BSOD multiple error messages

[MJoannides]

Please help! I have been getting a BSOD error message almost daily. I get one of two errors: either driver_irql_not_less_or_equal OR worker_thread_returned_at_bad_IRQL.
I'll be in the middle of working and my computer will freeze up. Sometimes it will reboot itself, sometimes the blue screen comes up.
I have tried everything I know. I have updated the BIOS version, reinstalled the OS, checked the hard drive numerous times, and ran the memtest86 test for 8 passes and they were all successful. Does anyone have any ideas????

 

[cpc2004]

Hi,

You are using W2K and Microsoft does not provide the symbolic files for your version. I am using XP Pro and I can't resolve the W2K symbol file at my PC. Without the symbol file, it is very hard to debug your problem. You have to change dump option to full memory dump and install windbg. Run windbg at your PC and post the debug report here.

Debugging Tools from Microsoft
1) Create folder c:\symbols
2) Download and install the http://www.microsoft.com/whdc/devtools/debugging/installx86.mspx
3) Locate your latest memory.dmp file- C:\WINNT\memory.dmp
4) open a CMD prompt and cd\program files\debugging tools for windows\
5) type the following stuff:

Code:
c:\program files\debugging tools>kd -z C:\WINNT\memory.dmp
kd> .logopen c:\debuglog.txt
kd> .sympath srv*c:\symbols*http://msdl.microsoft.com/download/symbols
kd> .reload;!analyze -v;r;kv;lmnt;.logclose;q

You now have a debuglog.txt in c:\, open it in notepad and post to this thread.

 

[MJoannides]

I followed your instructions and here is the debug log. Thank you for your help this far!

 

[cpc2004]

Hi,

Your debug report still cannot resolve the nt symbols. Do you change the dump option to full memory dump?

c:\program files\debugging tools>kd -z C:\WINNT\memory.dmp
kd> .logopen c:\debuglog.txt
kd> .sympath srv*c:\symbols*http://msdl.microsoft.com/download/symbols
kd> .reload;!analyze -v;r;kv;lmnt;.logclose;q

 

[MJoannides]

Okay. I hope I did this right. I changed the setting so I got a complete memory dump. Then reran the code you had given. Here it is. Thanks again!

 

[cpc2004]

Your dump is a minidump and not a full memory dump. What is the size of memory.dmp?

 

[MJoannides]

The last memory.dmp file was from yesterday at 11:35 AM (EST) and was 523648 KB.

 

[cpc2004]

The output of a sample full memory dump look like this and your module list does not have module list at the user region. Probably you process the minidump and not the memory.dmp. (Note Windows take a full memory and the minidump is also taken as well).

Make sure that the kd command access the memory dump. Do you create the folder symbols at drive.

kd> .reload;!analyse -v;r;!thread;kv;lmnt
Loading Kernel Symbols
................................................................................
..................
Loading unloaded module list
........
Loading User Symbols
........
No export analyse found
eax=ffdff13c ebx=0000000a ecx=00000001 edx=40000000 esi=8042bfbc edi=f00095e3
eip=80467d67 esp=ed4f3a88 ebp=ed4f3a9c iopl=0 nv up ei ng nz na po nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00000286
nt!KiTrap0E+0x20b:
80467d67 f7457000000200 test dword ptr [ebp+0x70],0x20000 ss:0010:ed4f3b0c=00010
202
THREAD 810c3900 Cid a8.c0 Teb: 00000000 Win32Thread: e22acb08 RUNNING
IRP List:
81659188: (0006,0148) Flags: 00000970 Mdl: 00000000
Not impersonating
Owning Process 81641680
Wait Start TickCount 9492 Elapsed Ticks: 0
Context Switch Count 2464
UserTime 0:00:00.0000
KernelTime 0:00:00.0000
Start Address win32k!RawInputThread (0xa0072055)
Stack Init ed4f4000 Current ed4f3af0 Base ed4f4000 Limit ed4f1000 Call 0
Priority 19 BasePriority 13 PriorityDecrement 0 DecrementCount 0

