AOA Forums AOA Forums AOA Forums Folding For Team 45 AOA Files Home Front Page Become an AOA Subscriber! UserCP Calendar Memberlist FAQ Search Forum Home


Go Back   AOA Forums > Hardware > CRASHED!

CRASHED! A topic for SEVERE and immediate Hardware and Operating System FAILURES. We will try to get you up again. NOT for Optimization questions!


Reply
 
LinkBack Thread Tools Rate Thread
  #1 (permalink)  
Old 22nd April, 2005, 12:56 AM
Member
 
Join Date: April 2005
Posts: 79
Send a message via MSN to acgraham

random crashes-memory dump doesn't make sense to me

Hey guys this is my first post to AOA! ive just configured this dual 2.4 ghz xeon with 2gb ram and 2 200gb sata drives with raid, and a geforce 6800 GT.

im using this box for 3d and ive been getting some random blue screens. i opened up the memory dump file and im getting this output-


Microsoft (R) Windows Debugger Version 6.3.0017.0
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [c:\windows\minidump\Mini042205-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: c:\windows\symbols\
Executable search path is: c:\windows\i386
Unable to load image ntoskrnl.exe, Win32 error 2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
Windows XP Kernel Version 2600 (Service Pack 2) MP (4 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Kernel base = 0x804d7000 PsLoadedModuleList = 0x805624a0
Debug session time: Fri Apr 22 04:59:50 2005
System Uptime: 0 days 16:09:05.866
Unable to load image ntoskrnl.exe, Win32 error 2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
Loading Kernel Symbols
.................................................. .................................................. .................................
Loading unloaded module list
..............
Loading User Symbols
************************************************** *****************************
* *
* Bugcheck Analysis *
* *
************************************************** *****************************

Use !analyze -v to get detailed debugging information.

BugCheck 100000D1, {1, 2, 0, b9dc1377}

*** WARNING: Unable to verify timestamp for ntdll.dll
Unable to load image aswTdi.SYS, Win32 error 2
*** WARNING: Unable to verify timestamp for aswTdi.SYS
*** ERROR: Module load completed but symbols could not be loaded for aswTdi.SYS
Unable to load image tcpip.sys, Win32 error 2
*** WARNING: Unable to verify timestamp for tcpip.sys
Unable to load image netbt.sys, Win32 error 2
*** WARNING: Unable to verify timestamp for netbt.sys
Unable to load image srv.sys, Win32 error 2
*** WARNING: Unable to verify timestamp for srv.sys
Probably caused by : aswTdi.SYS ( aswTdi+1377 )

Followup: MachineOwner
---------

3: kd> !analyze -v
************************************************** *****************************
* *
* Bugcheck Analysis *
* *
************************************************** *****************************

DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: 00000001, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000000, value 0 = read operation, 1 = write operation
Arg4: b9dc1377, address which referenced memory

Debugging Details:
------------------


READ_ADDRESS: 00000001

CURRENT_IRQL: 2

FAULTING_IP:
aswTdi+1377
b9dc1377 8a4601 mov al,[esi+0x1]

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: 0xD1

LAST_CONTROL_TRANSFER: from b9dc19ca to b9dc1377

STACK_TEXT:
WARNING: Stack unwind information not available. Following frames may be wrong.
a4ab9910 b9dc19ca a8ede000 0000eec0 00000001 aswTdi+0x1377
a4ab9940 b9dc1cba a8ecf140 0000eec0 00000001 aswTdi+0x19ca
a4ab99a0 b9dc1b2b 88fda288 a8ecf140 0000eec0 aswTdi+0x1cba
a4ab99c0 b9dc4138 88fda288 00000005 a8ecf140 aswTdi+0x1b2b
a4ab99f8 b9dc41f5 02eff3b8 870c2978 88eff470 aswTdi+0x4138
a4ab9a3c b4306ad2 87e41720 881f8e70 881f8e74 aswTdi+0x41f5
a4ab9a54 b430b6ac 870c2978 00000000 00005524 tcpip!TCBTimeout+0x9e9
a4ab9a90 b430b75f 00000000 00000002 000000c0 tcpip!InitTCBFromConn+0x89
a4ab9ab4 b4302a08 00000002 00000002 a4ab9ae0 tcpip!InitTCBFromConn+0x165
a4ab9ae8 b431e9bc 00000002 00000000 8903cbb0 tcpip!ProcessTCBDelayQ+0xc4
a4ab9b0c b431ea48 a4ab9b30 00000000 870c2b9c tcpip!ObDereferenceSecurityDescriptor+0x6
a4ab9b44 b43081ef 8903cbd4 870c2b98 870c2bb4 tcpip!TCPDispatch+0x103
a4ab9b60 804e13d9 88d62530 870c2978 88eff4a0 tcpip!ARPQueryInfo+0x47c
a4ab9bd4 b9dc035b 88eff470 870c2978 870c2bbc nt!KiTrap0B+0x10f
a4ab9c48 804e13d9 88eff3b8 870c2978 88c5e3c0 aswTdi+0x35b
a4ab9c9c b4159d58 000c2be4 020c2978 e4d4dbf0 nt!KiTrap0B+0x10f
a4ab9cb8 804e13d9 e0880500 870c2be0 870c2008 netbt!NbtDispatchInternalCtrl+0xd1
a4ab9cf8 a97a3b7d a976df34 870c2008 88ce1318 nt!KiTrap0B+0x10f
a4ab9d7c a9760ef6 870c2010 88ce12e0 a9771be8 srv!SrvSmbWriteAndX+0x719
a4ab9d88 a9771be8 00000000 871da020 00000000 srv!SrvProcessSmb+0xb7
a4ab9dac 80574128 870c2008 00000000 00000000 srv!WorkerThread+0x11e
a4ab9ddc 804efc81 a9771b32 88ce12e0 00000000 nt!NtQueryInformationFile+0x459
00000000 00000000 00000000 00000000 00000000 nt!MmFlushSection+0x111


