TechSpot

Java applet application causing frequent Blue Screen and OS restart

By arpee
Jan 30, 2008
  1. Hello,

    My users of java applet application is facing BSOD which causes their laptop to reboot frequently causing loss of work. I have read a number of posts related to the same error but unable to find appropriate resolution. I will try and list the observations and hope someone here could help me reolve this.
    1) Only users using Dell M 70 laptop have reported crashing of OS after using the my application. All laptops are provided by company and configured the same with
    1) Operating system - Win XP SP2
    2) RAM - 1Gig
    3) Internet Brower Version - IE 6 with latest patch
    4) Java (Plug –In) Version(s) installed
    PC1 - 1.4.2
    PC2 - 1.5.6
    The laptop which I have kept under observation has Intel Centrino mobile processor (1.6 Ghz)

    The event log and minidump file were acquired and analysed.
    The system log had the following errors:

    The computer has rebooted from a bugcheck. The bugcheck was: 0x1000000a (0x9d086240, 0x00000002, 0x00000000, 0x8051ede8). A dump was saved in: [link removed].

    The minidump was analysed with Windbg utility. The details are

    Loading Dump File [Edited]
    Mini Kernel Dump File: Only registers and stack trace are available

    Symbol search path is[edited for posting]
    Executable search path is:
    Windows XP Kernel Version 2600 (Service Pack 2) UP Free x86 compatible
    Product: WinNt, suite: TerminalServer SingleUserTS
    Built by: 2600.xpsp_sp2_gdr.070227-2254
    Kernel base = 0x804d7000 PsLoadedModuleList = 0x805533a0
    Debug session time: Wed Jan 16 02:18:46.975 2008 (GMT+6)
    System Uptime: 1 days 7:26:11.973
    Loading Kernel Symbols
    ........................................................................................................................................
    Loading User Symbols
    Loading unloaded module list
    .......................................
    *******************************************************************************
    * *
    * Bugcheck Analysis *
    * *
    *******************************************************************************

    Use !analyze -v to get detailed debugging information.

    BugCheck 1000000A, {9d086240, 2, 0, 8051ede8}

    Unable to load image SYMEVENT.SYS, Win32 error 0n2
    *** WARNING: Unable to verify timestamp for SYMEVENT.SYS
    *** ERROR: Module load completed but symbols could not be loaded for SYMEVENT.SYS


    Probably caused by : SYMEVENT.SYS ( SYMEVENT+12175 )

    Followup: MachineOwner
    ---------

    I confirmed they have Symantec Antivirus version 10.1.6 version. Even after disabling the antivirus (not removing which would voilate corporate policy), the computer crashed with the same error as above.

    Now the affected users have stopped using the java application (blaming it to be the cause) and it is affecting the usability of the application. If not resolved, it might affect the funding although the application may not have anything to do with the crash. Unfortunately, the laptops don't crash if they don't use the application.

    I would appreciate if someone could direct me how to proceed further since the laptops are under corporate IT control.

    Regards,
    arpee
     
  2. Route44

    Route44 TechSpot Ambassador Posts: 12,168   +37

    Can you attach a few of these latest BSOD's since Symantec has been disabled? When did these crashes start occuring?

    It would be a big help if we could read them; I am not sure if Java is your issue but something else going on -- like your anti-virus.
     
  3. jobeard

    jobeard TS Ambassador Posts: 13,476   +329

    what version of Java?
     
  4. arpee

    arpee TS Rookie Topic Starter

    Route44,

    I have analyzed around 8 minidumps, 6 of which were from before symantec was disabled and 2 after disabling. Out of these 6 reported SYMEVENT.SYS as possible cause which includes the dump after Symantec was disabled. The other 2 instances happened only once, one after the other, which occured possibly due to memory corruption (as reported by windbg). The only pattern I could get from one of the user is it happens when he tries to copy data from excel file generated by the application to his own master excel file. The files are not huge (< 100kb). Others reported that it happened to them when they leave the application open on their computer for while (after using is heavily which is mostly like querying 1000 records from the database at a time and displaying them in applet as tree structure) and return to their computer to start working only to find it getting rebooted. I cannot see the screen myself as I am working from different location but I am told the screen has the same information as in the system event log (one of which I have mentioned in my original post).

    jobeard,
    Currently the java plug-in version on the machines have been updated to 1.5.0_10 which is same as what the application was developed with. However, prior to this exercise different machine had different version like 1.6.0 and 1.4.2. This hasn't helped in getting anything different.
     