ChildEBP RetAddr Args to Child
ed4f3a9c 8042bfbc 9b123920 287a1bc9 00000000 nt!KiTrap0E+0x20b
ed4f3b3c a0072417 00000004 810cb0a8 00000001 nt!KeWaitForMultipleObjects+0x1f4
ed4f3da8 80454a24 00000002 00000000 00000000 win32k!RawInputThread+0x3c2
ed4f3ddc 80469212 a0072055 ed18f7d0 00000000 nt!PspSystemThreadStartup+0x54
00000000 f00095e3 f000e363 f00095e3 f00095e3 nt!KiThreadStartup+0x16
00000000 00000000 f000e363 f00095e3 f00095e3 +0xf00095e3

ChildEBP RetAddr Args to Child
ed4f3a9c 8042bfbc 9b123920 287a1bc9 00000000 nt!KiTrap0E+0x20b (FPO: [0,0] TrapF
rame @ ed4f3a9c)
ed4f3b3c a0072417 00000004 810cb0a8 00000001 nt!KeWaitForMultipleObjects+0x1f4 (
FPO: [Non-Fpo])
ed4f3da8 80454a24 00000002 00000000 00000000 win32k!RawInputThread+0x3c2 (FPO: [
Non-Fpo])
ed4f3ddc 80469212 a0072055 ed18f7d0 00000000 nt!PspSystemThreadStartup+0x54 (FPO
: [Non-Fpo])
00000000 f00095e3 f000e363 f00095e3 f00095e3 nt!KiThreadStartup+0x16
WARNING: Frame IP not in any known module. Following frames may be wrong.
00000000 00000000 f000e363 f00095e3 f00095e3 0xf00095e3

start end module name
-----------------------------------------------------------------------
5ff90000 5ff9c000 CSRSRV CSRSRV.dll Thu Jan 13 11:09:48 2005 (41E648EC)
5ffa0000 5ffae000 basesrv basesrv.dll Thu Jan 13 11:09:46 2005 (41E648EA)
5fff0000 5fff4000 csrss csrss.exe Fri Jun 20 04:44:27 2003 (3EF2750B)
77e10000 77e79000 USER32 USER32.dll Thu Apr 21 10:08:41 2005 (42675F89)
77f40000 77f7f000 GDI32 GDI32.dll Fri Apr 08 13:54:28 2005 (425670F4)
77f80000 77ffc000 ntdll ntdll.dll Thu Jan 13 11:09:36 2005 (41E648E0)
7c570000 7c623000 KERNEL32 KERNEL32.dll Thu Jan 06 10:17:41 2005 (41DD0235)
7cc30000 7cc70000 winsrv winsrv.dll Sat Mar 12 08:54:53 2005 (4232A04D)
--------------------------------------------------------------------

80062000 80072520 hal halacpi.dll Fri Mar 21 03:04:40 2003 (3E7A7338)
80400000 8059cb40 nt ntoskrnl.exe Fri May 06 13:44:59 2005 (427B58BB)
a0000000 a018ee40 win32k win32k.sys Sat Feb 19 01:28:34 2005 (42168832)

 

[MJoannides]

In the command window I see: ERROR: Symbol file could not be found. Defaulted to export symbols for KS.SYS.
Also, I am getting the blue screen more frequently now. The only way I run these tests is in Safe mode, so I don't know if that's affecting anything.

On the blue screen it is now referencing cwawdm.sys. Is that revelant?

 

[MJoannides]

Here is the output of my last debug log in case this helps:

eax=ffdff13c ebx=0000000a ecx=00000000 edx=00000002 esi=82006a18 edi=82006388
eip=bfd658a3 esp=eb833d58 ebp=820063b0 iopl=0 nv up ei ng nz na po nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00000286
KS!KsPropertyHandlerWithAllocator+0x81:
bfd658a3 33c0 xor eax,eax
THREAD 820b28a0 Cid 8.18 Teb: 00000000 Win32Thread: 00000000 RUNNING
Not impersonating
Owning Process 820b39e0
Wait Start TickCount 4408 Elapsed Ticks: 0
Context Switch Count 204
UserTime 0:00:00.0000
KernelTime 0:00:00.0010
Start Address nt!ExpWorkerThread (0x80416b4c)
Stack Init eb834000 Current eb833d34 Base eb834000 Limit eb831000 Call 0
Priority 13 BasePriority 13 PriorityDecrement 0 DecrementCount 0

