BSOD Memory Problems

G

Get a Mac

Posts: 15   +0
Hi,

I have Windows XP on a Thinkpad with 512 MB RAM preinstalled and one additional 1024 MB RAM chip. The system worked perfectly for over a year. Unfortunately, I suddenly started getting BSODs even though I installed no new hardware or software. I removed the 1024 MB chip and the errors stopped. I then ordered a new chip, but I quickly got the same "memory_corruption" BSODs, so I removed the new faulty 1024 MB chip. Unfortunately, now I get new BSODs about once a day, even with just the one MB chip. I followed all the steps you listed to no avail.

I am attaching some Bugcheck analyses. Mini111306-01 is a BSOD with both sticks of memory. The remaining errors are with just the 512 MB system RAM. The errors with both RAM chips are usually IRQL_NOT_LESS_OR_EQUAL, and the errors with only the 512 MB chip are usually BAD_POOL_CALLER or KERNEL_MODE_EXCEPTION_NOT_HANDLED_M.

Thanks so much for all the help! Next time, I'll get a Mac and save me (and you) the trouble.
 

Attachments

  • Mini111306-01 (Includes 1024 MB Stick).txt
    3.6 KB · Views: 5
  • Mini111306-02.txt
    4.3 KB · Views: 8
  • Mini111206-01.txt
    4.3 KB · Views: 5
do as listed below and post results

kd> .bugcheck[Lists bugcheck data.]
Bugcheck code 0000000a
Arguments 00000000 0000001c 00000000 00000000

kd> kb[Lists the stack trace.]
ChildEBP RetAddr Args to Child
8013ed5c 801263ba 00000000 00000000 e12ab000 NT!_DbgBreakPoint
8013eecc 801389ee 0000000a 00000000 0000001c NT!_KeBugCheckEx+0x194
8013eecc 00000000 0000000a 00000000 0000001c NT!_KiTrap0E+0x256
8013ed5c 801263ba 00000000 00000000 e12ab000
8013ef64 00000246 fe551aa1 ff690268 00000002 NT!_KeBugCheckEx+0x194

kd> kv[Lists the trap frames.]
ChildEBP RetAddr Args to Child
8013ed5c 801263ba 00000000 00000000 e12ab000 NT!_DbgBreakPoint (FPO: [0,0,0])
8013eecc 801389ee 0000000a 00000000 0000001c NT!_KeBugCheckEx+0x194
8013eecc 00000000 0000000a 00000000 0000001c NT!_KiTrap0E+0x256 (FPO: [0,0] TrapFrame @ 8013eee8)
8013ed5c 801263ba 00000000 00000000 e12ab000
8013ef64 00000246 fe551aa1 ff690268 00000002 NT!_KeBugCheckEx+0x194

kd> .trap 8013eee8 [Gets the registers for the trap frame at the time of the fault.]
eax=dec80201 ebx=ffdff420 ecx=8013c71c edx=000003f8 esi=00000000 edi=87038e10
eip=00000000 esp=8013ef5c ebp=8013ef64 iopl=0 nv up ei pl nz na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010202
ErrCode = 00000000
00000000 ??????????????? [The current instruction pointer is NULL.]

kd> kb [Gives the stack trace before the fault.]
ChildEBP RetAddr Args to Child
8013ef68 fe551aa1 ff690268 00000002 fe5620d2 NT!_DbgBreakPoint
8013ef74 fe5620d2 fe5620da ff690268 80404690
NDIS!_EthFilterIndicateReceiveComplete+0x31
8013ef64 00000246 fe551aa1 ff690268 00000002 elnkii!_ElnkiiRcvInterruptDpc+0x1d0
__________________
 
Hi xxdanielxx,

Here's the data you requested. The first minidump is with both RAM chips, and it looks like a RAM problem. The other two dumps include just the one factory installed RAM chip. I have lots of additional minidumps (unfortunately); if they would be useful, just ask.

Thanks so much!


1. IRQL_NOT_LESS_OR_EQUAL (a)

kd> .bugcheck
Bugcheck code 1000000A
Arguments fef7ffff 00000002 00000000 8050a526
kd> kb
ChildEBP RetAddr Args to Child
ba51fd3c 8050af09 8238a350 00064b8c 00000014 nt!MiGatherMappedPages+0x1a
ba51fd74 80642453 00000000 8a2aab30 00000000 nt!MiModifiedPageWriterWorker+0x1c7
ba51fdac 805c4a24 00000000 00000000 00000000 nt!MiModifiedPageWriter+0x165
ba51fddc 80540fb2 806422ee 00000000 00000000 nt!PspSystemThreadStartup+0x34
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16
kd> kv
ChildEBP RetAddr Args to Child
ba51fd3c 8050af09 8238a350 00064b8c 00000014 nt!MiGatherMappedPages+0x1a (FPO: [Non-Fpo])
ba51fd74 80642453 00000000 8a2aab30 00000000 nt!MiModifiedPageWriterWorker+0x1c7 (FPO: [Non-Fpo])
ba51fdac 805c4a24 00000000 00000000 00000000 nt!MiModifiedPageWriter+0x165 (FPO: [Non-Fpo])
ba51fddc 80540fb2 806422ee 00000000 00000000 nt!PspSystemThreadStartup+0x34 (FPO: [Non-Fpo])
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16
kd> .trap
kd> kb
ChildEBP RetAddr Args to Child
ba51fd3c 8050af09 8238a350 00064b8c 00000014 nt!MiGatherMappedPages+0x1a
ba51fd74 80642453 00000000 8a2aab30 00000000 nt!MiModifiedPageWriterWorker+0x1c7
ba51fdac 805c4a24 00000000 00000000 00000000 nt!MiModifiedPageWriter+0x165
ba51fddc 80540fb2 806422ee 00000000 00000000 nt!PspSystemThreadStartup+0x34
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16


