TechSpot

WinDbg and BSODs

By geoffcox
Oct 22, 2011
Post New Reply
  1. Hello

    I have a PC which has screen freezing and bsods. When the screen freezes CTRL/ALT/DEL does not bring up Task manager so have to reboot.

    I have used memtest86+ for hours - no errors. I have used Verifier on all drivers loaded and no problem there. The power unit is 400W so that should be OK. As far as I know all drivers are up-to-date. I have tried removing both DVD drives and still get the freezing. I have reseated the RAM sticks.

    The latest text from WinDbg (!analyze -v) is below and I have attached the minidump file.

    Can anyone see an answer?!!

    Cheers

    Geoff


    Microsoft (R) Windows Debugger Version 6.12.0002.633 X86
    Copyright (c) Microsoft Corporation. All rights reserved.


    Loading Dump File [C:\Windows\Minidump\102211-15578-01.dmp]
    Mini Kernel Dump File: Only registers and stack trace are available

    Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
    Executable search path is:
    Windows 7 Kernel Version 7601 (Service Pack 1) MP (2 procs) Free x86 compatible
    Product: WinNt, suite: TerminalServer SingleUserTS Personal
    Built by: 7601.17640.x86fre.win7sp1_gdr.110622-1506
    Machine Name:
    Kernel base = 0x8283f000 PsLoadedModuleList = 0x8297f250
    Debug session time: Sat Oct 22 08:15:05.047 2011 (UTC + 1:00)
    System Uptime: 0 days 0:16:13.875
    Loading Kernel Symbols
    ...............................................................
    ................................................................
    ......
    Loading User Symbols
    Loading unloaded module list
    .....
    *******************************************************************************
    * *
    * Bugcheck Analysis *
    * *
    *******************************************************************************

    Use !analyze -v to get detailed debugging information.

    BugCheck 1000008E, {c0000005, 93918197, 9c4efa88, 0}

    Probably caused by : win32k.sys ( win32k!zzzLockDisplayAreaAndInvalidateDCCache+ba )

    Followup: MachineOwner
    ---------

    1: kd> !analyze -v
    *******************************************************************************
    * *
    * Bugcheck Analysis *
    * *
    *******************************************************************************

    KERNEL_MODE_EXCEPTION_NOT_HANDLED_M (1000008e)
    This is a very common bugcheck. Usually the exception address pinpoints
    the driver/function that caused the problem. Always note this address
    as well as the link date of the driver/image that contains this address.
    Some common problems are exception code 0x80000003. This means a hard
    coded breakpoint or assertion was hit, but this system was booted
    /NODEBUG. This is not supposed to happen as developers should never have
    hardcoded breakpoints in retail code, but ...
    If this happens, make sure a debugger gets connected, and the
    system is booted /DEBUG. This will let us see why this breakpoint is
    happening.
    Arguments:
    Arg1: c0000005, The exception code that was not handled
    Arg2: 93918197, The address that the exception occurred at
    Arg3: 9c4efa88, Trap Frame
    Arg4: 00000000

    Debugging Details:
    ------------------


    EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

    FAULTING_IP:
    win32k!zzzLockDisplayAreaAndInvalidateDCCache+ba
    93918197 f6412302 test byte ptr [ecx+23h],2

    TRAP_FRAME: 9c4efa88 -- (.trap 0xffffffff9c4efa88)
    ErrCode = 00000000
    eax=fe04d168 ebx=00000010 ecx=00000000 edx=00010002 esi=fe04d198 edi=fe8264c0
    eip=93918197 esp=9c4efafc ebp=9c4efb14 iopl=0 nv up ei pl zr na pe nc
    cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010246
    win32k!zzzLockDisplayAreaAndInvalidateDCCache+0xba:
    93918197 f6412302 test byte ptr [ecx+23h],2 ds:0023:00000023=??
    Resetting default scope

