Frequent BSOD's

[skyeclad]

I'm receiving frequent BSOD's at random intervals and am unable to determine what the cause is. I figure that there might be a driver issue but I don't know how to interpret the minidump that I received.

My initial guess is that this was network related in some way so I removed NV firewall. It didn't seem to help. If this information is not enough, let me know what else to post.

Use !analyze -v to get detailed debugging information.

BugCheck 100000D1, {1721f91c, 2, 0, aaece7e0}

***** Kernel symbols are WRONG. Please fix symbols to do analysis.

Unable to load image tcpip.sys, Win32 error 2
*** WARNING: Unable to verify timestamp for tcpip.sys
*** ERROR: Module load completed but symbols could not be loaded for tcpip.sys
*** WARNING: Unable to verify timestamp for aswTdi.SYS
*** ERROR: Module load completed but symbols could not be loaded for aswTdi.SYS
*** WARNING: Unable to verify timestamp for HTTP.sys
*** ERROR: Module load completed but symbols could not be loaded for HTTP.sys
Probably caused by : aswTdi.SYS ( aswTdi+7f0 )

Followup: MachineOwner

kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: 1721f91c, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000000, value 0 = read operation, 1 = write operation
Arg4: aaece7e0, address which referenced memory

Debugging Details:
------------------

***** Kernel symbols are WRONG. Please fix symbols to do analysis.


MODULE_NAME: aswTdi

FAULTING_MODULE: 804d7000 nt

DEBUG_FLR_IMAGE_TIMESTAMP: 4390542f

READ_ADDRESS: unable to get nt!MmSpecialPoolStart
unable to get nt!MmSpecialPoolEnd
unable to get nt!MmPoolCodeStart
unable to get nt!MmPoolCodeEnd
1721f91c

CURRENT_IRQL: 2

FAULTING_IP:
tcpip+287e0
aaece7e0 807b1c00 cmp byte ptr [ebx+0x1c],0x0

CUSTOMER_CRASH_COUNT: 25

DEFAULT_BUCKET_ID: COMMON_SYSTEM_FAULT

BUGCHECK_STR: 0xD1

LAST_CONTROL_TRANSFER: from aaeb1b15 to aaece7e0

STACK_TEXT:
WARNING: Stack unwind information not available. Following frames may be wrong.
a88ee978 aaeb1b15 853325ac 85442af0 85451cb8 tcpip+0x287e0
a88ee998 aaeb147b a88ee9c0 85442ba8 85442af0 tcpip+0xbb15
a88ee9d4 aaeb0c9e 86b59d80 85442af0 00442ba8 tcpip+0xb47b
a88eea10 804eddf9 86b59d80 85442af0 86ec43b8 tcpip+0xac9e
a88eea78 ee5a17f0 86ec4388 85442af0 85442bcc nt+0x16df9
a88eeadc ee5a1a1e 86ec4388 85442af0 85442bcc aswTdi+0x7f0
a88eeb48 804eddf9 86ec42d0 85442af0 86aae0d8 aswTdi+0xa1e
a88eeb8c 804eddf9 86aae020 85442bcc 85442af0 nt+0x16df9
a88eebf0 805b0beb 86fc67c0 853e2938 0012019f nt+0x16df9
a88eec20 805b053f 86fc67c0 8528cd30 86fb2560 nt+0xd9beb
a88eec48 805b05dd e1001cd0 8528cd30 00001db8 nt+0xd953f
a88eec90 805b0715 00001db8 00000000 00000000 nt+0xd95dd
a88eeca4 8053c808 80001db8 a88eed38 804fd479 nt+0xd9715
a88eecb0 804fd479 badb0d00 a88eed28 00000440 nt+0x65808
a88eed38 a7e29659 00000000 a7e27858 a88eed58 nt+0x26479
a88eed78 a7e34768 00000000 00000b35 853e9a80 HTTP+0x16659
a88eed8c a7e456ba e1467b90 00000000 853ecda8 HTTP+0x21768
a88eedac 805c4a06 853e9a80 00000000 00000000 HTTP+0x326ba
a88eeddc 80540fa2 a7e454fa 853e9a80 00000000 nt+0xeda06
00000000 00000000 00000000 00000000 00000000 nt+0x69fa2


FOLLOWUP_IP:
aswTdi+7f0
ee5a17f0 ?? ???

SYMBOL_STACK_INDEX: 5

FOLLOWUP_NAME: MachineOwner

SYMBOL_NAME: aswTdi+7f0

IMAGE_NAME: aswTdi.SYS

STACK_COMMAND: kb

BUCKET_ID: WRONG_SYMBOLS

Followup: MachineOwner
---------

 

[montag451]

What hardware have you got? inc psu
Can you run Memtest overnite and see if it comes up with anything.

 

[skyeclad]

Here are my spec's:


Asus A8N-E nForce4
AMD Athlon 64 3200+ 512K 90nm Rev. E
DDR (400) 3200 - 1 GB (2 pcs 512) OCZ
ATI (Connect3D) Radeon X800 XL 256MB
OCZ OCZ45012U ModStream ATX 2.0 450W Power Supply
Win XP SP2

I will also run the memory tests overnight tonight.

