Can anybody help me in analyzing this?

[mms]

Hi CPC2004,


I have been struggling with this BSOD problem for long. I work from home and am not able to part with this computer to send it to "emachines" for a diagnosis.

I have tried all the things possible, like reformatting the system, loading the drivers etc. I tried the speedfan utility. Itshows normal results. Yesterday, I changed thepower supply too. I did not have reboots from yesterday night to today afternoon. I thought the power supply fixed the issue. But, no... The problem persists. It only reduced the frequency
of the reboots.

Frankly, I am tired, sad and exhausted. I am not good at reading with debugging thing. But, I am pasting what it showed. Can you please go through it and point out the error?

It will a great christmas gift for me if somebody could solve my problem.

Thanks.





Microsoft (R) Windows Debugger Version 6.8.0004.0 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\WINDOWS\Minidump\Mini122207-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows XP Kernel Version 2600 (Service Pack 2) MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 2600.xpsp_sp2_qfe.070227-2300
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055c700
Debug session time: Sat Dec 22 12:20:18.921 2007 (GMT-6)
System Uptime: 0 days 2:26:40.610
Loading Kernel Symbols
...............................................................................................................................................................................
Loading User Symbols
Loading unloaded module list
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1000008E, {c0000005, bf80114f, f6fc46b8, 0}



Probably caused by : win32k.sys ( win32k!ThreadUnlock1+14 )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

KERNEL_MODE_EXCEPTION_NOT_HANDLED_M (1000008e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003. This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG. This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG. This will let us see why this breakpoint is
happening.
Arguments:
Arg1: c0000005, The exception code that was not handled
Arg2: bf80114f, The address that the exception occurred at
Arg3: f6fc46b8, Trap Frame
Arg4: 00000000

Debugging Details:
------------------
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx". The memory could not be "%s".

FAULTING_IP:
win32k!ThreadUnlock1+14
bf80114f ff4804 dec dword ptr [eax+4]

TRAP_FRAME: f6fc46b8 -- (.trap 0xfffffffff6fc46b8)
ErrCode = 00000002
eax=4397bf28 ebx=bc6917a8 ecx=f6fc4758 edx=f6fc4c70 esi=e26064f8 edi=bc68bf28
eip=bf80114f esp=f6fc472c ebp=f6fc4790 iopl=0 nv up ei pl nz na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010206
win32k!ThreadUnlock1+0x14:
bf80114f ff4804 dec dword ptr [eax+4] ds:0023:4397bf2c=????????
Resetting default scope
CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: 0x8E

PROCESS_NAME: UdaterUI.exe

LAST_CONTROL_TRANSFER: from bf83f323 to bf80114f

STACK_TEXT:
f6fc4728 bf83f323 0012f6e4 f6fc47e8 bf8f64fd win32k!ThreadUnlock1+0x14
f6fc4790 bf8f648b 0368bf28 00000000 00000001 win32k!xxxCallHook2+0x2cc
f6fc47ac bf8e32dc 00000000 00000001 00000002 win32k!xxxCallNextHookEx+0x2d
f6fc4800 bf8f6408 00000003 00000000 00000001 win32k!NtUserfnHkINLPMSG+0x3a
f6fc481c 805409ac 00000000 00000001 0012f6c8 win32k!NtUserCallNextHookEx+0xa5
f6fc481c 7c90eb94 00000000 00000001 0012f6c8 nt!KiFastCallEntry+0xfc
WARNING: Frame IP not in any known module. Following frames may be wrong.
0012f5e8 00000000 00000000 00000000 00000000 0x7c90eb94


STACK_COMMAND: kb

FOLLOWUP_IP:
win32k!ThreadUnlock1+14
bf80114f ff4804 dec dword ptr [eax+4]

SYMBOL_STACK_INDEX: 0

SYMBOL_NAME: win32k!ThreadUnlock1+14

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: win32k

IMAGE_NAME: win32k.sys

DEBUG_FLR_IMAGE_TIMESTAMP: 45f013f6

FAILURE_BUCKET_ID: 0x8E_win32k!ThreadUnlock1+14

BUCKET_ID: 0x8E_win32k!ThreadUnlock1+14

Followup: MachineOwner
---------

 

[kirock]

It's your McAfree av program. Uninstall it and go get AVG 7.5. It's free and is better then McAfree.