FOLLOWUP_IP:
aswTdi+1377
b9dc1377 8a4601 mov al,[esi+0x1]

SYMBOL_STACK_INDEX: 0

FOLLOWUP_NAME: MachineOwner

SYMBOL_NAME: aswTdi+1377

MODULE_NAME: aswTdi

IMAGE_NAME: aswTdi.SYS

DEBUG_FLR_IMAGE_TIMESTAMP: 4232b24a

STACK_COMMAND: kb

BUCKET_ID: 0xD1_aswTdi+1377

Followup: MachineOwner
---------

Apparently avast could be a problem so im going to uninstall it and see what happens. does anyone else know anyhting about this problem?
__________________

Last edited by acgraham; 26th April, 2005 at 05:51 AM. Reason: bad spelling
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!
Reply With Quote
  #2 (permalink)  
Old 22nd April, 2005, 10:14 AM
Chief Systems Administrator
 
Join Date: September 2001
Location: Europe
Posts: 13,075

DRIVER_IRQL_NOT_LESS_OR_EQUAL is usually the result of either a memory problem or a driver problem. If you can, try running memtest86+ on the machine - that would at least rule out your memory.
__________________
Any views, thoughts and opinions are entirely my own. They don't necessarily represent those of my employer (BlackBerry).
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!
Reply With Quote
  #3 (permalink)  
Old 26th April, 2005, 02:14 AM
Member
 
Join Date: April 2005
Posts: 79
Send a message via MSN to acgraham

thanks man, i will try that on my lunch break.

i saw that someone using avast seemed to have a similar problem to me, so to be safe i uninstalled avast, and over the weekend while i was rendering some 3d i had another crash right at the beginning - grrr! i have now installed norton instead.

so anyway i checked the memory dump this time and this is what i got -


Microsoft (R) Windows Debugger Version 6.3.0017.0
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [c:\windows\minidump\Mini042605-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: c:\windows\symbols\
Executable search path is: c:\windows\i386
Unable to load image ntoskrnl.exe, Win32 error 2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
Windows XP Kernel Version 2600 (Service Pack 2) MP (4 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Kernel base = 0x804d7000 PsLoadedModuleList = 0x805624a0
Debug session time: Tue Apr 26 10:21:41 2005
System Uptime: 0 days 0:04:13.390
Unable to load image ntoskrnl.exe, Win32 error 2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
Loading Kernel Symbols
.................................................. .................................................. ..........................................
Loading unloaded module list
..........
Loading User Symbols
************************************************** *****************************
* *
* Bugcheck Analysis *
* *
************************************************** *****************************

Use !analyze -v to get detailed debugging information.

BugCheck 10000050, {ffffffff, 0, ffffffff, 0}

*** WARNING: Unable to verify timestamp for hal.dll
Unable to load image atalk.sys, Win32 error 2
*** WARNING: Unable to verify timestamp for atalk.sys
*** ERROR: Module load completed but symbols could not be loaded for atalk.sys
Unable to load image ndisuio.sys, Win32 error 2
*** WARNING: Unable to verify timestamp for ndisuio.sys
Unable to load image wdmaud.sys, Win32 error 2
*** WARNING: Unable to verify timestamp for wdmaud.sys

Could not read faulting driver name
Probably caused by : atalk.sys ( atalk+14cb2 )

Followup: MachineOwner
---------

0: kd> !analyze -v
************************************************** *****************************
* *
* Bugcheck Analysis *
* *
************************************************** *****************************

PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced. This cannot be protected by try-except,
it must be protected by a Probe. Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: ffffffff, memory referenced.
Arg2: 00000000, value 0 = read operation, 1 = write operation.
Arg3: ffffffff, If non-zero, the instruction address which referenced the bad memory
address.
Arg4: 00000000, (reserved)

Debugging Details:
------------------


Could not read faulting driver name

READ_ADDRESS: ffffffff

FAULTING_IP:
+ffffffffffffffff
ffffffff ?? ???

