Hello,

My users of java applet application is facing BSOD which causes their laptop to reboot frequently causing loss of work. I have read a number of posts related to the same error but unable to find appropriate resolution. I will try and list the observations and hope someone here could help me reolve this.
1) Only users using Dell M 70 laptop have reported crashing of OS after using the my application. All laptops are provided by company and configured the same with
1) Operating system - Win XP SP2
2) RAM - 1Gig
3) Internet Brower Version - IE 6 with latest patch
4) Java (Plug –In) Version(s) installed
PC1 - 1.4.2
PC2 - 1.5.6
The laptop which I have kept under observation has Intel Centrino mobile processor (1.6 Ghz)

The event log and minidump file were acquired and analysed.
The system log had the following errors:

The computer has rebooted from a bugcheck. The bugcheck was: 0x1000000a (0x9d086240, 0x00000002, 0x00000000, 0x8051ede8). A dump was saved in: [link removed].

The minidump was analysed with Windbg utility. The details are

Loading Dump File [Edited]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is[edited for posting]
Executable search path is:
Windows XP Kernel Version 2600 (Service Pack 2) UP Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 2600.xpsp_sp2_gdr.070227-2254
Kernel base = 0x804d7000 PsLoadedModuleList = 0x805533a0
Debug session time: Wed Jan 16 02:18:46.975 2008 (GMT+6)
System Uptime: 1 days 7:26:11.973
Loading Kernel Symbols
........................................................................................................................................
Loading User Symbols
Loading unloaded module list
.......................................
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1000000A, {9d086240, 2, 0, 8051ede8}

Unable to load image SYMEVENT.SYS, Win32 error 0n2
*** WARNING: Unable to verify timestamp for SYMEVENT.SYS
*** ERROR: Module load completed but symbols could not be loaded for SYMEVENT.SYS


Probably caused by : SYMEVENT.SYS ( SYMEVENT+12175 )

Followup: MachineOwner
---------

I confirmed they have Symantec Antivirus version 10.1.6 version. Even after disabling the antivirus (not removing which would voilate corporate policy), the computer crashed with the same error as above.

Now the affected users have stopped using the java application (blaming it to be the cause) and it is affecting the usability of the application. If not resolved, it might affect the funding although the application may not have anything to do with the crash. Unfortunately, the laptops don't crash if they don't use the application.

I would appreciate if someone could direct me how to proceed further since the laptops are under corporate IT control.

Regards,
arpee

Can you attach a few of these latest BSOD's since Symantec has been disabled? When did these crashes start occuring?

It would be a big help if we could read them; I am not sure if Java is your issue but something else going on -- like your anti-virus.

what version of Java?

Route44,

I have analyzed around 8 minidumps, 6 of which were from before symantec was disabled and 2 after disabling. Out of these 6 reported SYMEVENT.SYS as possible cause which includes the dump after Symantec was disabled. The other 2 instances happened only once, one after the other, which occured possibly due to memory corruption (as reported by windbg). The only pattern I could get from one of the user is it happens when he tries to copy data from excel file generated by the application to his own master excel file. The files are not huge (< 100kb). Others reported that it happened to them when they leave the application open on their computer for while (after using is heavily which is mostly like querying 1000 records from the database at a time and displaying them in applet as tree structure) and return to their computer to start working only to find it getting rebooted. I cannot see the screen myself as I am working from different location but I am told the screen has the same information as in the system event log (one of which I have mentioned in my original post).

jobeard,
Currently the java plug-in version on the machines have been updated to 1.5.0_10 which is same as what the application was developed with. However, prior to this exercise different machine had different version like 1.6.0 and 1.4.2. This hasn't helped in getting anything different.

Was there any attempt to run MemTest on your memory just as a precautionary? That rebooting sounds awfully familiar to what I was experiencing when one of my four sticks of RAM was corrupted. I could be in the middle of someting or walk away and come back and either my system was rebooting or I had an error notification on my desktop screen.

Just for the information alone I'd try running MemTest.



Is this Symantec Corporate? Even when it is disabled Symantec is still present and some applications may still be running in the background. Check Task Manager and for I'd also run chkdsk. I assume you've run scans for viruses, trojans, and malware.


For clarity, have you always had Java and Symantec present and only recently the crashes have been occuring?




What keeps raising the red flag for me is how SYMEVENT.SYS is ever present as the cause.

I am waiting for Dell Diagnostic tool report from the system. It should cover RAM and hard disk checking, as per my knowledge.
Yes, it is Symantec Corporate and scans have been made. Java and Symantec have always been present and crash got reported only after they started using this Java applet application.

