Windbg bsod

By ten
Jun 10, 2008
  1. Hello, I get a lot of BSOD and I've ru Windbg. But I cannot interprate what it means. Could you help me. Thank you very much.

    Windbg says:

    Executable search path is:
    Windows XP Kernel Version 2600 (Service Pack 2) UP Free x86 compatible
    Product: WinNt, suite: TerminalServer SingleUserTS Personal
    Built by: 2600.xpsp_sp2_gdr.070227-2254
    Kernel base = 0x804d7000 PsLoadedModuleList = 0x805533a0
    Debug session time: Tue Jun 10 17:09:20.890 2008 (GMT+2)
    System Uptime: 0 days 0:04:04.453
    Loading Kernel Symbols
    Loading User Symbols
    Loading unloaded module list
    * *
    * Bugcheck Analysis *
    * *

    Use !analyze -v to get detailed debugging information.

    BugCheck 1000008E, {c0000005, bf801193, ee4f0a48, 0}

    Probably caused by : win32k.sys ( win32k!TimersProc+45 )

    Followup: MachineOwner

    kd> !analyze -v
    * *
    * Bugcheck Analysis *
    * *

    This is a very common bugcheck. Usually the exception address pinpoints
    the driver/function that caused the problem. Always note this address
    as well as the link date of the driver/image that contains this address.
    Some common problems are exception code 0x80000003. This means a hard
    coded breakpoint or assertion was hit, but this system was booted
    /NODEBUG. This is not supposed to happen as developers should never have
    hardcoded breakpoints in retail code, but ...
    If this happens, make sure a debugger gets connected, and the
    system is booted /DEBUG. This will let us see why this breakpoint is
    Arg1: c0000005, The exception code that was not handled
    Arg2: bf801193, The address that the exception occurred at
    Arg3: ee4f0a48, Trap Frame
    Arg4: 00000000

    Debugging Details:

    EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - L'instruction "0x%08lx" emploie l'adresse m emoire "0x%08lx". La me moire ne peut pas tre "%s".

    bf801193 8b4624 mov eax,dword ptr [esi+24h]

    TRAP_FRAME: ee4f0a48 -- (.trap 0xffffffffee4f0a48)
    ErrCode = 00000000
    eax=e156bde8 ebx=00000032 ecx=00000000 edx=00000000 esi=0c070214 edi=00000020
    eip=bf801193 esp=ee4f0abc ebp=ee4f0ad4 iopl=0 nv up ei pl nz na pe nc
    cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010206
    bf801193 8b4624 mov eax,dword ptr [esi+24h] ds:0023:0c070238=????????
    Resetting default scope




    PROCESS_NAME: csrss.exe

    LAST_CONTROL_TRANSFER: from bf895545 to bf801193

    ee4f0ad4 bf895545 00000022 006dfff4 bf801067 win32k!TimersProc+0x45
    ee4f0d30 bf879fa3 ee500490 00000002 ee4f0d54 win32k!RawInputThread+0x634
    ee4f0d40 bf80108a ee500490 ee4f0d64 006dfff4 win32k!xxxCreateSystemThreads+0x60
    ee4f0d54 8053ca28 00000000 00000022 00000000 win32k!NtUserCallOneParam+0x23
    ee4f0d54 7c91eb94 00000000 00000022 00000000 nt!KiFastCallEntry+0xf8
    WARNING: Frame IP not in any known module. Following frames may be wrong.
    00000000 00000000 00000000 00000000 00000000 0x7c91eb94


    bf801193 8b4624 mov eax,dword ptr [esi+24h]


    SYMBOL_NAME: win32k!TimersProc+45

    FOLLOWUP_NAME: MachineOwner

    MODULE_NAME: win32k

    IMAGE_NAME: win32k.sys


    FAILURE_BUCKET_ID: 0x8E_win32k!TimersProc+45

    BUCKET_ID: 0x8E_win32k!TimersProc+45

    Followup: MachineOwner

    kd> lmvm win32k
    start end module name
    bf800000 bf9c2880 win32k (pdb symbols) c:\WINDOWS\SYMBOLS\win32k.pdb\8F51F3B8BFB742E49E1C50FC54A9630F2\win32k.pdb
    Loaded symbol image file: win32k.sys
    Mapped memory image file: c:\WINDOWS\SYMBOLS\win32k.sys\47E0E1061c2880\win32k.sys
    Image path: win32k.sys
    Image name: win32k.sys
    Timestamp: Wed Mar 19 10:46:46 2008 (47E0E106)
    CheckSum: 001CF050
    ImageSize: 001C2880
    File version: 5.1.2600.3335
    Product version: 5.1.2600.3335
    File flags: 0 (Mask 3F)
    File OS: 40004 NT Win32
    File type: 3.7 Driver
    File date: 00000000.00000000
    Translations: 0416.04b0
    CompanyName: Microsoft Corporation
    ProductName: Sistema operacional Microsoft® Windows®
    InternalName: win32k.sys
    OriginalFilename: win32k.sys
    ProductVersion: 5.1.2600.3335
    FileVersion: 5.1.2600.3335 (xpsp_sp2_gdr.080319-1240)
    FileDescription: Driver Win32 multiusuário
    LegalCopyright: © Microsoft Corporation. Todos os direitos reservados.
  2. Route44

    Route44 TechSpot Ambassador Posts: 11,984   +72

    0x8E errors are almost always caused by hardware compatibility issues though sometimes it can be a driver or even a need for a BIOS upgrade.

    In your minidump text it cited two core Windows drivers which is too general.

    So, my first best advice to you is to run MemTest on your RAM for a minimum of 7 passes. If you have any errors then you have corrupted memory. If you have more than one stick and you have errors run the test on each individual stick to determine if one or more than one needs to be replaced.

    But before even running MemTest make sure your RAM is seated properly. I know of people who had memory errors due to a stick of RAM not properly seated.

    Second, after you run MemTest and there are no errors then run a full harddrive diagnostics. Your harddrive manufacturer provides a free utility to do this.
Topic Status:
Not open for further replies.

Similar Topics

Add your comment to this article

You need to be a member to leave a comment. Join thousands of tech enthusiasts and participate.
TechSpot Account You may also...