ChildEBP RetAddr Args to Child
820063b0 00000000 00000001 00000000 00000000 KS!KsPropertyHandlerWithAllocator+0x81

ChildEBP RetAddr Args to Child
WARNING: Stack unwind information not available. Following frames may be wrong.
820063b0 00000000 00000001 00000000 00000000 KS!KsPropertyHandlerWithAllocator+0x81
start end module name
80062000 80072520 hal halacpi.dll Thu Mar 20 21:04:40 2003 (3E7A7338)
80400000 8059cb40 nt ntoskrnl.exe Fri May 06 07:44:59 2005 (427B58BB)
bb916000 bb92b180 dump_atapi dump_atapi.sys Tue Apr 01 13:08:25 2003 (3E89D599)
bb92c000 bb94eac0 Fastfat Fastfat.SYS Tue Jul 19 06:44:42 2005 (42DCD99A)
bb977000 bb9938e0 jsmux jsmux.sys Tue Sep 21 11:35:37 1999 (37E7A5C9)
bb994000 bb9fda40 mrxsmb mrxsmb.sys Fri Apr 01 20:23:32 2005 (424DF414)
bba10000 bba3cac0 rdbss rdbss.sys Mon Apr 11 17:31:22 2005 (425AECAA)
bbadd000 bbaee980 naveng naveng.sys Mon Oct 10 15:18:51 2005 (434ABE9B)
bbaef000 bbb90860 navex15 navex15.sys Mon Oct 10 15:18:03 2005 (434ABE6B)
bbb91000 bbbe0000 savrt savrt.sys Mon Feb 09 18:24:30 2004 (402816AE)
bbbe0000 bbc0ad00 netbt netbt.sys Fri Apr 01 20:23:24 2005 (424DF40C)
bbc0b000 bbc1df00 SYMEVENT SYMEVENT.SYS Wed Jan 14 21:02:13 2004 (4005F4A5)
bbc1e000 bbc5d0e0 SYMTDI SYMTDI.SYS Thu Mar 11 17:50:21 2004 (4050ED2D)
bbc5e000 bbcac1a0 tcpip tcpip.sys Thu May 12 06:24:58 2005 (42832EFA)
bfced000 bfd173a0 update update.sys Wed Apr 16 00:22:01 2003 (3E9CDA69)
bfd40000 bfd56ba0 ndiswan ndiswan.sys Tue Apr 29 19:05:01 2003 (3EAF051D)
bfd57000 bfd74a00 KS KS.SYS Sat Oct 21 06:25:13 2000 (39F16F09)
bfd75000 bfd991e0 portcls portcls.sys Wed Apr 16 00:11:22 2003 (3E9CD7EA)
bfd9a000 bfdbab00 cwawdm cwawdm.sys Wed Aug 01 11:27:51 2001 (3B681FF7)
bfdbb000 bfdf2e20 SynTP SynTP.sys Fri Apr 13 12:34:11 2001 (3AD72A83)
bfdf3000 bfe44480 ati2mtag ati2mtag.sys Sat Aug 04 20:24:56 2001 (3B6C9258)
bfe76000 bfe8bbe0 Mup Mup.sys Thu Dec 02 22:37:23 2004 (41AFDF73)
bfe8c000 bfeb5aa0 NDIS NDIS.sys Tue Apr 29 19:05:01 2003 (3EAF051D)
bfeb6000 bff33480 Ntfs Ntfs.sys Tue May 10 05:20:29 2005 (42807CDD)
bff34000 bff457c0 KSecDD KSecDD.sys Sat Sep 20 20:32:19 2003 (3F6CF193)
bff46000 bff675a0 fltmgr fltmgr.sys Thu Apr 14 02:59:00 2005 (425E14B4)
bff68000 bff7d180 atapi atapi.sys Tue Apr 01 13:08:25 2003 (3E89D599)
bff7e000 bff9f9c0 dmio dmio.sys Wed Jan 15 14:47:04 2003 (3E25BAB8)
bffa0000 bffbc5a0 ftdisk ftdisk.sys Thu Dec 02 22:29:58 2004 (41AFDDB6)
bffbd000 bffd7b00 pcmcia pcmcia.sys Wed Feb 12 11:09:23 2003 (3E4A71B3)
