BSOD and Windows Explorer crashes

Status
Not open for further replies.

toppa

Posts: 6   +0
***Please could somebody move this to the BSOD sub-forum, sorry***

Hi,

This is a direct follow-on from my thread 'PC Problems, please help', which had a more detailed write-up of my problem, as follows:

I wonder if anyone could help me, please? I'm a bit of a hardware novice, I've reached the end of my tether with this particular problem and am not far off selling off another good system for cheap scrap...

First, my system spec:

Packard Bell iMedia - Intel Core Duo 1.86Ghz
2Gb DDR2 RAM
400Gb HD
Nvidia GeForce 8500 video card
XP Home Edition

Right, this could be a long story, but I'll try to include as much detail as I can.

My PC started having problems a few weeks back, primarily through Firefox and Chrome continually and repeatedly crashing and restarting. I was told this could be a Flash issue, so I reinstalled that and reinstalled the browsers. Same problem. Next, and increasingly more common, Windows Explorer frequently started collapsing in on itself, telling me it had to close, followed by the usual Dr Watson post-mortem stuff. This was combined with a series of BSODs, frequently brought about (as with the browser restarts) by watching youtube videos - if there could be a correlation between the two, I'm not sure.

Here's an example of one, but they were all the same variety - STOP 0x0000008E errors.

h tt p:// i32.tinypic. com/ix8e4m.jpg (remove spaces)

I read that these were probably brought about by faulty RAM, so I replaced my old 2 x 512mb sticks with some brand new 2 x 1gb sticks yesterday. The RAM was installed fine, but the same consistent Windows Explorer error kept occuring, to the point where the system was seriously unstable most of the time.

My next step was to reinstall XP, which I did yesterday, but I got the same blue screen errors even when that was in the installlation stages - incredibly frustrating. For a while every time I booted the system I was met with the same error. Somehow I eventually got past that, thanks to persistent reboot attempts.

I ran chkdsk on both my partitioned drives earlier today - it initially found some errors, but these are all now fixed and the drives have been reported as clean.

I ran memtest, and this is coming back with multiple errors (loads!) from both sockets/RAM ports (I can't remember the exact terminology, sorry!). One test reported literally millions of errors. Yet my RAM is brand new and was installed safely and correctly, so I'm completely confused as to why this is the case. Could it be a problem with the RAM sockets on my motherboard?

As a result of the reinstall, my system seems a little more stable - I managed to get online to post this! - but I'm still get the same Windows Explorer/Dr Watson errors/closes and unpredictable BSODs regularly.

Another BSOD I just had was listed in Event Viewer as a system error, ER_KRNLCRASH_LOG .

As I only reinstalled XP yesterday, there seems to be only 1 minidump in the folder, but I have attached it anyway.

Many thanks for any help.
 
The dump is helpful. It was Avast that crashed the system. This is highly unusual.

It may indicate a conflict with other installed software. Since I have not seen avast conflict with any known good processes (like firewalls, etc), I am concerned that this may be a possible indicator of malware. This IS one of the possible sources of 0x8e BSODs.

It may be something else, though, since you did just reinstall XP!

Just to be safe, I would like to suggest that you take a look at the specialized section of Techspot that deals with malware. See here.

Those members (volunteers who help as time permits!) who are trained to deal with malware will be better able to help you on this question. Once we are sure your system is clean, then we can look for other issues.

One of our other BSOD helpers may have other ideas, but this is where I would like you to start.
 
I have just run a full scan with MalwareBytes and got the all-clear.

I will work my way through the others.

However, I just this second had another BSOD - I've attached the minidump in case it's different from the last time and if any more clues can be found.

Thanks again for your help.
 
This time your firewall was involved.

I strongly urge you to follow the 8 steps carefully, and post your results in a new thread in that subforum of Techspot.
I am not (yet) qualified to help you with malware, but others are.
And I strongly suspect this is what is giving you problems.

When you post your logs, you can refer to this thread for background for your helper.
They will be interested that you attempted to do a clean install and are still experiencing difficulties.
You should also read the other stickies(by Julio) at the top of that board. They provide additional helpful information.
 
