IRQL _NOT_LESS_OR_EQUAL

Rhonda the Sly

Senior member
Nov 22, 2007
818
4
76
I understand this is a lot of words, if you want the gist of things, just read the italicized portions.

A short apology: I created a thread a month or so back about the same issue but with the holidays, finals, and waiting for a new DVD drive from the egg, the thread kinda died. I decided to just take my time and run Memtest like suggested when I could after the drive arrived. Sorry to anyone who was totally offended by me disappearing from my own thread. :x

Long story short:
One afternoon I decided to removing the front case panel of my computer to inspect the fan I had placed behind the panel. It was making far too much noise for my liking and I'd had just about enough of it. I opened up the case, cleaned (read: removed) a dust-trapper from my the fan, then slammed the thing shut. After closing it I started receiving IRQL_NOT_LESS_OR_EQUAL errors just before the login screen. Yup, just like that. I thought maybe I messed up a wire or yanked a header but everything checks out okay. Three days prior to the event, I removed my processor. My computer ran fine three days until I decided to remove that damn fan. Tomorrow I'm gonna beat that thing with a hammer. I know it's impossible the fan played any part in this mess but I'm sure the experience will be... therapeutic.

Parts List: Everything marked with "New!" is added after I bought the original package.
New!_6600GT PCI-E
MS-7145 PCB rev.2.1
A64 3400+ (Newcastle)
2 x 512MB Samsung PC3200u
Seagate 7200.7 200GB IDE
New!_Antec Earthwatts 500
New!_Asus SATA DRW201L1T DVD Drive, SATA runs off IDE Channel in BIOS
New!_Sony OEM floppy drive
Windows Media Center, OEM on HD from old emachines.
Logitech USB Wireless KB/Mouse, use PS/2 Dongle

What I've tested
First and foremost: yes, I've checked the memory. I've checked it in every configuration I can think of. Memtest86+ clears both sticks. In case you're wondering, I tried: (A/B), (B/A), (A/0), (0/A), (B/0), and (0/B), A and B being my two memory sticks and 0 being absolutely nothing. (A/B), (B,A), (0/A), and (0/B) all can get 8 to 20 hours on Memtest Test 5. Through the weeks I've run a few hours of various tests for fun ending with no errors. I messed around with some sticks today and (A,0) and (B,0) get stuck in post. Oddly enough, one of my sticks previously couldn't even get the board to do much as that. If my monitor was in sleep mode, it wouldn't even wake up if I tried running it. The fans would spin up and things would get going but I'd be left without video. I can't remember which stick wouldn't run though... and I lost all my papers moving into my new place. If I loaded at least two sticks together my computer displays 1GB of memory and works just as well as having 512MB in DIMM2. I tried another pair in a few configurations as well, none yielded positive results. Something interesting I did with my sticks was load them into my brothers board with my HD to play StarCraft, WarCraft III, and another game, maybe Doom 3 or Oblivion. Either way, everything looked to work just fine.

Other parts I've tested or excluded:
I've played around with a few other parts, namely the GPU, ODD, FDD, HDD, and PSU (hurray for acronyms!). I've switched between my 6600GT and 7900GS but mainly use the 6600 while tinkering because of its size. The power supply is a spankin' new Earthwatts 500 to take over for my old Truepower 430 for future upgrades. My Seagate 7200.7 200GB has also been switched for my brother's, which doesn't perform any better in my computer. Seatools clears the HD as well. The floppy and DVD are new, obtained post-BSOD, sometimes I remove them or disable them in BIOS. Only parts I haven't gotten around to testing individually are my processor and motherboard and unfortunately I'm eyeing the board as the culprit, the slimey bastard. Onboard video doesn't seem to work either, that's two strikes for those keeping count. And before you ask, yes, I remembered to plug the monitor into the board. If I enter the onboard video as initial display in BIOS I get blackness (better than nothing, I guess) and have to navigate BIOS blind... or reset CMOS like anyone with two braincells to rub together would do.

Anything else...? <.<
Recently I've jotted down a number of potential solutions to the problem and tested a few. So far I've gotten around to a few...none worked.
Did a repair installation from (D) partition and proceeded to then remove some programs installed by default.
Tried updating logitech mouseware for my wireless mouse but didn't help. BSODs with no mouse in as well. Tried a PS/2 mouse with default and updated drivers.
Using an Nvidia graphics card, tried updating drivers on that, too.
I set all non-essential programs not run on startup in MSCONFIG.
Tried patching Windows up completely with no success.
Had a hell of a time uninstalling CD emulation software but I did (with the help of that reformat). It didn't help.
HD jumpers have been checked and double-checked for placement.
Checked the IDE cable on the drive as well. Has the notch so I know it's not reverse.
I've tried turning off hardware acceleration.
I tried updating ACPI drivers but apparently they're up to date.
Tried Enabling/Disabling USB Legacy Support.
In BIOS CPU idles at 20~24°, so it's not frying itself. And while I'm here... go winter! Now if only I could make it into Windows...

Things I still think need looking into: You guys might be able to give a quicker take on these.
**Safe Mode booting hangs on agpCPQ.sys, it could have something to do with that or what should be loading next, ACPI.
**Adjust IRQs. Looking at one of the screens on startup I can tell that these IRQs are being used when everything is turned on.
NA Smbus ctrl
03 Multimedia Device
04 USB 1.0/1.1 EHCI ctrl
04 USB 1.0/1.1 EHCI ctrl
04 USB 2.0 EHCI ctrl
05 Disp ctrl
09 ACPI
10 IDE
10 Network ctrl
11 IDE
11 Serial Bus ctrl
14 IDE

After disabling a few things, it looks like this:
NA Smbus ctrl
09 ACPI
11 Disp ctrl
14 IDE

My brother's computer will run my hard drive so I did a backup reformat on there. I'm not sure if that will cause any problems with the IRQs as he has a slightly different setup (2 IDE ODDs, a network card, and more). I'd have done it attached to my own motherboard but I BSOD before I can even get started. According to the internet, most BIOS allow a user to look at what IRQs are doing what and even disable some, if necessary. My BIOS doesn't. I suppose that's because it's from an old emachines so they stripped it. I don't know if that's the case but it's missing many options from the online documentation. The last thing on my laundry is flashing my board to a new set of BIOS but I'm a bit fuzzy on that. If I search on MSI's website for a RS480M or MS-7145 under their product listing, my board shows under their S939 lineup, which I find strange. Nevertheless, it states it supports S754 chips, fine. I run over to the BIOS page, where I can check CPU compatibility and I see my 3400+ Newcastle with an "OK" stamped to the right. Things are looking up until I go to download the BIOS themselves... AMI BIOS. Currently I'm running Pheonix BIOS so things are looking a bit cross-eyed. I wasn't planning on flashing anytime soon, especially not with so many flags being thrown, so I'm not torn apart, I just find the delay annoying. Are boards bought from prebuilts sold using modified bios and not retail BIOS?

Tomorrow I'll see what I can do to view my HDs event viewer and see if anything is logged in there. It loosk like I forgot it completely. Goodnight Anandtech... and goodluck. :3

Thanks.
 

montag451

Diamond Member
Dec 17, 2004
4,587
0
0
Try upping the voltage going to RAM a little.

If I got that error, I would start off looking at RAM.

Its possible that a little more oomph is needed when booting into windows than running memtest.
Post back.
 

skreet

Senior member
Sep 7, 2004
681
0
0
Its possible that a little more oomph is needed when booting into windows than running memtest.

Entirely disagree. Usually memtest is finding errors that wouldn't happen in Windows for minutes, if not hours.

I would *swap* the ram, if that's a possibility.
 

montag451

Diamond Member
Dec 17, 2004
4,587
0
0
I agree that RAM would prob have to be changed, but no harm in trying out a couple of things first.
 

SphinxnihpS

Diamond Member
Feb 17, 2005
8,368
25
91
I agree with 'up the RAM voltage'. I had under-powered RAM (thanks Del), and this is exactly what Vista did.
 

