[Nichtsicher]

Hi guys

Im currently having some issues with BSOD in vista ultimate (build 6600). its always the same two errors they just altinate basically when it happens each time. They are pretty frequent

here are the Stop codes.


0x00000050 (oxf273ed38, 0x00000001,0x00000002)

0x0000000a (0x0662080c, 0x0000001b,0x00000000, 0x8ica96139)
(Page fault in non page area)

Ive got alot of memory dumps which i cant open because I cant give Windbg permission to open the file (im new with vista)

My system specs are

CPU: Intel Core2 Extreme 9650 3.0ghz
Mobo: Asus Striker 2 Forumla
HDD: Seagate Barracudda 500gb 32mb chache
GPU: Elite group 8400gs 256mb
RAM: corsair xms ddr2 4gb CM2X2048-6400C5 DDR2-SDRAM PC2-6400 (399 MHz) - [DDR2-800]

Ive tried every hardware test under the sun Ive had memtest go for 8 hours ive done a disk scan in windows and taken one stick of ram out and replaced it with others

if anyone wants me to email them my memory dumps just pm me and id be happy to

Thanks

[Rollin' Rog]

First the most important part of a STOP message like that is the driver file mentioned, if you see one.

When did these problems begin? If you can pinpoint a time period , you might be able to relate them to a change.

I don't know why you are having problems with windbg, but you can try right clicking on the EXE and choose to run it in administrative mode.

I can run a debugging utility on the dump files if you do this:

1 > create a new folder on the desktop and call it "dumpcheck" or whatever you like
2 > navigate to %systemroot%\minidump and copy the last few minidump files to that folder.%systemroot% is normally c:\windows. They are numbered by date. You can paste that address in address bar to get there.
3 > close the folder and right click on it and select Send to Compressed (zipped) Folder.
4 > use the "manage attachments" in the "advanced" reply window to upload that zip file here as an attachment.

[Nichtsicher]

Done and done. I built the computer myself. I used to have win xp which used to get alot more of the BSOD's now I have vista and its still doing it

[Nichtsicher]

ok i got the debugger to work. can someone please help me? this is just one of my growing collection of mini dumps


Microsoft (R) Windows Debugger Version 6.8.0004.0 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Windows\Minidump\Mini030108-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is:
SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows Vista Kernel Version 6000 MP (4 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 6000.16584.x86fre.vista_gdr.071023-1545
Kernel base = 0x81800000 PsLoadedModuleList = 0x81911e10
Debug session time: Sat Mar 1 20:10:22.713 2008 (GMT+11)
System Uptime: 0 days 3:45:15.835
Loading Kernel Symbols
........................................................................... .......................................................................
Loading User Symbols
Loading unloaded module list
...........
*************************************************************************** ****
* *
* Bugcheck Analysis *
* *
*************************************************************************** ****

Use !analyze -v to get detailed debugging information.

BugCheck A, {7c698c4, 1b, 0, 818a96b9}



Probably caused by : ntkrpamp.exe ( nt!KiTimerExpiration+184 )

Followup: MachineOwner
---------

0: kd> !analyze -v
*************************************************************************** ****
* *
* Bugcheck Analysis *
* *
*************************************************************************** ****

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 07c698c4, memory referenced
Arg2: 0000001b, IRQL
Arg3: 00000000, bitfield :
bit 0 : value 0 = read operation, 1 = write operation
bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: 818a96b9, address which referenced memory

Debugging Details:
------------------




READ_ADDRESS: GetPointerFromAddress: unable to read from 819315ac
Unable to read MiSystemVaType memory at 819117e0
07c698c4

CURRENT_IRQL: 1b

FAULTING_IP:
nt!KiTimerExpiration+184
818a96b9 8b4614 mov eax,dword ptr [esi+14h]