  5. Route44

    Route44 TechSpot Ambassador Posts: 12,168   +37

    Was there any attempt to run MemTest on your memory just as a precautionary? That rebooting sounds awfully familiar to what I was experiencing when one of my four sticks of RAM was corrupted. I could be in the middle of someting or walk away and come back and either my system was rebooting or I had an error notification on my desktop screen.

    Just for the information alone I'd try running MemTest.



    Is this Symantec Corporate? Even when it is disabled Symantec is still present and some applications may still be running in the background. Check Task Manager and for I'd also run chkdsk. I assume you've run scans for viruses, trojans, and malware.


    For clarity, have you always had Java and Symantec present and only recently the crashes have been occuring?




    What keeps raising the red flag for me is how SYMEVENT.SYS is ever present as the cause.
     
  6. arpee

    arpee TS Rookie Topic Starter

    I am waiting for Dell Diagnostic tool report from the system. It should cover RAM and hard disk checking, as per my knowledge.
    Yes, it is Symantec Corporate and scans have been made. Java and Symantec have always been present and crash got reported only after they started using this Java applet application.
     
  7. jobeard

    jobeard TS Ambassador Posts: 13,476   +329

  8. arpee

    arpee TS Rookie Topic Starter

    I got the Dell Diagnostic tool run on the laptop and the result was "All passed". This time I had the Symantec antivirus removed from the system. However, there was another crash. Here is the report from WinDBG tool.

    Microsoft (R) Windows Debugger Version 6.8.0004.0 X86
    Copyright (c) Microsoft Corporation. All rights reserved.


    Loading Dump File [link edited]
    Mini Kernel Dump File: Only registers and stack trace are available

    Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
    Executable search path is:
    Windows XP Kernel Version 2600 (Service Pack 2) UP Free x86 compatible
    Product: WinNt, suite: TerminalServer SingleUserTS
    Built by: 2600.xpsp_sp2_gdr.070227-2254
    Kernel base = 0x804d7000 PsLoadedModuleList = 0x805533a0
    Debug session time: Fri Feb 1 16:55:42.437 2008 (GMT-5)
    System Uptime: 0 days 8:01:56.533
    Loading Kernel Symbols
    ...........................................................................................................................................
    Loading User Symbols
    Loading unloaded module list
    ........................
    *******************************************************************************
    * *
    * Bugcheck Analysis *
    * *
    *******************************************************************************

    Use !analyze -v to get detailed debugging information.

    BugCheck 1000000A, {9d086240, 2, 0, 8051ede8}



    Probably caused by : memory_corruption ( nt!MiDeletePte+198 )

    Followup: MachineOwner
    ---------

    kd> !analyze -v
    *******************************************************************************
    * *
    * Bugcheck Analysis *
    * *
    *******************************************************************************

    IRQL_NOT_LESS_OR_EQUAL (a)
    An attempt was made to access a pageable (or completely invalid) address at an
    interrupt request level (IRQL) that is too high. This is usually
    caused by drivers using improper addresses.
    If a kernel debugger is available get the stack backtrace.
    Arguments:
    Arg1: 9d086240, memory referenced
    Arg2: 00000002, IRQL
    Arg3: 00000000, bitfield :
    bit 0 : value 0 = read operation, 1 = write operation
    bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
    Arg4: 8051ede8, address which referenced memory

    Debugging Details:
    ------------------




    READ_ADDRESS: 9d086240

    CURRENT_IRQL: 2

    FAULTING_IP:
    nt!MiDeletePte+198
    8051ede8 8b420c mov eax,dword ptr [edx+0Ch]

