Repeated crashes-at my wit's end-desperate for help!

Status
Not open for further replies.
D

DSP316

Posts: 17   +0
Hello everyone:

I am new to this forum and like many of you searching for BSOD solutions I googled my way in here! To anyone who can help-thanks in advance:

Here’s a challenge!

Calling all computer gurus-I need your help!

I got my system in September 2005. Almost from the beginning-I started getting a message-windows has recovered from a serious error along with random BSOD-usually IRQ less or equal driver fault issues-. After troubleshooting with the dump files and running hardware diagnostics –memory tests (all passed)-I changed the video card, RAM, HD and no change-random crashes and the WinDebug analysis shows various things on each crash!-they range from ntkrpramp causing crash to usbstor.sys, NTFS,sys, memory corruption, (even after I changed the memory fully), Intel C51sys etc and sometimes unidentified driver fault-fact is there is no single driver identified each time-it is a different process causing a crash-and the fact is the same thing is happening under Vista as well (I set up a dual boot system to see if it was system related)-I have run all the hardwre diagnostics (the long version!) and everything passed everytime-I am just at my wits end and perhaps I should put it out of its misery by shooting it. I have an old Dim233 (now running XP Home) and an Inspiron 8000 (XP Pro) which are rock solid and this latest and greatest is virtually useless as it crashes randomly at least 5 times a day in the middle of something or even when I am not using it, it will crash! I did a clean install last week and the system still crashes even with minimal software-Windebug analyses still shows random reasons-no single process or driver-mostly these days it is due to NTKRPAMP.EXE. I would appreciate any help and I will post two of the dump file messages for perusal if that would help right at the bottom. Maybe I have a lemon! TIA...



Here are my system specs:

Dell Dim 9100 BIOS A03-

3 Ghz HT-2 GB Corsair RAM at 667 Mhz -

WinXP MCE 2005 now with IE 7-all updates current-

HDD-300 GB SATA 3Gb/sec X 2(Seagate Barracuda)-

LG Muti_Drive with lightscribe; Phillips DVD-DL (OEM) writers-

13-1 Internal Card reader (Samsung-Dell OEM)-

Internal FDD-

Nvidia GeForce 256 MB 9600 GS PCI Express (Retail)-

Hauppage WINTV PVR 150 PCI for MCE-

SoundBlaster Audigy 2 (Internal PCI)-

Intel Modem and Network cards (OEM)-

External USB Linksys WUSB 54G card-

Office 2003-AVG anti-virus-

ZA 7.0., Active Sync 4.2, Windows defender

____________________________________________________________

DUMP FILE analysIs follows (sorry its long)


Microsoft (R) Windows Debugger Version 6.6.0007.5
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\WINDOWS\Minidump\Mini040207-03.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*crogram Files\WinDebug\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows XP Kernel Version 2600 (Service Pack 2) MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 2600.xpsp_sp2_gdr.061219-0316
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055c700
Debug session time: Mon Apr 2 10:37:40.265 2007 (GMT-5)
System Uptime: 0 days 1:21:19.971
Loading Kernel Symbols
............................................................................................................................................
Loading User Symbols
Loading unloaded module list
.............
ERROR: FindPlugIns 8007007b
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1000007E, {c0000005, 805503d3, b9810c58, b9810954}

Unable to load image IntelC52.sys, Win32 error 2
*** WARNING: Unable to verify timestamp for IntelC52.sys
*** ERROR: Module load completed but symbols could not be loaded for IntelC52.sys
Probably caused by : ntkrpamp.exe ( nt!KiDoubleFaultStack+2cd3 )

Followup: MachineOwner
---------

1: kd> !analyze -v
ERROR: FindPlugIns 8007007b
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

SYSTEM_THREAD_EXCEPTION_NOT_HANDLED_M (1000007e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003. This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG. This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG. This will let us see why this breakpoint is
happening.
Arguments:
Arg1: c0000005, The exception code that was not handled
Arg2: 805503d3, The address that the exception occurred at
Arg3: b9810c58, Exception Record Address
Arg4: b9810954, Context Record Address

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx". The memory could not be "%s".

FAULTING_IP:
nt!KiDoubleFaultStack+2cd3
805503d3 80b0ff19b92830 xor byte ptr [eax+28B919FFh],30h

EXCEPTION_RECORD: b9810c58 -- (.exr ffffffffb9810c58)
ExceptionAddress: 805503d3 (nt!KiDoubleFaultStack+0x00002cd3)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 00000001
Parameter[1]: 28b91a03
Attempt to write to address 28b91a03

CONTEXT: b9810954 -- (.cxr ffffffffb9810954)
eax=00000004 ebx=00000000 ecx=b8f3ab60 edx=00000000 esi=804fa034 edi=804fa0ec
eip=805503d3 esp=b9810d20 ebp=b9810dac iopl=0 nv up ei pl nz na po nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00210202
nt!KiDoubleFaultStack+0x2cd3:
805503d3 80b0ff19b92830 xor byte ptr [eax+28B919FFh],30h ds:0023:28b91a03=??
Resetting default scope

CUSTOMER_CRASH_COUNT: 3

DEFAULT_BUCKET_ID: DRIVER_FAULT

PROCESS_NAME: System

ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx". The memory could not be "%s".

