ntfs.sys PAGE FAULT IN NONPAGE AREA bluescreen

Status
Not open for further replies.
DrWtsn32.exe Errors

Hi cpc,

I'm getting a drwtsn32.exe error whenever I exit Battlefield 2. I attached the minidumps. Any help/info will be greatly appreciated. Thanks!
 
Hi pxlai675,

I've investigate your minidumps and faulty ram is the culprit.

Mini091705-01.dmp D1 (00000000, 00000006, 00000008, 00000000) USBPORT!USBPORT_InterruptService+3d
 
Hi CPC,

Sorry to bother you - have you had a chance to take a look at my minidumps in my previous message? My PC is now crashing while I'm working on it whereas before it was only if it was sitting idle for 15 or so minutes. Any help is greatly appreciated.

Thanks,

Mikey
 
Hi Mikey,

Your problem is very weired. All the system crashes are memory corruption but the overlaid storage is very conistent. I cannot whether it is ram problem or device driver problem. Usually memory corruption is caused by faulty ram. If it is ram problem, the memory corruption must be different at each crash.

PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced. This cannot be protected by try-except,
it must be protected by a Probe. Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: d7c3dd45, memory referenced.
Arg2: 00000001, value 0 = read operation, 1 = write operation.
Arg3: f73bf89d, If non-zero, the instruction address which referenced the bad memory
address.
Arg4: 00000000, (reserved)

Debugging Details:
------------------
Could not read faulting driver name
WRITE_ADDRESS: d7c3dd45

FAULTING_IP:
Ntfs!NtfsDefragFile+8c1
f73bf89d ff8b45bc8b55 dec dword ptr [ebx+0x558bbc45]

MM_INTERNAL_CODE: 0
CUSTOMER_CRASH_COUNT: 18
DEFAULT_BUCKET_ID: CODE_CORRUPTION
BUGCHECK_STR: 0x50
LAST_CONTROL_TRANSFER: from f73f3a2a to f73bf89d

STACK_TEXT:
f1d74afc f73f3a2a 81eb40f0 82077008 f1d74b40 Ntfs!NtfsDefragFile+0x8c1
f1d74b10 f73da859 81eb40f0 82077008 f1d74b40 Ntfs!NtfsUserFsRequest+0x198
f1d74b24 f73da7b3 81eb40f0 82077008 804e91a1 Ntfs!NtfsCommonFileSystemControl+0x44
f1d74b98 804e3d77 82382020 82077008 823656c0 Ntfs!NtfsFsdFileSystemControl+0x116
f1d74ba8 f7456ee5 82340908 f1c47e5c f1d74be0 nt!IopfCallDriver+0x31
f1d74bb8 804e3d77 823656c0 82077008 f1d74c14 sr!SrFsControl+0x121
f1d74bc8 f1c3e18b 00000000 f1d74c14 00000000 nt!IopfCallDriver+0x31
WARNING: Stack unwind information not available. Following frames may be wrong.
f1d74be0 f1c40e72 82365608 8216fce8 f1d74c14 SYMEVENT+0x118b
f1d74c34 804e3d77 81efe348 82077008 806ee2d0 SYMEVENT+0x3e72
f1d74c44 8056a9ab 820771bc 8228f0a8 82077008 nt!IopfCallDriver+0x31
f1d74c58 8057d9f7 81efe348 82077008 8228f0a8 nt!IopSynchronousServiceTail+0x60
f1d74d00 8057da37 00000148 00000000 00000000 nt!IopXxxControlFile+0x611
f1d74d34 804df06b 00000148 00000000 00000000 nt!NtFsControlFile+0x2a
f1d74d34 7c90eb94 00000148 00000000 00000000 nt!KiFastCallEntry+0xf8
00c1eda8 00000000 00000000 00000000 00000000 0x7c90eb94

CHKIMG_EXTENSION: !chkimg -lo 50 -db !Ntfs
24 errors : !Ntfs (f73bf828-f73bffd8)
f73bf820 40 24 13 c2 89 8d 00 ff *f7 ff 89 85 04 ff ff ff @$.................
f73bf880 fe ff 8b 45 98 8b 4d 0c *81 41 04 0f be 83 18 01 ...E..M..A.........
f73bf8f0 18 01 00 00 89 85 2c ff *f7 ff 8b 47 10 89 85 f0 ......,....G.......
f73bf920 c2 d3 e0 89 95 bc fe ff *f7 89 85 b8 fe ff ff 6a ...............j...
f73bf940 fe ff 56 e8 44 e5 fe ff *83 46 28 8b 40 0c 85 c0 ..V.D....F(.@......
f73bf970 6a 00 50 56 e8 cb 28 ff *f7 8b 45 0c 83 60 1c 00 j.PV..(...E..`.....
f73bf9a0 ff 75 ac ff 75 a8 51 50 *f7 75 ac ff 75 a8 51 50 .u..u.QP.u..u.QP...
f73bfaa0 90 90 83 7d d8 00 74 16 *f7 75 d8 ff 75 98 e8 91 ...}..t..u..u......
f73bfb40 00 00 00 ff 75 c4 ff 75 *04 56 e8 69 db fe ff 8b ....u..u.V.i.......
f73bfbb0 0d 00 00 c0 57 ff 75 0c *e3 1a 8b 5d 0c 8b 4d d4 ....W.u....]..M....
f73bfcd0 5d d0 8b 45 28 89 45 d4 *81 5d d8 8d 45 c0 50 6a ]..E(.E..]..E.Pj...
f73bfd50 90 90 90 90 90 8b ff 55 *83 ec 51 51 53 56 8b 75 .......U..QQSV.u...
f73bfda0 10 ff 75 08 e8 28 5e ff *f7 80 7e 26 00 8b 1e 74 ..u..(^...~&...t...
f73bfdc0 89 45 20 76 47 89 45 0c *83 46 18 03 45 0c 8b 55 .E vG.E..F..E..U...
f73bfde0 4d fc ff 70 14 8b 48 10 *85 45 f8 50 8d 04 19 50 M..p..H..E.P...P...
f73bfe90 23 45 14 89 45 b0 0f 84 *35 01 00 00 8b 87 18 01 #E..E...5.......
f73bfea0 00 00 89 85 7c ff ff ff *83 8d 7c ff ff ff 8b 45 ....|.....|....E...
f73bfed0 51 52 50 ff 75 10 ff 75 *00 e8 88 dc fe ff 88 45 QRP.u..u.......E...
f73bfef0 23 8b 4d d0 8b 55 b0 2b *c2 33 c0 8b 75 e4 8d 3c #.M..U.+.3..u..<
f73bff00 32 8b d1 c1 e9 02 f3 ab *83 ca 83 e1 03 f3 aa e9 2..................
f73bff90 18 00 0f 8c e2 01 00 00 *83 45 d0 8b 55 b0 2b c2 .........E..U.+.
f73bffa0 39 45 1c 73 03 8b 45 1c *81 45 a8 8b c8 8b 75 e4 9E.s..E..E....u.
f73bffb0 03 f2 8b 7d d4 8b d1 c1 *e1 02 f3 a5 8b ca 83 e1 ...}...............
f73bffd0 01 00 00 8b 7d a4 8b 75 *94 8b c6 23 45 1c 89 45 ....}..u...#E..E

