BSoD's, several of them :S

Hi folks,

I am experiencing several BSoD's lately.
Began about 5 weeks ago or so with an occasional BSoD. Now I get them so often I lost count.

They vary as far as code go, but I can't figure out what on earth is going on.
I run Kaspersky Internet Security, did a complete uninstall and all with their help but one error keeps coming back every few crashes. Most common is ntoskrnl.exe error, for which I have tried several fixes and tests without any result. I ended up copying the i386 file manually onto my HD.

I ran a HD check with the manufacturers' tool and HD is in ship shape.

As far as I am able to tell all drivers are up to date as well.

I run Windows XP sp3.

Any idea to what it can be?

Sincerely, Marti

 

Increasing in numbers now... Had 5 of them since last entry.

Managed to grab a few of the 'names' real quick on a piece of paper.
Will try to add the mini dumps is it let's me.

Hoping someone can help, otherwise I have to return to the shop and hope for the best.

ETA// Can someone help me attach the .dmp files? I get an Invalid file error/

 

Hi Marti, reads like a frustrating time you're having.

Copy the minidump files to your Desktop, then zip them and attach the zip - try just zipping and uploading the latest 3 to begin with.

 

Thanks for your reply.
Did work this time

Hopefully someone can make anything of it 'cause I'm lost in the woods.

 

Hmm, this feels like a driver issue but which one, or combination of, I can't tell. If the BSOD's had begun inside the last 3 weeks, I might be able to hazard a guess.

Is Windows fully updated?

Can you give me full hardware specs please? CPU, motherboard make/model, RAM, graphics card, etc?

And upload any more recent dumps

Code:

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck C2, {40, 0, 80000000, 0}

Probably caused by : ntkrpamp.exe ( nt!KiFastCallEntry+fc )

Followup: MachineOwner
---------

1: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

BAD_POOL_CALLER (c2)
The current thread is making a bad pool request.  Typically this is at a bad IRQL level or double freeing the same allocation, etc.
Arguments:
Arg1: 00000040, Attempt to free usermode address to kernel pool
Arg2: 00000000, Starting address
Arg3: 80000000, Start of system address space
Arg4: 00000000, 0

Debugging Details:
------------------


FAULTING_IP: 
nt!KiFastCallEntry+fc
8054161c 8be5            mov     esp,ebp

BUGCHECK_STR:  0xc2_40

CUSTOMER_CRASH_COUNT:  2

DEFAULT_BUCKET_ID:  DRIVER_FAULT

PROCESS_NAME:  lsass.exe

LAST_CONTROL_TRANSFER:  from 80548c2d to 804f9f33

STACK_TEXT:  
b8543cbc 80548c2d 000000c2 00000040 00000000 nt!KeBugCheckEx+0x1b
b8543cfc 8054b49a 00000000 b8543d44 e3188c50 nt!MiFreePoolPages+0x8b
b8543d4c 8054161c 00000000 00a5fe6c 00000000 nt!ExFreePoolWithTag+0x1ba
b8543d4c 7c90e4f4 00000000 00a5fe6c 00000000 nt!KiFastCallEntry+0xfc
WARNING: Frame IP not in any known module. Following frames may be wrong.
00a5ff74 00000000 00000000 00000000 00000000 0x7c90e4f4


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt!KiFastCallEntry+fc
8054161c 8be5            mov     esp,ebp

SYMBOL_STACK_INDEX:  3

SYMBOL_NAME:  nt!KiFastCallEntry+fc

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrpamp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  4802516a

FAILURE_BUCKET_ID:  0xc2_40_nt!KiFastCallEntry+fc

BUCKET_ID:  0xc2_40_nt!KiFastCallEntry+fc

Followup: MachineOwner
---------


*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 4E, {99, 774f8, 0, 0}

Probably caused by : memory_corruption ( nt!MiDeleteValidAddress+156 )

Followup: MachineOwner
---------

1: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

PFN_LIST_CORRUPT (4e)
Typically caused by drivers passing bad memory descriptor lists (ie: calling
MmUnlockPages twice with the same list, etc).  If a kernel debugger is
available get the stack trace.
Arguments:
Arg1: 00000099, A PTE or PFN is corrupt
Arg2: 000774f8, page frame number
Arg3: 00000000, current page state
Arg4: 00000000, 0

Debugging Details:
------------------


BUGCHECK_STR:  0x4E_99

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  DRIVER_FAULT

PROCESS_NAME:  firefox.exe

LAST_CONTROL_TRANSFER:  from 80511a24 to 804f9f33

STACK_TEXT:  
aa285bc4 80511a24 0000004e 00000099 000774f8 nt!KeBugCheckEx+0x1b
aa285bfc 805b0253 08a22201 884d3020 007ffff8 nt!MiDeleteValidAddress+0x156
aa285c1c 805134e7 884d3020 884d3158 884d3020 nt!MiDeleteAddressesInWorkingSet+0x65
aa285c50 805d2706 004d3020 88b482f0 00000001 nt!MmCleanProcessAddressSpace+0x193
aa285cf0 805d27e9 00000001 aa285d4c 804ff93f nt!PspExitThread+0x680
aa285cfc 804ff93f 88b482f0 aa285d48 aa285d3c nt!PsExitSpecialApc+0x23
aa285d4c 80541687 00000001 00000000 aa285d64 nt!KiDeliverApc+0x1af
aa285d4c 7c90e4f4 00000001 00000000 aa285d64 nt!KiServiceExit+0x59
WARNING: Frame IP not in any known module. Following frames may be wrong.
0513fe84 00000000 00000000 00000000 00000000 0x7c90e4f4


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt!MiDeleteValidAddress+156
80511a24 8b5808          mov     ebx,dword ptr [eax+8]

SYMBOL_STACK_INDEX:  1

SYMBOL_NAME:  nt!MiDeleteValidAddress+156

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

DEBUG_FLR_IMAGE_TIMESTAMP:  4802516a

IMAGE_NAME:  memory_corruption

FAILURE_BUCKET_ID:  0x4E_99_nt!MiDeleteValidAddress+156

BUCKET_ID:  0x4E_99_nt!MiDeleteValidAddress+156

Followup: MachineOwner
---------



*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1000000A, {4, 1c, 1, 80502376}

Probably caused by : rdbss.sys ( rdbss!RxpWorkerThreadDispatcher+4b )

Followup: MachineOwner
---------

1: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 00000004, memory referenced
Arg2: 0000001c, IRQL
Arg3: 00000001, bitfield :
	bit 0 : value 0 = read operation, 1 = write operation
	bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: 80502376, address which referenced memory

Debugging Details:
------------------


WRITE_ADDRESS:  00000004 

CURRENT_IRQL:  1c

FAULTING_IP: 
nt!KiInsertTimerTable+4e
80502376 894204          mov     dword ptr [edx+4],eax

CUSTOMER_CRASH_COUNT:  8

DEFAULT_BUCKET_ID:  COMMON_SYSTEM_FAULT

BUGCHECK_STR:  0xA

PROCESS_NAME:  System

LAST_CONTROL_TRANSFER:  from 8050244b to 80502376

STACK_TEXT:  
a9855d14 8050244b fa0a1f00 ffffffff 0720d923 nt!KiInsertTimerTable+0x4e
a9855d30 804fcc34 fa0a1f00 ffffffff 88eea1dc nt!KiInsertTreeTimer+0x7d
a9855d64 aaa3c469 00000000 00000000 aaa46240 nt!KeRemoveQueue+0x1d8
a9855d9c aaa46957 00a45fc0 aaa46240 a9855ddc rdbss!RxpWorkerThreadDispatcher+0x4b
a9855dac 805cff64 aaa45fc0 00000000 00000000 rdbss!RxWorkerThreadDispatcher+0x1a
a9855ddc 805460de aaa4693d aaa45fc0 00000000 nt!PspSystemThreadStartup+0x34
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16


STACK_COMMAND:  kb

FOLLOWUP_IP: 
rdbss!RxpWorkerThreadDispatcher+4b
aaa3c469 3d02010000      cmp     eax,102h

SYMBOL_STACK_INDEX:  3

SYMBOL_NAME:  rdbss!RxpWorkerThreadDispatcher+4b

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: rdbss

IMAGE_NAME:  rdbss.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  48025ee6

FAILURE_BUCKET_ID:  0xA_rdbss!RxpWorkerThreadDispatcher+4b

BUCKET_ID:  0xA_rdbss!RxpWorkerThreadDispatcher+4b

Followup: MachineOwner
---------

 

Ok,

thanks for your reply

I will look for a simple way to post all my hardware data (mobo, HD, ram 'n all)

Will be back as soon as possible

Added Specs file and all mini dumps since new clean installation.

