TechSpot

Can anybody help me in analyzing this?

By mms
Dec 22, 2007
  1. Hi CPC2004,


    I have been struggling with this BSOD problem for long. I work from home and am not able to part with this computer to send it to "emachines" for a diagnosis.

    I have tried all the things possible, like reformatting the system, loading the drivers etc. I tried the speedfan utility. Itshows normal results. Yesterday, I changed thepower supply too. I did not have reboots from yesterday night to today afternoon. I thought the power supply fixed the issue. But, no... The problem persists. It only reduced the frequency
    of the reboots.

    Frankly, I am tired, sad and exhausted. I am not good at reading with debugging thing. But, I am pasting what it showed. Can you please go through it and point out the error?

    It will a great christmas gift for me if somebody could solve my problem.

    Thanks.





    Microsoft (R) Windows Debugger Version 6.8.0004.0 X86
    Copyright (c) Microsoft Corporation. All rights reserved.


    Loading Dump File [C:\WINDOWS\Minidump\Mini122207-01.dmp]
    Mini Kernel Dump File: Only registers and stack trace are available
    Symbol search path is: http://msdl.microsoft.com/download/symbols
    Executable search path is:
    Windows XP Kernel Version 2600 (Service Pack 2) MP (2 procs) Free x86 compatible
    Product: WinNt, suite: TerminalServer SingleUserTS
    Built by: 2600.xpsp_sp2_qfe.070227-2300
    Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055c700
    Debug session time: Sat Dec 22 12:20:18.921 2007 (GMT-6)
    System Uptime: 0 days 2:26:40.610
    Loading Kernel Symbols
    ...............................................................................................................................................................................
    Loading User Symbols
    Loading unloaded module list
    *******************************************************************************
    * *
    * Bugcheck Analysis *
    * *
    *******************************************************************************

    Use !analyze -v to get detailed debugging information.

    BugCheck 1000008E, {c0000005, bf80114f, f6fc46b8, 0}



    Probably caused by : win32k.sys ( win32k!ThreadUnlock1+14 )

    Followup: MachineOwner
    ---------

    0: kd> !analyze -v
    *******************************************************************************
    * *
    * Bugcheck Analysis *
    * *
    *******************************************************************************

    KERNEL_MODE_EXCEPTION_NOT_HANDLED_M (1000008e)
    This is a very common bugcheck. Usually the exception address pinpoints
    the driver/function that caused the problem. Always note this address
    as well as the link date of the driver/image that contains this address.
    Some common problems are exception code 0x80000003. This means a hard
    coded breakpoint or assertion was hit, but this system was booted
    /NODEBUG. This is not supposed to happen as developers should never have
    hardcoded breakpoints in retail code, but ...
    If this happens, make sure a debugger gets connected, and the
    system is booted /DEBUG. This will let us see why this breakpoint is
    happening.
    Arguments:
    Arg1: c0000005, The exception code that was not handled
    Arg2: bf80114f, The address that the exception occurred at
    Arg3: f6fc46b8, Trap Frame
    Arg4: 00000000

    Debugging Details:
    ------------------
    EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx". The memory could not be "%s".

    FAULTING_IP:
    win32k!ThreadUnlock1+14
    bf80114f ff4804 dec dword ptr [eax+4]

    TRAP_FRAME: f6fc46b8 -- (.trap 0xfffffffff6fc46b8)
    ErrCode = 00000002
    eax=4397bf28 ebx=bc6917a8 ecx=f6fc4758 edx=f6fc4c70 esi=e26064f8 edi=bc68bf28
    eip=bf80114f esp=f6fc472c ebp=f6fc4790 iopl=0 nv up ei pl nz na pe nc
    cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010206
    win32k!ThreadUnlock1+0x14:
    bf80114f ff4804 dec dword ptr [eax+4] ds:0023:4397bf2c=????????
    Resetting default scope
    CUSTOMER_CRASH_COUNT: 1

