Blue screen death back, problem found, need help eliminating

[KazaaBoy]

You may remember my thread here

http://filesharingtalk.com/vb3/software/t-blue-screen-death-xp-pro-help-129221


Now the problem is back but this time I know what it is however I don't know how to target it and eliminate it. It's "IRQL_NOT_LESS_ OR_EQUAL" or a "STOP 0x0cc" at the bottom of the BSOD. I found an answer here

http://www.pcformat.co.uk/tips/default.asp?pagetypeid=2&articleid=16167&subsectionid=688&subsubsectionid=488

and a quote from here

http://www.experts-exchange.com/Operating_Systems/WinXP/Q_20361745.html



My experience with the IRQL_NOT_LESS_THAN_OR_EQUAL BSOD has been wide and varied. Windows knowledge base suggests that this is because of two modules trying to access the same IRQ. This error will appear more when using resources that share the same IRQ, i.e. a sound card and video sharing same IRQ will crash system during games and other programs that use these devices more frequently and intensively; where as, running Word or Excel will not show an error. From what I gather, this problem DOES have to do with IRQ’s –rather IRQ levels. Possible situations that cause this conflict would be:
1. Installation of Roxio products (EZ-CD creator, Video Pack 5.0, etc.) Possible BIOS (aka device drivers) conflicts include: acpi.sys (Advanced Configuration and Power Interface) and ntfs.sys (NT File Structure).
2. Setting CMOS settings incorrectly. Look for PnP OS options, and try to free up IRQ’s for windows to use. Disable COM ports if you do not need them. Try setting OS to PnP. Also, try switching physical locations of interface cards. (The AGP slots in most motherboards share an IRQ with the slot next to it.)
3. Use of programs that tax system resources. In my case, Pulldown.exe (deals with video encoding), Uudecode.exe (used to combine binary newsgroup posts.), and other DVD tools during the creation of VOB’s.
4. Bad RAM. Although this is a very rare occurrence, in my experience, it is very possible that bad RAM can cause this error. I have never received a DIMM that was faulty (In 15 years), but I don’t buy cheap DIMM’s either. A colleague of mine says that he corrected this problem after replacing a suspected bad DIMM.
5. Installation of a new device that has not been properly configured or doesn’t have the correct driver installed. Try freeing up some IRQ’s for the OS to use in the CMOS. Disable COM’s and try to reproduce the error.
6. Corrupted page file due to improper shut down or BSOD. In XP, Right-click on “My computer”, select “Properties”. Then click the “Advanced” tab, click “Settings” in the “Performance” area and another window will appear. Click the “Advanced” tab. In the “Virtual Memory” section click “Change” button. If you have a custom setting write these numbers down, then tick the “No Page File” button. Click ok-ok-ok. Then reboot the system. Repeat the process except correct the window to reflect your original settings reboot again. Sometimes this will temporarily correct the error.
Please continue to test and change system setting (as much as you feel comfortable with) until we can reach a final solution to this problem. Don’t tip-toe around suspect programs because they crash, continue to use them and find solutions so we can put an end to this problem.




but like I said I need help targeting the problem and finding out which driver is causing it. How can I do it? This may not only help me but other people as well.

Thanks for your help guys. Appriciate it.

[zapjb]

What hardware changes did you make before reseiving these BSODs?

[KazaaBoy]

none. Remember that when I got my PC back from the shop, it was reformatted and it was like a fresh copy of a new PC system. So it must be a software issue.

[ooo]

i get this on my notebook alot i believe its my ram =/ i seem to only get that when im running alot of applications or one heavy application, like just now i was booting the computer and my startup apps didnt finish loadin i opened my outlook n firefox and it immediately crashed. im about to run a memtest right now to see if its really my ram thats the problem

[KazaaBoy]

I guess I may have to get more ram. I am getting 1GB this christmas so should have 1.5GB

Don't know why it keeps giving me BSOD when there are not many programes on the PC.

[zaphodiv]

IRQL_NOT_LESS_ OR_EQUAL is often due to buggy drivers. For example the The netgear FA311 card is notoious for this problem.

[KazaaBoy]

This is what I get now;


Error code 1000007e, parameter1 c0000005, parameter2 80503ff8, parameter3 f8891748, parameter4 f8891444.



faultrep.dll - is the one causing problems I think. It's in c:\windows\system32

I dont know what it does and I dont know how to fix the problem.

