Blue screen of death - windos XP pro

Status
Not open for further replies.
H

henrique_m

Posts: 7   +0
Hi I have a windows Xp pro machine that constantly crashes. i enclose a minidump, can you help finding out if it is HW or SW problem?
*****************************************************

KERNEL_MODE_EXCEPTION_NOT_HANDLED_M (1000008e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003. This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG. This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG. This will let us see why this breakpoint is
happening.
Arguments:
Arg1: c0000005, The exception code that was not handled
Arg2: 8056e2ea, The address that the exception occurred at
Arg3: f781898c, Trap Frame
Arg4: 00000000

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - A instru o no "0x%08lx" fez refer ncia mem ria no "0x%08lx". A mem ria n o p de ser "%s".

FAULTING_IP:
nt!HvpGetCellMapped+5f
8056e2ea 8b4304 mov eax,dword ptr [ebx+4]

TRAP_FRAME: f781898c -- (.trap 0xfffffffff781898c)
.trap 0xfffffffff781898c
ErrCode = 00000000
eax=00001ff0 ebx=00001ff0 ecx=823c18f8 edx=000002ef esi=e1035b60 edi=00000fff
eip=8056e2ea esp=f7818a00 ebp=f7818a48 iopl=0 nv up ei pl zr na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010246
nt!HvpGetCellMapped+0x5f:
8056e2ea 8b4304 mov eax,dword ptr [ebx+4] ds:0023:00001ff4=????????
.trap
Resetting default scope

CUSTOMER_CRASH_COUNT: 7

DEFAULT_BUCKET_ID: CODE_CORRUPTION

BUGCHECK_STR: 0x8E

PROCESS_NAME: services.exe

LAST_CONTROL_TRANSFER: from 8057903a to 8056e2ea

STACK_TEXT:
f7818a48 8057903a e1035b60 5dffffff e1035b60 nt!HvpGetCellMapped+0x5f
f7818a5c 80578eb5 e1035b60 5dffffff e1035b60 nt!HvpGetHCell+0x10
f7818a78 805d7cca e1035b60 5dffffff dac2607c nt!HvMarkCellDirty+0x30
f7818a90 805d7dd7 e1035b60 00365078 dac2607c nt!CmpMarkKeyValuesDirty+0x3d
f7818aac 805d7b5d e1035b60 00365078 dac2607c nt!CmpFreeKeyValues+0x17
f7818ae8 805d7ca7 e1035b60 000a12b8 daa222bc nt!CmpSyncKeyValues+0x26
f7818b2c 805d7955 e130c000 00000400 00000003 nt!CmpCopySyncTree2+0x1f4
f7818b5c 805d86b1 e1035b60 000001b8 e1035b60 nt!CmpCopySyncTree+0x4f
f7818ccc 805a2ffb 00010003 f7818d64 f7818ce8 nt!CmpSaveBootControlSet+0x2a7
f7818cdc 804de7ec 00000005 f7818d64 804dcdfd nt!NtInitializeRegistry+0x5e
f7818cdc 804dcdfd 00000005 f7818d64 804dcdfd nt!KiFastCallEntry+0xf8
f7818d58 804de7ec 00000005 0007fe8c 7c91eb94 nt!ZwInitializeRegistry+0x11
f7818d58 7c91eb94 00000005 0007fe8c 7c91eb94 nt!KiFastCallEntry+0xf8
WARNING: Frame IP not in any known module. Following frames may be wrong.
0007fe8c 00000000 00000000 00000000 00000000 0x7c91eb94
 
another dump

*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

KERNEL_MODE_EXCEPTION_NOT_HANDLED_M (1000008e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003. This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG. This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG. This will let us see why this breakpoint is
happening.
Arguments:
Arg1: c0000005, The exception code that was not handled
Arg2: 8056e2ea, The address that the exception occurred at
Arg3: f77b898c, Trap Frame
Arg4: 00000000

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - A instru o no "0x%08lx" fez refer ncia mem ria no "0x%08lx". A mem ria n o p de ser "%s".

FAULTING_IP:
nt!HvpGetCellMapped+5f
8056e2ea 8b4304 mov eax,dword ptr [ebx+4]

TRAP_FRAME: f77b898c -- (.trap 0xfffffffff77b898c)
.trap 0xfffffffff77b898c
ErrCode = 00000000
eax=00001ff0 ebx=00001ff0 ecx=823c18f8 edx=000002ef esi=e1035b60 edi=00000fff
eip=8056e2ea esp=f77b8a00 ebp=f77b8a48 iopl=0 nv up ei pl zr na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010246
nt!HvpGetCellMapped+0x5f:
8056e2ea 8b4304 mov eax,dword ptr [ebx+4] ds:0023:00001ff4=????????
.trap
Resetting default scope

