Often experiencing BSODs

[StMartin]

Hello people,

I have huge problem with my computer. It is fairly new and I am very often receiving BSODs (My computer is formated 4 times since I bought it, and still experiencing BSOD, it is also checked by the technical stuff for hardware and software problem, and there is no problem, at least my technical stuff say it).

Oftenly ACPI.sys and random executable files... Also it often happens when I install new software or some random applications. Today I installed the newest version of nod32 and it happend. It often gives me error IRQL_LESS_OR_EQUAL.

My configuration:

Intel Pentium D CPU 3.20GHz, 2,00 GB of RAM.

GeForce 8400 GS

160 GB SATA disk

ASUS DVD/RW

Here are the logs of the dumps and hijack this. Thank you.

 

[Bobbye]

O17 - HKLM\System\CCS\Services\Tcpip\..\{BCA80F16-210B-4F3D-A62F-F28B1257113C}: NameServer = 62.162.32.5 62.162.32.6

'62.162.32.0 - 62.162.33.255'

inetnum: 62.162.32.0 - 62.162.33.255
netname: MT-MTNET-IP-BACKBONE
descr: Management IP subnet
descr: Skopje, Macedonia
country: MK

If the domain is not from your ISP or company network, have HijackThis fix it.

 

[StMartin]

O17 - HKLM\System\CCS\Services\Tcpip\..\{BCA80F16-210B-4F3D-A62F-F28B1257113C}: NameServer = 62.162.32.5 62.162.32.6

'62.162.32.0 - 62.162.33.255'

inetnum: 62.162.32.0 - 62.162.33.255
netname: MT-MTNET-IP-BACKBONE
descr: Management IP subnet
descr: Skopje, Macedonia
country: MK

If the domain is not from your ISP or company network, have HijackThis fix it.

The domain is from my ISP.

 

[Bobbye]

Okay, thanks. I'm waiting for kritius to pick up your hijack log.

 

[StMartin]

I don't actually think that it is software problem, because I formatted it, 4-5 times (2-3 times with different CD). Are you sure that it is hardware problem?

 

[Route44]

Have you run MemTest on your memory? Bobbye is suspicious that you might be infected.

 

[StMartin]

Yes. It is not the RAM memory, cos I changed with 2GB.

 

[StMartin]

Today, I received BSOD again. HEre is the message:

Microsoft (R) Windows Debugger  Version 6.6.0007.5
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\WINDOWS\Minidump\Mini050508-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: C:/websymbols
Executable search path is: 
Unable to load image ntoskrnl.exe, Win32 error 2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
Windows XP Kernel Version 2600 (Service Pack 2) MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Kernel base = 0x804d7000 PsLoadedModuleList = 0x805634c0
Debug session time: Mon May  5 16:11:12.515 2008 (GMT+2)
System Uptime: 0 days 2:15:38.257
Unable to load image ntoskrnl.exe, Win32 error 2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
Loading Kernel Symbols
...........................................................................................................................
Loading User Symbols
Loading unloaded module list
..............
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1000000A, {c01f8094, 2, 0, 80500351}

Probably caused by : memory_corruption ( nt!MiLocateSubsection+67 )

Followup: MachineOwner
---------

1: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: c01f8094, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000000, value 0 = read operation, 1 = write operation
Arg4: 80500351, address which referenced memory

Debugging Details:
------------------


READ_ADDRESS:  c01f8094 

CURRENT_IRQL:  2

FAULTING_IP: 
nt!MiLocateSubsection+67
80500351 8b0b            mov     ecx,dword ptr [ebx]

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  DRIVER_FAULT

BUGCHECK_STR:  0xA

PROCESS_NAME:  firefox.exe

LAST_CONTROL_TRANSFER:  from 80500627 to 80500351

STACK_TEXT:  
9bc95c4c 80500627 895ab020 895ab158 895ab020 nt!MiLocateSubsection+0x67
9bc95c50 895ab020 895ab158 895ab020 87b6e020 nt!MMTEMPORARY+0x7b
WARNING: Frame IP not in any known module. Following frames may be wrong.
9bc95c54 895ab158 895ab020 87b6e020 f7717538 0x895ab020
9bc95c58 895ab020 87b6e020 f7717538 804dc766 0x895ab158
9bc95c5c 87b6e020 f7717538 804dc766 87b6e020 0x895ab020
9bc95c60 f7717538 804dc766 87b6e020 804ec2a0 0x87b6e020
9bc95c64 804dc766 87b6e020 804ec2a0 895ab110 0xf7717538
9bc95c8c 87b6e268 895ab020 00200008 00000006 nt!KeWaitForSingleObject+0x16
9bc95ca4 00000000 8949b020 520713fc 01c8aeb9 0x87b6e268


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt!MiLocateSubsection+67
80500351 8b0b            mov     ecx,dword ptr [ebx]

SYMBOL_STACK_INDEX:  0

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

DEBUG_FLR_IMAGE_TIMESTAMP:  469f6017

SYMBOL_NAME:  nt!MiLocateSubsection+67

IMAGE_NAME:  memory_corruption

FAILURE_BUCKET_ID:  0xA_nt!MiLocateSubsection+67

BUCKET_ID:  0xA_nt!MiLocateSubsection+67

Followup: MachineOwner
---------

 

[Bobbye]

StMartin, when I see the timestamp related Warning, I do something simple first. You will probably have a warning or Error in the Event Viewer for Windows Time service (W32Time)

W32Time error messages appear in the Event Viewer's System log with the source W32Time (click the Source column heading to sort the log by source). Many of the events that the time service records are Informational, but if you see a Warning event, you should try to fix the problem.

So give this a try and see if it resolves the problem:
1. Right click on the clock> Adjust Date/Time>
2.Time Zone tab> make sure your correct Time zone is set>
3. Check 'automatically adjust for Daylight Savings Time'>
4. Internet Time tab> check 'automatically sync with Internet Time Server'>
5. Copy this server and paste it in the server box:
tick.usno.navy.mil
6. Click on Update now.
After update, close..

I have seen this handle many to most of the Time Warnings.