MM_INTERNAL_CODE: 0

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: 0x50

LAST_CONTROL_TRANSFER: from ad7e8cb2 to ffffffff

STACK_TEXT:
ac8dfd3c ad7e8cb2 ad742890 ffffff9c 8897e690 0xffffffff
WARNING: Stack unwind information not available. Following frames may be wrong.
00010286 00000000 00000000 00000000 00000000 atalk+0x14cb2


FAILED_INSTRUCTION_ADDRESS:
+ffffffffffffffff
ffffffff ?? ???

FOLLOWUP_IP:
atalk+14cb2
ad7e8cb2 ?? ???

SYMBOL_STACK_INDEX: 1

FOLLOWUP_NAME: MachineOwner

SYMBOL_NAME: atalk+14cb2

MODULE_NAME: atalk

IMAGE_NAME: atalk.sys

DEBUG_FLR_IMAGE_TIMESTAMP: 3e3eb545

STACK_COMMAND: kb

BUCKET_ID: 0x50_CODE_AV_BAD_IP_atalk+14cb2

Followup: MachineOwner
---------



so its different to what it was before when i had avast installed. maybe i really do have dodgy ram. i guess we will find out after lunch.

atalk is an appletalk driver to network with macs on a pc.

i also have a new albatron geforce 6800gt 256mb. i haven't heard of anyone having this problem with it, but i have heard that dodgy cards or bad drivers could cause problems like this.

do different card manufacturers make drivers specific for their cards? or is using the nvidia drivers alway the best/only way to go?
__________________
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!
Reply With Quote
  #4 (permalink)  
Old 26th April, 2005, 05:49 AM
Member
 
Join Date: April 2005
Posts: 79
Send a message via MSN to acgraham

Just did a memcheck on my ram. Did 1 pass that took about an hour and i didn't find anything wrong with it. so im pretty sure i can rule that one out. what should i look to next?
__________________
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!
Reply With Quote
  #5 (permalink)  
Old 26th April, 2005, 08:29 AM
hoinar's Avatar
Member
 
Join Date: February 2005
Location: Iasi, Romania
Posts: 945
Send a message via Skype™ to hoinar

Reinstall your drivers. Check your Computer Management/Device Manager to see if you have some IRQ conflicts between devices.
Most of the manufacturers make their device drivers so you can use/test them too. It's only up to you to choose the one that's more suitable for you.
Good luck.
__________________
I'd cry...but I can't stop laughing.
AOA Team fah
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!
Reply With Quote
  #6 (permalink)  
Old 26th April, 2005, 04:19 PM
cloasters's Avatar
Asst. BBS Administrator
 
Join Date: September 2001
Location: Location, Location
Posts: 21,956

Memtest 86 should be run for say..four hours at least. The "yadda and Not_Less_Than Equal" usually means that diferent drivers must be used.
__________________
When the world will be better.
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!
Reply With Quote
  #7 (permalink)  
Old 27th April, 2005, 12:35 AM
Member
 
Join Date: April 2005
Posts: 79
Send a message via MSN to acgraham

when i uninstalled avast, i had one blue screen after i rebooted, but they may have still somehow been related. since then and all of last night we didn't have a crash. maybe for the moment everything is ok. we well find out in the next few days i guess.
__________________
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!
Reply With Quote
  #8 (permalink)  
Old 27th April, 2005, 01:58 AM
cloasters's Avatar
Asst. BBS Administrator
 
Join Date: September 2001
Location: Location, Location
Posts: 21,956

Yaay! Good news is always the best, I hope your machine remains happy for a while.
__________________
When the world will be better.
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!
Reply With Quote
  #9 (permalink)  
Old 27th April, 2005, 02:59 PM
cloasters's Avatar
Asst. BBS Administrator
 
Join Date: September 2001
Location: Location, Location
Posts: 21,956

Welcome to AOA's Forums, acgraham!