WRITE_ADDRESS: 28b91a03

BUGCHECK_STR: 0x7E

LAST_CONTROL_TRANSFER: from 805ce84c to 805503d3

STACK_TEXT:
b9810dac 805ce84c 892a3cd0 00000000 00000000 nt!KiDoubleFaultStack+0x2cd3
b9810ddc 8054532e b8edf707 892a3cd0 00000000 nt!PspSystemThreadStartup+0x34
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16


FOLLOWUP_IP:
nt!KiDoubleFaultStack+2cd3
805503d3 80b0ff19b92830 xor byte ptr [eax+28B919FFh],30h

SYMBOL_STACK_INDEX: 0

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nt

IMAGE_NAME: ntkrpamp.exe

DEBUG_FLR_IMAGE_TIMESTAMP: 4587e148

SYMBOL_NAME: nt!KiDoubleFaultStack+2cd3

STACK_COMMAND: .cxr 0xffffffffb9810954 ; kb

FAILURE_BUCKET_ID: 0x7E_nt!KiDoubleFaultStack+2cd3

BUCKET_ID: 0x7E_nt!KiDoubleFaultStack+2cd3

Followup: MachineOwner


******************************************************************************
 
Second dump file (latest)

Sorry-had to truncate my prior post as it was too long for the forum-here's the latest dump file-:confused:

Thanks for any help!
Dan



Microsoft (R) Windows Debugger Version 6.6.0007.5
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\WINDOWS\Minidump\Mini041207-03.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:program Files\WinDebug\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows XP Kernel Version 2600 (Service Pack 2) MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 2600.xpsp_sp2_gdr.070227-2254
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055c700
Debug session time: Thu Apr 12 08:18:46.359 2007 (GMT-5)
System Uptime: 0 days 1:20:08.083
Loading Kernel Symbols
...........................................................................................................................................
Loading User Symbols
Loading unloaded module list
.............
ERROR: FindPlugIns 8007007b
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 10000050, {badb0cfa, 0, 8054a51a, 0}


Could not read faulting driver name
Probably caused by : ntkrpamp.exe ( nt!ExFreePoolWithTag+23a )

Followup: MachineOwner
---------

1: kd> !analyze -v
ERROR: FindPlugIns 8007007b
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced. This cannot be protected by try-except,
it must be protected by a Probe. Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: badb0cfa, memory referenced.
Arg2: 00000000, value 0 = read operation, 1 = write operation.
Arg3: 8054a51a, If non-zero, the instruction address which referenced the bad memory
address.
Arg4: 00000000, (reserved)

Debugging Details:
------------------


Could not read faulting driver name

READ_ADDRESS: badb0cfa

FAULTING_IP:
nt!ExFreePoolWithTag+23a
8054a51a 668b4efa mov cx,word ptr [esi-6]

MM_INTERNAL_CODE: 0

CUSTOMER_CRASH_COUNT: 3

DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: 0x50

PROCESS_NAME: BrmfRsmg.exe

LAST_CONTROL_TRANSFER: from 805bf539 to 8054a51a

STACK_TEXT:
a412dc48 805bf539 badb0d00 00000000 805ba6ce nt!ExFreePoolWithTag+0x23a
a412dc54 805ba6ce 00000000 0057fe90 00000000 nt!ObpFreeObjectNameBuffer+0x13
a412dc7c 80623649 c0000034 89e34390 0057fe01 nt!ObOpenObjectByName+0x370
a412dd50 8054086c 0057fe90 00020019 0057fdf0 nt!NtOpenKey+0x1af
a412dd50 7c90eb94 0057fe90 00020019 0057fdf0 nt!KiFastCallEntry+0xfc
WARNING: Frame IP not in any known module. Following frames may be wrong.
0057fe30 00000000 00000000 00000000 00000000 0x7c90eb94


STACK_COMMAND: kb

FOLLOWUP_IP:
nt!ExFreePoolWithTag+23a
8054a51a 668b4efa mov cx,word ptr [esi-6]

SYMBOL_STACK_INDEX: 0

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nt

IMAGE_NAME: ntkrpamp.exe

DEBUG_FLR_IMAGE_TIMESTAMP: 45e53f9d

SYMBOL_NAME: nt!ExFreePoolWithTag+23a

FAILURE_BUCKET_ID: 0x50_nt!ExFreePoolWithTag+23a

BUCKET_ID: 0x50_nt!ExFreePoolWithTag+23a

Followup: MachineOwner
 
You wouldn't happen to have the Application and System files from the event viewer? Look in these and see if any warning or error indications are present. Check the Event ID and Source. Look the information up at the Microsoft Technet. The dump information is useful but this will help isolate the problem faster.
 