MODULE_NAME: memory_corruption
IMAGE_NAME: memory_corruption
FOLLOWUP_NAME: memory_corruption
DEBUG_FLR_IMAGE_TIMESTAMP: 0
MEMORY_CORRUPTOR: STRIDE
STACK_COMMAND: kb
FAILURE_BUCKET_ID: MEMORY_CORRUPTION_STRIDE
BUCKET_ID: MEMORY_CORRUPTION_STRIDE
 
@cpc2004

Hi there.
When you analyze all these dumps, do you use DumpCheck (dumpchk.exe)? If so, what parameters do you use?

Thank you.

:EDIT
Added some minidump's in case you want to help me and got some time to spare.
 

Attachments

  • minidumps_d-skott.zip
    98 KB · Views: 7
Another BSOD w/ ntfs.sys

I've got a computer that's been randomly restarting, having the screen go black, and today it finally blue screened. I can't seem to force the error, but i'm attaching the minidump so if anyone can figure it out, i'd be very greatful.

I tried to do the analysis myself using the debug tools, but i don't understand the output...

thanks in advance. :)

*EDIT*
Thinking about it, the debuglog.txt file that someone else would generate is probably the same...so here it is...(i had to chop some of it; hope it isn't relvant) i'll attach the file too...

Code:
Opened log file 'c:\debuglog.txt'
kd> .sympath srv*c:\symbols*http://msdl.microsoft.com/download/symbols
Symbol search path is: srv*c:\symbols*http://msdl.microsoft.com/download/symbols
kd> .reload;!analyze -v;r;kv;lmnt;.logclose;q
Loading Kernel Symbols
....................................................................................................................
Loading unloaded module list
........
Loading User Symbols
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced.  This cannot be protected by try-except,
it must be protected by a Probe.  Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: 8d7c071d, memory referenced.
Arg2: 00000000, value 0 = read operation, 1 = write operation.
Arg3: f7569514, If non-zero, the instruction address which referenced the bad memory
	address.
Arg4: 00000000, (reserved)

Debugging Details:
------------------


Could not read faulting driver name
Unable to load image SYMEVENT.SYS, Win32 error 2
*** WARNING: Unable to verify timestamp for SYMEVENT.SYS
*** ERROR: Module load completed but symbols could not be loaded for SYMEVENT.SYS

READ_ADDRESS:  8d7c071d 

FAULTING_IP: 
Ntfs!NtfsCreateLcb+5b
f7569514 3b4810           cmp     ecx,[eax+0x10]

MM_INTERNAL_CODE:  0

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  DRIVER_FAULT

BUGCHECK_STR:  0x50

LAST_CONTROL_TRANSFER:  from f756eaff to f7569514

STACK_TEXT:  
f3bf34e0 f756eaff f3bf3840 e1699540 e16e73d0 Ntfs!NtfsCreateLcb+0x5b
f3bf35c4 f756edef f3bf3840 822cebd8 822ced8c Ntfs!NtfsOpenFile+0x449
f3bf381c f7560f72 f3bf3840 822cebd8 f3bf3970 Ntfs!NtfsCommonCreate+0x134a
f3bf39c8 f75e7f70 822cebd8 f3bf3c00 82bd0020 Ntfs!NtfsNetworkOpenCreate+0x8a
f3bf39e8 f40540f1 822cebd8 f3bf3c00 82bd1aa8 sr!SrFastIoQueryOpen+0x40
WARNING: Stack unwind information not available. Following frames may be wrong.
f3bf3a08 8057150e 822cebd8 f3bf3c00 829085d0 SYMEVENT+0x80f1
f3bf3cc0 82bab030 00000000 00000000 00000000 nt!IopParseDevice+0x95c
f3bf3d54 804de7ec 011cfb4c 011cfb88 011cfb6c 0x82bab030
f3bf3d54 7c90eb94 011cfb4c 011cfb88 011cfb6c nt!KiFastCallEntry+0xf8
011cfb6c 00000000 00000000 00000000 00000000 0x7c90eb94


FOLLOWUP_IP: 
SYMEVENT+80f1
f40540f1 ??               ???