Windows XP has a great way to find 'causes'- you mentioned it once: finding the Error in the Event Viewer that corresponds with the time of the crash: I don't do the minidumps so rely heavily on this- or information taken for both can be helpful:

Start> Run> type in eventvwr

Do this on each the System and the Applications logs:

  • [1]. Click to open the log>
    [2]. Look for the Error>
    [3] .Right click on the Error> Properties>
    [4]. Click on Copy button, top right, below the down arrow >
    [5]. Paste here (Ctrl V)
    [6].NOTES
  • You can ignore Warnings and Information Events.
  • If you have a recurring Error with same ID#, same Source and same Description, only one copy is needed.
  • You don't need to include the lines of code in the box below the Description, if any.
  • Please do not copy the entire Event log.

Errors are time coded. Check the computer clock on freeze.

There are 3 parts to the Error: the ID#, the Source and the description. Taking them together can often lead to a resolution. You have obviously done some searching and taken some actions. But it's best to do as much troubleshooting as possible before taking the actions.

Your Error will look similar to this: (I omitted some info I didn't need)
Event Error ID# 1003
Source: System Error
Description: Error code 1000008e, parameter1,c0000005, parameter2 bf8713ef, parameter3 ef1deb7c, parameter4 00000000.

Most of the problems leading to this event indicate faulty hardware, bugs in device drivers or incompatible hardware.


Here's one possibility for 0x8E: http://support.microsoft.com/default.aspx?scid=kb;en-us;894061
And another: http://support.microsoft.com/default.aspx?scid=kb;en-us;898542
And another: http://support.microsoft.com/default.aspx?scid=kb;en-us;907966

These relate to hotfixes for the Windows Sever.

I suggest you stop reinstalling the OS and look for cause. It sounds like on the reinstall, you are just carrying the problem along with it.

One other good place to look is in the Device Manager. You will be looking for a yellow triangle with black ! point in it, indicating an Error:
Start> Run> type in devmgmt.msc
 
Thanks for your help.

To B00kWyrm: I tried to run the 8 steps of the malware check, however each time I run one of the checks, Windows Explorer crashes and closes the malware scanner. So it seems I've hit a dead-end with regard to that for the time being!

I forgot to mention in my first post that since I've reinstalled XP, my DVD trays won't open by clicking the button on my PC button - I can get around this by using the 'eject' feature in My Computer, but I guess this might be a related problem.

Bobbye - sadly I've had to have Event Viewer as a permanent desktop shortcut recently, such has been the frequency of the errors!

There have been tens and tens of Application and System errors since I reinstalled XP on Wednesday, but I'll do my best to post up the error logs now:


System Errors

-------------------------------------------------------------------------------------------
Event Type: Error
Event Source: BITS
Event ID: 16391
The BITS job list is not in a recognized format. It may have been created by a different version of BITS. The job list has been cleared.
-------------------------------------------------------------------------------------------
Event Type: Error
Event Source: sr
Event ID: 1
The System Restore filter encountered the unexpected error '0xC000000D' while processing the file 'MSI7357c.tmp' on the volume 'HarddiskVolume1'. It has stopped monitoring the volume.
-------------------------------------------------------------------------------------------
Event Type: Error
Event Source: PSched
Event ID: 14107
Description:
QoS [Adapter NDISWANIP]:
The Packet Scheduler could not initialize the virtual miniport with NDIS.
-------------------------------------------------------------------------------------------
Event Type: Error
Event Source: System Error
Event Category: (102)
Event ID: 1003
Description:
Error code 1000008e, parameter1 c0000005, parameter2 7e5bbc78, parameter3 b3e38c10, parameter4 00000000.
-------------------------------------------------------------------------------------------
**This is only slightly different to the last one.***

Event Type: Error
Event Source: System Error
Event Category: (102)
Event ID: 1003
Description:
Error code 1000008e, parameter1 c0000005, parameter2 7e5bbc78, parameter3 b3b31c10, parameter4 00000000.