I went and reread the things to do before posting BSODs and I have done all the steps (replaced the RAM-even though it passed MEMtest), cleaned all the dust out and ran chkdisk etc., except install and run the everest software-I did try changing the PSU but the one I got from PC power and cooling was too samll for my machine
 
Do you have a spare SATA cable? Try replacing that. I see errors that appear to be random as though the information is being scrambled during the load process. I'm still going through the dump.
 
Thanks sliderule 101 for teh quick response-I reviewed the event viewer-most of the errors relate to the catalog service and I have disabled the indexing serivce since the last 2 days and still the BSODs continue-some warnings related the TCPIP settings-none related to the stuff I get in the WinDBG
 
I do have an e SATA drive (I just put it up yesterday) which I could disconnect and use as the spare SATA cable I suppose-but it seemed like it was happening even with only one internal SATA HDD-I will proceed with installing the Everest software and see as wel. Thanks ...
 
Have you reloaded the operating system after formatting the hard drive, then loading the software one item at a time and testing for a day or two before installing other software? It maybe that the OS or one of the software programs is corrupt.
 
I reloaded the OS and then followed the recommended order of loading the system software as DELL recommended (chip set utility, DSS, video driver, audio driver etc). But almost immediately without any other software except the system, the crashes started-I also noticed during cleaning that the paste on top of the processor and the heat sink was kind of dry-but my MOBO does not have a processor heat sensor and the everest software gives only the heat on the Video card and the HDDs-so I do not know whether the processor is heating up too much or the PSU not supplying enough Wattage-I heard Dell PSUs (375W) are underrated and should be sufficient for the hardware I have inside-it is frustrating-the pity is that the machine flies when it is working!
 
I found something which may be significant-I have a Samsung Dell OEM internal 13-1 card reader-sometimes the OS does not seem to "recognize" it and it is not listed in the Device manager and then randomly after some days it will come back in the device manager by itself. I find that whenever it is NOT listed in device manager then machine does NOT crash. Could it be that the internal wire is faulty or the reader is faulty-I am going to disable the reader in the BIOS and test the hypothesis. If the wire is faulty-it is a pain to replace as it is a Dell proprietary one -any insights? TIA
 
Sigh-the theory is gone-it just crashed -again the notorius ntkrpamp.exe
Here's the bug check analysis

Microsoft (R) Windows Debugger Version 6.6.0007.5
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\WINDOWS\Minidump\Mini041207-05.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:program Files\WinDebug\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows XP Kernel Version 2600 (Service Pack 2) MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 2600.xpsp_sp2_gdr.070227-2254
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055c700
Debug session time: Thu Apr 12 16:01:50.921 2007 (GMT-5)
System Uptime: 0 days 3:51:20.632
Loading Kernel Symbols
..............................................................................................................................................
Loading User Symbols
Loading unloaded module list
...............
ERROR: FindPlugIns 8007007b
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 10000050, {ffffff93, 1, e4d1c0a0, 0}


Could not read faulting driver name
Probably caused by : ntkrpamp.exe ( nt!ObpLookupObjectName+119 )

Followup: MachineOwner
---------

1: kd> !analyze -v
ERROR: FindPlugIns 8007007b
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced. This cannot be protected by try-except,
it must be protected by a Probe. Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: ffffff93, memory referenced.
Arg2: 00000001, value 0 = read operation, 1 = write operation.
Arg3: e4d1c0a0, If non-zero, the instruction address which referenced the bad memory
address.
Arg4: 00000000, (reserved)

Debugging Details:
------------------


Could not read faulting driver name

WRITE_ADDRESS: ffffff93

FAULTING_IP:
+ffffffffe4d1c0a0
e4d1c0a0 294193 sub dword ptr [ecx-6Dh],eax

MM_INTERNAL_CODE: 0

CUSTOMER_CRASH_COUNT: 5

DEFAULT_BUCKET_ID: COMMON_SYSTEM_FAULT

BUGCHECK_STR: 0x50

PROCESS_NAME: BrmfRsmg.exe

LAST_CONTROL_TRANSFER: from 805bd99d to e4d1c0a0

STACK_TEXT:
WARNING: Frame IP not in any known module. Following frames may be wrong.
a40d9bb0 805bd99d 00000120 89e34390 877a5170 0xe4d1c0a0
a40d9c28 805ba448 00000010 a40d9c68 00000040 nt!ObpLookupObjectName+0x119
a40d9c7c 80623649 00000000 89e34390 0057fe01 nt!ObOpenObjectByName+0xea
a40d9d50 8054086c 0057fe90 00020019 0057fdf0 nt!NtOpenKey+0x1af
a40d9d50 7c90eb94 0057fe90 00020019 0057fdf0 nt!KiFastCallEntry+0xfc
0057fe30 00000000 00000000 00000000 00000000 0x7c90eb94


STACK_COMMAND: kb

FOLLOWUP_IP:
nt!ObpLookupObjectName+119
805bd99d 3d04010000 cmp eax,104h

SYMBOL_STACK_INDEX: 1

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nt

IMAGE_NAME: ntkrpamp.exe

DEBUG_FLR_IMAGE_TIMESTAMP: 45e53f9d

SYMBOL_NAME: nt!ObpLookupObjectName+119

FAILURE_BUCKET_ID: 0x50_W_nt!ObpLookupObjectName+119

BUCKET_ID: 0x50_W_nt!ObpLookupObjectName+119

Followup: MachineOwner
 
I have been tracing the address:

Could not read faulting driver name

WRITE_ADDRESS: ffffff93

FFFFFFF93 is memory used by the system board, i.e. crash time. What ever is accessing this area of memory maybe an older program. Are you running any old programs from a previous computer that was running an older OS?
 
