XP Pro BSOD every 24 hours (+/- 12 hours)

[drsills]

Thanks for your attention; I've got spirals for eyes trying to figure this out.

My HP dc5750 small factor was quite reliable until April of this year, when it suddenly began to crash daily (give or take a few hours). The BSOD message was almost never the same, so I thought I'd treat it as a hardware problem. I swapped RAM, ran with just one or the other -- no appreciable difference.

I've also tried deleting, defragging, and rebuilding the page file. No difference.

I've updated the drivers and bios. Sigh.

I'm attaching my (abbreviated) EVEREST report and I'm also attaching the last four minidumps.

Thanks again!

 

[Route44]

Three of your errors are 0x000000C2: BAD_POOL_CALLER
A kernel-mode process or driver incorrectly attempted to perform memory operations. Typically, a faulty driver or buggy software causes this.

One error is 0x000000BE: ATTEMPTED_WRITE_TO_READONLY_MEMORY
A driver attempted to write to read-only memory. Commonly occurs after installing a faulty device driver, system service, or firmware.

Unfortunately nothing definitive was cited. Therefore please do the following and note any Yellow Triangles or Red X's and what they flag...

Start > Run > EventVwr.msc > Okay

 

[drsills]

Thankyouthankyouthankyou for your speedy reply; I'm very much obliged.
You've asked that I report from Event Viewer

...any Yellow Triangles or Red X's and what they flag...

Right before it crashed this morning (I'm attaching the minidump), this "red x error" was logged:

Event Type: Error
Event Source: .NET Runtime Optimization Service
Event Category: None
Event ID: 1103
Date: 8/12/2011
Time: 8:19:58 AM
User: N/A
Computer: SAMANTHA
Description:
.NET Runtime Optimization Service (clr_optimization_v2.0.50727_32) - Tried to start a service that wasn't the latest version of CLR Optimization service. Will shutdown

The above looks like clinching evidence of something; is it significant that the following warning was logged yesterday?

Event Type: Warning
Event Source: ASP.NET 2.0.50727.0
Event Category: Setup
Event ID: 1020
Date: 8/11/2011
Time: 12:48:02 PM
User: N/A
Computer: SAMANTHA
Description:
Updates to the IIS metabase were aborted because IIS is either not installed or is disabled on this machine. To configure ASP.NET to run in IIS, please install or enable IIS and re-register ASP.NET using aspnet_regiis.exe /I.

The same "warning" Event ID (1020) was logged in regard to ASP.NET 4.0.30319.0 three minutes earlier. Five days ago, this error was recorded:

Event Type: Error
Event Source: MPSampleSubmission
Event Category: None
Event ID: 5000
Date: 8/7/2011
Time: 2:39:51 AM
User: N/A
Computer: SAMANTHA
Description:
EventType mptelemetry, P1 0, P2 moaccapability, P3 3.0.8402.0, P4 3, P5 3, P6 unspecified, P7 unspecified, P8 NIL, P9 NIL, P10 NIL.

For more information, see Help and Support Center at ...
Data:
0000: 6d 00 70 00 74 00 65 00 m.p.t.e.
0008: 6c 00 65 00 6d 00 65 00 l.e.m.e.
0010: 74 00 72 00 79 00 2c 00 t.r.y.,.
0018: 20 00 30 00 2c 00 20 00 .0.,. .
0020: 6d 00 6f 00 61 00 63 00 m.o.a.c.
0028: 63 00 61 00 70 00 61 00 c.a.p.a.
0030: 62 00 69 00 6c 00 69 00 b.I.l.I.
0038: 74 00 79 00 2c 00 20 00 t.y.,. .
0040: 33 00 2e 00 30 00 2e 00 3...0...
0048: 38 00 34 00 30 00 32 00 8.4.0.2.
0050: 2e 00 30 00 2c 00 20 00 ..0.,. .
0058: 33 00 2c 00 20 00 33 00 3.,. .3.
0060: 2c 00 20 00 75 00 6e 00 ,. .u.n.
0068: 73 00 70 00 65 00 63 00 s.p.e.c.
0070: 69 00 66 00 69 00 65 00 I.f.I.e.
0078: 64 00 2c 00 20 00 75 00 d.,. .u.
0080: 6e 00 73 00 70 00 65 00 n.s.p.e.
0088: 63 00 69 00 66 00 69 00 c.I.f.I.
0090: 65 00 64 00 2c 00 20 00 e.d.,. .
0098: 4e 00 49 00 4c 00 2c 00 N.I.L.,.
00a0: 20 00 4e 00 49 00 4c 00 .N.I.L.
00a8: 20 00 4e 00 49 00 4c 00 .N.I.L.
00b0: 0d 00 0a 00 ....

