Windows XP BSOD's

[latintrpt]

Hey guys i'm having an issue with my computer.
Current Specs:
Core 2 Duo E6300
Asus P5B Deluxe mobo
3 GB Corsair PC2-6400 (400 MHz)
2 320GB Seagate HD's (not raided)
EVGA 7600GT Video Card

As of late i've been having random blue screens
DUMP 1.) FROM TODAY 9/6/07

Microsoft (R) Windows Debugger Version 6.7.0005.1
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\WINDOWS\Minidump\Mini090607-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: *** Invalid ***
****************************************************************************
* Symbol loading may be unreliable without a symbol search path. *
* Use .symfix to have the debugger choose a symbol path. *
* After setting your symbol path, use .reload to refresh symbol locations. *
****************************************************************************
Executable search path is:
*********************************************************************
* Symbols can not be loaded because symbol path is not initialized. *
* *
* The Symbol Path can be set by: *
* using the _NT_SYMBOL_PATH environment variable. *
* using the -y <symbol_path> argument when starting the debugger. *
* using .sympath and .sympath+ *
*********************************************************************
Unable to load image ntoskrnl.exe, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
*** ERROR: Module load completed but symbols could not be loaded for ntoskrnl.exe
Windows XP Kernel Version 2600 (Service Pack 2) MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055c700
Debug session time: Thu Sep 6 09:41:37.462 2007 (GMT-5)
System Uptime: 2 days 22:21:54.062
*********************************************************************
* Symbols can not be loaded because symbol path is not initialized. *
* *
* The Symbol Path can be set by: *
* using the _NT_SYMBOL_PATH environment variable. *
* using the -y <symbol_path> argument when starting the debugger. *
* using .sympath and .sympath+ *
*********************************************************************
Unable to load image ntoskrnl.exe, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
*** ERROR: Module load completed but symbols could not be loaded for ntoskrnl.exe
Loading Kernel Symbols
................................................................................................................................................................
Loading User Symbols
Loading unloaded module list
..............................
*** WARNING: Unable to verify timestamp for hal.dll
*** ERROR: Module load completed but symbols could not be loaded for hal.dll
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 100000C5, {4, 2, 0, 8054a71c}

***** Kernel symbols are WRONG. Please fix symbols to do analysis.

*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!KPRCB ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!KPRCB ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
*************************************************************************
*** WARNING: Unable to verify timestamp for PCIIDEX.SYS
*** ERROR: Module load completed but symbols could not be loaded for PCIIDEX.SYS
*** WARNING: Unable to verify timestamp for atapi.sys
*** ERROR: Module load completed but symbols could not be loaded for atapi.sys
Probably caused by : PCIIDEX.SYS ( PCIIDEX+c91 )

Followup: MachineOwner
---------

DUMP 2.) FROM 08/26/07

Microsoft (R) Windows Debugger Version 6.7.0005.1
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\WINDOWS\Minidump\Mini082607-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: *** Invalid ***
****************************************************************************
* Symbol loading may be unreliable without a symbol search path. *
* Use .symfix to have the debugger choose a symbol path. *
* After setting your symbol path, use .reload to refresh symbol locations. *
****************************************************************************
Executable search path is:
*********************************************************************
* Symbols can not be loaded because symbol path is not initialized. *
* *
* The Symbol Path can be set by: *
* using the _NT_SYMBOL_PATH environment variable. *
* using the -y <symbol_path> argument when starting the debugger. *
* using .sympath and .sympath+ *
*********************************************************************
Unable to load image ntoskrnl.exe, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
*** ERROR: Module load completed but symbols could not be loaded for ntoskrnl.exe
Windows XP Kernel Version 2600 (Service Pack 2) MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055c700
Debug session time: Sun Aug 26 10:34:31.343 2007 (GMT-5)
System Uptime: 0 days 20:10:28.034
*********************************************************************
* Symbols can not be loaded because symbol path is not initialized. *
* *
* The Symbol Path can be set by: *
* using the _NT_SYMBOL_PATH environment variable. *
* using the -y <symbol_path> argument when starting the debugger. *
* using .sympath and .sympath+ *
*********************************************************************
Unable to load image ntoskrnl.exe, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
*** ERROR: Module load completed but symbols could not be loaded for ntoskrnl.exe
Loading Kernel Symbols
...............................................................................................................................................................
Loading User Symbols
Loading unloaded module list
.........................
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1000000A, {206c614c, 2, 1, 8050b043}

