BSOD 0x0000008E on XP, need advice

[Hunter_Thompson]

Hi, I am trying to diagnose an XP machine that BSOD about twice a day.

Last one happened at 10:28am today (about 30 mins ago)

Came up with BSOD and the following:
0x0000008E (0xC0000005, 0x8054B034, 0xEDDED468, 0x00000000)

BCCode : 1000008e BCP1 : C0000005 BCP2 : 8054B034 BCP3 : EDDED468
BCP4 : 00000000 OSVer : 5_1_2600 SP : 2_0 Product : 256_1

There seems to be no new hardware, except for new RAM about 2 months ago but this doesn't seem to correlate with the blue screens... Seems to be no pattern to what application was being run when BSOD happens (happened to me while doing Windows Update).

Have attached all the minidumps.

I am trying to learn how to decipher these dumps but need to get this machine back up ASAP and have seen some great posts on this website where people are able to tell what driver or hardware was to blame for the crash after looking at a dump - if anyone can help us out it is greatly appreciated! Let me know if you need any other info.

Hunter

 

[Route44]

The majority of your minidumps point to 0x8E Pool_Corruption which points to a hardware compatibility or driver issue.

However, your first minidump stated Corrupted Memory. Thus thye very first thing I would do is run a MemTest on your RAM for 10 passes to see if your memory is bad. faulty memory can be a real headache.

 

[Hunter_Thompson]

Thank you for your prompt post!

I don't suppose there was any indicator of what driver or hardware was being used in the dump? Anyway to trace it down further?

I have been running a memtest for about an hour now, will go see how it went.

MEMTEST got to 900% (9 passes?) without an error.

I know that bad RAM can often pass memory tests...

But I was hoping to be more sure about the cause, it still seems like a un-researched option to just replace RAM when you get bluescreens...

I'll keep Googling. Thanks again for any advice!

Hunter

 

[Hunter_Thompson]

Whoa, poeple, one answer at a time, if you all shout at once I can't hear.

Maybe I was offensive or arrogant in my question?

Is there something I need to do before I get replies on this website?

Hunter

 

[cpc2004]

Yours windows are crashed with random bugcheck codes and this is symptom of hardware error. As hardware occurs at random pattern and software error usually has same pattern.

One minidump is crashed with bugcheck code 7F with NT Staus code d this is also the symptom of hardware problem. Most hardware is related to RAM.

Mini071307-01.dmp BugCheck 7F, {d, 0, 0, 0}
Probably caused by : ntoskrnl.exe ( nt!KiSystemFatalException+f )

 

[Hunter_Thompson]

Hi - thanks for the reply.

Got the user to take out the newest RAM chip this morning after reading your post, and it still blue screens. We will try swapping out the other chip, but I have concerns.

cpc2004 - In a perfect world, I would not just be able to fix this PC but also have the skills to figure out BSOD's and dump files... how on earth did you establish the information you posted? How do you look at dump files? Do you use the obscure Microsoft Debugging tools, or do you just open the file in a text editor and do the hard yards? Also, to quote your post, "Yours windows are crashed with random bugcheck codes and this is symptom of hardware error. As hardware occurs at random pattern and software error usually has same pattern" how did you figure this one out??? BTW, a great tip, but how do I see these "patterns"?

Thanks for your informative post, it is leaps and bounds more detailed than some of the "google it" replies other forums have posted.

Hunter

 

[cpc2004]

I use windbg to process the dump and not notepad. The following are what you want

Mini071207-01.dmp BugCheck 50, {ffffffff, 0, ee77306a, 0}
Probably caused by : mrxsmb.sys ( mrxsmb!InitShareRec+17 )

Mini071207-02.dmp BugCheck 1000008E, {c0000005, 8054b38f, b89cbfe8, 0}
Probably caused by : Pool_Corruption ( nt!ExDeferredFreePool+ac )

Mini071307-01.dmp BugCheck 7F, {d, 0, 0, 0}
Probably caused by : ntoskrnl.exe ( nt!KiSystemFatalException+f )

Mini071307-02.dmp BugCheck 1000008E, {c0000005, 8054b539, ed7ce944, 0}
Probably caused by : Pool_Corruption ( nt!ExDeferredFreePool+fd )

Mini071407-01.dmp BugCheck 8E, {c0000005, 8054b38f, eda7582c, 0}
Probably caused by : Pool_Corruption ( nt!ExDeferredFreePool+ac )

Mini071407-02.dmp BugCheck A, {20, 2, 0, 804f9f45}
Probably caused by : VSApiNt.sys ( VSApiNt+f9212 )

Mini071607-01.dmp BugCheck 8E, {c0000005, 8054b539, eda77bfc, 0}
Probably caused by : Pool_Corruption ( nt!ExDeferredFreePool+fd )

Mini071807-01.dmp BugCheck 1000008E, {c0000005, 8054b38f, f7023a70, 0}
Probably caused by : Pool_Corruption ( nt!ExDeferredFreePool+ac )

Mini072707-01.dmp BugCheck 1000008E, {c0000005, 8054b38f, ee17482c, 0}
Probably caused by : Pool_Corruption ( nt!ExDeferredFreePool+ac )

Mini080207-01.dmp BugCheck 51, {4, 1, e819aab8, 501e8}
Probably caused by : ntoskrnl.exe ( nt!CmpAssignSecurityToKcb+3f )

Mini080307-01.dmp BugCheck 1000008E, {c0000005, 8054b034, edded468, 0}
Probably caused by : win32k.sys ( win32k!HeavyAllocPool+74

 

[Hunter_Thompson]

Wow, what a post!

This is exactly what I am looking for - actual services and processes that were being used when crash occurs. Some serious stuff to consider and start informed troubleshooting with.

Guess I just have to learn windbg.

Thanks a million, cpc2004 - I really appreciate your effort. Time to learn new stuff.

Hunter

 

[EZ123]

I am suspecting that those issues are related to a software problems and not a hardware problem.

After taking a look at several dumps you provided, I could notice that most of the dumps related to free memory allocations. this can caused by a driver that doing deallocation wrong.

I will be able to help you if you could provide me with a kernel dump of your system.

to create a kernel dump you should do the following :

Go to control Panel -> System -> Advanced tab -> Startup and recovery Setting button.
Change Write debugging information section to kernel dump.

now notice that when a BSOD will generated , memory.dmp file will be generated in the directory %SYSTEMROOT%\memory.dmp

so in my XP it is c:\windows\memory.dmp.

the file that will generated will be around 100MB compressed to somthing from 10 to 35mb.

you will have to provide me with this file so I could get a better understanding about your issue.

Cheers,
EZ

 

[Hunter_Thompson]

Thanks for the post.

I am going to make the change you suggest and get this info today, if all goes to plan.

I am still struggling to learn how you guys are able to get this info out of my dump files, but am very appreciative of the offers to lok at them for me. I am reading a beginners tutorial on windbg so maybe one day I can diagnose this stuff myself.

Will post the info as soon as it comes to hand.

Hunter

 

[Hunter_Thompson]

Damn, the user of the PC has gone away. As soon as they are back I will get them to do your suggested change and get them to supply info.

 

[Tedster]

learn how to read your own minidumps: https://www.techspot.com/vb/topic31341.html