Win Xp Problem
Hi Guys working on a Travelmate 290 which has been returned to us where the end user was experiencing a Blue Screen Of Death issue.
I have checked the error logs and have the following errors.
Error Code 1000000a, parameter1 ff1711f2, parameter2 00000002, parameter 3 00000000, parameter4, 804d9b64
this error is listed in the error logs numerous times, The laptop has been memtested and has reported no errors
Just trying to get to the bottom of this problem
Many Thanks
I have checked the error logs and have the following errors.
Error Code 1000000a, parameter1 ff1711f2, parameter2 00000002, parameter 3 00000000, parameter4, 804d9b64
this error is listed in the error logs numerous times, The laptop has been memtested and has reported no errors
Just trying to get to the bottom of this problem
Many Thanks
Microsoft's strategy to conquer the I.T industry
" Embrace, evolve, extinguish "
" Embrace, evolve, extinguish "
Comments
-
skrpune
Member Posts: 1,409
any way you can hook up the HD as a secondary HD to another machine so you can snag the **** files?Currently Studying For: Nothing (cert-wise, anyway)
Next Up: Security+, 291?
Enrolled in Masters program: CS 2011 expected completion -
tiersten
Member Posts: 4,505
What skrpune said.
It is an error which generally means something is wrong with your hardware or your drivers. Without further information from the **** files or the BSOD screen you can't narrow it down. -
ally_uk
Member Posts: 1,145 ■■■■□□□□□□
What further information do you need? do you want me to screenshot the error logs in event viewer?Microsoft's strategy to conquer the I.T industry
" Embrace, evolve, extinguish " -
pennystrader
Member Posts: 155
Go to My Computer, right click properties, choose Advanced and then under startup and recovery enable a **** so the next blue screen will be captured. then after it bluescreens you can run Kernel Memory Space Analyzer (free tool from Microsoft) to analyze and tell you the bad driver that is trying to load.
Event logs will not help when you are blue screening, you need to capture the BSOD and analyze the ****.
The more knowledge one obtains the more there is too accumulate..... -
ally_uk
Member Posts: 1,145 ■■■■□□□□□□
Thank you for expanding my knowledge, Now I am going to have to get the BSOD to reoccur, I was running the laptop solid for about 3 hours today and had no issues, I have a feeling that it might be something do do with the wireless. Only trouble is at work we don't have a wireless network so testing it is a issue.Microsoft's strategy to conquer the I.T industry
" Embrace, evolve, extinguish " -
pennystrader
Member Posts: 155
Do you want me to tell you how to make it bluescreen:) I know a little trick for that.
1. Start regedit. (If you are unfamiliar with regedit, please refer to this FAQ)
2. Navigate to:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\i8042prt\Parameters
3. Create a new DWORD value and name it CrashOnCtrlScroll
4. Right-click on this newly created value and click on Modify
5. Enter 1 in the Value data field and click on OK.
6. Close regedit and reboot your system.
7. Now you can blue screen (crash) your system by holding the right CTRL key and pressing "Scroll Lock" twice.
Your system may reboot or show a blue screen whenever this crash is initiated. If your system reboots after initiating the crash and you want to see the blue screen, follow these steps:
1. Go to Control Panel > System
2. Click on the Advanced tab
3. Under Startup and Recovery, click the Settings button.
4. Under System
The more knowledge one obtains the more there is too accumulate..... -
Hyper-Me
Banned Posts: 2,059
pennystrader wrote: »Do you want me to tell you how to make it bluescreen:) I know a little trick for that.
1. Start regedit. (If you are unfamiliar with regedit, please refer to this FAQ)
2. Navigate to:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\i8042prt\Parameters
3. Create a new DWORD value and name it CrashOnCtrlScroll
4. Right-click on this newly created value and click on Modify
5. Enter 1 in the Value data field and click on OK.
6. Close regedit and reboot your system.
7. Now you can blue screen (crash) your system by holding the right CTRL key and pressing "Scroll Lock" twice.
Your system may reboot or show a blue screen whenever this crash is initiated. If your system reboots after initiating the crash and you want to see the blue screen, follow these steps:
1. Go to Control Panel > System
2. Click on the Advanced tab
3. Under Startup and Recovery, click the Settings button.
4. Under System
Or just download and run NotMyFault from sysinternals to BSOD on command. -
ally_uk
Member Posts: 1,145 ■■■■□□□□□□
This is one of the MiniDumps any ideas guys?
Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
Copyright (c) Microsoft Corporation. All rights reserved.
Loading **** File [C:\Documents and Settings\Owner\Desktop\Minidump\Mini020310-01.dmp]
Mini Kernel **** File: Only registers and stack trace are available
Symbol search path is: *** Invalid ***
****************************************************************************
* Symbol loading may be unreliable without a symbol search path. *
* Use .symfix to have the debugger choose a symbol path. *
* After setting your symbol path, use .reload to refresh symbol locations. *
****************************************************************************
Executable search path is:
*********************************************************************
* Symbols can not be loaded because symbol path is not initialized. *
* *
* The Symbol Path can be set by: *
* using the _NT_SYMBOL_PATH environment variable. *
* using the -y <symbol_path> argument when starting the debugger. *
* using .sympath and .sympath+ *
*********************************************************************
Unable to load image ntoskrnl.exe, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
*** ERROR: Module load completed but symbols could not be loaded for ntoskrnl.exe
Windows XP Kernel Version 2600 (Service Pack 2) UP Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Machine Name:
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055ab20
Debug session time: Wed Feb 3 21:06:32.069 2010 (GMT+0)
System Uptime: 0 days 3:55:56.623
*********************************************************************
* Symbols can not be loaded because symbol path is not initialized. *
* *
* The Symbol Path can be set by: *
* using the _NT_SYMBOL_PATH environment variable. *
* using the -y <symbol_path> argument when starting the debugger. *
* using .sympath and .sympath+ *
*********************************************************************
Unable to load image ntoskrnl.exe, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
*** ERROR: Module load completed but symbols could not be loaded for ntoskrnl.exe
Loading Kernel Symbols
...............................................................
....................................................
Loading User Symbols
Loading unloaded module list
.................
Unable to load image w22n51.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for w22n51.sys
*** ERROR: Module load completed but symbols could not be loaded for w22n51.sys
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 1000000A, {ff1711f2, 2, 0, 804d9f68}
***** Kernel symbols are WRONG. Please fix symbols to do analysis.
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!KPRCB ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!KPRCB ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
*************************************************************************
*********************************************************************
* Symbols can not be loaded because symbol path is not initialized. *
* *
* The Symbol Path can be set by: *
* using the _NT_SYMBOL_PATH environment variable. *
* using the -y <symbol_path> argument when starting the debugger. *
* using .sympath and .sympath+ *
*********************************************************************
*********************************************************************
* Symbols can not be loaded because symbol path is not initialized. *
* *
* The Symbol Path can be set by: *
* using the _NT_SYMBOL_PATH environment variable. *
* using the -y <symbol_path> argument when starting the debugger. *
* using .sympath and .sympath+ *
*********************************************************************
Probably caused by : w22n51.sys ( w22n51+69222 )
Followup: MachineOwner
Microsoft's strategy to conquer the I.T industry
" Embrace, evolve, extinguish " -
ally_uk
Member Posts: 1,145 ■■■■□□□□□□
More detailed information with symbols support added.
Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
Copyright (c) Microsoft Corporation. All rights reserved.
Loading **** File [C:\Documents and Settings\Owner\Desktop\Minidump\Mini020310-03.dmp]
Mini Kernel **** File: Only registers and stack trace are available
Symbol search path is: C:\WINDOWS\Symbols
Executable search path is:
Unable to load image ntoskrnl.exe, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
Windows XP Kernel Version 2600 (Service Pack 2) UP Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Machine Name:
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055ab20
Debug session time: Wed Feb 3 21:10:15.456 2010 (GMT+0)
System Uptime: 0 days 0:01:35.016
Unable to load image ntoskrnl.exe, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
Loading Kernel Symbols
...............................................................
..................................................
Loading User Symbols
Loading unloaded module list
...........
