Thanks in advance for all your assistance!

I have had two crashes today.

Computer is configured to auto restart on crash so I never see the Blue screen of Death. It

just reboots like your unplugged it and plugged it right back in. When it comes up I get the

report error popup.

When this happens I'm not doing anything that would tax the processor. I typically have

Outlook, Excel & Word 2003 open. I had IE 6 open and Windows media player open playing a web

based audio file.

Here is a rundown of the system;

XP Home
Version 2002
Service Pack 2
AMD Sempron(tm) 3000+
1.99 GHz, 480 MB of RAM
Seagate Barracuda ST380011A 76.5 GB with only 11.5 GB used.
Running Norton Internet Security Suite 2006, fully updated and just completely scanned.
Scan comes back clean.


Here are both minidump log, one right atfer the other;


C:\Program Files\Support Tools>dumpchk.exe c:\windows\minidump\mini011207-01.dmp

Loading dump file c:\windows\minidump\mini011207-01.dmp
----- 32 bit Kernel Mini Dump Analysis

DUMP_HEADER32:
MajorVersion 0000000f
MinorVersion 00000a28
DirectoryTableBase 0ea97000
PfnDataBase 81000000
PsLoadedModuleList 8055a420
PsActiveProcessHead 805604d8
MachineImageType 0000014c
NumberProcessors 00000001
BugCheckCode 000000c4
BugCheckParameter1 00000090
BugCheckParameter2 ffdff120
BugCheckParameter3 00000000
BugCheckParameter4 00000000
PaeEnabled 00000000
KdDebuggerDataBlock 8054c060
MiniDumpFields 00000dff

TRIAGE_DUMP32:
ServicePackBuild 00000200
SizeOfDump 00010000
ValidOffset 0000fffc
ContextOffset 00000320
ExceptionOffset 000007d0
MmOffset 00001068
UnloadedDriversOffset 000010a0
PrcbOffset 00001878
ProcessOffset 000024c8
ThreadOffset 00002728
CallStackOffset 00002980
SizeOfCallStack 00003fff
DriverListOffset 00006c10
DriverCount 00000088
StringPoolOffset 00009470
StringPoolSize 000012b8
BrokenDriverOffset 00000000
TriageOptions 00000041
TopOfStack f233b000
DebuggerDataOffset 00006980
DebuggerDataSize 00000290
DataBlocksOffset 0000a728
DataBlocksCount 00000003


Windows XP Kernel Version 2600 (Service Pack 2) UP Free x86 compatible
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055a420
Debug session time: Fri Jan 12 09:18:22 2007
System Uptime: 0 days 16:51:32
start end module name
804d7000 806eb100 nt Checksum: 002198AF Timestamp: Tue Mar 01 17:
59:37 2005 (42250FF9)

Unloaded modules:
f1e06000 f1e31000 kmixer.sys Timestamp: unavailable (00000000)
f2782000 f27ad000 kmixer.sys Timestamp: unavailable (00000000)
f7b0c000 f7b0d000 drmkaud.sys Timestamp: unavailable (00000000)
f27ad000 f27d0000 aec.sys Timestamp: unavailable (00000000)
f2b8b000 f2b98000 DMusic.sys Timestamp: unavailable (00000000)
f2b1b000 f2b29000 swmidi.sys Timestamp: unavailable (00000000)
f79f3000 f79f5000 splitter.sys Timestamp: unavailable (00000000)
f5f37000 f5f68000 symidsco.sys Timestamp: unavailable (00000000)
f787f000 f7884000 Cdaudio.SYS Timestamp: unavailable (00000000)
bae0c000 bae0f000 Sfloppy.SYS Timestamp: unavailable (00000000)

Finished dump check

C:\Program Files\Support Tools>dumpchk.exe c:\windows\minidump\mini011207-02.dmp

Loading dump file c:\windows\minidump\mini011207-02.dmp
----- 32 bit Kernel Mini Dump Analysis

DUMP_HEADER32:
MajorVersion 0000000f
MinorVersion 00000a28
DirectoryTableBase 10008000
PfnDataBase 81000000
PsLoadedModuleList 8055a420
PsActiveProcessHead 805604d8
MachineImageType 0000014c
NumberProcessors 00000001
BugCheckCode 000000c4
BugCheckParameter1 00000090
BugCheckParameter2 ffdff120
BugCheckParameter3 00000000
BugCheckParameter4 00000000
PaeEnabled 00000000
KdDebuggerDataBlock 8054c060
MiniDumpFields 00000dff

