TechSpot

Bsod

By tmb
Nov 8, 2007
  1. I'm having a nagging problem that I have tried, but unsuccessful to date to fix and need some help debugging.

    Any help would be appreciated. Thanks in advance.

    Here is results from WinDbg:


    Kernel Summary Dump File: Only kernel address space is available

    Symbol search path is: .
    Executable search path is:
    Windows XP Kernel Version 2600 (Service Pack 2) MP (2 procs) Free x86 compatible
    Product: WinNt, suite: TerminalServer SingleUserTS Personal
    Built by: 2600.xpsp_sp2_gdr.070227-2254
    Kernel base = 0x804d7000 PsLoadedModuleList = 0x805624a0
    Debug session time: Thu Nov 8 20:01:55.921 2007 (GMT-5)
    System Uptime: 0 days 0:16:04.493
    Loading Kernel Symbols
    ................................................................................................................................................
    Loading User Symbols

    Loading unloaded module list
    ............
    *******************************************************************************
    * *
    * Bugcheck Analysis *
    * *
    *******************************************************************************

    Use !analyze -v to get detailed debugging information.

    BugCheck 7E, {c0000005, 0, f78fac58, f78fa954}

    Probably caused by : ntkrnlmp.exe ( nt!ObpRemoveObjectRoutine+c3 )

    Followup: MachineOwner
    ---------

    1: kd> !analyze -v
    *******************************************************************************
    * *
    * Bugcheck Analysis *
    * *
    *******************************************************************************

    SYSTEM_THREAD_EXCEPTION_NOT_HANDLED (7e)
    This is a very common bugcheck. Usually the exception address pinpoints
    the driver/function that caused the problem. Always note this address
    as well as the link date of the driver/image that contains this address.
    Arguments:
    Arg1: c0000005, The exception code that was not handled
    Arg2: 00000000, The address that the exception occurred at
    Arg3: f78fac58, Exception Record Address
    Arg4: f78fa954, Context Record Address

    Debugging Details:
    ------------------


    EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx". The memory could not be "%s".

    FAULTING_IP:
    +0
    00000000 ?? ???

    EXCEPTION_RECORD: f78fac58 -- (.exr fffffffff78fac58)
    ExceptionAddress: 00000000
    ExceptionCode: c0000005 (Access violation)
    ExceptionFlags: 00000000
    NumberParameters: 2
    Parameter[0]: 00000000
    Parameter[1]: 00000000
    Attempt to read from address 00000000

    CONTEXT: f78fa954 -- (.cxr fffffffff78fa954)
    eax=86392ad0 ebx=00000000 ecx=00000000 edx=85c1bff8 esi=85c1c008 edi=00000000
    eip=00000000 esp=f78fad20 ebp=f78fad54 iopl=0 nv up ei ng nz na po nc
    cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010282
    00000000 ?? ???
    Resetting default scope

    DEFAULT_BUCKET_ID: DRIVER_FAULT

    PROCESS_NAME: System

    ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx". The memory could not be "%s".

    READ_ADDRESS: 00000000

    BUGCHECK_STR: 0x7E

    LAST_CONTROL_TRANSFER: from 8056efd4 to 00000000

    FAILED_INSTRUCTION_ADDRESS:
    +0
    00000000 ?? ???

    STACK_TEXT:
    WARNING: Frame IP not in any known module. Following frames may be wrong.
    f78fad1c 8056efd4 85c1c020 00000002 00000000 0x0
    f78fad54 804e1957 85c1c020 00000000 806ffa3c nt!ObpRemoveObjectRoutine+0xc3
    f78fad6c 804ec4de 8638fb30 80568590 80569538 nt!ObfDereferenceObject+0x4c
    f78fad7c 804e23b5 00000000 00000000 8638fb30 nt!PspReaper+0x5c
    f78fadac 80574128 00000000 00000000 00000000 nt!ExpWorkerThread+0xef
    f78faddc 804ec781 804e22f1 00000002 00000000 nt!PspSystemThreadStartup+0x34
    00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16