    DEFAULT_BUCKET_ID: DRIVER_FAULT

    BUGCHECK_STR: 0x8E

    PROCESS_NAME: UdaterUI.exe

    LAST_CONTROL_TRANSFER: from bf83f323 to bf80114f

    STACK_TEXT:
    f6fc4728 bf83f323 0012f6e4 f6fc47e8 bf8f64fd win32k!ThreadUnlock1+0x14
    f6fc4790 bf8f648b 0368bf28 00000000 00000001 win32k!xxxCallHook2+0x2cc
    f6fc47ac bf8e32dc 00000000 00000001 00000002 win32k!xxxCallNextHookEx+0x2d
    f6fc4800 bf8f6408 00000003 00000000 00000001 win32k!NtUserfnHkINLPMSG+0x3a
    f6fc481c 805409ac 00000000 00000001 0012f6c8 win32k!NtUserCallNextHookEx+0xa5
    f6fc481c 7c90eb94 00000000 00000001 0012f6c8 nt!KiFastCallEntry+0xfc
    WARNING: Frame IP not in any known module. Following frames may be wrong.
    0012f5e8 00000000 00000000 00000000 00000000 0x7c90eb94


    STACK_COMMAND: kb

    FOLLOWUP_IP:
    win32k!ThreadUnlock1+14
    bf80114f ff4804 dec dword ptr [eax+4]

    SYMBOL_STACK_INDEX: 0

    SYMBOL_NAME: win32k!ThreadUnlock1+14

    FOLLOWUP_NAME: MachineOwner

    MODULE_NAME: win32k

    IMAGE_NAME: win32k.sys

    DEBUG_FLR_IMAGE_TIMESTAMP: 45f013f6

    FAILURE_BUCKET_ID: 0x8E_win32k!ThreadUnlock1+14

    BUCKET_ID: 0x8E_win32k!ThreadUnlock1+14

    Followup: MachineOwner
    ---------
     
  2. kirock

    kirock TS Rookie Posts: 1,221

    It's your McAfree av program. Uninstall it and go get AVG 7.5. It's free and is better then McAfree.
     
  3. mms

    mms TS Rookie Topic Starter

    Hi

    Thanks. Do you say this because it file is pointing to UdaterUI.exe?

    In that case, I would also like to paste one (or two more files)



    File 1:

    Microsoft (R) Windows Debugger Version 6.8.0004.0 X86
    Copyright (c) Microsoft Corporation. All rights reserved.


    Loading Dump File [C:\WINDOWS\Minidump\Mini122007-01.dmp]
    Mini Kernel Dump File: Only registers and stack trace are available

    Symbol search path is: http://msdl.microsoft.com/download/symbols
    Executable search path is:
    Windows XP Kernel Version 2600 (Service Pack 2) MP (2 procs) Free x86 compatible
    Product: WinNt, suite: TerminalServer SingleUserTS
    Built by: 2600.xpsp_sp2_qfe.070227-2300
    Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055c700
    Debug session time: Thu Dec 20 23:48:09.890 2007 (GMT-6)
    System Uptime: 0 days 1:51:27.597
    Loading Kernel Symbols
    ..............................................................................................................................................................................
    Loading User Symbols
    Loading unloaded module list
    .................
    *******************************************************************************
    * *
    * Bugcheck Analysis *
    * *
    *******************************************************************************

    Use !analyze -v to get detailed debugging information.

    BugCheck 1000008E, {c0000005, 407f0afe, badb5ce4, 0}



    Probably caused by : hardware

    Followup: MachineOwner
    ---------
    *** Possible invalid call from bf803782 ( win32k!NtUserWaitMessage+0x3 )
    *** Expected target bf800aea ( win32k!EnterCrit+0x0 )

    1: kd> !analyze -v
    *******************************************************************************
    * *
    * Bugcheck Analysis *
    * *
    *******************************************************************************

    KERNEL_MODE_EXCEPTION_NOT_HANDLED_M (1000008e)
    This is a very common bugcheck. Usually the exception address pinpoints
    the driver/function that caused the problem. Always note this address
    as well as the link date of the driver/image that contains this address.
    Some common problems are exception code 0x80000003. This means a hard
    coded breakpoint or assertion was hit, but this system was booted
    /NODEBUG. This is not supposed to happen as developers should never have
    hardcoded breakpoints in retail code, but ...
    If this happens, make sure a debugger gets connected, and the
    system is booted /DEBUG. This will let us see why this breakpoint is
    happening.
    Arguments:
    Arg1: c0000005, The exception code that was not handled
    Arg2: 407f0afe, The address that the exception occurred at
    Arg3: badb5ce4, Trap Frame
    Arg4: 00000000

    Debugging Details:
    ------------------




    EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx". The memory could not be "%s".

    FAULTING_IP:
    +407f0afe
    407f0afe ?? ???