***** Kernel symbols are WRONG. Please fix symbols to do analysis.

*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!KPRCB ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!KPRCB ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
*************************************************************************
Probably caused by : ntoskrnl.exe ( nt+34043 )

Followup: MachineOwner
---------

DUMP 3.) FROM 08/25/07

Microsoft (R) Windows Debugger Version 6.7.0005.1
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\WINDOWS\Minidump\Mini082507-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: *** Invalid ***
****************************************************************************
* Symbol loading may be unreliable without a symbol search path. *
* Use .symfix to have the debugger choose a symbol path. *
* After setting your symbol path, use .reload to refresh symbol locations. *
****************************************************************************
Executable search path is:
*********************************************************************
* Symbols can not be loaded because symbol path is not initialized. *
* *
* The Symbol Path can be set by: *
* using the _NT_SYMBOL_PATH environment variable. *
* using the -y <symbol_path> argument when starting the debugger. *
* using .sympath and .sympath+ *
*********************************************************************
Unable to load image ntoskrnl.exe, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
*** ERROR: Module load completed but symbols could not be loaded for ntoskrnl.exe
Windows XP Kernel Version 2600 (Service Pack 2) MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055c700
Debug session time: Sat Aug 25 11:04:17.234 2007 (GMT-5)
System Uptime: 0 days 14:53:10.922
*********************************************************************
* Symbols can not be loaded because symbol path is not initialized. *
* *
* The Symbol Path can be set by: *
* using the _NT_SYMBOL_PATH environment variable. *
* using the -y <symbol_path> argument when starting the debugger. *
* using .sympath and .sympath+ *
*********************************************************************
Unable to load image ntoskrnl.exe, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
*** ERROR: Module load completed but symbols could not be loaded for ntoskrnl.exe
Loading Kernel Symbols
..................................................................................................................................................................
Loading User Symbols
Loading unloaded module list
...............
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 100000C5, {0, 2, 1, 8054a10d}

***** Kernel symbols are WRONG. Please fix symbols to do analysis.

*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!KPRCB ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!KPRCB ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
*************************************************************************
*** WARNING: Unable to verify timestamp for NDIS.sys
*** ERROR: Module load completed but symbols could not be loaded for NDIS.sys
*** WARNING: Unable to verify timestamp for VMNetSrv.sys
*** ERROR: Module load completed but symbols could not be loaded for VMNetSrv.sys
Probably caused by : VMNetSrv.sys ( VMNetSrv+1855 )

