1. Computer problem? Tech Support Guy is completely free -- paid for by advertisers and donations. Click here to join today! If you're new to Tech Support Guy, we highly recommend that you visit our Guide for New Members.

Weird WIndows XP BLUE SCREEN problems, help plz?

Discussion in 'Windows XP' started by bbasir, Jan 15, 2006.

Thread Status:
Not open for further replies.
Advertisement
  1. bbasir

    bbasir Thread Starter

    Joined:
    Jan 15, 2006
    Messages:
    4
    Hey Everyone,

    I am running out of ideas here, okay this is the situation. I have built two IDENTICAL computers (IDENTICAL

    HARDWARE). Here is the spec :

    -Amd Athlon64 3200+
    -Asus A8V motherboard (Socket 939 VIA chipset)
    -OCZ 1GB (2x512) DDR 400 RAM
    -Seagate 80GB SATA hard drive
    -Apacer 15-in-1 card reader
    -Pioneer DVR-110 DVD Writer
    -Antec computer case and power supply
    -ATI RAdeon 9600 with 256MB RAM

    Both of these computers have been giving me random blue screens, I am sending a link to the minidumps in

    windows. I have analyzed them both both cannot come to a conclusion. Here is what I've tried :

    -Changed power supply
    -Changed video card
    -Changed RAM
    -BIOS updated
    -Freshly installed XP too many times (Installation of Windows works just fine)

    Problem still continues, only thing that has not changed on both computers is motherboard or CPU. Can anyone

    else help? I really am out of ideas. Anyone really good at analyzing the minidumps? I've done my best and most

    of the time the minidumps direct to .sys files but no way of knowing what's going on here.

    Path to the minidump zip file, if you want analyze them and see if you can help ??

    http://www.pinksolution.ca/webstat/data/minidumps.zip

    I will also attach the file to this post.
     

    Attached Files:

  2. blues_harp28

    blues_harp28 Trusted Advisor Spam Fighter

    Joined:
    Jan 9, 2005
    Messages:
    18,565
    Hi and welcome to TSG..
    Don't know the answer to your problem..hopefully someone will.
     
  3. bbasir

    bbasir Thread Starter

    Joined:
    Jan 15, 2006
    Messages:
    4
    Thanks blues :)

    Okay just wanted to post an update, I will list some onfo from the minidumps for you guys that don't have much time to examine the minidumps.

    Blue screen faults:

    ******************
    ****Computer 1****
    ******************

    *****************************************************************
    1. NTFS_FILE_SYSTEM (24)
    Arguments:
    Arg1: 001902fe
    Arg2: a7384618
    Arg3: a7384314
    Arg4: f7691fe4

    Debugging Details:
    ------------------


    EXCEPTION_RECORD: a7384618 -- (.exr ffffffffa7384618)
    ExceptionAddress: f7691fe4 (Ntfs!NtfsCommonCreate+0x0000147b)
    ExceptionCode: c0000005 (Access violation)
    ExceptionFlags: 00000000
    NumberParameters: 2
    Parameter[0]: 00000000
    Parameter[1]: 18a73870
    Attempt to read from address 18a73870

    CONTEXT: a7384314 -- (.cxr ffffffffa7384314)
    eax=00000000 ebx=a7384970 ecx=f7692909 edx=a7384401 esi=18a73848 edi=00780068
    eip=f7691fe4 esp=a73846e0 ebp=a738481c iopl=0 nv up ei ng nz ac pe cy
    cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010293
    Ntfs!NtfsCommonCreate+0x147b:
    f7691fe4 8b4628 mov eax,[esi+0x28] ds:0023:18a73870=????????
    Resetting default scope

    CUSTOMER_CRASH_COUNT: 1

    DEFAULT_BUCKET_ID: DRIVER_FAULT

    ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx". The memory

    could not be "%s".

    READ_ADDRESS: 18a73870

    BUGCHECK_STR: 0x24

    LAST_CONTROL_TRANSFER: from f7692ec2 to f7691fe4

    STACK_TEXT:
    a738481c f7692ec2 a7384840 85117918 a7384970 Ntfs!NtfsCommonCreate+0x147b
    a73849c8 f7719f70 85117918 a7384c00 865a4020 Ntfs!NtfsNetworkOpenCreate+0x8a
    a73849e8 a99bcdb1 85117918 a7384c00 865a6bc8 sr!SrFastIoQueryOpen+0x40
    WARNING: Stack unwind information not available. Following frames may be wrong.
    a7384a08 8057168e 85117918 a7384c00 8642b228 SYMEVENT+0x4db1
    a7384af4 805632ec 8677de30 00000000 8638f728 nt!IopParseDevice+0x95c
    a7384b7c 8056741a 00000000 a7384bbc 00000040 nt!ObpLookupObjectName+0x56a
    a7384bd0 80571834 00000000 00000000 a7384c01 nt!ObOpenObjectByName+0xeb
    a7384d54 804de7ec 0012f288 0012f260 0012f2b4 nt!NtQueryAttributesFile+0xf1
    a7384d54 7c90eb94 0012f288 0012f260 0012f2b4 nt!KiFastCallEntry+0xf8
    0012f2b4 00000000 00000000 00000000 00000000 0x7c90eb94