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT

BUGCHECK_STR: 0xA

PROCESS_NAME: Idle

TRAP_FRAME: 818f1b94 -- (.trap 0xffffffff818f1b94)
ErrCode = 00000000
eax=07c698c8 ebx=ffdf000c ecx=818f8f60 edx=000005a0 esi=07c698b0 edi=818f4ce8
eip=818a96b9 esp=818f1c08 ebp=818f1ce8 iopl=0 ov up ei ng nz na po cy
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010a83
nt!KiTimerExpiration+0x184:
818a96b9 8b4614 mov eax,dword ptr [esi+14h] ds:0023:07c698c4=????????
Resetting default scope

LAST_CONTROL_TRANSFER: from 818a96b9 to 8188fd84

STACK_TEXT:
818f1b94 818a96b9 badb0d00 000005a0 00000002 nt!KiTrap0E+0x2ac
818f1ce8 818a9321 00000000 00000000 000d385a nt!KiTimerExpiration+0x184
818f1d50 818913ee 00000000 0000000e 00000000 nt!KiRetireDpcList+0xba
818f1d54 00000000 0000000e 00000000 00000000 nt!KiIdleLoop+0x46


STACK_COMMAND: kb

FOLLOWUP_IP:
nt!KiTimerExpiration+184
818a96b9 8b4614 mov eax,dword ptr [esi+14h]

SYMBOL_STACK_INDEX: 1

SYMBOL_NAME: nt!KiTimerExpiration+184

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nt

IMAGE_NAME: ntkrpamp.exe

DEBUG_FLR_IMAGE_TIMESTAMP: 471ea39c

FAILURE_BUCKET_ID: 0xA_nt!KiTimerExpiration+184

BUCKET_ID: 0xA_nt!KiTimerExpiration+184

Followup: MachineOwner
---------

[Nichtsicher]

here is another. which is another error



Loading Dump File [C:\Windows\Minidump\Mini030208-02.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is:
SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows Vista Kernel Version 6000 MP (4 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 6000.16584.x86fre.vista_gdr.071023-1545
Kernel base = 0x81c00000 PsLoadedModuleList = 0x81d11e10
Debug session time: Sun Mar 2 13:41:48.524 2008 (GMT+11)
System Uptime: 0 days 1:37:07.631
Loading Kernel Symbols
........................................................................... .......................................................................
Loading User Symbols
Loading unloaded module list
...........
*************************************************************************** ****
* *
* Bugcheck Analysis *
* *
*************************************************************************** ****

Use !analyze -v to get detailed debugging information.

BugCheck C5, {1cfe3ac, 2, 1, 81ce7610}



Probably caused by : hidusb.sys ( hidusb!HumReadReport+ed )

Followup: MachineOwner
---------

0: kd> !analyze -v
*************************************************************************** ****
* *
* Bugcheck Analysis *
* *
*************************************************************************** ****

DRIVER_CORRUPTED_EXPOOL (c5)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is
caused by drivers that have corrupted the system pool. Run the driver
verifier against any new (or suspect) drivers, and if that doesn't turn up
the culprit, then use gflags to enable special pool.
Arguments:
Arg1: 01cfe3ac, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000001, value 0 = read operation, 1 = write operation
Arg4: 81ce7610, address which referenced memory

Debugging Details:
------------------




BUGCHECK_STR: 0xC5_2

CURRENT_IRQL: 2

FAULTING_IP:
nt!ExAllocatePoolWithTag+605
81ce7610 8902 mov dword ptr [edx],eax

CUSTOMER_CRASH_COUNT: 2

DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT

PROCESS_NAME: Idle

TRAP_FRAME: 81cf184c -- (.trap 0xffffffff81cf184c)
ErrCode = 00000002
eax=85fbca90 ebx=000001ff ecx=81cfe3ac edx=01cfe3ac esi=81cfe100 edi=85fbcd08
eip=81ce7610 esp=81cf18c0 ebp=81cf1908 iopl=0 nv up ei pl nz na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010206
nt!ExAllocatePoolWithTag+0x605:
81ce7610 8902 mov dword ptr [edx],eax ds:0023:01cfe3ac=????????
Resetting default scope