    TRAP_FRAME: badb5ce4 -- (.trap 0xffffffffbadb5ce4)
    ErrCode = 00000010
    eax=839dd501 ebx=bf80377f ecx=00000000 edx=00000000 esi=085cff58 edi=badb5d64
    eip=407f0afe esp=badb5d58 ebp=badb5d64 iopl=0 nv up ei ng nz ac po cy
    cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010293
    407f0afe ?? ???
    Resetting default scope

    CUSTOMER_CRASH_COUNT: 1

    DEFAULT_BUCKET_ID: DRIVER_FAULT

    BUGCHECK_STR: 0x8E

    PROCESS_NAME: iexplore.exe

    LAST_CONTROL_TRANSFER: from bf803787 to 407f0afe

    POSSIBLE_INVALID_CONTROL_TRANSFER: from bf803782 to bf800aea

    STACK_TEXT:
    WARNING: Frame IP not in any known module. Following frames may be wrong.
    badb5d54 bf803787 085cff58 805409ac 085cffb4 0x407f0afe
    badb5d5c 805409ac 085cffb4 7c90eb94 badb0d00 win32k!NtUserWaitMessage+0x8
    badb5d5c 7c90eb94 085cffb4 7c90eb94 badb0d00 nt!KiFastCallEntry+0xfc
    085cff4c 7e419418 42f8f324 0731d6b8 00140000 0x7c90eb94
    085cffb4 7c80b683 04883a38 0731d6b8 00140000 0x7e419418
    085cffec 00000000 42f8e424 0731a440 00000000 0x7c80b683


    STACK_COMMAND: .trap 0xffffffffbadb5ce4 ; kb

    FOLLOWUP_NAME: MachineOwner

    MODULE_NAME: hardware

    IMAGE_NAME: hardware

    DEBUG_FLR_IMAGE_TIMESTAMP: 0

    BUCKET_ID: CPU_CALL_ERROR

    Followup: MachineOwner
    ---------
    *** Possible invalid call from bf803782 ( win32k!NtUserWaitMessage+0x3 )
    *** Expected target bf800aea ( win32k!EnterCrit+0x0 )




    I am posting the second file in the next thread.
     
  4. mms

    mms TS Rookie Topic Starter

    One more file

    FILE 2:

    Microsoft (R) Windows Debugger Version 6.8.0004.0 X86
    Copyright (c) Microsoft Corporation. All rights reserved.


    Loading Dump File [C:\WINDOWS\Minidump\Mini121907-06.dmp]
    Mini Kernel Dump File: Only registers and stack trace are available

    Symbol search path is: http://msdl.microsoft.com/download/symbols
    Executable search path is:
    Windows XP Kernel Version 2600 (Service Pack 2) MP (2 procs) Free x86 compatible
    Product: WinNt, suite: TerminalServer SingleUserTS
    Built by: 2600.xpsp.051011-1528
    Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055c700
    Debug session time: Wed Dec 19 23:14:43.250 2007 (GMT-6)
    System Uptime: 0 days 0:39:21.966
    Loading Kernel Symbols
    .............................................................................................................................................................................
    Loading User Symbols
    Loading unloaded module list
    .............
    *******************************************************************************
    * *
    * Bugcheck Analysis *
    * *
    *******************************************************************************

    Use !analyze -v to get detailed debugging information.

    BugCheck 1000008E, {c0000005, 407f0c2d, eb84c2b4, 0}



    Probably caused by : hardware

    Followup: MachineOwner
    ---------
    *** Possible invalid call from bf823d24 ( win32k!NtUserGetForegroundWindow+0x3 )
    *** Expected target bf800c19 ( win32k!EnterSharedCrit+0x0 )

    0: kd> !analyze -v
    *******************************************************************************
    * *
    * Bugcheck Analysis *
    * *
    *******************************************************************************

    KERNEL_MODE_EXCEPTION_NOT_HANDLED_M (1000008e)
    This is a very common bugcheck. Usually the exception address pinpoints
    the driver/function that caused the problem. Always note this address
    as well as the link date of the driver/image that contains this address.
    Some common problems are exception code 0x80000003. This means a hard
    coded breakpoint or assertion was hit, but this system was booted
    /NODEBUG. This is not supposed to happen as developers should never have
    hardcoded breakpoints in retail code, but ...
    If this happens, make sure a debugger gets connected, and the
    system is booted /DEBUG. This will let us see why this breakpoint is
    happening.
    Arguments:
    Arg1: c0000005, The exception code that was not handled
    Arg2: 407f0c2d, The address that the exception occurred at
    Arg3: eb84c2b4, Trap Frame
    Arg4: 00000000

    Debugging Details:
    ------------------




    EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx". The memory could not be "%s".