2. BAD_POOL_CALLER (c2)
kd> .bugcheck
Bugcheck code 000000C2
Arguments 00000040 00000000 80000000 00000000
kd> kb
ChildEBP RetAddr Args to Child
f82eabb0 805429ed 000000c2 00000040 00000000 nt!KeBugCheckEx+0x1b
f82eabf0 80543b9d 00000000 00000005 e1621518 nt!MiFreePoolPages+0x8b
f82eac30 80629fd5 00000000 00000000 e1553ef0 nt!ExFreePoolWithTag+0x1b7
f82eac4c 8062a5e8 e1621518 e1553ef0 e102aba4 nt!CmpCleanUpKcbValueCache+0x3d
f82eac60 806312a2 e1621518 e1a2e008 806313be nt!CmpCleanUpKcbCacheWithLock+0x1a
f82eac6c 806313be f82eac80 8062a6de e1553ef0 nt!CmpGetDelayedCloseIndex+0x16
f82eac74 8062a6de e1553ef0 f82eac8c 8062aac6 nt!CmpAddToDelayedClose+0xa
f82eac80 8062aac6 e1553ef0 f82eaca4 8062bbc6 nt!CmpDereferenceKeyControlBlockWithLock+0x38
f82eac8c 8062bbc6 e1553ef0 00000000 e1d670e8 nt!CmpDereferenceKeyControlBlock+0x12
f82eaca4 805af537 e1d67100 e1d670e8 00000000 nt!CmpDeleteKeyObject+0x92
f82eacc0 80521e5b e1d67100 00000000 000003f0 nt!ObpRemoveObjectRoutine+0xdf
f82eace4 805b0537 82c52a10 e14b97a8 82ac3a18 nt!ObfDereferenceObject+0x5f
f82eacfc 805b05cd e14b97a8 e1d67100 000003f0 nt!ObpCloseHandleTableEntry+0x155
f82ead44 805b0705 000003f0 00000001 00000000 nt!ObpCloseHandle+0x87
f82ead58 8053c818 000003f0 00acf1a8 7c90eb94 nt!NtClose+0x1d
f82ead58 7c90eb94 000003f0 00acf1a8 7c90eb94 nt!KiFastCallEntry+0xf8
WARNING: Frame IP not in any known module. Following frames may be wrong.
00acf1a8 00000000 00000000 00000000 00000000 0x7c90eb94
kd> kv
ChildEBP RetAddr Args to Child
f82eabb0 805429ed 000000c2 00000040 00000000 nt!KeBugCheckEx+0x1b (FPO: [Non-Fpo])
f82eabf0 80543b9d 00000000 00000005 e1621518 nt!MiFreePoolPages+0x8b (FPO: [Non-Fpo])
f82eac30 80629fd5 00000000 00000000 e1553ef0 nt!ExFreePoolWithTag+0x1b7 (FPO: [Non-Fpo])
f82eac4c 8062a5e8 e1621518 e1553ef0 e102aba4 nt!CmpCleanUpKcbValueCache+0x3d (FPO: [Non-Fpo])
f82eac60 806312a2 e1621518 e1a2e008 806313be nt!CmpCleanUpKcbCacheWithLock+0x1a (FPO: [Non-Fpo])
f82eac6c 806313be f82eac80 8062a6de e1553ef0 nt!CmpGetDelayedCloseIndex+0x16 (FPO: [0,0,0])
f82eac74 8062a6de e1553ef0 f82eac8c 8062aac6 nt!CmpAddToDelayedClose+0xa (FPO: [Non-Fpo])
f82eac80 8062aac6 e1553ef0 f82eaca4 8062bbc6 nt!CmpDereferenceKeyControlBlockWithLock+0x38 (FPO: [Non-Fpo])
f82eac8c 8062bbc6 e1553ef0 00000000 e1d670e8 nt!CmpDereferenceKeyControlBlock+0x12 (FPO: [Non-Fpo])
f82eaca4 805af537 e1d67100 e1d670e8 00000000 nt!CmpDeleteKeyObject+0x92 (FPO: [Non-Fpo])
f82eacc0 80521e5b e1d67100 00000000 000003f0 nt!ObpRemoveObjectRoutine+0xdf (FPO: [Non-Fpo])
f82eace4 805b0537 82c52a10 e14b97a8 82ac3a18 nt!ObfDereferenceObject+0x5f (FPO: [Non-Fpo])
f82eacfc 805b05cd e14b97a8 e1d67100 000003f0 nt!ObpCloseHandleTableEntry+0x155 (FPO: [Non-Fpo])
f82ead44 805b0705 000003f0 00000001 00000000 nt!ObpCloseHandle+0x87 (FPO: [Non-Fpo])
f82ead58 8053c818 000003f0 00acf1a8 7c90eb94 nt!NtClose+0x1d (FPO: [Non-Fpo])
f82ead58 7c90eb94 000003f0 00acf1a8 7c90eb94 nt!KiFastCallEntry+0xf8 (FPO: [0,0] TrapFrame @ f82ead64)
WARNING: Frame IP not in any known module. Following frames may be wrong.
00acf1a8 00000000 00000000 00000000 00000000 0x7c90eb94
kd> .trap f82ead64
ErrCode = 00000000
eax=00000000 ebx=00e5ff78 ecx=00acf0a8 edx=00000063 esi=00acf1bc edi=00000000
eip=7c90eb94 esp=00acf198 ebp=00acf1a8 iopl=0 nv up ei pl zr na pe nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000246
001b:7c90eb94 ?? ???
kd> kb
*** Stack trace for last set context - .thread/.cxr resets it
ChildEBP RetAddr Args to Child
WARNING: Frame IP not in any known module. Following frames may be wrong.
00acf1a8 00000000 00000000 00000000 00000000 0x7c90eb94


3. KERNEL_MODE_EXCEPTION_NOT_HANDLED_M (1000008e)
kd> .bugcheck
Bugcheck code 1000008E
Arguments c0000005 80543e61 f35c6bb0 00000000
kd> kb
ChildEBP RetAddr Args to Child
f35c6c58 80629fd5 e16126b0 00000000 0000067b nt!ExFreePoolWithTag+0x47b
f35c6c74 8062a5e8 e39f2b00 0000067b e39f2b00 nt!CmpCleanUpKcbValueCache+0x3d
f35c6c88 8062a71d e39f2b00 e2bfbb60 e27900e0 nt!CmpCleanUpKcbCacheWithLock+0x1a
f35c6c98 8062a745 e27900e0 f35c6cc0 80627c3e nt!CmpCleanUpKCBCacheTable+0x2d
f35c6ca4 80627c3e e27900e0 00000000 00000020 nt!CmpSearchForOpenSubKeys+0xb
f35c6cc0 8061770c e2bfbb60 00000020 e27900e0 nt!CmUnloadKey+0x32
f35c6d58 8053c818 0006faec 0006fb04 7c90eb94 nt!NtUnloadKey+0x18c
f35c6d58 7c90eb94 0006faec 0006fb04 7c90eb94 nt!KiFastCallEntry+0xf8
WARNING: Frame IP not in any known module. Following frames may be wrong.
0006fb04 00000000 00000000 00000000 00000000 0x7c90eb94
kd> kv
ChildEBP RetAddr Args to Child
f35c6c58 80629fd5 e16126b0 00000000 0000067b nt!ExFreePoolWithTag+0x47b (FPO: [Non-Fpo])
f35c6c74 8062a5e8 e39f2b00 0000067b e39f2b00 nt!CmpCleanUpKcbValueCache+0x3d (FPO: [Non-Fpo])
f35c6c88 8062a71d e39f2b00 e2bfbb60 e27900e0 nt!CmpCleanUpKcbCacheWithLock+0x1a (FPO: [Non-Fpo])
f35c6c98 8062a745 e27900e0 f35c6cc0 80627c3e nt!CmpCleanUpKCBCacheTable+0x2d (FPO: [0,0,0])
f35c6ca4 80627c3e e27900e0 00000000 00000020 nt!CmpSearchForOpenSubKeys+0xb (FPO: [Non-Fpo])
f35c6cc0 8061770c e2bfbb60 00000020 e27900e0 nt!CmUnloadKey+0x32 (FPO: [Non-Fpo])
f35c6d58 8053c818 0006faec 0006fb04 7c90eb94 nt!NtUnloadKey+0x18c (FPO: [Non-Fpo])
f35c6d58 7c90eb94 0006faec 0006fb04 7c90eb94 nt!KiFastCallEntry+0xf8 (FPO: [0,0] TrapFrame @ f35c6d64)
WARNING: Frame IP not in any known module. Following frames may be wrong.
0006fb04 00000000 00000000 00000000 00000000 0x7c90eb94
kd> .trap f35c6d64
ErrCode = 00000000
eax=0006fb1c ebx=00000600 ecx=0006fb1c edx=77e46180 esi=00000000 edi=00000000
eip=7c90eb94 esp=0006fae0 ebp=0006fb04 iopl=0 nv up ei pl zr na pe nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000246
001b:7c90eb94 ?? ???
kd> kb
*** Stack trace for last set context - .thread/.cxr resets it
ChildEBP RetAddr Args to Child
WARNING: Frame IP not in any known module. Following frames may be wrong.
0006fb04 00000000 00000000 00000000 00000000 0x7c90eb94
 
the first one is bad memory wich is the old ram have you tested the new ram just to be safe download memtest86 from memtest86.com. the next minidump point to 0xc2 wich is most likely bad ram. the last one points to 1x8e wich is the same as 0x8e wich means

A kernel mode program generated an exception which the error handler didn’t catch. These are nearly always hardware compatibility issues (which sometimes means a driver issue or a need for a BIOS upgrade). look to see if there is an update for your bios and test the rams you have
 
Thanks for the reply.

I'm worried it's more than RAM that's the problem.

1. The first error above is from the new RAM. (I got similar errors with the old RAM.)

2. I ran MemTest on 3 different DIMMs and found no errors.

3. I had no problems for over 1 year. I find it difficult to believe that the two original DIMMs as well as one new DIMM all failed within 1 month.

At the very least, am I safe to assume that this is a hardware issue and not software? I already updated to the latest BIOS, and I don't see any driver issues. Thanks again!
 
bsod are caused by hardware problems such as lan card,video card, ram,hdd and so on. the only thing is that your minidumps are pointing to memory coruption wich is ram and also the BC point to ram. You said you have more minidumps can you analyze some of them using the same method above as the first time not the way i ask the way u did them. use the newest minidumps if you have not
 
Here are two more. Thanks!