Music Match is the only one and Greetings workshop but the problem is there even before I installed them...thanks
 
Update to crashes after PSU replaced-any thoughts-anyone?

Hello all computer experts!:
Well my misery continues with a twist-I changed the PSU (a refurbished Dell part)-now the crashes are 90% due to ntkrpapamp.exe! What is that file and why is it crashing the machine? I am going to try leaving the machine on under Vista (I dual boot) and see it it happens there as well-it used to crash under Vista as well before the PSU was changed-the challenge is I can't figure out if is hardware or software.
Except for the optical drives, the media reader and the floppy as well as the mobo and sound card, modem and TV tuner-practically everything from RAM to video card to HDD have been replaced to no effect! Strangely, after the crash it reboots and goes to the log on screen and many times it will not crash if the machine is left at the log on screen-but if I log on and then leave it on-it seems to crash more often! It is possessed! But take a look at the latest log file anyone and let me know what you think...TSA
Dan


Loading Dump File [C:\WINDOWS\Minidump\Mini041907-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:program Files\WinDebug\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows XP Kernel Version 2600 (Service Pack 2) MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 2600.xpsp_sp2_gdr.070227-2254
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055c700
Debug session time: Thu Apr 19 23:13:38.796 2007 (GMT-5)
System Uptime: 0 days 0:32:23.376
Loading Kernel Symbols
..............................................................................................................................................
Loading User Symbols
Loading unloaded module list
..............
ERROR: FindPlugIns 8007007b
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 100000D1, {0, 1d, 8, 0}

Probably caused by : ntkrpamp.exe ( nt!CcUnmapVacbArray+e5 )

Followup: MachineOwner
---------

0: kd> !analyze -v
ERROR: FindPlugIns 8007007b
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: 00000000, memory referenced
Arg2: 0000001d, IRQL
Arg3: 00000008, value 0 = read operation, 1 = write operation
Arg4: 00000000, address which referenced memory

Debugging Details:
------------------


WRITE_ADDRESS: 00000000

CURRENT_IRQL: 1d

FAULTING_IP:
+0
00000000 ?? ???

PROCESS_NAME: System

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: 0xD1

LAST_CONTROL_TRANSFER: from 89e2e7c8 to 00000000

STACK_TEXT:
WARNING: Frame IP not in any known module. Following frames may be wrong.
bacdbc78 89e2e7c8 bacdbcb0 804e81ad 89e2e7c8 0x0
bacdbc80 804e81ad 89e2e7c8 87918ed0 00000000 0x89e2e7c8
bacdbcb0 804e51ec 00000000 00000000 87918f34 nt!CcUnmapVacbArray+0xe5
bacdbccc 804e54a7 87918ed0 806e4a4c 87918ed0 nt!CcUnmapAndPurge+0x20
bacdbcfc 804e4aa9 00000001 80558690 88d91fd0 nt!CcDeleteSharedCacheMap+0xc5
bacdbd34 804e7081 89e34638 80563720 89e3d910 nt!CcWriteBehind+0x357
bacdbd7c 805379bd 89e34638 00000000 89e3d910 nt!CcWorkerThread+0x12f
bacdbdac 805ce84c 89e34638 00000000 00000000 nt!ExpWorkerThread+0xef
bacdbddc 8054532e 805378ce 00000000 00000000 nt!PspSystemThreadStartup+0x34
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16


STACK_COMMAND: kb

FOLLOWUP_IP:
nt!CcUnmapVacbArray+e5
804e81ad 6a04 push 4

SYMBOL_STACK_INDEX: 2

SYMBOL_NAME: nt!CcUnmapVacbArray+e5

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nt

IMAGE_NAME: ntkrpamp.exe

DEBUG_FLR_IMAGE_TIMESTAMP: 45e53f9d

FAILURE_BUCKET_ID: 0xD1_W_nt!CcUnmapVacbArray+e5

BUCKET_ID: 0xD1_W_nt!CcUnmapVacbArray+e5

Followup: MachineOwner
 
Hi KC-thanks -I will check out the links-problem is the crashes continue under Vista as well-I do not know whether the WinDBG works for Vista as well-then I can analyze the dump filers in vista-since it occurs under bot the OSes, can it be the hardware but which one-I have replaced almost everything- I think I have probably spent too much on this dumb machine already-but I have learnt a lot-lol! Maybe I should change careers:)
 
Hi DSP316
Et. al.

