Blue screen death back, problem found, need help eliminating
You may remember my thread here
http://filesharingtalk.com/vb3/softw...ro-help-129221
Now the problem is back but this time I know what it is however I don't know how to target it and eliminate it. It's "IRQL_NOT_LESS_ OR_EQUAL" or a "STOP 0x0cc" at the bottom of the BSOD. I found an answer here
http://www.pcformat.co.uk/tips/defau...bsectionid=488
and a quote from here
http://www.experts-exchange.com/Oper..._20361745.html
Quote:
My experience with the IRQL_NOT_LESS_THAN_OR_EQUAL BSOD has been wide and varied. Windows knowledge base suggests that this is because of two modules trying to access the same IRQ. This error will appear more when using resources that share the same IRQ, i.e. a sound card and video sharing same IRQ will crash system during games and other programs that use these devices more frequently and intensively; where as, running Word or Excel will not show an error. From what I gather, this problem DOES have to do with IRQ’s –rather IRQ levels. Possible situations that cause this conflict would be:
1. Installation of Roxio products (EZ-CD creator, Video Pack 5.0, etc.) Possible BIOS (aka device drivers) conflicts include: acpi.sys (Advanced Configuration and Power Interface) and ntfs.sys (NT File Structure).
2. Setting CMOS settings incorrectly. Look for PnP OS options, and try to free up IRQ’s for windows to use. Disable COM ports if you do not need them. Try setting OS to PnP. Also, try switching physical locations of interface cards. (The AGP slots in most motherboards share an IRQ with the slot next to it.)
3. Use of programs that tax system resources. In my case, Pulldown.exe (deals with video encoding), Uudecode.exe (used to combine binary newsgroup posts.), and other DVD tools during the creation of VOB’s.
4. Bad RAM. Although this is a very rare occurrence, in my experience, it is very possible that bad RAM can cause this error. I have never received a DIMM that was faulty (In 15 years), but I don’t buy cheap DIMM’s either. A colleague of mine says that he corrected this problem after replacing a suspected bad DIMM.
5. Installation of a new device that has not been properly configured or doesn’t have the correct driver installed. Try freeing up some IRQ’s for the OS to use in the CMOS. Disable COM’s and try to reproduce the error.
6. Corrupted page file due to improper shut down or BSOD. In XP, Right-click on “My computer”, select “Properties”. Then click the “Advanced” tab, click “Settings” in the “Performance” area and another window will appear. Click the “Advanced” tab. In the “Virtual Memory” section click “Change” button. If you have a custom setting write these numbers down, then tick the “No Page File” button. Click ok-ok-ok. Then reboot the system. Repeat the process except correct the window to reflect your original settings reboot again. Sometimes this will temporarily correct the error.
Please continue to test and change system setting (as much as you feel comfortable with) until we can reach a final solution to this problem. Don’t tip-toe around suspect programs because they crash, continue to use them and find solutions so we can put an end to this problem.
but like I said I need help targeting the problem and finding out which driver is causing it. How can I do it? This may not only help me but other people as well.
Thanks for your help guys. Appriciate it.
Re: Blue screen death back, problem found, need help eliminating
What hardware changes did you make before reseiving these BSODs?
Re: Blue screen death back, problem found, need help eliminating
none. Remember that when I got my PC back from the shop, it was reformatted and it was like a fresh copy of a new PC system. So it must be a software issue.
Re: Blue screen death back, problem found, need help eliminating
i get this on my notebook alot i believe its my ram =/ i seem to only get that when im running alot of applications or one heavy application, like just now i was booting the computer and my startup apps didnt finish loadin i opened my outlook n firefox and it immediately crashed. im about to run a memtest right now to see if its really my ram thats the problem
Re: Blue screen death back, problem found, need help eliminating
I guess I may have to get more ram. I am getting 1GB this christmas so should have 1.5GB
Don't know why it keeps giving me BSOD when there are not many programes on the PC.
Re: Blue screen death back, problem found, need help eliminating
IRQL_NOT_LESS_ OR_EQUAL is often due to buggy drivers. For example the The netgear FA311 card is notoious for this problem.