Followup: MachineOwner
---------

DUMP 4.) From 3/28/07

Microsoft (R) Windows Debugger Version 6.7.0005.1
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\WINDOWS\Minidump\Mini032807-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: *** Invalid ***
****************************************************************************
* Symbol loading may be unreliable without a symbol search path. *
* Use .symfix to have the debugger choose a symbol path. *
* After setting your symbol path, use .reload to refresh symbol locations. *
****************************************************************************
Executable search path is:
*********************************************************************
* Symbols can not be loaded because symbol path is not initialized. *
* *
* The Symbol Path can be set by: *
* using the _NT_SYMBOL_PATH environment variable. *
* using the -y <symbol_path> argument when starting the debugger. *
* using .sympath and .sympath+ *
*********************************************************************
Unable to load image ntoskrnl.exe, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
*** ERROR: Module load completed but symbols could not be loaded for ntoskrnl.exe
Windows XP Kernel Version 2600 (Service Pack 2) MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055c700
Debug session time: Wed Mar 28 03:33:09.250 2007 (GMT-5)
System Uptime: 0 days 1:52:57.824
*********************************************************************
* Symbols can not be loaded because symbol path is not initialized. *
* *
* The Symbol Path can be set by: *
* using the _NT_SYMBOL_PATH environment variable. *
* using the -y <symbol_path> argument when starting the debugger. *
* using .sympath and .sympath+ *
*********************************************************************
Unable to load image ntoskrnl.exe, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
*** ERROR: Module load completed but symbols could not be loaded for ntoskrnl.exe
Loading Kernel Symbols
............................................................................................................................................
Loading User Symbols
Loading unloaded module list
................
*** WARNING: Unable to verify timestamp for hal.dll
*** ERROR: Module load completed but symbols could not be loaded for hal.dll
Unable to load image Ntfs.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for Ntfs.sys
*** ERROR: Module load completed but symbols could not be loaded for Ntfs.sys
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1000000A, {50ba9938, 2, 1, 806e4a16}

***** Kernel symbols are WRONG. Please fix symbols to do analysis.

*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!KPRCB ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!KPRCB ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
*************************************************************************
*** WARNING: Unable to verify timestamp for avg7rsxp.sys
*** ERROR: Module load completed but symbols could not be loaded for avg7rsxp.sys
*** WARNING: Unable to verify timestamp for ASACPI.sys
*** ERROR: Module load completed but symbols could not be loaded for ASACPI.sys
Probably caused by : avg7rsxp.sys ( avg7rsxp+16ab )

Followup: MachineOwner
---------

If you need anymore info from me, please let me know.

 

[latintrpt]

anyone?

 

[dclive]

Fix your symbols (see my webpage for the setup guide) and then repost the output (see my webpage for what to post).

 

[latintrpt]

Here you go, with the user symbols, Thanks

Crash Dump 1.) 9/6/07

Microsoft (R) Windows Debugger Version 6.7.0005.1
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\WINDOWS\Minidump\Mini090607-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: srv*c:\debug*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows XP Kernel Version 2600 (Service Pack 2) MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 2600.xpsp_sp2_gdr.070227-2254
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055c700
Debug session time: Thu Sep 6 09:41:37.462 2007 (GMT-5)
System Uptime: 2 days 22:21:54.062
Loading Kernel Symbols
................................................................................................................................................................
Loading User Symbols
Loading unloaded module list
..............................
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 100000C5, {4, 2, 0, 8054a71c}

Probably caused by : PCIIDEX.SYS ( PCIIDEX!BmFlush+29 )

Followup: MachineOwner
---------

Crash Dump 2.) 8/26/07


Microsoft (R) Windows Debugger Version 6.7.0005.1
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\WINDOWS\Minidump\Mini082607-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: srv*c:\debug*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows XP Kernel Version 2600 (Service Pack 2) MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 2600.xpsp_sp2_gdr.070227-2254
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055c700
Debug session time: Sun Aug 26 10:34:31.343 2007 (GMT-5)
System Uptime: 0 days 20:10:28.034
Loading Kernel Symbols
...............................................................................................................................................................
Loading User Symbols
Loading unloaded module list
.........................
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1000000A, {206c614c, 2, 1, 8050b043}

Probably caused by : memory_corruption ( nt!MiRemoveUnusedSegments+6f9 )

Followup: MachineOwner
---------

Crash Dump 3.) 8/25/07


Microsoft (R) Windows Debugger Version 6.7.0005.1
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\WINDOWS\Minidump\Mini082507-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: srv*c:\debug*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows XP Kernel Version 2600 (Service Pack 2) MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 2600.xpsp_sp2_gdr.070227-2254
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055c700
Debug session time: Sat Aug 25 11:04:17.234 2007 (GMT-5)
System Uptime: 0 days 14:53:10.922
Loading Kernel Symbols
..................................................................................................................................................................
Loading User Symbols
Loading unloaded module list
...............
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 100000C5, {0, 2, 1, 8054a10d}