    FOLLOWUP_IP:
    nt!ObpRemoveObjectRoutine+c3
    8056efd4 e99ad7ffff jmp nt!ObpRemoveObjectRoutine+0xc3 (8056c773)

    SYMBOL_STACK_INDEX: 1

    SYMBOL_NAME: nt!ObpRemoveObjectRoutine+c3

    FOLLOWUP_NAME: MachineOwner

    MODULE_NAME: nt

    IMAGE_NAME: ntkrnlmp.exe

    DEBUG_FLR_IMAGE_TIMESTAMP: 45e54690

    STACK_COMMAND: .cxr 0xfffffffff78fa954 ; kb

    FAILURE_BUCKET_ID: 0x7E_VRF_NULL_IP_nt!ObpRemoveObjectRoutine+c3

    BUCKET_ID: 0x7E_VRF_NULL_IP_nt!ObpRemoveObjectRoutine+c3

    Followup: MachineOwner
    ---------
     
  2. Route44

    Route44 TechSpot Ambassador Posts: 11,966   +70

    Does this happen randomnly or when you are doing certain things?
     
  3. tmb

    tmb TS Rookie Topic Starter

    It is random. However if I'm not logged on to windows, I've noticed that the computer will stay on without crashing.

    Shortly after logging on and using programs, it may be immediately, it may be several minutes, but it will crash.

    Here is the latest from winndbg


    Microsoft (R) Windows Debugger Version 6.6.0007.5
    Copyright (c) Microsoft Corporation. All rights reserved.


    Loading Dump File [C:\WINDOWS\MEMORY.DMP]
    Kernel Summary Dump File: Only kernel address space is available

    Symbol search path is:
    Executable search path is:
    Windows XP Kernel Version 2600 (Service Pack 2) MP (2 procs) Free x86 compatible
    Product: WinNt, suite: TerminalServer SingleUserTS Personal
    Built by: 2600.xpsp_sp2_gdr.070227-2254
    Kernel base = 0x804d7000 PsLoadedModuleList = 0x805624a0
    Debug session time: Mon Nov 12 12:01:57.546 2007 (GMT-5)
    System Uptime: 0 days 4:27:36.250
    WARNING: Process directory table base 275C3000 doesn't match CR3 00039000
    WARNING: Process directory table base 275C3000 doesn't match CR3 00039000
    Loading Kernel Symbols
    .................................................................................................................................................
    Loading User Symbols
    PEB is paged out (Peb.Ldr = 7ffdf00c). Type ".hh dbgerr001" for details
    Loading unloaded module list
    ............
    *******************************************************************************
    * *
    * Bugcheck Analysis *
    * *
    *******************************************************************************

    Use !analyze -v to get detailed debugging information.

    BugCheck 7F, {8, 80042000, 0, 0}

    Probably caused by : ntkrnlmp.exe ( nt!KiTrap0E+be )

    Followup: MachineOwner
    ---------

    0: kd> !analyze -v
    *******************************************************************************
    * *
    * Bugcheck Analysis *
    * *
    *******************************************************************************

    UNEXPECTED_KERNEL_MODE_TRAP (7f)
    This means a trap occurred in kernel mode, and it's a trap of a kind
    that the kernel isn't allowed to have/catch (bound trap) or that
    is always instant death (double fault). The first number in the
    bugcheck params is the number of the trap (8 = double fault, etc)
    Consult an Intel x86 family manual to learn more about what these
    traps are. Here is a *portion* of those codes:
    If kv shows a taskGate
    use .tss on the part before the colon, then kv.
    Else if kv shows a trapframe
    use .trap on that value
    Else
    .trap on the appropriate frame will show where the trap was taken
    (on x86, this will be the ebp that goes with the procedure KiTrap)
    Endif
    kb will then show the corrected stack.
    Arguments:
    Arg1: 00000008, EXCEPTION_DOUBLE_FAULT
    Arg2: 80042000
    Arg3: 00000000
    Arg4: 00000000