    FOLLOWUP_IP:
    Ntfs!NtfsCommonCreate+147b
    f7691fe4 8b4628 mov eax,[esi+0x28]

    SYMBOL_STACK_INDEX: 0

    FOLLOWUP_NAME: MachineOwner

    SYMBOL_NAME: Ntfs!NtfsCommonCreate+147b

    MODULE_NAME: Ntfs

    IMAGE_NAME: Ntfs.sys

    DEBUG_FLR_IMAGE_TIMESTAMP: 42797de8

    STACK_COMMAND: .cxr ffffffffa7384314 ; kb

    FAILURE_BUCKET_ID: 0x24_Ntfs!NtfsCommonCreate+147b

    BUCKET_ID: 0x24_Ntfs!NtfsCommonCreate+147b
    *****************************************************************


    *****************************************************************
    2.IRQL_NOT_LESS_OR_EQUAL (a)
    Arguments:
    Arg1: 0000000c, memory referenced
    Arg2: 000000ff, IRQL
    Arg3: 00000000, value 0 = read operation, 1 = write operation
    Arg4: 80531bc7, address which referenced memory

    Debugging Details:
    ------------------


    READ_ADDRESS: 0000000c

    CURRENT_IRQL: ff

    FAULTING_IP:
    nt!ExAcquireResourceSharedLite+65
    80531bc7 66395e0c cmp [esi+0xc],bx

    CUSTOMER_CRASH_COUNT: 1

    DEFAULT_BUCKET_ID: DRIVER_FAULT

    BUGCHECK_STR: 0xA

    LAST_CONTROL_TRANSFER: from 805eb492 to 80531bc7

    STACK_TEXT:
    f5dd4448 805eb492 00000000 00000001 f5dd46b8 nt!ExAcquireResourceSharedLite+0x65
    f5dd445c 805b4723 f5dd46d4 867c6040 8621f218 nt!SeLockSubjectContext+0x22
    f5dd4484 805b12d3 8621f230 f5dd46b8 00000001 nt!ObCheckObjectAccess+0x51
    f5dd4534 805b1991 00000001 867c69c8 8621f230 nt!ObpIncrementHandleCount+0x1f7
    f5dd459c 805b0038 00000001 8621f230 867c6040 nt!ObpCreateHandle+0x17d
    f5dd466c 805bff39 8621f230 00000200 f5dd46b8 nt!ObOpenObjectByPointer+0xa4
    f5dd4770 8053c958 f5dd4848 00000400 f5dd4810 nt!NtOpenProcess+0x229
    f5dd4770 804fdd39 f5dd4848 00000400 f5dd4810 nt!KiFastCallEntry+0xf8
    f5dd47f8 eb28fb8e f5dd4848 00000400 f5dd4810 nt!ZwOpenProcess+0x11
    WARNING: Stack unwind information not available. Following frames may be wrong.
    f5dd4830 eb25a954 000002e0 f5dd4848 00000000 SPBBCDrv+0x48b8e
    f5dd484c eb25ac9c 00000000 f5dd4864 e2126230 SPBBCDrv+0x13954
    f5dd4868 eb25789c 00000000 e2126230 f5dd4c6c SPBBCDrv+0x13c9c
    f5dd4964 805da392 00000000 e4463434 00000004 SPBBCDrv+0x1089c
    f5dd49a4 8054447e 80559480 80559490 000d1d68 nt!RtlpInheritAcl+0x68
    f5dd4a44 80602ad0 e1195358 0000039c f5dd4b24 nt!ExAllocatePoolWithTag+0x27e
    f5dd4a78 e1195358 e12a8738 f5dd4b24 000002b4 nt!ExpAllocateHandleTableEntry+0x11e
    f5dd4a8c 805c482f 805594b8 80559480 00000000 0xe1195358
    f5dd4ac0 805b54b1 00000001 00000006 f5dd4af4 nt!PsReturnSharedPoolQuota+0x1d9
    f5dd4af4 805af6db e6332a48 00000000 00000000 nt!ObpFreeObject+0x12f
    f5dd4b0c 80521f73 e6332a60 00000000 e6332a60 nt!ObpRemoveObjectRoutine+0xe7
    f5dd4b30 805c40cb 00000000 862adabc 00000000 nt!ObfDereferenceObject+0x5f
    f5dd4b44 f5dd4ba0 805c437f 00000002 00000000 nt!PsRevertThreadToSelf+0xb1
    f5dd4b4c 00000000 00000000 00000004 00000000 0xf5dd4ba0


    FOLLOWUP_IP:
    SPBBCDrv+48b8e
    eb28fb8e ?? ???