Rhonda the Sly

Senior member
Nov 22, 2007
818
4
76
My motherboard has no overclocking options in BIOS. :/ And I tried swapping in new memory:

I tried another pair in a few configurations as well, none yielded positive results. Something interesting I did with my sticks was load them into my brother's board with my HD to play StarCraft, WarCraft III, and another game, maybe Doom 3 or Oblivion. Either way, everything looked to work just fine.
Tried them in another computer and they work fine. Trying another two sticks in my computer didn't work any better than my own.


Post back.
With pleasure. :)
 

Arcanedeath

Platinum Member
Jan 29, 2000
2,822
1
76
IRQL _NOT_LESS_OR_EQUAL errors are typicaly caused by one of 2 things faulty hardware that stores data, (memory, hdd, cpu (usualy in this order)) or by faulty device drivers, I would suggest you take an empty hard drive and do a clean install of windows and load the latest drivers for all your gear and see what happens, Use Just 1 optical drive 1 HDD, 1 stick of memory, 1 GPU, and pull everything else (and I mean everything) and test it in this config, (you may even want to do this outside the case to rule it out as an issue) don't plug in any fans but the CPU fan.... if it works in that config, Great :) Then start adding stuff back in till you find the culprit, if it doesn't work you may have a faulty chip, board or hdd as you've tested the memory as good in another PC, but at that point I'd lean toward the Motherboard. Good Luck :)

Edit: you may also want to try updating the bios and relaxing your memory timings along w/ running at least 2.6V
 

Rhonda the Sly

Senior member
Nov 22, 2007
818
4
76
Hmm, the hard drive probably won't be ordered for a while. :/ Isn't the hard drive working in another system (or another known to be function HD not working in my system) enough to count out the HD as the cause of the problem? And I'll try what you suggested as soon as I order Vista and the HD.

Just for the sake of doing something between now and then, is there anything else that can cause this specific BSOD?
 

montag451

Diamond Member
Dec 17, 2004
4,587
0
0
There really should be an option to change voltage to RAM.
I would start off slow and then go all the way to 2.8v if needed.

If there is still a problem, then format, reinstall. See if it happens again.

Could always try LIVE KNOPPIX cd, runs off the cd and won't touch your hdd but at least you might see if it is possible to run a different OS temporarily.
 

dclive

Elite Member
Oct 23, 2003
5,626
2
81
Originally posted by: Rhonda the Sly
I understand this is a lot of words, if you want the gist of things, just read the italicized portions.

A short apology: I created a thread a month or so back about the same issue but with the holidays, finals, and waiting for a new DVD drive from the egg, the thread kinda died. I decided to just take my time and run Memtest like suggested when I could after the drive arrived. Sorry to anyone who was totally offended by me disappearing from my own thread. :x

Long story short:
One afternoon I decided to removing the front case panel of my computer to inspect the fan I had placed behind the panel. It was making far too much noise for my liking and I'd had just about enough of it. I opened up the case, cleaned (read: removed) a dust-trapper from my the fan, then slammed the thing shut. After closing it I started receiving IRQL_NOT_LESS_OR_EQUAL errors just before the login screen. Yup, just like that. I thought maybe I messed up a wire or yanked a header but everything checks out okay. Three days prior to the event, I removed my processor. My computer ran fine three days until I decided to remove that damn fan. Tomorrow I'm gonna beat that thing with a hammer. I know it's impossible the fan played any part in this mess but I'm sure the experience will be... therapeutic.

Parts List: Everything marked with "New!" is added after I bought the original package.
New!_6600GT PCI-E
MS-7145 PCB rev.2.1
A64 3400+ (Newcastle)
2 x 512MB Samsung PC3200u
Seagate 7200.7 200GB IDE
New!_Antec Earthwatts 500
New!_Asus SATA DRW201L1T DVD Drive, SATA runs off IDE Channel in BIOS
New!_Sony OEM floppy drive
Windows Media Center, OEM on HD from old emachines.
Logitech USB Wireless KB/Mouse, use PS/2 Dongle

What I've tested
First and foremost: yes, I've checked the memory. I've checked it in every configuration I can think of. Memtest86+ clears both sticks. In case you're wondering, I tried: (A/B), (B/A), (A/0), (0/A), (B/0), and (0/B), A and B being my two memory sticks and 0 being absolutely nothing. (A/B), (B,A), (0/A), and (0/B) all can get 8 to 20 hours on Memtest Test 5. Through the weeks I've run a few hours of various tests for fun ending with no errors. I messed around with some sticks today and (A,0) and (B,0) get stuck in post. Oddly enough, one of my sticks previously couldn't even get the board to do much as that. If my monitor was in sleep mode, it wouldn't even wake up if I tried running it. The fans would spin up and things would get going but I'd be left without video. I can't remember which stick wouldn't run though... and I lost all my papers moving into my new place. If I loaded at least two sticks together my computer displays 1GB of memory and works just as well as having 512MB in DIMM2. I tried another pair in a few configurations as well, none yielded positive results. Something interesting I did with my sticks was load them into my brothers board with my HD to play StarCraft, WarCraft III, and another game, maybe Doom 3 or Oblivion. Either way, everything looked to work just fine.

Other parts I've tested or excluded:
I've played around with a few other parts, namely the GPU, ODD, FDD, HDD, and PSU (hurray for acronyms!). I've switched between my 6600GT and 7900GS but mainly use the 6600 while tinkering because of its size. The power supply is a spankin' new Earthwatts 500 to take over for my old Truepower 430 for future upgrades. My Seagate 7200.7 200GB has also been switched for my brother's, which doesn't perform any better in my computer. Seatools clears the HD as well. The floppy and DVD are new, obtained post-BSOD, sometimes I remove them or disable them in BIOS. Only parts I haven't gotten around to testing individually are my processor and motherboard and unfortunately I'm eyeing the board as the culprit, the slimey bastard. Onboard video doesn't seem to work either, that's two strikes for those keeping count. And before you ask, yes, I remembered to plug the monitor into the board. If I enter the onboard video as initial display in BIOS I get blackness (better than nothing, I guess) and have to navigate BIOS blind... or reset CMOS like anyone with two braincells to rub together would do.

Anything else...? <.<
Recently I've jotted down a number of potential solutions to the problem and tested a few. So far I've gotten around to a few...none worked.
Did a repair installation from (D) partition and proceeded to then remove some programs installed by default.
Tried updating logitech mouseware for my wireless mouse but didn't help. BSODs with no mouse in as well. Tried a PS/2 mouse with default and updated drivers.
Using an Nvidia graphics card, tried updating drivers on that, too.
I set all non-essential programs not run on startup in MSCONFIG.
Tried patching Windows up completely with no success.
Had a hell of a time uninstalling CD emulation software but I did (with the help of that reformat). It didn't help.
HD jumpers have been checked and double-checked for placement.
Checked the IDE cable on the drive as well. Has the notch so I know it's not reverse.
I've tried turning off hardware acceleration.
I tried updating ACPI drivers but apparently they're up to date.
Tried Enabling/Disabling USB Legacy Support.
In BIOS CPU idles at 20~24°, so it's not frying itself. And while I'm here... go winter! Now if only I could make it into Windows...

Things I still think need looking into: You guys might be able to give a quicker take on these.
**Safe Mode booting hangs on agpCPQ.sys, it could have something to do with that or what should be loading next, ACPI.
**Adjust IRQs. Looking at one of the screens on startup I can tell that these IRQs are being used when everything is turned on.
NA Smbus ctrl
03 Multimedia Device
04 USB 1.0/1.1 EHCI ctrl
04 USB 1.0/1.1 EHCI ctrl
04 USB 2.0 EHCI ctrl
05 Disp ctrl
09 ACPI
10 IDE
10 Network ctrl
11 IDE
11 Serial Bus ctrl
14 IDE

After disabling a few things, it looks like this:
NA Smbus ctrl
09 ACPI
11 Disp ctrl
14 IDE

My brother's computer will run my hard drive so I did a backup reformat on there. I'm not sure if that will cause any problems with the IRQs as he has a slightly different setup (2 IDE ODDs, a network card, and more). I'd have done it attached to my own motherboard but I BSOD before I can even get started. According to the internet, most BIOS allow a user to look at what IRQs are doing what and even disable some, if necessary. My BIOS doesn't. I suppose that's because it's from an old emachines so they stripped it. I don't know if that's the case but it's missing many options from the online documentation. The last thing on my laundry is flashing my board to a new set of BIOS but I'm a bit fuzzy on that. If I search on MSI's website for a RS480M or MS-7145 under their product listing, my board shows under their S939 lineup, which I find strange. Nevertheless, it states it supports S754 chips, fine. I run over to the BIOS page, where I can check CPU compatibility and I see my 3400+ Newcastle with an "OK" stamped to the right. Things are looking up until I go to download the BIOS themselves... AMI BIOS. Currently I'm running Pheonix BIOS so things are looking a bit cross-eyed. I wasn't planning on flashing anytime soon, especially not with so many flags being thrown, so I'm not torn apart, I just find the delay annoying. Are boards bought from prebuilts sold using modified bios and not retail BIOS?

