XP SP3 crashing with Event Category: (102), Event ID: 1003

By rkudyba
Apr 1, 2010
Topic Status:
Not open for further replies.
  1. rkudyba

    rkudyba Newcomer, in training Topic Starter Posts: 46

    Another dump, this time with a 0X00000007F and it's crashing in Safe Mode whenever I copy files either to a USB or via the network. Any hope?
  2. Route44

    Route44 TechSpot Ambassador Posts: 12,113   +23

    0x0000007F: UNEXPECTED_KERNEL_MODE_TRAP
    One of three types of problems occurred in kernel-mode: (1) Hardware failures. (2) Software problems. (3) A bound trap (i.e., a condition that the kernel is not allowed to have or intercept). Hardware failures are the most common cause and, of these, memory hardware failures are the most common.

    Nothing definitive as way of drivers, etc. However, within both dumps EXCETION_GP_FAILURE was noted and one possibility is that this can be due to faulty memory.

    I went back and reread this thread. You ran memtest once for 3 Passes and then again for 4 Passes for a total of 7 Passes. I missed this earlier and that is not how it needs to work.

    Memtest needs to run a mininimum of 7 Passes in one testing. Many people think that after running the minimum of 8 individual tests that constitute one Pass that the test is only repeating itself. Nothing could be further from the truth because the test throws at the memory differeing patterns all the time that is why a minimum of 7 Passes is essential.

    I have run this test myself and my RAM together failed in the first Pass but running individually per stick I didn't get errors until the 7th or even 8th Pass. I know those who didn't get fails until the 10th, 15th, 19th, and one person until the 26th.

    I strongly suggest you start this test again 2 hours before going to bed and check the next morning. In your case I would not stop this test until at least 10 Passes have occured.
  3. rkudyba

    rkudyba Newcomer, in training Topic Starter Posts: 46

    I have run the MEMTEST overnight twice and never did an error show. Not sure how many times it ran but it was for over 12 hours.

    I went back to the original memory and right away got this even in Safe Mode:
    The computer has rebooted from a bugcheck. The bugcheck was: 0x00000050 (0x80f19dc1, 0x00000001, 0xf73fcac1, 0x00000000). A dump was saved in: C:\WINDOWS\MEMORY.DMP. And here it is.
  4. Route44

    Route44 TechSpot Ambassador Posts: 12,113   +23

    You are going to find this hard to believe but the 0x50 error specifically cited corrupted memory are the cause of your system crashes. On the rare occasions bad RAM has been known to pass Memtest.


    The other 0x50 error cited Mup.sys which is a Windows driver. See this link to gain more information: http://www.file.net/process/mup.sys.html

    In my research the advice was to run a Repair but one person mentioned he got this this error and Mup.sys and came to be a bad memory slot on his motherboard and once he switched the memory to another slot all was well.

    How many memory slots does your motherboard have?
  5. rkudyba

    rkudyba Newcomer, in training Topic Starter Posts: 46

    4 slots, 2 blue, 2 black. That's what I keep thinking that it's a MB problem. But if it is a bad slot would MEMTEST show which?

    The latest crash had 4 512 MB RAM's from HP, the originals.

    The earlier crashes had replacement Kingston 1 GB chips.
  6. Route44

    Route44 TechSpot Ambassador Posts: 12,113   +23

    I think this is going to be the "switch around and see what works" diagnostic step. Not very sleek but it works. :blush:

    I wish I could see how the manual designates the memory configuration for your board. I take it the Kingston is in a 2x1gig set, correct?

    If so where are they placed in the motherboard, both blue or both black?

    Can you link me to your system on HP's website?
  7. rkudyba

    rkudyba Newcomer, in training Topic Starter Posts: 46

    HP D530 CMT drivers link.

    Yes they come in pairs and need to be installed in the corresponding blue & black slots respectively, but it doesn't much matter since the 4 are all the same.

    See attached pic of the slots w old mem installed.

    I have MEMTEST running now on the old memory, and I'll run it all night.