If its any consolation... I am having the same problem I upgraded to Vista Business a few weeks ago and every since my machine has been giving me random BSOD ( 1~2 daily ... random intervals)

Analyzing the dump it have the same culprit ntkrpamp.exe ... If any one thinks it would be helpful I can post the full listing for it as well .

I set the machine up as a dual boot system as it was originally XP Pro I installed a second drive and put Vista on that.

Under Xp the system NEVER Blue Screened on me ,

Under Vista the error is always PAGE_FAULT_IN_NONPAGED_AREA


PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced. This cannot be protected by try-except,
it must be protected by a Probe. Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: a55c9560, memory referenced.
Arg2: 00000000, value 0 = read operation, 1 = write operation.
Arg3: 81c76fbf, If non-zero, the instruction address which referenced the bad memory
address.
Arg4: 00000000, (reserved)

Debugging Details:
------------------


READ_ADDRESS: GetPointerFromAddress: unable to read from 81d315ac
Unable to read MiSystemVaType memory at 81d11780
a55c9560

FAULTING_IP:
nt!ExIsResourceAcquiredExclusiveLite+a
81c76fbf f6410e80 test byte ptr [ecx+0Eh],80h

MM_INTERNAL_CODE: 0

CUSTOMER_CRASH_COUNT: 3

DEFAULT_BUCKET_ID: VISTA_RC

BUGCHECK_STR: 0x50

PROCESS_NAME: WINWORD.EXE

CURRENT_IRQL: 0

TRAP_FRAME: a5def9b4 -- (.trap ffffffffa5def9b4)
ErrCode = 00000000
eax=a7ac5c00 ebx=00000000 ecx=a55c9552 edx=90fa3b24 esi=a7ac5d80 edi=a507fd08
eip=81c76fbf esp=a5defa28 ebp=a5defa28 iopl=0 nv up ei pl zr na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010246
nt!ExIsResourceAcquiredExclusiveLite+0xa:
81c76fbf f6410e80 test byte ptr [ecx+0Eh],80h ds:0023:a55c9560=??
Resetting default scope

LAST_CONTROL_TRANSFER: from 81c8fa74 to 81ca9ef2

STACK_TEXT:
a5def99c 81c8fa74 00000000 a55c9560 00000000 nt!MmAccessFault+0x106
a5def99c 81c76fbf 00000000 a55c9560 00000000 nt!KiTrap0E+0xdc
a5defa28 82737438 a55c9552 a507fd08 00000000 nt!ExIsResourceAcquiredExclusiveLite+0xa
a5defa70 8273642d 90fa3a64 a7ac5c90 a5defb10 Ntfs!NtfsDeleteAllocationFromRecord+0xd5
a5defb94 82767bb5 90fa3a64 a7ac5c90 98c977b0 Ntfs!NtfsDeleteFile+0x2bb
a5defcf0 826d9a79 90fa3a64 854b2710 a55c920e Ntfs!NtfsCommonCleanup+0x1974
a5defd2c 81c80278 90fa3a14 00000000 ffffffff Ntfs!NtfsCommonCleanupCallout+0x1d
a5defd2c 81c80371 90fa3a14 00000000 ffffffff nt!KiSwapKernelStackAndExit+0x118
90fa39ac 00000000 00000000 00000000 00000000 nt!KiSwitchKernelStackAndCallout+0x31


STACK_COMMAND: kb

FOLLOWUP_IP:
nt!ExIsResourceAcquiredExclusiveLite+a
81c76fbf f6410e80 test byte ptr [ecx+0Eh],80h

SYMBOL_STACK_INDEX: 2

SYMBOL_NAME: nt!ExIsResourceAcquiredExclusiveLite+a

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nt

IMAGE_NAME: ntkrpamp.exe

DEBUG_FLR_IMAGE_TIMESTAMP: 4549ae00

FAILURE_BUCKET_ID: 0x50_nt!ExIsResourceAcquiredExclusiveLite+a

BUCKET_ID: 0x50_nt!ExIsResourceAcquiredExclusiveLite+a

Followup: MachineOwner
---------

I have been trying everything I can find on the net and Still no luck

The only things yet to try is New SATA Cable but I doubt that will make a difference :(

Please any help would be really really really appreciated ... I've past my wit's end last week and now I'm driving my wife crazy :(


JustWilliam
 
Finally-found the culprit-(I hope!)

Thanks one and all who helped-I took my machine to my friend today and he put new thermal paste on the processor and heat sink (arctic silver?)-we fired up 7-8 applications at the same time-including virus scanner, DVD movie, MS Word, Adobe PS and the machine ran without crashing and I am currently using it and it has not crahed (yet!)-I will leave it on all night (usually crashes/reboots several times during the night and writes mini-dump)-so if it stays all night without crashing then heat may have been the issue-too bad-I wasted money on the PSU. Cheers (I hope!)
Dan
 
No joy! ntoskernel?