Tomorrow I'll see what I can do to view my HDs event viewer and see if anything is logged in there. It loosk like I forgot it completely. Goodnight Anandtech... and goodluck. :3

Thanks.

Debug your dump. Read my website (see my .sig) and follow the BSOD directions so you can then debug your dump(s), and post the output of !analyze -v for the most recent 3 or 4.
 

Rhonda the Sly

Senior member
Nov 22, 2007
818
4
76
There really should be an option to change voltage to RAM.
There aren't. Trust me, I've looked up and down the BIOS, no voltage settings, timings, or multipliers to be found,

Could always try LIVE KNOPPIX cd, runs off the cd and won't touch your hdd but at least you might see if it is possible to run a different OS temporarily.
Worked. Posting from a Ubuntu LiveCD as I speak. If I called these things ingenious it would be a horrible understatement. Only problem is now I'm more confused than ever about what the problem is. I've have to see what IRQ my brother's computer sets my drive to, maybe Windows is looking for another IRQ and that jams it.

Debug your dump. Read my website (see my .sig) and follow the BSOD directions so you can then debug your dump(s), and post the output of !analyze -v for the most recent 3 or 4.
I'll get working on that right away.
 

Rhonda the Sly

Senior member
Nov 22, 2007
818
4
76
Edit:Dumps are complete.

Okay, I'm posting from my brother's computer with my drive, with a load of bugchecks. I've seperated them with quotes for easy identification. But before we get into those, one thing:

The other day I got a DRIVER_IRQL_NOT_LESS_OR_EQUAL message, I restarted a few times and couldn't get it anymore. No memory dump for it.

DRIVER_IRQL_NOT_LESS_OR_EQUAL
***Stop: 0x0D1 (0x01, 0x02, 0x01, 0x0F6D5DF7F)
--tcpip.sys address F6D5DF1F base at F6D41000, datestamp 4234e0e9

Now lets hit the dumps...


Dump 01
Microsoft (R) Windows Debugger Version 6.8.0004.0 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\WINDOWS\Minidump\Mini010405-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: C:\Documents and Settings\Owner\Desktop\WindowsXP-KB835935-SP2-slp-Symbols;C:\WINDOWS\Symbols
Executable search path is:
Unable to load image ntoskrnl.exe, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
Windows XP Kernel Version 2600 (Service Pack 2) UP Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Kernel base = 0x804d7000 PsLoadedModuleList = 0x805531a0
Debug session time: Tue Jan 4 20:31:41.828 2005 (GMT-8)
System Uptime: 0 days 0:00:25.421
Unable to load image ntoskrnl.exe, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
Loading Kernel Symbols
..........................................................................................................................................
Loading User Symbols
Loading unloaded module list
.......
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.

BugCheck 1000000A, {0, 2, 1, 8051e106}


Probably caused by : ntoskrnl.exe ( nt!KiInsertTimerTable+57 )

Followup: MachineOwner
---------

kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 00000000, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000001, bitfield :
bit 0 : value 0 = read operation, 1 = write operation
bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: 8051e106, address which referenced memory

Debugging Details:
------------------




WRITE_ADDRESS: 00000000

CURRENT_IRQL: 2

FAULTING_IP:
nt!KiInsertTimerTable+57
8051e106 ff08 dec dword ptr [eax]

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: 0xA

PROCESS_NAME: System

LAST_CONTROL_TRANSFER: from 80518808 to 8051e106

STACK_TEXT:
f7a4b818 80518808 00000000 00008000 00000000 nt!KiInsertTimerTable+0x57
f7a4b844 8068466d 867c53e8 00000000 00000044 nt!KiEm87StateToNpxFrame+0x6b
f7a4bdac 805c4a06 80087000 00000000 00000000 nt!$$VProc_ImageExportDirectory+0x2f6d
f7a4bddc 80540fa2 80683528 80087000 00000000 nt!IopProcessSetInterfaceState+0x1fb
f7a4bdec 00000000 00000000 00000000 00000000 nt!RtlIpv4StringToAddressExW+0x16b


STACK_COMMAND: kb

FOLLOWUP_IP:
nt!KiInsertTimerTable+57
8051e106 ff08 dec dword ptr [eax]

SYMBOL_STACK_INDEX: 0

SYMBOL_NAME: nt!KiInsertTimerTable+57

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nt

IMAGE_NAME: ntoskrnl.exe

DEBUG_FLR_IMAGE_TIMESTAMP: 42250a1d

FAILURE_BUCKET_ID: 0xA_W_nt!KiInsertTimerTable+57

BUCKET_ID: 0xA_W_nt!KiInsertTimerTable+57

Followup: MachineOwner

Dump 02
Loading Dump File [C:\WINDOWS\Minidump\Mini010405-02.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: C:\Documents and Settings\Owner\Desktop\WindowsXP-KB835935-SP2-slp-Symbols;C:\WINDOWS\Symbols
Executable search path is:
Unable to load image ntoskrnl.exe, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
Windows XP Kernel Version 2600 (Service Pack 2) UP Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Kernel base = 0x804d7000 PsLoadedModuleList = 0x805531a0
Debug session time: Tue Jan 4 20:33:19.531 2005 (GMT-8)
System Uptime: 0 days 0:00:32.125
Unable to load image ntoskrnl.exe, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
Loading Kernel Symbols
......................................................................................................................................
Loading User Symbols
Loading unloaded module list
......
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1000007F, {8, 80042000, 0, 0}



Probably caused by : ntoskrnl.exe ( nt!RtlpVerCompare+c3 )

Followup: MachineOwner
---------

kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

UNEXPECTED_KERNEL_MODE_TRAP_M (1000007f)
This means a trap occurred in kernel mode, and it's a trap of a kind
that the kernel isn't allowed to have/catch (bound trap) or that
is always instant death (double fault). The first number in the
bugcheck params is the number of the trap (8 = double fault, etc)
Consult an Intel x86 family manual to learn more about what these
traps are. Here is a *portion* of those codes:
If kv shows a taskGate
use .tss on the part before the colon, then kv.
Else if kv shows a trapframe
use .trap on that value
Else
.trap on the appropriate frame will show where the trap was taken
(on x86, this will be the ebp that goes with the procedure KiTrap)
Endif
kb will then show the corrected stack.
Arguments:
Arg1: 00000008, EXCEPTION_DOUBLE_FAULT
Arg2: 80042000
Arg3: 00000000
Arg4: 00000000