SYMBOL_STACK_INDEX:  5

FOLLOWUP_NAME:  MachineOwner

SYMBOL_NAME:  SYMEVENT+80f1

MODULE_NAME:  SYMEVENT

IMAGE_NAME:  SYMEVENT.SYS

DEBUG_FLR_IMAGE_TIMESTAMP:  42ddb287

STACK_COMMAND:  kb

FAILURE_BUCKET_ID:  0x50_SYMEVENT+80f1

BUCKET_ID:  0x50_SYMEVENT+80f1

Followup: MachineOwner
---------

eax=8d7c070d ebx=f3bf34c6 ecx=e1699540 edx=01c5bc27 esi=e16e7648 edi=00000000
eip=f7569514 esp=f3bf348c ebp=f3bf34e0 iopl=0         nv up ei ng nz na pe nc
cs=0008  ss=0010  ds=0023  es=0023  fs=0030  gs=0000             efl=00010282
Ntfs!NtfsCreateLcb+0x5b:
f7569514 3b4810           cmp     ecx,[eax+0x10]    ds:0023:8d7c071d=????????
ChildEBP RetAddr  Args to Child              
f3bf34e0 f756eaff f3bf3840 e1699540 e16e73d0 Ntfs!NtfsCreateLcb+0x5b (FPO: [Non-Fpo])
f3bf35c4 f756edef f3bf3840 822cebd8 822ced8c Ntfs!NtfsOpenFile+0x449 (FPO: [Non-Fpo])
f3bf381c f7560f72 f3bf3840 822cebd8 f3bf3970 Ntfs!NtfsCommonCreate+0x134a (FPO: [Non-Fpo])
f3bf39c8 f75e7f70 822cebd8 f3bf3c00 82bd0020 Ntfs!NtfsNetworkOpenCreate+0x8a (FPO: [Non-Fpo])
f3bf39e8 f40540f1 822cebd8 f3bf3c00 82bd1aa8 sr!SrFastIoQueryOpen+0x40 (FPO: [Non-Fpo])
WARNING: Stack unwind information not available. Following frames may be wrong.
f3bf3a08 8057150e 822cebd8 f3bf3c00 829085d0 SYMEVENT+0x80f1
f3bf3cc0 82bab030 00000000 00000000 00000000 nt!IopParseDevice+0x95c (FPO: [Non-Fpo])
f3bf3d54 804de7ec 011cfb4c 011cfb88 011cfb6c 0x82bab030
f3bf3d54 7c90eb94 011cfb4c 011cfb88 011cfb6c nt!KiFastCallEntry+0xf8 (FPO: [0,0] TrapFrame @ f3bf3d64)
011cfb6c 00000000 00000000 00000000 00000000 0x7c90eb94
start    end        module name
804d7000 806eb100   nt       ntoskrnl.exe Tue Mar 01 16:59:37 2005 (42250FF9)
806ec000 806ffd80   hal      halacpi.dll  Tue Aug 03 22:59:04 2004 (41107B28)
bf000000 bf011580   dxg      dxg.sys      Tue Aug 03 23:00:51 2004 (41107B93)
bf012000 bf425a80   nv4_disp nv4_disp.dll Wed Aug 04 00:57:11 2004 (411096D7)
bf800000 bf9c0500   win32k   win32k.sys   Tue Mar 01 17:06:42 2005 (422511A2)
f2b50000 f2b79f00   kmixer   kmixer.sys   Tue Aug 03 23:07:46 2004 (41107D32)
f2cba000 f2cdd000   Fastfat  Fastfat.SYS  Tue Aug 03 23:14:15 2004 (41107EB7)
f2d2d000 f2d3e980   NAVENG   NAVENG.Sys   Mon Jul 25 15:14:25 2005 (42E56441)
f2d3f000 f2de0260   NavEx15  NavEx15.Sys  Mon Jul 25 15:31:29 2005 (42E56841)
f2de1000 f2e39000   SAVRT    SAVRT.SYS    Mon Mar 07 14:49:41 2005 (422CDA85)
f2f01000 f2f41100   HTTP     HTTP.sys     Fri Oct 08 16:48:20 2004 (41672744)
f328a000 f32db300   srv      srv.sys      Mon May 09 17:17:49 2005 (427FFDAD)
f3304000 f3330400   mrxdav   mrxdav.sys   Tue Aug 03 23:00:49 2004 (41107B91)
f380e000 f3822400   wdmaud   wdmaud.sys   Tue Aug 03 23:15:03 2004 (41107EE7)
f39eb000 f39f9d80   sysaudio sysaudio.sys Tue Aug 03 23:15:54 2004 (41107F1A)
f3a7b000 f3aaa420   symidsco symidsco.sys Mon Aug 29 15:37:52 2005 (43138E40)
f3aab000 f3ad3dc0   SYMFW    SYMFW.SYS    Tue Apr 05 11:11:07 2005 (4252D4BB)
f3bc8000 f3bcaf60   SYMREDRV SYMREDRV.SYS Tue Apr 05 11:11:10 2005 (4252D4BE)
f3c50000 f3c53280   ndisuio  ndisuio.sys  Tue Aug 03 23:03:10 2004 (41107C1E)
f3ef4000 f3f0b480   dump_atapi dump_atapi.sys Tue Aug 03 22:59:41 2004 (41107B4D)
f3f34000 f3f54f00   ipnat    ipnat.sys    Wed Sep 29 15:28:36 2004 (415B3714)
f3f55000 f3fc3400   mrxsmb   mrxsmb.sys   Tue Jan 18 20:26:50 2005 (41EDE18A)
f3fc4000 f3feea00   rdbss    rdbss.sys    Wed Oct 27 18:13:57 2004 (418047D5)
f3fef000 f4002000   SAVRTPEL SAVRTPEL.SYS Mon Mar 07 14:49:43 2005 (422CDA87)