 

[mms]

Hi

Thanks. Do you say this because it file is pointing to UdaterUI.exe?

In that case, I would also like to paste one (or two more files)



File 1:

Microsoft (R) Windows Debugger Version 6.8.0004.0 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\WINDOWS\Minidump\Mini122007-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows XP Kernel Version 2600 (Service Pack 2) MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 2600.xpsp_sp2_qfe.070227-2300
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055c700
Debug session time: Thu Dec 20 23:48:09.890 2007 (GMT-6)
System Uptime: 0 days 1:51:27.597
Loading Kernel Symbols
..............................................................................................................................................................................
Loading User Symbols
Loading unloaded module list
.................
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1000008E, {c0000005, 407f0afe, badb5ce4, 0}



Probably caused by : hardware

Followup: MachineOwner
---------
*** Possible invalid call from bf803782 ( win32k!NtUserWaitMessage+0x3 )
*** Expected target bf800aea ( win32k!EnterCrit+0x0 )

1: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

KERNEL_MODE_EXCEPTION_NOT_HANDLED_M (1000008e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003. This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG. This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG. This will let us see why this breakpoint is
happening.
Arguments:
Arg1: c0000005, The exception code that was not handled
Arg2: 407f0afe, The address that the exception occurred at
Arg3: badb5ce4, Trap Frame
Arg4: 00000000

Debugging Details:
------------------




EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx". The memory could not be "%s".

FAULTING_IP:
+407f0afe
407f0afe ?? ???

TRAP_FRAME: badb5ce4 -- (.trap 0xffffffffbadb5ce4)
ErrCode = 00000010
eax=839dd501 ebx=bf80377f ecx=00000000 edx=00000000 esi=085cff58 edi=badb5d64
eip=407f0afe esp=badb5d58 ebp=badb5d64 iopl=0 nv up ei ng nz ac po cy
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010293
407f0afe ?? ???
Resetting default scope

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: 0x8E

PROCESS_NAME: iexplore.exe

LAST_CONTROL_TRANSFER: from bf803787 to 407f0afe

POSSIBLE_INVALID_CONTROL_TRANSFER: from bf803782 to bf800aea

STACK_TEXT:
WARNING: Frame IP not in any known module. Following frames may be wrong.
badb5d54 bf803787 085cff58 805409ac 085cffb4 0x407f0afe
badb5d5c 805409ac 085cffb4 7c90eb94 badb0d00 win32k!NtUserWaitMessage+0x8
badb5d5c 7c90eb94 085cffb4 7c90eb94 badb0d00 nt!KiFastCallEntry+0xfc
085cff4c 7e419418 42f8f324 0731d6b8 00140000 0x7c90eb94
085cffb4 7c80b683 04883a38 0731d6b8 00140000 0x7e419418
085cffec 00000000 42f8e424 0731a440 00000000 0x7c80b683


STACK_COMMAND: .trap 0xffffffffbadb5ce4 ; kb

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: hardware

IMAGE_NAME: hardware

DEBUG_FLR_IMAGE_TIMESTAMP: 0

BUCKET_ID: CPU_CALL_ERROR

Followup: MachineOwner
---------
*** Possible invalid call from bf803782 ( win32k!NtUserWaitMessage+0x3 )
*** Expected target bf800aea ( win32k!EnterCrit+0x0 )




I am posting the second file in the next thread.

 

[mms]

One more file

FILE 2:

Microsoft (R) Windows Debugger Version 6.8.0004.0 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\WINDOWS\Minidump\Mini121907-06.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows XP Kernel Version 2600 (Service Pack 2) MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 2600.xpsp.051011-1528
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055c700
Debug session time: Wed Dec 19 23:14:43.250 2007 (GMT-6)
System Uptime: 0 days 0:39:21.966
Loading Kernel Symbols
.............................................................................................................................................................................
Loading User Symbols
Loading unloaded module list
.............
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1000008E, {c0000005, 407f0c2d, eb84c2b4, 0}