 

Ok, the dumps have ruled some things out and added more possibilities

Update the ATK0110 driver from the Downloads/Utilities section here please.

 

Another entire edit:
I locted which one to download, but which one to install? It doesn't show XP as option, only vista, windows 7 and windows 2000.
I know I have to chose 32 but then?

 

If you use the installer in the 32 folder (AsAcpiIns.exe), it should install the correct version = W2000 it's the same driver for XP and Windows 2003.

 

Oooooooooooh, okay. Learned something new today right here haha ^_^

Shows you're never to old to learn

Okay, I am going to try that and report back if any problems comes back up again, is that a good idea?

ETA// I clicked the installer and all I saw a quick black flash of the prompt screen. Is that good?

 

GRR, I just checked on the driver date inside the zip, it's the same 2004 driver that you already had Sorry, I was misled by the more recent date on the download page.

Ok, the next thing to update is the full nForce package to the latest available for your chipset: same download page but this time under Chipset, the NVIDIA nForce Chipset Package Driver V15.45 - it's 150+ megabytes so best downloaded on a different PC, one that won't crash inside of 10 minutes

 

Do I run set up or a different file?

First guess is set up, but better safe than sorry

 

It's a self-extracting installer, iirc, so run the setup - just double-click it and follow the prompts.

 

Installed it, it automatically removed the older data.

Curious if it'll BSoD on me again. I'll be back if it does.

Thanks so far Satrow You rock

 

Well, I'm back, as you can see.

Got a double BSoD. One while browsing internet and the other straight after reboot, secs before loading Windows welcome screen.

Attached the mini dumps.

 

Can't edit... but adding another BSoD.

It seems to reboot after the first reboot prior to properly load.
So fully loads windows at 2nd boot.

 

Can you give me as much history as you can please?

The Windows CD that it was installed from: was it an original or Slipstreamed, which Service Pack level was it?

I'd assumed you'd run a memory test while Kaspersky were helping you, is this correct?

Code:

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1000000A, {c8f255, 1c, 1, 80502cb0}

Probably caused by : ntkrpamp.exe ( nt!KiUnlinkThread+0 )

Followup: MachineOwner
---------

1: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 00c8f255, memory referenced
Arg2: 0000001c, IRQL
Arg3: 00000001, bitfield :
	bit 0 : value 0 = read operation, 1 = write operation
	bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: 80502cb0, address which referenced memory

Debugging Details:
------------------


WRITE_ADDRESS:  00c8f255 

CURRENT_IRQL:  1c

FAULTING_IP: 
nt!KiUnlinkThread+0
80502cb0 095154          or      dword ptr [ecx+54h],edx

CUSTOMER_CRASH_COUNT:  2

DEFAULT_BUCKET_ID:  DRIVER_FAULT

BUGCHECK_STR:  0xA

PROCESS_NAME:  plugin-containe

LAST_CONTROL_TRANSFER:  from 80502d1e to 80502cb0

STACK_TEXT:  
a6138ca8 80502d1e 88dfb5e8 88dfb5f0 00000100 nt!KiUnlinkThread
a6138cbc 80502f15 00000001 a6138cd8 00000000 nt!KiUnwaitThread+0x12
a6138ce8 804fa28e 00000000 88dfb5e8 00000000 nt!KiWaitTest+0xab
a6138cfc 8060eac6 88dfb5e8 00000001 00000000 nt!KeSetEvent+0x5a
a6138d54 8054161c 0000023c 00000000 0012f4e4 nt!NtSetEvent+0x72
a6138d54 7c90e4f4 0000023c 00000000 0012f4e4 nt!KiFastCallEntry+0xfc
WARNING: Frame IP not in any known module. Following frames may be wrong.
0012f4e4 00000000 00000000 00000000 00000000 0x7c90e4f4


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt!KiUnlinkThread+0
80502cb0 095154          or      dword ptr [ecx+54h],edx

SYMBOL_STACK_INDEX:  0

SYMBOL_NAME:  nt!KiUnlinkThread+0

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrpamp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  4802516a

FAILURE_BUCKET_ID:  0xA_nt!KiUnlinkThread+0

BUCKET_ID:  0xA_nt!KiUnlinkThread+0

Followup: MachineOwner
---------


*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 4E, {7, 79bf, 1, 0}

Unable to load image klif.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for klif.sys
*** ERROR: Module load completed but symbols could not be loaded for klif.sys
Probably caused by : kmixer.sys ( kmixer!PinDispatchClose+364 )

Followup: MachineOwner
---------

1: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

PFN_LIST_CORRUPT (4e)
Typically caused by drivers passing bad memory descriptor lists (ie: calling
MmUnlockPages twice with the same list, etc).  If a kernel debugger is
available get the stack trace.
Arguments:
Arg1: 00000007, A driver has unlocked a page more times than it locked it
Arg2: 000079bf, page frame number
Arg3: 00000001, current share count
Arg4: 00000000, 0