Is this late? Yes, apologies.
__________________
When the world will be better.
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!
Reply With Quote
  #10 (permalink)  
Old 5th May, 2005, 01:05 AM
Member
 
Join Date: April 2005
Posts: 79
Send a message via MSN to acgraham

hey guys, well last night just when i was about to leave i got a crash again. looks like i haven't solved the problem after all.

when i arrived this morning it turned out my itunes xml file and my firefox profile had been corrupted as well.

here is the memory dump -


Microsoft (R) Windows Debugger Version 6.3.0017.0
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [c:\windows\minidump\Mini050405-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: c:\windows\symbols\
Executable search path is: c:\windows\i386
Unable to load image ntoskrnl.exe, Win32 error 2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
Windows XP Kernel Version 2600 (Service Pack 2) MP (4 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Kernel base = 0x804d7000 PsLoadedModuleList = 0x805624a0
Debug session time: Wed May 04 17:50:45 2005
System Uptime: 0 days 0:05:46.781
Unable to load image ntoskrnl.exe, Win32 error 2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
Loading Kernel Symbols
.................................................. .................................................. ................................................
Loading unloaded module list
..........
Loading User Symbols
************************************************** *****************************
* *
* Bugcheck Analysis *
* *
************************************************** *****************************

Use !analyze -v to get detailed debugging information.

BugCheck 24, {1902fe, a93885e4, a93882e0, f7bd5f7a}

*** WARNING: Unable to verify timestamp for ntdll.dll
Unable to load image Ntfs.sys, Win32 error 2
*** WARNING: Unable to verify timestamp for Ntfs.sys
Probably caused by : Ntfs.sys ( Ntfs!EfsRead+14 )

Followup: MachineOwner
---------

2: kd> !analyze -v
************************************************** *****************************
* *
* Bugcheck Analysis *
* *
************************************************** *****************************

NTFS_FILE_SYSTEM (24)
If you see NtfsExceptionFilter on the stack then the 2nd and 3rd
parameters are the exception record and context record. Do a .cxr
on the 3rd parameter and then kb to obtain a more informative stack
trace.
Arguments:
Arg1: 001902fe
Arg2: a93885e4
Arg3: a93882e0
Arg4: f7bd5f7a

Debugging Details:
------------------


EXCEPTION_RECORD: a93885e4 -- (.exr ffffffffa93885e4)
ExceptionAddress: f7bd5f7a (Ntfs!EfsRead+0x00000014)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 00000000
Parameter[1]: 00080004
Attempt to read from address 00080004

CONTEXT: a93882e0 -- (.cxr ffffffffa93882e0)
eax=b77e1000 ebx=e37da750 ecx=a9388708 edx=00000000 esi=b77e1000 edi=00080000
eip=f7bd5f7a esp=a93886ac ebp=a93886c8 iopl=0 nv up ei ng nz na po nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010286
Ntfs!EfsRead+0x14:
f7bd5f7a 8b4704 mov eax,[edi+0x4] ds:0023:00080004=????????
Resetting default scope

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: 0x24

LAST_CONTROL_TRANSFER: from f7b60b6c to f7bd5f7a

STACK_TEXT:
a93886c8 f7b60b6c b77e1000 a9388708 00000c00 Ntfs!EfsRead+0x14
a9388794 f7b5a723 a9388a70 8846c008 e37da750 Ntfs!NtfsFinishBuffers+0x95
a938897c f7b556fe a9388a70 8846c008 e37da750 Ntfs!NtfsNonCachedIo+0x681
a9388a5c f7b54fbf a9388a70 8846c008 00000001 Ntfs!NtfsCommonRead+0xbdd
a9388c0c 804e13d9 8a52e020 8846c008 8a575968 Ntfs!NtfsFsdRead+0x22d
a9388c24 804e13d9 8a52fdd0 8846c008 8846c008 nt!KiTrap0B+0x10f
a9388c64 804fb0c5 89710298 8841cc09 8841ccc8 nt!KiTrap0B+0x10f
a9388c84 804fadec 88379028 8841cce8 8841ccc8 nt!IopPageReadInternal+0x17
a9388cf8 804e8afd 6ac42820 63bac00c c018eeb0 nt!MiDispatchFault+0x26c
a9388d4c 804e0944 00000000 63bac00c 00000001 nt!ExpScanSystemLookasideList+0x26a
a9388d64 7c91280d badb0d00 00000002 a9e31d98 nt!KiTrap06+0x387
WARNING: Frame IP not in any known module. Following frames may be wrong.
0012cda0 00000000 00000000 00000000 00000000 0x7c91280d


FOLLOWUP_IP:
Ntfs!EfsRead+14
f7bd5f7a 8b4704 mov eax,[edi+0x4]