Probably caused by : hardware

Followup: MachineOwner
---------
*** Possible invalid call from bf823d24 ( win32k!NtUserGetForegroundWindow+0x3 )
*** Expected target bf800c19 ( win32k!EnterSharedCrit+0x0 )

0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

KERNEL_MODE_EXCEPTION_NOT_HANDLED_M (1000008e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003. This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG. This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG. This will let us see why this breakpoint is
happening.
Arguments:
Arg1: c0000005, The exception code that was not handled
Arg2: 407f0c2d, The address that the exception occurred at
Arg3: eb84c2b4, Trap Frame
Arg4: 00000000

Debugging Details:
------------------




EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx". The memory could not be "%s".

FAULTING_IP:
+407f0c2d
407f0c2d ?? ???

TRAP_FRAME: eb84c2b4 -- (.trap 0xffffffffeb84c2b4)
ErrCode = 00000010
eax=00000001 ebx=bf823d21 ecx=00000000 edx=00000000 esi=0007fa0c edi=eb84c334
eip=407f0c2d esp=eb84c328 ebp=eb84c334 iopl=0 nv up ei ng nz ac po cy
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010293
407f0c2d ?? ???
Resetting default scope

CUSTOMER_CRASH_COUNT: 6

DEFAULT_BUCKET_ID: COMMON_SYSTEM_FAULT

BUGCHECK_STR: 0x8E

PROCESS_NAME: ctfmon.exe

LAST_CONTROL_TRANSFER: from bf823d29 to 407f0c2d

POSSIBLE_INVALID_CONTROL_TRANSFER: from bf823d24 to bf800c19

STACK_TEXT:
WARNING: Frame IP not in any known module. Following frames may be wrong.
eb84c324 bf823d29 0007fa0c 8054070c 0007fa1c 0x407f0c2d
eb84c32c 8054070c 0007fa1c 7c90eb94 badb0d00 win32k!NtUserGetForegroundWindow+0x8
eb84c32c 7c90eb94 0007fa1c 7c90eb94 badb0d00 nt!KiFastCallEntry+0xfc
0007fa00 77d4be57 5fc1763c 000ac9a8 5fc1ebe1 0x7c90eb94
0007fa1c 7473da7c 000ac9a8 00000654 00000000 0x77d4be57
0007fa58 7473e26e 000ac9a8 0000c0a4 00000000 0x7473da7c
0007fac0 74730ccc 0000c0a4 00000000 00000654 0x7473e26e
0007fae0 74730e3e 00000001 0007fbb8 00030001 0x74730ccc
0007fb1c 77d4eaf2 00000000 00000001 0007fbb8 0x74730e3e
0007fb38 77d4ea9e 00030000 00000001 0007fbb8 0x77d4eaf2
0007fb74 77d4ebf3 0007fba8 0007fbb8 0007fbd4 0x77d4ea9e
0007fb98 7c90eae3 0007fba8 00000030 00030000 0x77d4ebf3
0007fbfc 00a05112 0008022c 00000000 00000001 0x7c90eae3
0007fc44 77d4ea9e 00030000 00000001 0007fcc4 0xa05112
0007fc80 77d4ebf3 0007fcb4 0007fcc4 0007fce0 0x77d4ea9e
0007fca4 7c90eae3 0007fcb4 00000030 00030000 0x77d4ebf3
0007fd0c 77d4ca67 0007fde8 00000000 00000000 0x7c90eae3
0007fd38 00402702 0007fde8 00000000 00000000 0x77d4ca67
0007ffa8 806e4ef2 0007ffe0 0040308a 00401420 0x402702
0007ffa8 00000000 0007ffe0 0040308a 00401420 hal!HalpApcInterrupt+0xc6


STACK_COMMAND: .trap 0xffffffffeb84c2b4 ; kb

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: hardware

IMAGE_NAME: hardware

DEBUG_FLR_IMAGE_TIMESTAMP: 0

BUCKET_ID: CPU_CALL_ERROR

Followup: MachineOwner
---------
*** Possible invalid call from bf823d24 ( win32k!NtUserGetForegroundWindow+0x3 )
*** Expected target bf800c19 ( win32k!EnterSharedCrit+0x0 )



Do you still think the problem is with the Anti-virus? Actually, I don't mind uninstalling it.