Well-I left the system running all night and it is crashing less now and the main culprit now is ntoskernel and win32k.sys!
Here are two dump files from last night-



Loading Dump File [C:\WINDOWS\Minidump\Mini050407-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: C:\WINDOWS\Symbols
Executable search path is:
Unable to load image ntoskrnl.exe, Win32 error 2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
Windows XP Kernel Version 2600 (Service Pack 2) MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055c700
Debug session time: Fri May 4 00:37:27.125 2007 (GMT-5)
System Uptime: 0 days 0:43:42.705
Unable to load image ntoskrnl.exe, Win32 error 2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
Loading Kernel Symbols
............................................................................................................................................
Loading User Symbols
Loading unloaded module list
.............
ERROR: FindPlugIns 8007007b
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 10000050, {fffffff7, 0, 805ba459, 0}


Could not read faulting driver name
Probably caused by : ntoskrnl.exe ( nt!CcPfParametersRead+15e )

Followup: MachineOwner
---------

0: kd> !analyze -v
ERROR: FindPlugIns 8007007b
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced. This cannot be protected by try-except,
it must be protected by a Probe. Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: fffffff7, memory referenced.
Arg2: 00000000, value 0 = read operation, 1 = write operation.
Arg3: 805ba459, If non-zero, the instruction address which referenced the bad memory
address.
Arg4: 00000000, (reserved)

Debugging Details:
------------------


Could not read faulting driver name

READ_ADDRESS: fffffff7

FAULTING_IP:
nt!CcPfParametersRead+15e
805ba459 f6470f01 test byte ptr [edi+0Fh],1

MM_INTERNAL_CODE: 0

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: 0x50

PROCESS_NAME: BrmfRsmg.exe

LAST_CONTROL_TRANSFER: from 80623649 to 805ba459

STACK_TEXT:
a4322c7c 80623649 c0000034 89e34390 0057fe01 nt!CcPfParametersRead+0x15e
a4322d50 8054086c 0057fe90 00020019 0057fdf0 nt!MmSetBankedSection+0x50
a4322d64 7c90eb94 badb0d00 0057fdd8 ffffffff nt!RtlIpv4StringToAddressExA+0x149
WARNING: Frame IP not in any known module. Following frames may be wrong.
a4322d78 00000000 00000000 00000000 00000000 0x7c90eb94


STACK_COMMAND: kb

FOLLOWUP_IP:
nt!CcPfParametersRead+15e
805ba459 f6470f01 test byte ptr [edi+0Fh],1

SYMBOL_STACK_INDEX: 0

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nt

IMAGE_NAME: ntoskrnl.exe

DEBUG_FLR_IMAGE_TIMESTAMP: 45e53f9d

SYMBOL_NAME: nt!CcPfParametersRead+15e

FAILURE_BUCKET_ID: 0x50_nt!CcPfParametersRead+15e

BUCKET_ID: 0x50_nt!CcPfParametersRead+15e

Followup: MachineOwner
---------



Loading Dump File [C:\WINDOWS\Minidump\Mini050407-03.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: C:\WINDOWS\Symbols
Executable search path is:
Unable to load image ntoskrnl.exe, Win32 error 2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
Windows XP Kernel Version 2600 (Service Pack 2) MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055c700
Debug session time: Fri May 4 06:25:57.703 2007 (GMT-5)
System Uptime: 0 days 3:17:31.412
Unable to load image ntoskrnl.exe, Win32 error 2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
Loading Kernel Symbols
............................................................................................................................................
Loading User Symbols
Loading unloaded module list
.............
ERROR: FindPlugIns 8007007b
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1A, {41284, 8db0001, 0, c0883000}

Probably caused by : hardware ( nt!KeForceResumeThread+1 )

Followup: MachineOwner
---------

1: kd> !analyze -v
ERROR: FindPlugIns 8007007b
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

MEMORY_MANAGEMENT (1a)
# Any other values for parameter 1 must be individually examined.
Arguments:
Arg1: 00041284, A PTE or the working set list is corrupt.
Arg2: 08db0001
Arg3: 00000000
Arg4: c0883000

Debugging Details:
------------------


BUGCHECK_STR: 0x1a_41284

CUSTOMER_CRASH_COUNT: 3

DEFAULT_BUCKET_ID: DRIVER_FAULT

PROCESS_NAME: WUSB54Gv42.exe

MISALIGNED_IP:
nt!KeForceResumeThread+1
804f9deb 5d pop ebp

LAST_CONTROL_TRANSFER: from 805225e5 to 804f9deb

STACK_TEXT:
a4346b5c 805225e5 0000001a 00041284 08db0001 nt!KeForceResumeThread+0x1
a4346b94 80522e6b 00000000 08db0000 c0600230 nt!MiDispatchFault+0xb6
a4346bc8 80523283 c0046d80 08db0000 00000000 nt!MiCheckPurgeAndUpMapCount+0x3a
a4346c90 80519954 00000000 08eb0fff 00000000 nt!MiPfPutPagesInTransition+0x715
a4346cac 805b1e24 08db0000 08eb0fff a4346d64 nt!CcPinFileData+0x42c
a4346d4c 8054086c ffffffff 00198388 00198390 nt!NtQueryInformationJobObject+0x5ff
a4346d64 7c90eb94 badb0d00 0012e878 00000000 nt!RtlIpv4StringToAddressExA+0x149
WARNING: Frame IP not in any known module. Following frames may be wrong.
a4346d78 00000000 00000000 00000000 00000000 0x7c90eb94