Debugging Details:
------------------




BUGCHECK_STR: 0x7f_8

CUSTOMER_CRASH_COUNT: 2

DEFAULT_BUCKET_ID: DRIVER_FAULT

PROCESS_NAME: System

LAST_CONTROL_TRANSFER: from 00000000 to 8053f671

STACK_TEXT:
f7a84ff8 00000000 badb0d00 00000000 00000001 nt!RtlpVerCompare+0xc3


STACK_COMMAND: kb

FOLLOWUP_IP:
nt!RtlpVerCompare+c3
8053f671 895d00 mov dword ptr [ebp],ebx

SYMBOL_STACK_INDEX: 0

SYMBOL_NAME: nt!RtlpVerCompare+c3

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nt

IMAGE_NAME: ntoskrnl.exe

DEBUG_FLR_IMAGE_TIMESTAMP: 42250a1d

FAILURE_BUCKET_ID: 0x7f_8_nt!RtlpVerCompare+c3

BUCKET_ID: 0x7f_8_nt!RtlpVerCompare+c3

Followup: MachineOwner


Dump 03
Microsoft (R) Windows Debugger Version 6.8.0004.0 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\WINDOWS\Minidump\Mini010405-03.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: C:\Documents and Settings\Owner\Desktop\WindowsXP-KB835935-SP2-slp-Symbols;C:\WINDOWS\Symbols
Executable search path is:
Unable to load image ntoskrnl.exe, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
Windows XP Kernel Version 2600 (Service Pack 2) UP Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Kernel base = 0x804d7000 PsLoadedModuleList = 0x805531a0
Debug session time: Tue Jan 4 20:34:56.453 2005 (GMT-8)
System Uptime: 0 days 0:00:33.046
Unable to load image ntoskrnl.exe, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
Loading Kernel Symbols
..........................................................................................................................................
Loading User Symbols
Loading unloaded module list
.......
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1000000A, {15, ff, 1, 8053ef30}



Probably caused by : ntoskrnl.exe ( nt!RtlpSysVolTakeOwnership+cc )

Followup: MachineOwner
---------

kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 00000015, memory referenced
Arg2: 000000ff, IRQL
Arg3: 00000001, bitfield :
bit 0 : value 0 = read operation, 1 = write operation
bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: 8053ef30, address which referenced memory

Debugging Details:
------------------




WRITE_ADDRESS: 00000015

CURRENT_IRQL: ff

FAULTING_IP:
nt!RtlpSysVolTakeOwnership+cc
8053ef30 f744240c00000200 test dword ptr [esp+0Ch],20000h

CUSTOMER_CRASH_COUNT: 3

DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: 0xA

PROCESS_NAME: System

LAST_CONTROL_TRANSFER: from 8068466d to 8053ef30

STACK_TEXT:
f7a4b844 8068466d 867c53e8 00000000 00000044 nt!RtlpSysVolTakeOwnership+0xcc
f7a4bdac 805c4a06 80087000 00000000 00000000 nt!$$VProc_ImageExportDirectory+0x2f6d
f7a4bddc 80540fa2 80683528 80087000 00000000 nt!IopProcessSetInterfaceState+0x1fb
f7a4bdec 00000000 00000000 00000000 00000000 nt!RtlIpv4StringToAddressExW+0x16b


STACK_COMMAND: kb

FOLLOWUP_IP:
nt!RtlpSysVolTakeOwnership+cc
8053ef30 f744240c00000200 test dword ptr [esp+0Ch],20000h

SYMBOL_STACK_INDEX: 0

SYMBOL_NAME: nt!RtlpSysVolTakeOwnership+cc

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nt

IMAGE_NAME: ntoskrnl.exe

DEBUG_FLR_IMAGE_TIMESTAMP: 42250a1d

FAILURE_BUCKET_ID: 0xA_W_nt!RtlpSysVolTakeOwnership+cc

BUCKET_ID: 0xA_W_nt!RtlpSysVolTakeOwnership+cc

Followup: MachineOwner


Dump 04
Microsoft (R) Windows Debugger Version 6.8.0004.0 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\WINDOWS\Minidump\Mini010405-04.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: C:\Documents and Settings\Owner\Desktop\WindowsXP-KB835935-SP2-slp-Symbols;C:\WINDOWS\Symbols
Executable search path is:
Unable to load image ntoskrnl.exe, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
Windows XP Kernel Version 2600 (Service Pack 2) UP Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Kernel base = 0x804d7000 PsLoadedModuleList = 0x805531a0
Debug session time: Tue Jan 4 20:36:15.609 2005 (GMT-8)
System Uptime: 0 days 0:00:28.203
Unable to load image ntoskrnl.exe, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
Loading Kernel Symbols
.......................................................................................................................................
Loading User Symbols
Loading unloaded module list
......
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1000000A, {0, 2, 1, 8051e106}



Probably caused by : ntoskrnl.exe ( nt!KiInsertTimerTable+57 )

Followup: MachineOwner
---------

kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 00000000, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000001, bitfield :
bit 0 : value 0 = read operation, 1 = write operation
bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: 8051e106, address which referenced memory

Debugging Details:
------------------




WRITE_ADDRESS: 00000000

CURRENT_IRQL: 2

FAULTING_IP:
nt!KiInsertTimerTable+57
8051e106 ff08 dec dword ptr [eax]

CUSTOMER_CRASH_COUNT: 4

DEFAULT_BUCKET_ID: COMMON_SYSTEM_FAULT

BUGCHECK_STR: 0xA

PROCESS_NAME: System

LAST_CONTROL_TRANSFER: from 80518808 to 8051e106

STACK_TEXT:
f7a4b818 80518808 00000000 00008000 00000000 nt!KiInsertTimerTable+0x57
f7a4b844 8068466d 867c53e8 00000000 00000044 nt!KiEm87StateToNpxFrame+0x6b
f7a4bdac 805c4a06 80087000 00000000 00000000 nt!$$VProc_ImageExportDirectory+0x2f6d
f7a4bddc 80540fa2 80683528 80087000 00000000 nt!IopProcessSetInterfaceState+0x1fb
f7a4bdec 00000000 00000000 00000000 00000000 nt!RtlIpv4StringToAddressExW+0x16b


STACK_COMMAND: kb

FOLLOWUP_IP:
nt!KiInsertTimerTable+57
8051e106 ff08 dec dword ptr [eax]

SYMBOL_STACK_INDEX: 0

SYMBOL_NAME: nt!KiInsertTimerTable+57

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nt

IMAGE_NAME: ntoskrnl.exe

DEBUG_FLR_IMAGE_TIMESTAMP: 42250a1d

FAILURE_BUCKET_ID: 0xA_W_nt!KiInsertTimerTable+57

BUCKET_ID: 0xA_W_nt!KiInsertTimerTable+57

Followup: MachineOwner

Dump 05
Microsoft (R) Windows Debugger Version 6.8.0004.0 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\WINDOWS\Minidump\Mini010405-05.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: C:\Documents and Settings\Owner\Desktop\WindowsXP-KB835935-SP2-slp-Symbols;C:\WINDOWS\Symbols
Executable search path is:
Unable to load image ntoskrnl.exe, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
Windows XP Kernel Version 2600 (Service Pack 2) UP Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Kernel base = 0x804d7000 PsLoadedModuleList = 0x805531a0
Debug session time: Tue Jan 4 20:39:34.312 2005 (GMT-8)
System Uptime: 0 days 0:00:24.906
Unable to load image ntoskrnl.exe, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
Loading Kernel Symbols
.....................................................................................................................................
Loading User Symbols
Loading unloaded module list
.........
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1000000A, {a, ff, 1, 8053ef30}



Probably caused by : ntoskrnl.exe ( nt!RtlpSysVolTakeOwnership+cc )

Followup: MachineOwner
---------

kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 0000000a, memory referenced
Arg2: 000000ff, IRQL
Arg3: 00000001, bitfield :
bit 0 : value 0 = read operation, 1 = write operation
bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: 8053ef30, address which referenced memory

Debugging Details:
------------------




WRITE_ADDRESS: 0000000a

CURRENT_IRQL: ff

FAULTING_IP:
nt!RtlpSysVolTakeOwnership+cc
8053ef30 f744240c00000200 test dword ptr [esp+0Ch],20000h

CUSTOMER_CRASH_COUNT: 5

DEFAULT_BUCKET_ID: COMMON_SYSTEM_FAULT

BUGCHECK_STR: 0xA

PROCESS_NAME: System

LAST_CONTROL_TRANSFER: from 8068466d to 8053ef30

STACK_TEXT:
f7a4b844 8068466d 867c53e8 00000000 00000044 nt!RtlpSysVolTakeOwnership+0xcc
f7a4bdac 805c4a06 80087000 00000000 00000000 nt!$$VProc_ImageExportDirectory+0x2f6d
f7a4bddc 80540fa2 80683528 80087000 00000000 nt!IopProcessSetInterfaceState+0x1fb
f7a4bdec 00000000 00000000 00000000 00000000 nt!RtlIpv4StringToAddressExW+0x16b