    Debugging Details:
    ------------------


    BUGCHECK_STR: 0x7f_8

    TSS: 00000028 -- (.tss 28)
    eax=00000000 ebx=f639e098 ecx=00000001 edx=40000000 esi=80556802 edi=00000002
    eip=804e0932 esp=f639e000 ebp=f639e008 iopl=0 nv up ei pl zr na pe nc
    cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010246
    nt!KiTrap0E+0xbe:
    804e0932 57 push edi
    Resetting default scope

    DEFAULT_BUCKET_ID: DRIVER_FAULT

    PROCESS_NAME: lsass.exe

    TRAP_FRAME: f639e518 -- (.trap fffffffff639e518)
    ErrCode = 00000002
    eax=00000002 ebx=f639e638 ecx=00000001 edx=40000000 esi=80556802 edi=00000002
    eip=80556802 esp=f639e58c ebp=f639e5a8 iopl=0 nv up ei pl nz na po nc
    cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010202
    nt!KeBugCheckCount+0x2:
    80556802 0000 add byte ptr [eax],al ds:0023:00000002=??
    Resetting default scope

    LAST_CONTROL_TRANSFER: from 80556802 to 804e0932

    STACK_TEXT:
    f639e008 80556802 badb0d00 40000000 0000001c nt!KiTrap0E+0xbe
    f639e098 80556802 badb0d00 40000000 00000000 nt!KeBugCheckCount+0x2
    f639e198 804e0aac 0000000a 00000002 00000002 nt!KeBugCheckCount+0x2
    f639e198 80556802 0000000a 00000002 00000002 nt!KiTrap0E+0x238
    f639e248 80556802 badb0d00 40000000 857a7640 nt!KeBugCheckCount+0x2
    f639e348 804e0aac 0000000a 00000002 00000002 nt!KeBugCheckCount+0x2
    f639e348 80556802 0000000a 00000002 00000002 nt!KiTrap0E+0x238
    f639e3f8 80556802 badb0d00 40000000 00090778 nt!KeBugCheckCount+0x2
    f639e4f8 804e0aac 0000000a 00000002 00000002 nt!KeBugCheckCount+0x2
    f639e4f8 80556802 0000000a 00000002 00000002 nt!KiTrap0E+0x238
    f639e5a8 80556802 badb0d00 40000000 ebebebeb nt!KeBugCheckCount+0x2
    f639e6a8 804e0aac 0000000a 00000002 00000002 nt!KeBugCheckCount+0x2
    f639e6a8 80556802 0000000a 00000002 00000002 nt!KiTrap0E+0x238
    f639e758 80556802 badb0d00 40000000 ebebebeb nt!KeBugCheckCount+0x2
    f639e858 804e0aac 0000000a 00000002 00000002 nt!KeBugCheckCount+0x2
    f639e858 80556802 0000000a 00000002 00000002 nt!KiTrap0E+0x238
    f639e908 80556802 badb0d00 40000000 ebebebeb nt!KeBugCheckCount+0x2
    f639ea08 804e0aac 0000000a 00000002 00000002 nt!KeBugCheckCount+0x2
    f639ea08 80556802 0000000a 00000002 00000002 nt!KiTrap0E+0x238
    f639eab8 80556802 badb0d00 40000000 ebebebeb nt!KeBugCheckCount+0x2
    f639ebb8 804e0aac 0000000a 00000002 00000002 nt!KeBugCheckCount+0x2
    f639ebb8 80556802 0000000a 00000002 00000002 nt!KiTrap0E+0x238
    f639ec68 80556802 badb0d00 40000000 ebebebeb nt!KeBugCheckCount+0x2
    f639ed68 804e0aac 0000000a 00000002 00000002 nt!KeBugCheckCount+0x2
    f639ed68 80556802 0000000a 00000002 00000002 nt!KiTrap0E+0x238
    f639ee18 80556802 badb0d00 40000000 ebebebeb nt!KeBugCheckCount+0x2
    f639ef18 804e0aac 0000000a 00000002 00000002 nt!KeBugCheckCount+0x2
    f639ef18 80556802 0000000a 00000002 00000002 nt!KiTrap0E+0x238
    f639efc8 80556802 badb0d00 40000000 ebebebeb nt!KeBugCheckCount+0x2
    f639f0c8 804e0aac 0000000a 00000002 00000002 nt!KeBugCheckCount+0x2
    f639f0c8 80556802 0000000a 00000002 00000002 nt!KiTrap0E+0x238
