not available. Following frames may be wrong.
    f08be334 8053c818 00001658 029ae1b8 00000000 SYMEVENT+0x1410e
    f08be334 7c90eb94 00001658 029ae1b8 00000000 nt!KiFastCallEntry+0xf8 (FPO: [0,0] TrapFrame @ f08be354)
    029ae190 00000000 00000000 00000000 00000000 0x7c90eb94

    kd> .trap f08be354
    ErrCode = 00000000
    eax=00000808 ebx=00000000 ecx=00000000 edx=005007d1 esi=7c90e7bc edi=00001658
    eip=7c90eb94 esp=029ae14c ebp=029ae190 iopl=0 nv up ei pl zr na pe nc
    cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000246
    001b:7c90eb94 ?? ???

    kd> kb
    *** Stack trace for last set context - .thread/.cxr resets it
    ChildEBP RetAddr Args to Child
    WARNING: Frame IP not in any known module. Following frames may be wrong.
    029ae190 00000000 00000000 00000000 00000000 0x7c90eb94
     
  11. cpc2004

    cpc2004 TS Evangelist Posts: 1,994

    Norton AV

    Hi,

    I find the footprnt of Norton AV at the stack trace. Probably Norton AV is the culprit. What version of Norton AV are you using?

    Issue lm tn within windbg and the attach the output here.
     
  12. Get a Mac

    Get a Mac TS Rookie Topic Starter

    Hi CPC,

    I'm running Symantec Antivirus 10.1.0.394. I'll uninstall and see if it helps. I just got a second BSOD so I'll analyze both and post the results. Thanks!
     
  13. cpc2004

    cpc2004 TS Evangelist Posts: 1,994

    Hi,

    Norton AV 10.1.x has known problem which causes blue screen. Refer Norton AV Web Page
     
  14. Get a Mac

    Get a Mac TS Rookie Topic Starter

    Thanks CPC! This looks promising!

    The lm tn output you asked for is huge and doesn't fit in this message, but I think you set me on the right track. Thanks again!
     
  15. Get a Mac

    Get a Mac TS Rookie Topic Starter

    Hi,

    Unfortunately, it wasn't Symantec and the BSOD's continue. Here are two new BSODs. Thanks for any help.



     
  16. Get a Mac

    Get a Mac TS Rookie Topic Starter

    And here are two more:

     
  17. cpc2004

    cpc2004 TS Evangelist Posts: 1,994

    Hi,

    The first crash is related to hive corrruption (ie registry). It may be caused by faulty ram or the registry is really corrupted.

    STACK_TEXT:
    ef4d3c40 80634c17 e1036b60 ffffffff e37fe5f0 nt!HvpGetCellMapped+0x5f
    ef4d3c5c 806261b7 e1036b60 ffffffff ef4d3c90 nt!CmpGetValueListFromCache+0x33
    ef4d3cb4 8061988c e37fe5f0 00000000 00000001 nt!CmEnumerateValueKey+0x81
    ef4d3d44 8053c818 000000d8 00000000 00000001 nt!NtEnumerateValueKey+0x1ea
    ef4d3d44 7c90eb94 000000d8 00000000 00000001 nt!KiFastCallEntry+0xf8
    WARNING: Frame IP not in any known module. Following frames may be wrong.

    The second crash is related to faulty ram (ie RAM or video RAM).
     
  18. Get a Mac

    Get a Mac TS Rookie Topic Starter

    Hi CPC,

    Is there a way to fix the Registry other than reinstalling XP? Thanks!
     
  19. cpc2004

    cpc2004 TS Evangelist Posts: 1,994

    Hi,

    Procedure to repair Hives
    1. Export the registry for backup purpose
    2. XP registry editor has an inbuilt feature to repair corruption of Hives.

    Refer Microsoft User Profile Hive Cleanup.
     
  20. Get a Mac

    Get a Mac TS Rookie Topic Starter

    Thanks, I'll try it out!
     
  21. Get a Mac

    Get a Mac TS Rookie Topic Starter

    Registry problems

    Maybe I should rename the thread to BSOD Registry Problems.

    I used regedit to backup the HKEYs, but I got a BSOD three times in row while exporting HKEY_LOCAL_MACHINE. The weird thing is that the other four HKEYs export fine. This is the first time something I did triggered the BSODs. Is this consistent with hive corruption or something else? Thanks!

     
  22. cpc2004

    cpc2004 TS Evangelist Posts: 1,994

    Hi,

    Do you mean your windows crashes when you running regedit export? If yes, your registry is corrupted. I believe that your registry maybe corrupted due to faulty ram.
     
  23. Get a Mac

    Get a Mac TS Rookie Topic Starter

    Hi CPC,

    Yes, Windows crashes while exporting, but only for HKEY_LOCAL_MACHINE. I removed the RAM that was clearly faulty, so I don't know why I still get the BSODs
     
  24. cpc2004

    cpc2004 TS Evangelist Posts: 1,994

    Hi,

    When did you replace the faulty ram? If the software hive is corrupted, you have to repair it. Otherwise your windows crashes, when the corrupted software hive are referred by windows.
     
  25. Get a Mac

    Get a Mac TS Rookie Topic Starter

    I had two RAM DIMMs and one had MemTest errors. I removed it over a month ago and the other DIMM tested out ok in Memtest. I have yet to replace the faulty RAM, so now I only use the one DIMM that tested ok.
     
Topic Status:
Not open for further replies.

Similar Topics

Add New Comment

You need to be a member to leave a comment. Join thousands of tech enthusiasts and participate.
TechSpot Account You may also...