Debugging Details:
------------------


BUGCHECK_STR:  0x4E_7

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  DRIVER_FAULT

PROCESS_NAME:  plugin-containe

LAST_CONTROL_TRANSFER:  from 80522d03 to 804f9f33

STACK_TEXT:  
a838e8f0 80522d03 0000004e 00000007 000079bf nt!KeBugCheckEx+0x1b
a838e910 80509692 8054b2e0 88910000 00000018 nt!MiDecrementReferenceCount+0x33
a838e93c a6ceaa44 880d1490 888a5018 8812e9b0 nt!MmUnlockPages+0x1ee
a838e960 b74a8695 88084df0 888a5008 a838e9b8 kmixer!PinDispatchClose+0x364
a838e970 804ef18f 88084df0 888a5008 888a5008 ks!DispatchClose+0x32
a838e980 80583af8 88139f78 00000000 00000000 nt!IopfCallDriver+0x31
a838e9b8 805bb466 00139f90 00000000 88139f78 nt!IopDeleteFile+0x132
a838e9d4 805266ca 88139f90 00000000 8054b2e0 nt!ObpRemoveObjectRoutine+0xe0
a838e9ec a6cea9ca 880ca440 8812e9b0 88e28850 nt!ObfDereferenceObject+0x4c
a838ea0c b74a8695 88084df0 880ca430 a838ea64 kmixer!PinDispatchClose+0x2ea
a838ea1c 804ef18f 88084df0 880ca430 880ca430 ks!DispatchClose+0x32
a838ea2c 80583af8 88e28838 00000000 00000000 nt!IopfCallDriver+0x31
a838ea64 805bb466 00e28850 00000000 88e28838 nt!IopDeleteFile+0x132
a838ea80 805266ca 88e28850 00000000 8052667e nt!ObpRemoveObjectRoutine+0xe0
a838ea98 b5d71125 8891de58 e342bdb8 b5d6fba2 nt!ObfDereferenceObject+0x4c
a838eaa4 b5d6fba2 8891de48 a838eac0 b5d7035c sysaudio!CInstance::~CInstance+0x28
a838eab0 b5d7035c 00000001 89029698 a838ead0 sysaudio!CPinInstance::`scalar deleting destructor'+0xd
a838eac0 b74a8695 8a142030 8891de48 a838eb18 sysaudio!CPinInstance::PinDispatchClose+0x26
a838ead0 804ef18f 8a142030 8891de48 8891de48 ks!DispatchClose+0x32
a838eae0 80583af8 88937628 00000000 00000000 nt!IopfCallDriver+0x31
a838eb18 805bb466 00937640 00000000 88937628 nt!IopDeleteFile+0x132
a838eb34 805266ca 88937640 00000000 88953000 nt!ObpRemoveObjectRoutine+0xe0
a838eb4c a881de8c a838eb68 a881de5b 88953000 nt!ObfDereferenceObject+0x4c
a838eb54 a881de5b 88953000 88937640 889530ac wdmaud!CloseSysAudio+0xe
a838eb68 a881ded0 88119c98 88049008 a838eb94 wdmaud!CloseWavePin+0x1f
a838eb78 a881de2e 8895308c 0017be58 00000000 wdmaud!CloseTheWavePin+0x3e
a838eb94 a881d43e 880be8b0 88953000 00000000 wdmaud!Dispatch_ClosePin+0x82
a838ebbc 804ef18f 00000000 88953000 806e6410 wdmaud!SoundDispatch+0x1d7
a838ebcc 8057f982 880be944 8816c400 880be8b0 nt!IopfCallDriver+0x31
a838ebe0 805807f7 8a17d228 880be8b0 8816c400 nt!IopSynchronousServiceTail+0x70
a838ec7c 80579274 000001f8 000003b4 00000000 nt!IopXxxControlFile+0x5c5
a838ecb0 aed45a6a 000001f8 000003b4 00000000 nt!NtDeviceIoControlFile+0x2a
WARNING: Stack unwind information not available. Following frames may be wrong.
a838ed34 8054161c 000001f8 000003b4 00000000 klif+0x2da6a
a838ed34 7c90e4f4 000001f8 000003b4 00000000 nt!KiFastCallEntry+0xfc
096bfe74 00000000 00000000 00000000 00000000 0x7c90e4f4


STACK_COMMAND:  kb

FOLLOWUP_IP: 
kmixer!PinDispatchClose+364
a6ceaa44 8b4648          mov     eax,dword ptr [esi+48h]

SYMBOL_STACK_INDEX:  3

SYMBOL_NAME:  kmixer!PinDispatchClose+364

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: kmixer

IMAGE_NAME:  kmixer.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  480254b3

FAILURE_BUCKET_ID:  0x4E_7_kmixer!PinDispatchClose+364

BUCKET_ID:  0x4E_7_kmixer!PinDispatchClose+364

Followup: MachineOwner
---------


*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 24, {1902fe, acd42da8, acd42aa4, b7e3b94f}

Unable to load image klif.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for klif.sys
*** ERROR: Module load completed but symbols could not be loaded for klif.sys
Probably caused by : Ntfs.sys ( Ntfs!NtfsCreateScb+54 )

Followup: MachineOwner
---------

1: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

NTFS_FILE_SYSTEM (24)
    If you see NtfsExceptionFilter on the stack then the 2nd and 3rd
    parameters are the exception record and context record. Do a .cxr
    on the 3rd parameter and then kb to obtain a more informative stack
    trace.
Arguments:
Arg1: 001902fe
Arg2: acd42da8
Arg3: acd42aa4
Arg4: b7e3b94f

Debugging Details:
------------------


EXCEPTION_RECORD:  acd42da8 -- (.exr 0xffffffffacd42da8)
ExceptionAddress: b7e3b94f (Ntfs!NtfsCreateScb+0x00000054)
   ExceptionCode: c0000005 (Access violation)
  ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 00000000
   Parameter[1]: 00c8073e
Attempt to read from address 00c8073e

CONTEXT:  acd42aa4 -- (.cxr 0xffffffffacd42aa4)
eax=000000a0 ebx=00c806c2 ecx=8a322638 edx=acd42fa8 esi=e17958a8 edi=00000000
eip=b7e3b94f esp=acd42e70 ebp=acd42ef4 iopl=0         nv up ei pl nz na po nc
cs=0008  ss=0010  ds=0023  es=0023  fs=0030  gs=0000             efl=00010202
Ntfs!NtfsCreateScb+0x54:
b7e3b94f 3b437c          cmp     eax,dword ptr [ebx+7Ch] ds:0023:00c8073e=????????
Resetting default scope

CUSTOMER_CRASH_COUNT:  4

DEFAULT_BUCKET_ID:  COMMON_SYSTEM_FAULT

PROCESS_NAME:  firefox.exe

ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

EXCEPTION_PARAMETER1:  00000000

EXCEPTION_PARAMETER2:  00c8073e

READ_ADDRESS:  00c8073e 

FOLLOWUP_IP: 
Ntfs!NtfsCreateScb+54
b7e3b94f 3b437c          cmp     eax,dword ptr [ebx+7Ch]

FAULTING_IP: 
Ntfs!NtfsCreateScb+54
b7e3b94f 3b437c          cmp     eax,dword ptr [ebx+7Ch]