    CUSTOMER_CRASH_COUNT: 1

    DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT

    BUGCHECK_STR: 0x8E

    PROCESS_NAME: iexplore.exe

    CURRENT_IRQL: 0

    LAST_CONTROL_TRANSFER: from 9392c7c9 to 93918197

    STACK_TEXT:
    9c4efb14 9392c7c9 fe8264c0 00000010 00000000 win32k!zzzLockDisplayAreaAndInvalidateDCCache+0xba
    9c4efc30 939303f4 00000000 00000000 fe818f68 win32k!xxxCreateWindowEx+0xcb3
    9c4efcf0 8287487a 00000000 9c4efcc0 9c4efcb4 win32k!NtUserCreateWindowEx+0x2a8
    9c4efcf0 775f70b4 00000000 9c4efcc0 9c4efcb4 nt!KiFastCallEntry+0x12a
    WARNING: Frame IP not in any known module. Following frames may be wrong.
    001fe548 00000000 00000000 00000000 00000000 0x775f70b4


    STACK_COMMAND: kb

    FOLLOWUP_IP:
    win32k!zzzLockDisplayAreaAndInvalidateDCCache+ba
    93918197 f6412302 test byte ptr [ecx+23h],2

    SYMBOL_STACK_INDEX: 0

    SYMBOL_NAME: win32k!zzzLockDisplayAreaAndInvalidateDCCache+ba

    FOLLOWUP_NAME: MachineOwner

    MODULE_NAME: win32k

    IMAGE_NAME: win32k.sys

    DEBUG_FLR_IMAGE_TIMESTAMP: 4e65853e

    FAILURE_BUCKET_ID: 0x8E_win32k!zzzLockDisplayAreaAndInvalidateDCCache+ba

    BUCKET_ID: 0x8E_win32k!zzzLockDisplayAreaAndInvalidateDCCache+ba

    Followup: MachineOwner
    ---------
     

    Attached Files:

  2. geoffcox

    geoffcox TS Rookie Topic Starter Posts: 23

    Its happened again! WinDbg text below plus mindump file attached ...

    Geoff


    Microsoft (R) Windows Debugger Version 6.12.0002.633 X86
    Copyright (c) Microsoft Corporation. All rights reserved.


    Loading Dump File [C:\Windows\Minidump\102211-19046-01.dmp]
    Mini Kernel Dump File: Only registers and stack trace are available

    Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
    Executable search path is:
    Windows 7 Kernel Version 7601 (Service Pack 1) MP (2 procs) Free x86 compatible
    Product: WinNt, suite: TerminalServer SingleUserTS Personal
    Built by: 7601.17640.x86fre.win7sp1_gdr.110622-1506
    Machine Name:
    Kernel base = 0x8284b000 PsLoadedModuleList = 0x8298b250
    Debug session time: Sat Oct 22 09:33:19.205 2011 (UTC + 1:00)
    System Uptime: 0 days 1:04:53.048
    Loading Kernel Symbols
    ...............................................................
    ................................................................
    ........
    Loading User Symbols
    Loading unloaded module list
    .....
    0: kd> !analyze -v
    *******************************************************************************
    * *
    * Bugcheck Analysis *
    * *
    *******************************************************************************

    BAD_POOL_HEADER (19)
    The pool is already corrupt at the time of the current request.
    This may or may not be due to the caller.
    The internal pool links must be walked to figure out a possible cause of
    the problem, and then special pool applied to the suspect tags or the driver
    verifier to a suspect driver.
    Arguments:
    Arg1: 00000020, a pool block header size is corrupt.
    Arg2: a6caa240, The pool entry we were looking for within the page.
    Arg3: a6caa2d0, The next pool entry.
    Arg4: 0a12021f, (reserved)

    Debugging Details:
    ------------------

    GetPointerFromAddress: unable to read from 829aa828
    Unable to read MiSystemVaType memory at 8298ada0

    BUGCHECK_STR: 0x19_20

    POOL_ADDRESS: GetPointerFromAddress: unable to read from 829aa828
    Unable to read MiSystemVaType memory at 8298ada0
    a6caa240

    CUSTOMER_CRASH_COUNT: 1

    DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT

    PROCESS_NAME: iexplore.exe

    CURRENT_IRQL: 0

    LAST_CONTROL_TRANSFER: from 82a86f25 to 82963c4e

    STACK_TEXT:
    9c1a6b90 82a86f25 a6caa248 e24e4d43 82a86eec nt!ExFreePoolWithTag+0x1b2
    9c1a6b9c 82a86eec a97f76d5 00000003 00000001 nt!CmQueryKey+0x585
    9c1a6c68 82a7447b 00000000 00000003 0273aa3c nt!CmQueryKey+0x551
    9c1a6d18 8288087a 000003ae 00000003 0273aa3c nt!NtQueryKey+0x328
    9c1a6d18 76ec70b4 000003ae 00000003 0273aa3c nt!KiFastCallEntry+0x12a
    WARNING: Frame IP not in any known module. Following frames may be wrong.
    0273aa00 00000000 00000000 00000000 00000000 0x76ec70b4