-------------------------------------------------------------------------------------------


Application Errors


Event Type: Error
Event Source: Application Error
Event Category: (100)
Event ID: 1000
Description:
Faulting application explorer.exe, version 6.0.2900.5512, faulting module unknown, version 0.0.0.0, fault address 0x75f17d6a.

**This has happened on multiple occasions***
-------------------------------------------------------------------------------------------
Event Type: Error
Event Source: Application Error
Event Category: (100)
Event ID: 1000
Description:
Faulting application drwtsn32.exe, version 5.1.2600.0, faulting module dbghelp.dll, version 5.1.2600.5512, fault address 0x0001295d.

**This has happened on multiple occasions***
-------------------------------------------------------------------------------------------
Event Type: Error
Event Source: Application Error
Event Category: (100)
Event ID: 1000
Description:
Faulting application explorer.exe, version 6.0.2900.5512, faulting module unknown, version 0.0.0.0, fault address 0x75f17d6a.

**This has happened on multiple occasions***
-------------------------------------------------------------------------------------------
Event Type: Error
Event Source: Application Error
Event Category: (100)
Event ID: 1000
Description:
Faulting application drwtsn32.exe, version 5.1.2600.0, faulting module dbghelp.dll, version 5.1.2600.5512, fault address 0x0001295d.

**This has happened on multiple occasions***
-------------------------------------------------------------------------------------------
Event Type: Error
Event Source: Application Error
Event Category: (100)
Event ID: 1000
Description:
Faulting application taskmgr.exe, version 5.1.2600.5512, faulting module unknown, version 0.0.0.0, fault address 0x75f17d6a.
-------------------------------------------------------------------------------------------
Event Type: Error
Event Source: Application Hang
Event Category: (101)
Event ID: 1002
Description:
Hanging application taskmgr.exe, version 5.1.2600.5512, hang module hungapp, version 0.0.0.0, hang address 0x00000000.
-------------------------------------------------------------------------------------------
Event Type: Error
Event Source: Application Error
Event Category: (100)
Event ID: 1000
Description:
Faulting application , version 0.0.0.0, faulting module unknown, version 0.0.0.0, fault address 0x00000000.
-------------------------------------------------------------------------------------------
Event Type: Error
Event Source: Application Error
Event Category: None
Event ID: 1000
Description:
Faulting application ashavast.exe, version 4.8.1351.0, faulting module unknown, version 0.0.0.0, fault address 0x75f17d6a.
-------------------------------------------------------------------------------------------
Event Type: Error
Event Source: Application Error
Event Category: None
Event ID: 1000
Description:
Faulting application wmplayer.exe, version 10.0.0.3931, faulting module unknown, version 0.0.0.0, fault address 0x00460029.
-------------------------------------------------------------------------------------------
Event Type: Error
Event Source: Application Error
Event Category: None
Event ID: 1000
Date: 20/08/2009
Time: 21:49:19
User: N/A
Computer: SNA123456789
Description:
Faulting application wmplayer.exe, version 10.0.0.3931, faulting module jscript.dll, version 5.8.6001.18702, fault address 0x00025b24.
-------------------------------------------------------------------------------------------
Event Type: Error
Event Source: Application Error
Event Category: (100)
Event ID: 1000
Description:
Faulting application mspaint.exe, version 5.1.2600.5512, faulting module unknown, version 0.0.0.0, fault address 0x75f17d6a.
-------------------------------------------------------------------------------------------
Event Type: Error
Event Source: Application Hang
Event Category: (101)
Event ID: 1002
Description:
Hanging application chrome.exe, version 0.0.0.0, hang module hungapp, version 0.0.0.0, hang address 0x00000000.
-------------------------------------------------------------------------------------------


Phew! Hopefully all of the above can provide some clues as to the problem(s).

Thanks again, I really appreciate your help.
 