    SYMBOL_STACK_INDEX: 9

    FOLLOWUP_NAME: MachineOwner

    SYMBOL_NAME: SPBBCDrv+48b8e

    MODULE_NAME: SPBBCDrv

    IMAGE_NAME: SPBBCDrv.sys

    DEBUG_FLR_IMAGE_TIMESTAMP: 4329f3e4

    STACK_COMMAND: kb

    FAILURE_BUCKET_ID: 0xA_SPBBCDrv+48b8e

    BUCKET_ID: 0xA_SPBBCDrv+48b8e

    Followup: MachineOwner
    *****************************************************************


    *****************************************************************
    3.Pretty much the same as #1 NTFS.SYS
    *****************************************************************


    *****************************************************************
    4.PAGE_FAULT_IN_NONPAGED_AREA (50)
    Arguments:
    Arg1: c4849d38, memory referenced.
    Arg2: 00000000, value 0 = read operation, 1 = write operation.
    Arg3: f73d226a, If non-zero, the instruction address which referenced the bad memory
    address.
    Arg4: 00000000, (reserved)

    Debugging Details:
    ------------------


    Could not read faulting driver name

    READ_ADDRESS: c4849d38

    FAULTING_IP:
    KSecDD!KSecReferenceListEntry+18
    f73d226a 8b4610 mov eax,[esi+0x10]

    MM_INTERNAL_CODE: 0

    CUSTOMER_CRASH_COUNT: 1

    DEFAULT_BUCKET_ID: DRIVER_FAULT

    BUGCHECK_STR: 0x50

    LAST_CONTROL_TRANSFER: from f73d1635 to f73d226a

    STACK_TEXT:
    b7368c88 f73d1635 c4849d28 4d4c544e 00000001 KSecDD!KSecReferenceListEntry+0x18
    b7368cac f73cfc24 c4849d28 b7368ce0 b7368ce4 KSecDD!NtLmDeleteKernelContext+0x1e
    b7368cc4 f73cf411 e3883f78 b7368cdc e3883f78 KSecDD!DeleteUserModeContext+0x4c
    b7368ce4 f73cf461 00000001 e3883f78 b7368d08 KSecDD!DeleteSecurityContextInternal+0x25
    b7368cf4 b9829dfc e3883f78 e3883ef8 867c69c8 KSecDD!DeleteSecurityContext+0xf
    b7368d08 b9829d08 e3883ef8 85e4e6b0 e3883ef8 srv!SrvFreeSecurityContexts+0x3a
    b7368d34 b9829b7a e3883ef8 85e4e6b0 e3ee0c88 srv!SrvFreeSession+0x37
    b7368d4c b9829c21 00000000 85d89368 85d89360 srv!SrvDereferenceSession+0x37
    b7368d68 b98129c7 85d89368 85d89360 85f27dd8 srv!SrvDereferenceTreeConnect+0x77
    b7368d7c b98127c6 85d89360 85f27da0 b9822a98 srv!SrvReleaseContext+0x38
    b7368d88 b9822a98 00000000 85c6bda8 00000000 srv!SrvDereferenceWorkItem+0x3b
    b7368dac 805c4bc0 85d89360 00000000 00000000 srv!WorkerThread+0x11e
    b7368ddc 805410f2 b98229e4 85f27da0 00000000 nt!PspSystemThreadStartup+0x34
    00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16


    FOLLOWUP_IP:
    KSecDD!KSecReferenceListEntry+18
    f73d226a 8b4610 mov eax,[esi+0x10]

    SYMBOL_STACK_INDEX: 0

    FOLLOWUP_NAME: MachineOwner

    SYMBOL_NAME: KSecDD!KSecReferenceListEntry+18

    MODULE_NAME: KSecDD

    IMAGE_NAME: KSecDD.sys

    DEBUG_FLR_IMAGE_TIMESTAMP: 41107b51

    STACK_COMMAND: kb

    FAILURE_BUCKET_ID: 0x50_KSecDD!KSecReferenceListEntry+18

    BUCKET_ID: 0x50_KSecDD!KSecReferenceListEntry+18

    Followup: MachineOwner
    *****************************************************************


    *****************************************************************
    5.KERNEL_MODE_EXCEPTION_NOT_HANDLED_M (1000008e)
    Arguments:
    Arg1: c0000005, The exception code that was not handled
    Arg2: 00ef480d, The address that the exception occurred at
    Arg3: aa34d819, Trap Frame
    Arg4: 00000000

    Debugging Details:
    ------------------


    EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx". The memory

    could not be "%s".

    FAULTING_IP:
    +ef480d
    00ef480d f3f3ff84c074208b45 rep rep inc dword ptr [eax+eax*8+0x458b2074]

    TRAP_FRAME: aa34d819 -- (.trap ffffffffaa34d819)
    ErrCode = 00000002
    eax=00000000 ebx=85b3f25c ecx=f7360be3 edx=00000000 esi=7985b3f2 edi=859e5468
    eip=00ef480d esp=aa34d88d ebp=86748bc8 iopl=0 nv up ei ng nz na pe nc
    cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010282
    00ef480d f3f3ff84c074208b45 rep rep inc dword ptr [eax+eax*8+0x458b2074] ds:0023:458b2074=????????
    Resetting default scope

    CUSTOMER_CRASH_COUNT: 2

    DEFAULT_BUCKET_ID: DRIVER_FAULT

    BUGCHECK_STR: 0x8E

    LAST_CONTROL_TRANSFER: from 00000000 to 00ef480d

    UNALIGNED_STACK_POINTER: aa34d88d

    SYMBOL_ON_RAW_STACK: 1

    STACK_TEXT:
    86748bc8 00000000 867ca878 867c99b8 861d9ae8 0xef480d


    STACK_COMMAND: .trap ffffffffaa34d819; dds @$csp ; kb

    FOLLOWUP_IP:
    SAVRT+4609f
    ef48409f ?? ???