BUGCHECK_STR:  0x24

LAST_CONTROL_TRANSFER:  from b7e3c213 to b7e3b94f

STACK_TEXT:  
acd42ef4 b7e3c213 89201008 e17958a8 000000a0 Ntfs!NtfsCreateScb+0x54
acd42f88 b7e3c5d1 89201008 8867e780 8a358100 Ntfs!NtfsOpenAttribute+0x42
acd42fe0 b7e3cae1 89201008 8867e5f0 8867e780 Ntfs!NtfsOpenExistingAttr+0x1aa
acd430ec b7e3c9b8 89201008 8867e5f0 8867e780 Ntfs!NtfsOpenAttributeInExistingFile+0x1b6
acd431d4 b7e3c151 89201008 8867e5f0 8867e780 Ntfs!NtfsOpenExistingPrefixFcb+0x253
acd43354 b7e3df2d 89201008 8867e5f0 acd433ac Ntfs!NtfsCommonCreate+0x134a
acd43438 804ef18f 8a358020 8867e5f0 8a34dbf8 Ntfs!NtfsFsdCreate+0x1dc
acd43448 b7ebc459 acd43540 804ef18f 8a35add0 nt!IopfCallDriver+0x31
acd43450 804ef18f 8a35add0 8867e5f0 8867e5f0 sr!SrPassThrough+0x31
acd43460 805831fa 8a310688 890c45bc acd435f8 nt!IopfCallDriver+0x31
acd43540 805bf444 8a3106a0 00000000 890c4518 nt!IopParseDevice+0xa12
acd435b8 805bb9d0 00000000 acd435f8 00000240 nt!ObpLookupObjectName+0x53c
acd4360c 80576033 00000000 00000000 00000000 nt!ObOpenObjectByName+0xea
acd43688 80576a20 acd43740 00100001 acd43720 nt!IopCreateFile+0x407
acd436d0 b7ee3c79 acd43740 00100001 acd43720 nt!IoCreateFileSpecifyDeviceObjectHint+0x52
acd43744 b7ee3f63 8960abb8 acd4377c b7ee4480 fltMgr!FltpNormalizeNameComponent+0x75
acd43750 b7ee4480 8960abb8 00000000 8960abb8 fltMgr!FltpCallNormalizeNameComponentHandler+0x41
acd4377c b7ee515a 0000004b 00000000 8960abb8 fltMgr!FltpExpandShortNames+0x110
acd43798 b7ee576b 0000abb8 00000000 000000fe fltMgr!FltpGetNormalizedFileNameWorker+0x90
acd437b0 b7ee32a2 8960abb8 00000000 8960abb8 fltMgr!FltpGetNormalizedFileName+0x19
acd437c8 b7ee3365 80554000 8960abb8 acd43804 fltMgr!FltpCreateFileNameInformation+0x84
acd437d8 b7ed3e0a 8960abb8 890993bc 00000000 fltMgr!CreateTemporaryFileNameInformation+0xf
acd43804 b7ed4366 8960abb8 00000a30 804f0044 fltMgr!FltpGetFileNameInformation+0xaa
acd4382c af2a9540 000993bc 00000101 acd43868 fltMgr!FltGetFileNameInformation+0x114
WARNING: Stack unwind information not available. Following frames may be wrong.
acd4384c af2a9274 890993bc 00000101 acd43868 klif+0x23540
acd4386c af2a9333 890993bc 00000000 acd4388c klif+0x23274
acd43898 af2a1eae 890993bc 8a0e3258 00000000 klif+0x23333
acd43910 b7eceef3 890993bc acd43934 e2ee8000 klif+0x1beae
acd43978 b7ed1338 00099360 00000000 89099360 fltMgr!FltpPerformPostCallbacks+0x1c5
acd4398c b7ed1867 89099360 8958a008 acd439cc fltMgr!FltpProcessIoCompletion+0x10
acd4399c b7ed1ef9 8a0ddcd8 8958a008 89099360 fltMgr!FltpPassThroughCompletion+0x89
acd439cc b7ede754 acd439ec 00000000 00000000 fltMgr!FltpLegacyProcessingAfterPreCallbacksCompleted+0x269
acd43a08 804ef18f 8a0ddcd8 8958a008 8958a008 fltMgr!FltpCreate+0x26a
acd43a18 805831fa 8a310688 89f45efc acd43bb0 nt!IopfCallDriver+0x31
acd43af8 805bf444 8a3106a0 00000000 89f45e58 nt!IopParseDevice+0xa12
acd43b70 805bb9d0 00000000 acd43bb0 00000040 nt!ObpLookupObjectName+0x53c
acd43bc4 80576033 00000000 00000000 d43c9401 nt!ObOpenObjectByName+0xea
acd43c40 805769aa 010bfebc 40100080 010bfe5c nt!IopCreateFile+0x407
acd43c9c 805790b4 010bfebc 40100080 010bfe5c nt!IoCreateFile+0x8e
acd43cdc af2b3384 010bfebc 40100080 010bfe5c nt!NtCreateFile+0x30
acd43d30 8054161c 010bfebc 40100080 010bfe5c klif+0x2d384
acd43d30 7c90e4f4 010bfebc 40100080 010bfe5c nt!KiFastCallEntry+0xfc
010bfeb4 00000000 00000000 00000000 00000000 0x7c90e4f4


SYMBOL_STACK_INDEX:  0

SYMBOL_NAME:  Ntfs!NtfsCreateScb+54

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: Ntfs

IMAGE_NAME:  Ntfs.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  48025be5

STACK_COMMAND:  .cxr 0xffffffffacd42aa4 ; kb

FAILURE_BUCKET_ID:  0x24_Ntfs!NtfsCreateScb+54

BUCKET_ID:  0x24_Ntfs!NtfsCreateScb+54

Followup: MachineOwner
---------


*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 100000BE, {b7eb8104, a6aa121, a57d404c, b}

Probably caused by : sr.sys ( sr!SrWrite+aa )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

ATTEMPTED_WRITE_TO_READONLY_MEMORY (be)
An attempt was made to write to readonly memory.  The guilty driver is on the
stack trace (and is typically the current instruction pointer).
When possible, the guilty driver's name (Unicode string) is printed on
the bugcheck screen and saved in KiBugCheckDriver.
Arguments:
Arg1: b7eb8104, Virtual address for the attempted write.
Arg2: 0a6aa121, PTE contents.
Arg3: a57d404c, (reserved)
Arg4: 0000000b, (reserved)

Debugging Details:
------------------


CUSTOMER_CRASH_COUNT:  3

DEFAULT_BUCKET_ID:  DRIVER_FAULT

BUGCHECK_STR:  0xBE

PROCESS_NAME:  svchost.exe

LAST_CONTROL_TRANSFER:  from b7e18b3b to b7e18b96

STACK_TEXT:  
a57d40d8 b7e18b3b e1895e28 00000002 00000000 Ntfs!NtfsLookupNtfsMcbEntry+0x17f
a57d41e4 b7e18ffc a57d47a4 e1895d90 00000002 Ntfs!NtfsLookupAllocation+0x5b
a57d43b4 b7e18c76 a57d47a4 8a0cdd48 e1895d90 Ntfs!NtfsPrepareBuffers+0x270
a57d459c b7e19a6a a57d47a4 8a0cdd48 e1895d90 Ntfs!NtfsNonCachedIo+0x20e
a57d4794 b7e19c18 a57d47a4 8a0cdd48 0110070a Ntfs!NtfsCommonWrite+0x1943
a57d4908 804ef18f 8a3bd020 8a0cdd48 8a331bf0 Ntfs!NtfsFsdWrite+0xf3
a57d4918 b7ebc3ca 00000000 890d5008 a57d495c nt!IopfCallDriver+0x31
a57d4928 804ef18f 8a368748 8a0cdd48 8a0cdd48 sr!SrWrite+0xaa
a57d4938 b7ed1e9b 8a0e0ee8 8a0cdd48 8a0ed008 nt!IopfCallDriver+0x31
a57d495c b7ed206b a57d497c 8a0e0ee8 00000000 fltMgr!FltpLegacyProcessingAfterPreCallbacksCompleted+0x20b
a57d4994 804ef18f 8a0e0ee8 8a0cdd48 00000000 fltMgr!FltpDispatch+0x11f
a57d49a4 804f04d9 a57d49e0 8a215248 8a215218 nt!IopfCallDriver+0x31
a57d49b8 8050f072 89477e0a a57d49e0 a57d4a80 nt!IoSynchronousPageWrite+0xaf
a57d4aa0 8050fa94 e17c63d8 e2a657c0 e17c6418 nt!MiFlushSectionInternal+0x3f8
a57d4adc 804e438b 8a215248 00000000 00000000 nt!MmFlushSection+0x1f2
a57d4b64 b7e581f3 8a2150e4 00000000 00000000 nt!CcFlushCache+0x1e7
a57d4b90 b7e57f45 8a275b40 e1895d90 00000000 Ntfs!NtfsFlushUserStream+0x6c
a57d4c00 b7e58160 8a275b40 892ff6d8 8a0e0ee8 Ntfs!NtfsCommonFlushBuffers+0x12a
a57d4c64 804ef18f 8a3bd020 892ff6d8 8a331bf0 Ntfs!NtfsFsdFlushBuffers+0x92
a57d4c74 b7ebc459 a57d4cb8 804ef18f 8a368748 nt!IopfCallDriver+0x31
a57d4c7c 804ef18f 8a368748 892ff6d8 892ff6d8 sr!SrPassThrough+0x31
a57d4c8c b7ed209e 892ff6d8 8a309670 89477e88 nt!IopfCallDriver+0x31
a57d4cb8 804ef18f 8a0e0ee8 892ff6d8 806e6410 fltMgr!FltpDispatch+0x152
a57d4cc8 8057f982 89477e88 892ff6d8 8a0e0ee8 nt!IopfCallDriver+0x31
a57d4cdc 80576eb1 8a0e0ee8 892ff6d8 89477e88 nt!IopSynchronousServiceTail+0x70
a57d4d54 8054161c 000006ec 025afa40 025afa48 nt!NtFlushBuffersFile+0x1b9
a57d4d54 7c90e4f4 000006ec 025afa40 025afa48 nt!KiFastCallEntry+0xfc
WARNING: Frame IP not in any known module. Following frames may be wrong.
025afa48 00000000 00000000 00000000 00000000 0x7c90e4f4