:grinthumbGood Points, Bobbye. Thank You.:approve:
I do not often use Event Viewer, simply because I like the more complete information in the Minidumps.
There are times when minidumps are not available that the Event Viewer can then be an absolute lifesaver,
and there are others who are better at dealing with Event Viewer reports. Some here are better with the minidumps too. :rolleyes:

Absolutely right about
Most of the problems leading to this event indicate faulty hardware, bugs in device drivers or incompatible hardware.
Since the minidumps specifically pointed to the AV and Firewall, and since these -normally- do not misbehave without malware intrusions, I pointed the OP to the Malware board. I am suspecting that the misbehaving driver is malware, and that the AV and Firewall are what are failing, resulting in BSOD.

If the minidumps had said something else, I would have pointed in another direction.
For the sake of the OP, I would love to be wrong on this guess.

All readers... please note... I am not trying to help resolve a malware issue... :)
I only suspect that there may be one present, and I am trying to point the OP to the proper help on this board.
 
B00kWyrm, you can send me one of those animated replies anytime!

I am still inclined to think the major problem is hardware. He says his RM is good, but it fails the memtest. So the question about bad sockets in the motherboard should be considered. You are at an advantage because I can't open or read minidumps!

Consider that he has reinstalled Windows XP. He uninstalled then reinstalled 2 browsers- And still has the problem, I'd like to see what shows in the Event Viewer. While you are correct that both antivirus and firewall problems would point to malware, I think he also needs to rule out the hardware problem. If it was 'just malware' the OS reinstall should have handled it.

Here's a heads up on an Explorer crash. If the files are set to show hidden files and folders and left with that setting, it can cause Explorer to crash- for seemingly an unknown reason.
 
hmmm... Good Catch, Bobbye!
I failed to connect this thread with my two posts in the previous thread... I only read his top post here...

Okay Toppa... if you are still with us...
  • for now stop chasing the possibility of Malware...
  • We do need to get back to the issue of Failing Memtest.
Are you still here?

In the previous thread I had posted...
"I have never seen a Memtest report be wrong... The only question is why..."

1. Some motherboards are notoriously picky about RAM. You need to make sure that your new ram is on their compatibility list.
2. If you are overclocking or under/overvoltage, you can get memory errors. Reset to default if you are overclocking.
3. Other things can cause memory errors as well, (there are several kinds)... One might be failing memory in your video card.

To do further diagnostics, we need for you to attach your most recent minidumps.
You have replied with memory dumps... unfortunately they do not confirm what memtest is telling us. There are other codes that often indicate bad memory. And sometimes WinDbg will specifically spell out "corrupted memory". These did not appear here.

So... back to the original questions...
Overclocking? Voltages?
I have seen failing PSU's cause memory errors. Even if your clock and voltages are set properly in BIOS...
Sometimes a tool like "Speed Fan" or "Everest" might help isolate a PSU problem.
Others here are better with those tools.
When you replaced ram, did you get modules that were listed in the Hardware Compatibility list for your Motherboard?
Some boards are very picky. And some ram is better than others.
Route 44 can make some good recommendations here, if he will take a look.
But, to see if this might be a problem we need to know the maker and model of both MB and RAM.
Don't just assume that it is bad yet. AND, if it is, you may be able to RMA it.


Are you using a PCI video card or "on board graphics"?
Wondering if we might be able to isolate the issue a little further by pulling the video card.
 
Sheesh... something weird is going on for me today...
Only NOW does post 6 show up with all the events.

Bobbye... What do you think of having him run Driver Verifier? Do you think this would be fruitful at this point?
Note, I am still concerned about the hardware... PSU seems a distinct possibility...
Another memory issue recently resolved to bad capacitors on the motherboard.
Some boards were known for this issue. I don't remember now who was talking about this.
 
I don't know if we can save it. This error alone is serious: From TechNet:
Event ID: 14107
Source: PSched
Version: 5.0
Component: System Event Log
Symbolic Name: EVENT_PS_INIT_DEVICE_FAILED
Message: QoS [Adapter %2]:
The Packet Scheduler could not initialize the virtual miniport with NDIS.

Explanation:This event record indicates a serious problem.