    FOLLOWUP_NAME: MachineOwner

    SYMBOL_NAME: SAVRT+4609f

    MODULE_NAME: SAVRT

    IMAGE_NAME: SAVRT.SYS

    DEBUG_FLR_IMAGE_TIMESTAMP: 430f857b

    FAILURE_BUCKET_ID: 0x8E_SAVRT+4609f

    BUCKET_ID: 0x8E_SAVRT+4609f

    Followup: MachineOwner
    *****************************************************************


    *******************
    ****Computer 2****
    *******************


    +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
    1.DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
    Arguments:
    Arg1: 00000004, memory referenced
    Arg2: 00000002, IRQL
    Arg3: 00000001, value 0 = read operation, 1 = write operation
    Arg4: f70b8a16, address which referenced memory

    Debugging Details:
    ------------------


    WRITE_ADDRESS: 00000004

    CURRENT_IRQL: 2

    FAULTING_IP:
    USBPORT!USBPORT_QueuePendingUrbToEndpoint+70
    f70b8a16 894104 mov [ecx+0x4],eax

    CUSTOMER_CRASH_COUNT: 1

    DEFAULT_BUCKET_ID: DRIVER_FAULT

    BUGCHECK_STR: 0xD1

    LAST_CONTROL_TRANSFER: from f70b5c4a to f70b8a16

    STACK_TEXT:
    80548aa0 f70b5c4a 85ea7918 864b0550 86223008 USBPORT!USBPORT_QueuePendingUrbToEndpoint+0x70
    80548acc f70bc1bd 02524974 805419f8 864b0550 USBPORT!USBPORT_QueuePendingTransferIrp+0xf6
    80548af8 f70c317a 86469d80 80548b30 f70c2d3e USBPORT!USBPORT_QueueTransferUrb+0x22f
    80548b04 f70c2d3e 863f2028 86223008 864b0550 USBPORT!USBPORT_AsyncTransfer+0x30
    80548b30 f70c7de2 8622d618 863f2028 00000090 USBPORT!USBPORT_ProcessURB+0x3f4
    80548b50 f70b11e2 8622d618 86223008 86223008 USBPORT!USBPORT_PdoInternalDeviceControlIrp+0x7e
    80548b74 804edf35 862230e4 8622d770 864b0550 USBPORT!USBPORT_Dispatch+0x148
    80548b84 f358150a 80548bac f35853ef 86223008 nt!IopfCallDriver+0x31
    80548b8c f35853ef 86223008 8622d618 86223008 usbhub!USBH_PassIrp+0x18
    80548bac f3585c4e 86406d50 86223008 86223124 usbhub!USBH_PdoUrbFilter+0xbd
    80548bc8 f35832ee 864b0550 86223008 80548c04 usbhub!USBH_PdoDispatch+0x202
    80548bd8 804edf35 864945d8 86223008 85ec0708 usbhub!USBH_HubDispatch+0x48
    80548be8 f3aed4db 00220003 862230e4 80000000 nt!IopfCallDriver+0x31
    80548c04 f3aec76b 85ec05b8 86223008 862c8220 usbccgp!ParentInternalDeviceControl+0xbb
    80548c28 f3aec5d3 85ec05b0 86223008 0000000f usbccgp!USBC_InternalDeviceControl+0x3b
    80548c64 804edf35 85ec04f8 86223008 85ec0708 usbccgp!USBC_Dispatch+0x183
    80548c74 f3aee231 80000000 00000009 00220003 nt!IopfCallDriver+0x31
    80548ca4 f3aec786 865eaee0 86223008 865eaee0 usbccgp!FunctionInternalDeviceControl+0x1c1
    80548cc8 f3aec5d3 865eaed8 86223008 0000000f usbccgp!USBC_InternalDeviceControl+0x56
    80548d04 804edf35 865eae20 86223008 86223148 usbccgp!USBC_Dispatch+0x183
    80548d14 f7abcb22 85ec0318 86223008 80548d40 nt!IopfCallDriver+0x31
    WARNING: Stack unwind information not available. Following frames may be wrong.
    80548d24 f7abd036 85ec0318 86223008 85ec0260 LUsbKbd+0xb22
    80548d40 804edf35 85ec0260 86223008 864b0550 LUsbKbd+0x1036
    80548d9c 804f048e aab6e2cc 86223008 aab6e22c nt!IopfCallDriver+0x31
    80548dc0 aab57e91 85eabcb0 86223008 86223008 nt!IopfCompleteRequest+0xa2
    80548dd4 aab59234 85eabcb0 86223008 86223008 HIDCLASS!HidpCallDriver+0x3f
    80548df0 aab5909c 85eabd7c 85ea73d8 80548e3b HIDCLASS!HidpSubmitInterruptRead+0x84
    80548e28 804f048e 00000000 86223008 00eabd7c HIDCLASS!HidpInterruptReadComplete+0x1d2
    80548e58 f70b8ee5 86223008 86247508 863f2028 nt!IopfCompleteRequest+0xa2
    80548ec0 f70b9b57 864b0550 00000000 863f27d8 USBPORT!USBPORT_CompleteTransfer+0x373
    80548ef0 f70ba754 026e6f44 863f20e0 863f20e0 USBPORT!USBPORT_DoneTransfer+0x137
    80548f28 f70bbf4a 863f2028 805419f8 863f2230 USBPORT!USBPORT_FlushDoneTransferList+0x16c
    80548f54 f70c9fa5 863f2028 805419f8 863f2028 USBPORT!USBPORT_DpcWorker+0x224
    80548f90 f70ca11c 863f2028 00000001 80551d00 USBPORT!USBPORT_IsrDpcWorker+0x38f
    80548fac 80540ead 863f264c 6b755044 00000000 USBPORT!USBPORT_IsrDpc+0x166
    80548fc0 80551aa0 ffdffc50 00000000 00000000 nt!KiRetireDpcList+0x46
    ffdff980 863f2670 f79fc000 0019cdd8 00000001 nt!KiIdleThread0
    ffdff984 f79fc000 0019cdd8 00000001 80548fc4 0x863f2670
    ffdff988 0019cdd8 00000001 80548fc4 00000001 0xf79fc000
    ffdff98c 00000000 80548fc4 00000001 0019cdd6 0x19cdd8