STACK_COMMAND:  kb

FOLLOWUP_IP: 
sr!SrWrite+aa
b7ebc3ca 5f              pop     edi

SYMBOL_STACK_INDEX:  7

SYMBOL_NAME:  sr!SrWrite+aa

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: sr

IMAGE_NAME:  sr.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  480252c2

FAILURE_BUCKET_ID:  0xBE_sr!SrWrite+aa

BUCKET_ID:  0xBE_sr!SrWrite+aa

Followup: MachineOwner
---------

These latest BSOD's still feel like they're caused by drivers and judging by the KIS files and NTFS seemingly implicated in them, probably the same BSOD types that you had pre- the current install.

Can you fully uninstall KIS please - if you have a paid subscription, make sure you copy any needed license key for reinstall.

After a reboot, enable the Windows Firewall then download and install MSE.

 

Hi again,

My Windows is an original, came with sp3.

Haven't run a memory test but am going to, once I find an straight forward use tool for it.

So basically you suggest removing Kaspersky again, and then install that Microsoft thingy?
But when I do that, I have wasted the Kaspersky licence.

My husband has virtually the same set up yet he has no issues. His PC is a bit different than mine and a few months older, but no problems what so ever. Mine began, as said, a couple of weeks ago with an occasional BSoD. Then it increased so I made a fresh installation of Windows, but the same issue still exists, obviously It started out of the blue, literally in this case.

 

MemTest86+, you need to create a bootable CD from the ISO, boot from it to run the tests, allow them to run for 7 passes.

The Kaspersky licence will only be wasted if it's proven to cause conflicts with your Windows. If removing it doesn't make a difference, you can reinstall it if you so wish.

We've updated all the hardware drivers that I can see, we're now down to eliminating what's left = software drivers and hardware problems.

 

Memtest came through clean.
Let it run the full 100%, took only 12 minutes or so.

So, the last resort is to play around with Kasper vs Microsoft thingy?
If it should be a Kaspersky error, I wonder why the other 2 users (my husband and my dad - who doesn't live with us, kind you ) don't have this error.

 

Memory tests are not 100% accurate, they cannot fully test RAM, best to run 5-7 tests to be reasonably sure that the memory is good.

I doubt that any 2 installs of Windows are identical, even after only a day or two of normal use. But that has reminded me, can you look in C:\Windows\Setuperr.log with Notepad and check what's in there?

 

Setuperr is an empty file.

You're right about the installs, no 2 are equal, but we have the exact same version (of course we got our own keys and cd).

 

Ok, so that should rule out any faults during the XP install.

 

Suggest I go ahead and take out Kaspersky and use Microsoft for a while to see what goes?

 

I think that's the best way forward

 

I'll go and try that.
I so hope I get rid of those BSoD's somehow... fed up with them by now...:hammer

I'm glad I don't need my PC for work!

 

Haven't uninstalled KIS yet, but I did notice that the last 2 or 3 BSoD's do not contain the klif file (KIS).

Only the ntoskrnl keeps showing it's hideous face.
Other file varies :S

 

Wanted to add:

Removed KIS and installed the Microsoft security thing.
Curious what will happen, or not

 

Installed Microsoft IS but alas, issue still occurs.

I attached all 4 BSoD's of today.

I am getting desperate by now......Seriously thinking of learning the machine how it is to fly without wings...:guns

 

Ok Marti, the latest BSOD (the only one without KIS) points to the portcls.sys driver as being at fault: this is a driver for audio - could you disable any onboard audio in the BIOS please, also disconnect any USB audio devices like headsets, webcams etc.

Code:

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 100000D1, {402c, 2, 0, b44a8a5b}

Probably caused by : portcls.sys ( portcls!CIrpStream::Complete+50 )

Followup: MachineOwner
---------

1: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: 0000402c, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000000, value 0 = read operation, 1 = write operation
Arg4: b44a8a5b, address which referenced memory

Debugging Details:
------------------


READ_ADDRESS:  0000402c 

CURRENT_IRQL:  2

FAULTING_IP: 
portcls!CIrpStream::Complete+50
b44a8a5b 8b492c          mov     ecx,dword ptr [ecx+2Ch]

CUSTOMER_CRASH_COUNT:  4

DEFAULT_BUCKET_ID:  COMMON_SYSTEM_FAULT

BUGCHECK_STR:  0xD1

PROCESS_NAME:  Idle

LAST_CONTROL_TRANSFER:  from b44aca4e to b44a8a5b

STACK_TEXT:  
b84d3cd4 b44aca4e 888a2428 00000300 b84d3d00 portcls!CIrpStream::Complete+0x50
b84d3d10 b44a67bf 000013d8 8055c0c0 b8338000 portcls!CPortPinWaveCyclic::RequestService+0x3a1
b84d3d28 80545eef 88a3da58 88a3da48 00000000 portcls!CServiceGroup::ServiceDpc+0x2a
b84d3d50 80545dd4 00000000 0000000e 00000000 nt!KiRetireDpcList+0x61
b84d3d54 00000000 0000000e 00000000 00000000 nt!KiIdleLoop+0x28


STACK_COMMAND:  kb

FOLLOWUP_IP: 
portcls!CIrpStream::Complete+50
b44a8a5b 8b492c          mov     ecx,dword ptr [ecx+2Ch]

SYMBOL_STACK_INDEX:  0

SYMBOL_NAME:  portcls!CIrpStream::Complete+50

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: portcls

IMAGE_NAME:  portcls.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  48025ccc

FAILURE_BUCKET_ID:  0xD1_portcls!CIrpStream::Complete+50

BUCKET_ID:  0xD1_portcls!CIrpStream::Complete+50

Followup: MachineOwner
---------

1: kd> lmvm portcls
start    end        module name
b44a5000 b44c8a80   portcls    (pdb symbols)          c:\symbols\portcls.pdb\893B99F792D34D5383CF0246F6EF17172\portcls.pdb
    Loaded symbol image file: portcls.sys
    Mapped memory image file: c:\symbols\portcls.sys\48025CCC23a80\portcls.sys
    Image path: portcls.sys
    Image name: portcls.sys
    Timestamp:        Sun Apr 13 20:19:40 2008 (48025CCC)
    CheckSum:         00030B59
    ImageSize:        00023A80
    File version:     5.1.2600.5512
    Product version:  5.1.2600.5512
    File flags:       0 (Mask 3F)
    File OS:          40004 NT Win32
    File type:        3.9 Driver
    File date:        00000000.00000000
    Translations:     0409.04b0
    CompanyName:      Microsoft Corporation
    ProductName:      Microsoft® Windows® Operating System
    InternalName:     portcls.sys
    OriginalFilename: portcls.sys
    ProductVersion:   5.1.2600.5512
    FileVersion:      5.1.2600.5512 (xpsp.080413-2108)
    FileDescription:  Port Class (Class Driver for Port/Miniport Devices)
    LegalCopyright:   © Microsoft Corporation. All rights reserved.