Microsoft Technet doesn't even offer informtion on this, let alone a fix!

Run the System File Checker

Start> Run type in Go to the Run box on the Start Menu and type in:
sfc /scannow ( sfc if not recognized) (Note that there is a space between sfc and /scannow)

This command will immediately initiate the Windows File Protection service to scan all protected files and verify their integrity, replacing any files with which it finds a problem.

In all likelihood you will be prompted to insert the Windows XP CD so have it handy.

I'd like you to try to manually set a restore point: All Programs> Accessories> System Tools System Restore> CHECK 'create a new restore point'> next> give it a name> OK. That "might" get SR to kick back in.

I think we can ignore the faulting and hanging apps for now. But I would take everything off of the Startup menu except the antivirus and touchpad if you have a laptop:

Start> Run> type in msconfig> enter> Selective Startup> Startup tag> Uncheck all but the AV> Apply> OK.

NOTE: when you reboot the first time after doing this, you'll get a nag message you can ignore and close after checking 'don't show this message again.' Stay in Selective Startup.

See how this goes. You have some serious problems and my next suggestion is to take it in to a shop- and I almost never suggest that!

B00k, feel free to add.
 
Hi guys,

Still here!

This doesn't sound good, you're right!

I'll try to work my way through some of your points.

The 'show hidden files and folders' option is unchecked, so this can't be the cause. Useful tip though - I'll keep that in mind.

When I bought my new RAM, I was recommended by many people to use Crucial.com - they have an in-site scanner that scans your motherboard and recommends a specific type of new RAM accordingly. As such, the new RAM I bought was their own brand, 2 x CT12864AA667 1GB, 240-pin DIMM sticks. My motherboard is a Packard Bell Cuba MS-730 - the RAM was automatically selected for me by this site using my MB as a starting point.

My video card is a nVidia GeForce 8500 GT - so not onboard graphics.

My system isn't overclocked. I've run SpeedFan, as recommended, and all temperatures are between 40-60 - which seems average according to a quick google search (although I could be wrong!)

I've changed to selective startup through msconfig and setting a new restore point didn't seem to be a problem.

Edit: I've just rebooted for the first time using Selective Startup, with no joy. Upon entering XP, I was almost instantly met with the usual 'Windows Explorer has to close' and the Dr. Watson error message. Sigh.
 
I'd still suggest you run the SFC.

Another diagnostic option would be Safe Mode: As you probably know, when booting in to Safe Mode, there are processes that do not start. It is one of the diagnostic ways to pinpoint a source of a problem.

Boot into Safe Mode
  • Restart your computer and start pressing the F8 key on your keyboard.
  • Select the Safe Mode option when the Windows Advanced Options menu appears, and then press ENTER.

If a symptom does not reappear when you start in safe mode, you can eliminate the default settings and minimum device drivers as possible causes. If a newly added device or a changed driver is causing problems, you can use safe mode to remove the device or reverse the change.

Using Safe Mode to determine a basic source of a problem:The choices:
  • Safe Mode: Loads the minimum set of device drivers (serial or PS/2 mouse devices, standard keyboards, hard disks, CD-ROM drives, and standard VGA devices)and system services required to start Windows XP/2000/2003.(Event Log, Plug and Play, remote procedure calls (RPCs), and Logical Disk Manager.) User specific startup programs do not run. This is helpful in determining whether problems are due to specific programs.
  • Safe Mode with Networking: Includes the services and drivers needed for network connectivity. Safe mode with networking enables logging on to the network, logon scripts, security, and Group Policy settings. Nonessential services and startup programs not related to networking do not run. Helpful if needed but should be used with caution as the security programs don't load in this mode.
  • Safe Mode with Command Prompt: Starts the computer in safe mode, but displays the command prompt rather than the Windows GUI interface.
  • Last Known Good Configuration, which starts your computer using the registry information that was saved at the last shutdown.

So by using the different options of Safe Mode, you can sometimes determine what the area of problem is- and isn't.
 
Status
Not open for further replies.
Back