If your Java is still 6.*, then I suggest deleting the Applet plugin and download/ reinstall it.

btw: the current release is 1.6.0_04

I got the Dell Diagnostic tool run on the laptop and the result was "All passed". This time I had the Symantec antivirus removed from the system. However, there was another crash. Here is the report from WinDBG tool.

Microsoft (R) Windows Debugger Version 6.8.0004.0 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [link edited]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows XP Kernel Version 2600 (Service Pack 2) UP Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 2600.xpsp_sp2_gdr.070227-2254
Kernel base = 0x804d7000 PsLoadedModuleList = 0x805533a0
Debug session time: Fri Feb 1 16:55:42.437 2008 (GMT-5)
System Uptime: 0 days 8:01:56.533
Loading Kernel Symbols
...........................................................................................................................................
Loading User Symbols
Loading unloaded module list
........................
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1000000A, {9d086240, 2, 0, 8051ede8}



Probably caused by : memory_corruption ( nt!MiDeletePte+198 )

Followup: MachineOwner
---------

kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 9d086240, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000000, bitfield :
bit 0 : value 0 = read operation, 1 = write operation
bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: 8051ede8, address which referenced memory

Debugging Details:
------------------




READ_ADDRESS: 9d086240

CURRENT_IRQL: 2

FAULTING_IP:
nt!MiDeletePte+198
8051ede8 8b420c mov eax,dword ptr [edx+0Ch]

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: 0xA

PROCESS_NAME: iexplore.exe

LAST_CONTROL_TRANSFER: from 8051f25c to 8051ede8

STACK_TEXT:
ee018a50 8051f25c c000cea0 019d4000 00000000 nt!MiDeletePte+0x198
ee018b14 8051680d 00000020 01acffff 00000000 nt!MiDeleteVirtualAddresses+0x164
ee018b30 805a75b4 019d0000 01acffff ee018bf0 nt!MiDeleteFreeVm+0x1d
ee018bd8 8053ca28 ffffffff ee018cb8 ee018cbc nt!NtFreeVirtualMemory+0x42e
ee018bd8 804fdacd ffffffff ee018cb8 ee018cbc nt!KiFastCallEntry+0xf8
ee018c60 805c7395 ffffffff ee018cb8 ee018cbc nt!ZwFreeVirtualMemory+0x11
ee018d14 805c7696 00000000 00000000 85d48930 nt!PspExitThread+0x541
ee018d34 805c79d6 85d48930 00000000 ee018d64 nt!PspTerminateThreadByPointer+0x52
ee018d54 8053ca28 00000000 00000000 01acff74 nt!NtTerminateThread+0x70
ee018d54 7c90eb94 00000000 00000000 01acff74 nt!KiFastCallEntry+0xf8
WARNING: Frame IP not in any known module. Following frames may be wrong.
01acff74 00000000 00000000 00000000 00000000 0x7c90eb94


STACK_COMMAND: kb

FOLLOWUP_IP:
nt!MiDeletePte+198
8051ede8 8b420c mov eax,dword ptr [edx+0Ch]

SYMBOL_STACK_INDEX: 0

SYMBOL_NAME: nt!MiDeletePte+198

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nt

DEBUG_FLR_IMAGE_TIMESTAMP: 45e53f9c

IMAGE_NAME: memory_corruption

FAILURE_BUCKET_ID: 0xA_nt!MiDeletePte+198

BUCKET_ID: 0xA_nt!MiDeletePte+198

Followup: MachineOwner
---------

As Route44 has suggested, it seems to point to faulty RAM. I am going to have the MemTest run separately. If anyone can point something else from the WinDBG output, please let me know.

The three suspects are Memory, Drivers, and the HD itself -- in that order.
Test memory thoroughly!! Then update ALL your drivers.
If it happens again, then backup your HD and test it

I have some good news to share on the issue. Although it is too early to conclude but the problem has not occured on one of the machine since 24hrs after upgrading NVIDIA driver. Earlier it was very easy to crash. A couple of other machines (all dell M70) have also been upgraded and under watch. Previous version of NVIDIA driver was 6.7.7.1 while the upgraded version is 8.4.3.0. Special thanks to jobeard and route44 for quick response and providing vital clues. I will update here if there is any further information.

Thanks arpee for the update. Computers, who can figure them especially when minidumps point to one thing, i.e., memory corruption, only to find out it was a Nvidia driver.

joebeard was right on with updating all drivers. it appears the newer Java script needed the newer Nvidia drivers.