    FAULTING_IP:
    +407f0c2d
    407f0c2d ?? ???

    TRAP_FRAME: eb84c2b4 -- (.trap 0xffffffffeb84c2b4)
    ErrCode = 00000010
    eax=00000001 ebx=bf823d21 ecx=00000000 edx=00000000 esi=0007fa0c edi=eb84c334
    eip=407f0c2d esp=eb84c328 ebp=eb84c334 iopl=0 nv up ei ng nz ac po cy
    cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010293
    407f0c2d ?? ???
    Resetting default scope

    CUSTOMER_CRASH_COUNT: 6

    DEFAULT_BUCKET_ID: COMMON_SYSTEM_FAULT

    BUGCHECK_STR: 0x8E

    PROCESS_NAME: ctfmon.exe

    LAST_CONTROL_TRANSFER: from bf823d29 to 407f0c2d

    POSSIBLE_INVALID_CONTROL_TRANSFER: from bf823d24 to bf800c19

    STACK_TEXT:
    WARNING: Frame IP not in any known module. Following frames may be wrong.
    eb84c324 bf823d29 0007fa0c 8054070c 0007fa1c 0x407f0c2d
    eb84c32c 8054070c 0007fa1c 7c90eb94 badb0d00 win32k!NtUserGetForegroundWindow+0x8
    eb84c32c 7c90eb94 0007fa1c 7c90eb94 badb0d00 nt!KiFastCallEntry+0xfc
    0007fa00 77d4be57 5fc1763c 000ac9a8 5fc1ebe1 0x7c90eb94
    0007fa1c 7473da7c 000ac9a8 00000654 00000000 0x77d4be57
    0007fa58 7473e26e 000ac9a8 0000c0a4 00000000 0x7473da7c
    0007fac0 74730ccc 0000c0a4 00000000 00000654 0x7473e26e
    0007fae0 74730e3e 00000001 0007fbb8 00030001 0x74730ccc
    0007fb1c 77d4eaf2 00000000 00000001 0007fbb8 0x74730e3e
    0007fb38 77d4ea9e 00030000 00000001 0007fbb8 0x77d4eaf2
    0007fb74 77d4ebf3 0007fba8 0007fbb8 0007fbd4 0x77d4ea9e
    0007fb98 7c90eae3 0007fba8 00000030 00030000 0x77d4ebf3
    0007fbfc 00a05112 0008022c 00000000 00000001 0x7c90eae3
    0007fc44 77d4ea9e 00030000 00000001 0007fcc4 0xa05112
    0007fc80 77d4ebf3 0007fcb4 0007fcc4 0007fce0 0x77d4ea9e
    0007fca4 7c90eae3 0007fcb4 00000030 00030000 0x77d4ebf3
    0007fd0c 77d4ca67 0007fde8 00000000 00000000 0x7c90eae3
    0007fd38 00402702 0007fde8 00000000 00000000 0x77d4ca67
    0007ffa8 806e4ef2 0007ffe0 0040308a 00401420 0x402702
    0007ffa8 00000000 0007ffe0 0040308a 00401420 hal!HalpApcInterrupt+0xc6


    STACK_COMMAND: .trap 0xffffffffeb84c2b4 ; kb

    FOLLOWUP_NAME: MachineOwner

    MODULE_NAME: hardware

    IMAGE_NAME: hardware

    DEBUG_FLR_IMAGE_TIMESTAMP: 0

    BUCKET_ID: CPU_CALL_ERROR

    Followup: MachineOwner
    ---------
    *** Possible invalid call from bf823d24 ( win32k!NtUserGetForegroundWindow+0x3 )
    *** Expected target bf800c19 ( win32k!EnterSharedCrit+0x0 )



    Do you still think the problem is with the Anti-virus? Actually, I don't mind uninstalling it.


    Thanks again for the quik reply.
     
  5. kirock

    kirock TS Rookie Posts: 1,221

    Well your 1st debugger above implied IE, so that might be some hardware issue (ram?).
    The 2nd one implied Office's alternative user Input TIP.
    Go here to see if this resolves the prob. I still recommend uninstalling McAfee and getting AVG7.5 instead, then see what happens.
     
  6. mms

    mms TS Rookie Topic Starter

    Hi, Thanks

    Hey, thanks for giving a quick reply. I will try uninstalling the Mcafee.

