[COLOR=DarkOrange]Hi can any one help, i have a Blue screen error on shutdown of log off a certan user error code :[/COLOR]

STOP : 0x00000050 (0xfffffff0, 0x00000000, 0x8054a51a, 0x00000000) PAGE_FAULT_IN_NONPAGED_AREA

our system is a Dell Optiplex SX280 see spec attached

[COLOR=DarkOrange]i have done a system restore point, general tidy of drive, changed memory, and motherboard, here is a debugger :[/COLOR]

Opened log file 'c:\debuglog.txt'

Microsoft (R) Windows Debugger Version 6.6.0003.5
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Documents and Settings\NAME\Desktop\user.dmp]
User Mini Dump File: Only registers, stack and portions of memory are available

Comment: 'Dr. Watson generated MiniDump'
Windows XP Version 2600 (Service Pack 2) UP Free x86 compatible
Product: WinNt, suite: SingleUserTS
Debug session time: Tue Sep 27 09:32:40.000 2005 (GMT+1) (Date wrong on pc sorry)
System Uptime: not available
Process Uptime: 0 days 0:00:02.000
Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: C:\WINDOWS;C:\WINDOWS\system32;C:\WINDOWS\system32\drivers
.........................................
This dump file has an exception of interest stored in it.
The stored exception information can be accessed via .ecxr.
(298.2f8): Access violation - code c0000005 (first/second chance not available)
eax=00000000 ebx=00c40020 ecx=7c91056d edx=00000040 esi=76c630e0 edi=0012926c
eip=7c91389e esp=00befb08 ebp=00befb0c iopl=0 nv up ei pl zr na po nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000246
ntdll!_wcsicmp+0xe:
7c91389e 668b02 mov ax,[edx] ds:0023:00000040=????
0:007> !analyze -v;r;kv;lmtn;.logclose;q
*************************************************************************** ****
* *
* Exception Analysis *
* *
*************************************************************************** ****


FAULTING_IP:
ntdll!_wcsicmp+e
7c91389e 668b02 mov ax,[edx]

EXCEPTION_RECORD: ffffffff -- (.exr ffffffffffffffff)
.exr ffffffffffffffff
ExceptionAddress: 7c91389e (ntdll!_wcsicmp+0x0000000e)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 00000000
Parameter[1]: 00000040
Attempt to read from address 00000040

PROCESS_NAME: winlogon.exe

ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx". The memory could not be "%s".

READ_ADDRESS: 00000040

BUGCHECK_STR: ACCESS_VIOLATION

DEFAULT_BUCKET_ID: NULL_CLASS_PTR_DEREFERENCE

LAST_CONTROL_TRANSFER: from 76c6c4e4 to 7c91389e

STACK_TEXT:
00befb0c 76c6c4e4 00000040 76c630e0 00000000 ntdll!_wcsicmp+0xe
00befb38 76c6faf7 7c80ac28 00000000 76bb0000 sfc_os!SfcBuildDirectoryWatchList+0x1e9
00befd78 01030198 00000000 00000000 00000000 sfc_os!SfcInitProt+0x715
00beffb4 7c80b50b 00000000 00000018 00003000 winlogon!InitializeSfc+0x97
00beffec 00000000 01030101 00000000 00000000 kernel32!BaseThreadStart+0x37