TRIAGE_DUMP32:
ServicePackBuild 00000200
SizeOfDump 00010000
ValidOffset 0000fffc
ContextOffset 00000320
ExceptionOffset 000007d0
MmOffset 00001068
UnloadedDriversOffset 000010a0
PrcbOffset 00001878
ProcessOffset 000024c8
ThreadOffset 00002728
CallStackOffset 00002980
SizeOfCallStack 00003000
DriverListOffset 00005c10
DriverCount 00000087
StringPoolOffset 00008428
StringPoolSize 00001298
BrokenDriverOffset 00000000
TriageOptions 00000041
TopOfStack f377b000
DebuggerDataOffset 00005980
DebuggerDataSize 00000290
DataBlocksOffset 000096c0
DataBlocksCount 00000003


Windows XP Kernel Version 2600 (Service Pack 2) UP Free x86 compatible
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055a420
Debug session time: Fri Jan 12 11:31:54 2007
System Uptime: 0 days 2:13:18
start end module name
804d7000 806eb100 nt Checksum: 002198AF Timestamp: Tue Mar 01 17:
59:37 2005 (42250FF9)

Unloaded modules:
f20eb000 f2116000 kmixer.sys Timestamp: unavailable (00000000)
f77c7000 f77ce000 usbprint.sys Timestamp: unavailable (00000000)
f31db000 f3206000 kmixer.sys Timestamp: unavailable (00000000)
f7a55000 f7a56000 drmkaud.sys Timestamp: unavailable (00000000)
f33be000 f33cb000 DMusic.sys Timestamp: unavailable (00000000)
f3206000 f3229000 aec.sys Timestamp: unavailable (00000000)
f35ce000 f35dc000 swmidi.sys Timestamp: unavailable (00000000)
f79ed000 f79ef000 splitter.sys Timestamp: unavailable (00000000)
f7887000 f788c000 Cdaudio.SYS Timestamp: unavailable (00000000)
badfc000 badff000 Sfloppy.SYS Timestamp: unavailable (00000000)

Finished dump check

C:\Program Files\Support Tools>

I forgot to add the following.

It is a work computer that is always on, is never put into standby or hibernate and is rebooted on average, two to three times a week.

Thanks, Tim

It just happened agin.
Here is the log.

C:\Program Files\Support Tools>dumpchk.exe c:\windows\minidump\mini011207-03.DMP

Loading dump file c:\windows\minidump\mini011207-03.DMP
----- 32 bit Kernel Mini Dump Analysis

DUMP_HEADER32:
MajorVersion 0000000f
MinorVersion 00000a28
DirectoryTableBase 1bfec000
PfnDataBase 81000000
PsLoadedModuleList 8055a420
PsActiveProcessHead 805604d8
MachineImageType 0000014c
NumberProcessors 00000001
BugCheckCode 000000c4
BugCheckParameter1 00000090
BugCheckParameter2 ffdff120
BugCheckParameter3 00000000
BugCheckParameter4 00000000
PaeEnabled 00000000
KdDebuggerDataBlock 8054c060
MiniDumpFields 00000dff

TRIAGE_DUMP32:
ServicePackBuild 00000200
SizeOfDump 00010000
ValidOffset 0000fffc
ContextOffset 00000320
ExceptionOffset 000007d0
MmOffset 00001068
UnloadedDriversOffset 000010a0
PrcbOffset 00001878
ProcessOffset 000024c8
ThreadOffset 00002728
CallStackOffset 00002980
SizeOfCallStack 00003fff
DriverListOffset 00006c10
DriverCount 00000088
StringPoolOffset 00009470
StringPoolSize 000012b8
BrokenDriverOffset 00000000
TriageOptions 00000041
TopOfStack f1e68000
DebuggerDataOffset 00006980
DebuggerDataSize 00000290
DataBlocksOffset 0000a728
DataBlocksCount 00000003


Windows XP Kernel Version 2600 (Service Pack 2) UP Free x86 compatible
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055a420
Debug session time: Fri Jan 12 13:59:37 2007
System Uptime: 0 days 2:27:28
start end module name
804d7000 806eb100 nt Checksum: 002198AF Timestamp: Tue Mar 01 17:
59:37 2005 (42250FF9)