f4002000 f4023d00   afd      afd.sys      Tue Aug 03 23:14:13 2004 (41107EB5)
f4024000 f404bc00   netbt    netbt.sys    Tue Aug 03 23:14:36 2004 (41107ECC)
f404c000 f4068cc0   SYMEVENT SYMEVENT.SYS Tue Jul 19 19:10:15 2005 (42DDB287)
f4069000 f40a8ce0   SYMTDI   SYMTDI.SYS   Tue Apr 05 11:10:52 2005 (4252D4AC)
f40a9000 f4100d80   tcpip    tcpip.sys    Wed May 25 12:04:00 2005 (4294CC20)
f4101000 f4113400   ipsec    ipsec.sys    Tue Aug 03 23:14:27 2004 (41107EC3)
f615c000 f615e900   Dxapi    Dxapi.sys    Fri Aug 17 13:53:19 2001 (3B7D843F)
f6184000 f61b7200   update   update.sys   Tue Aug 03 22:58:32 2004 (41107B08)
f6918000 f6928e00   psched   psched.sys   Tue Aug 03 23:04:16 2004 (41107C60)
f6929000 f693f680   ndiswan  ndiswan.sys  Tue Aug 03 23:14:30 2004 (41107EC6)
f6940000 f6953900   parport  parport.sys  Tue Aug 03 22:59:04 2004 (41107B28)
f6985000 f6a1fae0   ltmdmnt  ltmdmnt.sys  Fri Dec 12 15:03:08 2003 (3FDA492C)
f6a20000 f6a33780   VIDEOPRT VIDEOPRT.SYS Tue Aug 03 23:07:04 2004 (41107D08)
f6a34000 f6c033c0   nv4_mini nv4_mini.sys Wed Apr 07 19:30:48 2004 (4074B958)
f6c04000 f6c27980   portcls  portcls.sys  Tue Aug 03 23:15:47 2004 (41107F13)
f6c28000 f6c84d80   sis7018  sis7018.sys  Fri Jul 12 00:32:39 2002 (3D2E8617)
f6c85000 f6ca7e80   USBPORT  USBPORT.SYS  Tue Aug 03 23:08:34 2004 (41107D62)
f6ca8000 f6cca680   ks       ks.sys       Tue Aug 03 23:15:20 2004 (41107EF8)
f6ccb000 f6cd9100   usbhub   usbhub.sys   Tue Aug 03 23:08:40 2004 (41107D68)
f6cdb000 f6ce4480   NDProxy  NDProxy.SYS  Fri Aug 17 13:55:30 2001 (3B7D84C2)
f6ceb000 f6cf4f00   termdd   termdd.sys   Tue Aug 03 22:58:52 2004 (41107B1C)
f6cfb000 f6d03900   msgpc    msgpc.sys    Tue Aug 03 23:04:11 2004 (41107C5B)
f6d0b000 f6d16d00   raspptp  raspptp.sys  Tue Aug 03 23:14:26 2004 (41107EC2)
f6d1b000 f6d25200   raspppoe raspppoe.sys Tue Aug 03 23:05:06 2004 (41107C92)
f6d2b000 f6d37880   rasl2tp  rasl2tp.sys  Tue Aug 03 23:14:21 2004 (41107EBD)
f6d3b000 f6d47e00   i8042prt i8042prt.sys Tue Aug 03 23:14:36 2004 (41107ECC)
f6d4b000 f6d5ad80   serial   serial.sys   Tue Aug 03 23:15:51 2004 (41107F17)
f6d5b000 f6d69b80   drmk     drmk.sys     Tue Aug 03 23:07:54 2004 (41107D3A)
f73d2000 f73d4280   rasacd   rasacd.sys   Fri Aug 17 13:55:39 2001 (3B7D84CB)
f74f4000 f750e580   Mup      Mup.sys      Tue Aug 03 23:15:20 2004 (41107EF8)
f750f000 f753ba80   NDIS     NDIS.sys     Tue Aug 03 23:14:27 2004 (41107EC3)
f753c000 f75c8480   Ntfs     Ntfs.sys     Tue Aug 03 23:15:06 2004 (41107EEA)
f75c9000 f75df780   KSecDD   KSecDD.sys   Tue Aug 03 22:59:45 2004 (41107B51)
f75e0000 f75f1f00   sr       sr.sys       Tue Aug 03 23:06:22 2004 (41107CDE)
f75f2000 f7610780   fltmgr   fltmgr.sys   Tue Aug 03 23:01:17 2004 (41107BAD)
f7611000 f7628480   atapi    atapi.sys    Tue Aug 03 22:59:41 2004 (41107B4D)

...
*snipped to fit post size*

Closing open log file c:\debuglog.txt
 
Same ish problem

Hey people,

Just joined after reading through this thread, a lot of helpfull info thought still getting a similar fault. Hope someone can help!

This is a customers pc - Spec

Processor - Celeron 1.2
M/board - QDI ADV6TL
128MB RAM
Onboard video and sound
O/S - Windows 2000

THey are complaingin about a very weird fault that the system reboots itself after the first cold boot of the day(in the morning) thern after that it works fine. Though after having a look at it in our workshop it has started rebooting itself just after u have logged in getting the BSOD - Page fault in a non-paged area.