    FOLLOWUP_IP:
    usbccgp!ParentInternalDeviceControl+bb
    f3aed4db 8945f4 mov [ebp-0xc],eax

    SYMBOL_STACK_INDEX: d

    FOLLOWUP_NAME: MachineOwner

    SYMBOL_NAME: usbccgp!ParentInternalDeviceControl+bb

    MODULE_NAME: usbccgp

    IMAGE_NAME: usbccgp.sys

    DEBUG_FLR_IMAGE_TIMESTAMP: 42b216bb

    STACK_COMMAND: kb

    FAILURE_BUCKET_ID: 0xD1_W_usbccgp!ParentInternalDeviceControl+bb

    BUCKET_ID: 0xD1_W_usbccgp!ParentInternalDeviceControl+bb

    Followup: MachineOwner
    +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++



    +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
    2. Pretty much the same as #1 (Comp 2)
    +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++



    +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
    3. NTFS_FILE_SYSTEM (24)
    Arguments:
    Arg1: 001902fe
    Arg2: f7a17978
    Arg3: f7a17674
    Arg4: 805171e7

    Debugging Details:
    ------------------


    EXCEPTION_RECORD: f7a17978 -- (.exr fffffffff7a17978)
    ExceptionAddress: 805171e7 (nt!MmUnmapViewInSystemCache+0x00000061)
    ExceptionCode: c0000005 (Access violation)
    ExceptionFlags: 00000000
    NumberParameters: 2
    Parameter[0]: 00000000
    Parameter[1]: 00000018
    Attempt to read from address 00000018

    CONTEXT: f7a17674 -- (.cxr fffffffff7a17674)
    eax=00000018 ebx=c06c0000 ecx=00603600 edx=00000000 esi=867b44d0 edi=81164260
    eip=805171e7 esp=f7a17a40 ebp=f7a17a74 iopl=0 nv up ei pl zr ac po nc
    cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010256
    nt!MmUnmapViewInSystemCache+0x61:
    805171e7 8b00 mov eax,[eax] ds:0023:00000018=????????
    Resetting default scope

    CUSTOMER_CRASH_COUNT: 1

    DEFAULT_BUCKET_ID: DRIVER_FAULT

    ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx". The memory

    could not be "%s".

    READ_ADDRESS: 00000018

    BUGCHECK_STR: 0x24

    LAST_CONTROL_TRANSFER: from 8055ee3e to 805171e7

    STACK_TEXT:
    f7a17a74 8055ee3e d8000000 c490f838 00000000 nt!MmUnmapViewInSystemCache+0x61
    f7a17a8c 804e7242 867b44d0 86610ed0 00000000 nt!CcUnmapVacb+0x2a
    f7a17ac8 804e44a2 00000004 00000000 86610f34 nt!CcUnmapVacbArray+0x120
    f7a17ae4 804e46f0 86610ed0 84797038 86610ed0 nt!CcUnmapAndPurge+0x20
    f7a17b10 804e4e1b 00000000 e854f0d0 84797038 nt!CcDeleteSharedCacheMap+0xa6
    f7a17b2c f738dc97 00000000 00000000 00000000 nt!CcUninitializeCacheMap+0x127
    f7a17b50 f738bc7d e854f0d0 00000000 00000000 Ntfs!NtfsDeleteInternalAttributeStream+0x98
    f7a17b6c f7366800 84bf6920 e854f0d0 00000000 Ntfs!NtfsRemoveScb+0x77
    f7a17b88 f736a550 84bf6920 e854f008 00000000 Ntfs!NtfsPrepareFcbForRemoval+0x52
    f7a17bd8 f738bcde 84bf6920 86772100 e838ecc8 Ntfs!NtfsTeardownFromLcb+0x2bc
    f7a17c30 f73667b0 84bf6920 e838ed90 e838ef28 Ntfs!NtfsTeardownStructures+0x125
    f7a17c5c f7389535 84bf6920 0138ed90 e838ef28 Ntfs!NtfsDecrementCloseCounts+0x9e
    f7a17ce0 f738e445 84bf6920 e838ed90 e838ecc8 Ntfs!NtfsCommonClose+0x397
    f7a17d74 80533f22 00000000 00000000 867c5640 Ntfs!NtfsFspClose+0xe3
    f7a17dac 805c4bc0 00000000 00000000 00000000 nt!ExpWorkerThread+0x100
    f7a17ddc 805410f2 80533e22 00000000 00000000 nt!PspSystemThreadStartup+0x34
    00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16