Unable to load image VMNetSrv.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for VMNetSrv.sys
*** ERROR: Module load completed but symbols could not be loaded for VMNetSrv.sys
Probably caused by : Pool_Corruption ( nt!ExDeferredFreePool+107 )

Followup: Pool_corruption
---------

Crash Dump 4.) 3/28/07


Microsoft (R) Windows Debugger Version 6.7.0005.1
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\WINDOWS\Minidump\Mini032807-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: srv*c:\debug*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows XP Kernel Version 2600 (Service Pack 2) MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 2600.xpsp_sp2_gdr.061219-0316
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055c700
Debug session time: Wed Mar 28 03:33:09.250 2007 (GMT-5)
System Uptime: 0 days 1:52:57.824
Loading Kernel Symbols
............................................................................................................................................
Loading User Symbols
Loading unloaded module list
................
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1000000A, {50ba9938, 2, 1, 806e4a16}

*** WARNING: Unable to verify timestamp for avg7rsxp.sys
*** ERROR: Module load completed but symbols could not be loaded for avg7rsxp.sys
Probably caused by : avg7rsxp.sys ( avg7rsxp+2328 )

Followup: MachineOwner
---------

 

[latintrpt]

REVISED:
Crash Dump 1.) 9/6/07

Microsoft (R) Windows Debugger Version 6.7.0005.1
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\WINDOWS\Minidump\Mini090607-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: srv*c:\debug*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows XP Kernel Version 2600 (Service Pack 2) MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 2600.xpsp_sp2_gdr.070227-2254
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055c700
Debug session time: Thu Sep 6 09:41:37.462 2007 (GMT-5)
System Uptime: 2 days 22:21:54.062
Loading Kernel Symbols
................................................................................................................................................................
Loading User Symbols
Loading unloaded module list
..............................
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 100000C5, {4, 2, 0, 8054a71c}

Probably caused by : PCIIDEX.SYS ( PCIIDEX!BmFlush+29 )

Followup: MachineOwner
---------
0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

DRIVER_CORRUPTED_EXPOOL (c5)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is
caused by drivers that have corrupted the system pool. Run the driver
verifier against any new (or suspect) drivers, and if that doesn't turn up
the culprit, then use gflags to enable special pool.
Arguments:
Arg1: 00000004, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000000, value 0 = read operation, 1 = write operation
Arg4: 8054a71c, address which referenced memory

Debugging Details:
------------------


BUGCHECK_STR: 0xC5_2

CURRENT_IRQL: 2

FAULTING_IP:
nt!ExFreePoolWithTag+43c
8054a71c 668b4b04 mov cx,word ptr [ebx+4]

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: DRIVER_FAULT

PROCESS_NAME: Idle

LAST_CONTROL_TRANSFER: from 806e6d1a to 8054a71c

STACK_TEXT:
80550380 806e6d1a 88711c40 00000000 806e26b8 nt!ExFreePoolWithTag+0x43c
80550398 bab28c91 8ac48e80 88711c40 00000000 hal!HalPutScatterGatherList+0x1c
805503b8 ba610a05 8ad24d00 8055b0a0 ffdff9c0 PCIIDEX!BmFlush+0x29
80550428 805450bf 8abaf0a4 8abaf030 00000000 atapi!IdePortCompletionDpc+0x75
80550440 8055ae40 ffdffc50 00000000 8055ae40 nt!KiRetireDpcList+0x61
80550450 80544fa4 00000000 0000000e 00000000 nt!KiIdleThread0
80550454 00000000 0000000e 00000000 00000000 nt!KiIdleLoop+0x28


