Random BSOD

[neiden]

Hi, this is the second time I'm writing this post, try to do it just a couple of minutes ago but it happend again, the BSOD..

anyway, I keep getting BSOD randomly, some days only once other 3-4 times. I have no idea why. My computer is a dell optiplex 170l with default factory settings and Win XP sp2, ie no overclocking or such..

I looked into the minidump files with the WinDbg and from the little I know I figure it is a memory reference that goes bad. What concerns me is that from what I can see the problem is in the ntkernel, which I supose is a vital part of the OS..

I'll post a couple of my minidumps and hope that someone have an idea on what I can do!

Neiden

:edit: turned off hyper threading today but it didn't make any difference got a BSOD an hour or so later..

 

[neiden]

ok I looked through the latest minidump file from today
when typing the !analyze -v command I get the following:

*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

KERNEL_MODE_EXCEPTION_NOT_HANDLED_M (1000008e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003. This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG. This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG. This will let us see why this breakpoint is
happening.
Arguments:
Arg1: c0000005, The exception code that was not handled
Arg2: 8618f5d0, The address that the exception occurred at
Arg3: eea89cb0, Trap Frame
Arg4: 00000000

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx". The memory could not be "%s".

FAULTING_IP:
+ffffffff8618f5d0
8618f5d0 033e add edi,[esi]

TRAP_FRAME: eea89cb0 -- (.trap ffffffffeea89cb0)
ErrCode = 00000000
eax=01cfdc98 ebx=00000000 ecx=860378b8 edx=929d0004 esi=01d115e6 edi=0001394e
eip=8618f5d0 esp=eea89d24 ebp=eea89d30 iopl=0 nv up ei pl nz na po nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010206
8618f5d0 033e add edi,[esi] ds:0023:01d115e6=????????
Resetting default scope

CUSTOMER_CRASH_COUNT: 2

DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: 0x8E

LAST_CONTROL_TRANSFER: from 804dd99f to 8618f5d0

STACK_TEXT:
WARNING: Frame IP not in any known module. Following frames may be wrong.
eea89d30 804dd99f 000009e4 00000000 00000000 0x8618f5d0
eea89d30 7c90eb94 000009e4 00000000 00000000 nt!KiFastCallEntry+0xfc
0070fb00 00000000 00000000 00000000 00000000 0x7c90eb94


FOLLOWUP_IP:
nt!KiFastCallEntry+fc
804dd99f 8be5 mov esp,ebp

SYMBOL_STACK_INDEX: 1

FOLLOWUP_NAME: MachineOwner

SYMBOL_NAME: nt!KiFastCallEntry+fc

MODULE_NAME: nt

IMAGE_NAME: ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP: 42250f77

STACK_COMMAND: .trap ffffffffeea89cb0 ; kb

FAILURE_BUCKET_ID: 0x8E_nt!KiFastCallEntry+fc

BUCKET_ID: 0x8E_nt!KiFastCallEntry+fc

Followup: MachineOwner
---------

any guru out there that could give me some clues on what to do? it's just killing me to get these BS after working for an hour without saving...

 

[kenyee]

smells like bad hardware...any systems you can swap parts from?

 

[neiden]

ok, yesterday I swapped my harddrive to a entirly new computer. But after a couple of hours I got a BSOD so it's either the harddrive or the OS. The minidump looks exactly as the one posted above so my guess is that it is the same error..

oh well, nothing else to do but to format and reinstall I guess..

 

[howard_hopkinso]

Hello and welcome to Techspot.

All your minidumps crash with exactly the same problem, and the same bugcheck.

0x0000008E: KERNEL_MODE_EXCEPTION_NOT_HANDLED

A kernel mode program generated an exception which the error handler didn’t catch. These are nearly always hardware compatibility issues (which sometimes means a driver issue or a need for a BIOS upgrade).

Your minidumps also reference svchost.exe. svchost.exe is a system process belonging to the Microsoft Windows Operating System which handles processes executed from DLLs.

Maybe doing a Windows repair as per this thread HERE will help.

Regards Howard :wave: :wave:

 

[neiden]

Hi and thanks for the reply,

I tried to repair the windows installation as suggested but still no luck, I keep getting BSOD. However, the behavoir has changed a little bit, instead of just freezing the computer the BSOD now starts a count from 0 to 100 saying something like, Dumping memory to file, and when it's finished it reboots.

I'll post the two latest minidumps, from what I can see it's not exactly same error.

I did run the Dell utility tests that resides on a partition of my hd, it was very thorough but did not find any bad hardware.

Could it still be an hardware issue or is it the OS?

regards,
neiden

 

[howard_hopkinso]

Your latest minidumps both crash at ntoskrnl.exe, with a bugcheck of 8E.

I do believe this is an OS problem. Back up your important data, and reformat the drive, and reinstall the OS. Hopefully this should solve your problem.

If it doesn`t then it has to be a hardware problem.

Regards Howard

 

[cpc2004]

virus Backdoor.Rustock (i386p)

Hi neiden,

At another forum, I find two BSOD cases which are related to virus Backdoor.Rustock. Your windows has the same virus. Refer the following webpage to clean up the virus.
http://www.symantec.com/avcenter/venc/data/backdoor.rustock.html

Mini120705-01.dmp 8E (c0000005, 85dfd5d0, ee32acb0, 00000000)

STACK_TEXT:
WARNING: Frame IP not in any known module. Following frames may be wrong.
ee32ad30 804dd99f 00001944 00000000 00000000 0x85dfd5d0
ee32ad30 7c90eb94 00001944 00000000 00000000 nt!KiFastCallEntry+0xfc
008afb14 00000000 00000000 00000000 00000000 0x7c90eb94
nt!KiFastCallEntry+fc

i386p.sys Wed Nov 30 04:22:31 2005 (438CB887) <--- virus