[peat moss]

Its a corrupted driver ?


http://www.google.ca/search?q=faultrep.dll&ie=utf-8&oe=utf-8&rls=org.mozilla:en-US:official&client=firefox-a


Just by reading the Google hits you'll see that someone else has the same problem .

http://www.experts-exchange.com/Operating_Systems/WinXP/Q_20912978.html


Have you tried SFC ? Or maybe a registry cleaner .

http://www.updatexp.com/scannow-sfc.html

[KazaaBoy]

I managed to find out the problem using a debugger but I don't know how to fix it. Does anyone here understand it?? This is from the minidump file created after the system crashed.




Microsoft (R) Windows Debugger Version 6.6.0007.5
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\WINDOWS\Minidump\Mini103006-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows XP Kernel Version 2600 (Service Pack 2) MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 2600.xpsp.060411-1541
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055c700
Debug session time: Mon Oct 30 20:04:28.187 2006 (GMT+0)
System Uptime: 1 days 11:41:39.874
Loading Kernel Symbols
..............................................................................................................................
Loading User Symbols
Loading unloaded module list
..................................................
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1000007E, {c0000005, 80503ff8, f8891748, f8891444}

Probably caused by : memory_corruption

Followup: memory_corruption
---------

1: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

SYSTEM_THREAD_EXCEPTION_NOT_HANDLED_M (1000007e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003. This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG. This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG. This will let us see why this breakpoint is
happening.
Arguments:
Arg1: c0000005, The exception code that was not handled
Arg2: 80503ff8, The address that the exception occurred at
Arg3: f8891748, Exception Record Address
Arg4: f8891444, Context Record Address

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx". The memory could not be "%s".

FAULTING_IP:
nt!KiXMMIZeroPageNoSave+8
80503ff8 0f2b4100 movntps xmmword ptr [ecx],xmm0

EXCEPTION_RECORD: f8891748 -- (.exr fffffffff8891748)
ExceptionAddress: 80503ff8 (nt!KiXMMIZeroPageNoSave+0x00000008)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 00000001
Parameter[1]: 783bc000
Attempt to write to address 783bc000

CONTEXT: f8891444 -- (.cxr fffffffff8891444)
eax=00000040 ebx=783bc000 ecx=783bc000 edx=00000000 esi=00000000 edi=000081cf
eip=80503ff8 esp=f8891810 ebp=f8891840 iopl=0 nv up ei pl zr na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010246
nt!KiXMMIZeroPageNoSave+0x8:
80503ff8 0f2b4100 movntps xmmword ptr [ecx],xmm0 ds:0023:783bc000=????????????????????????????????
Resetting default scope

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: CODE_CORRUPTION

PROCESS_NAME: System

ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx". The memory could not be "%s".

WRITE_ADDRESS: 783bc000

BUGCHECK_STR: 0x7E

LAST_CONTROL_TRANSFER: from 80696b94 to 80503ff8

STACK_TEXT:
f8891840 80696b94 82bc84e0 00000000 00000044 nt!KiXMMIZeroPageNoSave+0x8
f8891840 80696b94 82bc84e0 00000000 00000044 nt!Phase1Initialization+0x1288
f8891dac 805ce892 80087000 00000000 00000000 nt!Phase1Initialization+0x1288
f8891ddc 8054540e 8069590c 80087000 00000000 nt!PspSystemThreadStartup+0x34
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16


CHKIMG_EXTENSION: !chkimg -lo 50 -d !nt
80503ab8-80503abb 4 bytes - nt!KiServiceTable+64
[ 6e af 5b 80:b8 7b 35 f8 ]
80503af8-80503afb 4 bytes - nt!KiServiceTable+a4 (+0x40)
[ 62 21 62 80:70 7b 35 f8 ]
80503b08-80503b0b 4 bytes - nt!KiServiceTable+b4 (+0x10)
[ ce a4 5a 80:70 bc 34 f8 ]
80503b70-80503b73 4 bytes - nt!KiServiceTable+11c (+0x68)
[ a2 29 62 80:fe c4 34 f8 ]
80503b78-80503b7b 4 bytes - nt!KiServiceTable+124 (+0x08)
[ 0c 2c 62 80:b0 7c 35 f8 ]
80503c24-80503c27 4 bytes - nt!KiServiceTable+1d0 (+0xac)
[ ee 8f 57 80:28 70 88 f8 ]
80503c30-80503c33 4 bytes - nt!KiServiceTable+1dc (+0x0c)
[ f8 34 62 80:34 7b 35 f8 ]
80503cd4-80503cd7 4 bytes - nt!KiServiceTable+280 (+0xa4)
[ 1c 38 62 80:1e c5 34 f8 ]
80503d18-80503d1b 4 bytes - nt!KiServiceTable+2c4 (+0x44)
[ 1c 02 62 80:06 7c 35 f8 ]
80503de4-80503de7 4 bytes - nt!KiServiceTable+390 (+0xcc)
[ 8e c7 5c 80:d0 2c e0 a9 ]
80503e18-80503e1b 4 bytes - nt!KiServiceTable+3c4 (+0x34)
[ 34 0e 65 80:50 74 35 f8 ]
44 errors : !nt (80503ab8-80503e1b)