STACK_COMMAND: ~7s; .ecxr ; kb

FOLLOWUP_IP:
sfc_os!SfcBuildDirectoryWatchList+1e9
76c6c4e4 85c0 test eax,eax

SYMBOL_STACK_INDEX: 1

FOLLOWUP_NAME: MachineOwner

SYMBOL_NAME: sfc_os!SfcBuildDirectoryWatchList+1e9

MODULE_NAME: sfc_os

IMAGE_NAME: sfc_os.dll

DEBUG_FLR_IMAGE_TIMESTAMP: 411096b3

FAILURE_BUCKET_ID: ACCESS_VIOLATION_sfc_os!SfcBuildDirectoryWatchList+1e9

BUCKET_ID: ACCESS_VIOLATION_sfc_os!SfcBuildDirectoryWatchList+1e9

Followup: MachineOwner
---------

eax=00000000 ebx=00c40020 ecx=7c91056d edx=00000040 esi=76c630e0 edi=0012926c
eip=7c91389e esp=00befb08 ebp=00befb0c iopl=0 nv up ei pl zr na po nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000246
ntdll!_wcsicmp+0xe:
7c91389e 668b02 mov ax,[edx] ds:0023:00000040=????
ChildEBP RetAddr Args to Child
00befb0c 76c6c4e4 00000040 76c630e0 00000000 ntdll!_wcsicmp+0xe (FPO: [Non-Fpo])
00befb38 76c6faf7 7c80ac28 00000000 76bb0000 sfc_os!SfcBuildDirectoryWatchList+0x1e9 (FPO: [Non-Fpo])
00befd78 01030198 00000000 00000000 00000000 sfc_os!SfcInitProt+0x715 (FPO: [Non-Fpo])
00beffb4 7c80b50b 00000000 00000018 00003000 winlogon!InitializeSfc+0x97 (FPO: [Non-Fpo])
00beffec 00000000 01030101 00000000 00000000 kernel32!BaseThreadStart+0x37 (FPO: [Non-Fpo])
start end module name
01000000 01080000 winlogon winlogon.exe Wed Aug 04 07:14:52 2004 (41107EDC)
20000000 20017000 odbcint odbcint.dll Wed Aug 04 08:57:25 2004 (411096E5)
5ad70000 5ada8000 uxtheme uxtheme.dll Wed Aug 04 08:56:43 2004 (411096BB)
5b860000 5b8b4000 netapi32 netapi32.dll Wed Aug 04 08:56:28 2004 (411096AC)
5d090000 5d127000 comctl32 comctl32.dll Wed Aug 04 08:56:31 2004 (411096AF)
71aa0000 71aa8000 ws2help ws2help.dll Wed Aug 04 08:57:39 2004 (411096F3)
71ab0000 71ac7000 ws2_32 ws2_32.dll Wed Aug 04 08:57:38 2004 (411096F2)
723d0000 723ec000 winscard winscard.dll Wed Aug 04 08:56:36 2004 (411096B4)
74320000 7435d000 odbc32 odbc32.dll Wed Aug 04 08:57:17 2004 (411096DD)
75930000 7593a000 profmap profmap.dll Wed Aug 04 08:56:55 2004 (411096C7)
75940000 75948000 nddeapi nddeapi.dll Wed Aug 04 08:56:24 2004 (411096A8)
75970000 75a67000 msgina msgina.dll Wed Aug 04 08:58:01 2004 (41109709)
76360000 76370000 winsta winsta.dll Wed Aug 04 08:56:40 2004 (411096B8)
763b0000 763f9000 comdlg32 comdlg32.dll Wed Aug 04 08:56:32 2004 (411096B0)
769c0000 76a73000 userenv userenv.dll Wed Aug 04 08:56:41 2004 (411096B9)
76bb0000 76bb5000 sfc sfc.dll Wed Aug 04 08:56:34 2004 (411096B2)
76bc0000 76bcf000 regapi regapi.dll Wed Aug 04 08:56:40 2004 (411096B8)
76bf0000 76bfb000 psapi psapi.dll Wed Aug 04 08:56:58 2004 (411096CA)
76c30000 76c5e000 wintrust wintrust.dll Wed Aug 04 08:56:41 2004 (411096B9)
76c60000 76c8a000 sfc_os sfc_os.dll Wed Aug 04 08:56:35 2004 (411096B3)
76c90000 76cb8000 imagehlp imagehlp.dll Wed Aug 04 08:56:25 2004 (411096A9)
76f50000 76f58000 wtsapi32 wtsapi32.dll Wed Aug 04 08:57:55 2004 (41109703)
773d0000 774d2000 comctl32_773d0000 comctl32.dll Wed Aug 04 08:55:56 2004 (4110968C)
774e0000 7761c000 ole32 ole32.dll Wed Aug 04 08:57:38 2004 (411096F2)
776c0000 776d1000 authz authz.dll Wed Aug 04 08:57:05 2004 (411096D1)
776e0000 77703000 shsvcs shsvcs.dll Wed Aug 04 08:56:47 2004 (411096BF)
77920000 77a13000 setupapi setupapi.dll Wed Aug 04 08:56:32 2004 (411096B0)
77a80000 77b14000 crypt32 crypt32.dll Wed Aug 04 08:56:01 2004 (41109691)
77b20000 77b32000 msasn1 msasn1.dll Wed Aug 04 08:57:23 2004 (411096E3)
77b40000 77b62000 apphelp apphelp.dll Wed Aug 04 08:56:36 2004 (411096B4)
77c00000 77c08000 version version.dll Wed Aug 04 08:56:39 2004 (411096B7)
77c10000 77c68000 msvcrt msvcrt.dll Wed Aug 04 08:59:14 2004 (41109752)
77d40000 77dd0000 user32 user32.dll Wed Aug 04 08:56:40 2004 (411096B8)
77dd0000 77e6b000 advapi32 advapi32.dll Wed Aug 04 08:56:23 2004 (411096A7)
77e70000 77f01000 rpcrt4 rpcrt4.dll Wed Aug 04 08:56:30 2004 (411096AE)
77f10000 77f56000 gdi32 gdi32.dll Wed Aug 04 08:56:07 2004 (41109697)
77f60000 77fd6000 shlwapi shlwapi.dll Thu Mar 10 08:02:34 2005 (422FFF1A)
77fe0000 77ff1000 secur32 secur32.dll Wed Aug 04 08:56:49 2004 (411096C1)
7c800000 7c8f4000 kernel32 kernel32.dll Wed Aug 04 08:56:36 2004 (411096B4)
7c900000 7c9b0000 ntdll ntdll.dll Wed Aug 04 08:56:36 2004 (411096B4)
7c9c0000 7d1d4000 shell32 shell32.dll Wed Aug 04 08:56:39 2004 (411096B7)
Closing open log file c:\debuglog.txt

