Blue Screen Error WinXP

Status
Not open for further replies.
I get the blue screen of death after the winxp boot logo. Safemode with networking works. I first got this error after I went to add/remove programs, windows components, network services, and checked UPNP, then restarted.

Went into eventvwr.msc and put the errors in a word document. Still trying to figure out how to get a minidump.

Bad_pool_caller
enum132k.sys

Things I have tried.
-Different sticks of ram
-Chkdsk
-Unplugging everything on boot, mouse, keyboard, etc.
-Winxp cd recovery function
-Registry repair software
 

Attachments

  • loh.doc
    38 KB · Views: 5
Please don't attach a document file for the Events. Open the Event Viewer> click on each system and Applications, one at a time to open each log> right click on Error> Properties> click on Copy icon top right, below the down arrow> Paste here (Ctrl V).

Event Type: Error
Event Source: Userenv
Event Category: None
Event ID: 1512
Date: 9/24/2008
Time: 3:05:13 PM
User: NT AUTHORITY\SYSTEM
Computer: JOE-2T4CDA09R4H
Description:
Windows cannot unload your registry file. The memory used by the registry has not been freed. This is often caused by services running as a user account, try configuring the services to run in either the LocalService or NetworkService account. If this problem persists, contact your administrator.
Run the User Profile Hive Cleanup Service from this Microsoft site: http://tinyurl.com/2h3yl:

DETAIL - Insufficient system resources exist to complete the requested service.

This line puzzles me. I'm not sure how it applies.

Ignore this. Deal with the Error above.
Event Type: Warning
Event Source: Userenv
Event Category: None
Event ID: 1524
Date: 9/24/2008
Time: 3:05:01 PM
User: JOE-2T4CDA09R4H\Joe
Computer: JOE-2T4CDA09R4H
Description:
Windows cannot unload your classes registry file - it is still in use by other applications or services. The file will be unloaded when it is no longer in use.

This is the most significant Error:
Event Type: Error
Event Source: Application Error
Event Category: None
Event ID: 1000
Date: 9/24/2008
Time: 1:43:58 PM
User: N/A
Computer: JOE-2T4CDA09R4H
Description:
Faulting application firefox.exe, version 1.9.0.3180, faulting module nvoglnt.dll, version 6.14.11.7792, fault address 0x00121e2d.

You are using an old, out of date version of Firefox. Please update to either v2.0.16 or v3- now.
nvoglnt.dll is a module associated with NVIDIA Compatible OpenGL ICD from NVIDIA Corporation.

NVIDIA Compatible OpenGL ICD is a product for Corrupted Data Recovery which is apparently running in the background and should not be. Find the program on the Startup tab and UNCHECK it.

Ignore the following for now:
Event Type: Warning
Event Source: MSSQL$ACCPAC53CGA
Event Category: (8)
Event ID: 19011
Date: 9/23/2008
Time: 11:34:10 PM
User: N/A
Computer: JOE-2T4CDA09R4H
Description:
The description for Event ID ( 19011 ) in Source ( MSSQL$ACCPAC53CGA ) cannot be found. .

The following Error indicates you have booted into Safe Mode and the drivers don't load in Safe Mode:
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7026
Date: 9/24/2008
Time: 5:29:36 PM
User: N/A
Computer: JOE-2T4CDA09R4H
Description:
The following boot-start or system-start driver(s) failed to load:
AsIO
aslm75
asuskbnt
ATITool
avgio
avipbb
ElbyCDIO
Fips
hwinterface
intelppm
irbusex
NetworkX
prodrv06
The source of this Error is the StarForce Protection Synchronization Driver from Protection Technology's StarForce Protection System. It's mainly used to protect computer games, and that's probably how you got it installed. Apparently, it can be very hard to get rid of it. However, you can download an official StarForce Removal Tool from an online security site http://www.onlinesecurity-on.com/protect.phtml?c=55
Event Type: Error
Event Source: sfsync02
Event Category: None
Event ID: 12
Date: 9/24/2008
Time: 5:27:49 PM
User: N/A
Computer: JOE-2T4CDA09R4H
Description:
The description for Event ID ( 12 ) in Source ( sfsync02 ) cannot be found.

Again, it appears you started in Safe Mode and the drivers don't load, which is normal:
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7026
Date: 9/24/2008
Time: 4:57:51 PM
User: N/A
Computer: JOE-2T4CDA09R4H
Description:
The following boot-start or system-start driver(s) failed to load:
AsIO
aslm75
asuskbnt
ATITool
avgio
avipbb
ElbyCDIO
Fips
hwinterface
intelppm
irbusex
NetworkX
prodrv06

Again, caused by Safe Mode: DCOM got error "This service cannot be started in Safe Mode "
Event Type: Error
Event Source: DCOM
Event Category: None
Event ID: 10005
Date: 9/24/2008
Time: 4:32:21 PM
User: JOE-2T4CDA09R4H\Joe
Computer: JOE-2T4CDA09R4H
Description:
DCOM got error "This service cannot be started in Safe Mode " attempting to start the service StiSvc with arguments "" in order to run the server:
{A1F4E726-8CF1-11D1-BF92-0060081ED811}
When looking in the Event Viewer, you need to find the Error that correspond to the time of the problem. Items that do not start in Safe Mode are NOT an issue.

Usually we ignore Warnings. The reason, as seen here, if the Warning doesn't resolve, it will become an Error. Event #1524, Source: usernrv will happen any time you shut down without logging off first. This clears the Registry. In your case, it did become an Error #1512.

See how you do after uninstalling StarForce Protection Synchronization Driver, stopping the Nvidia. updating Firefox and running the Hive cleanup. We'll go from there.

Edit: No, doc file was only Word print of Events, no minidumps. It isn't a zip file.
 
Okay I re-uploaded a minidump, so it should work know.

I did a couple things you said to do Bobbye.

Blue screen of death errors I'm getting are

0x00000019
&
0x000000C2
 
I don't read minidump files so I'll leave that for someone else.

I did try to open the file though and it wouldn't open. You most likely will have to attach unzipped and as a copy from Notepad.
 
All three crashes are caused by enum132k.sys. Yours is the only hit on Google. Do a search on your system to see if you can find out what it belongs. I also found a file with the same timestamp with a similar name, so it could be an infection.

BugCheck C2, {7, cd4, b1f9759e, b9448e00}
Probably caused by : enum132k.sys ( enum132k+5272 )
b1f8f000 b1fffd00 enum132k enum132k.sys Fri Dec 22 18:04:12 2006 (458B9F8C)

Suspcious files:
irbusex irbusex.sys Mon Jun 05 20:09:43 2006 (44841F07) <-- one hit.
oprghdnt oprghdnt.sys Mon Jun 05 20:09:16 2006 (44841EEC) <-- no hit.
 
As mentioned, I don't do the minidumps, but here is some information that might help:

You may receive a "STOP: 0x00000019" error message on a Windows Server 2003-based computer
BSOD - Bad Header Pool 0x00000019
> http://support.microsoft.com/kb/892260
CAUSE
This issue occurs because of a problem in the NTFS file system.
RESOLUTION
Service pack information> How to obtain the latest service pack for Windows Server 2003 :
http://support.microsoft.com/kb/889100/

Bad_pool_caller stop:0x000000c2
:
c2 is usually a driver or bad ram - update video and sound drivers and run memory tests:
How to use Memtest: https://www.techspot.com/vb/topic62524.html
 
Status
Not open for further replies.
Back