 

I looked in the bios, but haven't got the faintest idea where to look for it.
I looked at the onboard things, but I found nothing that said sound or anything.

Attaching the latest BSoD's as well.

 

Fooey, just missed the edit time:

Disabled the onboard sound Found it ^_^
Unplugged my webcam, pulled out the jacks of my headset as well.

 

The most recent dump points squarely at the audio (sub)system, HDAudBus.sys being flagged but the Stack Text is full of audio references:

Code:

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1000000A, {80fffff4, 2, 0, 80522620}

Unable to load image RtkHDAud.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for RtkHDAud.sys
*** ERROR: Module load completed but symbols could not be loaded for RtkHDAud.sys
Probably caused by : HDAudBus.sys ( HDAudBus!AzController::AllocateContiguousBuffer+37 )

Followup: MachineOwner
---------

1: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 80fffff4, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000000, bitfield :
	bit 0 : value 0 = read operation, 1 = write operation
	bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: 80522620, address which referenced memory

Debugging Details:
------------------


READ_ADDRESS:  80fffff4 

CURRENT_IRQL:  2

FAULTING_IP: 
nt!MiUnlinkFreeOrZeroedPage+de
80522620 8b7910          mov     edi,dword ptr [ecx+10h]

CUSTOMER_CRASH_COUNT:  6

DEFAULT_BUCKET_ID:  COMMON_SYSTEM_FAULT

BUGCHECK_STR:  0xA

PROCESS_NAME:  plugin-containe

LAST_CONTROL_TRANSFER:  from 80651364 to 80522620

STACK_TEXT:  
b70f9ce8 80651364 00001002 8055d29c 00000003 nt!MiUnlinkFreeOrZeroedPage+0xde
b70f9d20 80508b24 00001000 00002000 00001000 nt!MiFindContiguousMemory+0x274
b70f9d4c 80508bb6 00003000 00001000 0007ffaf nt!MiAllocateContiguousMemory+0x10e
b70f9d7c b7d5d21d 00003000 01000000 00000000 nt!MmAllocateContiguousMemorySpecifyCache+0x7a
b70f9db0 b7d4251c 00003000 00000002 88e1f12c HDAudBus!AzController::AllocateContiguousBuffer+0x37
b70f9dd4 b7d42ec8 00000004 00003000 88e1f12c HDAudBus!AzController::AllocateContiguousDmaBuffer+0x6c
b70f9df0 a9a764a9 89d33630 00000004 00003000 HDAudBus!AzBusInterfaceBdl::AllocateContiguousDmaBuffer+0x32
WARNING: Stack unwind information not available. Following frames may be wrong.
b70f9e0c a9dd6f6c 89a30004 00003000 88e1f12c RtkHDAud+0x2c84a9
b70f9e48 a9dd76d0 88e1f078 88e1f080 00000000 RtkHDAud+0x628f6c
b70f9e9c a9dd6e49 0031f008 893b03c0 8942f6c4 RtkHDAud+0x6296d0
b70f9eb4 a9dd1652 00000000 89412008 00000000 RtkHDAud+0x628e49
b70f9ef4 a97fbc2b 88e1f008 89390ac8 00000000 RtkHDAud+0x623652
b70fa210 ac71b049 89ccdb00 00000000 ac71b049 RtkHDAud+0x4dc2b
b70fa254 ac719df2 00000000 890fb3c8 88d55200 portcls!CPortPinWaveCyclic::Init+0x250
b70fa27c ac70dfe3 890fb388 88f617f4 88f617f8 portcls!CPortFilterWaveCyclic::NewIrpTarget+0xd9
b70fa2c4 ac70e132 88d55200 89b92030 88e0c658 portcls!xDispatchCreate+0x90
b70fa2d8 b7d23fdb 89b92030 88e0c658 89b92030 portcls!KsoDispatchCreateWithGenericFactory+0x2b
b70fa2fc b7d230c6 89b92030 00000000 b70fa324 ks!DispatchCreate+0xc7
b70fa30c ac70e09d 89b92030 88e0c658 88e0c658 ks!KsDispatchIrp+0x98
b70fa324 ac70d88a 89b92030 88e0c658 89b92030 portcls!DispatchCreate+0x34
b70fa33c ac70d881 89b92030 88e0c658 b70fa364 portcls!KsoDispatchIrp+0x3b
b70fa34c a9ce51e7 89b92030 88e0c658 88e0c668 portcls!PcDispatchIrp+0x5f
b70fa364 804ef19f 89b92030 88e0c658 88e0c658 RtkHDAud+0x5371e7
b70fa374 80583220 88ebc028 89ccb310 b70fa544 nt!IopfCallDriver+0x31
b70fa454 80583642 89b92030 00000000 88e6cc40 nt!IopParseDevice+0xa12
b70fa48c 805bf065 88ebc028 00000000 88e6cc40 nt!IopParseFile+0x46
b70fa504 805bba14 80000060 b70fa544 00000240 nt!ObpLookupObjectName+0x119
b70fa558 80576057 00000000 00000000 70d75500 nt!ObOpenObjectByName+0xea
b70fa5d4 805769ce e2cdd8b8 40000000 b70fa67c nt!IopCreateFile+0x407
b70fa630 b7d244ee e2cdd8b8 40000000 b70fa67c nt!IoCreateFile+0x8e
b70fa6ac b7d23a77 80000060 b7d23a80 e2b26f58 ks!KsiCreateObjectType+0xd6
b70fa6cc b740dfdf 80000060 e2b26f58 40000200 ks!KsCreatePin+0x33
b70fa6f0 b740e6fc e1355888 e1079aa8 e18745d8 sysaudio!CPinNodeInstance::Create+0x6b
b70fa72c b740d454 00000000 e1355884 e2d825b0 sysaudio!CConnectNodeInstance::Connect+0xb3
b70fa748 b740db2a 00000000 89ccb870 00000000 sysaudio!CStartNodeInstance::Connect+0x52
b70fa770 b740c574 e2d6f658 e1f10970 89ccb870 sysaudio!CStartNodeInstance::Create+0x181
b70fa7a0 b740d1e7 c0000010 89ccb870 00000000 sysaudio!CPinInstance::PinDispatchCreateKP+0xa8
b70fa7bc b740c718 89ccd008 b740c4e6 89ccb870 sysaudio!CInstance::DispatchCreate+0x63
b70fa7f0 b7d23fdb 890e97d0 89ccd008 89ccd018 sysaudio!CPinInstance::PinDispatchCreate+0xc1
b70fa814 804ef19f 890e97d0 00000000 89ccd008 ks!DispatchCreate+0xc7
b70fa824 80583220 88d6e1f8 88e88200 b70fa9f4 nt!IopfCallDriver+0x31
b70fa904 80583642 890e97d0 00000000 88ec6300 nt!IopParseDevice+0xa12
b70fa93c 805bf065 88d6e1f8 00000000 88ec6300 nt!IopParseFile+0x46
b70fa9b4 805bba14 800000f8 b70fa9f4 00000240 nt!ObpLookupObjectName+0x119
b70faa08 80576057 00000000 00000000 4f17f600 nt!ObOpenObjectByName+0xea
b70faa84 805769ce b70fabac 40000000 b70fab2c nt!IopCreateFile+0x407
b70faae0 b7d244ee b70fabac 40000000 b70fab2c nt!IoCreateFile+0x8e
b70fab5c b7d23a77 800000f8 b7d23a80 88d6b120 ks!KsiCreateObjectType+0xd6
b70fab7c a90f53e2 800000f8 88d6b120 40000200 ks!KsCreatePin+0x33
b70fabb0 a90f5813 00000001 0000000a 00000001 wdmaud!OpenSysAudioPin+0xa2
b70fabec a90f4a83 00000092 0000000a 88f657a0 wdmaud!OpenWavePin+0x3e2
b70fac18 a90f4382 88d69a38 88f657a0 00000000 wdmaud!Dispatch_OpenPin+0xb7
b70fac40 804ef19f 00000010 88e3b000 806e7410 wdmaud!SoundDispatch+0x430
b70fac50 8057f98e 88d69acc 890e7458 88d69a38 nt!IopfCallDriver+0x31
b70fac64 8058081d 88fd6560 88d69a38 890e7458 nt!IopSynchronousServiceTail+0x70
b70fad00 80579298 00000234 0000036c 00000000 nt!IopXxxControlFile+0x5c5
b70fad34 8054167c 00000234 0000036c 00000000 nt!NtDeviceIoControlFile+0x2a
b70fad34 7c90e514 00000234 0000036c 00000000 nt!KiFastCallEntry+0xfc
0012e010 00000000 00000000 00000000 00000000 0x7c90e514