Here is what I have tried already:

Reaseating the memory in same slot - no joy
Reseating the processor - no joy
Using slot 2 for the memory(same stick) - no joy
Using 2nd hand testing memory - no joy in 1st + 2nd slots
Using brand new stuff - slot 1 - seamed to work ok then bam reboots
same in slot 2 /\

Also crashed while Ghosting onto a backup hard disk

Just about to try a new processor in it though any help would be greatly appriciated

Cheers

Andy

have attached the 3 mini dumps that were in the folder
 
Hi, I'm just about to purchase 2x256mb memory for my laptop, but before I shell out. Can someone check my minidump (attached) and tell me if faulty RAM is my problem? My laptop has really bad battery life so I plug it into the mains and use it but the power adapter always becomes red hot after about 25 minutes and it shuts down and refuses to turn back on? Anyway I can fix this? Thanks, Ed EDIT: I can't attach the dump because it times out or something is there any other way I can attach it?
 
Razorback said:
cpc,
I know you are probably tired of looking at minidumps but I am still trying to determine what my problem. I have done a fresh install and have tried different ram. Tonight I received an IRQL BSOD. I am attaching the minidump. Nothing shows up in the event logger. If you don't mind, please take a look at it and see what you think. Thanks.
Do you have any update of the problem?
 
tfj said:
I've got a computer that's been randomly restarting, having the screen go black, and today it finally blue screened. I can't seem to force the error, but i'm attaching the minidump so if anyone can figure it out, i'd be very greatful.

I tried to do the analysis myself using the debug tools, but i don't understand the output...

thanks in advance. :)

*EDIT*
Thinking about it, the debuglog.txt file that someone else would generate is probably the same...so here it is...(i had to chop some of it; hope it isn't relvant) i'll attach the file too...

Code:
Opened log file 'c:\debuglog.txt'
kd> .sympath srv*c:\symbols*http://msdl.microsoft.com/download/symbols
Symbol search path is: srv*c:\symbols*http://msdl.microsoft.com/download/symbols
kd> .reload;!analyze -v;r;kv;lmnt;.logclose;q
Loading Kernel Symbols
....................................................................................................................
Loading unloaded module list
........
Loading User Symbols
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced.  This cannot be protected by try-except,
it must be protected by a Probe.  Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: 8d7c071d, memory referenced.
Arg2: 00000000, value 0 = read operation, 1 = write operation.
Arg3: f7569514, If non-zero, the instruction address which referenced the bad memory
	address.
Arg4: 00000000, (reserved)

Debugging Details:
------------------


Could not read faulting driver name
Unable to load image SYMEVENT.SYS, Win32 error 2
*** WARNING: Unable to verify timestamp for SYMEVENT.SYS
*** ERROR: Module load completed but symbols could not be loaded for SYMEVENT.SYS

READ_ADDRESS:  8d7c071d 

FAULTING_IP: 
Ntfs!NtfsCreateLcb+5b
f7569514 3b4810           cmp     ecx,[eax+0x10]

MM_INTERNAL_CODE:  0

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  DRIVER_FAULT

BUGCHECK_STR:  0x50

LAST_CONTROL_TRANSFER:  from f756eaff to f7569514

STACK_TEXT:  
f3bf34e0 f756eaff f3bf3840 e1699540 e16e73d0 Ntfs!NtfsCreateLcb+0x5b
f3bf35c4 f756edef f3bf3840 822cebd8 822ced8c Ntfs!NtfsOpenFile+0x449
f3bf381c f7560f72 f3bf3840 822cebd8 f3bf3970 Ntfs!NtfsCommonCreate+0x134a
f3bf39c8 f75e7f70 822cebd8 f3bf3c00 82bd0020 Ntfs!NtfsNetworkOpenCreate+0x8a
f3bf39e8 f40540f1 822cebd8 f3bf3c00 82bd1aa8 sr!SrFastIoQueryOpen+0x40
WARNING: Stack unwind information not available. Following frames may be wrong.
f3bf3a08 8057150e 822cebd8 f3bf3c00 829085d0 SYMEVENT+0x80f1
f3bf3cc0 82bab030 00000000 00000000 00000000 nt!IopParseDevice+0x95c
f3bf3d54 804de7ec 011cfb4c 011cfb88 011cfb6c 0x82bab030
f3bf3d54 7c90eb94 011cfb4c 011cfb88 011cfb6c nt!KiFastCallEntry+0xf8
011cfb6c 00000000 00000000 00000000 00000000 0x7c90eb94


FOLLOWUP_IP: 
SYMEVENT+80f1
f40540f1 ??               ???