STACK_COMMAND: kb

FOLLOWUP_IP:
PCIIDEX!BmFlush+29
bab28c91 891f mov dword ptr [edi],ebx

SYMBOL_STACK_INDEX: 2

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: PCIIDEX

IMAGE_NAME: PCIIDEX.SYS

DEBUG_FLR_IMAGE_TIMESTAMP: 41107b4c

SYMBOL_NAME: PCIIDEX!BmFlush+29

FAILURE_BUCKET_ID: 0xC5_2_PCIIDEX!BmFlush+29

BUCKET_ID: 0xC5_2_PCIIDEX!BmFlush+29

Followup: MachineOwner
---------

0: kd> lmvm PCIIDEX
start end module name
bab28000 bab2e200 PCIIDEX (pdb symbols) c:\debug\pciidex.pdb\671C7864E7F74A9D8D84385D1A6347411\pciidex.pdb
Loaded symbol image file: PCIIDEX.SYS
Mapped memory image file: c:\debug\PCIIDEX.SYS\41107B4C6200\PCIIDEX.SYS
Image path: PCIIDEX.SYS
Image name: PCIIDEX.SYS
Timestamp: Wed Aug 04 00:59:40 2004 (41107B4C)
CheckSum: 0000D978
ImageSize: 00006200
File version: 5.1.2600.2180
Product version: 5.1.2600.2180
File flags: 0 (Mask 3F)
File OS: 40004 NT Win32
File type: 3.7 Driver
File date: 00000000.00000000
Translations: 0000.04b0
CompanyName: Microsoft Corporation
ProductName: Microsoft® Windows® Operating System
InternalName: pciidex.sys
OriginalFilename: pciidex.sys
ProductVersion: 5.1.2600.2180
FileVersion: 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
FileDescription: PCI IDE Bus Driver Extension
LegalCopyright: © Microsoft Corporation. All rights reserved.

Crash Dump 2.) 8/26/07


Microsoft (R) Windows Debugger Version 6.7.0005.1
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\WINDOWS\Minidump\Mini082607-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: srv*c:\debug*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows XP Kernel Version 2600 (Service Pack 2) MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 2600.xpsp_sp2_gdr.070227-2254
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055c700
Debug session time: Sun Aug 26 10:34:31.343 2007 (GMT-5)
System Uptime: 0 days 20:10:28.034
Loading Kernel Symbols
...............................................................................................................................................................
Loading User Symbols
Loading unloaded module list
.........................
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1000000A, {206c614c, 2, 1, 8050b043}

Probably caused by : memory_corruption ( nt!MiRemoveUnusedSegments+6f9 )

Followup: MachineOwner
---------

1: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 206c614c, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000001, bitfield :
bit 0 : value 0 = read operation, 1 = write operation
bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: 8050b043, address which referenced memory

Debugging Details:
------------------


WRITE_ADDRESS: 206c614c

CURRENT_IRQL: 2

FAULTING_IP:
nt!MiRemoveUnusedSegments+6f9
8050b043 c74004680d5680 mov dword ptr [eax+4],offset nt!MmUnusedSegmentList (80560d68)

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: 0xA

PROCESS_NAME: System

LAST_CONTROL_TRANSFER: from 8050b3c8 to 8050b043

STACK_TEXT:
bad13d90 8050b3c8 00000000 8acffa90 00000000 nt!MiRemoveUnusedSegments+0x6f9
bad13dac 805ce84c 00000000 00000000 00000000 nt!MiDereferenceSegmentThread+0x60
bad13ddc 8054532e 8050b368 00000000 00000000 nt!PspSystemThreadStartup+0x34
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16


STACK_COMMAND: kb

FOLLOWUP_IP:
nt!MiRemoveUnusedSegments+6f9
8050b043 c74004680d5680 mov dword ptr [eax+4],offset nt!MmUnusedSegmentList (80560d68)