From the "system" tab of the Event Viewer I find a quantity (eleven identical entries within two minutes) of Event ID 7001 errors logged:

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7001
Date: 8/12/2011
Time: 8:21:30 AM
User: N/A
Computer: SAMANTHA
Description:
The Remote Access Connection Manager service depends on the Telephony service which failed to start because of the following error:
The service cannot be started, either because it is disabled or because it has no enabled devices associated with it.

Warnings in the System event viewer include Event 4226:

Event Type: Warning
Event Source: Tcpip
Event Category: None
Event ID: 4226
Date: 8/12/2011
Time: 4:25:59 AM
User: N/A
Computer: SAMANTHA
Description:
TCP/IP has reached the security limit imposed on the number of concurrent TCP connect attempts.

For more information, see Help and Support Center at ...
Data:
0000: 00 00 00 00 01 00 54 00 ......T.
0008: 00 00 00 00 82 10 00 80 ....‚..€
0010: 01 00 00 00 00 00 00 00 ........
0018: 00 00 00 00 00 00 00 00 ........
0020: 00 00 00 00 00 00 00 00 ........

...and also event id 36, which looks like this:

Event Type: Warning
Event Source: W32Time
Event Category: None
Event ID: 36
Date: 8/12/2011
Time: 2:09:25 AM
User: N/A
Computer: SAMANTHA
Description:
The time service has not been able to synchronize the system time for 49152 seconds because none of the time providers has been able to provide a usable time stamp. The system clock is unsynchronized.

For more information, see Help and Support Center at ...

Another warning recorded among the system events is this one:

Event Type: Warning
Event Source: BROWSER
Event Category: None
Event ID: 8021
Date: 8/11/2011
Time: 5:45:58 PM
User: N/A
Computer: SAMANTHA
Description:
The browser was unable to retrieve a list of servers from the browser master \\[private] on the network \Device\NetBT_Tcpip_{2105BCA0-3BDF-4CD7-ABBE-328682ADEA5D}. The data is the error code.

For more information, see Help and Support Center at ...
Data:
0000: 35 00 00 00 5...

As long as we're on the subject of errors and warnings, may I volunteer this information about my Device Manager window?

When set to "show hidden devices," it shows a yellow exclamation icon next to "alps Pointing-device" under "Mice and other pointing devices -- probably because I'm using a USB mouse (hardwired) and nothing's plugged into the mouse socket.

Also among the hidden devices are a number of entries of the form "MpKslxxxxxxxx," where the x's are an assortment of letters and numbers. I understand that this warning, filed under the M's in "Non-Plug and Play Drivers," is related to Microsoft Security Essentials.

I hope the above is helpful. Thanks again for your expert attention!

 

[Route44]

Nothing definitive in the minidump. If you have them please give us five of the most recent minidumps - not including the one you just gave - in one Zip file and attach.

 

[drsills]

Ok, here's the previous five minidumps zipped together.

 

[Route44]

You are having a bunch of different error codes with no one thing definitively cited. This can be a sign of corrupted memory but until we test it we will not know.

Have you ever run memtest before? Also, what firewall are you using?

 

[drsills]

Have you ever run memtest before?