    Attached Files:

  8. Route44

    Route44 TechSpot Ambassador Posts: 12,113   +23

    I believe I found the correct manual for your system (not 100% sure though). Can you link me to your Kingston RAM?
  9. rkudyba

    rkudyba Newcomer, in training Topic Starter Posts: 46

    KTH-D530/512

    but on Kingston's site they have KTH-D530/512S but my chips do not have the last "S" on them.

    Note MEMTEST ran 39 times over night and passed with no errors no the OLD HP memory.
  10. Route44

    Route44 TechSpot Ambassador Posts: 12,113   +23

    And you are getting crashes even with your old memory in, correct?
  11. rkudyba

    rkudyba Newcomer, in training Topic Starter Posts: 46

     
  12. rkudyba

    rkudyba Newcomer, in training Topic Starter Posts: 46

    Did the dumps provide any info? I'm leaning towards a logic board or slot problem...
  13. Route44

    Route44 TechSpot Ambassador Posts: 12,113   +23

    Your larger dump was corrupted and thus unreadable.

    Your second minidump is 0xD1 and these are usually caused by faulty drivers. In this case the Windows driver ndis.sys was cited as the cause of your issues. usually OS drivers are too general to be of much help but in your case it might be helpful.

    The NDIS library (Network Driver Interface Specification) is contained in ndis.sys. It is a collection of routines that applications can invoke to perform network-related operations. Ndis.sys is an integral part of the kernel and it must match other kernel components to work properly.

    Further research shows that one way to rectify ndis.sys BSODs is to either update NIC card drivers or in some cases replace a defective NIC card.

    Update your NIC card drivers.
  14. rkudyba

    rkudyba Newcomer, in training Topic Starter Posts: 46

    I had done that recently as well. It's a built in:
    Broadcom NetExtreme Gigabit for hp
    driver date 7/30/2008
    version 10.86.0.0

    For now I replaced it with an older 100MB NIC to see what happens.
  15. Route44

    Route44 TechSpot Ambassador Posts: 12,113   +23

    Good move. I'll be very interested to see the results.
  16. rkudyba

    rkudyba Newcomer, in training Topic Starter Posts: 46

    Blast. Another IRQL_NOT_LESS_OR_EQUAL, again referencing ATAPI.sys. Note I did disable the installed NIC card. Dump file download link.
  17. Route44

    Route44 TechSpot Ambassador Posts: 12,113   +23

    Both errors are 0xD1 which are usually caused by faulty drivers. Both cite the Windows OS driver atapi.sys which IDE/AEPI Port Driver - Standard Harddisk controller. It can also be used for CD-ROM drives.

    In my research it cited possible memory issues, harddrive issues, or CD-ROM.

    Also, there was a lot about rootkits and this driver being corrupted but I am not saying this is your issue.

    Have you done any system scans with your security software?
  18. rkudyba

    rkudyba Newcomer, in training Topic Starter Posts: 46

    Yep ran AVG from safe mode, full scan, clean. Beyond frustrated...
     
  19. Route44

    Route44 TechSpot Ambassador Posts: 12,113   +23

    Download the free versions of Malwarebytes and Superantispyware and run both.

    Sorry, but I can't remember if you did or stated the following:

    1. Run a harddrive diagnostics.

    2. Check your cables to your harddrive and ROM drives. Make sure they are securly attached to both components and the motherboard.

    3. When do the BSODs occur, i.e. what are you doing?
  20. rkudyba

    rkudyba Newcomer, in training Topic Starter Posts: 46

    Have run Malwarebytes previously; clean.

    1) HD diagnostics passes multiple times
    2) check all good.
    3) Sometimes nothing, sometimes browsing with IE or Safari.
  21. Route44

    Route44 TechSpot Ambassador Posts: 12,113   +23

    Lets back up a step. When you updated your onboard NIC drivers from where did you update?