SYMBOL_STACK_INDEX: 0

SYMBOL_NAME: nt!MiRemoveUnusedSegments+6f9

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nt

DEBUG_FLR_IMAGE_TIMESTAMP: 45e53f9d

IMAGE_NAME: memory_corruption

FAILURE_BUCKET_ID: 0xA_W_nt!MiRemoveUnusedSegments+6f9

BUCKET_ID: 0xA_W_nt!MiRemoveUnusedSegments+6f9

Followup: MachineOwner
---------

1: kd> lmvm nt
start end module name
804d7000 806e2000 nt # (pdb symbols) c:\debug\ntkrpamp.pdb\966DF78E558F483199141B029DF5A9D51\ntkrpamp.pdb
Loaded symbol image file: ntkrpamp.exe
Mapped memory image file: c:\debug\ntkrpamp.exe\45E53F9D20b000\ntkrpamp.exe
Image path: ntkrpamp.exe
Image name: ntkrpamp.exe
Timestamp: Wed Feb 28 02:38:53 2007 (45E53F9D)
CheckSum: 001F873F
ImageSize: 0020B000
File version: 5.1.2600.3093
Product version: 5.1.2600.3093
File flags: 0 (Mask 3F)
File OS: 40004 NT Win32
File type: 1.0 App
File date: 00000000.00000000
Translations: 0415.04b0
CompanyName: Microsoft Corporation
ProductName: System operacyjny Microsoft® Windows®
InternalName: ntkrpamp.exe
OriginalFilename: ntkrpamp.exe
ProductVersion: 5.1.2600.3093
FileVersion: 5.1.2600.3093 (xpsp_sp2_gdr.070227-2254)
FileDescription: Jadro i system NT
LegalCopyright: © Microsoft Corporation. Wszelkie prawa zastrzezone.

Crash Dump 3.) 8/25/07


Microsoft (R) Windows Debugger Version 6.7.0005.1
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\WINDOWS\Minidump\Mini082507-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: srv*c:\debug*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows XP Kernel Version 2600 (Service Pack 2) MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 2600.xpsp_sp2_gdr.070227-2254
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055c700
Debug session time: Sat Aug 25 11:04:17.234 2007 (GMT-5)
System Uptime: 0 days 14:53:10.922
Loading Kernel Symbols
..................................................................................................................................................................
Loading User Symbols
Loading unloaded module list
...............
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 100000C5, {0, 2, 1, 8054a10d}

Unable to load image VMNetSrv.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for VMNetSrv.sys
*** ERROR: Module load completed but symbols could not be loaded for VMNetSrv.sys
Probably caused by : Pool_Corruption ( nt!ExDeferredFreePool+107 )

Followup: Pool_corruption
---------

0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

DRIVER_CORRUPTED_EXPOOL (c5)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is
caused by drivers that have corrupted the system pool. Run the driver
verifier against any new (or suspect) drivers, and if that doesn't turn up
the culprit, then use gflags to enable special pool.
Arguments:
Arg1: 00000000, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000001, value 0 = read operation, 1 = write operation
Arg4: 8054a10d, address which referenced memory