4. BAD_POOL_CALLER (c2)
kd> .bugcheck
Bugcheck code 000000C2
Arguments 00000040 00000000 80000000 00000000
kd> kb
ChildEBP RetAddr Args to Child
efd5bbb0 805429ed 000000c2 00000040 00000000 nt!KeBugCheckEx+0x1b
efd5bbf0 80543b9d 00000000 0000000b e3ad5830 nt!MiFreePoolPages+0x8b
efd5bc30 80629fd5 00000000 00000000 e2793a28 nt!ExFreePoolWithTag+0x1b7
efd5bc4c 8062a5e8 e3ad5830 e2793a28 e102c800 nt!CmpCleanUpKcbValueCache+0x3d
efd5bc60 806312a2 e3ad5830 e2273b60 806313be nt!CmpCleanUpKcbCacheWithLock+0x1a
efd5bc6c 806313be efd5bc80 8062a6de e2793a28 nt!CmpGetDelayedCloseIndex+0x16
efd5bc74 8062a6de e2793a28 efd5bc8c 8062aac6 nt!CmpAddToDelayedClose+0xa
efd5bc80 8062aac6 e2793a28 efd5bca4 8062bbc6 nt!CmpDereferenceKeyControlBlockWithLock+0x38
efd5bc8c 8062bbc6 e2793a28 00000000 e36a91b0 nt!CmpDereferenceKeyControlBlock+0x12
efd5bca4 805af537 e36a91c8 e36a91b0 00000000 nt!CmpDeleteKeyObject+0x92
efd5bcc0 80521e5b e36a91c8 00000000 00000282 nt!ObpRemoveObjectRoutine+0xdf
efd5bce4 805b0537 ff073320 e27f5b10 ff5f6870 nt!ObfDereferenceObject+0x5f
efd5bcfc 805b05cd e27f5b10 e36a91c8 00000282 nt!ObpCloseHandleTableEntry+0x155
efd5bd44 805b0705 00000282 00000001 00000000 nt!ObpCloseHandle+0x87
efd5bd58 8053c818 00000282 0012df0c 7c90eb94 nt!NtClose+0x1d
efd5bd58 7c90eb94 00000282 0012df0c 7c90eb94 nt!KiFastCallEntry+0xf8
WARNING: Frame IP not in any known module. Following frames may be wrong.
0012df0c 00000000 00000000 00000000 00000000 0x7c90eb94
kd> kv
ChildEBP RetAddr Args to Child
efd5bbb0 805429ed 000000c2 00000040 00000000 nt!KeBugCheckEx+0x1b (FPO: [Non-Fpo])
efd5bbf0 80543b9d 00000000 0000000b e3ad5830 nt!MiFreePoolPages+0x8b (FPO: [Non-Fpo])
efd5bc30 80629fd5 00000000 00000000 e2793a28 nt!ExFreePoolWithTag+0x1b7 (FPO: [Non-Fpo])
efd5bc4c 8062a5e8 e3ad5830 e2793a28 e102c800 nt!CmpCleanUpKcbValueCache+0x3d (FPO: [Non-Fpo])
efd5bc60 806312a2 e3ad5830 e2273b60 806313be nt!CmpCleanUpKcbCacheWithLock+0x1a (FPO: [Non-Fpo])
efd5bc6c 806313be efd5bc80 8062a6de e2793a28 nt!CmpGetDelayedCloseIndex+0x16 (FPO: [0,0,0])
efd5bc74 8062a6de e2793a28 efd5bc8c 8062aac6 nt!CmpAddToDelayedClose+0xa (FPO: [Non-Fpo])
efd5bc80 8062aac6 e2793a28 efd5bca4 8062bbc6 nt!CmpDereferenceKeyControlBlockWithLock+0x38 (FPO: [Non-Fpo])
efd5bc8c 8062bbc6 e2793a28 00000000 e36a91b0 nt!CmpDereferenceKeyControlBlock+0x12 (FPO: [Non-Fpo])
efd5bca4 805af537 e36a91c8 e36a91b0 00000000 nt!CmpDeleteKeyObject+0x92 (FPO: [Non-Fpo])
efd5bcc0 80521e5b e36a91c8 00000000 00000282 nt!ObpRemoveObjectRoutine+0xdf (FPO: [Non-Fpo])
efd5bce4 805b0537 ff073320 e27f5b10 ff5f6870 nt!ObfDereferenceObject+0x5f (FPO: [Non-Fpo])
efd5bcfc 805b05cd e27f5b10 e36a91c8 00000282 nt!ObpCloseHandleTableEntry+0x155 (FPO: [Non-Fpo])
efd5bd44 805b0705 00000282 00000001 00000000 nt!ObpCloseHandle+0x87 (FPO: [Non-Fpo])
efd5bd58 8053c818 00000282 0012df0c 7c90eb94 nt!NtClose+0x1d (FPO: [Non-Fpo])
efd5bd58 7c90eb94 00000282 0012df0c 7c90eb94 nt!KiFastCallEntry+0xf8 (FPO: [0,0] TrapFrame @ efd5bd64)
WARNING: Frame IP not in any known module. Following frames may be wrong.
0012df0c 00000000 00000000 00000000 00000000 0x7c90eb94
kd> .trap efd5bd64
ErrCode = 00000000
eax=00000009 ebx=00000000 ecx=0012dae4 edx=00000005 esi=0012df20 edi=7344475e
eip=7c90eb94 esp=0012defc ebp=0012df0c iopl=0 nv up ei pl zr na pe nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00240246
001b:7c90eb94 ?? ???
kd> kb
*** Stack trace for last set context - .thread/.cxr resets it
ChildEBP RetAddr Args to Child
WARNING: Frame IP not in any known module. Following frames may be wrong.
0012df0c 00000000 00000000 00000000 00000000 0x7c90eb94


5. KERNEL_MODE_EXCEPTION_NOT_HANDLED_M (1000008e)
kd> .bugcheck
Bugcheck code 1000008E
Arguments c0000005 80543e61 eeb6ab78 00000000
kd> kb
ChildEBP RetAddr Args to Child
eeb6ac20 805b5373 e1a14270 e56b6f54 82db6cf0 nt!ExFreePoolWithTag+0x47b
eeb6ac44 805af53f e1a14280 00000000 00000000 nt!ObpFreeObject+0x18d
eeb6ac5c 80521e5b e1a14298 00000000 0000064c nt!ObpRemoveObjectRoutine+0xe7
eeb6ac80 805b0537 e1a14281 0000064c e423ac98 nt!ObfDereferenceObject+0x5f
eeb6ac98 805b6ceb e1c1bd58 e1a14298 0000064c nt!ObpCloseHandleTableEntry+0x155
eeb6acb8 80602c6b e423ac98 0000064c eeb6ad20 nt!ObpCloseHandleProcedure+0x1f
eeb6ace8 805b6d4d e1c1bd58 805b6ccc eeb6ad20 nt!ExSweepHandleTable+0x4f
eeb6ad2c 805c75fa 82031830 eeb6ad64 00b2ffa0 nt!ObClearProcessHandleTable+0x57
eeb6ad54 8053c818 00000000 c0000005 00b2ffa0 nt!NtTerminateProcess+0x136
eeb6ad54 7c90eb94 00000000 c0000005 00b2ffa0 nt!KiFastCallEntry+0xf8
WARNING: Frame IP not in any known module. Following frames may be wrong.
00b2ffa0 00000000 00000000 00000000 00000000 0x7c90eb94
kd> kv
ChildEBP RetAddr Args to Child
eeb6ac20 805b5373 e1a14270 e56b6f54 82db6cf0 nt!ExFreePoolWithTag+0x47b (FPO: [Non-Fpo])
eeb6ac44 805af53f e1a14280 00000000 00000000 nt!ObpFreeObject+0x18d (FPO: [Non-Fpo])
eeb6ac5c 80521e5b e1a14298 00000000 0000064c nt!ObpRemoveObjectRoutine+0xe7 (FPO: [Non-Fpo])
eeb6ac80 805b0537 e1a14281 0000064c e423ac98 nt!ObfDereferenceObject+0x5f (FPO: [Non-Fpo])
eeb6ac98 805b6ceb e1c1bd58 e1a14298 0000064c nt!ObpCloseHandleTableEntry+0x155 (FPO: [Non-Fpo])
eeb6acb8 80602c6b e423ac98 0000064c eeb6ad20 nt!ObpCloseHandleProcedure+0x1f (FPO: [Non-Fpo])
eeb6ace8 805b6d4d e1c1bd58 805b6ccc eeb6ad20 nt!ExSweepHandleTable+0x4f (FPO: [Non-Fpo])
eeb6ad2c 805c75fa 82031830 eeb6ad64 00b2ffa0 nt!ObClearProcessHandleTable+0x57 (FPO: [Non-Fpo])
eeb6ad54 8053c818 00000000 c0000005 00b2ffa0 nt!NtTerminateProcess+0x136 (FPO: [Non-Fpo])
eeb6ad54 7c90eb94 00000000 c0000005 00b2ffa0 nt!KiFastCallEntry+0xf8 (FPO: [0,0] TrapFrame @ eeb6ad64)
WARNING: Frame IP not in any known module. Following frames may be wrong.
00b2ffa0 00000000 00000000 00000000 00000000 0x7c90eb94
kd> .trap eeb6ad64
ErrCode = 00000000
eax=010036cd ebx=00034e40 ecx=00000000 edx=00000000 esi=00034e40 edi=000004f4
eip=7c90eb94 esp=00b2ff90 ebp=00b2ffa0 iopl=0 nv up ei pl nz na po nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000202
001b:7c90eb94 ?? ???
kd> kb
*** Stack trace for last set context - .thread/.cxr resets it
ChildEBP RetAddr Args to Child
WARNING: Frame IP not in any known module. Following frames may be wrong.
00b2ffa0 00000000 00000000 00000000 00000000 0x7c90eb94
 