    FOLLOWUP_IP:
    Ntfs!NtfsDeleteInternalAttributeStream+98
    f738dc97 8bce mov ecx,esi

    SYMBOL_STACK_INDEX: 6

    FOLLOWUP_NAME: MachineOwner

    SYMBOL_NAME: Ntfs!NtfsDeleteInternalAttributeStream+98

    MODULE_NAME: Ntfs

    IMAGE_NAME: Ntfs.sys

    DEBUG_FLR_IMAGE_TIMESTAMP: 42797de8

    STACK_COMMAND: .cxr fffffffff7a17674 ; kb

    FAILURE_BUCKET_ID: 0x24_Ntfs!NtfsDeleteInternalAttributeStream+98

    BUCKET_ID: 0x24_Ntfs!NtfsDeleteInternalAttributeStream+98

    Followup: MachineOwner
    +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++


    +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
    4. DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
    Arguments:
    Arg1: 7def13cb, memory referenced
    Arg2: 00000002, IRQL
    Arg3: 00000001, value 0 = read operation, 1 = write operation
    Arg4: f61e891e, address which referenced memory

    Debugging Details:
    ------------------


    WRITE_ADDRESS: 7def13cb

    CURRENT_IRQL: 2

    FAULTING_IP:
    LMouKE+391e
    f61e891e c0740d8b45 shl byte ptr [ebp+ecx-0x75],0x45

    CUSTOMER_CRASH_COUNT: 1

    DEFAULT_BUCKET_ID: DRIVER_FAULT

    BUGCHECK_STR: 0xD1

    MISALIGNED_IP:
    LMouKE+391e
    f61e891e c0740d8b45 shl byte ptr [ebp+ecx-0x75],0x45

    LAST_CONTROL_TRANSFER: from f61e9f8b to f61e891e

    STACK_TEXT:
    WARNING: Stack unwind information not available. Following frames may be wrong.
    f79fbf04 f61e9f8b 864f54b4 f79fbf38 00000000 LMouKE+0x391e
    f79fbf1c f61e5807 864f54b4 f79fbf38 80540630 LMouKE+0x4f8b
    f79fbf6c f78140cb 8626ba50 86061068 86061080 LMouKE+0x807
    f79fbfd0 80540ead 8626de98 0126dc88 00000000 i8042prt!I8042MouseIsrDpc+0xf0
    f79fbff4 80540b7a a10e3d44 00000000 00000000 nt!KiRetireDpcList+0x46
    f79fbff8 a10e3d44 00000000 00000000 00000000 nt!KiDispatchInterrupt+0x2a
    80540b7a 00000000 00000009 bb835675 00000128 0xa10e3d44


    FOLLOWUP_IP:
    LMouKE+391e
    f61e891e c0740d8b45 shl byte ptr [ebp+ecx-0x75],0x45

    SYMBOL_STACK_INDEX: 0

    FOLLOWUP_NAME: MachineOwner

    SYMBOL_NAME: LMouKE+391e

    IMAGE_NAME: hardware

    DEBUG_FLR_IMAGE_TIMESTAMP: 0

    STACK_COMMAND: kb

    MODULE_NAME: hardware

    FAILURE_BUCKET_ID: IP_MISALIGNED_LMouKE.Sys

    BUCKET_ID: IP_MISALIGNED_LMouKE.Sys

    Followup: MachineOwner
    +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++



    +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
    5. KERNEL_MODE_EXCEPTION_NOT_HANDLED_M (1000008e)
    Arguments:
    Arg1: c0000005, The exception code that was not handled
    Arg2: bf80fcd3, The address that the exception occurred at
    Arg3: a0fcd0e8, Trap Frame
    Arg4: 00000000

    Debugging Details:
    ------------------


    EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx". The memory

    could not be "%s".

    FAULTING_IP:
    win32k!divff3_c+5b
    bf80fcd3 8903 mov [ebx],eax

    TRAP_FRAME: a0fcd0e8 -- (.trap ffffffffa0fcd0e8)
    ErrCode = 00000002
    eax=60000000 ebx=0000000d ecx=00000002 edx=00000000 esi=fffffffa edi=a0fcd710
    eip=bf80fcd3 esp=a0fcd15c ebp=a0fcd164 iopl=0 nv up ei pl nz na po nc
    cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010206
    win32k!divff3_c+0x5b:
    bf80fcd3 8903 mov [ebx],eax ds:0023:0000000d=????????
    Resetting default scope