SYMBOL_STACK_INDEX:  5

FOLLOWUP_NAME:  MachineOwner

SYMBOL_NAME:  SYMEVENT+80f1

MODULE_NAME:  SYMEVENT

IMAGE_NAME:  SYMEVENT.SYS

DEBUG_FLR_IMAGE_TIMESTAMP:  42ddb287

STACK_COMMAND:  kb

FAILURE_BUCKET_ID:  0x50_SYMEVENT+80f1

BUCKET_ID:  0x50_SYMEVENT+80f1

Followup: MachineOwner
---------

eax=8d7c070d ebx=f3bf34c6 ecx=e1699540 edx=01c5bc27 esi=e16e7648 edi=00000000
eip=f7569514 esp=f3bf348c ebp=f3bf34e0 iopl=0         nv up ei ng nz na pe nc
cs=0008  ss=0010  ds=0023  es=0023  fs=0030  gs=0000             efl=00010282
Ntfs!NtfsCreateLcb+0x5b:
f7569514 3b4810           cmp     ecx,[eax+0x10]    ds:0023:8d7c071d=????????
ChildEBP RetAddr  Args to Child              
f3bf34e0 f756eaff f3bf3840 e1699540 e16e73d0 Ntfs!NtfsCreateLcb+0x5b (FPO: [Non-Fpo])
f3bf35c4 f756edef f3bf3840 822cebd8 822ced8c Ntfs!NtfsOpenFile+0x449 (FPO: [Non-Fpo])
f3bf381c f7560f72 f3bf3840 822cebd8 f3bf3970 Ntfs!NtfsCommonCreate+0x134a (FPO: [Non-Fpo])
f3bf39c8 f75e7f70 822cebd8 f3bf3c00 82bd0020 Ntfs!NtfsNetworkOpenCreate+0x8a (FPO: [Non-Fpo])
f3bf39e8 f40540f1 822cebd8 f3bf3c00 82bd1aa8 sr!SrFastIoQueryOpen+0x40 (FPO: [Non-Fpo])
WARNING: Stack unwind information not available. Following frames may be wrong.
f3bf3a08 8057150e 822cebd8 f3bf3c00 829085d0 SYMEVENT+0x80f1
f3bf3cc0 82bab030 00000000 00000000 00000000 nt!IopParseDevice+0x95c (FPO: [Non-Fpo])
f3bf3d54 804de7ec 011cfb4c 011cfb88 011cfb6c 0x82bab030
f3bf3d54 7c90eb94 011cfb4c 011cfb88 011cfb6c nt!KiFastCallEntry+0xf8 (FPO: [0,0] TrapFrame @ f3bf3d64)
011cfb6c 00000000 00000000 00000000 00000000 0x7c90eb94
start    end        module name
804d7000 806eb100   nt       ntoskrnl.exe Tue Mar 01 16:59:37 2005 (42250FF9)
806ec000 806ffd80   hal      halacpi.dll  Tue Aug 03 22:59:04 2004 (41107B28)
bf000000 bf011580   dxg      dxg.sys      Tue Aug 03 23:00:51 2004 (41107B93)
bf012000 bf425a80   nv4_disp nv4_disp.dll Wed Aug 04 00:57:11 2004 (411096D7)
bf800000 bf9c0500   win32k   win32k.sys   Tue Mar 01 17:06:42 2005 (422511A2)
f2b50000 f2b79f00   kmixer   kmixer.sys   Tue Aug 03 23:07:46 2004 (41107D32)
f2cba000 f2cdd000   Fastfat  Fastfat.SYS  Tue Aug 03 23:14:15 2004 (41107EB7)
f2d2d000 f2d3e980   NAVENG   NAVENG.Sys   Mon Jul 25 15:14:25 2005 (42E56441)
f2d3f000 f2de0260   NavEx15  NavEx15.Sys  Mon Jul 25 15:31:29 2005 (42E56841)
f2de1000 f2e39000   SAVRT    SAVRT.SYS    Mon Mar 07 14:49:41 2005 (422CDA85)
f2f01000 f2f41100   HTTP     HTTP.sys     Fri Oct 08 16:48:20 2004 (41672744)
f328a000 f32db300   srv      srv.sys      Mon May 09 17:17:49 2005 (427FFDAD)
f3304000 f3330400   mrxdav   mrxdav.sys   Tue Aug 03 23:00:49 2004 (41107B91)
f380e000 f3822400   wdmaud   wdmaud.sys   Tue Aug 03 23:15:03 2004 (41107EE7)
f39eb000 f39f9d80   sysaudio sysaudio.sys Tue Aug 03 23:15:54 2004 (41107F1A)
f3a7b000 f3aaa420   symidsco symidsco.sys Mon Aug 29 15:37:52 2005 (43138E40)
f3aab000 f3ad3dc0   SYMFW    SYMFW.SYS    Tue Apr 05 11:11:07 2005 (4252D4BB)
f3bc8000 f3bcaf60   SYMREDRV SYMREDRV.SYS Tue Apr 05 11:11:10 2005 (4252D4BE)
f3c50000 f3c53280   ndisuio  ndisuio.sys  Tue Aug 03 23:03:10 2004 (41107C1E)
f3ef4000 f3f0b480   dump_atapi dump_atapi.sys Tue Aug 03 22:59:41 2004 (41107B4D)
f3f34000 f3f54f00   ipnat    ipnat.sys    Wed Sep 29 15:28:36 2004 (415B3714)
f3f55000 f3fc3400   mrxsmb   mrxsmb.sys   Tue Jan 18 20:26:50 2005 (41EDE18A)
f3fc4000 f3feea00   rdbss    rdbss.sys    Wed Oct 27 18:13:57 2004 (418047D5)
f3fef000 f4002000   SAVRTPEL SAVRTPEL.SYS Mon Mar 07 14:49:43 2005 (422CDA87)
f4002000 f4023d00   afd      afd.sys      Tue Aug 03 23:14:13 2004 (41107EB5)
f4024000 f404bc00   netbt    netbt.sys    Tue Aug 03 23:14:36 2004 (41107ECC)
f404c000 f4068cc0   SYMEVENT SYMEVENT.SYS Tue Jul 19 19:10:15 2005 (42DDB287)
f4069000 f40a8ce0   SYMTDI   SYMTDI.SYS   Tue Apr 05 11:10:52 2005 (4252D4AC)
f40a9000 f4100d80   tcpip    tcpip.sys    Wed May 25 12:04:00 2005 (4294CC20)
f4101000 f4113400   ipsec    ipsec.sys    Tue Aug 03 23:14:27 2004 (41107EC3)
f615c000 f615e900   Dxapi    Dxapi.sys    Fri Aug 17 13:53:19 2001 (3B7D843F)
f6184000 f61b7200   update   update.sys   Tue Aug 03 22:58:32 2004 (41107B08)
f6918000 f6928e00   psched   psched.sys   Tue Aug 03 23:04:16 2004 (41107C60)
f6929000 f693f680   ndiswan  ndiswan.sys  Tue Aug 03 23:14:30 2004 (41107EC6)
f6940000 f6953900   parport  parport.sys  Tue Aug 03 22:59:04 2004 (41107B28)
f6985000 f6a1fae0   ltmdmnt  ltmdmnt.sys  Fri Dec 12 15:03:08 2003 (3FDA492C)
f6a20000 f6a33780   VIDEOPRT VIDEOPRT.SYS Tue Aug 03 23:07:04 2004 (41107D08)
f6a34000 f6c033c0   nv4_mini nv4_mini.sys Wed Apr 07 19:30:48 2004 (4074B958)
f6c04000 f6c27980   portcls  portcls.sys  Tue Aug 03 23:15:47 2004 (41107F13)
f6c28000 f6c84d80   sis7018  sis7018.sys  Fri Jul 12 00:32:39 2002 (3D2E8617)
f6c85000 f6ca7e80   USBPORT  USBPORT.SYS  Tue Aug 03 23:08:34 2004 (41107D62)
f6ca8000 f6cca680   ks       ks.sys       Tue Aug 03 23:15:20 2004 (41107EF8)
f6ccb000 f6cd9100   usbhub   usbhub.sys   Tue Aug 03 23:08:40 2004 (41107D68)
f6cdb000 f6ce4480   NDProxy  NDProxy.SYS  Fri Aug 17 13:55:30 2001 (3B7D84C2)
f6ceb000 f6cf4f00   termdd   termdd.sys   Tue Aug 03 22:58:52 2004 (41107B1C)
f6cfb000 f6d03900   msgpc    msgpc.sys    Tue Aug 03 23:04:11 2004 (41107C5B)
f6d0b000 f6d16d00   raspptp  raspptp.sys  Tue Aug 03 23:14:26 2004 (41107EC2)
f6d1b000 f6d25200   raspppoe raspppoe.sys Tue Aug 03 23:05:06 2004 (41107C92)
f6d2b000 f6d37880   rasl2tp  rasl2tp.sys  Tue Aug 03 23:14:21 2004 (41107EBD)
f6d3b000 f6d47e00   i8042prt i8042prt.sys Tue Aug 03 23:14:36 2004 (41107ECC)
f6d4b000 f6d5ad80   serial   serial.sys   Tue Aug 03 23:15:51 2004 (41107F17)
f6d5b000 f6d69b80   drmk     drmk.sys     Tue Aug 03 23:07:54 2004 (41107D3A)
f73d2000 f73d4280   rasacd   rasacd.sys   Fri Aug 17 13:55:39 2001 (3B7D84CB)
f74f4000 f750e580   Mup      Mup.sys      Tue Aug 03 23:15:20 2004 (41107EF8)
f750f000 f753ba80   NDIS     NDIS.sys     Tue Aug 03 23:14:27 2004 (41107EC3)
f753c000 f75c8480   Ntfs     Ntfs.sys     Tue Aug 03 23:15:06 2004 (41107EEA)
f75c9000 f75df780   KSecDD   KSecDD.sys   Tue Aug 03 22:59:45 2004 (41107B51)
f75e0000 f75f1f00   sr       sr.sys       Tue Aug 03 23:06:22 2004 (41107CDE)
f75f2000 f7610780   fltmgr   fltmgr.sys   Tue Aug 03 23:01:17 2004 (41107BAD)
f7611000 f7628480   atapi    atapi.sys    Tue Aug 03 22:59:41 2004 (41107B4D)