bffd8000 bffffc20 ACPI ACPI.sys Wed Jan 15 14:44:22 2003 (3E25BA16)
eb400000 eb40e6a0 pci pci.sys Wed Jan 15 14:44:07 2003 (3E25BA07)
eb410000 eb41b680 isapnp isapnp.sys Wed Jan 15 14:43:47 2003 (3E25B9F3)
eb420000 eb428700 CLASSPNP CLASSPNP.SYS Wed Jan 15 14:42:51 2003 (3E25B9BB)
eb440000 eb44c4c0 VIDEOPRT VIDEOPRT.SYS Wed Jan 15 14:47:20 2003 (3E25BAC8)
eb450000 eb45f000 el90xbc5 el90xbc5.sys Tue Oct 19 13:09:18 1999 (380CA5BE)
eb460000 eb46b680 i8042prt i8042prt.sys Wed Apr 16 00:00:59 2003 (3E9CD57B)
eb470000 eb47f400 serial serial.sys Wed Apr 16 00:19:39 2003 (3E9CD9DB)
eb480000 eb48ca80 rasl2tp rasl2tp.sys Tue Apr 29 19:05:06 2003 (3EAF0522)
eb490000 eb49bc40 raspptp raspptp.sys Wed May 14 19:47:00 2003 (3EC2D574)
eb4a0000 eb4aea20 parallel parallel.sys Wed Jan 15 14:47:14 2003 (3E25BAC2)
eb4d0000 eb4d9be0 usbhub usbhub.sys Tue Mar 18 18:30:41 2003 (3E77AC21)
eb500000 eb509ce0 NDProxy NDProxy.SYS Thu Sep 30 19:25:35 1999 (37F3F16F)
eb510000 eb518fa0 Npfs Npfs.SYS Sat Oct 09 19:58:07 1999 (37FFD68F)
eb520000 eb528680 msgpc msgpc.sys Wed Jan 15 14:54:25 2003 (3E25BC71)
eb530000 eb5381a0 netbios netbios.sys Tue Oct 12 15:34:19 1999 (38038D3B)
eb540000 eb550000 Savrtpel Savrtpel.sys Mon Feb 09 18:24:34 2004 (402816B2)
eb680000 eb685520 PCIIDEX PCIIDEX.SYS Tue Feb 25 13:31:08 2003 (3E5BB66C)
eb688000 eb68f4c0 MountMgr MountMgr.sys Tue Aug 16 04:40:55 2005 (4301A697)
eb690000 eb697720 disk disk.sys Wed Jan 15 14:43:05 2003 (3E25B9C9)
eb6a8000 eb6aff40 uhcd uhcd.sys Wed Jan 15 14:45:50 2003 (3E25BA6E)
eb6c0000 eb6c4fc0 USBD USBD.SYS Wed Jan 22 12:05:33 2003 (3E2ECF5D)
eb6e0000 eb6e5400 mouclass mouclass.sys Thu Feb 20 11:37:45 2003 (3E550459)
eb6f0000 eb6f5ec0 kbdclass kbdclass.sys Thu Feb 20 11:37:30 2003 (3E55044A)
eb700000 eb706580 fdc fdc.sys Wed Jan 15 14:42:51 2003 (3E25B9BB)
eb718000 eb71e100 parport parport.sys Wed Jan 15 14:47:13 2003 (3E25BAC1)
eb740000 eb744400 ptilink ptilink.sys Wed Jan 15 14:47:15 2003 (3E25BAC3)
eb750000 eb7540e0 raspti raspti.sys Fri Oct 08 16:45:10 1999 (37FE57D6)
eb768000 eb76ca60 flpydisk flpydisk.sys Wed Jan 15 14:42:52 2003 (3E25B9BC)
eb778000 eb77ea20 EFS EFS.SYS Wed Jan 15 14:46:55 2003 (3E25BAAF)
eb7a8000 eb7ad240 Msfs Msfs.SYS Tue Oct 26 19:21:32 1999 (3816377C)
eb7c8000 eb7cfd00 wanarp wanarp.sys Fri Aug 16 08:25:01 2002 (3D5CEF1D)
eb7f8000 eb7ff100 jsscan jsscan.sys Tue Sep 21 11:32:35 1999 (37E7A513)
eb810000 eb812a20 BOOTVID BOOTVID.dll Wed Nov 03 20:24:33 1999 (3820E051)