    STACK_COMMAND: kb

    FOLLOWUP_IP:
    nt!ExFreePoolWithTag+1b2
    82963c4e cc int 3

    SYMBOL_STACK_INDEX: 0

    SYMBOL_NAME: nt!ExFreePoolWithTag+1b2

    FOLLOWUP_NAME: MachineOwner

    MODULE_NAME: nt

    IMAGE_NAME: ntkrnlmp.exe

    DEBUG_FLR_IMAGE_TIMESTAMP: 4e02a381

    FAILURE_BUCKET_ID: 0x19_20_nt!ExFreePoolWithTag+1b2

    BUCKET_ID: 0x19_20_nt!ExFreePoolWithTag+1b2

    Followup: MachineOwner
    ---------
     

    Attached Files:

  3. Route44

    Route44 TechSpot Ambassador Posts: 11,966   +70

    I read the minidumps and though nothing specific was cited the error code 0x8E can direct us to try a good diagnostic step. This error is almost always caused by hardware and can be a strong indicator of corrupted memory (bad RAM). Therefore we want you to run Memtest on your RAM.

    1. Go to www.memtest.org and download the latest ISO version which is 4.20. It is free and perfectly safe.

    2. Burn ISO to a CD.

    3. Place CD in your drive and reboot with CD in drive. (You might have to place your drive as first bootable in your BIOS) The test will take over.


    There is a Tutorial: How to use Memtest in our Guides and Tutorials forum; follow the instructions. There is a newer version than what is listed; use the newer. If you need to see what the Memtest screen looks like go to reply #21. The third screen is the Memtest screen.

    Step1 - Let it run for a LONG time. The rule is a minimum of 7 Passes (not hours; this test is not measured by hours); the more Passes after 7 so much the better. The only exception is if you start getting errors before 7 Passes then you can skip to Step 2.

    There are 8 individual tests per Pass. Many people will start this test before going to bed and check it the next day.

    If you have errors you have corrupted memory and it needs to be replaced.

    Step 2 – Because of errors you need to run this test per stick of RAM. Take out one and run the test. Then take that one out and put the other in and run the test. If you start getting errors before 7 Passes you know that stick is corrupted and you don’t need to run the test any further on that stick.


    * Get back to us with the results.
     
  4. geoffcox

    geoffcox TS Rookie Topic Starter Posts: 23

    Thanks for your reply. I have used memtest before but will try again and ger back.

    Cheers

    Geoff
     
  5. geoffcox

    geoffcox TS Rookie Topic Starter Posts: 23

    Hello

    'just to say I ran the 4.2 version of Memtest86+ on the 2x 1GB sticks separately for 7 passes each - and no errors.

    I will see when/if I get the screen to freeze and come back!

    Cheers

    Geoff
     
  6. Route44

    Route44 TechSpot Ambassador Posts: 11,966   +70

    If you get anymore Blue Screens please attach the minidump files in your next post.
     
  7. geoffcox

    geoffcox TS Rookie Topic Starter Posts: 23

    Hello

    it's started again! This time I had just re-installed Windows 7 on a new hard disk. I went away for a few minutes and then found the PC had rebooted and created a minidump file which I attach.

    It then froze and had to reboot - so attache 2nd minidump file too.

    Any ideas?!

    Cheers

    Geoff
     

    Attached Files:

  8. Route44

    Route44 TechSpot Ambassador Posts: 11,966   +70

    This time memory corruption was specifically cited as your issue. Run memtest for 7 passes or more if possible per stick.



    *** If Memtest shows no errors then find the voltage specs of your RAM and compare it to the voltage setting in your BIOS. Do they match?
     
  9. geoffcox

    geoffcox TS Rookie Topic Starter Posts: 23

    I have run memtest86+ v4.2 7 times and also the Miscrosoft Memory Diagnostic tool 6 times and no errors reported.

    will check the voltages.

    Cheers

    Geoff
     

Similar Topics

Add New Comment

You need to be a member to leave a comment. Join thousands of tech enthusiasts and participate.
TechSpot Account You may also...