I had a LOT of crashes yesterday whereas I was getting a BSOD around every 3 days or so before. Maybe it's related to the NForce drivers or BIOS? I updated the NForce drivers a few weeks back but I couldn't get the OS to load without a crash so I rolled the OS back and I left it with the old drivers. I wonder if they are the cause?

 

[imported_nocturne]

Basically, the BIOS and XP don't agree on a certain BIOS setting, This can be caused by ACPI conflicts, BIOS IRQ settings, which XP HAL driver is loaded, and xp device settings.

First, check your BIOS to see if you have any devices set to use a certain IRQ. If you do, clear the settings and enable 'AUTO UPDATE ESCD'. Also, look for a setting called 'APIC' (probally in power management) and enable it (better hw compat, no perf. decrease). If neither of these fixes the problem, find the Computer device (Standard, ACPI uniprocessor PC, etc). Try disabling the MS HAL irq steering.

If none of this helps, uninstall ALL of your device drivers (except the ide driver, of course) and reinstall them.

 

[skyeclad]

I checked my BIOS and the settings were as you requested already. I then checked the ACPI setting and see that it?s set at ACPI uniprocessor which is odd since I have a single processor board and not a multi-processor board. Is this a possible cause of the problem? If I wanted to change this to ACPI PC I think I have to re-install windows xp. I?m not really sure how to disable HAL as well. Any thoughts?

 

[dclive]

Originally posted by: skyeclad
I checked my BIOS and the settings were as you requested already. I then checked the ACPI setting and see that it?s set at ACPI uniprocessor which is odd since I have a single processor board and not a multi-processor board. Is this a possible cause of the problem? If I wanted to change this to ACPI PC I think I have to re-install windows xp. I?m not really sure how to disable HAL as well. Any thoughts?

You ran the dump analysis utility (even though you didn't install symbols; you need to do so) and it said Avast AV was the problem.

Did you uninstall Avast and confirm the problem still exists?

 

[skyeclad]

Originally posted by: dclive
You ran the dump analysis utility (even though you didn't install symbols; you need to do so) and it said Avast AV was the problem.

Did you uninstall Avast and confirm the problem still exists?

I don't know how to install symbols. Can you explain?

I also noted that although this time it was AVAST, many other times it is TCPIP.SYS, or NV*.SYS and some other drivers. It doesn't seem to be any single driver but I think they seem to be related to ethernet access.

I uninstalled my NForce drivers and reinstalled them to see if that helped. I haven't yet experienced the multitude of crashes(like 15 in a day) that I've seen prior to yesterday. I don't know if the problem is solved or if I just haven't tripped whatever it is that causes the crash.

I have to say that I think the Nforce4 drivers or the BIOS or my motherboard chipset is pretty buggy. I have in the past had to reflash my BIOS just to boot the computer after a power disruption. I can't seem to update to the laterst Nforce drivers without running into a BSOD cycle. I opted to stick with the original drivers and BIOS and that seems to be the most stable until this week when I ran into a frequent BSOD problem that only used to crop up every now and then.

 

[dclive]

Originally posted by: skyeclad

Originally posted by: dclive
You ran the dump analysis utility (even though you didn't install symbols; you need to do so) and it said Avast AV was the problem.

Did you uninstall Avast and confirm the problem still exists?

I don't know how to install symbols. Can you explain?

>>http://www.microsoft.com/whdc/devtools/debugging/debugstart.mspx

I also noted that although this time it was AVAST, many other times it is TCPIP.SYS, or NV*.SYS and some other drivers. It doesn't seem to be any single driver but I think they seem to be related to ethernet access.

>> Even more reason to remove AVAST.

I uninstalled my NForce drivers and reinstalled them to see if that helped. I haven't yet experienced the multitude of crashes(like 15 in a day) that I've seen prior to yesterday. I don't know if the problem is solved or if I just haven't tripped whatever it is that causes the crash.

I have to say that I think the Nforce4 drivers or the BIOS or my motherboard chipset is pretty buggy. I have in the past had to reflash my BIOS just to boot the computer after a power disruption. I can't seem to update to the laterst Nforce drivers without running into a BSOD cycle. I opted to stick with the original drivers and BIOS and that seems to be the most stable until this week when I ran into a frequent BSOD problem that only used to crop up every now and then.

Easiest way to troubleshoot is to do what you're doing - look at the dumps with a debugger and use that as the starting point for troubleshooting.

I suggest once you've confirmed the problem still exists to remove AVAST and see if it then reproduces. And I also suggest getting a new motherboard. Having to reflash the BIOS just to boot is crazy.

 

[skyeclad]

Originally posted by: dclive


I suggest once you've confirmed the problem still exists to remove AVAST and see if it then reproduces. And I also suggest getting a new motherboard. Having to reflash the BIOS just to boot is crazy.

I'll uninstall Avast and see if it helps. As for the Mobo, I'm not sure why this occured but it might have been a power spike or something as it happened when the house lost power. I turned the PC on and I had a BIOS error so I reflashed it and it was fine. The reason why I don't think this problem is related to that one event is because I had some crashing prior to it. Honestly, I think it might be a driver conflict or something.

 

[dclive]

A 2-second look at the debugger says that's exactly what it is. If I were you I'd load up the symbols (see the link I provided) and have another look at the dump to confirm, but I suspect just removing Avast will fix the reason for that particular dump.