SYMBOL_STACK_INDEX: 0

FOLLOWUP_NAME: MachineOwner

SYMBOL_NAME: Ntfs!EfsRead+14

MODULE_NAME: Ntfs

IMAGE_NAME: Ntfs.sys

DEBUG_FLR_IMAGE_TIMESTAMP: 41107eea

STACK_COMMAND: .cxr ffffffffa93882e0 ; kb

BUCKET_ID: 0x24_Ntfs!EfsRead+14

Followup: MachineOwner
---------


should i be worried about this? maybe its my hard drives, though they are both brand new. im using raid 0, which i know is risky but they are both brand new drives.

i ran a chkdsk and it found some errors.

but what is ntfs.sys?

could a driver still be doing this? i haven't seen this error before. any help on what you guys can understand from the memory dump would be really helpful. thanks again guys!
__________________
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!
Reply With Quote
  #11 (permalink)  
Old 5th May, 2005, 04:03 PM
cloasters's Avatar
Asst. BBS Administrator
 
Join Date: September 2001
Location: Location, Location
Posts: 21,956

Bump.
__________________
When the world will be better.
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!
Reply With Quote
  #12 (permalink)  
Old 5th May, 2005, 10:30 PM
Member
 
Join Date: August 2003
Location: Belgium
Posts: 211

Wink

Quote:
Originally Posted by acgraham
hey guys, ......

...................................

should i be worried about this? maybe its my hard drives, though they are both brand new. im using raid 0, which i know is risky but they are both brand new drives.

i ran a chkdsk and it found some errors.

but what is ntfs.sys?

could a driver still be doing this? i haven't seen this error before. any help on what you guys can understand from the memory dump would be really helpful. thanks again guys!
you 'd better check those disks first in another machine if you can.
check the cables to those disks, maybe replace ...
ntfs.sys must have to do with the NTFS disk format system tha is used in a professional setup of any Windows NT-based system (NT4.0, Win2000, WinXP, Win2003).

Do a longer run of the memory test and try putting in extra loads in the case and driving up power load and temps in that case during that testing to make it more real (for the system) ...

Do a check of your voltages and temps in 'idle' and under 'load' (in Windows you could run StressCPU to do a full load of the system / found here: http://home.comcast.net/~wxdude1/ems.../stresscpu.zip)
__________________
F_O_L_D_E_R_S

1] ... Athlon XP2500+ Barton @ 3000+ & 512 MB RAM WinXP
2] ... Athlon XP2500+ Barton @ 3100+ & 1024 MB RAMWin2k
3] ... Athlon XP2500+ Mobile Barton @ 3200+ & 512 MB RAM WinXP
4&5] Athlon A64X2 3800+ @ 2.6 GHz (~ 5000+) & 2x 1024 MB RAM running @ 237 MHz WinXP

All folding 24/7
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!
Reply With Quote
  #13 (permalink)  
Old 6th May, 2005, 12:54 AM
Member
 
Join Date: April 2005
Posts: 79
Send a message via MSN to acgraham

i used winbond hardwar doctor to check my voltage which came with the MB. if i look at +12V it is 11.64V which is close to 11.52 as the minimum. is that bad? other than that one voltage readout everything else looks ok. when i run stress CPU the CPU1 temperature is 56 degrees C, and CPU 2 is 40 degrees C.

"Do a longer run of the memory test and try putting in extra loads in the case and driving up power load and temps in that case during that testing to make it more real (for the system) ..."

how do i actually increase the loads, power loads, temp in the case during the memory test?

dont know if this is totally useless information but when i submit the error report on reboot windows claims its due to a driver issue.

Im confident it isn't a temperature issue, because it happens when im doing mundane non-intensive stuff as well
__________________
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!
Reply With Quote
  #14 (permalink)  
Old 6th May, 2005, 01:02 AM
Member
 
Join Date: April 2005
Posts: 79
Send a message via MSN to acgraham

and i got these two memory dumps in the last two days -

yesterday -




Microsoft (R) Windows Debugger Version 6.3.0017.0
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [c:\windows\minidump\Mini050505-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: c:\windows\symbols\
Executable search path is: c:\windows\i386
Unable to load image ntoskrnl.exe, Win32 error 2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
Windows XP Kernel Version 2600 (Service Pack 2) MP (4 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Kernel base = 0x804d7000 PsLoadedModuleList = 0x805624a0
Debug session time: Thu May 05 10:26:17 2005
System Uptime: 0 days 16:35:08.933
Unable to load image ntoskrnl.exe, Win32 error 2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
Loading Kernel Symbols
.................................................. .................................................. ...............................................
Loading unloaded module list
...............
Loading User Symbols
************************************************** *****************************
* *
* Bugcheck Analysis *
* *
************************************************** *****************************

Use !analyze -v to get detailed debugging information.