if you see you still get the same bugcheck code of 8e and c2 when you bought the ram i know this is going to sound stupid but did you make sure the ram works on your mobo
 
I know I got the right type of RAM (PC4200 DDR2 SODIMM). Do I also need to check if a particular brand of RAM works with a mobo?

Moreover, the 0xc2 and 1x8e errors continue with just the factory installed RAM (but not the IRQL errors). I'm thinking I might send the laptop in for warranty repair when I don't need it for a week.

Thanks again!
 
New Error

I just got an error I never saw before. That's not good news. :( I'm posting the minidump below.

Do you know what is the significance of the string "7c90eb94"? It appeared in all my previous dumps and reappeared here. Thanks!


DRIVER_CORRUPTED_EXPOOL (c5)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is
caused by drivers that have corrupted the system pool. Run the driver
verifier against any new (or suspect) drivers, and if that doesn't turn up
the culprit, then use gflags to enable special pool.
Arguments:
Arg1: 0a100005, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000000, value 0 = read operation, 1 = write operation
Arg4: 805437b2, address which referenced memory

Debugging Details:
------------------


BUGCHECK_STR: 0xC5_2

CURRENT_IRQL: 2

FAULTING_IP:
nt!ExDeferredFreePool+ac
805437b2 8b08 mov ecx,dword ptr [eax]

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: DRIVER_FAULT

PROCESS_NAME: explorer.exe

LAST_CONTROL_TRANSFER: from 80543e6f to 805437b2

STACK_TEXT:
f08be104 80543e6f 0a100005 000000f8 e31bd200 nt!ExDeferredFreePool+0xac
f08be144 80629fd5 e5392e30 00000000 d792c34c nt!ExFreePoolWithTag+0x489
f08be160 80627bb3 e31bd200 e5709a80 00000000 nt!CmpCleanUpKcbValueCache+0x3d
f08be1c4 806174e0 e31bd200 f08be21c 00000001 nt!CmSetValueKey+0x231
f08be258 f388010e 00001658 029ae1b8 00000000 nt!NtSetValueKey+0x228
WARNING: Stack unwind information not available. Following frames may be wrong.
f08be334 8053c818 00001658 029ae1b8 00000000 SYMEVENT+0x1410e
f08be334 7c90eb94 00001658 029ae1b8 00000000 nt!KiFastCallEntry+0xf8
029ae190 00000000 00000000 00000000 00000000 0x7c90eb94


STACK_COMMAND: kb

FOLLOWUP_IP:
nt!ExDeferredFreePool+ac
805437b2 8b08 mov ecx,dword ptr [eax]

SYMBOL_STACK_INDEX: 0

FOLLOWUP_NAME: Pool_corruption

IMAGE_NAME: Pool_Corruption

DEBUG_FLR_IMAGE_TIMESTAMP: 0

SYMBOL_NAME: nt!ExDeferredFreePool+ac

MODULE_NAME: Pool_Corruption

FAILURE_BUCKET_ID: 0xC5_2_nt!ExDeferredFreePool+ac

BUCKET_ID: 0xC5_2_nt!ExDeferredFreePool+ac

Followup: Pool_corruption
---------

kd> .bugcheck
Bugcheck code 100000C5
Arguments 0a100005 00000002 00000000 805437b2

kd> kb
ChildEBP RetAddr Args to Child
f08be104 80543e6f 0a100005 000000f8 e31bd200 nt!ExDeferredFreePool+0xac
f08be144 80629fd5 e5392e30 00000000 d792c34c nt!ExFreePoolWithTag+0x489
f08be160 80627bb3 e31bd200 e5709a80 00000000 nt!CmpCleanUpKcbValueCache+0x3d
f08be1c4 806174e0 e31bd200 f08be21c 00000001 nt!CmSetValueKey+0x231
f08be258 f388010e 00001658 029ae1b8 00000000 nt!NtSetValueKey+0x228
WARNING: Stack unwind information not available. Following frames may be wrong.
f08be334 8053c818 00001658 029ae1b8 00000000 SYMEVENT+0x1410e
f08be334 7c90eb94 00001658 029ae1b8 00000000 nt!KiFastCallEntry+0xf8
029ae190 00000000 00000000 00000000 00000000 0x7c90eb94

kd> kv
ChildEBP RetAddr Args to Child
f08be104 80543e6f 0a100005 000000f8 e31bd200 nt!ExDeferredFreePool+0xac (FPO: [Non-Fpo])
f08be144 80629fd5 e5392e30 00000000 d792c34c nt!ExFreePoolWithTag+0x489 (FPO: [Non-Fpo])
f08be160 80627bb3 e31bd200 e5709a80 00000000 nt!CmpCleanUpKcbValueCache+0x3d (FPO: [Non-Fpo])
f08be1c4 806174e0 e31bd200 f08be21c 00000001 nt!CmSetValueKey+0x231 (FPO: [Non-Fpo])
f08be258 f388010e 00001658 029ae1b8 00000000 nt!NtSetValueKey+0x228 (FPO: [Non-Fpo])
WARNING: Stack unwind information not available. Following frames may be wrong.
f08be334 8053c818 00001658 029ae1b8 00000000 SYMEVENT+0x1410e
f08be334 7c90eb94 00001658 029ae1b8 00000000 nt!KiFastCallEntry+0xf8 (FPO: [0,0] TrapFrame @ f08be354)
029ae190 00000000 00000000 00000000 00000000 0x7c90eb94

kd> .trap f08be354
ErrCode = 00000000
eax=00000808 ebx=00000000 ecx=00000000 edx=005007d1 esi=7c90e7bc edi=00001658
eip=7c90eb94 esp=029ae14c ebp=029ae190 iopl=0 nv up ei pl zr na pe nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000246
001b:7c90eb94 ?? ???

kd> kb
*** Stack trace for last set context - .thread/.cxr resets it
ChildEBP RetAddr Args to Child
WARNING: Frame IP not in any known module. Following frames may be wrong.
029ae190 00000000 00000000 00000000 00000000 0x7c90eb94
 
Norton AV

Hi,

I find the footprnt of Norton AV at the stack trace. Probably Norton AV is the culprit. What version of Norton AV are you using?

Issue lm tn within windbg and the attach the output here.
 
Hi CPC,

I'm running Symantec Antivirus 10.1.0.394. I'll uninstall and see if it helps. I just got a second BSOD so I'll analyze both and post the results. Thanks!
 
Thanks CPC! This looks promising!

The lm tn output you asked for is huge and doesn't fit in this message, but I think you set me on the right track. Thanks again!
 
Hi,

Unfortunately, it wasn't Symantec and the BSOD's continue. Here are two new BSODs. Thanks for any help.


KERNEL_MODE_EXCEPTION_NOT_HANDLED_M (1000008e)

Arguments:
Arg1: c0000005, The exception code that was not handled
Arg2: 8062bfdd, The address that the exception occurred at
Arg3: ef4d3b84, Trap Frame
Arg4: 00000000

Debugging Details:
------------------

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx". The memory could not be "%s".