    CUSTOMER_CRASH_COUNT: 1

    DEFAULT_BUCKET_ID: DRIVER_FAULT

    BUGCHECK_STR: 0xA

    PROCESS_NAME: iexplore.exe

    LAST_CONTROL_TRANSFER: from 8051f25c to 8051ede8

    STACK_TEXT:
    ee018a50 8051f25c c000cea0 019d4000 00000000 nt!MiDeletePte+0x198
    ee018b14 8051680d 00000020 01acffff 00000000 nt!MiDeleteVirtualAddresses+0x164
    ee018b30 805a75b4 019d0000 01acffff ee018bf0 nt!MiDeleteFreeVm+0x1d
    ee018bd8 8053ca28 ffffffff ee018cb8 ee018cbc nt!NtFreeVirtualMemory+0x42e
    ee018bd8 804fdacd ffffffff ee018cb8 ee018cbc nt!KiFastCallEntry+0xf8
    ee018c60 805c7395 ffffffff ee018cb8 ee018cbc nt!ZwFreeVirtualMemory+0x11
    ee018d14 805c7696 00000000 00000000 85d48930 nt!PspExitThread+0x541
    ee018d34 805c79d6 85d48930 00000000 ee018d64 nt!PspTerminateThreadByPointer+0x52
    ee018d54 8053ca28 00000000 00000000 01acff74 nt!NtTerminateThread+0x70
    ee018d54 7c90eb94 00000000 00000000 01acff74 nt!KiFastCallEntry+0xf8
    WARNING: Frame IP not in any known module. Following frames may be wrong.
    01acff74 00000000 00000000 00000000 00000000 0x7c90eb94


    STACK_COMMAND: kb

    FOLLOWUP_IP:
    nt!MiDeletePte+198
    8051ede8 8b420c mov eax,dword ptr [edx+0Ch]

    SYMBOL_STACK_INDEX: 0

    SYMBOL_NAME: nt!MiDeletePte+198

    FOLLOWUP_NAME: MachineOwner

    MODULE_NAME: nt

    DEBUG_FLR_IMAGE_TIMESTAMP: 45e53f9c

    IMAGE_NAME: memory_corruption

    FAILURE_BUCKET_ID: 0xA_nt!MiDeletePte+198

    BUCKET_ID: 0xA_nt!MiDeletePte+198

    Followup: MachineOwner
    ---------

    As Route44 has suggested, it seems to point to faulty RAM. I am going to have the MemTest run separately. If anyone can point something else from the WinDBG output, please let me know.
     
  9. jobeard

    jobeard TS Ambassador Posts: 13,476   +329

    The three suspects are Memory, Drivers, and the HD itself -- in that order.
    Test memory thoroughly!! Then update ALL your drivers.
    If it happens again, then backup your HD and test it
     
  10. arpee

    arpee TS Rookie Topic Starter

    I have some good news to share on the issue. Although it is too early to conclude but the problem has not occured on one of the machine since 24hrs after upgrading NVIDIA driver. Earlier it was very easy to crash. A couple of other machines (all dell M70) have also been upgraded and under watch. Previous version of NVIDIA driver was 6.7.7.1 while the upgraded version is 8.4.3.0. Special thanks to jobeard and route44 for quick response and providing vital clues. I will update here if there is any further information.
     
  11. Route44

    Route44 TechSpot Ambassador Posts: 12,168   +37

    Thanks arpee for the update. Computers, who can figure them especially when minidumps point to one thing, i.e., memory corruption, only to find out it was a Nvidia driver.

    joebeard was right on with updating all drivers. it appears the newer Java script needed the newer Nvidia drivers.
     
     
Topic Status:
Not open for further replies.


Add New Comment

TechSpot Members
Login or sign up for free,
it takes about 30 seconds.
You may also...


Get complete access to the TechSpot community. Join thousands of technology enthusiasts that contribute and share knowledge in our forum. Get a private inbox, upload your own photo gallery and more.