...
*snipped to fit post size*

Closing open log file c:\debuglog.txt
Hi,

One minidump is insufficient to identify the root cause. Attach 5 to 6 minidumps here.
 
Hi cpc2004,

you seem to be the main person around here to offer a helping hand,
so i was wondering if you has a spare one for me??

i too am part of this never ending broken record of errors and the lovely "Blue Screen"


here are my minidumps, (there is only a couple, but thats them all)


Cheers if you can help.. its got to a stage now where i cant even fully boot
up windows (gets to the welcome screen then freezes) unless i boot in safe mode


MobiTec
 
Hi MobiTec,

The premlinmary investigation, it is faulty ram. Two minidumps are insufficient to confirm the root cause. Attach 5 to 6 minidumps here.
 
Hi Mobitec,

One of your minidumps had memory corruption and I confirm that it is faulty ram.

BugCheck 1000008E, {c0000005, 804dd980, b79eacf0, 0}
Probably caused by : memory_corruption
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: CODE_CORRUPTION
BUGCHECK_STR: 0x8E
LAST_CONTROL_TRANSFER: from 7c90eb94 to 804dd980

STACK_TEXT:
b79ead64 7c90eb94 badb0d00 0172f248 b6ef3d98 nt!KiFastCallEntry+0xdd
WARNING: Frame IP not in any known module. Following frames may be wrong.
0172f23c 7c90dfe8 7c810c3e 000000ec 0172f274 0x7c90eb94
0172f27c 7c810ca2 000000ec 0172f28c 00704b80 0x7c90dfe8
0172f294 6af44044 000000ec 0172f2b0 00704b78 0x7c810ca2
0172f2b4 6af4085c 0172f35c 0172f4cc 00704b78 0x6af44044
0172f2fc 6af41ec9 0001a1ac 00000000 0172f35c 0x6af4085c
0172f364 0040c04c 0172f4cc 00f66d50 00000308 0x6af41ec9
0172f3a4 00408915 00f63770 00f63300 000002a0 0x40c04c
0172f4e8 0040964e 0015d754 001acf28 00000114 0x408915
0172f4ec 0015d754 001acf28 00000114 00000760 0x40964e
0172f4f0 001acf28 00000114 00000760 00000000 0x15d754
0172f4f4 00000000 00000760 00000000 0172f580 0x1acf28

