Minidump and Event Log

By mulcra
Dec 12, 2008
Topic Status:
Not open for further replies.
  1. Hello and thank you in advance for your help.

    Optiplex 755 rebooted about 3X in one week per the user. The error code is 00000096 with parameters 88e9ca48, 8055b17c, 8055b140, 8055bd32.

    Sent the following minidumps to windbgfb at microsoft an hour ago and now waiting.
    Reseated the 2GB memory stick and memory test passed, cleaned the pc and ran malware and anti-virus programs with 10 infections, ran chkdsk, but will not have another chance work on the user's pc until late next week.
    Would like to have run dumpchk.exe, Dell Crash Analysis...need help interpretting the dump...thank you!


    Microsoft (R) Windows Debugger Version 6.10.0003.233 X86
    Copyright (c) Microsoft Corporation. All rights reserved.


    Loading Dump File [C:\Documents and Settings\cmorales\Desktop\Minidump\Mini121008-01.dmp]
    Mini Kernel Dump File: Only registers and stack trace are available

    Symbol search path is: C:\WINDOWS\Symbols
    Executable search path is:
    Unable to load image ntoskrnl.exe, Win32 error 0n2
    *** WARNING: Unable to verify timestamp for ntoskrnl.exe
    Windows XP Kernel Version 2600 (Service Pack 3) UP Free x86 compatible
    Product: WinNt, suite: TerminalServer SingleUserTS
    Machine Name:
    Kernel base = 0x804d7000 PsLoadedModuleList = 0x80554040
    Debug session time: Wed Dec 10 16:11:38.662 2008 (GMT-6)
    System Uptime: 0 days 5:58:17.815
    Unable to load image ntoskrnl.exe, Win32 error 0n2
    *** WARNING: Unable to verify timestamp for ntoskrnl.exe
    Loading Kernel Symbols
    ...............................................................
    ................................................................
    ...
    Loading User Symbols
    Loading unloaded module list
    .........................
    *******************************************************************************
    * *
    * Bugcheck Analysis *
    * *
    *******************************************************************************

    Use !analyze -v to get detailed debugging information.

    BugCheck 96, {88d66f58, 8055b17c, 8055b140, 8056bd32}

    Probably caused by : ntoskrnl.exe ( nt!NtSetIoCompletion+17 )

    Followup: MachineOwner
    ---------

    kd> !analyze -v
    *******************************************************************************
    * *
    * Bugcheck Analysis *
    * *
    *******************************************************************************

    INVALID_WORK_QUEUE_ITEM (96)
    This message occurs when KeRemoveQueue removes a queue entry whose flink
    or blink field is null. This is almost always called by code misusing
    worker thread work items, but any queue misuse can cause this. The rule
    is that an entry on a queue may only be inserted on the list once. When an
    item is removed from a queue, it's flink field is set to NULL. This bugcheck
    occurs when remove queue attempts to remove an entry, but the flink or blink
    field is NULL. In order to debug this problem, you need to know the queue being
    referenced.
    In an attempt to help identify the guilty driver, this bugcheck assumes the
    queue is a worker queue (ExWorkerQueue) and prints the worker routine as
    parameter 4 below.
    Arguments:
    Arg1: 88d66f58, The address of the queue entry whose flink/blink field is NULL
    Arg2: 8055b17c, The address of the queue being references. Usually this is one
    of the ExWorkerQueues.
    Arg3: 8055b140, The base address of the ExWorkerQueue array. This will help determine
    if the queue in question is an ExWorkerQueue and if so, the offset from
    this parameter will isolate the queue.
    Arg4: 8056bd32, If this is an ExWorkerQueue (which it usually is), this is the address
    of the worker routine that would have been called if the work item was
    valid. This can be used to isolate the driver that is misusing the work
    queue.