FAULTING_IP:
nt!HvpGetCellMapped+5f
8062bfdd 8b4304 mov eax,dword ptr [ebx+4]

TRAP_FRAME: ef4d3b84 -- (.trap ffffffffef4d3b84)
ErrCode = 00000000
eax=00009ff0 ebx=00009ff0 ecx=82daf3e0 edx=000003ff esi=e1036b60 edi=00000fff
eip=8062bfdd esp=ef4d3bf8 ebp=ef4d3c40 iopl=0 nv up ei pl zr na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010246
nt!HvpGetCellMapped+0x5f:
8062bfdd 8b4304 mov eax,dword ptr [ebx+4] ds:0023:00009ff4=????????
Resetting default scope

CUSTOMER_CRASH_COUNT: 2

DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: 0x8E

PROCESS_NAME: regedit.exe

LAST_CONTROL_TRANSFER: from 80634c17 to 8062bfdd

STACK_TEXT:
ef4d3c40 80634c17 e1036b60 ffffffff e37fe5f0 nt!HvpGetCellMapped+0x5f
ef4d3c5c 806261b7 e1036b60 ffffffff ef4d3c90 nt!CmpGetValueListFromCache+0x33
ef4d3cb4 8061988c e37fe5f0 00000000 00000001 nt!CmEnumerateValueKey+0x81
ef4d3d44 8053c818 000000d8 00000000 00000001 nt!NtEnumerateValueKey+0x1ea
ef4d3d44 7c90eb94 000000d8 00000000 00000001 nt!KiFastCallEntry+0xf8
WARNING: Frame IP not in any known module. Following frames may be wrong.
0007e684 00000000 00000000 00000000 00000000 0x7c90eb94

STACK_COMMAND: kb

FOLLOWUP_IP:
nt!HvpGetCellMapped+5f
8062bfdd 8b4304 mov eax,dword ptr [ebx+4]

SYMBOL_STACK_INDEX: 0

SYMBOL_NAME: nt!HvpGetCellMapped+5f

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nt

IMAGE_NAME: ntkrnlpa.exe

DEBUG_FLR_IMAGE_TIMESTAMP: 42250a95

FAILURE_BUCKET_ID: 0x8E_nt!HvpGetCellMapped+5f

BUCKET_ID: 0x8E_nt!HvpGetCellMapped+5f

Followup: MachineOwner
---------

kd> .bugcheck
Bugcheck code 1000008E
Arguments c0000005 8062bfdd ef4d3b84 00000000

kd> kv
ChildEBP RetAddr Args to Child
ef4d3c40 80634c17 e1036b60 ffffffff e37fe5f0 nt!HvpGetCellMapped+0x5f (FPO: [Non-Fpo])
ef4d3c5c 806261b7 e1036b60 ffffffff ef4d3c90 nt!CmpGetValueListFromCache+0x33 (FPO: [Non-Fpo])
ef4d3cb4 8061988c e37fe5f0 00000000 00000001 nt!CmEnumerateValueKey+0x81 (FPO: [Non-Fpo])
ef4d3d44 8053c818 000000d8 00000000 00000001 nt!NtEnumerateValueKey+0x1ea (FPO: [Non-Fpo])
ef4d3d44 7c90eb94 000000d8 00000000 00000001 nt!KiFastCallEntry+0xf8 (FPO: [0,0] TrapFrame @ ef4d3d64)
WARNING: Frame IP not in any known module. Following frames may be wrong.
0007e684 00000000 00000000 00000000 00000000 0x7c90eb94

kd> .trap ef4d3d64
ErrCode = 00000000
eax=00000000 ebx=7c90d976 ecx=000e7cbe edx=0000004e esi=0007e6b4 edi=0007e5a4
eip=7c90eb94 esp=0007e554 ebp=0007e684 iopl=0 nv up ei pl nz na po nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000202
001b:7c90eb94 ?? ???

kd> kb
*** Stack trace for last set context - .thread/.cxr resets it
ChildEBP RetAddr Args to Child
WARNING: Frame IP not in any known module. Following frames may be wrong.
0007e684 00000000 00000000 00000000 00000000 0x7c90eb94
Click to expand...


KERNEL_MODE_EXCEPTION_NOT_HANDLED_M (1000008e)

Arguments:
Arg1: c0000005, The exception code that was not handled
Arg2: 8062bfdd, The address that the exception occurred at
Arg3: f7bebac8, Trap Frame
Arg4: 00000000

Debugging Details:
------------------

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx". The memory could not be "%s".

FAULTING_IP:
nt!HvpGetCellMapped+5f
8062bfdd 8b4304 mov eax,dword ptr [ebx+4]

TRAP_FRAME: f7bebac8 -- (.trap fffffffff7bebac8)
ErrCode = 00000000
eax=00001ff1 ebx=00001ff1 ecx=81d196c8 edx=000003ff esi=e30ff008 edi=00000fa8
eip=8062bfdd esp=f7bebb3c ebp=f7bebb84 iopl=0 nv up ei pl zr na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010246
nt!HvpGetCellMapped+0x5f:
8062bfdd 8b4304 mov eax,dword ptr [ebx+4] ds:0023:00001ff5=????????
Resetting default scope

CUSTOMER_CRASH_COUNT: 3

DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: 0x8E

PROCESS_NAME: winlogon.exe

LAST_CONTROL_TRANSFER: from 8062d8b8 to 8062bfdd

STACK_TEXT:
f7bebb84 8062d8b8 e30ff008 ffffffa8 d5f62c04 nt!HvpGetCellMapped+0x5f
f7bebbac 8062df69 e30ff008 ffffffa8 e360cb60 nt!CmpCopyValue+0x18
f7bebbf4 8062e420 e30ff008 004a1c00 004f3810 nt!CmpCopyKeyPartial+0x16f
f7bebc34 8062e52d e19e1000 00000400 00000006 nt!CmpCopySyncTree2+0x25a
f7bebc64 8062917c e30ff008 00000020 e360cb60 nt!CmpCopySyncTree+0x4f
f7bebc98 8061711a 00000020 000008e0 00000003 nt!CmSaveKey+0xde
f7bebcbc 8053c818 e3617bf8 000008e0 f7bebd54 nt!NtSaveKey+0x78
f7bebcbc 804fe2c5 e3617bf8 000008e0 f7bebd54 nt!KiFastCallEntry+0xf8
f7bebd3c 806170e7 00000094 000008e0 806170a2 nt!ZwSaveKey+0x11
f7bebd54 8053c818 00000094 000008e0 0006f8b8 nt!NtSaveKey+0x45
f7bebd54 7c90eb94 00000094 000008e0 0006f8b8 nt!KiFastCallEntry+0xf8
WARNING: Frame IP not in any known module. Following frames may be wrong.
0006f8b8 00000000 00000000 00000000 00000000 0x7c90eb94


STACK_COMMAND: kb

FOLLOWUP_IP:
nt!HvpGetCellMapped+5f
8062bfdd 8b4304 mov eax,dword ptr [ebx+4]