Thanks again for the quik reply.

 

[kirock]

Well your 1st debugger above implied IE, so that might be some hardware issue (ram?).
The 2nd one implied Office's alternative user Input TIP.
Go here to see if this resolves the prob. I still recommend uninstalling McAfee and getting AVG7.5 instead, then see what happens.

 

[mms]

Hi, Thanks

Hey, thanks for giving a quick reply. I will try uninstalling the Mcafee.

Meanwhile, I just tried to analyze the dumps. And, this is what I infer. Just my thoughts, may be totally base less. As I told you, I don't know anything about deciphering the dumps.

I tried to see some 6/7 dumps in the same style and found out that each dump file was pointing to a different process like skype, internet explorer, realtek audio control panel, mcafee, etc etc. So, could it be this way? The problem is not of a software, but hardware nature. Each time it reboots, it is just pointing out the currently running process. I may be wrong.

If it is hardware, it is not the powersupply. It is not RAM, because, i already tried changing ram.

One important thing is, why is frequency of reboots less after changing the powersupply? I did upgrade the power supply from 250 watts to 380 watts. Is this a reason?

Though the there is no pattern in reboots, the system is sure to reboot if i am watching a video, doing a voice chat or using Netbeans IDE, visual studio etc. So, does the problem aggravate with the CPU usage? Could it be some heat management problem? if it is not power supply, could it be the FAN? But, the speedfan shows no abnormalities.

It can not be the dust. Because, mine is relatively a new system ,1 yr old and during the process of my trials like changes in ram, power supply, i see that there is no dust inside.

I am confused. But for now, let me try uninstalling the anti-virus.

Thanks for bearing with me.

 

[Blind Dragon]

CPU_CALL_ERROR -> most likely faulty motherboard, video card or PSU

And 2 of the crashes even show hardware as the image name

I would first try stress testing the Video card as that would be an easy way to tell. Also look inside your case that all fans are spinning, make sure your motherboard looks okay also

I really hate telling you this but I think it is hardware related

 

[kirock]

Ok so you have a new 380W PSU (sounds like a pos generic), what's your system specs? cpu, video card, how many HDDs, dvd's etc.

 

[mms]

hi

hm..
Power supply is ruled out now.

Mother board... How do I know if it is ok?

and, how do we do this stress testing for video card?

 

[mms]

Ok.

The PSU which I bought now is Antec 380 Watt (ATX12v v2.2). This was the one I could get with great difficulty which was compatible with my system, emachines. previous power supply was bestec.

System is Emachines T 5212.

CPU : Intel® Pentium® D Processor 805 (dual-core)
(2.66GHz, 533MHz FSB, 2 x 1MB L2 cache

Optical Drives: 16x multiformat dual-layer DVD±RW
(Up to 8.5GB with dual-layer media)
Write max: 16x DVD±R, 6x DVD-RW, 8x DVD+RW, 4x DVD+R DL, 40x CD-R, 24x CD-RW


Video Card: ATI Radeon® Xpress 200 integrated graphics solution
Up to 128MB of shared video memory
PCI-Express® (PCI-E x16)

HDD: 200GB (7200rpm, 2MB cache)

 

[Blind Dragon]

are these errors completely random or is there something that seems to trigger them?

 

[mms]

completely random. Infact, many a times, I see that even when I am away from the system(i.e., when the system is idle), the system goes to a BSOD state.

but, as I said earlier, if I try to watch video, do a voice chat(with no video), or do some programming using Netbeans IDE or Visual Studio etc., the system is sure to reboot within 30 minutes (max).

 

[cpc2004]

BUCKET_ID: CPU_CALL_ERROR is the symptom of hardware error. There have 5 confirmed case CPU_CALL_ERROR were caused by faullty m/b and one confirmed case for faulty CPU.

 

[kirock]

Well it seems like these BSODs could be caused by a faulty cpu (pretty rare though) or is it just overheating (HSF coming loose)(or dried up thermal paste or bad thermal pad). Remove the side of the case and put an external table fan blowing right into the case. This may help a little. If it helps at all (reduced # of bsods) then we might be on the right track.