eb814000 eb816320 compbatt compbatt.sys Wed Jan 15 14:44:30 2003 (3E25BA1E)
eb818000 eb81ad00 PartMgr PartMgr.sys Wed Jan 15 14:43:07 2003 (3E25B9CB)
eb87c000 eb87e5a0 CmBatt CmBatt.sys Wed Jan 15 14:44:29 2003 (3E25BA1D)
eb88c000 eb88f640 serenum serenum.sys Wed Jan 15 14:47:01 2003 (3E25BAB5)
eb894000 eb8962e0 ndistapi ndistapi.sys Wed Jan 15 14:54:15 2003 (3E25BC67)
eb8a4000 eb8a7e60 TDI TDI.SYS Wed Jan 15 14:56:26 2003 (3E25BCEA)
eb8c8000 eb8cb580 vga vga.sys Sat Sep 25 14:37:40 1999 (37ED1674)
eb8e8000 eb8eafe0 OMCI OMCI.SYS Fri Jun 15 21:27:11 2001 (3B2AB5EF)
eb900000 eb901b00 BATTC BATTC.SYS Wed Jan 15 14:44:26 2003 (3E25BA1A)
eb902000 eb903d20 Diskperf Diskperf.sys Wed Feb 12 16:34:38 2003 (3E4ABDEE)
eb90c000 eb90dca0 Fs_Rec Fs_Rec.SYS Wed Jan 15 14:53:30 2003 (3E25BC3A)
eb914000 eb915e40 rasacd rasacd.sys Sat Sep 25 14:41:23 1999 (37ED1753)
eb9c8000 eb9c8f80 WMILIB WMILIB.SYS Sat Sep 25 14:36:47 1999 (37ED163F)
eb9c9000 eb9c9b00 pciide pciide.sys Wed Jan 15 14:43:03 2003 (3E25B9C7)
eb9e9000 eb9e9a40 audstub audstub.sys Sat Sep 25 14:35:33 1999 (37ED15F5)
eb9f3000 eb9f3d80 swenum swenum.sys Sat Oct 21 06:25:39 2000 (39F16F23)
eba01000 eba019e0 Null Null.SYS Sat Sep 25 14:34:58 1999 (37ED15D2)
eba03000 eba03ee0 Beep Beep.SYS Wed Oct 20 18:18:59 1999 (380E3FD3)
eba06000 eba06f80 mnmdd mnmdd.SYS Sat Sep 25 14:37:40 1999 (37ED1674)
eba3c000 eba3cf80 dump_WMILIB dump_WMILIB.SYS Sat Sep 25 14:36:47 1999 (37ED163F)

Unloaded modules:
eb550000 eb559000 redbook.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
eb798000 eb79d000 Cdaudio.SYS
Timestamp: unavailable (00000000)
Checksum: 00000000
eb788000 eb78f000 cdrom.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
eb8c0000 eb8c3000 Sfloppy.SYS
Timestamp: unavailable (00000000)
Checksum: 00000000

 

[MJoannides]

Hey cpc2004,
Thanks for your help this far. I wanted to give you an update. My computer has been up and running okay for a day so far. I ran the extended tests from my Dell diag. Cd and every component came back ok. I called Dell support and they felt this was a software issue.
Anyway, I updated my video driver because I hadn't done that yet since I flashed the BIOS. So far I have been okay.
I still don't know what caused the error in the first place. If you get a chance to look through my previous logs and you see anything I would still like to know. Thanks again!
This is a great and informative forum site. I'll be checking back here again