Hello and thank you in advance for your help.
Optiplex 755 rebooted about 3X in one week per the user. The error code is 00000096 with parameters 88e9ca48, 8055b17c, 8055b140, 8055bd32.
Sent the following minidumps to windbgfb at microsoft an hour ago and now waiting.
Reseated the 2GB memory stick and memory test passed, cleaned the pc and ran malware and anti-virus programs with 10 infections, ran chkdsk, but will not have another chance work on the user's pc until late next week.
Would like to have run dumpchk.exe, Dell Crash Analysis...need help interpretting the dump...thank you!
Microsoft (R) Windows Debugger Version 6.10.0003.233 X86
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [C:\Documents and Settings\cmorales\Desktop\Minidump\Mini121008-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: C:\WINDOWS\Symbols
Executable search path is:
Unable to load image ntoskrnl.exe, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
Windows XP Kernel Version 2600 (Service Pack 3) UP Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Machine Name:
Kernel base = 0x804d7000 PsLoadedModuleList = 0x80554040
Debug session time: Wed Dec 10 16:11:38.662 2008 (GMT-6)
System Uptime: 0 days 5:58:17.815
Unable to load image ntoskrnl.exe, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
Loading Kernel Symbols
...............................................................
................................................................
...
Loading User Symbols
Loading unloaded module list
.........................
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 96, {88d66f58, 8055b17c, 8055b140, 8056bd32}
Probably caused by : ntoskrnl.exe ( nt!NtSetIoCompletion+17 )
Followup: MachineOwner
---------
kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
INVALID_WORK_QUEUE_ITEM (96)
This message occurs when KeRemoveQueue removes a queue entry whose flink
or blink field is null. This is almost always called by code misusing
worker thread work items, but any queue misuse can cause this. The rule
is that an entry on a queue may only be inserted on the list once. When an
item is removed from a queue, it's flink field is set to NULL. This bugcheck
occurs when remove queue attempts to remove an entry, but the flink or blink
field is NULL. In order to debug this problem, you need to know the queue being
referenced.
In an attempt to help identify the guilty driver, this bugcheck assumes the
queue is a worker queue (ExWorkerQueue) and prints the worker routine as
parameter 4 below.
Arguments:
Arg1: 88d66f58, The address of the queue entry whose flink/blink field is NULL
Arg2: 8055b17c, The address of the queue being references. Usually this is one
of the ExWorkerQueues.
Arg3: 8055b140, The base address of the ExWorkerQueue array. This will help determine
if the queue in question is an ExWorkerQueue and if so, the offset from
this parameter will isolate the queue.
Arg4: 8056bd32, If this is an ExWorkerQueue (which it usually is), this is the address
of the worker routine that would have been called if the work item was
valid. This can be used to isolate the driver that is misusing the work
queue.
Debugging Details:
------------------
WORKER_ROUTINE:
nt!NtSetIoCompletion+17
8056bd32 8bff mov edi,edi
FAULTING_IP:
nt!NtSetIoCompletion+17
8056bd32 8bff mov edi,edi
WORK_ITEM: 88d66f58
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: DRIVER_FAULT
BUGCHECK_STR: 0x96
PROCESS_NAME: System
LAST_CONTROL_TRANSFER: from 804fb39f to 804f8cc5
STACK_TEXT:
ba4f3d2c 804fb39f 00000096 88d66f58 8055b17c nt!KeContextToKframes+0x1eb
ba4f3d6c 80534be7 00000001 00000001 00000000 nt!ExTraceAllTables+0x5a
ba4f3d70 00000000 00000001 00000000 00000000 nt!ZwAcceptConnectPort
STACK_COMMAND: .bugcheck ; kb
FOLLOWUP_IP:
nt!NtSetIoCompletion+17
8056bd32 8bff mov edi,edi
SYMBOL_NAME: nt!NtSetIoCompletion+17
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntoskrnl.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 48a3fbd8
FAILURE_BUCKET_ID: 0x96_nt!NtSetIoCompletion+17
BUCKET_ID: 0x96_nt!NtSetIoCompletion+17
Followup: MachineOwner
---------
Optiplex 755 rebooted about 3X in one week per the user. The error code is 00000096 with parameters 88e9ca48, 8055b17c, 8055b140, 8055bd32.