Unloaded modules:
f1d21000 f1d4c000 kmixer.sys Timestamp: unavailable (00000000)
f1d21000 f1d4c000 kmixer.sys Timestamp: unavailable (00000000)
f20bc000 f20e7000 kmixer.sys Timestamp: unavailable (00000000)
f2e14000 f2e3f000 kmixer.sys Timestamp: unavailable (00000000)
f7aaf000 f7ab0000 drmkaud.sys Timestamp: unavailable (00000000)
f30ff000 f310c000 DMusic.sys Timestamp: unavailable (00000000)
f301f000 f302d000 swmidi.sys Timestamp: unavailable (00000000)
f2e67000 f2e8a000 aec.sys Timestamp: unavailable (00000000)
f7a0d000 f7a0f000 splitter.sys Timestamp: unavailable (00000000)
f788f000 f7894000 Cdaudio.SYS Timestamp: unavailable (00000000)
bae00000 bae03000 Sfloppy.SYS Timestamp: unavailable (00000000)

Finished dump check

C:\Program Files\Support Tools>

Found the debugging analyzer and ran it.
These are the culprit files
SAVRT.SYS
navex15.sys
SYMEVENT.SYS
They all belong to Norton.
Anyone know how I might stop the problem? Removing Norton is not an option, as my boss thinks it is a good program.

Thanks, Tim

Hello Tim

I see that you have atleast have found what might be causing your problem?

I have had a series of crashes increasing over the last couple of months. I have re formatted, tried new drivers & have reverted back to the old, so and so on.

I configurerd the pc not to shut down so that It can atleast get a BSOD that may give me a little insight to my problem. I received an error this afternoon that is similar to yours. I do not know how to extract the minidum file information? Can you enlighten me to a possible fix or direction to follow?

DRIVER_IRQL_NOT_LESS_OR_EQUAL
**STOP 0x000000D1, (0x08A743B1A, 0x00000002, 0x00000000,0xA8233B6F)
SYMIDSCO.SYS ADDRESS A8233B6F BASE AT A8214000, date stamp 45384916.

Any assistance or direction would be a great help.

Thank you in advance.
Craig

Well I cannot take credit for anything here. I found a link that TS Special Forces member howard_hopkinso posted a while ago.

Here is the link - http://forums.majorgeeks.com/showthread.php?t=35246

Here is the link to Howard's post - http://www.techspot.com/vb/topic35422.html

I hope this helps because I'm not really someone that should try to help you with this deep of a problem.

I still do no know how to fix my computer's problems even though I think I know what drivers are causing the errors.

Anyone want to bail me out here?

Tim

Please can one of you folks that know this stuff please take a look at this.
This is the debug log I got on my last minidump and I have run the "!analyze -v" command on it.

1) Can I run a "verifier.exe stop" from the cmd and shut off the verifier?
2) Is that a bad thing to do?
3) Is there a better way to fix this?

Thanks, Tim

Microsoft (R) Windows Debugger Version 6.6.0007.5
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\WINDOWS\Minidump\Mini011507-03.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows XP Kernel Version 2600 (Service Pack 2) UP Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 2600.xpsp_sp2_gdr.050301-1519
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055a420
Debug session time: Mon Jan 15 15:48:44.468 2007 (GMT-7)
System Uptime: 0 days 3:37:22.016
Loading Kernel Symbols
........................................................................... ............................................................
Loading User Symbols
Loading unloaded module list
.............
*************************************************************************** ****
* *
* Bugcheck Analysis *
* *
*************************************************************************** ****

Use !analyze -v to get detailed debugging information.

BugCheck C4, {90, ffdff120, 0, 0}

Unable to load image SAVRT.SYS, Win32 error 2
*** WARNING: Unable to verify timestamp for SAVRT.SYS
*** ERROR: Module load completed but symbols could not be loaded for SAVRT.SYS
Probably caused by : SAVRT.SYS ( SAVRT+3c2e0 )

Followup: MachineOwner
---------

kd> !analyze -v
*************************************************************************** ****
* *
* Bugcheck Analysis *
* *
*************************************************************************** ****