MODULE_NAME: memory_corruption

IMAGE_NAME: memory_corruption

FOLLOWUP_NAME: memory_corruption

DEBUG_FLR_IMAGE_TIMESTAMP: 0

MEMORY_CORRUPTOR: LARGE

STACK_COMMAND: .cxr 0xfffffffff8891444 ; kb

FAILURE_BUCKET_ID: MEMORY_CORRUPTION_LARGE

BUCKET_ID: MEMORY_CORRUPTION_LARGE

Followup: memory_corruption
---------

1: kd> lmvm memory_corruption
start end module name

[KazaaBoy]

Got more dumps check them out. They all seem to be .sys files




KERNEL_MODE_EXCEPTION_NOT_HANDLED_M (1000008e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003. This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG. This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG. This will let us see why this breakpoint is
happening.
Arguments:
Arg1: c0000005, The exception code that was not handled
Arg2: 8066b934, The address that the exception occurred at
Arg3: aa2acc0c, Trap Frame
Arg4: 00000000

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx". The memory could not be "%s".

FAULTING_IP:
nt!MiAllocateSpecialPool+27e
8066b934 f3ab rep stos dword ptr es:[edi]

TRAP_FRAME: aa2acc0c -- (.trap ffffffffaa2acc0c)
ErrCode = 00000002
eax=19191919 ebx=04c84000 ecx=00000400 edx=00000440 esi=c0426420 edi=04c84000
eip=8066b934 esp=aa2acc80 ebp=aa2acca4 iopl=0 nv up ei pl zr na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010246
nt!MiAllocateSpecialPool+0x27e:
8066b934 f3ab rep stos dword ptr es:[edi] es:0023:04c84000=????????
Resetting default scope

CUSTOMER_CRASH_COUNT: 3

DEFAULT_BUCKET_ID: INTEL_CPU_MICROCODE_ZERO

BUGCHECK_STR: 0x8E

PROCESS_NAME: services.exe

LAST_CONTROL_TRANSFER: from 80536376 to 8066b934

STACK_TEXT:
aa2acca4 80536376 00000440 70426f53 00000040 nt!MiAllocateSpecialPool+0x27e
aa2accc4 80658103 00000040 00000440 70426f53 nt!ExAllocatePoolWithTagPriority+0x2c
aa2accf0 80658730 00000040 00000000 70426f53 nt!VeAllocatePoolWithTagPriority+0x13b
aa2acd14 eb618d23 00000000 00000438 70426f53 nt!VerifierAllocatePoolWithTag+0x46
WARNING: Stack unwind information not available. Following frames may be wrong.
aa2acd44 8054094c 0000047c 00000007 00000000 klif+0xdd23
aa2acd44 00000000 0000047c 00000007 00000000 nt!KiFastCallEntry+0xfc


STACK_COMMAND: kb

FOLLOWUP_IP:
klif+dd23
eb618d23 ?? ???

SYMBOL_STACK_INDEX: 4

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: klif

IMAGE_NAME: klif.sys

DEBUG_FLR_IMAGE_TIMESTAMP: 44d328c7

SYMBOL_NAME: klif+dd23

FAILURE_BUCKET_ID: 0x8E_klif+dd23

BUCKET_ID: 0x8E_klif+dd23

Followup: MachineOwner
---------






DRIVER_VERIFIER_IOMANAGER_VIOLATION (c9)
The IO manager has caught a misbehaving driver.
Arguments:
Arg1: 00000009, Call to IoBuildDeviceIoControlRequest threw an exception
Arg2: 827267b0, the Device object
Arg3: 002f0003, the IoControlCode
Arg4: c0000005, the exception status

Debugging Details:
------------------


BUGCHECK_STR: 0xc9_9

DRIVER_VERIFIER_IO_VIOLATION_TYPE: 9

IOCONTROL_CODE: 8001000001001

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx". The memory could not be "%s".