Sent the following minidumps to windbgfb at microsoft an hour ago and now waiting.
Reseated the 2GB memory stick and memory test passed, cleaned the pc and ran malware and anti-virus programs with 10 infections, ran chkdsk, but will not have another chance work on the user's pc until late next week.
Would like to have run dumpchk.exe, Dell Crash Analysis...need help interpretting the dump...thank you!
Microsoft (R) Windows Debugger Version 6.10.0003.233 X86
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [C:\Documents and Settings\cmorales\Desktop\Minidump\Mini121008-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: C:\WINDOWS\Symbols
Executable search path is:
Unable to load image ntoskrnl.exe, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
Windows XP Kernel Version 2600 (Service Pack 3) UP Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Machine Name:
Kernel base = 0x804d7000 PsLoadedModuleList = 0x80554040
Debug session time: Wed Dec 10 16:11:38.662 2008 (GMT-6)
System Uptime: 0 days 5:58:17.815
Unable to load image ntoskrnl.exe, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
Loading Kernel Symbols
...............................................................
................................................................
...
Loading User Symbols
Loading unloaded module list
.........................
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 96, {88d66f58, 8055b17c, 8055b140, 8056bd32}
Probably caused by : ntoskrnl.exe ( nt!NtSetIoCompletion+17 )
Followup: MachineOwner
---------
kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
INVALID_WORK_QUEUE_ITEM (96)
This message occurs when KeRemoveQueue removes a queue entry whose flink
or blink field is null. This is almost always called by code misusing
worker thread work items, but any queue misuse can cause this. The rule
is that an entry on a queue may only be inserted on the list once. When an
item is removed from a queue, it's flink field is set to NULL. This bugcheck
occurs when remove queue attempts to remove an entry, but the flink or blink
field is NULL. In order to debug this problem, you need to know the queue being
referenced.
In an attempt to help identify the guilty driver, this bugcheck assumes the
queue is a worker queue (ExWorkerQueue) and prints the worker routine as
parameter 4 below.
Arguments:
Arg1: 88d66f58, The address of the queue entry whose flink/blink field is NULL
Arg2: 8055b17c, The address of the queue being references. Usually this is one
of the ExWorkerQueues.
Arg3: 8055b140, The base address of the ExWorkerQueue array. This will help determine
if the queue in question is an ExWorkerQueue and if so, the offset from
this parameter will isolate the queue.
Arg4: 8056bd32, If this is an ExWorkerQueue (which it usually is), this is the address
of the worker routine that would have been called if the work item was
valid. This can be used to isolate the driver that is misusing the work
queue.
Debugging Details:
------------------
WORKER_ROUTINE:
nt!NtSetIoCompletion+17
8056bd32 8bff mov edi,edi
FAULTING_IP:
nt!NtSetIoCompletion+17
8056bd32 8bff mov edi,edi
WORK_ITEM: 88d66f58
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: DRIVER_FAULT
BUGCHECK_STR: 0x96
PROCESS_NAME: System
LAST_CONTROL_TRANSFER: from 804fb39f to 804f8cc5
STACK_TEXT:
ba4f3d2c 804fb39f 00000096 88d66f58 8055b17c nt!KeContextToKframes+0x1eb
ba4f3d6c 80534be7 00000001 00000001 00000000 nt!ExTraceAllTables+0x5a
ba4f3d70 00000000 00000001 00000000 00000000 nt!ZwAcceptConnectPort
STACK_COMMAND: .bugcheck ; kb
FOLLOWUP_IP:
nt!NtSetIoCompletion+17
8056bd32 8bff mov edi,edi
SYMBOL_NAME: nt!NtSetIoCompletion+17
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntoskrnl.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 48a3fbd8
FAILURE_BUCKET_ID: 0x96_nt!NtSetIoCompletion+17
BUCKET_ID: 0x96_nt!NtSetIoCompletion+17
Followup: MachineOwner
---------