I found this, which is very similar to yours:
http://support.microsoft.com/?kbid=817197

I would have thought it to be a memory problem but likely not in your case.

more:
http://kadaitcha.cx/stop_err.html#0x00000050

You could also try running memtest and see what results you get.
Only one stick at a time for memtest.

Hi Nork

thanks for your help, ill have a look at those links, i did run a memtest and all was well....

I also found this:
http://support.microsoft.com/?kbid=811270
The "unhandled exception" is the same as what is in the debug info, althought it may or may not apply to your pc. Do you have that Delfin media viewer installed?
If you dont know look in add\remove software and also do a search of c: drive for the word delfin.
Im still looking for more info.

thanks nork, ill have a look at that link, we dont have delfin, but i will look...

Attached Files

	Mini051006-01.zip (14.0 KB, 4 views)
	Mini051006-02.zip (14.1 KB, 3 views)
	Mini051106-01.zip (14.2 KB, 3 views)
	Mini051206-01.zip (14.5 KB, 4 views)

You arent running the game diablo 2 are you?
see here if so:
http://www.opentechsupport.net/forum...ic/1387-1.html

By the way, what was the last piece of software you installed in your pc?

Hi nork, no its an office pc, it apparantly used to do i before i worked here and they changed the ram, but i have done all that and still no joy, probarley the last software would be updates and stuff like that.... just trying to zip my mini dumps to upload may be you can look and see anything in them? i dont know how to read them...

cant open that link you gave me nork? i have uploaded so Zip mini dumps...

I got all of the above from google:
http://www.google.com/search?sourcei...:en&q=c0000005

I will now try a different search

nothing came up on Delfin....

By the way, i am NOT the best person to analyze this debug sesson. I am mainly guessing here, so someone else with more knowledge is welcome to get in here, lol.

Using these lines as reference:

FAULTING_IP:
ntdll!_wcsicmp+e
7c91389e 668b02 mov ax,[edx]

I googled ntdll and found this. You can download a fresh ntdll file here and place the file where it belongs in your windows folders. You could take the original and simply rename it, then put this one it its place, see if it takes care of your blue screen, if not then delete it and change the original dll back to its proper name.
http://www.dll-files.com/dllindex/dll-files.shtml?ntdll

The only thing is that i dont know if changing that ntdll file will cause your system to not boot or some other problem. I dont think so, but thats only a guess.
Anyone else?

Sorry, i didnt even notice you were answering my posts, lol. I will go back and check them out better.

Which link is no good?
I will look at those dumps.
thanks

Lol thats ok, i dont have much else to do so i tend to bombard people with emails (makes me look busy ) lol

I d\loaded those dumps and unzipped them but i cant find anything to open them with. You seem to have opened them, right? How?
Lol, this is like the blind leading the blind.

Is there a microsoft or other reader that i can download to read these files?

4 crashes at "ntkrpamp.exe" with a Bugcheck of 50:

try installing the latest updates for all components, and update your windows files using windows update, and then use "sfc /scannow" (without quotes) from command prompt to verify your system files are not modified versions.

you wrote you ran memtest, but if you didnt let if run for atleast 7 passes, then do it again.

altheman, thanks for the rescue, lol.
I didnt notice the slip up about checking to see how many passes allsigns did with memtest. That could be important as it still could be a memory problem.

Also, couldnt allsigns go to computer management\event viewer\system and report on red error messages?

p.S. I tried all the links that i gave you and they all work for me.
Which link didnt work for you?

Hi altheman, thanks for ya help, i left memtest running over night from 4pm till 11pm the next day!! would that be long enough? it didnt show any errors,
i have installed all the updates there are no more coming up to install, ill try the SFC scan and get back to you...

Hi altheman, right i done the sfc /scannow went though but when it finished it went back to the dos prompt but no list or messages were given!!