Debugging Details:
------------------


BUGCHECK_STR: 0xC5_2

CURRENT_IRQL: 2

FAULTING_IP:
nt!ExDeferredFreePool+107
8054a10d 893b mov dword ptr [ebx],edi

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: DRIVER_FAULT

PROCESS_NAME: Virtual PC.exe

LAST_CONTROL_TRANSFER: from 8054a75f to 8054a10d

STACK_TEXT:
bacc7c98 8054a75f 00000001 896eeeb0 88dace50 nt!ExDeferredFreePool+0x107
bacc7cd8 ba50660f 894cc348 00000000 8050837e nt!ExFreePoolWithTag+0x47f
bacc7ce8 baa19855 894cc348 0000025c 00000000 NDIS!NdisFreeMemory+0x3b
WARNING: Stack unwind information not available. Following frames may be wrong.
bacc7d44 ba528bd6 8a73a7d8 8a1b3000 8a8c402a VMNetSrv+0x1855
bacc7df8 b979e8b3 10000001 0000024e 8a8c4000 NDIS!EthFilterDprIndicateReceive+0xe0
bacc7e48 804f15b6 00000000 87e7f6c8 8a211614 USBPORT!USBPORTSVC_LogEntry+0x41
bacc7e78 b978dee5 87e7f6c8 89262360 8a9b0028 nt!IopfCompleteRequest+0xa2
bacc7ee0 b978eb57 8a7ccb70 00000000 8a9b07d8 USBPORT!USBPORT_CompleteTransfer+0x373
bacc7f10 b978f754 026e6f44 8a9b00e0 8a9b00e0 USBPORT!USBPORT_DoneTransfer+0x137
bacc7f48 b9790f6a 8a9b0028 80545d0c 8a9b0230 USBPORT!USBPORT_FlushDoneTransferList+0x16c
bacc7f74 b979efb0 8a9b0028 80545d0c 8a9b0028 USBPORT!USBPORT_DpcWorker+0x224
bacc7fb0 b979f128 8a9b0028 00000001 8a942778 USBPORT!USBPORT_IsrDpcWorker+0x37e
bacc7fcc 805450bf 8a9b064c 6b755044 00000000 USBPORT!USBPORT_IsrDpc+0x166
bacc7ff4 80544c2b a833db08 00000000 00000000 nt!KiRetireDpcList+0x61
bacc7ff8 a833db08 00000000 00000000 00000000 nt!KiDispatchInterrupt+0x2b
80544c2b 00000000 00000009 0081850f bb830000 0xa833db08


STACK_COMMAND: kb

FOLLOWUP_IP:
nt!ExDeferredFreePool+107
8054a10d 893b mov dword ptr [ebx],edi

SYMBOL_STACK_INDEX: 0

FOLLOWUP_NAME: Pool_corruption

IMAGE_NAME: Pool_Corruption

DEBUG_FLR_IMAGE_TIMESTAMP: 0

SYMBOL_NAME: nt!ExDeferredFreePool+107

MODULE_NAME: Pool_Corruption

FAILURE_BUCKET_ID: 0xC5_2_nt!ExDeferredFreePool+107

BUCKET_ID: 0xC5_2_nt!ExDeferredFreePool+107

Followup: Pool_corruption
---------

Crash Dump 4.) 3/28/07


Microsoft (R) Windows Debugger Version 6.7.0005.1
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\WINDOWS\Minidump\Mini032807-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: srv*c:\debug*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows XP Kernel Version 2600 (Service Pack 2) MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 2600.xpsp_sp2_gdr.061219-0316
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055c700
Debug session time: Wed Mar 28 03:33:09.250 2007 (GMT-5)
System Uptime: 0 days 1:52:57.824
Loading Kernel Symbols
............................................................................................................................................
Loading User Symbols
Loading unloaded module list
................
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1000000A, {50ba9938, 2, 1, 806e4a16}

*** WARNING: Unable to verify timestamp for avg7rsxp.sys
*** ERROR: Module load completed but symbols could not be loaded for avg7rsxp.sys
Probably caused by : avg7rsxp.sys ( avg7rsxp+2328 )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 50ba9938, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000001, bitfield :
bit 0 : value 0 = read operation, 1 = write operation
bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: 806e4a16, address which referenced memory

Debugging Details:
------------------


WRITE_ADDRESS: 50ba9938

CURRENT_IRQL: 2

FAULTING_IP:
hal!KeAcquireInStackQueuedSpinLock+26
806e4a16 8711 xchg edx,dword ptr [ecx]

