BSOD/random restart

[ev0l]

I know a little about computers and have tried working this out. I think there is a problem w/ a driver on my system, but I could be completely wrong.

My last step led me to using verifier.exe (driver verifier) Which is a program that I am not familiar with in the least. I was going for enabling special pool, but descided against doing anything without consulting someone of higher knowledge.

If someone could please tell me what logs I need to post in order to get help I'd be very greatful.

 

[greenflash]

Welcome ev0l

Main problem is : You are getting randomly BSODs and dont know what to do.Right?

First of all i suggest you attach all minidump files in ur C:\WINDOWS\Minidump folder

Add them into a zip file then post it here.So helpers can review it and tell u what is wrong with ur system.

 

[ev0l]

Thanks

The folder contained quite a few files, therefor I could not upload them all due to the size.

These are the last four arranged by date

 

[cpc2004]

Hi evol,

I've studied your dump and one of your minidump has memory corruption. The culprit is faulty RAM.

DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: ffffffbf, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000000, value 0 = read operation, 1 = write operation
Arg4: f1b123c8, address which referenced memory

Debugging Details:
------------------
OVERLAPPED_MODULE:
READ_ADDRESS: ffffffbf
CURRENT_IRQL: 2

FAULTING_IP:
tcpip!TCPRcv+b7b
f1b123c8 856abf test [edx-0x41],ebp

CUSTOMER_CRASH_COUNT: 2
DEFAULT_BUCKET_ID: CODE_CORRUPTION
BUGCHECK_STR: 0xD1
LAST_CONTROL_TRANSFER: from f1b0fef5 to f1b123c8

STACK_TEXT:
ec4ceb28 f1b0fef5 827d5ab0 6601a8c0 4dde59d1 tcpip!TCPRcv+0xb7b
ec4ceb88 f1b0fb19 00000020 827d5ab0 f1b12076 tcpip!DeliverToUser+0x18e
ec4cec04 f1b0f836 f1b4f3f0 827d5ab0 82b7100e tcpip!DeliverToUserEx+0x95f
ec4cecbc f1b0e922 827d5ab0 82b71022 000005a0 tcpip!IPRcvPacket+0x6cb
ec4cecfc f1b134ad 00000000 ec4ced5c 82b71000 tcpip!ARPRcvIndicationNew+0x149
ec4ced2c f89caad1 82486628 ec4ced5c 82b71000 tcpip!ARPRcv+0x42
WARNING: Stack unwind information not available. Following frames may be wrong.
ec4ced74 f89cae33 ec4ced98 00b71000 000005c2 Teefer+0xaad1
f89dd668 335151ec 0c4539c0 0a50850f 6a500000 Teefer+0xae33
8b55ff8b 00000000 00000000 00000000 00000000 0x335151ec

CHKIMG_EXTENSION: !chkimg -lo 50 -d !tcpip
f1b123c0 - tcpip!TCPRcv+b73
[ 0b:7f ]
f1b123c2-f1b123c7 6 bytes - tcpip!TCPRcv+b75 (+0x02)
[ 3b c3 89 4e 78 0f:7b cf 8b de 79 cf ]
f1b123ca-f1b123cc 3 bytes - tcpip!TCPRcv+b7d (+0x08)
[ 3f 00 00:bf a6 f1 ]
f1b123ce-f1b123cf 2 bytes - tcpip!TCPRcv+b94 (+0x04)
[ 86 5e:ff 5f ]
12 errors : !tcpip (f1b123c0-f1b123cf)

MODULE_NAME: memory_corruption
IMAGE_NAME: memory_corruption
FOLLOWUP_NAME: memory_corruption
DEBUG_FLR_IMAGE_TIMESTAMP: 0
MEMORY_CORRUPTOR: LARGE
STACK_COMMAND: kb
FAILURE_BUCKET_ID: MEMORY_CORRUPTION_LARGE
BUCKET_ID: MEMORY_CORRUPTION_LARGE
Followup: memory_corruption

 

[h-tech]

Hey, just so us future members know and can be more effective in helping others fight the good fight, how do you read these mini dump files with the .dmp extension? I have attempted to open one mini dump file on my own machine using notepad and all I got was a lot of garbage. Very little could be understood.

Thanks.

 

[cpc2004]

Download Debugging Tools from Microsoft and use kd to analyse your minidumps
1) Create folder c:\symbols
2) Download and install the http://www.microsoft.com/whdc/devtools/debugging/installx86.mspx
3) Locate your latest memory.dmp file- C:\WINDOWS\ Minidump\Mini011005-01.dmp or whatever
4) open a CMD prompt and cd\program files\debugging tools for windows\
5) type the following stuff:

Code:
c:\program files\debugging tools>kd -z C:\WINDOWS\Minidump\Mini011005-01.dmp
kd> .logopen c:\debuglog.txt
kd> .sympath srv*c:\symbols*http://msdl.microsoft.com/download/symbols
kd> .reload;!analyze -v;r;kv;lmnt;.logclose;q

 

[ev0l]

thanks for the info

i had an idea it was either the memory or powersupply.

i need to upgrade anyway, but untill then i'll just pull out the stick i'm thinking it probably is.

again thankyou for your time and suggestion

 

[Tatia]

BSOD - bad_pool_caller - 7 times since April 2005

Hello everyone – I found this post and I have experienced similar errors, latest: bad_pool_caller 0x000000C2, 0x00000007, 0x00000CD4, 0x02100010, 0x84EC8C38.