    Update: Are you running Avira? The reason for my asking is because in one of your latest minidumps the avipbb.sys driver was cited as not being able to load because it was being blocked. This is an Avira driver that I had written down to research but I forgot to. What security software besides Avira do you have installed running as real time protection, i.e. firewall, anitspyware/malware, etc.? Which ones, if any, are installed but not in real time protection?
  22. rkudyba

    rkudyba Newcomer, in training Topic Starter Posts: 46

    Well I disabled the NIC card and put in an old one, but for the installed, hard wired NIC I used the HP support page.

    Yes only AVG Free 9.0 is installed. I uninstalled SAV a whilst back. No other real time running. Should I uninstall AVG? MalwareBytes is installed but not real time.

    Another minidump attached.

    Attached Files:

  23. Route44

    Route44 TechSpot Ambassador Posts: 12,113   +23

    First, since you uninstalled Avira the avipbb.sys driver should not be present. Different antivirus drivers will conflict causing system crashes. it appears there is at least one old Avira driver still present in your system.

    Second, I read your minidump file and it is error 0x7E: SYSTEM_THREAD_EXCEPTION_NOT_HANDLED
    A system thread generated an exception which the error handler did not catch. There are numerous individual causes for this problem, including hardware incompatibility, a faulty device driver or system service, or some software issues.

    It simply cited hardware as the problem. However, within the minidump this information was cited: IP_MISALIGNED and this is often due to memory. In my research I came across the following from a 2005 TechSpot post by cpc2004 who, in my estimation, was the best I have ever come across to read minidumps. He now only checks in on the rare occasion. Here is what he wrote to someone else concerning IP_MISALIGNED:

    This is hardware problem. IP_Misaligned (Instruction Misaligned) is usually caused by faulty memory.

    Suggestion
    1. Check the temperature of the CPU and make sure that it is not overheat (ie temperature < 60C)
    2. Reseat the memory stick to another memory slot
    3. Downclock the ram
    4. Clean the dust inside the computer case
    5. Make sure that the ram is compatible to the motherboard
    If it still crashes, diagnostic which memory stick is faulty
    1. Take out one memory stick. If windows does not crash, the removed memory stick is faulty.
    2. If you have only one memory stick, replace the ram
  24. rkudyba

    rkudyba Newcomer, in training Topic Starter Posts: 46

    I've done 1-5 already. Note that I still had AVG installed; I just UNinstalled it now. Just before uninstalling yet another crash of:

    The computer has rebooted from a bugcheck. The bugcheck was: 0x0000008e (0xc0000005, 0xbff6a931, 0xee346830, 0x00000000). A dump was saved in: C:\WINDOWS\MEMORY.DMP.

    And a link to download the dumps..
  25. Route44

    Route44 TechSpot Ambassador Posts: 12,113   +23

    Both errors are 0x8E and both pointed to the Windows driver rdpdd.dll as the cause of your crashes. This driver is for video display. keep in mind that OS drivers generally are not the issue but point to the fact that there is an issue. From research the latest video card drivers correct this issue. However, you already did this if I am not mistaking, correct?

    Another interesting thing in your dump is the following: PEB is paged out. This can be due to memory leakage and here is one definition that, honestly, I can't fully explain but perhaps it might help you:

    "PEB is paged out." This error indicates that the process environment block (PEB) is not accessible.

    To load symbols, the debugger looks at the list of modules loaded by the operating system. The pointer to the user-mode module list is one of the items stored in the PEB.

    In order to reclaim memory, the Memory Manager may page out user-mode data to make space for other process or kernel mode components.

    When this error occurs, it means that the debugger has detected that the PEB data structure for this process is no longer readable. Most likely, is has been paged out to disk.

    Without this data structure, the debugger cannot determine what images the symbols should be loaded for.

    * I'll take a guess but a module or two could not be loaded for your video card.
Topic Status:
Not open for further replies.


Add New Comment

TechSpot Members
Login or sign up for free,
it takes about 30 seconds.
You may also...


Get complete access to the TechSpot community. Join thousands of technology enthusiasts that contribute and share knowledge in our forum. Get a private inbox, upload your own photo gallery and more.