CUSTOMER_CRASH_COUNT: 8

DEFAULT_BUCKET_ID: CODE_CORRUPTION

BUGCHECK_STR: 0x8E

PROCESS_NAME: services.exe

LAST_CONTROL_TRANSFER: from 8057903a to 8056e2ea

STACK_TEXT:
f77b8a48 8057903a e1035b60 5dffffff e1035b60 nt!HvpGetCellMapped+0x5f
f77b8a5c 80578eb5 e1035b60 5dffffff e1035b60 nt!HvpGetHCell+0x10
f77b8a78 805d7cca e1035b60 5dffffff dd2e607c nt!HvMarkCellDirty+0x30
f77b8a90 805d7dd7 e1035b60 00365078 dd2e607c nt!CmpMarkKeyValuesDirty+0x3d
f77b8aac 805d7b5d e1035b60 00365078 dd2e607c nt!CmpFreeKeyValues+0x17
f77b8ae8 805d7ca7 e1035b60 000a12b8 dd0e22bc nt!CmpSyncKeyValues+0x26
f77b8b2c 805d7955 e1265000 00000400 00000003 nt!CmpCopySyncTree2+0x1f4
f77b8b5c 805d86b1 e1035b60 000001b8 e1035b60 nt!CmpCopySyncTree+0x4f
f77b8ccc 805a2ffb 00010003 f77b8d64 f77b8ce8 nt!CmpSaveBootControlSet+0x2a7
f77b8cdc 804de7ec 00000005 f77b8d64 804dcdfd nt!NtInitializeRegistry+0x5e
f77b8cdc 804dcdfd 00000005 f77b8d64 804dcdfd nt!KiFastCallEntry+0xf8
f77b8d58 804de7ec 00000005 0007fe8c 7c91eb94 nt!ZwInitializeRegistry+0x11
f77b8d58 7c91eb94 00000005 0007fe8c 7c91eb94 nt!KiFastCallEntry+0xf8
WARNING: Frame IP not in any known module. Following frames may be wrong.
0007fe8c 00000000 00000000 00000000 00000000 0x7c91eb94
 
It's a registry problem. Can by caused by hardware or software. Have you installed anything lately? Check the event viewer for Event Id 1517.
 
yes, I found event id 1517, but it dosnt give me any clue about the application that might cause this. (its in portuguese, so i dont post it here). How can i fix this? can you help?
thanks .
 
Hi! Sorry, didnt help.

The system has Mcafee protection installed, and it has changed the policies; it says that the Administrador has set policies that do not allow the installation of that software.
Tryed to uninstall Mcafee but got also a blue screen in the process (in safe mode):


KERNEL_MODE_EXCEPTION_NOT_HANDLED_M (1000008e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003. This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG. This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG. This will let us see why this breakpoint is
happening.
Arguments:
Arg1: c0000005, The exception code that was not handled
Arg2: 8056e2ea, The address that the exception occurred at
Arg3: f7de9ba4, Trap Frame
Arg4: 00000000

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - A instru o no "0x%08lx" fez refer ncia mem ria no "0x%08lx". A mem ria n o p de ser "%s".

FAULTING_IP:
nt!HvpGetCellMapped+5f
8056e2ea 8b4304 mov eax,dword ptr [ebx+4]

TRAP_FRAME: f7de9ba4 -- (.trap 0xfffffffff7de9ba4)
.trap 0xfffffffff7de9ba4
ErrCode = 00000000
eax=00001ff0 ebx=00001ff0 ecx=823c1b98 edx=00000377 esi=e1035008 edi=00000fff
eip=8056e2ea esp=f7de9c18 ebp=f7de9c60 iopl=0 nv up ei pl zr na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010246
nt!HvpGetCellMapped+0x5f:
8056e2ea 8b4304 mov eax,dword ptr [ebx+4] ds:0023:00001ff4=????????
.trap
Resetting default scope

CUSTOMER_CRASH_COUNT: 4

DEFAULT_BUCKET_ID: COMMON_SYSTEM_FAULT

BUGCHECK_STR: 0x8E

PROCESS_NAME: McProxy.exe

LAST_CONTROL_TRANSFER: from 8057903a to 8056e2ea

STACK_TEXT:
f7de9c60 8057903a e1035008 6effffff e1035008 nt!HvpGetCellMapped+0x5f
f7de9c74 80578eb5 e1035008 6effffff c13663bc nt!HvpGetHCell+0x10
f7de9c90 805dd012 e1035008 6effffff e1035008 nt!HvMarkCellDirty+0x30
f7de9cb0 80594e4b e1035008 003653b8 e179ba70 nt!CmpMarkKeyDirty+0x68
f7de9cc8 80594f6b e1035008 003653b8 00000001 nt!CmpFreeKeyByCell+0x14
f7de9cf8 805951e3 e1937fb8 f7de9d64 0012f88c nt!CmDeleteKey+0x8c
f7de9d58 804de7ec 000000d4 0012f8b4 7c91eb94 nt!NtDeleteKey+0x138
f7de9d58 7c91eb94 000000d4 0012f8b4 7c91eb94 nt!KiFastCallEntry+0xf8
WARNING: Frame IP not in any known module. Following frames may be wrong.
0012f8b4 00000000 00000000 00000000 00000000 0x7c91eb94


STACK_COMMAND: kb

FOLLOWUP_IP:
nt!HvpGetCellMapped+5f
8056e2ea 8b4304 mov eax,dword ptr [ebx+4]

SYMBOL_STACK_INDEX: 0

SYMBOL_NAME: nt!HvpGetCellMapped+5f

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nt

IMAGE_NAME: ntoskrnl.exe

DEBUG_FLR_IMAGE_TIMESTAMP: 45e54711

FAILURE_BUCKET_ID: 0x8E_nt!HvpGetCellMapped+5f

BUCKET_ID: 0x8E_nt!HvpGetCellMapped+5f

Followup: MachineOwner
---------

eax=00001ff0 ebx=00001ff0 ecx=823c1b98 edx=00000377 esi=e1035008 edi=00000fff
eip=8056e2ea esp=f7de9c18 ebp=f7de9c60 iopl=0 nv up ei pl zr na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010246
nt!HvpGetCellMapped+0x5f:
 
Status
Not open for further replies.

Similar threads

P
BSOD Classpnp.sys
Replies
5
Views
3K
Tmagic650
Tmagic650
A
Blue screen issue -- error category 102
Replies
2
Views
3K
Tmagic650
Tmagic650
G
WinDbg and BSODs
Replies
8
Views
3K
geoffcox
G

Latest posts

Back