LAST_CONTROL_TRANSFER: from 81ce7610 to 81c8fd84

STACK_TEXT:
81cf184c 81ce7610 badb0d00 01cfe3ac 00000000 nt!KiTrap0E+0x2ac
81cf1908 8d3963c0 00000000 000002ec 70627375 nt!ExAllocatePoolWithTag+0x605
81cf1920 8d39b1bc 81cf195c 00000000 000002ec USBPORT!UsbAllocPool_Z+0x2e
81cf1964 8d39ba35 87e7d028 85e00fa0 8aabc398 USBPORT!USBPORT_Core_AllocTransferEx+0x187
81cf198c 8d39f0df 87e7d028 85e00fa0 8aabc398 USBPORT!USBPORT_Core_AllocTransfer+0x20
81cf19cc 8d39f5bb 87fc6028 87e7d028 87a188c0 USBPORT!USBPORT_ProcessURB+0x7c2
81cf19f8 8d39681e 87fc6028 87a188c0 85eb9ab8 USBPORT!USBPORT_PdoInternalDeviceControlIrp+0x198
81cf1a24 81c27f83 87fc6028 85eb9ab8 87a188c0 USBPORT!USBPORT_Dispatch+0x31a
81cf1a3c 8e820e67 87a188c0 8b00b7b8 00000000 nt!IofCallDriver+0x63
81cf1a50 8e82113c 885690e0 8b00b700 87a188c0 usbhub!UsbhFdoUrbPdoFilter+0x68
81cf1a74 8e820c92 8b00b700 87a189e4 8b00b700 usbhub!UsbhPdoInternalDeviceControl+0xf6
81cf1a88 81c27f83 8b00b700 87a188c0 887ac7c0 usbhub!UsbhGenDispatch+0x4a
81cf1aa0 8ea4c556 887a6d50 887ac7c0 85e00fa0 nt!IofCallDriver+0x63
81cf1ab4 8ea49bb5 887ac7c0 8b00b700 87a188c0 usbccgp!UsbcForwardIrp+0x4c
81cf1ae0 8ea49dff 00000000 87a188c0 87a188c0 usbccgp!DispatchPdoUrb+0xef
81cf1afc 8ea483ed 887a6d50 00220003 81cf1b3c usbccgp!DispatchPdoInternalDeviceControl+0x17b
81cf1b0c 8ea48675 887a6d48 87a188c0 87a188c0 usbccgp!USBC_InternalDeviceControl+0x25
81cf1b3c 81c27f83 887a6c90 00a188c0 85e00fa0 usbccgp!USBC_Dispatch+0x1d5
81cf1b54 8d2c0cb3 87a188c0 887b2a68 8880caa8 nt!IofCallDriver+0x63
81cf1b74 8d2c02cb 887b2c58 8a0c5088 81cf1b93 hidusb!HumReadReport+0xed
81cf1b94 83361a5d 887b2c58 87a188c0 87a188c0 hidusb!HumInternalIoctl+0x75
81cf1ba8 83362dea 887b2c58 87a188c0 87a18a0b HIDCLASS!HidpCallDriver+0x3f
81cf1bc4 83362d3c 887b2d24 8880caa8 81cf1c07 HIDCLASS!HidpSubmitInterruptRead+0x84
81cf1bf4 81cacb3b 00000000 87a188c0 007b2d24 HIDCLASS!HidpInterruptReadComplete+0x1c4
81cf1c28 8d3982ba 81c91f34 85fd23d8 00000000 nt!IopfCompleteRequest+0x13d
81cf1c64 8d398906 87e7d028 87a188c0 85ecfa60 USBPORT!USBPORT_Core_iCompleteDoneTransfer+0x6cb
81cf1c94 8d39e509 87e7d028 39585043 87e7dbf0 USBPORT!USBPORT_Core_iIrpCsqCompleteDoneTransfer+0x4f5
81cf1cc0 8d3955b9 87e7d028 87e7dbf0 87e7d002 USBPORT!USBPORT_Core_UsbIocDpc_Worker+0x122
81cf1ce8 81ca93ae 87e7dbfc 34776478 00000000 USBPORT!USBPORT_Xdpc_Worker+0x273
81cf1d50 81c913ee 00000000 0000000e 00000000 nt!KiRetireDpcList+0x147
81cf1d54 00000000 0000000e 00000000 00000000 nt!KiIdleLoop+0x46