Re: Blue screen death back, problem found, need help eliminating
This is what I get now;
Error code 1000007e, parameter1 c0000005, parameter2 80503ff8, parameter3 f8891748, parameter4 f8891444.
faultrep.dll - is the one causing problems I think. It's in c:\windows\system32
I dont know what it does and I dont know how to fix the problem.
Re: Blue screen death back, problem found, need help eliminating
Its a corrupted driver ?
http://www.google.ca/search?q=faultr...ient=firefox-a
Just by reading the Google hits you'll see that someone else has the same problem .
http://www.experts-exchange.com/Oper..._20912978.html
Have you tried SFC ? Or maybe a registry cleaner .
http://www.updatexp.com/scannow-sfc.html
Re: Blue screen death back, problem found, need help eliminating
I managed to find out the problem using a debugger but I don't know how to fix it. Does anyone here understand it?? This is from the minidump file created after the system crashed.
Code:
Microsoft (R) Windows Debugger Version 6.6.0007.5
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [C:\WINDOWS\Minidump\Mini103006-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows XP Kernel Version 2600 (Service Pack 2) MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 2600.xpsp.060411-1541
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055c700
Debug session time: Mon Oct 30 20:04:28.187 2006 (GMT+0)
System Uptime: 1 days 11:41:39.874
Loading Kernel Symbols
..............................................................................................................................
Loading User Symbols
Loading unloaded module list
..................................................
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 1000007E, {c0000005, 80503ff8, f8891748, f8891444}
Probably caused by : memory_corruption
Followup: memory_corruption
---------
1: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
SYSTEM_THREAD_EXCEPTION_NOT_HANDLED_M (1000007e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003. This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG. This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG. This will let us see why this breakpoint is
happening.
Arguments:
Arg1: c0000005, The exception code that was not handled
Arg2: 80503ff8, The address that the exception occurred at
Arg3: f8891748, Exception Record Address
Arg4: f8891444, Context Record Address
Debugging Details:
------------------
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx". The memory could not be "%s".
FAULTING_IP:
nt!KiXMMIZeroPageNoSave+8
80503ff8 0f2b4100 movntps xmmword ptr [ecx],xmm0
EXCEPTION_RECORD: f8891748 -- (.exr fffffffff8891748)
ExceptionAddress: 80503ff8 (nt!KiXMMIZeroPageNoSave+0x00000008)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 00000001
Parameter[1]: 783bc000
Attempt to write to address 783bc000
CONTEXT: f8891444 -- (.cxr fffffffff8891444)
eax=00000040 ebx=783bc000 ecx=783bc000 edx=00000000 esi=00000000 edi=000081cf
eip=80503ff8 esp=f8891810 ebp=f8891840 iopl=0 nv up ei pl zr na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010246
nt!KiXMMIZeroPageNoSave+0x8:
80503ff8 0f2b4100 movntps xmmword ptr [ecx],xmm0 ds:0023:783bc000=????????????????????????????????
Resetting default scope
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: CODE_CORRUPTION
PROCESS_NAME: System
ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx". The memory could not be "%s".