SYMBOL_STACK_INDEX: 0

SYMBOL_NAME: nt!HvpGetCellMapped+5f

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nt

IMAGE_NAME: ntkrnlpa.exe

DEBUG_FLR_IMAGE_TIMESTAMP: 42250a95

FAILURE_BUCKET_ID: 0x8E_nt!HvpGetCellMapped+5f

BUCKET_ID: 0x8E_nt!HvpGetCellMapped+5f

Followup: MachineOwner
---------

kd> .bugcheck
Bugcheck code 1000008E
Arguments c0000005 8062bfdd f7bebac8 00000000

kd> kv
ChildEBP RetAddr Args to Child
f7bebb84 8062d8b8 e30ff008 ffffffa8 d5f62c04 nt!HvpGetCellMapped+0x5f (FPO: [Non-Fpo])
f7bebbac 8062df69 e30ff008 ffffffa8 e360cb60 nt!CmpCopyValue+0x18 (FPO: [Non-Fpo])
f7bebbf4 8062e420 e30ff008 004a1c00 004f3810 nt!CmpCopyKeyPartial+0x16f (FPO: [Non-Fpo])
f7bebc34 8062e52d e19e1000 00000400 00000006 nt!CmpCopySyncTree2+0x25a (FPO: [Non-Fpo])
f7bebc64 8062917c e30ff008 00000020 e360cb60 nt!CmpCopySyncTree+0x4f (FPO: [Non-Fpo])
f7bebc98 8061711a 00000020 000008e0 00000003 nt!CmSaveKey+0xde (FPO: [Non-Fpo])
f7bebcbc 8053c818 e3617bf8 000008e0 f7bebd54 nt!NtSaveKey+0x78 (FPO: [Non-Fpo])
f7bebcbc 804fe2c5 e3617bf8 000008e0 f7bebd54 nt!KiFastCallEntry+0xf8 (FPO: [0,0] TrapFrame @ f7bebccc)
f7bebd3c 806170e7 00000094 000008e0 806170a2 nt!ZwSaveKey+0x11 (FPO: [2,0,0])
f7bebd54 8053c818 00000094 000008e0 0006f8b8 nt!NtSaveKey+0x45 (FPO: [Non-Fpo])
f7bebd54 7c90eb94 00000094 000008e0 0006f8b8 nt!KiFastCallEntry+0xf8 (FPO: [0,0] TrapFrame @ f7bebd64)
WARNING: Frame IP not in any known module. Following frames may be wrong.
0006f8b8 00000000 00000000 00000000 00000000 0x7c90eb94

kd> .trap f7bebccc
ErrCode = 00000000
eax=f7bebd28 ebx=80617001 ecx=805ec8c8 edx=f7bebd64 esi=0006f878 edi=f7bebd64
eip=804fe2c5 esp=f7bebd40 ebp=f7bebd54 iopl=0 nv up ei pl zr na pe nc
cs=0008 ss=0010 ds=f878 es=b225 fs=0030 gs=bd08 efl=00000246
nt!ZwSaveKey+0x11:
804fe2c5 c20800 ret 8

kd> .trap f7bebd64
ErrCode = 00000000
eax=0006f8ec ebx=00000094 ecx=0006f8ec edx=7c90eb94 esi=00000000 edi=00000000
eip=7c90eb94 esp=0006f868 ebp=0006f8b8 iopl=0 nv up ei pl zr na pe nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000246
001b:7c90eb94 ?? ???
kd> kb
*** Stack trace for last set context - .thread/.cxr resets it
ChildEBP RetAddr Args to Child
WARNING: Frame IP not in any known module. Following frames may be wrong.
0006f8b8 00000000 00000000 00000000 00000000 0x7c90eb94
Click to expand...
 
And here are two more:

KERNEL_MODE_EXCEPTION_NOT_HANDLED_M (1000008e)

Arguments:
Arg1: c0000005, The exception code that was not handled
Arg2: 805418bd, The address that the exception occurred at
Arg3: efa453c4, Trap Frame
Arg4: 00000000

Debugging Details:
------------------

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx". The memory could not be "%s".

FAULTING_IP:
nt!__InterlockedDecrement+5
805418bd 0fc101 xadd dword ptr [ecx],eax

TRAP_FRAME: efa453c4 -- (.trap ffffffffefa453c4)
ErrCode = 00000002
eax=ffffffff ebx=00000000 ecx=00000ff0 edx=e470d008 esi=00000ff0 edi=e2267ed8
eip=805418bd esp=efa45438 ebp=efa45440 iopl=0 nv up ei pl nz na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010206
nt!__InterlockedDecrement+0x5:
805418bd 0fc101 xadd dword ptr [ecx],eax ds:0023:00000ff0=????????
Resetting default scope

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: 0x8E

PROCESS_NAME: aim.exe

LAST_CONTROL_TRANSFER: from bf80804f to 805418bd

STACK_TEXT:
efa45434 bf80804f e470d424 efa45468 bf8078b0 nt!__InterlockedDecrement+0x5
efa45440 bf8078b0 00000000 e18f8d10 e23f9008 win32k!RBRUSH::vRemoveRef+0xe
efa45468 bf805319 e470d008 e1070008 e18f8d10 win32k!EBRUSHOBJ::vInitBrush+0x22d
efa454a4 bf8087d7 e470d424 efa454f8 efa454dc win32k!GrePatBltLockedDC+0x190
efa4553c bf80d4e7 efa45574 0000f0f0 efa45594 win32k!GrePolyPatBltInternal+0x17c
efa4556c bf8ab14e e470d008 00f00021 efa45594 win32k!GrePolyPatBlt+0x42
efa455e8 bf8ab565 cf011877 00000000 00f00021 win32k!DrawFrame+0xed
efa45660 bf823219 bbf549c0 cf011877 0000980c win32k!xxxDrawCaptionBar+0x225
efa456a4 bf8095ce bbf549c0 cf011877 00000000 win32k!xxxDrawWindowFrame+0x13d
efa45704 bf80f55e bbf549c0 00000085 00000001 win32k!xxxRealDefWindowProc+0x7a7
efa4571c bf81bd6c bbf549c0 00000085 00000001 win32k!xxxWrapRealDefWindowProc+0x16
efa45738 bf80f7a5 bbf549c0 00000085 00000001 win32k!NtUserfnDWORD+0x27
efa45770 8053c818 000c0148 00000085 00000001 win32k!NtUserMessageCall+0xae
efa45770 7c90eb94 000c0148 00000085 00000001 nt!KiFastCallEntry+0xf8
WARNING: Frame IP not in any known module. Following frames may be wrong.
0012f6d8 00000000 00000000 00000000 00000000 0x7c90eb94

STACK_COMMAND: kb

FOLLOWUP_IP:
win32k!RBRUSH::vRemoveRef+e
bf80804f 85c0 test eax,eax

SYMBOL_STACK_INDEX: 1

SYMBOL_NAME: win32k!RBRUSH::vRemoveRef+e

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: win32k

IMAGE_NAME: win32k.sys

DEBUG_FLR_IMAGE_TIMESTAMP: 43446b4e

FAILURE_BUCKET_ID: 0x8E_win32k!RBRUSH::vRemoveRef+e

BUCKET_ID: 0x8E_win32k!RBRUSH::vRemoveRef+e

Followup: MachineOwner
---------

kd> .bugcheck
Bugcheck code 1000008E
Arguments c0000005 805418bd efa453c4 00000000

kd> kv
ChildEBP RetAddr Args to Child
efa45434 bf80804f e470d424 efa45468 bf8078b0 nt!__InterlockedDecrement+0x5 (FPO: [0,0,0])
efa45440 bf8078b0 00000000 e18f8d10 e23f9008 win32k!RBRUSH::vRemoveRef+0xe (FPO: [Non-Fpo])
efa45468 bf805319 e470d008 e1070008 e18f8d10 win32k!EBRUSHOBJ::vInitBrush+0x22d (FPO: [Non-Fpo])
efa454a4 bf8087d7 e470d424 efa454f8 efa454dc win32k!GrePatBltLockedDC+0x190 (FPO: [Non-Fpo])
efa4553c bf80d4e7 efa45574 0000f0f0 efa45594 win32k!GrePolyPatBltInternal+0x17c (FPO: [Non-Fpo])
efa4556c bf8ab14e e470d008 00f00021 efa45594 win32k!GrePolyPatBlt+0x42 (FPO: [Non-Fpo])
efa455e8 bf8ab565 cf011877 00000000 00f00021 win32k!DrawFrame+0xed (FPO: [Non-Fpo])
efa45660 bf823219 bbf549c0 cf011877 0000980c win32k!xxxDrawCaptionBar+0x225 (FPO: [Non-Fpo])
efa456a4 bf8095ce bbf549c0 cf011877 00000000 win32k!xxxDrawWindowFrame+0x13d (FPO: [Non-Fpo])
efa45704 bf80f55e bbf549c0 00000085 00000001 win32k!xxxRealDefWindowProc+0x7a7 (FPO: [Non-Fpo])
efa4571c bf81bd6c bbf549c0 00000085 00000001 win32k!xxxWrapRealDefWindowProc+0x16 (FPO: [Non-Fpo])
efa45738 bf80f7a5 bbf549c0 00000085 00000001 win32k!NtUserfnDWORD+0x27 (FPO: [Non-Fpo])
efa45770 8053c818 000c0148 00000085 00000001 win32k!NtUserMessageCall+0xae (FPO: [Non-Fpo])
efa45770 7c90eb94 000c0148 00000085 00000001 nt!KiFastCallEntry+0xf8 (FPO: [0,0] TrapFrame @ efa45794)
WARNING: Frame IP not in any known module. Following frames may be wrong.
0012f6d8 00000000 00000000 00000000 00000000 0x7c90eb94

kd> .trap efa45794
ErrCode = 00000000
eax=efa457e8 ebx=004d15e8 ecx=bf800b66 edx=00000000 esi=007149c0 edi=00000085
eip=7c90eb94 esp=0012f688 ebp=0012f6d8 iopl=0 nv up ei pl zr na pe nc
cs=001b ss=0023 ds=57d8 es=6e40 fs=003b gs=0414 efl=00200246
001b:7c90eb94 ?? ???
Click to expand...