BugCheck 10000050, {a8e1b2e0, 1, a96677e9, 0}

Unable to load image atfsd.sys, Win32 error 2
*** WARNING: Unable to verify timestamp for atfsd.sys
*** ERROR: Module load completed but symbols could not be loaded for atfsd.sys

Could not read faulting driver name
Probably caused by : atfsd.sys ( atfsd+147e9 )

Followup: MachineOwner
---------

3: kd> !analyze -v
************************************************** *****************************
* *
* Bugcheck Analysis *
* *
************************************************** *****************************

PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced. This cannot be protected by try-except,
it must be protected by a Probe. Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: a8e1b2e0, memory referenced.
Arg2: 00000001, value 0 = read operation, 1 = write operation.
Arg3: a96677e9, If non-zero, the instruction address which referenced the bad memory
address.
Arg4: 00000000, (reserved)

Debugging Details:
------------------


Could not read faulting driver name

WRITE_ADDRESS: a8e1b2e0

FAULTING_IP:
atfsd+147e9
a96677e9 66c7845590faffff0000 mov word ptr [ebp+edx*2-0x570],0x0

MM_INTERNAL_CODE: 0

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: 0x50

LAST_CONTROL_TRANSFER: from a965c83b to a96677e9

STACK_TEXT:
WARNING: Stack unwind information not available. Following frames may be wrong.
a87cb7dc a965c83b 86577608 a87cb998 f772f538 atfsd+0x147e9
a87cba00 a9669284 874b61c0 874b61d0 8999a788 atfsd+0x983b
a87cba5c 804e13d9 8971d230 874b61c0 874b61c0 atfsd+0x16284
a87cbb4c 8056c063 8971d230 00000000 8901b798 nt!KiTrap0B+0x10f
a87cbbc4 8056f2a8 00000000 a87cbc04 00000040 nt!CmpQuerySecurityDescriptorInfo+0x1d
a87cbc18 8057d2d3 00000000 00000000 50ee8801 nt!ObQueryDeviceMapInformation+0x79
a87cbc94 8057d3a2 0350eea8 00100181 0350ee30 nt!NtReplyPort+0x245
a87cbcf0 8057d3e5 0350eea8 00100181 0350ee30 nt!SeCaptureSecurityQos+0x6f
a87cbd30 804dd99f 0350eea8 00100181 0350ee30 nt!SeFreeCapturedSecurityQos+0xa
a87cbd64 7c90eb94 badb0d00 0350edbc a9403d98 nt!ZwQueryFullAttributesFile
0350f0b8 00000000 00000000 00000000 00000000 0x7c90eb94


FOLLOWUP_IP:
atfsd+147e9
a96677e9 66c7845590faffff0000 mov word ptr [ebp+edx*2-0x570],0x0

SYMBOL_STACK_INDEX: 0

FOLLOWUP_NAME: MachineOwner

SYMBOL_NAME: atfsd+147e9

MODULE_NAME: atfsd

IMAGE_NAME: atfsd.sys

DEBUG_FLR_IMAGE_TIMESTAMP: 3e3eb6b1

STACK_COMMAND: kb

BUCKET_ID: 0x50_W_atfsd+147e9

Followup: MachineOwner
---------



and today -


Microsoft (R) Windows Debugger Version 6.3.0017.0
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [c:\windows\minidump\Mini050605-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: c:\windows\symbols\
Executable search path is: c:\windows\i386
Unable to load image ntoskrnl.exe, Win32 error 2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
Windows XP Kernel Version 2600 (Service Pack 2) MP (4 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Kernel base = 0x804d7000 PsLoadedModuleList = 0x805624a0
Debug session time: Fri May 06 09:26:37 2005
System Uptime: 0 days 20:41:11.823
Unable to load image ntoskrnl.exe, Win32 error 2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
Loading Kernel Symbols
.................................................. .................................................. ............................................
Loading unloaded module list
.......................
Loading User Symbols
************************************************** *****************************
* *
* Bugcheck Analysis *
* *
************************************************** *****************************

Use !analyze -v to get detailed debugging information.

BugCheck 1A, {41284, c83c1001, f20e, c0c00000}

*** WARNING: Unable to verify timestamp for ntdll.dll
Unable to load image Ntfs.sys, Win32 error 2
*** WARNING: Unable to verify timestamp for Ntfs.sys
Probably caused by : memory_corruption ( nt!MiRemoveUnusedSegments+52f )

Followup: MachineOwner
---------

0: kd> !analyze -v
************************************************** *****************************
* *
* Bugcheck Analysis *
* *
************************************************** *****************************

MEMORY_MANAGEMENT (1a)
# Any other values for parameter 1 must be individually examined.
Arguments:
Arg1: 00041284, A PTE or the working set list is corrupt.
Arg2: c83c1001
Arg3: 0000f20e
Arg4: c0c00000