STACK_COMMAND: kb

FOLLOWUP_IP:
nt!RtlpSysVolTakeOwnership+cc
8053ef30 f744240c00000200 test dword ptr [esp+0Ch],20000h

SYMBOL_STACK_INDEX: 0

SYMBOL_NAME: nt!RtlpSysVolTakeOwnership+cc

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nt

IMAGE_NAME: ntoskrnl.exe

DEBUG_FLR_IMAGE_TIMESTAMP: 42250a1d

FAILURE_BUCKET_ID: 0xA_W_nt!RtlpSysVolTakeOwnership+cc

BUCKET_ID: 0xA_W_nt!RtlpSysVolTakeOwnership+cc

Followup: MachineOwner

Dump 06
Microsoft (R) Windows Debugger Version 6.8.0004.0 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\WINDOWS\Minidump\Mini010405-06.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: C:\Documents and Settings\Owner\Desktop\WindowsXP-KB835935-SP2-slp-Symbols;C:\WINDOWS\Symbols
Executable search path is:
Unable to load image ntoskrnl.exe, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
Windows XP Kernel Version 2600 (Service Pack 2) UP Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Kernel base = 0x804d7000 PsLoadedModuleList = 0x805531a0
Debug session time: Tue Jan 4 21:07:29.359 2005 (GMT-8)
System Uptime: 0 days 0:00:21.953
Unable to load image ntoskrnl.exe, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
Loading Kernel Symbols
..................................................................................................................................
Loading User Symbols
Loading unloaded module list
.......
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.

BugCheck 1000007F, {8, 80042000, 0, 0}



Probably caused by : ntoskrnl.exe ( nt!RtlpVerCompare+96 )

Followup: MachineOwner
---------

kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

UNEXPECTED_KERNEL_MODE_TRAP_M (1000007f)
This means a trap occurred in kernel mode, and it's a trap of a kind
that the kernel isn't allowed to have/catch (bound trap) or that
is always instant death (double fault). The first number in the
bugcheck params is the number of the trap (8 = double fault, etc)
Consult an Intel x86 family manual to learn more about what these
traps are. Here is a *portion* of those codes:
If kv shows a taskGate
use .tss on the part before the colon, then kv.
Else if kv shows a trapframe
use .trap on that value
Else
.trap on the appropriate frame will show where the trap was taken
(on x86, this will be the ebp that goes with the procedure KiTrap)
Endif
kb will then show the corrected stack.
Arguments:
Arg1: 00000008, EXCEPTION_DOUBLE_FAULT
Arg2: 80042000
Arg3: 00000000
Arg4: 00000000

Debugging Details:
------------------




BUGCHECK_STR: 0x7f_8

CUSTOMER_CRASH_COUNT: 6

DEFAULT_BUCKET_ID: COMMON_SYSTEM_FAULT

PROCESS_NAME: System

LAST_CONTROL_TRANSFER: from 8053f6ec to 8053f644

STACK_TEXT:
f7a49084 8053f6ec 00000001 00000002 00000000 nt!RtlpVerCompare+0x96
f7a4909c 805102e0 badb0d00 00000001 00000000 nt!RtlpImageDirectoryEntryToData64+0x2f
f7a49158 8053f6ec 00000001 00000002 00000000 nt!_output+0x314
f7a49170 805102e0 badb0d00 00000001 00000000 nt!RtlpImageDirectoryEntryToData64+0x2f
f7a4922c 8053f6ec 00000001 00000002 00000000 nt!_output+0x314
f7a49244 805102e0 badb0d00 00000001 00000000 nt!RtlpImageDirectoryEntryToData64+0x2f
f7a49300 8053f6ec 00000001 00000002 00000000 nt!_output+0x314
f7a49318 805102e0 badb0d00 00000001 00000000 nt!RtlpImageDirectoryEntryToData64+0x2f
f7a493d4 8053f6ec 00000001 00000002 00000000 nt!_output+0x314
f7a493ec 805102e0 badb0d00 00000001 00000000 nt!RtlpImageDirectoryEntryToData64+0x2f
f7a494a8 8053f6ec 00000001 00000002 00000000 nt!_output+0x314
f7a494c0 805102e0 badb0d00 00000001 00000000 nt!RtlpImageDirectoryEntryToData64+0x2f
f7a4957c 8053f6ec 00000001 00000002 00000000 nt!_output+0x314
f7a49594 805102e0 badb0d00 00000001 00000000 nt!RtlpImageDirectoryEntryToData64+0x2f
f7a49650 8053f6ec 00000001 00000002 00000000 nt!_output+0x314
f7a49668 805102e0 badb0d00 00000001 00000000 nt!RtlpImageDirectoryEntryToData64+0x2f
f7a49724 8053f6ec 00000001 00000002 00000000 nt!_output+0x314
f7a4973c 805102e0 badb0d00 00000001 00000000 nt!RtlpImageDirectoryEntryToData64+0x2f
f7a497f8 8053f6ec 00000001 00000002 00000000 nt!_output+0x314
f7a49810 805102e0 badb0d00 00000001 00000000 nt!RtlpImageDirectoryEntryToData64+0x2f
f7a498cc 8053f6ec 00000001 00000002 00000000 nt!_output+0x314
f7a498e4 805102e0 badb0d00 00000001 00000000 nt!RtlpImageDirectoryEntryToData64+0x2f
f7a499a0 8053f6ec 00000001 00000002 00000000 nt!_output+0x314
f7a499b8 805102e0 badb0d00 00000001 00000000 nt!RtlpImageDirectoryEntryToData64+0x2f
f7a49a74 8053f6ec 00000001 00000002 00000000 nt!_output+0x314
f7a49a8c 805102e0 badb0d00 00000001 00000000 nt!RtlpImageDirectoryEntryToData64+0x2f
f7a49b48 8053f6ec 00000001 00000002 00000000 nt!_output+0x314
f7a49b60 805102e0 badb0d00 00000001 00000000 nt!RtlpImageDirectoryEntryToData64+0x2f
f7a49c1c 8053f6ec 00000001 00000002 00000000 nt!_output+0x314
f7a49c34 805102e0 badb0d00 00000001 00000000 nt!RtlpImageDirectoryEntryToData64+0x2f
f7a49cf0 8053f6ec 00000001 00000002 00000000 nt!_output+0x314
f7a49d08 805102e0 badb0d00 00000001 00000000 nt!RtlpImageDirectoryEntryToData64+0x2f
f7a49dc4 8053f6ec 00000001 00000002 00000000 nt!_output+0x314
f7a49ddc 805102e0 badb0d00 00000001 00000000 nt!RtlpImageDirectoryEntryToData64+0x2f
f7a49e98 8053f6ec 00000001 00000002 00000000 nt!_output+0x314
f7a49eb0 805102e0 badb0d00 00000001 00000000 nt!RtlpImageDirectoryEntryToData64+0x2f
f7a49f6c 8053f6ec 00000001 00000002 00000000 nt!_output+0x314
f7a49f84 805102e0 badb0d00 00000001 00000000 nt!RtlpImageDirectoryEntryToData64+0x2f
f7a4a040 8053f6ec 00000001 00000002 00000000 nt!_output+0x314
f7a4a058 805102e0 badb0d00 00000001 00000000 nt!RtlpImageDirectoryEntryToData64+0x2f
f7a4a114 8053f6ec 00000001 00000002 00000000 nt!_output+0x314
f7a4a12c 805102e0 badb0d00 00000001 00000000 nt!RtlpImageDirectoryEntryToData64+0x2f
f7a4a1e8 8053f6ec 00000001 00000002 00000000 nt!_output+0x314
f7a4a200 805102e0 badb0d00 00000001 00000000 nt!RtlpImageDirectoryEntryToData64+0x2f
f7a4a2bc 8053f6ec 00000001 00000002 00000000 nt!_output+0x314
f7a4a2d4 805102e0 badb0d00 00000001 01000000 nt!RtlpImageDirectoryEntryToData64+0x2f
f7a4a390 8053f6ec 00000001 00000002 00000000 nt!_output+0x314
f7a4a3a8 805102e0 badb0d00 00000001 86773030 nt!RtlpImageDirectoryEntryToData64+0x2f
f7a4a464 8053f6ec 00000001 00000002 00000000 nt!_output+0x314
f7a4a47c 805102e0 badb0d00 00000001 804eee19 nt!RtlpImageDirectoryEntryToData64+0x2f
f7a4a538 8053f6ec 00000001 00000002 00000000 nt!_output+0x314
f7a4a550 805102e0 badb0d00 00000001 86773030 nt!RtlpImageDirectoryEntryToData64+0x2f
f7a4a60c 8053f6ec 00000001 00000002 00000000 nt!_output+0x314
f7a4a624 805102e0 badb0d00 00000001 ffffffff nt!RtlpImageDirectoryEntryToData64+0x2f
f7a4a6e0 8053f6ec 00000001 00000002 00000000 nt!_output+0x314
f7a4a6f8 805102e0 badb0d00 00000001 f7a4a72c nt!RtlpImageDirectoryEntryToData64+0x2f
f7a4a7b4 8053f6ec 00000001 00000002 00000000 nt!_output+0x314
f7a4a7cc 805102e0 badb0d00 00000001 00000000 nt!RtlpImageDirectoryEntryToData64+0x2f
f7a4a888 8053f6ec 00000001 00000002 00000000 nt!_output+0x314
f7a4a8a0 805102e0 badb0d00 00000001 f7a4a954 nt!RtlpImageDirectoryEntryToData64+0x2f
f7a4a95c 8053f6ec 00000001 00000002 00000000 nt!_output+0x314
f7a4a974 805102e0 badb0d00 00000001 e1821d90 nt!RtlpImageDirectoryEntryToData64+0x2f
f7a4aa30 8053f6ec 00000001 00000002 00000000 nt!_output+0x314
f7a4aa48 805102e0 badb0d00 00000001 00000000 nt!RtlpImageDirectoryEntryToData64+0x2f
f7a4ab04 8053f6ec 00000001 00000002 00000000 nt!_output+0x314
f7a4ab1c 805102e0 badb0d00 00000001 f7a4ac30 nt!RtlpImageDirectoryEntryToData64+0x2f
f7a4abd8 8053f6ec 00000001 00000002 00000000 nt!_output+0x314
f7a4abf0 805102e0 badb0d00 00000001 00010100 nt!RtlpImageDirectoryEntryToData64+0x2f
f7a4acac 8053f6ec 00000001 00000002 00000000 nt!_output+0x314
f7a4acc4 805102e0 badb0d00 00000001 8062090d nt!RtlpImageDirectoryEntryToData64+0x2f
f7a4ad80 8053f6ec 00000001 00000002 00000000 nt!_output+0x314
f7a4ad98 805102e0 badb0d00 00000001 00000000 nt!RtlpImageDirectoryEntryToData64+0x2f
f7a4ae54 8053f6ec 00000001 00000002 00000000 nt!_output+0x314
f7a4ae6c 805102e0 badb0d00 00000001 00000007 nt!RtlpImageDirectoryEntryToData64+0x2f
f7a4af28 8053f6ec 00000001 00000002 00000000 nt!_output+0x314