KERNEL_MODE_EXCEPTION_NOT_HANDLED_M (1000008e)

Arguments:
Arg1: c0000005, The exception code that was not handled
Arg2: 80543e61, The address that the exception occurred at
Arg3: efb8fb84, Trap Frame
Arg4: 00000000

Debugging Details:
------------------

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx". The memory could not be "%s".

FAULTING_IP:
nt!ExFreePoolWithTag+47b
80543e61 813b80000000 cmp dword ptr [ebx],80h

TRAP_FRAME: efb8fb84 -- (.trap ffffffffefb8fb84)
ErrCode = 00000000
eax=00000000 ebx=00000024 ecx=00000000 edx=ff76a3c8 esi=e3628c28 edi=00000000
eip=80543e61 esp=efb8fbf8 ebp=efb8fc2c iopl=0 nv up ei pl nz na po nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010202
nt!ExFreePoolWithTag+0x47b:
80543e61 813b80000000 cmp dword ptr [ebx],80h ds:0023:00000024=????????
Resetting default scope

CUSTOMER_CRASH_COUNT: 2

DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: 0x8E

PROCESS_NAME: iTunes.exe

LAST_CONTROL_TRANSFER: from bf802aab to 80543e61

STACK_TEXT:
efb8fc2c bf802aab e3628c30 00000000 efb8fc48 nt!ExFreePoolWithTag+0x47b
efb8fc3c bf800b73 e3628c30 efb8fc58 bf805a1c win32k!HeavyFreePool+0xbb
efb8fc48 bf805a1c 822a4938 e3628c30 efb8fcac win32k!ExFreeToPagedLookasideList+0x1e
efb8fc58 bf80b781 e3628c30 00000005 e3d7a008 win32k!FreeObject+0x25
efb8fcac bf80b8a0 00000000 00000000 efb8fcec win32k!SURFACE::bDeleteSurface+0x14b
efb8fcbc bf80a909 00000000 00000000 00000001 win32k!SURFREF::bDeleteSurface+0x12
efb8fcec bf80642b e226a890 e3628c30 01050bcf win32k!hbmSelectBitmap+0x285
efb8fd28 bf80c490 00000000 bf810293 e3d7a008 win32k!XDCOBJ::bCleanDC+0x9e
efb8fd3c bf8102e4 01010bd0 00000000 00000000 win32k!bDeleteDCInternal+0x26
efb8fd58 8053c818 01010bd0 0012f7f4 7c90eb94 win32k!NtGdiDeleteObjectApp+0x88
efb8fd58 7c90eb94 01010bd0 0012f7f4 7c90eb94 nt!KiFastCallEntry+0xf8
WARNING: Frame IP not in any known module. Following frames may be wrong.
0012f7f4 00000000 00000000 00000000 00000000 0x7c90eb94


STACK_COMMAND: kb

FOLLOWUP_IP:
win32k!HeavyFreePool+bb
bf802aab 5d pop ebp

SYMBOL_STACK_INDEX: 1

SYMBOL_NAME: win32k!HeavyFreePool+bb

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: win32k

IMAGE_NAME: win32k.sys

DEBUG_FLR_IMAGE_TIMESTAMP: 43446b4e

FAILURE_BUCKET_ID: 0x8E_win32k!HeavyFreePool+bb

BUCKET_ID: 0x8E_win32k!HeavyFreePool+bb

Followup: MachineOwner
---------

kd> kv
ChildEBP RetAddr Args to Child
efb8fc2c bf802aab e3628c30 00000000 efb8fc48 nt!ExFreePoolWithTag+0x47b (FPO: [Non-Fpo])
efb8fc3c bf800b73 e3628c30 efb8fc58 bf805a1c win32k!HeavyFreePool+0xbb (FPO: [Non-Fpo])
efb8fc48 bf805a1c 822a4938 e3628c30 efb8fcac win32k!ExFreeToPagedLookasideList+0x1e (FPO: [Non-Fpo])
efb8fc58 bf80b781 e3628c30 00000005 e3d7a008 win32k!FreeObject+0x25 (FPO: [Non-Fpo])
efb8fcac bf80b8a0 00000000 00000000 efb8fcec win32k!SURFACE::bDeleteSurface+0x14b (FPO: [Non-Fpo])
efb8fcbc bf80a909 00000000 00000000 00000001 win32k!SURFREF::bDeleteSurface+0x12 (FPO: [Non-Fpo])
efb8fcec bf80642b e226a890 e3628c30 01050bcf win32k!hbmSelectBitmap+0x285 (FPO: [Non-Fpo])
efb8fd28 bf80c490 00000000 bf810293 e3d7a008 win32k!XDCOBJ::bCleanDC+0x9e (FPO: [Non-Fpo])
efb8fd3c bf8102e4 01010bd0 00000000 00000000 win32k!bDeleteDCInternal+0x26 (FPO: [Non-Fpo])
efb8fd58 8053c818 01010bd0 0012f7f4 7c90eb94 win32k!NtGdiDeleteObjectApp+0x88 (FPO: [Non-Fpo])
efb8fd58 7c90eb94 01010bd0 0012f7f4 7c90eb94 nt!KiFastCallEntry+0xf8 (FPO: [0,0] TrapFrame @ efb8fd64)
WARNING: Frame IP not in any known module. Following frames may be wrong.
0012f7f4 00000000 00000000 00000000 00000000 0x7c90eb94

kd> .trap efb8fd64
ErrCode = 00000000
eax=0291aecc ebx=01010bd0 ecx=00000000 edx=0291aecc esi=00000000 edi=00000000
eip=7c90eb94 esp=0012f7d0 ebp=0012f7f4 iopl=0 nv up ei pl zr na pe nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00200246
001b:7c90eb94 ?? ???
Click to expand...
 
Hi,

The first crash is related to hive corrruption (ie registry). It may be caused by faulty ram or the registry is really corrupted.

STACK_TEXT:
ef4d3c40 80634c17 e1036b60 ffffffff e37fe5f0 nt!HvpGetCellMapped+0x5f
ef4d3c5c 806261b7 e1036b60 ffffffff ef4d3c90 nt!CmpGetValueListFromCache+0x33
ef4d3cb4 8061988c e37fe5f0 00000000 00000001 nt!CmEnumerateValueKey+0x81
ef4d3d44 8053c818 000000d8 00000000 00000001 nt!NtEnumerateValueKey+0x1ea
ef4d3d44 7c90eb94 000000d8 00000000 00000001 nt!KiFastCallEntry+0xf8
WARNING: Frame IP not in any known module. Following frames may be wrong.

The second crash is related to faulty ram (ie RAM or video RAM).
 
Registry problems

Maybe I should rename the thread to BSOD Registry Problems.

I used regedit to backup the HKEYs, but I got a BSOD three times in row while exporting HKEY_LOCAL_MACHINE. The weird thing is that the other four HKEYs export fine. This is the first time something I did triggered the BSODs. Is this consistent with hive corruption or something else? Thanks!

KERNEL_MODE_EXCEPTION_NOT_HANDLED_M (1000008e)

Arguments:
Arg1: c0000005, The exception code that was not handled
Arg2: 8062bfdd, The address that the exception occurred at
Arg3: f04d2b84, Trap Frame
Arg4: 00000000

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx". The memory could not be "%s".