Debugging Details:
------------------


BUGCHECK_STR: 0x1a_41284

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: DRIVER_FAULT

LAST_CONTROL_TRANSFER: from 80529bbd to 805371aa

STACK_TEXT:
a66a63e8 80529bbd 0000001a 00041284 c83c1001 nt!MiRemoveUnusedSegments+0x52f
a66a6420 804f5015 0000f20e 89bb1a38 8a5afd00 nt!ObWatchHandles+0x999
a66a6460 8056f9c2 c83c1000 8791c538 00000000 nt!CcInitializeCacheMap+0x438
a66a6478 804f4f98 8a5afd00 89bb1a38 00000001 nt!NtReplyWaitReceivePortEx+0x5d5
a66a64a8 804f4996 00100000 00000001 00000000 nt!CcInitializeCacheMap+0x2df
a66a651c 804f468a 89bb1a38 03d87800 00000000 nt!MmMapViewInSystemCache+0x4b
a66a6544 8057d9f7 00bb1a38 03d87800 00000000 nt!MmUnmapViewInSystemCache+0x145
a66a65ac f7b787cb 89be9110 a66a65dc 00000400 nt!IopXxxControlFile+0x611
a66a65cc f7b789e7 88a09ef0 8a566008 03d87800 Ntfs!NtfsMapStream+0x46
a66a6640 f7b788f4 88a09ef0 89bb3100 e5bd5010 Ntfs!NtfsReadMftRecord+0x86
a66a6678 f7b7884a 88a09ef0 89bb3100 e5bd5010 Ntfs!NtfsReadFileRecord+0x7a
a66a66b0 f7b7cf05 88a09ef0 e5bd5008 e5bd5010 Ntfs!NtfsLookupInFileRecord+0x37
a66a6788 f7b9795a 88a09ef0 e5bd50d0 e5bd50f0 Ntfs!NtfsWriteFileSizes+0x76
a66a6814 f7b97dc9 88a09ef0 89bb3100 00000001 Ntfs!NtfsFlushVolume+0x276
a66a68b4 f7b8b385 88a09ef0 86aa02a0 a66a0080 Ntfs!NtfsCommonVolumeOpen+0x341
a66a698c 804e13d9 89bb3020 86aa02a0 86bbe430 Ntfs!NtfsFsdCreate+0x154
a66a69e8 804e13d9 89bb4c80 00000001 a66a6a40 nt!KiTrap0B+0x10f
a66a6b4c 8056c063 89bea680 00000000 86bf1008 nt!KiTrap0B+0x10f
a66a6bc4 8056f2a8 00000000 a66a6c04 00000040 nt!CmpQuerySecurityDescriptorInfo+0x1d
a66a6c18 8057d2d3 00000000 00000000 bbe4a001 nt!ObQueryDeviceMapInformation+0x79
a66a6c94 8057d3a2 0013e080 c0100080 0013e020 nt!NtReplyPort+0x245
a66a6cf0 8057d3e5 0013e080 c0100080 0013e020 nt!SeCaptureSecurityQos+0x6f
a66a6d30 804dd99f 0013e080 c0100080 0013e020 nt!SeFreeCapturedSecurityQos+0xa
a66a6d64 7c90eb94 badb0d00 0013dfe8 aa1bfd98 nt!ZwQueryFullAttributesFile
WARNING: Frame IP not in any known module. Following frames may be wrong.
0013e078 00000000 00000000 00000000 00000000 0x7c90eb94


FOLLOWUP_IP:
nt!MiRemoveUnusedSegments+52f
805371aa 5d pop ebp

SYMBOL_STACK_INDEX: 0

FOLLOWUP_NAME: MachineOwner

SYMBOL_NAME: nt!MiRemoveUnusedSegments+52f

MODULE_NAME: nt

DEBUG_FLR_IMAGE_TIMESTAMP: 42250f77

STACK_COMMAND: kb

IMAGE_NAME: memory_corruption

BUCKET_ID: 0x1a_41284_nt!MiRemoveUnusedSegments+52f

Followup: MachineOwner
---------



could someone explain all those module errors in there and warnings? i dont have a clue what they mean. like -

*** WARNING: Unable to verify timestamp for atfsd.sys
*** ERROR: Module load completed but symbols could not be loaded for atfsd.sys

tell me what are the chances that a video card could be causing all this? because i dont want my $700AU geforce 6800 GT to be the problem.

thanks for all your help again guys. i just hope we can nail this problem. its awesome that there are people out there that can understand all these problems, because customer support bites.
__________________
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!
Reply With Quote
  #15 (permalink)  
Old 6th May, 2005, 01:33 AM
Member
 