    f639f178 80556802 badb0d00 40000000 00000000 nt!KeBugCheckCount+0x2
    f639f278 804e0aac 0000000a 00000002 00000002 nt!KeBugCheckCount+0x2
    f639f278 80556802 0000000a 00000002 00000002 nt!KiTrap0E+0x238
    f639f328 80556802 badb0d00 40000000 00000000 nt!KeBugCheckCount+0x2
    f639f428 804e0aac 0000000a 00000002 00000002 nt!KeBugCheckCount+0x2
    f639f428 80556802 0000000a 00000002 00000002 nt!KiTrap0E+0x238
    f639f4d8 80556802 badb0d00 40000000 00000000 nt!KeBugCheckCount+0x2
    f639f5d8 804e0aac 0000000a 00000002 00000002 nt!KeBugCheckCount+0x2
    f639f5d8 80556802 0000000a 00000002 00000002 nt!KiTrap0E+0x238
    f639f688 80556802 badb0d00 40000000 00000000 nt!KeBugCheckCount+0x2
    f639f788 804e0aac 0000000a 00000002 00000002 nt!KeBugCheckCount+0x2
    f639f788 80556802 0000000a 00000002 00000002 nt!KiTrap0E+0x238
    f639f838 80556802 badb0d00 40000000 00000000 nt!KeBugCheckCount+0x2
    f639f938 804e0aac 0000000a 00000002 00000002 nt!KeBugCheckCount+0x2
    f639f938 80556802 0000000a 00000002 00000002 nt!KiTrap0E+0x238
    f639f9e8 80556802 badb0d00 40000000 00000000 nt!KeBugCheckCount+0x2
    f639fae8 804e0aac 0000000a 00000002 00000002 nt!KeBugCheckCount+0x2
    f639fae8 80556802 0000000a 00000002 00000002 nt!KiTrap0E+0x238
    f639fb98 80556802 badb0d00 40000000 00000000 nt!KeBugCheckCount+0x2
    f639fc98 804e0aac 0000000a 00000002 00000002 nt!KeBugCheckCount+0x2
    f639fc98 80556802 0000000a 00000002 00000002 nt!KiTrap0E+0x238
    f639fd48 80556802 badb0d00 40000000 00000000 nt!KeBugCheckCount+0x2
    f639fe48 804e0aac 0000000a 00000002 00000002 nt!KeBugCheckCount+0x2
    f639fe48 80556802 0000000a 00000002 00000002 nt!KiTrap0E+0x238
    f639fef8 80556802 badb0d00 40000000 00000000 nt!KeBugCheckCount+0x2
    f639fff8 804e0aac 0000000a 00000002 00000002 nt!KeBugCheckCount+0x2
    f639fff8 80556802 0000000a 00000002 00000002 nt!KiTrap0E+0x238
    f63a00a8 80556802 badb0d00 40000000 804ea6c3 nt!KeBugCheckCount+0x2
    f63a01a8 804e0aac 0000000a 00000002 00000002 nt!KeBugCheckCount+0x2
    f63a01a8 80556802 0000000a 00000002 00000002 nt!KiTrap0E+0x238
    f63a0258 80556802 badb0d00 40000000 0078c2b8 nt!KeBugCheckCount+0x2
    f63a0358 804e0aac 0000000a 00000002 00000002 nt!KeBugCheckCount+0x2
    f63a0358 80556802 0000000a 00000002 00000002 nt!KiTrap0E+0x238
    f63a0408 80556802 badb0d00 40000000 00000000 nt!KeBugCheckCount+0x2
    f63a04c0 bae99297 85650000 c0300023 c0000023 nt!KeBugCheckCount+0x2
    f63a0528 80556802 badb0d00 40000000 80542988 Ntfs!NtfsOpenAttributeInExistingFile+0x3f3
    f63a05e0 80504ad1 f63a0000 c0300023 c0000023 nt!KeBugCheckCount+0x2
    f63a0648 80556802 badb0d00 40000000 000000d1 nt!RtlWalkFrameChain+0x2d
    f63a0748 804e0aac 0000000a 00000002 00000002 nt!KeBugCheckCount+0x2
    f63a0748 80556802 0000000a 00000002 00000002 nt!KiTrap0E+0x238
    f63a07f8 80556802 badb0d00 40000000 c0c00000 nt!KeBugCheckCount+0x2
    f63a08f8 804e0aac 0000000a 00000002 00000002 nt!KeBugCheckCount+0x2
    f63a08f8 80556802 0000000a 00000002 00000002 nt!KiTrap0E+0x238
    f63a09a8 80556802 badb0d00 40000000 00000002 nt!KeBugCheckCount+0x2