FAULTING_IP:
nt!HvpGetCellMapped+5f
8062bfdd 8b4304 mov eax,dword ptr [ebx+4]

TRAP_FRAME: f04d2b84 -- (.trap fffffffff04d2b84)
ErrCode = 00000000
eax=00009ff0 ebx=00009ff0 ecx=82daf3e0 edx=000003ff esi=e1036b60 edi=00000fff
eip=8062bfdd esp=f04d2bf8 ebp=f04d2c40 iopl=0 nv up ei pl zr na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010246
nt!HvpGetCellMapped+0x5f:
8062bfdd 8b4304 mov eax,dword ptr [ebx+4] ds:0023:00009ff4=????????
Resetting default scope

CUSTOMER_CRASH_COUNT: 3

DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: 0x8E

PROCESS_NAME: regedit.exe

LAST_CONTROL_TRANSFER: from 80634c17 to 8062bfdd

STACK_TEXT:
f04d2c40 80634c17 e1036b60 ffffffff e23f1320 nt!HvpGetCellMapped+0x5f
f04d2c5c 806261b7 e1036b60 ffffffff f04d2c90 nt!CmpGetValueListFromCache+0x33
f04d2cb4 8061988c e23f1320 00000000 00000001 nt!CmEnumerateValueKey+0x81
f04d2d44 8053c818 00000588 00000000 00000001 nt!NtEnumerateValueKey+0x1ea
f04d2d44 7c90eb94 00000588 00000000 00000001 nt!KiFastCallEntry+0xf8
WARNING: Frame IP not in any known module. Following frames may be wrong.
0007e900 00000000 00000000 00000000 00000000 0x7c90eb94


STACK_COMMAND: kb

FOLLOWUP_IP:
nt!HvpGetCellMapped+5f
8062bfdd 8b4304 mov eax,dword ptr [ebx+4]

SYMBOL_STACK_INDEX: 0

SYMBOL_NAME: nt!HvpGetCellMapped+5f

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nt

IMAGE_NAME: ntkrnlpa.exe

DEBUG_FLR_IMAGE_TIMESTAMP: 42250a95

FAILURE_BUCKET_ID: 0x8E_nt!HvpGetCellMapped+5f

BUCKET_ID: 0x8E_nt!HvpGetCellMapped+5f

Followup: MachineOwner
Click to expand...

KERNEL_MODE_EXCEPTION_NOT_HANDLED_M (1000008e)

Arguments:
Arg1: c0000005, The exception code that was not handled
Arg2: 8062bfdd, The address that the exception occurred at
Arg3: f0807b84, Trap Frame
Arg4: 00000000

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx". The memory could not be "%s".

FAULTING_IP:
nt!HvpGetCellMapped+5f
8062bfdd 8b4304 mov eax,dword ptr [ebx+4]

TRAP_FRAME: f0807b84 -- (.trap fffffffff0807b84)
ErrCode = 00000000
eax=00009ff0 ebx=00009ff0 ecx=82daf3e0 edx=000003ff esi=e1036b60 edi=00000fff
eip=8062bfdd esp=f0807bf8 ebp=f0807c40 iopl=0 nv up ei pl zr na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010246
nt!HvpGetCellMapped+0x5f:
8062bfdd 8b4304 mov eax,dword ptr [ebx+4] ds:0023:00009ff4=????????
Resetting default scope

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: 0x8E

PROCESS_NAME: regedit.exe

LAST_CONTROL_TRANSFER: from 80634c17 to 8062bfdd

STACK_TEXT:
f0807c40 80634c17 e1036b60 ffffffff e31005f0 nt!HvpGetCellMapped+0x5f
f0807c5c 806261b7 e1036b60 ffffffff f0807c90 nt!CmpGetValueListFromCache+0x33
f0807cb4 8061988c e31005f0 00000000 00000001 nt!CmEnumerateValueKey+0x81
f0807d44 8053c818 000000d4 00000000 00000001 nt!NtEnumerateValueKey+0x1ea
f0807d44 7c90eb94 000000d4 00000000 00000001 nt!KiFastCallEntry+0xf8
WARNING: Frame IP not in any known module. Following frames may be wrong.
0007e900 00000000 00000000 00000000 00000000 0x7c90eb94


STACK_COMMAND: kb

FOLLOWUP_IP:
nt!HvpGetCellMapped+5f
8062bfdd 8b4304 mov eax,dword ptr [ebx+4]

SYMBOL_STACK_INDEX: 0

SYMBOL_NAME: nt!HvpGetCellMapped+5f

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nt

IMAGE_NAME: ntkrnlpa.exe

DEBUG_FLR_IMAGE_TIMESTAMP: 42250a95

FAILURE_BUCKET_ID: 0x8E_nt!HvpGetCellMapped+5f

BUCKET_ID: 0x8E_nt!HvpGetCellMapped+5f

Followup: MachineOwner
Click to expand...

KERNEL_MODE_EXCEPTION_NOT_HANDLED_M (1000008e)

Arguments:
Arg1: c0000005, The exception code that was not handled
Arg2: 8062bfdd, The address that the exception occurred at
Arg3: efbf76b4, Trap Frame
Arg4: 00000000

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx". The memory could not be "%s".

FAULTING_IP:
nt!HvpGetCellMapped+5f
8062bfdd 8b4304 mov eax,dword ptr [ebx+4]

TRAP_FRAME: efbf76b4 -- (.trap ffffffffefbf76b4)
ErrCode = 00000000
eax=00009ff0 ebx=00009ff0 ecx=82daf3e0 edx=000003ff esi=e1036b60 edi=00000fff
eip=8062bfdd esp=efbf7728 ebp=efbf7770 iopl=0 nv up ei pl zr na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010246
nt!HvpGetCellMapped+0x5f:
8062bfdd 8b4304 mov eax,dword ptr [ebx+4] ds:0023:00009ff4=????????
Resetting default scope

CUSTOMER_CRASH_COUNT: 2

DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: 0x8E

PROCESS_NAME: regedit.exe

LAST_CONTROL_TRANSFER: from 80634c17 to 8062bfdd

STACK_TEXT:
efbf7770 80634c17 e1036b60 ffffffff e3662170 nt!HvpGetCellMapped+0x5f
efbf778c 806261b7 e1036b60 ffffffff efbf77c0 nt!CmpGetValueListFromCache+0x33
efbf77e4 8061988c e3662170 00000000 00000001 nt!CmEnumerateValueKey+0x81
efbf7874 8053c818 000000e0 00000000 00000001 nt!NtEnumerateValueKey+0x1ea
efbf7874 7c90eb94 000000e0 00000000 00000001 nt!KiFastCallEntry+0xf8
WARNING: Frame IP not in any known module. Following frames may be wrong.
0007e660 00000000 00000000 00000000 00000000 0x7c90eb94


STACK_COMMAND: kb

FOLLOWUP_IP:
nt!HvpGetCellMapped+5f
8062bfdd 8b4304 mov eax,dword ptr [ebx+4]

SYMBOL_STACK_INDEX: 0

SYMBOL_NAME: nt!HvpGetCellMapped+5f

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nt

IMAGE_NAME: ntkrnlpa.exe

DEBUG_FLR_IMAGE_TIMESTAMP: 42250a95

FAILURE_BUCKET_ID: 0x8E_nt!HvpGetCellMapped+5f

BUCKET_ID: 0x8E_nt!HvpGetCellMapped+5f

Followup: MachineOwner
Click to expand...
 
Hi,

Do you mean your windows crashes when you running regedit export? If yes, your registry is corrupted. I believe that your registry maybe corrupted due to faulty ram.
 
Hi CPC,

Yes, Windows crashes while exporting, but only for HKEY_LOCAL_MACHINE. I removed the RAM that was clearly faulty, so I don't know why I still get the BSODs
 
Hi,

When did you replace the faulty ram? If the software hive is corrupted, you have to repair it. Otherwise your windows crashes, when the corrupted software hive are referred by windows.
 
I had two RAM DIMMs and one had MemTest errors. I removed it over a month ago and the other DIMM tested out ok in Memtest. I have yet to replace the faulty RAM, so now I only use the one DIMM that tested ok.
 

Similar threads

Raii722
BSOD. ntoskrnl.exe error. help needed as i tried everything
Replies
0
Views
532
Raii722
Raii722
Daniel Sims
The Atari ST was eight years too early for Doom, but not anymore
Replies
4
Views
57
Jonny5
Jonny5
S
Problem with computer installation
Replies
0
Views
137
Smilady
S

Latest posts

Back