STACK_COMMAND: kb

FOLLOWUP_IP:
nt!RtlpVerCompare+96
8053f644 06 push es

SYMBOL_STACK_INDEX: 0

SYMBOL_NAME: nt!RtlpVerCompare+96

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nt

IMAGE_NAME: ntoskrnl.exe

DEBUG_FLR_IMAGE_TIMESTAMP: 42250a1d

FAILURE_BUCKET_ID: 0x7f_8_nt!RtlpVerCompare+96

BUCKET_ID: 0x7f_8_nt!RtlpVerCompare+96

Followup: MachineOwner

Dump 07
Microsoft (R) Windows Debugger Version 6.8.0004.0 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\WINDOWS\Minidump\Mini011108-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: C:\Documents and Settings\Owner\Desktop\WindowsXP-KB835935-SP2-slp-Symbols;C:\WINDOWS\Symbols
Executable search path is:
Unable to load image ntoskrnl.exe, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
Windows XP Kernel Version 2600 (Service Pack 2) UP Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Kernel base = 0x804d7000 PsLoadedModuleList = 0x805531a0
Debug session time: Tue Jan 4 20:40:42.625 2005 (GMT-8)
System Uptime: 0 days 0:00:25.218
Unable to load image ntoskrnl.exe, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
Loading Kernel Symbols
.....................................................................................................................................
Loading User Symbols
Loading unloaded module list
.........
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 100000BE, {0, 13c91, f7a4b788, a}



Probably caused by : ntoskrnl.exe ( nt!KiInsertTimerTable+57 )

Followup: MachineOwner
---------

kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

ATTEMPTED_WRITE_TO_READONLY_MEMORY (be)
An attempt was made to write to readonly memory. The guilty driver is on the
stack trace (and is typically the current instruction pointer).
When possible, the guilty driver's name (Unicode string) is printed on
the bugcheck screen and saved in KiBugCheckDriver.
Arguments:
Arg1: 00000000, Virtual address for the attempted write.
Arg2: 00013c91, PTE contents.
Arg3: f7a4b788, (reserved)
Arg4: 0000000a, (reserved)

Debugging Details:
------------------




CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: 0xBE

PROCESS_NAME: System

LAST_CONTROL_TRANSFER: from 80518808 to 8051e106

STACK_TEXT:
f7a4b818 80518808 00000000 00008000 00000000 nt!KiInsertTimerTable+0x57
f7a4b844 8068466d 867c53e8 00000000 00000044 nt!KiEm87StateToNpxFrame+0x6b
f7a4bdac 805c4a06 80087000 00000000 00000000 nt!$$VProc_ImageExportDirectory+0x2f6d
f7a4bddc 80540fa2 80683528 80087000 00000000 nt!IopProcessSetInterfaceState+0x1fb
f7a4bdec 00000000 00000000 00000000 00000000 nt!RtlIpv4StringToAddressExW+0x16b


STACK_COMMAND: kb

FOLLOWUP_IP:
nt!KiInsertTimerTable+57
8051e106 ff08 dec dword ptr [eax]

SYMBOL_STACK_INDEX: 0

SYMBOL_NAME: nt!KiInsertTimerTable+57

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nt

IMAGE_NAME: ntoskrnl.exe

DEBUG_FLR_IMAGE_TIMESTAMP: 42250a1d

FAILURE_BUCKET_ID: 0xBE_nt!KiInsertTimerTable+57

BUCKET_ID: 0xBE_nt!KiInsertTimerTable+57

Followup: MachineOwner

Dump 08
Microsoft (R) Windows Debugger Version 6.8.0004.0 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\WINDOWS\Minidump\Mini011208-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: C:\Documents and Settings\Owner\Desktop\WindowsXP-KB835935-SP2-slp-Symbols;C:\WINDOWS\Symbols
Executable search path is:
Unable to load image ntoskrnl.exe, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
Windows XP Kernel Version 2600 (Service Pack 2) UP Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Kernel base = 0x804d7000 PsLoadedModuleList = 0x805531a0
Debug session time: Tue Jan 4 23:00:29.437 2005 (GMT-8)
System Uptime: 0 days 0:00:35.031
Unable to load image ntoskrnl.exe, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
Loading Kernel Symbols
....................................................................................................................................
Loading User Symbols
Loading unloaded module list
......
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1000000A, {1a, ff, 1, 8053ef30}



Probably caused by : ntoskrnl.exe ( nt!RtlpSysVolTakeOwnership+cc )

Followup: MachineOwner
---------

kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 0000001a, memory referenced
Arg2: 000000ff, IRQL
Arg3: 00000001, bitfield :
bit 0 : value 0 = read operation, 1 = write operation
bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: 8053ef30, address which referenced memory