    STACK_COMMAND: .tss 0x28 ; kb

    MODULE_NAME: nt

    IMAGE_NAME: ntkrnlmp.exe

    FOLLOWUP_NAME: MachineOwner

    DEBUG_FLR_IMAGE_TIMESTAMP: 45e54690

    FOLLOWUP_IP:
    nt!KiTrap0E+be
    804e0932 57 push edi

    SYMBOL_STACK_INDEX: 0

    SYMBOL_NAME: nt!KiTrap0E+be

    FAILURE_BUCKET_ID: TRAP_FRAME_RECURSION

    BUCKET_ID: TRAP_FRAME_RECURSION

    Followup: MachineOwner
    ---------
     
  4. Route44

    Route44 TechSpot Ambassador Posts: 11,966   +70

    7E errors are due to hardware issues, driver conflicts, or software conflicts. 7F is particulary cited for hardware issues.

    Both dumpps cite ntkrnlmp.exe which is part of the Windows OS and from what I have been able to find both BIOS and memory are both mentioned.

    I think the first and easiest thing I suggest you do is run MemTest on your RAM for a minimum of 7 passes or more.
     
  5. tmb

    tmb TS Rookie Topic Starter

    I ran memtest for 6 passes - no error.

    I suspect the ATI mobility radeon 9200 AGP videocard and drivers.

    I'm running an HP zx5000 and usually have a secondary monitor hooked up and switch off the laptop monitor.

    I updated the drivers but it didn't take very easily and I could not get the latest ATI control center to install.

    I was also tieing in a normal keyboard that has an old type connection to a USB adapter.

    I've now disconnected all external USB connections (except mouse) and external CRT. We'll see what happens.

    It ran the memtest with all of this disconnected for a few hours without crashing.
     
  6. Route44

    Route44 TechSpot Ambassador Posts: 11,966   +70

    I have that ATI 9200 card in my old P3 system and it still works well. I don't think the latest offerings from ATI will work with that card.

    Did you use their online webpage to determine what you can download and install?
     
  7. Cerberus

    Cerberus TS Rookie Posts: 56

Topic Status:
Not open for further replies.

Similar Topics

Add New Comment

You need to be a member to leave a comment. Join thousands of tech enthusiasts and participate.
TechSpot Account You may also...