DEVICE_OBJECT: 827267b0

DRIVER_OBJECT: 82728f38

CUSTOMER_CRASH_COUNT: 4

DEFAULT_BUCKET_ID: COMMON_SYSTEM_FAULT

PROCESS_NAME: System

LAST_CONTROL_TRANSFER: from 80656241 to 804f9ef7

STACK_TEXT:
f88b2af8 80656241 000000c9 00000009 827267b0 nt!KeBugCheckEx+0x1b
f88b2b40 f7c00c18 002f0003 827267b0 f88b2bc4 nt!IovBuildDeviceIoControlRequest+0x65
f88b2b90 f4f33e05 8259f3e8 00000000 002f0003 ks!KsSynchronousIoControlDevice+0x92
f88b2be4 f4f3822c 8259f3e8 00000005 00000000 sysaudio!GetPinPropertyEx+0x4d
f88b2c10 f4f38f3c 8259f3e8 f88b2c8c 00000000 sysaudio!CPinInfo::Create+0x10b
f88b2c64 f4f38d7d 8259f3e8 00000000 8de50fa8 sysaudio!CFilterNode::ProfileFilter+0x15d
f88b2d00 f4f37d58 8dbe2ef0 80545d28 8db40fe8 sysaudio!CFilterNode::Create+0x2d6
f88b2d3c f4f39109 8dbe2ef0 00000000 f88b2d7c sysaudio!AddFilter+0xf2
f88b2d4c f4f373a2 8dbe2ef0 00000000 8daa4fe0 sysaudio!AddFilterWorker+0xf
f88b2d64 f7bf780b 00000000 8daa4fc0 805637bc sysaudio!CQueueWorkListData::AsyncWorker+0x20
f88b2d7c 80537a97 8daa4fc0 00000000 82b0c8b8 ks!WorkerThread+0x45
f88b2dac 805ce892 8daa4fc0 00000000 00000000 nt!ExpWorkerThread+0xef
f88b2ddc 8054540e 805379a8 00000001 00000000 nt!PspSystemThreadStartup+0x34
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16


STACK_COMMAND: kb

FOLLOWUP_IP:
ks!KsSynchronousIoControlDevice+92
f7c00c18 8bf0 mov esi,eax

SYMBOL_STACK_INDEX: 2

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: ks

IMAGE_NAME: ks.sys

DEBUG_FLR_IMAGE_TIMESTAMP: 41107ef8

SYMBOL_NAME: ks!KsSynchronousIoControlDevice+92

FAILURE_BUCKET_ID: 0xc9_9_ks!KsSynchronousIoControlDevice+92

BUCKET_ID: 0xc9_9_ks!KsSynchronousIoControlDevice+92

Followup: MachineOwner
---------

[Virtualbody1234]

Looks like a possible memory problem.

I see that you have already posted this:
I guess I may have to get more ram. I am getting 1GB this christmas so should have 1.5GB

Don't know why it keeps giving me BSOD when there are not many programes on the PC.

Adding more memory won't solve a problem if you have faulty RAM.

Run a memory test! Replace it if tests don't pass.

http://www.memtest86.com/

[KazaaBoy]

I ran that memory test for 6 hrs and no problems came up. Maybe it's because there is not enough ram. Altho, when I go to update windows it always crashes.

[Virtualbody1234]

512 is enough if you aren't running multiple apps at once.

You can check Available Physical Memory with Windows Task Manager - Performance tab.

[KazaaBoy]

Here it is. I am not sure if that's good or not tho.

http://img172.imageshack.us/img172/5096/pictn2.jpg

[KazaaBoy]

Does anyone know whats the problem?

[david02]

Open device manager

when you opened device manager check if there are yellow exclamation marks which mean a device is not working.

you can try to disable com ports if you are not using them in your BIOS. This way you will free up a IRQ.

Also if available turn off/on PNP OS in the BIOS.

If you have a soundcard plugged in a PCI slot AND you have an onboard soundcard, check if and disable the onboard soundcard in your BIOS.

As we said before check out if one of your memory sticks is faulty. If you can safely open your computer (call your computer suplier if this will affect the warantee)
Try to use only one memorystick at a time to see if the errors disappear. If you are not sure where the memorysticks are located and how to remove/insert them ask a friend.