STACK_COMMAND:  kb

FOLLOWUP_IP: 
HDAudBus!AzController::AllocateContiguousBuffer+37
b7d5d21d 5f              pop     edi

SYMBOL_STACK_INDEX:  4

SYMBOL_NAME:  HDAudBus!AzController::AllocateContiguousBuffer+37

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: HDAudBus

IMAGE_NAME:  HDAudBus.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4295ef55

FAILURE_BUCKET_ID:  0xA_HDAudBus!AzController::AllocateContiguousBuffer+37

BUCKET_ID:  0xA_HDAudBus!AzController::AllocateContiguousBuffer+37

Followup: MachineOwner
---------

The previous dump point so the nVidia drivers:

Code:

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1000000A, {0, 2, 1, 80522718}

Unable to load image nv4_disp.dll, Win32 error 0n2
*** WARNING: Unable to verify timestamp for nv4_disp.dll
*** ERROR: Module load completed but symbols could not be loaded for nv4_disp.dll
Probably caused by : nv4_disp.dll ( nv4_disp+439e3 )

Followup: MachineOwner
---------

1: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 00000000, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000001, bitfield :
	bit 0 : value 0 = read operation, 1 = write operation
	bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: 80522718, address which referenced memory

Debugging Details:
------------------


WRITE_ADDRESS:  00000000 

CURRENT_IRQL:  2

FAULTING_IP: 
nt!MiRemovePageByColor+66
80522718 ff08            dec     dword ptr [eax]

CUSTOMER_CRASH_COUNT:  5

DEFAULT_BUCKET_ID:  COMMON_SYSTEM_FAULT

BUGCHECK_STR:  0xA

PROCESS_NAME:  firefox.exe

TRAP_FRAME:  ab1c742c -- (.trap 0xffffffffab1c742c)
ErrCode = 00000002
eax=b74284d0 ebx=00000008 ecx=00001ec0 edx=00000030 esi=b7422a10 edi=0a8b7000
eip=bd0559e3 esp=ab1c74a0 ebp=ab1c74bc iopl=0         nv up ei pl nz na pe nc
cs=0008  ss=0010  ds=0023  es=0023  fs=0030  gs=0000             efl=00010206
nv4_disp+0x439e3:
bd0559e3 ??              ???
Resetting default scope

LAST_CONTROL_TRANSFER:  from 80522ab0 to 80522718

STACK_TEXT:  
ab1c73a4 80522ab0 00000000 c00545b8 00000006 nt!MiRemovePageByColor+0x66
ab1c73c0 805208a5 0a8b7000 b7422a10 ab1c74bc nt!MiRemoveZeroPage+0x8a
ab1c7414 805445f0 00000001 0a8b7000 00000000 nt!MmAccessFault+0xeb3
ab1c7414 bd0559e3 00000001 0a8b7000 00000000 nt!KiTrap0E+0xd0
WARNING: Stack unwind information not available. Following frames may be wrong.
ab1c749c 00000000 b7422a08 ab1c75b4 000079b8 nv4_disp+0x439e3


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nv4_disp+439e3
bd0559e3 ??              ???

SYMBOL_STACK_INDEX:  4

SYMBOL_NAME:  nv4_disp+439e3

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nv4_disp

IMAGE_NAME:  nv4_disp.dll

DEBUG_FLR_IMAGE_TIMESTAMP:  4a7afb52

FAILURE_BUCKET_ID:  0xA_nv4_disp+439e3

BUCKET_ID:  0xA_nv4_disp+439e3

Followup: MachineOwner
---------

Ok, I see you've disable the audio, now we'll wait to see what happens next, eh ?

Did you run a MemTest for 5-7 runs yet?

 

The thingy I ran yesterday?
That memtest thing on a bootable cd?

 

Yes, it really needs to be run for about 7 passes to be reasonably sure that the installed memory is good - even then, there are many cases where the memory has been subsequently shown to be defective.

Perhaps a more realistic test would be 7 passes of MemTest then run the PC for 3-4 days on a single stick of RAM, switching the the second stick, test, switch to the third stick, test ... that's pretty time-consuming though.

EDIT: the main point is that ANY hardware problem will defeat anything done in Windows/drivers - the hardware must have a clean bill of health.

 

I'm beginning to think I better take it back to store. Still got 9 months warranty left.

Memtest can't hurt so I'll let it run some passes while I go do other things.

Since I have turned off the onboard sounds, it hasn't crashed (so far), eventhough I have been doing things such as games 'n all.

 

Keep testing it, then setup the MemTest to run overnight.

 

How do I do this?
It's not easy to find the settings for it. If there are any.

 

Even with sound disabled, received new BSoD's.
From what I can tell, all Windows system related.

Is there anything else I can try?

 

Adding another mini dump.

I also received the message that this file: windows\system32\config\system
may be missing or corrupt. It said to use the R to repair / recover, but I haven't got the faintest idea how to use that trash.

 

See this Microsoft page for details, warnings, methods ...

Code:

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1000000A, {1c075b, 1c, 1, 80502cca}

Probably caused by : win32k.sys ( win32k!SetWakeBit+b2 )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 001c075b, memory referenced
Arg2: 0000001c, IRQL
Arg3: 00000001, bitfield :
	bit 0 : value 0 = read operation, 1 = write operation
	bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: 80502cca, address which referenced memory

Debugging Details:
------------------


WRITE_ADDRESS:  001c075b 

CURRENT_IRQL:  1c

FAULTING_IP: 
nt!KiUnlinkThread+0
80502cca 095154          or      dword ptr [ecx+54h],edx

DEFAULT_BUCKET_ID:  DRIVER_FAULT

BUGCHECK_STR:  0xA

PROCESS_NAME:  csrss.exe

LAST_CONTROL_TRANSFER:  from 80502d38 to 80502cca

STACK_TEXT:  
b736da3c 80502d38 88ed71d8 88ed71e0 00000100 nt!KiUnlinkThread
b736da50 80502f2f 00000002 b736da6c 00000000 nt!KiUnwaitThread+0x12
b736da7c 804fa29e 0000000f e147e008 00000010 nt!KiWaitTest+0xab
b736da90 bf80178b 88ed71d8 00000002 00000000 nt!KeSetEvent+0x5a
b736daac bf8012aa e147e008 00000010 80500264 win32k!SetWakeBit+0xb2
b736dad4 bf883163 00000022 006efff4 bf8010ef win32k!TimersProc+0xeb
b736dd30 bf8b8f3f b8327490 00000002 b736dd54 win32k!RawInputThread+0x634
b736dd40 bf801112 b8327490 b736dd64 006efff4 win32k!xxxCreateSystemThreads+0x60
b736dd54 8054167c 00000000 00000022 00000000 win32k!NtUserCallOneParam+0x23
b736dd54 7c90e514 00000000 00000022 00000000 nt!KiFastCallEntry+0xfc
WARNING: Frame IP not in any known module. Following frames may be wrong.
00000000 00000000 00000000 00000000 00000000 0x7c90e514