WRITE_ADDRESS: 783bc000
BUGCHECK_STR: 0x7E
LAST_CONTROL_TRANSFER: from 80696b94 to 80503ff8
STACK_TEXT:
f8891840 80696b94 82bc84e0 00000000 00000044 nt!KiXMMIZeroPageNoSave+0x8
f8891840 80696b94 82bc84e0 00000000 00000044 nt!Phase1Initialization+0x1288
f8891dac 805ce892 80087000 00000000 00000000 nt!Phase1Initialization+0x1288
f8891ddc 8054540e 8069590c 80087000 00000000 nt!PspSystemThreadStartup+0x34
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16
CHKIMG_EXTENSION: !chkimg -lo 50 -d !nt
80503ab8-80503abb 4 bytes - nt!KiServiceTable+64
[ 6e af 5b 80:b8 7b 35 f8 ]
80503af8-80503afb 4 bytes - nt!KiServiceTable+a4 (+0x40)
[ 62 21 62 80:70 7b 35 f8 ]
80503b08-80503b0b 4 bytes - nt!KiServiceTable+b4 (+0x10)
[ ce a4 5a 80:70 bc 34 f8 ]
80503b70-80503b73 4 bytes - nt!KiServiceTable+11c (+0x68)
[ a2 29 62 80:fe c4 34 f8 ]
80503b78-80503b7b 4 bytes - nt!KiServiceTable+124 (+0x08)
[ 0c 2c 62 80:b0 7c 35 f8 ]
80503c24-80503c27 4 bytes - nt!KiServiceTable+1d0 (+0xac)
[ ee 8f 57 80:28 70 88 f8 ]
80503c30-80503c33 4 bytes - nt!KiServiceTable+1dc (+0x0c)
[ f8 34 62 80:34 7b 35 f8 ]
80503cd4-80503cd7 4 bytes - nt!KiServiceTable+280 (+0xa4)
[ 1c 38 62 80:1e c5 34 f8 ]
80503d18-80503d1b 4 bytes - nt!KiServiceTable+2c4 (+0x44)
[ 1c 02 62 80:06 7c 35 f8 ]
80503de4-80503de7 4 bytes - nt!KiServiceTable+390 (+0xcc)
[ 8e c7 5c 80:d0 2c e0 a9 ]
80503e18-80503e1b 4 bytes - nt!KiServiceTable+3c4 (+0x34)
[ 34 0e 65 80:50 74 35 f8 ]
44 errors : !nt (80503ab8-80503e1b)
MODULE_NAME: memory_corruption
IMAGE_NAME: memory_corruption
FOLLOWUP_NAME: memory_corruption
DEBUG_FLR_IMAGE_TIMESTAMP: 0
MEMORY_CORRUPTOR: LARGE
STACK_COMMAND: .cxr 0xfffffffff8891444 ; kb
FAILURE_BUCKET_ID: MEMORY_CORRUPTION_LARGE
BUCKET_ID: MEMORY_CORRUPTION_LARGE
Followup: memory_corruption
---------
1: kd> lmvm memory_corruption
start end module name
Re: Blue screen death back, problem found, need help eliminating
Got more dumps check them out. They all seem to be .sys files
Code:
KERNEL_MODE_EXCEPTION_NOT_HANDLED_M (1000008e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003. This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG. This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG. This will let us see why this breakpoint is
happening.
Arguments:
Arg1: c0000005, The exception code that was not handled
Arg2: 8066b934, The address that the exception occurred at
Arg3: aa2acc0c, Trap Frame
Arg4: 00000000
Debugging Details:
------------------
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx". The memory could not be "%s".
FAULTING_IP:
nt!MiAllocateSpecialPool+27e
8066b934 f3ab rep stos dword ptr es:[edi]
TRAP_FRAME: aa2acc0c -- (.trap ffffffffaa2acc0c)
ErrCode = 00000002
eax=19191919 ebx=04c84000 ecx=00000400 edx=00000440 esi=c0426420 edi=04c84000
eip=8066b934 esp=aa2acc80 ebp=aa2acca4 iopl=0 nv up ei pl zr na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010246
nt!MiAllocateSpecialPool+0x27e:
8066b934 f3ab rep stos dword ptr es:[edi] es:0023:04c84000=????????
Resetting default scope
CUSTOMER_CRASH_COUNT: 3
DEFAULT_BUCKET_ID: INTEL_CPU_MICROCODE_ZERO
BUGCHECK_STR: 0x8E
PROCESS_NAME: services.exe
LAST_CONTROL_TRANSFER: from 80536376 to 8066b934
STACK_TEXT:
aa2acca4 80536376 00000440 70426f53 00000040 nt!MiAllocateSpecialPool+0x27e
aa2accc4 80658103 00000040 00000440 70426f53 nt!ExAllocatePoolWithTagPriority+0x2c
aa2accf0 80658730 00000040 00000000 70426f53 nt!VeAllocatePoolWithTagPriority+0x13b
aa2acd14 eb618d23 00000000 00000438 70426f53 nt!VerifierAllocatePoolWithTag+0x46
WARNING: Stack unwind information not available. Following frames may be wrong.
aa2acd44 8054094c 0000047c 00000007 00000000 klif+0xdd23
aa2acd44 00000000 0000047c 00000007 00000000 nt!KiFastCallEntry+0xfc
STACK_COMMAND: kb
FOLLOWUP_IP:
klif+dd23
eb618d23 ?? ???