    Debugging Details:
    ------------------


    WORKER_ROUTINE:
    nt!NtSetIoCompletion+17
    8056bd32 8bff mov edi,edi

    FAULTING_IP:
    nt!NtSetIoCompletion+17
    8056bd32 8bff mov edi,edi

    WORK_ITEM: 88d66f58

    CUSTOMER_CRASH_COUNT: 1

    DEFAULT_BUCKET_ID: DRIVER_FAULT

    BUGCHECK_STR: 0x96

    PROCESS_NAME: System

    LAST_CONTROL_TRANSFER: from 804fb39f to 804f8cc5

    STACK_TEXT:
    ba4f3d2c 804fb39f 00000096 88d66f58 8055b17c nt!KeContextToKframes+0x1eb
    ba4f3d6c 80534be7 00000001 00000001 00000000 nt!ExTraceAllTables+0x5a
    ba4f3d70 00000000 00000001 00000000 00000000 nt!ZwAcceptConnectPort


    STACK_COMMAND: .bugcheck ; kb

    FOLLOWUP_IP:
    nt!NtSetIoCompletion+17
    8056bd32 8bff mov edi,edi

    SYMBOL_NAME: nt!NtSetIoCompletion+17

    FOLLOWUP_NAME: MachineOwner

    MODULE_NAME: nt

    IMAGE_NAME: ntoskrnl.exe

    DEBUG_FLR_IMAGE_TIMESTAMP: 48a3fbd8

    FAILURE_BUCKET_ID: 0x96_nt!NtSetIoCompletion+17

    BUCKET_ID: 0x96_nt!NtSetIoCompletion+17

    Followup: MachineOwner
    ---------
  2. unknownian

    unknownian Newcomer, in training

    I have had a similar issue except with the Dell Optiplex 745's.. apparently the computer will just reboot on our clients. This was my minidump file.
    Debugging Details:
    ------------------


    WORKER_ROUTINE:
    nt!IopProcessWorkItem+0
    8056bd32 8bff mov edi,edi

    FAULTING_IP:
    nt!IopProcessWorkItem+0
    8056bd32 8bff mov edi,edi

    WORK_ITEM: 8a8881a8

    CUSTOMER_CRASH_COUNT: 1

    DEFAULT_BUCKET_ID: DRIVER_FAULT

    BUGCHECK_STR: 0x96

    PROCESS_NAME: System

    LAST_CONTROL_TRANSFER: from 804fb39f to 804f8cc5

    STACK_TEXT:
    ba513d2c 804fb39f 00000096 8a8881a8 8055b17c nt!KeBugCheckEx+0x1b
    ba513d6c 80534be8 00000001 00000001 00000000 nt!KeRemoveQueue+0x2e7
    ba513dac 805c61ec 8a8881a8 00000000 00000000 nt!ExpWorkerThread+0xd6
    ba513ddc 80541de2 80534b12 00000001 00000000 nt!PspSystemThreadStartup+0x34
    00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16


    STACK_COMMAND: .bugcheck ; kb

    FOLLOWUP_IP:
    nt!IopProcessWorkItem+0
    8056bd32 8bff mov edi,edi

    SYMBOL_NAME: nt!IopProcessWorkItem+0

    FOLLOWUP_NAME: MachineOwner

    MODULE_NAME: nt

    IMAGE_NAME: ntkrnlpa.exe

    DEBUG_FLR_IMAGE_TIMESTAMP: 498c11d3

    FAILURE_BUCKET_ID: 0x96_nt!IopProcessWorkItem+0

    BUCKET_ID: 0x96_nt!IopProcessWorkItem+0

    Followup: MachineOwner
    ---------

    the image name ntkrnlpa.exe seemed to lead to the Video card. However, i went ahead and downloaded and installed all the drivers Chip, NIC, VID.. the problem has seemed to stop. Hope this helps.
  3. snowchick7669

    snowchick7669 TechSpot Enthusiast Posts: 698

    Hi unknownian,

    Would suggest creating your own thread with your problem, as even though Mulcra and your problem may seem similar, they could be rather different. :)

    That way no one gets confused and we get a quicker fix for both of you
Topic Status:
Not open for further replies.


Add New Comment

TechSpot Members
Login or sign up for free,
it takes about 30 seconds.
You may also...


Get complete access to the TechSpot community. Join thousands of technology enthusiasts that contribute and share knowledge in our forum. Get a private inbox, upload your own photo gallery and more.