STACK_COMMAND: kb

FOLLOWUP_IP:
hidusb!HumReadReport+ed
8d2c0cb3 8b4d10 mov ecx,dword ptr [ebp+10h]

SYMBOL_STACK_INDEX: 13

SYMBOL_NAME: hidusb!HumReadReport+ed

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: hidusb

IMAGE_NAME: hidusb.sys

DEBUG_FLR_IMAGE_TIMESTAMP: 4549b265

FAILURE_BUCKET_ID: 0xC5_2_hidusb!HumReadReport+ed

BUCKET_ID: 0xC5_2_hidusb!HumReadReport+ed

Followup: MachineOwner
---------

[Rollin' Rog]

What kind of mouse are you using?

Any USB wireless devices?

[Nichtsicher]

Yes, the wireless natural desktop 7000 from microsoft so its both a wireless keybored and mouse. and they are extremily buggy. it always stops working then starts again.

[Rollin' Rog]

This could be the source of the problem since the hidusb.sys which is one of the faulting modules ( the other is a core memory mapping module) is responsible for detecting USB ports and filtering the data.

I would uninstall those devices and test with a standard keyboard and mouse to see if any new dumps or different types of errors persist.

If you reinstall, do make sure you have the latest drivers from MS -- not just what came with the package.

Make sure you are getting a strong signal from the devices -- I think you probably have some method of switching channels -- and beware of possible interference from other cordless or wireless devices in the area (joysticks will operate on the same frequency, for example).

[Nichtsicher]

Thankyou for your help Im just using some old stuff I had lying around so I will see how that goes. The signal is always strong and the only thing I could think that is interfering is a cordless telephone but that is in another room quite a distance away. Also you mentioned that the other error is a memory mapping area? Does that mean that my RAM is causing the other error and is faulty?

Thanks again

[Rollin' Rog]

Well if it were not for the fact that these two were occuring together I would tell you to suspect the ram.

But you have tested that, and the system driver is likely the victim of another hardware driver such as those associated with your USB wireless devices.

Did you check the MS site for those devices to see if there were any later driver versions?

http://www.microsoft.com/hardware/mo.../Download.mspx

[Nichtsicher]

I did and it still didnt rectify the problem. My old keybored and mouse are doing fine so far. Ill give it a couple of days and see how I go if all is fine ill ask for my keybored and mouse to be replaced.

Thankyou for all your help

[Nichtsicher]

Well 4 minutes after that it did it again haha this was the error...



Microsoft (R) Windows Debugger Version 6.8.0004.0 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Windows\Minidump\Mini030108-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is:
SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows Vista Kernel Version 6000 MP (4 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 6000.16584.x86fre.vista_gdr.071023-1545
Kernel base = 0x81800000 PsLoadedModuleList = 0x81911e10
Debug session time: Sat Mar 1 20:10:22.713 2008 (GMT+11)
System Uptime: 0 days 3:45:15.835
Loading Kernel Symbols
........................................................................... .......................................................................
Loading User Symbols
Loading unloaded module list
...........
*************************************************************************** ****
* *
* Bugcheck Analysis *
* *
*************************************************************************** ****

Use !analyze -v to get detailed debugging information.

BugCheck A, {7c698c4, 1b, 0, 818a96b9}



Probably caused by : ntkrpamp.exe ( nt!KiTimerExpiration+184 )

Followup: MachineOwner
---------

0: kd> !analyze -v
*************************************************************************** ****
* *
* Bugcheck Analysis *
* *
*************************************************************************** ****

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 07c698c4, memory referenced
Arg2: 0000001b, IRQL
Arg3: 00000000, bitfield :
bit 0 : value 0 = read operation, 1 = write operation
bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: 818a96b9, address which referenced memory