STACK_COMMAND: kb

FOLLOWUP_IP:
nt!KeForceResumeThread+1
804f9deb 5d pop ebp

SYMBOL_STACK_INDEX: 0

FOLLOWUP_NAME: MachineOwner

IMAGE_NAME: hardware

DEBUG_FLR_IMAGE_TIMESTAMP: 0

SYMBOL_NAME: nt!KeForceResumeThread+1

MODULE_NAME: hardware

FAILURE_BUCKET_ID: IP_MISALIGNED

BUCKET_ID: IP_MISALIGNED

Followup: MachineOwner
 
Thanks CCT-I uninstalled the WUSB monitor and loaded the Linksys driver only after uninstalling the adapter. It still crashes! Any help appreciated. Here's the latest dump file:

Microsoft (R) Windows Debugger Version 6.6.0007.5
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\WINDOWS\Minidump\Mini050407-09.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: C:\WINDOWS\Symbols
Executable search path is:
Unable to load image ntoskrnl.exe, Win32 error 2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
Windows XP Kernel Version 2600 (Service Pack 2) MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055c700
Debug session time: Fri May 4 15:46:35.437 2007 (GMT-5)
System Uptime: 0 days 5:06:04.028
Unable to load image ntoskrnl.exe, Win32 error 2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
Loading Kernel Symbols
.........................................................................................................................................
Loading User Symbols
Loading unloaded module list
............
ERROR: FindPlugIns 8007007b
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 10000050, {d04ffffc, 0, 805bf39d, 0}


Could not read faulting driver name
Probably caused by : ntoskrnl.exe ( nt!HalpGetFullGeometry+44 )

Followup: MachineOwner
---------

0: kd> !analyze -v
ERROR: FindPlugIns 8007007b
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced. This cannot be protected by try-except,
it must be protected by a Probe. Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: d04ffffc, memory referenced.
Arg2: 00000000, value 0 = read operation, 1 = write operation.
Arg3: 805bf39d, If non-zero, the instruction address which referenced the bad memory
address.
Arg4: 00000000, (reserved)

Debugging Details:
------------------


Could not read faulting driver name

READ_ADDRESS: d04ffffc

FAULTING_IP:
nt!HalpGetFullGeometry+44
805bf39d 8b8cb5a8fdffff mov ecx,dword ptr [ebp+esi*4-258h]

MM_INTERNAL_CODE: 0

CUSTOMER_CRASH_COUNT: 9

DEFAULT_BUCKET_ID: COMMON_SYSTEM_FAULT

BUGCHECK_STR: 0x50

PROCESS_NAME: GoldfishMD.scr

LAST_CONTROL_TRANSFER: from 565308ec to 805bf39d

STACK_TEXT:
80538d00 565308ec 8bfc5557 458b0c5d 0440f708 nt!HalpGetFullGeometry+0x44
WARNING: Frame IP not in any known module. Following frames may be wrong.
80538d10 00000000 00ab850f 45890000 10458bf8 0x565308ec


STACK_COMMAND: kb

FOLLOWUP_IP:
nt!HalpGetFullGeometry+44
805bf39d 8b8cb5a8fdffff mov ecx,dword ptr [ebp+esi*4-258h]

SYMBOL_STACK_INDEX: 0

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nt

IMAGE_NAME: ntoskrnl.exe

DEBUG_FLR_IMAGE_TIMESTAMP: 45e53f9d

SYMBOL_NAME: nt!HalpGetFullGeometry+44

FAILURE_BUCKET_ID: 0x50_nt!HalpGetFullGeometry+44

BUCKET_ID: 0x50_nt!HalpGetFullGeometry+44

Followup: MachineOwner
---------
 
Another dump file-as you can see the BSODs are random! It is agravating!

Microsoft (R) Windows Debugger Version 6.6.0007.5
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\WINDOWS\Minidump\Mini050407-08.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: C:\WINDOWS\Symbols
Executable search path is:
Unable to load image ntoskrnl.exe, Win32 error 2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
Windows XP Kernel Version 2600 (Service Pack 2) MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055c700
Debug session time: Fri May 4 10:39:50.031 2007 (GMT-5)
System Uptime: 0 days 1:49:31.742
Unable to load image ntoskrnl.exe, Win32 error 2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
Loading Kernel Symbols
...........................................................................................................................................
Loading User Symbols
Loading unloaded module list
............
ERROR: FindPlugIns 8007007b
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1000007E, {c0000005, 0, b9804c64, b9804960}

Unable to load image IntelC52.sys, Win32 error 2
*** WARNING: Unable to verify timestamp for IntelC52.sys
*** ERROR: Module load completed but symbols could not be loaded for IntelC52.sys
Probably caused by : IntelC52.sys ( IntelC52+7b818 )

Followup: MachineOwner
---------

1: kd> !analyze -v
ERROR: FindPlugIns 8007007b
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

SYSTEM_THREAD_EXCEPTION_NOT_HANDLED_M (1000007e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003. This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG. This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG. This will let us see why this breakpoint is
happening.
Arguments:
Arg1: c0000005, The exception code that was not handled
Arg2: 00000000, The address that the exception occurred at
Arg3: b9804c64, Exception Record Address
Arg4: b9804960, Context Record Address

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx". The memory could not be "%s".