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: 0xA

PROCESS_NAME: svchost.exe

LAST_CONTROL_TRANSFER: from ba6358c9 to 806e4a16

STACK_TEXT:
b5b586d0 ba6358c9 50ba9904 8a014000 b5b58704 hal!KeAcquireInStackQueuedSpinLock+0x26
b5b586d0 ba6358c9 50ba9904 8a014000 b5b58704 Ntfs!NtfsAcquireResourceExclusive+0x20
b5b586e0 ba655631 8a014008 e422c5c8 8a014000 Ntfs!NtfsAcquireResourceExclusive+0x20
b5b58704 ba659762 8a014000 e422c5c8 00000000 Ntfs!NtfsAcquireExclusiveFcb+0x42
b5b58730 ba659cb9 8a014008 e422c5c8 00000002 Ntfs!NtfsAcquireFcbWithPaging+0x74
b5b58764 ba658f73 8a014008 00000016 e15d4d20 Ntfs!NtfsFindPrefixHashEntry+0x2ec
b5b588d0 ba65af64 8a014008 8901c8c8 b5b58928 Ntfs!NtfsCommonCreate+0xb39
b5b589b0 804ef095 8a0a7020 8901c8c8 88ffac00 Ntfs!NtfsFsdCreate+0x1ec
b5b589c0 ba6de876 8901cae8 8a11bf38 88ffac30 nt!IopfCallDriver+0x31
b5b58a0c 804ef095 8a0ed768 00000001 8901c8c8 sr!SrCreate+0x150
b5b58a1c bac6a328 badde9f0 8901c8c8 89fad3b8 nt!IopfCallDriver+0x31
WARNING: Stack unwind information not available. Following frames may be wrong.
b5b58a38 bac696ab 89fad300 88ffac00 badde436 avg7rsxp+0x2328
b5b58b4c 805bddc0 8a0954b0 00000000 8902bb70 avg7rsxp+0x16ab
b5b58bc4 805ba448 00000000 b5b58c04 00000040 nt!ObpLookupObjectName+0x53c
b5b58c18 80574ec1 00000000 00000000 8fc46001 nt!ObOpenObjectByName+0xea
b5b58c94 80575838 00cbe660 80100080 00cbe600 nt!IopCreateFile+0x407
b5b58cf0 80577f02 00cbe660 80100080 00cbe600 nt!IoCreateFile+0x8e
b5b58d30 8054086c 00cbe660 80100080 00cbe600 nt!NtCreateFile+0x30
b5b58d30 7c90eb94 00cbe660 80100080 00cbe600 nt!KiFastCallEntry+0xfc
00cbe658 00000000 00000000 00000000 00000000 0x7c90eb94


STACK_COMMAND: kb

FOLLOWUP_IP:
avg7rsxp+2328
bac6a328 ?? ???

SYMBOL_STACK_INDEX: b

SYMBOL_NAME: avg7rsxp+2328

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: avg7rsxp

IMAGE_NAME: avg7rsxp.sys

DEBUG_FLR_IMAGE_TIMESTAMP: 45bf5f7a

FAILURE_BUCKET_ID: 0xA_W_avg7rsxp+2328

BUCKET_ID: 0xA_W_avg7rsxp+2328

Followup: MachineOwner
---------

0: kd> lmvm avg7rsxp
start end module name
bac68000 bac6ec80 avg7rsxp T (no symbols)
Loaded symbol image file: avg7rsxp.sys
Image path: avg7rsxp.sys
Image name: avg7rsxp.sys
Timestamp: Tue Jan 30 09:08:42 2007 (45BF5F7A)
CheckSum: 0000C1DC
ImageSize: 00006C80
Translations: 0000.04b0 0000.04e0 0409.04b0 0409.04e0

 

[dclive]

OK, so from this you can see AVG caused your crash back in March, and your more recent ones might have been caused by Virtual PC's VMNet driver, but since you have 3 different dumps in a period of a week or two it's tough to say - start with removing VPC and seeing if it gets better (and hopefully AVG is long gone), but given the 3 different dumps one place to look is hardware. Anyway, try the VPC bit first, and if you like turn on driver verification (start/run/verifier/pick all defaults, reboot).