    CUSTOMER_CRASH_COUNT: 1

    DEFAULT_BUCKET_ID: DRIVER_FAULT

    BUGCHECK_STR: 0x8E

    LAST_CONTROL_TRANSFER: from bf811ab3 to bf80fcd3

    STACK_TEXT:
    a0fcd164 bf811ab3 0000000d a0fcd210 a0fcd208 win32k!divff3_c+0x5b
    a0fcd258 bf810ea8 a0fcd2c0 e18b5860 a0fcd40c win32k!bGetNtoW_Win31+0xfa
    a0fcd388 bf811200 a0fcd3f0 e18b5860 a0fcd40c win32k!bGetNtoD_Win31+0x179
    a0fcd3bc bf807393 a0fcd710 e18b5860 a0fcd3f0 win32k!PFEOBJ::bSetFontXform+0x53
    a0fcd440 bf80751c e18b5740 00000000 00000002 win32k!RFONTOBJ::bInit+0x1a8
    a0fcd458 bf812430 a0fcd710 00000000 00000002 win32k!RFONTOBJ::vInit+0x16
    a0fcd6c4 bf823d72 a0fcd710 00000017 0000030b win32k!GreExtTextOutWLocked+0x443
    a0fcd708 bf82454d e3b28300 00000017 0000030b win32k!GreExtTextOutWInternal+0x6e
    a0fcd858 8053c958 f5010869 00000017 0000030b win32k!NtGdiExtTextOutW+0x2b6
    a0fcd858 7c90eb94 f5010869 00000017 0000030b nt!KiFastCallEntry+0xf8
    WARNING: Frame IP not in any known module. Following frames may be wrong.
    00138644 00000000 00000000 00000000 00000000 0x7c90eb94


    FOLLOWUP_IP:
    win32k!divff3_c+5b
    bf80fcd3 8903 mov [ebx],eax

    SYMBOL_STACK_INDEX: 0

    FOLLOWUP_NAME: MachineOwner

    SYMBOL_NAME: win32k!divff3_c+5b

    MODULE_NAME: win32k

    IMAGE_NAME: win32k.sys

    DEBUG_FLR_IMAGE_TIMESTAMP: 43446b4e

    STACK_COMMAND: .trap ffffffffa0fcd0e8 ; kb

    FAILURE_BUCKET_ID: 0x8E_win32k!divff3_c+5b

    BUCKET_ID: 0x8E_win32k!divff3_c+5b

    Followup: MachineOwner
    +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++



    +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
    6. DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
    Arguments:
    Arg1: 010000a8, memory referenced
    Arg2: 00000002, IRQL
    Arg3: 00000000, value 0 = read operation, 1 = write operation
    Arg4: a683f98f, address which referenced memory

    Debugging Details:
    ------------------


    READ_ADDRESS: 010000a8

    CURRENT_IRQL: 2

    FAULTING_IP:
    tcpip!IPRcvPacket+2d1
    a683f98f 8b0b mov ecx,[ebx]

    CUSTOMER_CRASH_COUNT: 1

    DEFAULT_BUCKET_ID: DRIVER_FAULT

    BUGCHECK_STR: 0xD1

    LAST_CONTROL_TRANSFER: from a683f362 to a683f98f

    STACK_TEXT:
    f7c7ecac a683f362 8621ed08 f7c7ed24 00000030 tcpip!IPRcvPacket+0x2d1
    f7c7ed58 f7b573e4 a6871300 8621ed08 a6871310 tcpip!LoopXmitRtn+0x195
    f7c7ed74 804e426b 8621ed08 00000000 867c4640 TDI!CTEpEventHandler+0x32
    f7c7edac 8057bf95 a6871300 00000000 00000000 nt!ExpWorkerThread+0x100
    f7c7eddc 804f94b2 804e4196 00000001 00000000 nt!PspSystemThreadStartup+0x34
    00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16


    FOLLOWUP_IP:
    TDI!CTEpEventHandler+32
    f7b573e4 5f pop edi

    SYMBOL_STACK_INDEX: 2

    FOLLOWUP_NAME: MachineOwner

    SYMBOL_NAME: TDI!CTEpEventHandler+32

    MODULE_NAME: TDI

    IMAGE_NAME: TDI.SYS

    DEBUG_FLR_IMAGE_TIMESTAMP: 41107d33

    STACK_COMMAND: kb

    FAILURE_BUCKET_ID: 0xD1_TDI!CTEpEventHandler+32

    BUCKET_ID: 0xD1_TDI!CTEpEventHandler+32

    Followup: MachineOwner
    +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++


    +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
    7. Pretty much the same as #6 above
    +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++


    +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
    8. NTFS_FILE_SYSTEM (24)
    +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++


    Hope that helps anyone. :) Very puzzling problem
     
  4. primetime212

    primetime212

    Joined:
    May 21, 2004
    Messages:
    303
    did you install the updates ?? do you have Norton anitivirus installed ??
     
  5. bbasir

    bbasir Thread Starter

    Joined:
    Jan 15, 2006
    Messages:
    4
    Yup all updates are installed (SOftware updates, BIOS, firmwar & device drivers). I have NOton ANtivirus 2006 installed and it too is up to date.
     