Join Date: August 2003
Location: Belgium
Posts: 211

Wink

you could try following up this to find the problem; if handled correctly (as described) the minidump seems to have enough data to find sources of BSOD's ...
http://www.networklifemag.com/news/2...ows-crash.html
__________________
F_O_L_D_E_R_S

1] ... Athlon XP2500+ Barton @ 3000+ & 512 MB RAM WinXP
2] ... Athlon XP2500+ Barton @ 3100+ & 1024 MB RAMWin2k
3] ... Athlon XP2500+ Mobile Barton @ 3200+ & 512 MB RAM WinXP
4&5] Athlon A64X2 3800+ @ 2.6 GHz (~ 5000+) & 2x 1024 MB RAM running @ 237 MHz WinXP

All folding 24/7
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!
Reply With Quote
  #16 (permalink)  
Old 6th May, 2005, 09:23 AM
hoinar's Avatar
Member
 
Join Date: February 2005
Location: Iasi, Romania
Posts: 945
Send a message via Skype™ to hoinar

Noorman, thanks alot for pointing to that article...it was very interresting. Acgraham..now you have a good start point for tracking your problem
__________________
I'd cry...but I can't stop laughing.
AOA Team fah
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!
Reply With Quote
  #17 (permalink)  
Old 6th May, 2005, 10:59 AM
Member
 
Join Date: August 2003
Location: Belgium
Posts: 211

Wink

since 'acgraham' is the only one who has the minidumps, he 'll have to do some work now to discover the source of the problem.

maybe some bluescreen info can help him out sooner, we are waiting for it too ...
__________________
F_O_L_D_E_R_S

1] ... Athlon XP2500+ Barton @ 3000+ & 512 MB RAM WinXP
2] ... Athlon XP2500+ Barton @ 3100+ & 1024 MB RAMWin2k
3] ... Athlon XP2500+ Mobile Barton @ 3200+ & 512 MB RAM WinXP
4&5] Athlon A64X2 3800+ @ 2.6 GHz (~ 5000+) & 2x 1024 MB RAM running @ 237 MHz WinXP

All folding 24/7
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!
Reply With Quote
  #18 (permalink)  
Old 9th May, 2005, 03:42 AM
Member
 
Join Date: April 2005
Posts: 79
Send a message via MSN to acgraham

yeah that article was really good man. i think that since the minidumps list different drivers some of the time that the problem may be my ram. but i haven't had a crash in the last 3 days since i removed my soundblaster live and my belkin wireless netwrok card. so confusing. at least if it crashes again i know its not them.
__________________
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!
Reply With Quote
  #19 (permalink)  
Old 2nd June, 2005, 09:44 AM
chaosrecords's Avatar
Member
 
Join Date: June 2005
Location: Erie, PA
Posts: 3
Send a message via AIM to chaosrecords

BSODs do come from bad drivers, conflicts, and shady memory. But they also come when you overclock and have the memory settings too low, or the voltage too low to the processor & ram. I have dealt with BSODS for the last 3 months overclocking my rigs and 100% of it was from having 2 different sticks of memory, both PC2700, but one couldnt handle 2.5 3-3-6. Are you overclocking at all?
__________________
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!
Reply With Quote
  #20 (permalink)  
Old 2nd June, 2005, 10:02 AM
Chief Systems Administrator
 
Join Date: September 2001
Location: Europe
Posts: 13,075

As your STOP errors are varied, it suggests it's probably not a software problem, but probably is a hardware problem. Those are pretty hard to pinpoint unless you've got spare parts to try swapping out. As you have a dual Xeon machine, you have the possibility of removing one of the Xeons, and inserting a termination board instead. That would reduce the complexity of the system too.
__________________
Any views, thoughts and opinions are entirely my own. They don't necessarily represent those of my employer (BlackBerry).
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!
Reply With Quote
Reply



Currently Active Users Viewing This Thread: 1 (0 members and 1 guests)
 
Thread Tools
Rate This Thread
Rate This Thread:

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off
Trackbacks are On
Pingbacks are On
Refbacks are On


Similar Threads
Thread Thread Starter Forum Replies Last Post
What a difference decent memory can make! Lazgoat AMD Motherboards & CPUs 9 26th August, 2005 12:04 AM
memory dump error m1ke101 CRASHED! 2 2nd March, 2003 12:51 AM
Does this make any sense or help anyone? revrondo EPoX MotherBoards 2 10th January, 2003 04:46 AM
Ati3d1ag.dll--memory Dump--error--consistently CNUCompGuy CRASHED! 9 3rd February, 2002 12:28 AM


All times are GMT +1. The time now is 03:02 PM.


Copyright ©2001 - 2010, AOA Forums
Don't Click Here Don't Click Here Either

Search Engine Friendly URLs by vBSEO 3.3.0