FAULTING_IP:
+0
00000000 ?? ???

EXCEPTION_RECORD: b9804c64 -- (.exr ffffffffb9804c64)
ExceptionAddress: 00000000
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 00000008
Parameter[1]: 00000000
Attempt to execute non-executable address 00000000

CONTEXT: b9804960 -- (.cxr ffffffffb9804960)
eax=00000001 ebx=00000000 ecx=b8f26b60 edx=00000000 esi=804fa034 edi=804fa0ec
eip=00000000 esp=b9804d2c ebp=b9804dac iopl=0 nv up ei pl zr na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00210246
00000000 ?? ???
Resetting default scope

CUSTOMER_CRASH_COUNT: 8

DEFAULT_BUCKET_ID: COMMON_SYSTEM_FAULT

PROCESS_NAME: System

ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx". The memory could not be "%s".

WRITE_ADDRESS: 00000000

BUGCHECK_STR: 0x7E

LAST_CONTROL_TRANSFER: from 00000000 to 00000000

SYMBOL_ON_RAW_STACK: 1

STACK_ADDR_RAW_STACK_SYMBOL: 17002000010004

STACK_COMMAND: dds B9804D40-0x20 ; kb

STACK_TEXT:
b9804d20 00000000
b9804d24 00000008
b9804d28 00210246
b9804d2c 00000000
b9804d30 00000000
b9804d34 8912d6d8
b9804d38 00000000
b9804d3c b8f1a818 IntelC52+0x7b818
b9804d40 b8f1a818 IntelC52+0x7b818
b9804d44 8912d6d8
b9804d48 b8f1a810 IntelC52+0x7b810
b9804d4c b9804d54
b9804d50 00010000
b9804d54 b8f1a808 IntelC52+0x7b808
b9804d58 b8f1a808 IntelC52+0x7b808
b9804d5c 8912d6d8
b9804d60 b8f1a800 IntelC52+0x7b800
b9804d64 b9804d6c
b9804d68 00010001
b9804d6c b8f1a7f8 IntelC52+0x7b7f8
b9804d70 b8f1a7f8 IntelC52+0x7b7f8
b9804d74 8912d6d8
b9804d78 b8f1a7f0 IntelC52+0x7b7f0
b9804d7c b9804d84
b9804d80 00010002
b9804d84 b8f03428 IntelC52+0x64428
b9804d88 b8f03428 IntelC52+0x64428
b9804d8c 8912d6d8
b9804d90 b8f03420 IntelC52+0x64420
b9804d94 b9804d3c
b9804d98 00010003
b9804d9c b8f1a810 IntelC52+0x7b810


FOLLOWUP_IP:
IntelC52+7b818
b8f1a818 ?? ???

SYMBOL_NAME: IntelC52+7b818

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: IntelC52

IMAGE_NAME: IntelC52.sys

DEBUG_FLR_IMAGE_TIMESTAMP: 4406209b

FAILURE_BUCKET_ID: 0x7E_IntelC52+7b818

BUCKET_ID: 0x7E_IntelC52+7b818

Followup: MachineOwner
---------
 
Only thing I can say is pull the Sound Blaster and anything else you absolutely don't need and reinstall.

Just get the OS and chipset and Video going if you can.


:(
 
(In)voluntary euthanasia!

I appreciate your input CCT-I have analyzed the minidumps under Vista as well and no guesses allowed! same problems persist under Vista-almost the same processes with random crashes-which to me points to a hardware issue-but which one? I am going to do a heart transplant-I have ordered a replacement mobo from Centrix international (Dell OEM for 9100-it was not too costly-$49-so it should be the exact same replacement)-I will use this opportunity to learn to strip my computer and put it together and if it breaks the machine-so be it-at least it will be (in)voluntary euthanasia! I will report on my success (or lack of it) soon-as you can see-I will put an end to this BSOD problem one way or another!!:giddy:
 
Status
Not open for further replies.

Similar threads

R
Windows 2008 R2 BSOD
Replies
1
Views
2K
Cycloid Torus
Cycloid Torus
MaxFfm
BOSD irql_not_less_or_equal ntoskrnl.exe
Replies
1
Views
4K
Tmagic650
Tmagic650
MacunRc
BSOD bad pool caller (c2) Windows10
Replies
6
Views
4K
Tmagic650
Tmagic650

Latest posts

Back