  6. primetime212

    primetime212

    Joined:
    May 21, 2004
    Messages:
    303
    alot of those blue screen files listed are norton files...seems to be a conflict with norton
     
  7. xSoilworkeRx

    xSoilworkeRx

    Joined:
    Dec 6, 2004
    Messages:
    96
    Are you getting ALL those blue screens? Holy hell. The IRQL and DRIVER_IRQL screens are, most always, pointing towards some kind of driver problem (duh). Usually, though, not always. I'd try pulling the PCI bus in Safe Mode, restarting into Normal Mode, and let the system rebuild all of the drivers. The NTFS blue screen is more than likely due in part to the IRQL, if, in fact, both are happening on the same computer. If so, I'd run a repair reinstall, or a parallel reinstall, or, hell, just format the whole thing and try again. Get rid of Norton and get McAfee or something. Actually, no, both suck. Get SpySweeper and Spybot, and you should be okay. I'd use the Windows default firewall, keeps most things out.

    That's about all I can think of at the moment. Wow, what a problem.
     
  8. bbasir

    bbasir Thread Starter

    Joined:
    Jan 15, 2006
    Messages:
    4
    Just to give you guys an update, so since my very last visit it looks like the blue screens have decreased quite a bit. There was only 1 blue screen on 1 of the computers in 3 days. What I had done is updated the BIOS to latest BETA, disbaled everything not needed (including APM) and thats it. Here is the latest blue screen error, different than others. Any Ideas ?

    IRQL_NOT_LESS_OR_EQUAL (a)
    An attempt was made to access a pageable (or completely invalid) address at an
    interrupt request level (IRQL) that is too high. This is usually
    caused by drivers using improper addresses.
    If a kernel debugger is available get the stack backtrace.
    Arguments:
    Arg1: 00000028, memory referenced
    Arg2: 00000002, IRQL
    Arg3: 00000000, value 0 = read operation, 1 = write operation
    Arg4: 8051eb03, address which referenced memory

    Debugging Details:
    ------------------


    READ_ADDRESS: 00000028

    CURRENT_IRQL: 2

    FAULTING_IP:
    nt!MiReleasePageFileSpace+3d
    8051eb03 8b7828 mov edi,[eax+0x28]

    CUSTOMER_CRASH_COUNT: 1

    DEFAULT_BUCKET_ID: DRIVER_FAULT

    BUGCHECK_STR: 0xA

    LAST_CONTROL_TRANSFER: from 8050c86a to 8051eb03

    STACK_TEXT:
    a7a6590c 8050c86a 00007bcc 00000f83 00000001 nt!MiReleasePageFileSpace+0x3d
    a7a659c8 80543086 00018eb1 00000001 00000300 nt!MiDeleteSystemPagableVm+0x1e4
    a7a65a0c 80543afd 00000019 867ee050 e4d61dc8 nt!MiFreePoolPages+0x5a4
    a7a65a58 80543fef e4d4da68 e4d02b70 a7a65bbc nt!ExDeferredFreePool+0x277
    a7a65a98 805b9533 e4d61dd0 00000000 e1494c18 nt!ExFreePoolWithTag+0x489
    a7a65af4 805b37ce e1494c30 00000000 84c9e3e8 nt!ObpParseSymbolicLink+0x30f
    a7a65b7c 805afcaf 00000000 a7a65bbc 00000040 nt!ObpLookupObjectName+0x56a
    a7a65bd0 8056b255 00000000 00000000 8410ca01 nt!ObOpenObjectByName+0xeb
    a7a65d54 8053c958 0113d1e4 0113d1bc 0113d210 nt!NtQueryAttributesFile+0xf1
    a7a65d54 7c90eb94 0113d1e4 0113d1bc 0113d210 nt!KiFastCallEntry+0xf8
    WARNING: Frame IP not in any known module. Following frames may be wrong.
    0113d210 00000000 00000000 00000000 00000000 0x7c90eb94


    FOLLOWUP_IP:
    nt!ExDeferredFreePool+277
    80543afd 85ff test edi,edi

    SYMBOL_STACK_INDEX: 3

    FOLLOWUP_NAME: Pool_corruption

    SYMBOL_NAME: nt!ExDeferredFreePool+277

    MODULE_NAME: Pool_Corruption

    IMAGE_NAME: Pool_Corruption

    DEBUG_FLR_IMAGE_TIMESTAMP: 0

    STACK_COMMAND: kb

    FAILURE_BUCKET_ID: 0xA_nt!ExDeferredFreePool+277

    BUCKET_ID: 0xA_nt!ExDeferredFreePool+277

    Followup: Pool_corruption
    ---------

    Thanks all I will be leaving the stations alone for a few more days to see if they get any more blue screens.
     
  9. xSoilworkeRx

    xSoilworkeRx

    Joined:
    Dec 6, 2004
    Messages:
    96
    IRQL 2 cascades IRQ 8-15, which is for the real-time clock, 3 peripherals, and the primary and secondary IDE controllers. It's a driver, more than likely, causing the problem, so I'd boot into safe mode (if you can) and pull the PCI bus. Also, make sure you have the hard drive set up correctly (you probably do, doesn't hurt to double-check). Unplug any USB or PS/2 devices plugged into the system.

    I can't think of anything else.
     
  10. Sponsor

As Seen On
As Seen On...

Welcome to Tech Support Guy!

Are you looking for the solution to your computer problem? Join our site today to ask your question. This site is completely free -- paid for by advertisers and donations.

If you're not already familiar with forums, watch our Welcome Guide to get started.

Join over 733,556 other people just like you!

Loading...
Thread Status:
Not open for further replies.

Short URL to this thread: https://techguy.org/434232

  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Dismiss Notice