SYMBOL_STACK_INDEX: 4
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: klif
IMAGE_NAME: klif.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 44d328c7
SYMBOL_NAME: klif+dd23
FAILURE_BUCKET_ID: 0x8E_klif+dd23
BUCKET_ID: 0x8E_klif+dd23
Followup: MachineOwner
---------
Code:
DRIVER_VERIFIER_IOMANAGER_VIOLATION (c9)
The IO manager has caught a misbehaving driver.
Arguments:
Arg1: 00000009, Call to IoBuildDeviceIoControlRequest threw an exception
Arg2: 827267b0, the Device object
Arg3: 002f0003, the IoControlCode
Arg4: c0000005, the exception status
Debugging Details:
------------------
BUGCHECK_STR: 0xc9_9
DRIVER_VERIFIER_IO_VIOLATION_TYPE: 9
IOCONTROL_CODE: 8001000001001
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx". The memory could not be "%s".
DEVICE_OBJECT: 827267b0
DRIVER_OBJECT: 82728f38
CUSTOMER_CRASH_COUNT: 4
DEFAULT_BUCKET_ID: COMMON_SYSTEM_FAULT
PROCESS_NAME: System
LAST_CONTROL_TRANSFER: from 80656241 to 804f9ef7
STACK_TEXT:
f88b2af8 80656241 000000c9 00000009 827267b0 nt!KeBugCheckEx+0x1b
f88b2b40 f7c00c18 002f0003 827267b0 f88b2bc4 nt!IovBuildDeviceIoControlRequest+0x65
f88b2b90 f4f33e05 8259f3e8 00000000 002f0003 ks!KsSynchronousIoControlDevice+0x92
f88b2be4 f4f3822c 8259f3e8 00000005 00000000 sysaudio!GetPinPropertyEx+0x4d
f88b2c10 f4f38f3c 8259f3e8 f88b2c8c 00000000 sysaudio!CPinInfo::Create+0x10b
f88b2c64 f4f38d7d 8259f3e8 00000000 8de50fa8 sysaudio!CFilterNode::ProfileFilter+0x15d
f88b2d00 f4f37d58 8dbe2ef0 80545d28 8db40fe8 sysaudio!CFilterNode::Create+0x2d6
f88b2d3c f4f39109 8dbe2ef0 00000000 f88b2d7c sysaudio!AddFilter+0xf2
f88b2d4c f4f373a2 8dbe2ef0 00000000 8daa4fe0 sysaudio!AddFilterWorker+0xf
f88b2d64 f7bf780b 00000000 8daa4fc0 805637bc sysaudio!CQueueWorkListData::AsyncWorker+0x20
f88b2d7c 80537a97 8daa4fc0 00000000 82b0c8b8 ks!WorkerThread+0x45
f88b2dac 805ce892 8daa4fc0 00000000 00000000 nt!ExpWorkerThread+0xef
f88b2ddc 8054540e 805379a8 00000001 00000000 nt!PspSystemThreadStartup+0x34
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16
STACK_COMMAND: kb
FOLLOWUP_IP:
ks!KsSynchronousIoControlDevice+92
f7c00c18 8bf0 mov esi,eax
SYMBOL_STACK_INDEX: 2
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: ks
IMAGE_NAME: ks.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 41107ef8
SYMBOL_NAME: ks!KsSynchronousIoControlDevice+92
FAILURE_BUCKET_ID: 0xc9_9_ks!KsSynchronousIoControlDevice+92
BUCKET_ID: 0xc9_9_ks!KsSynchronousIoControlDevice+92
Followup: MachineOwner
---------