Debugging Details:
------------------




WRITE_ADDRESS: 0000001a

CURRENT_IRQL: ff

FAULTING_IP:
nt!RtlpSysVolTakeOwnership+cc
8053ef30 f744240c00000200 test dword ptr [esp+0Ch],20000h

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: 0xA

PROCESS_NAME: System

LAST_CONTROL_TRANSFER: from 8068466d to 8053ef30

STACK_TEXT:
f7a4b844 8068466d 867c53e8 00000000 00000044 nt!RtlpSysVolTakeOwnership+0xcc
f7a4bdac 805c4a06 80087000 00000000 00000000 nt!$$VProc_ImageExportDirectory+0x2f6d
f7a4bddc 80540fa2 80683528 80087000 00000000 nt!IopProcessSetInterfaceState+0x1fb
f7a4bdec 00000000 00000000 00000000 00000000 nt!RtlIpv4StringToAddressExW+0x16b


STACK_COMMAND: kb

FOLLOWUP_IP:
nt!RtlpSysVolTakeOwnership+cc
8053ef30 f744240c00000200 test dword ptr [esp+0Ch],20000h

SYMBOL_STACK_INDEX: 0

SYMBOL_NAME: nt!RtlpSysVolTakeOwnership+cc

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nt

IMAGE_NAME: ntoskrnl.exe

DEBUG_FLR_IMAGE_TIMESTAMP: 42250a1d

FAILURE_BUCKET_ID: 0xA_W_nt!RtlpSysVolTakeOwnership+cc

BUCKET_ID: 0xA_W_nt!RtlpSysVolTakeOwnership+cc

Followup: MachineOwner
 

dclive

Elite Member
Oct 23, 2003
5,626
2
81
The dumps you're analyzing (at least the two with dates on them) are from 2005. Figure out which ones are from 2008 (ending in -08-xx.dmp) and analyze those.

If they're all the same as what I see above, you have a hardware issue or a disk issue. Are you getting lots of disk errors in your System event log?
 

Rhonda the Sly

Senior member
Nov 22, 2007
818
4
76
possibly shorted out the board when you messed with the fan and slammed whatever shut.
I don't like the way that sounds at all, any way to tell?

The dumps you're analyzing (at least the two with dates on them) are from 2005. Figure out which ones are from 2008 (ending in -08-xx.dmp) and analyze those.
Dump 07 and 08 are dated for 2008, but they are all from 2008. Heck, their all from the same day. I had no minidump folder yesterday so I had to go back to my computer and let my computer BSOD a few times to get those dumps. 01 through 06 were done consecutively and dated 01-04-05. Later I got the DRIVER_IRQL and the ATTEMPT_TO_WRITE errors and decided I should put those down as I had never seen them before. I just checked my BIOS clock and it tells me today is Jan 5, 2005. I'm still confused as to why Dump 07 and Dump 08 are marked as 01-11-08 (yesterday), so don't expect me to be able to tell you why they are that way. :/

Edit:I'm blind! I found this in the Event Viewer:
Type:Information Date: 1/11/08 Time: 6:10:02PM Source :W32Time None Event: 35 User: N/A

The time service is now synchronizing the system time with the time source time.windows.com (ntp.m|0x1|192.168.1.65:123->207.46.197.32:123).
Now I know exactly why 07 and 08 are marked as 2008 dumps, I reached my desktop on those two attempts (only for about half a second). Apparently, during startup windows accesses their internet to update time with Microsoft.com. I'll be uploading the rest of dumps 02 to 07 pronto.

If they're all the same as what I see above, you have a hardware issue or a disk issue. Are you getting lots of disk errors in your System event log?
Just went through Eventvwr, only errors I have are off the application type, which can be explained. Every once in a while, after repeatedly trying my HD on my board it'll ask me to run chkdsk (which won't happen in my box), I've done this twice, maybe three times now. Reran SeaTools after my last chkdsk run and got nothing a :thumbsup:.
 

dclive

Elite Member
Oct 23, 2003
5,626
2
81
Remove your modem.

kd> lmvm HSFHWBS2
start end module name
f6076000 f60abb80 HSFHWBS2 T (no symbols)
Loaded symbol image file: HSFHWBS2.sys
Image path: HSFHWBS2.sys
Image name: HSFHWBS2.sys
Timestamp: Thu Jun 17 17:56:20 2004 (40D22194)
CheckSum: 0004330A
ImageSize: 00035B80
Translations: 0000.04b0 0000.04e0 0409.04b0 0409.04e0


Then let us know if the crashing continues.

 

Rhonda the Sly

Senior member
Nov 22, 2007
818
4
76
IModem? What modem? :/ I don't have a modem connected to my computer and when I try to open windows I try to take out everything that I don't need.Only things in how are my 7900GS, 1GB of memory (both sticks), my CPU, PSU, and hard drive.

Edit: and DVD player because I'm on a Ubuntu LiveCD... I just decided to check for drivers or something.

Edit 2: Figured I'd try removing the V92 modem and fax drivers and it didn't help.
 

dclive

Elite Member
Oct 23, 2003
5,626
2
81
Your modem. You have it at IRQ22:

IRQ 22 SoftV92 Data Fax Modem with SmartCP

This:

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx". The memory could not be "%s".

FAULTING_IP:
+128
00000128 ?? ???

EXCEPTION_RECORD: b9bdabb8 -- (.exr 0xffffffffb9bdabb8)
ExceptionAddress: 00000128
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 00000008
Parameter[1]: 00000128
Attempt to execute non-executable address 00000128

CONTEXT: b9bda8b4 -- (.cxr 0xffffffffb9bda8b4)
eax=85d9b8e0 ebx=00000000 ecx=00000001 edx=85e3b008 esi=85f23a70 edi=00000352
eip=00000128 esp=b9bdac80 ebp=85e3b008 iopl=0 nv up ei ng nz ac pe cy
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010297
00000128 ?? ???
Resetting default scope

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: DRIVER_FAULT

PROCESS_NAME: System

ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx". The memory could not be "%s".

WRITE_ADDRESS: 00000128

FAILED_INSTRUCTION_ADDRESS:
+128
00000128 ?? ???

BUGCHECK_STR: 0x7E

LAST_CONTROL_TRANSFER: from f608d542 to 00000128

STACK_TEXT:
WARNING: Frame IP not in any known module. Following frames may be wrong.
b9bdac7c f608d542 00000001 85e3b008 00000002 0x128
b9bdac80 00000000 85e3b008 00000002 b9bdac98 HSFHWBS2+0x17542


FOLLOWUP_IP:
HSFHWBS2+17542
f608d542 ?? ???

SYMBOL_STACK_INDEX: 1

SYMBOL_NAME: HSFHWBS2+17542

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: HSFHWBS2

IMAGE_NAME: HSFHWBS2.sys

DEBUG_FLR_IMAGE_TIMESTAMP: 40d22194

STACK_COMMAND: .cxr 0xffffffffb9bda8b4 ; kb

FAILURE_BUCKET_ID: 0x7E_BAD_IP_HSFHWBS2+17542

BUCKET_ID: 0x7E_BAD_IP_HSFHWBS2+17542

Followup: MachineOwner

Specifically, the driver I posted above.