Unable to load image w22n51.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for w22n51.sys
*** ERROR: Module load completed but symbols could not be loaded for w22n51.sys
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 1000000A, {ff1711f2, 2, 0, 804d9f68}
Probably caused by : w22n51.sys ( w22n51+69222 )
Followup: MachineOwner
kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: ff1711f2, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000000, bitfield :
bit 0 : value 0 = read operation, 1 = write operation
bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: 804d9f68, address which referenced memory
Debugging Details:
READ_ADDRESS: ff1711f2
CURRENT_IRQL: 2
FAULTING_IP:
nt!memcpy+12c
804d9f68 8b448efc mov eax,dword ptr [esi+ecx*4-4]
CUSTOMER_CRASH_COUNT: 3
DEFAULT_BUCKET_ID: DRIVER_FAULT
BUGCHECK_STR: 0xA
PROCESS_NAME: Idle
LAST_CONTROL_TRANSFER: from bacc6222 to 804d9f68
STACK_TEXT:
8054eec4 bacc6222 8054ef24 ff1711f2 00000004 nt!memcpy+0x12c
WARNING: Stack unwind information not available. Following frames may be wrong.
8054ef14 1edd100d 334c9000 ff1711f2 000000e6 w22n51+0x69222
8054ef18 334c9000 ff1711f2 000000e6 8054f038 0x1edd100d
8054ef1c ff1711f2 000000e6 8054f038 85611ed4 0x334c9000
8054ef20 00000000 8054f038 85611ed4 00000004 0xff1711f2
STACK_COMMAND: kb
FOLLOWUP_IP:
w22n51+69222
bacc6222 ?? ???
SYMBOL_STACK_INDEX: 1
SYMBOL_NAME: w22n51+69222
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: w22n51
IMAGE_NAME: w22n51.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 3ff54d71
FAILURE_BUCKET_ID: 0xA_w22n51+69222
BUCKET_ID: 0xA_w22n51+69222
Followup: MachineOwner
Another Mini **** from same laptop
Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
Copyright (c) Microsoft Corporation. All rights reserved.
Loading **** File [C:\Documents and Settings\Owner\Desktop\Minidump\Mini020710-03.dmp]
Mini Kernel **** File: Only registers and stack trace are available
Symbol search path is: C:\WINDOWS\Symbols
Executable search path is:
Unable to load image ntoskrnl.exe, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
Windows XP Kernel Version 2600 (Service Pack 2) UP Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Machine Name:
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055a6a0
Debug session time: Sun Feb 7 10:51:22.681 2010 (GMT+0)
System Uptime: 0 days 0:01:59.242
Unable to load image ntoskrnl.exe, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
Loading Kernel Symbols
...............................................................
.....................................................
Loading User Symbols
Loading unloaded module list
...........
Unable to load image w22n51.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for w22n51.sys
*** ERROR: Module load completed but symbols could not be loaded for w22n51.sys
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 1000000A, {ff1711f2, 2, 0, 804d9b64}
Probably caused by : w22n51.sys ( w22n51+69222 )
Followup: MachineOwner
kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: ff1711f2, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000000, bitfield :
bit 0 : value 0 = read operation, 1 = write operation
bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: 804d9b64, address which referenced memory
Debugging Details:
READ_ADDRESS: ff1711f2
CURRENT_IRQL: 2
FAULTING_IP:
nt!_aulldvrm+52
804d9b64 8b448efc mov eax,dword ptr [esi+ecx*4-4]
CUSTOMER_CRASH_COUNT: 3
DEFAULT_BUCKET_ID: DRIVER_FAULT
BUGCHECK_STR: 0xA
PROCESS_NAME: firefox.exe
LAST_CONTROL_TRANSFER: from bad76222 to 804d9b64
STACK_TEXT:
f79bd5e8 bad76222 f79bd648 ff1711f2 00000004 nt!_aulldvrm+0x52
WARNING: Stack unwind information not available. Following frames may be wrong.
f79bd638 1edd100d 334c9000 ff1711f2 000000e6 w22n51+0x69222
f79bd63c 334c9000 ff1711f2 000000e6 f79bd75c 0x1edd100d
f79bd640 ff1711f2 000000e6 f79bd75c 854d6f0c 0x334c9000
f79bd644 00000000 f79bd75c 854d6f0c 00000004 0xff1711f2
STACK_COMMAND: kb
FOLLOWUP_IP:
w22n51+69222
bad76222 ?? ???
SYMBOL_STACK_INDEX: 1
SYMBOL_NAME: w22n51+69222
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: w22n51
IMAGE_NAME: w22n51.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 3ff54d71
FAILURE_BUCKET_ID: 0xA_w22n51+69222
BUCKET_ID: 0xA_w22n51+69222
Followup: MachineOwner
Your thoughts pleaseMicrosoft's strategy to conquer the I.T industry
" Embrace, evolve, extinguish "