I have experienced BSOD 7 times since April 2005 and I would really appreciate any feedback on these 3 x minidumps as uploaded. What might be causing these BSOD's?! Perhaps someone would be kind to read all the minidumps like cpc2004 did and let me have the answer!? I am running XP, 1GB RAM.

Your prompt co-operation is much appreciated, I am working a few good hours tonight… Thanks in advance, kind regards

Tatia

 

[ev0l]

i found the problem in my case to be faulty memory, and upon inspection i found which stick it was. since the removal of the stick i have had no bsod so far, tho it has only been a short while. I am not experienced at reading minidump files, tho i plan to become so. i'm sure someone will have a look and help you out. good luck

 

[cpc2004]

Hello everyone – I found this post and I have experienced similar errors, latest: bad_pool_caller 0x000000C2, 0x00000007, 0x00000CD4, 0x02100010, 0x84EC8C38.

I have experienced BSOD 7 times since April 2005 and I would really appreciate any feedback on these 3 x minidumps as uploaded. What might be causing these BSOD's?! Perhaps someone would be kind to read all the minidumps like cpc2004 did and let me have the answer!? I am running XP, 1GB RAM.

Your prompt co-operation is much appreciated, I am working a few good hours tonight… Thanks in advance, kind regards

Tatia

Hi Titia

Your PC had 7 crashes since April and it is acceptable. You don't have to anything. After investigation of your minidump, probably it is faulty ram. Attach more minidumps here if you want to me to confirm.

 

[Tatia]

BSOD - bad_pool_caller - 7 times since April 2005, please help... thanks

Hello and many thanks for your replies – much appreciated! Though very helpful, I would love to hear comments from other people as well…

The BSOD’s does worry me, as when it has happened, I am always in the middle of something important and I loose all my settings and it takes a long time to reboot etc. I suspected bad RAM and although I bought Toshiba recommended 512 RAM, I would like to address this problem with them. I have uploaded 2 other minidump files with this post and if anyone is clever enough to read them and extract the information I will need to send to Toshiba to complain, that would be very helpful!

Thanks in advance – kind regards

Tatia

 

[leevh]

Hi evol,

I've studied your dump and one of your minidump has memory corruption. The culprit is faulty RAM.

...

Hello, I was just wondering if I also have 1 minidump out of about 8 that says memory corruption, does that mean there is a high chance that faulty RAM is to blame?

Other "IMAGE_NAME" culprits included various windows OS drivers and 1 that blamed "hardware".

I attached some minidumps incase anyone is bored and curious, but if there is a good chance its ram, or hardware related thats all I need to know. (its for a friends laptop which has warranty)

Thanks!!

EDIT** - other symptoms include freezing during windows startup screen, freezing in safe mode, BSOD stop errors AND hangups and after a BSOD restart, the post screen beeps at me saying "resource conflict: PCI network controller in slot 03 BUS:02 DEVICE:02 FUNCTION:00" but it only complains of this after a BSOD restart. It usually hangs within 2-20 mins of use, and many times wont even make it into windows before freezing.

 

[cpc2004]

Hi Leevh,

I've investigate your minidumps and I believe that it is faulty ram.

Suggestion
1. Reseat the memory stick to another memory slot
2. Clean up the dust with computer case
3. Downclock the ram

If it still crashes
1. Diagnostic which ram is faulty.
2. Take out one memory stick if you have more than one, If your windows does not crash or freeze, the remove memory stick is faulty.

 

[leevh]

Wow, thanks for the quick response cpc2004! I'm not sure I'll be able to get at the RAM since its a laptop, but it gives us a good reason to take it in for replacement! :grinthumb

thanks again for your help, it is very much appreciated

Lee

 

[davidc]

Since I upgraded Zone Alarm to the latest version I've had 3 bsod in the last 2 days. As this was the only change that I'd made to my (otherwise stable) system I presumed that ZA was the culprit but I've had another bsod after uninstalling the program.

It could be corrupt memory but I've run memtest (for a short time) with no errors.

Perhaps you could look at my comp minidump also.

Thanks in advance.

 

[cpc2004]

Davidc,

From your minidump, I find the footprint of ZoneAlarm in the stack trace and you do not de-install ZoneAlarm. Your Windows' problem may be related to ZA.