You also might call it:

Module[ 72] [C:\WINDOWS\SYSTEM32\DRIVERS\HSFHWBS2.SYS]
Company Name: Conexant Systems, Inc.
File Description: HSF_HWB2 WDM driver
Product Version: (7.12:9.0)
File Version: (7.12:9.0)
File Size (bytes): 220032
File Date: Thu Jun 17 14:56:22 2004

Here's more info on your modem:

[Modem]

Item Value
Name SoftV92 Data Fax Modem with SmartCP
Description SoftV92 Data Fax Modem with SmartCP
Device ID PCI\VEN_14F1&DEV_2F20&SUBSYS_200014F1&REV_00\4&2E26DDEC&0&10A4
Device Type Internal Modem
Attached To COM3
Answer Mode Not Available
PNP Device ID PCI\VEN_14F1&DEV_2F20&SUBSYS_200014F1&REV_00\4&2E26DDEC&0&10A4
Provider Name CXT
Modem INF Path oem1.inf
Modem INF Section ModemX
Blind Off X4
Blind On X3
Compression Off +DS=0;
Compression On +DS=3;
Error Control Forced +ES=3,2,4;
Error Control Off +ES=1,0,1;
Error Control On +ES=3,0,2;
Flow Control Hard +IFC=2,2;
Flow Control Off +IFC=0,0;
Flow Control Soft +IFC=1,1;
DCB &#x001c;
Default <
Inactivity Timeout Not Available
Modulation Bell Not Available
Modulation CCITT Not Available
Prefix AT
Pulse P
Reset ATZ<cr>
Responses Key Name SoftV92 Data Fax Modem with SmartCP::CXT::CXT
Speaker Mode Dial M1
Speaker Mode Off M0
Speaker Mode On M2
Speaker Mode Setup M3
Speaker Volume High L3
Speaker Volume Low L1
Speaker Volume Med L2
String Format Not Available
Terminator <cr>
Tone T
Memory Address 0xFDEE0000-0xFDEEFFFF
I/O Port 0x0000DF00-0x0000DF07
IRQ Channel IRQ 22

The MPSReports you sent were from a machine with a 6600GT (crazyjuicebox), so either you're looking in the wrong machine, you sent me stats/mpsreports for the wrong machine, or somebody's REALLY confused.

 

Rhonda the Sly

Senior member
Nov 22, 2007
818
4
76
Well, this just doubles the fun, doens't it? Well, I don't have the Soft V92 Fax Modem and Smart CP installed onto my motherboard, it's in my brothers. I can't quite seem to get rid of it, but I that can be attributed for lack of trying, I'm trying to get this post up fast. I've tried removing it in add/remove programs but it just comes back. Something I noticed however is that it will only load into add/remove programs if I have the card physically installed in the box. If I, say, uninstall the drivers then remove the card itself, the next time I boot I'm guaranteed to not see the drivers load in add/remove. If the OS spots the modem on startup it will load the appropriate drivers. My guess is that it's some sort of generic driver XP uses, who knows. Is it safe to assume XP is falsely identifying the absent modem card and loading it's drivers? I didn't want to leave the thought left open for later so I loaded it into my motherboard for a test run with results, but I wouldn't call them a success, or even positive. I think I managed to move my mouse about a mm, it almost made me squeel. Retried with no mouse in (for the sake of testing) with nothing better.

More importantly, late last night I noticed when I grabbed my brother's memory a day or three ago, I forgot to give his set back. I tried to test a few configurations and with memory in only DIMM1 I managed to get my familiar no-post. I wasn't surprised about that but what came along with it shocked me... read for it? A long beep. Yes, a beep code. Specifically the "no memory installed" code, I believe. Strangely enough, BIOS and Ubuntu (LiveCD)will still recognize 1GB if both DIMMs are used. As far as I'm aware LiveCDs are set to automatically use system memory for storage. I figured maybe if I try to load up more than 512MB (one stick) of space I'd run into an area where I'd need to use DIMM1 and hopefully crash, but I didn't. Memory usage in the system monitor never jumped over 360~380MB, though I had a more than that on the desktop. I guess that only gauges system processes but at least DIMM1 worked well enough...

Back onto the Modem issue: is there any way to perminantly prevent it from running the modem drivers on startup? Also, currently I have two partitions on my HD, my C: drive (180~GB) and another for my WinXP disc image and recovery software (4GB). I am pretty much bound to the recovery partition, should anything happen to it, I would be SOL with recovery and such for my operating system. If I were to take my C: partition and squeeze it down to 150GB, would I still be able to use the recovery software? I've been thinking of putting Ubuntu on my HD to see if it will boot, but I'd rather not see the recovert partition turn my 150GB windows part. and 30GB Ubuntu part. into another 180GB Windows part. should I need to recover.
 

dclive

Elite Member
Oct 23, 2003
5,626
2
81
You didn't comment on the 6600/7900 discrepancy. It might be best for you to run MPSReports again on the machine you're having the problem with, and give me the minidumps from the machine you're having the problem with, because I think we're talking about 2 different machines here.
 

Rhonda the Sly

Senior member
Nov 22, 2007
818
4
76
Everything we've been doing is from these two rigs down below, I can get my hard drive to boot only in the first. In the second (which is my computer) it will BSOD at windows startup. The dumps are from my hard drive which doesn't fully start on my computer. To collect them (let say, if I had a completely empty minidump directory) I take my HD to my computer (2) and power it on until I see a BSOD a few times. After that I take the drive to computer 1 so I can actually get into windows and send them out. So, two computers but only one hard drive being taken into consideration as I don't bother with his.

Computer 1
My brother's computer, I use it to load my HD and get dumps, add/remove drivers or whatnot. /edit/ I don't get BSODs here using my drive.
Parts
6600GT
A64 3400+
MS-7145
Soft V92 Fax Modem
Antec Truepower 430
DVD Drive
CD Drive

Computer 2
My computer, I'm usually just tinkering with the hardware or with BIOS, since it won't go into windows attached here. All the stuff about LiveCDs has been done here, I even post from this computer these days. This is the one that needs fixing, the juicebox.
Parts
6600GT and 7900GS
A64 3400+
MS-7145
Earthwatts 500
Asus DRW2014L1T DVD Drive
Sony OEM Floppy Drive
 

dclive

Elite Member
Oct 23, 2003
5,626
2
81
If it BSODs @ Windows startup, how did you run MPSReports on it? I'm confused. I can also say your modem driver caused the most recent BSOD, of the dumps you sent me.

In any case, if the hardware is the exactly the same between the two, and nothing else is different, and Windows can fully boot in PC #1, then you have a hardware issue in PC #2.

However, if you can reinstall Windows (and it fully works) on PC #2, then it's not hardware, it's software - which suggests there are other differences you aren't aware of.

 

Rhonda the Sly

Senior member
Nov 22, 2007
818
4
76
If it BSODs @ Windows startup, how did you run MPSReports on it? I'm confused. I can also say your modem driver caused the most recent BSOD, of the dumps you sent me.
It only does a BSOD on computer 2, I send these things by loading windows on computer 1 with my HD.

However, if you can reinstall Windows (and it fully works) on PC #2, then it's not hardware, it's software - which suggests there are other differences you aren't aware of.
I reinstall on PC#1, it freezes on #2. I just took another look into the PC1 case today, on the outside I noticed a 3-in-1 media reader (dunno how I missed it...) and a different case, on the inside a different heatsink made by Taisol. Here's everything I can think of for each PC:

As far as my use goes these computers share a HD, my Seagate 7200.7.

Computer 1
J
Case --- e-Machines case T6520

AUDIO1 --- case
JCDIN1 --- case
1394 --- empty
JUSB1 --- case
JUSB2 --- 3-in-1 reader
JFP1 --- These are power and whatnot, case
JFP2 --- case

IDE1 --- Master DVD drive
IDE1 --- Slave CD drive
IDE2 --- Hard drive
Floppy --- empty
SATA1 --- empty
SATA2 --- empty
SATA3 --- empty
SATA4 --- empty
PCI1 --- empty
PCI2 --- empty
PCI3 --- Soft V92 modem
PCI-e1 --- 6600GT
DIMM1 --- 512MB Hynix PC3200U
DIMM2 --- 512MB Hynix PC3200U
Processor --- AMD 3400+

Computer 2
J
Case --- ThermalTake Shark

AUDIO1 case
JCDIN1 --- empty
1394 --- case
JUSB1 --- case
JUSB2 --- empty
JFP1 --- These are power and whatnot, case
JFP2 --- case

IDE1 --- empty
IDE2 --- Hard drive
Floppy --- Floppy
SATA1 --- DVD drive
SATA2 --- empty
SATA3 --- empty
SATA4 --- empty
PCI1 --- empty
PCI2 --- empty
PCI3 --- empty
PCI-e1 --- 7900GS or 6600GT
DIMM1 --- 512MB Samsung PC-3200U
DIMM2 --- 512MB Samsung PC-3200U
Processor --- A64 3400+

All the hardware and every connection in each computer, 'cept fans