Debugging Details:
------------------




READ_ADDRESS: GetPointerFromAddress: unable to read from 819315ac
Unable to read MiSystemVaType memory at 819117e0
07c698c4

CURRENT_IRQL: 1b

FAULTING_IP:
nt!KiTimerExpiration+184
818a96b9 8b4614 mov eax,dword ptr [esi+14h]

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT

BUGCHECK_STR: 0xA

PROCESS_NAME: Idle

TRAP_FRAME: 818f1b94 -- (.trap 0xffffffff818f1b94)
ErrCode = 00000000
eax=07c698c8 ebx=ffdf000c ecx=818f8f60 edx=000005a0 esi=07c698b0 edi=818f4ce8
eip=818a96b9 esp=818f1c08 ebp=818f1ce8 iopl=0 ov up ei ng nz na po cy
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010a83
nt!KiTimerExpiration+0x184:
818a96b9 8b4614 mov eax,dword ptr [esi+14h] ds:0023:07c698c4=????????
Resetting default scope

LAST_CONTROL_TRANSFER: from 818a96b9 to 8188fd84

STACK_TEXT:
818f1b94 818a96b9 badb0d00 000005a0 00000002 nt!KiTrap0E+0x2ac
818f1ce8 818a9321 00000000 00000000 000d385a nt!KiTimerExpiration+0x184
818f1d50 818913ee 00000000 0000000e 00000000 nt!KiRetireDpcList+0xba
818f1d54 00000000 0000000e 00000000 00000000 nt!KiIdleLoop+0x46


STACK_COMMAND: kb

FOLLOWUP_IP:
nt!KiTimerExpiration+184
818a96b9 8b4614 mov eax,dword ptr [esi+14h]

SYMBOL_STACK_INDEX: 1

SYMBOL_NAME: nt!KiTimerExpiration+184

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nt

IMAGE_NAME: ntkrpamp.exe

DEBUG_FLR_IMAGE_TIMESTAMP: 471ea39c

FAILURE_BUCKET_ID: 0xA_nt!KiTimerExpiration+184

BUCKET_ID: 0xA_nt!KiTimerExpiration+184

Followup: MachineOwner
---------

[Rollin' Rog]

Can you zip and upload the minidump here as an attachment. I'd like to have a gander at the entire loaded module list.

Also, just for the heck of it run Vista's built-in memory checker, run mdsched.exe read the additional info and run the extended test.

Is there any pattern to to this -- what are you doing when it occurs?

Also, open the event viewer (run: eventvwr.msc) and look for any disk or NTFS errors in the System log -- or any that are repeating on a regular basis.

>> Do you have a non Windows firewall installed?

edit I just realized you uploaded some minidumps in your first post -- didn't see those before.

They only go up to the 16th though.

I'm seeing a lot of "sygate" drivers in the unloaded module list -- I don't know whether so many or normal for that firewall. And firewalls are always a good suspect for BSODs even when they are not flagged as the faulting application or module.

[Nichtsicher]

I did have sygate personal firewall installed when I had xp but since then I have formatted a couple of times. So no I only have windows firewall running. There really issnt a pattern. Its happend since i first built the thing and had xp although lately it seems to be when I watch videos or play a game. However, it does it also when im not doing anything its just sitting there. When I try to run the eventvwr.msc it comes up with the error 'event log service is unavalible, verify if the service is running'

Thanks

[Rollin' Rog]

Run services.msc and see if the "event log" service is present and set to automatic startup. If it is disabled you can start it from there, but double click it to access its properties and change the startup mode to automatic.

Also upload the last minidump and post a Hijackthis scanlog as well.

Download and install HijackThis. Run it and select "do a system scan and save the log file". Then copy/paste the contents of the log to a reply

http://www.majorgeeks.com/download5554.html

Is this a new or older motherboard that Vista is installed on? Does it have the latest Vista compatible chipset drivers for it? Have you looked for any desirable BIOS upgrades for Vista?

Any chance you could be overheating?

Have you had a close look for things like "bad caps"?

http://www.badcaps.net/ident/

Have you tried running with just one ram module at a time?