KERNEL_MODE_EXCEPTION_NOT_HANDLED_M (1000008e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003. This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG. This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG. This will let us see why this breakpoint is
happening.
Arguments:
Arg1: c0000005, The exception code that was not handled
Arg2: 8054a832, The address that the exception occurred at
Arg3: f50b6c3c, Trap Frame
Arg4: 00000000

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - "0x%08lx"

FAULTING_IP:
nt!ExFreePoolWithTag+237
8054a832 668b4efa mov cx,[esi-0x6]

TRAP_FRAME: f50b6c3c -- (.trap fffffffff50b6c3c)
Unable to read trap frame at f50b6c3c

CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: DRIVER_FAULT
BUGCHECK_STR: 0x8E
LAST_CONTROL_TRANSFER: from 8054b0b9 to 8054a832

STACK_TEXT:
f50b6ce4 8054b0b9 0000006e 00000000 f50b6d44 nt!ExFreePoolWithTag+0x237
f50b6cf4 f6b38410 0000006e 01f9ee94 f6b0d899 nt!ExFreePool+0xf
WARNING: Stack unwind information not available. Following frames may be wrong.
f50b6d44 804de7ec 01f9eed8 00010080 01f9ee94 vsdatant+0x43410 <- ZoneAlarm
f50b6d44 7c90eb94 01f9eed8 00010080 01f9ee94 nt!KiFastCallEntry+0xf8
01f9eee0 00000000 00000000 00000000 00000000 0x7c90eb94

 

[davidc]

Thanks for the reply, cpc2004.

You are right - i hadn't uninstalled ZA when the minidump I posted was recorded.

I have since then completely uninstalled ZA using the instructions posted here: http://forum.zonelabs.org/zonelabs/...ssage.id=36102&view=by_date_descending&page=3

To test the memory I ran Memtest86 which ran for 5h 35m with 21 complete passes and no errors before I stopped it. I have also restored optimised defaults in order to try and achieve stability, where previously I had been running the (Corsair) memory hot @ 3.2v which may have contributed to the problem.

All the bsod that I had where stop messages beginning 0x00000008e but there was no reference made to any driver or device which may have caused the exception.

If I have any more bsod I will post here with more detail.

Thanks for your help.

 

[davidc]

Hi cpc2004.

Had another bsod yesterday - details below along with minidump.

STOP 0X00000024 (0X001902FE, 0XF8C20904, 0XF8C2D600, 0XF862E98F).

NFTS.SYS - ADDRESS F862E98F BASE AT F860C000, DATE STAMP 41107EEA

If you get a chance please have a look at the minidump and see if there is anything there that I can deal with.

Much appreciated.

 

[stormchaser2300]

I have something like this going on as well.
A couple of my drivers, like the wireless card and sound card may be in a complete mess right now, so I hope a clean install of XP will fix it.
Just please let me know if it's faulty hardware, my comp is still under warranty.

0X000000C2 ( 0X00000007, 0X00000CD4, 0X024C0054, 0X856F86D8)

 

[ev0l]

just an update, memory was the final culprit, and i have not bsod'd since buying a new stick. i had three, which were all curupt as opossed to my previous thoughts of only one being so. my motherboard burned up awhile back, guess it fried the memory too.

 

[cpc2004]

Hi evol,

Great! Your problem is resolved. Let me know if you need furher help.

 

[Kobal]

Hello!

I'm getting BSoDs too. It says BAD_POOL_CALLER (aka. 0xc2 or 0x000000c2).
In full form it look like this: *** STOP: 0x000000c2 (0x00000007, 0x00000cd4, 0x02060002, 0x86180c38)

I have Googled for couple of days now and found lots of information regading this, but somehow I've not been able to resolve this prob. I tried to look at my minidumps, but the windows debugger said that it should be opened with another program, which I couldn't find.

I'm running WS XP (SP2), 1GB RAM

If someone could look at my minidump too, I'd be very happy!

The problem might be with my memory stick. I'm going to get it off and clean the dust and place it back and see if it works.

 

[peterdiva]

Probably caused by KERNEL1.EXE. I can see that you've got StyleXP installed, and this looks to belong to the boot splashscreen. The obvious thing to do is to uninstall StyleXP, although you may be able to remove it from the boot.ini file.

 

[Kobal]

Probably caused by KERNEL1.EXE. I can see that you've got StyleXP installed, and this looks to belong to the boot splashscreen. The obvious thing to do is to uninstall StyleXP, although you may be able to remove it from the boot.ini file.

Oh, ok. I'll keep that on mind.
I blew away some dust from the memory stick and I haven't got any bluescreens in 3 hours. I'm very lucky if it was so easy to resolve this time...
Thanks anyway.

 

[caravel]

Before changing supposedly faulty memory modules for new ones, it can be a good idea to check the timings/refresh, and see if the module runs ok at 2T instead of 1T. Some cheaper memory simply won't run at 1T without causing BSoDs. If, after setting it the most failsafe settings possible, it still won't run without BSoDs then it goes in the bin.