I did run memtest when this began months ago. Because a) memtest did not find any error, and because b) memtest can sometimes fail to detect problems in RAM, I tried running the system on either one of the two 512 mb dimms. Neither swapping dimms in slots, nor running with only one or the other of them seemed to make any difference in the frequency of BSODs.

Also, what firewall are you using?

I'm using the stock Windows firewall.

Again, thanks for your attention.

 

[Route44]

First, memtest while known for sometimes showing no errors on bad RAM this is the exception and not the rule. How many Passes did you allow with memtest?

Second, the Windows XP firewall is very poor.

Third, the reason I asked about what firewall is because one of your drivers that came up was the Windows ipnat.sys and when using the Windows XP firewall it has been know to cause conflicts resulting in system crashes.

 

[drsills]

How many Passes did you allow with memtest?

Honestly, I don't remember. Couldn't hurt to let it go all of tonight, right?

Second, the Windows XP firewall is very poor.

Ok. I'll scrap it. I've had Sygate Personal Firewall Pro (ver 5.6) for a while but hadn't bothered to install it; I've just done so.

So, shall I run a night-long memtest and reconnoiter with you tomorrow?

Thanks.

 

[Route44]

Yes, let it run throughout the night; it is the best way to run the test.

An excellent place to read on various firewalls by user experiences is Wilders Security forums.

 

[drsills]

Yes, let it run throughout the night; it is the best way to run the test.

After 14 hours and 30 iterations, memtest (ver. 4.1) found no errors. Dang!

An excellent place to read on various firewalls by user experiences is Wilders Security forums.

...where the consensus seems to be that only a raving loony would want a firewall that hasn't been updated since 2005 (i.e., Sygate). Gotcha. I'm going to try the free personal firewall Comodo produces; it seems popular with the Wilders crowd.

So, we've ruled out the RAM, I suppose. Today, I'll run this machine as per my usual custom but now with a non-Windows Firewall. Anything I ought to do in the meanwhile?
Thanks!

 

[Route44]

No, your course is a wise one. Try a non-Windows firewall and see if that brings stability. For XP I run Online Armor. They have a good free version but be prepared to have it learn your online habits. You'll get pop-ups asking you what you want to do. It can be annoying but then again it is doing what it wants.

Glad the Wilders Security forums helped. It really is a great place for security softwares.

Great work on your part. :grinthumb

 

[drsills]

I'm checking in this morning to say my computer has been stable for one day, seventeen hours and forty-eight minutes. Not a record, yet, but unusually long relative to the performance it's delivered in the last four months.

It's still too early to call, but right now the writing on the wall reads, "Windows' firewall is not compatible with the Windows operating system," which strikes me as just a little absurd, but there it is.

If we make it to tomorrow morning without a crash, I'll be wishing a big, healthy trout onto Route44's hook and calling my computer "healed!"

Here's hoping!

 

[Route44]

Look forward on reading that the system remains stable.

 

[drsills]

I am happy to report that, after 2 days, 20 hours, 16 min and 1 sec, my machine remains stable. This is a record uptime for this machine, and marks the end (knock on wood) of its propensity to deliver random BSODs, each of which pointed to any one of a variety of drivers or system files as the "culprit," when none of them really were.

I'll ask Route44 to correct me if I'm mistaken, but the real "culprit" appears to have been the stock Windows Firewall running on my XP Pro (sp3) system. I'm running Comodo's free Firewall now (along with Microsoft Security Essentials), and subsequently God has returned to His Heaven where all His angels are now singing.

Kudos go to Route44 in any abundance you might care to imagine. Much obliged, and happy fishing!

 

[Route44]

Excellent! And, yes, it appears your issue confirms what I wrote in one of my previous posts: Third, the reason I asked about what firewall is because one of your drivers that came up was the Windows ipnat.sys and when using the Windows XP firewall it has been know to cause conflicts resulting in system crashes.

Comodo is a good choice. Glad everything is working out for you.