STACK_COMMAND:  kb

FOLLOWUP_IP: 
win32k!SetWakeBit+b2
bf80178b ebe2            jmp     win32k!SetWakeBit+0xb2 (bf80176f)

SYMBOL_STACK_INDEX:  4

SYMBOL_NAME:  win32k!SetWakeBit+b2

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: win32k

IMAGE_NAME:  win32k.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4de797d3

FAILURE_BUCKET_ID:  0xA_win32k!SetWakeBit+b2

BUCKET_ID:  0xA_win32k!SetWakeBit+b2

Followup: MachineOwner
---------


*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1000000A, {e56c6946, 2, 1, 806e7a2a}

Probably caused by : Ntfs.sys ( Ntfs!NtfsCommonRead+dbb )

Followup: MachineOwner
---------

1: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: e56c6946, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000001, bitfield :
	bit 0 : value 0 = read operation, 1 = write operation
	bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: 806e7a2a, address which referenced memory

Debugging Details:
------------------


WRITE_ADDRESS:  e56c6946 

CURRENT_IRQL:  2

FAULTING_IP: 
hal!KeAcquireInStackQueuedSpinLock+3a
806e7a2a 8902            mov     dword ptr [edx],eax

DEFAULT_BUCKET_ID:  DRIVER_FAULT

BUGCHECK_STR:  0xA

PROCESS_NAME:  firefox.exe

LAST_CONTROL_TRANSFER:  from b7e1b869 to 806e7a2a

STACK_TEXT:  
a953d918 b7e1b869 b7e1b3d9 891d09e8 a953db10 hal!KeAcquireInStackQueuedSpinLock+0x3a
a953d9e0 b7e1b00a a953d9f4 891d09e8 00000001 Ntfs!NtfsCommonRead+0xdbb
a953db90 804ef19f 89d54658 891d09e8 891d09e8 Ntfs!NtfsFsdRead+0x22d
a953dba0 b7ed209e 89960008 89d59f38 89a79d50 nt!IopfCallDriver+0x31
a953dbcc 804ef19f 89d05210 891d09e8 89d4fb38 fltMgr!FltpDispatch+0x152
a953dbdc b7ebc459 a953dc20 804ef19f 89d559e8 nt!IopfCallDriver+0x31
a953dbe4 804ef19f 89d559e8 891d09e8 891d09e8 sr!SrPassThrough+0x31
a953dbf4 b7ed209e 89cf5e40 89d59f38 89cabe40 nt!IopfCallDriver+0x31
a953dc20 804ef19f 89a79d50 891d09e8 0000d000 fltMgr!FltpDispatch+0x152
a953dc30 804efb87 89093020 89cf5e30 89cf5e40 nt!IopfCallDriver+0x31
a953dc44 804efbaf 89a79d50 89cf5e0b 89cf5e48 nt!IopPageReadInternal+0xf3
a953dc64 805166e0 89cabe40 89cf5e68 89cf5e48 nt!IoPageRead+0x1b
a953dce0 80520b08 e18d7598 04d4d764 c0026a68 nt!MiDispatchFault+0x292
a953dd4c 805445f0 00000000 04d4d764 00000001 nt!MmAccessFault+0x1116
a953dd4c 59a8bf84 00000000 04d4d764 00000001 nt!KiTrap0E+0xd0
WARNING: Frame IP not in any known module. Following frames may be wrong.
0109f848 00000000 00000000 00000000 00000000 0x59a8bf84


STACK_COMMAND:  kb

FOLLOWUP_IP: 
Ntfs!NtfsCommonRead+dbb
b7e1b869 e9b0fbffff      jmp     Ntfs!NtfsCommonRead+0xdbb (b7e1b41e)

SYMBOL_STACK_INDEX:  1

SYMBOL_NAME:  Ntfs!NtfsCommonRead+dbb

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: Ntfs

IMAGE_NAME:  Ntfs.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  48025be5

FAILURE_BUCKET_ID:  0xA_Ntfs!NtfsCommonRead+dbb

BUCKET_ID:  0xA_Ntfs!NtfsCommonRead+dbb

Followup: MachineOwner
---------



*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1000000A, {1, ff, 1, 805454a2}

Probably caused by : ntkrpamp.exe ( nt!KeSynchronizeExecution+12 )

Followup: MachineOwner
---------

1: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 00000001, memory referenced
Arg2: 000000ff, IRQL
Arg3: 00000001, bitfield :
	bit 0 : value 0 = read operation, 1 = write operation
	bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: 805454a2, address which referenced memory

Debugging Details:
------------------


WORKER_ROUTINE: 
+6661323732333331
00000001 ??              ???

WORK_ITEM:  805454a2

CURRENT_IRQL:  ff

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  DRIVER_FAULT

BUGCHECK_STR:  0xA

PROCESS_NAME:  Idle

LAST_CONTROL_TRANSFER:  from 80545eef to 805454a2

STACK_TEXT:  
b84d3d28 80545eef 89dbdaac 89dbda38 00000000 nt!KeSynchronizeExecution+0x12
b84d3d50 80545dd4 00000000 0000000e 00000000 nt!KiRetireDpcList+0x61
b84d3d54 00000000 0000000e 00000000 00000000 nt!KiIdleLoop+0x28


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt!KeSynchronizeExecution+12
805454a2 f00fba2b00      lock bts dword ptr [ebx],0

SYMBOL_STACK_INDEX:  0

SYMBOL_NAME:  nt!KeSynchronizeExecution+12

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrpamp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  4d00d46f

FAILURE_BUCKET_ID:  0xA_nt!KeSynchronizeExecution+12

BUCKET_ID:  0xA_nt!KeSynchronizeExecution+12

Followup: MachineOwner
---------

I think it must be a RAM problem, can you test them by running only 1 memory stick please? If that stick gives a BSOD, switch off and swap sticks, test again.

 

I'll have a look at it tomorrow, thanks
Going to bed now, seeing that it's already been 3 AM.. again ><

Oh, I can turn sound back on now? It's rather...quiet without music

 

Been a while I know.

Everything has been going great after unplugging my headset from the onboard soundcard. So I decided to try 'n see what happened after I plugged in. Result: Crash!

I found a Creative Soundblaster sound card. Would it be a good idea to try that and see if it's all gone?

Added 3 latest BSoD reports, in case

Haven't been able to figure out the other errors though, about the ntoskrnl and things..

 

Adding a few more minidumps.

Attempted to play a game (a demanding game - SCII) and Poof! BsoD's again. Last minidump is from that occasion.

Startled me to see the Nvidia in there.

I am terribly sorry for posting back to back, but by the time my pc rebooted and I made the minidump logs postable, edit time is over.

 

Sorry about the terribly late reply!

I've been back to the shop. They said it was a software issue and I had to reinstall Windows (AGAIN). So I did but surprise, it didn't fix the problem.

Decided to clean the PC while it's not in use and got the idea to switch the RAM to a different slot (again) and it's solved since! Running smooth without any issues at all! I guess the previous time I tried I didn't push it down firmly enough or something, as the problem persisted.

Going to write an email to the shop, telling the solution and that I demand my money back plus a new mobo, as it IS an hardware problem, and not software as they claimed.

Thanks again to all who've been thinking with me