DRIVER_VERIFIER_DETECTED_VIOLATION (c4)
A device driver attempting to corrupt the system has been caught. This is
because the driver was specified in the registry as being suspect (by the
administrator) and the kernel has enabled substantial checking of this driver.
If the driver attempts to corrupt the system, bugchecks 0xC4, 0xC1 and 0xA will
be among the most commonly seen crashes.
Parameter 1 = 0x1000 .. 0x1020 - deadlock verifier error codes.
Typically the code is 0x1001 (deadlock detected) and you can
issue a '!deadlock' KD command to get more information.
Arguments:
Arg1: 00000090, A driver switched stacks. The current stack is neither a thread
stack nor a DPC stack. Typically the driver doing this should be
on the stack obtained from `kb' command.
Arg2: ffdff120
Arg3: 00000000
Arg4: 00000000

Debugging Details:
------------------


BUGCHECK_STR: 0xc4_90

CUSTOMER_CRASH_COUNT: 3

DEFAULT_BUCKET_ID: DRIVER_FAULT

PROCESS_NAME: LuCallbackProxy

TRAP_FRAME: 834d4e1c -- (.trap ffffffff834d4e1c)
ErrCode = 00000000
eax=000004d3 ebx=000000d3 ecx=00000052 edx=000004d3 esi=e2743008 edi=00000000
eip=f27922e0 esp=834d4e90 ebp=e1247008 iopl=0 nv up ei ng nz ac pe cy
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010297
SAVRT+0x3c2e0:
f27922e0 ?? ???
Resetting default scope

LAST_CONTROL_TRANSFER: from 80671fdb to 8053331e

STACK_TEXT:
834d4c30 80671fdb 000000c4 00000090 ffdff120 nt!KeBugCheckEx+0x1b
834d4c50 806722d9 834d4c7c 806728cc 00000000 nt!ViDeadlockCheckStackLimits+0x6c
834d4c58 806728cc 00000000 00000000 00000000 nt!ViDeadlockCanProceed+0x2a
834d4c7c 8054b60d 8343efb0 00000050 84d69c98 nt!VfDeadlockDeleteMemoryRange+0x13
834d4cc0 8054b0b9 8343efb0 00000000 834d4cdc nt!ExFreePoolWithTag+0xad
834d4cd0 804f107e 8343efb0 834d4d0c 80670ff8 nt!ExFreePool+0xf
834d4cdc 80670ff8 80553d00 8343efb0 80669cdd nt!ExFreeToPagedLookasideList+0x1e
834d4ce8 80669cdd 84d3e9f8 014c5000 84850ef8 nt!VfIrpReleaseCallStackData+0x15
834d4d0c 804f5508 00000000 84850ee8 84850ef8 nt!IovCallDriver+0xb8
834d4d20 804f552f 84d69c98 84850f0a 84850f00 nt!IopPageReadInternal+0xf4
834d4d40 804f5194 84d3e9f8 84850f20 84850f00 nt!IoPageRead+0x1b
834d4db4 804ebace 153eb8c0 f27922e0 c03c9e48 nt!MiDispatchFault+0x274
834d4e04 804e1718 00000000 f27922e0 00000000 nt!MmAccessFault+0x5bc
834d4e04 f27922e0 00000000 f27922e0 00000000 nt!KiTrap0E+0xcc
WARNING: Stack unwind information not available. Following frames may be wrong.
834d4e8c f27964ec 000004d3 e2743008 f2797e5c SAVRT+0x3c2e0
834d4e90 00000000 e2743008 f2797e5c 00000000 SAVRT+0x404ec


STACK_COMMAND: kb

FOLLOWUP_IP:
SAVRT+3c2e0
f27922e0 ?? ???

SYMBOL_STACK_INDEX: e

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: SAVRT

IMAGE_NAME: SAVRT.SYS

DEBUG_FLR_IMAGE_TIMESTAMP: 422cda85

SYMBOL_NAME: SAVRT+3c2e0

FAILURE_BUCKET_ID: 0xc4_90_SAVRT+3c2e0

BUCKET_ID: 0xc4_90_SAVRT+3c2e0

Followup: MachineOwner
---------

Hi,

From the stack trace, I find the footprint of SAVRT.sys which belongs to Norton AV. Upgrade or de-install Norton AV may resolve the blue screen problem.

he said its not an option... tell the boss you need a new computer or tell him you quit till he gets it fixed since he didnt notice the problem. and they said computers would decrease workload, they do but the stress!!!