CHKIMG_EXTENSION: !chkimg -lo 50 -d !nt
804dda40-804dda45 6 bytes - nt!KiServiceExit+8f
[ 75 79 f7 44 24 70:82 01 ff 46 88 86 ]
804dda50-804dda51 2 bytes - nt!KiServiceExit+9f (+0x10)
[ 66 f7:26 00 ]
804dda54-804dda57 4 bytes - nt!KiServiceExit+a3 (+0x04)
[ 6c f8 ff 0f:15 00 00 00 ]
804dda60-804dda67 8 bytes - nt!KiServiceExit+af (+0x0c)
[ 24 6c 1b 66 0f ba 64 24:75 79 f7 44 24 70 00 00 ]
804dda70-804dda7a 11 bytes - nt!KiServiceExit+bf (+0x10)
[ 00 66 83 7d 6c 08 74 05:24 6c 1b 66 0f ba 64 24 ]
804dda7c-804dda7f 4 bytes - nt!KiServiceExit+cb (+0x0c)
[ a1 8d 65 54:87 8e 00 00 ]
35 errors : !nt (804dda40-804dda7f)

MODULE_NAME: memory_corruption
IMAGE_NAME: memory_corruption
FOLLOWUP_NAME: memory_corruption
DEBUG_FLR_IMAGE_TIMESTAMP: 0
MEMORY_CORRUPTOR: LARGE_64
STACK_COMMAND: .trap ffffffffb79eacf0 ; kb
FAILURE_BUCKET_ID: MEMORY_CORRUPTION_LARGE_64
BUCKET_ID: MEMORY_CORRUPTION_LARGE_64

Followup: memory_corruption
 
thank you cpc2004 for your fast responce,

because i use 2 x Infineon 512MB DDR SDRAM PC2700 333Mhz

is there a way to tell which 1 is faulty, as i have tried to run them
both just on there own but for some reason it i get the error with both of them

or is there any programs that will distinguish the faulty 1?


Cheers,
MobiTec
 
If the BSOD occurs very frequently, it is faulty ram. As your windows does not encounter BSOD very often. Clear the dust inside the computer cabinet and reseat the memory stick may resolve the problem
 
Razorback said:
I borrowed another set of ram - 512 MB of PC4000 to see if my new ram was the problem. Just to recap, I replaced my ram a couple of months back. I went from 512 MB of OCZ PC4000 to 1 GB of OCZ PC3700. I wanted to rule out the new ram so I used the ram that borrowed from work.
Hi Razorback,

Have you resolved the hardware problem? Let me know if you need further help.
 
more dumps?

Could you give these a look?
I was trying to remove spyware and viri for a coworker's personal laptop. I fianlly got rid of SurfSideKick and rewarded with a bluescreen with every "regular" restart. I can restart in safemode and run everything fine there...just don't know what to do from here.
 
Hi Duhgus,

I've studied your minidumps. The crashes are caused by instruction misaligned. It may be hardware or device driver error. As you know the minidump is only snapshot of the critical memory and it is insufficient to diagnostic your problem. Change the dump option from minidump to full memory dump.
 
full dump

I've changed to a full dump...Searched for the .dmp file but found that XP will only generate a .dmp file if it actually makes it that far. Booting up in "regular" mode would not generate a .dmp file.

Being an IBM laptop and XP I was able to "restore" to a previous versios of existstance (man, that's deep...wish I could do that) and try different options before I was getting the BSOD.

I'll keep trying and post results...
 
Hi,

The dump option can be changed at any time and it is required to reboot the windows. I don't understand what do you mean regular windows to take the full memory dump. You must make sure that the size of paging space is bigger than the size of ram.
 
Crashing To Desktop Under Heavy Load

Hi Cpc2004,

I recently added a few upgrades to my system and all was working great for about 1 month. Now when i run any heavy load program it crashes to desktop. I have done memtest86 and i did get an error on test 7 but i replaced the stick of ram with another and got the same error. I ran a cpu tester called " processor stabilty tester " and it puts me to a BSOD. So im done with those, not sure they helped me at all. My system includes:
Abit kv7 socket a mobo.
Amd Athlon xp3000+ 2.8 ghz processor.
ultra 512 pc3200 ddr 400 mhz cl3 ram.
generic 350 w psu.
All new parts.
See what you can do.. Thanks !
 
Hi,

Two minidumps are inaccesible and this is the symptom of bad memory.

Suggestion
1. Reseat the memory stick to another memory slot
2. Downclock the ram
3. Clean the dust inside the computer case
4. Refer the manual of your motherboard and make sure that the ram is compatible to the motherboard
 
Tried

I'll look toward ram then. I've reseated the ram already into another slot, the case and mobo are brand new no dust is present and yes i have confirmed that the ram is compatible with the new mobo.

Thank You.
 
Still Happening...

I only had one pc3200 ddr 400 512 mb ram chips and wanted 2 so i went and bought 2 more. If i place them in one at a time or the two new or one old and either of the new it still crashes to desktop. Ive tried downclocking my ram and that didnt help in any combination either. Any other ideas ? Ill post some new dumps.
 
Status
Not open for further replies.
Back