    Meanwhile, I just tried to analyze the dumps. And, this is what I infer. Just my thoughts, may be totally base less. As I told you, I don't know anything about deciphering the dumps.

    I tried to see some 6/7 dumps in the same style and found out that each dump file was pointing to a different process like skype, internet explorer, realtek audio control panel, mcafee, etc etc. So, could it be this way? The problem is not of a software, but hardware nature. Each time it reboots, it is just pointing out the currently running process. I may be wrong.

    If it is hardware, it is not the powersupply. It is not RAM, because, i already tried changing ram.

    One important thing is, why is frequency of reboots less after changing the powersupply? I did upgrade the power supply from 250 watts to 380 watts. Is this a reason?

    Though the there is no pattern in reboots, the system is sure to reboot if i am watching a video, doing a voice chat or using Netbeans IDE, visual studio etc. So, does the problem aggravate with the CPU usage? Could it be some heat management problem? if it is not power supply, could it be the FAN? But, the speedfan shows no abnormalities.

    It can not be the dust. Because, mine is relatively a new system ,1 yr old and during the process of my trials like changes in ram, power supply, i see that there is no dust inside.

    I am confused. But for now, let me try uninstalling the anti-virus.

    Thanks for bearing with me.
     
  7. Blind Dragon

    Blind Dragon TS Evangelist Posts: 3,908

    CPU_CALL_ERROR -> most likely faulty motherboard, video card or PSU

    And 2 of the crashes even show hardware as the image name

    I would first try stress testing the Video card as that would be an easy way to tell. Also look inside your case that all fans are spinning, make sure your motherboard looks okay also

    I really hate telling you this but I think it is hardware related
     
  8. kirock

    kirock TS Rookie Posts: 1,221

    Ok so you have a new 380W PSU (sounds like a pos generic), what's your system specs? cpu, video card, how many HDDs, dvd's etc.
     
  9. mms

    mms TS Rookie Topic Starter

    hi

    hm..
    Power supply is ruled out now.

    Mother board... How do I know if it is ok?

    and, how do we do this stress testing for video card?
     
  10. mms

    mms TS Rookie Topic Starter

    Ok.

    The PSU which I bought now is Antec 380 Watt (ATX12v v2.2). This was the one I could get with great difficulty which was compatible with my system, emachines. previous power supply was bestec.

    System is Emachines T 5212.

    CPU : Intel® Pentium® D Processor 805 (dual-core)
    (2.66GHz, 533MHz FSB, 2 x 1MB L2 cache

    Optical Drives: 16x multiformat dual-layer DVD±RW
    (Up to 8.5GB with dual-layer media)
    Write max: 16x DVD±R, 6x DVD-RW, 8x DVD+RW, 4x DVD+R DL, 40x CD-R, 24x CD-RW


    Video Card: ATI Radeon® Xpress 200 integrated graphics solution
    Up to 128MB of shared video memory
    PCI-Express® (PCI-E x16)

    HDD: 200GB (7200rpm, 2MB cache)
     
  11. Blind Dragon

    Blind Dragon TS Evangelist Posts: 3,908

    are these errors completely random or is there something that seems to trigger them?
     
  12. mms

    mms TS Rookie Topic Starter

    completely random. Infact, many a times, I see that even when I am away from the system(i.e., when the system is idle), the system goes to a BSOD state.

    but, as I said earlier, if I try to watch video, do a voice chat(with no video), or do some programming using Netbeans IDE or Visual Studio etc., the system is sure to reboot within 30 minutes (max).
     
  13. cpc2004

    cpc2004 TS Evangelist Posts: 1,994

    BUCKET_ID: CPU_CALL_ERROR is the symptom of hardware error. There have 5 confirmed case CPU_CALL_ERROR were caused by faullty m/b and one confirmed case for faulty CPU.
     
  14. kirock

    kirock TS Rookie Posts: 1,221

    Well it seems like these BSODs could be caused by a faulty cpu (pretty rare though) or is it just overheating (HSF coming loose)(or dried up thermal paste or bad thermal pad). Remove the side of the case and put an external table fan blowing right into the case. This may help a little. If it helps at all (reduced # of bsods) then we might be on the right track.
     
Topic Status:
Not open for further replies.

Similar Topics

Add New Comment

You need to be a member to leave a comment. Join thousands of tech enthusiasts and participate.
TechSpot Account You may also...