I forgot to mention that the blue screen errors sometimes said IRQL or
USB network drivers. They are random errors, but all related to each other.

The blue screen can happen when not downloading, surfing, etc. It can be
idling too.


On 10/25/2009 1:38 PM PT, Ant typed:

> I am trying to fix my client's old Dell Optiplex GX260 PC that is
> getting a lot of blue screens lately. It can happen a few minutes after
> booting up old Windows 2000 SP4 (has all critical updates and latest
> drivers even though years old) or takes random hours to reproduce. There
> are no forced specific patterns to reproduce the crash, but there are
> patterns from what I saw in Windows' event logs.
>
> I also tried another wireless USB network devices (already tried
> uninstalling in safe mode too), but it still had the same blue screens
> so it is not the wireless devices. The problem started a few months ago,
> and seems to be slowly getting worse. Note this is an old PC from early
> 2000s, so it could be failing hardwares (USB inside?) in the PC and had
> to replace its CPU fan a couple months ago. The client uses USB a lot
> for his flash drives/sticks (old and new -- various brands and sizes),
> old Palm Treo 680, an old tiny four ports hub, Sony digital camera, an
> old HP multi-office machine (scanner+printer+copier), etc.
>
> I exported the event logs for system and cleaned them up for logged
> memory dump crashes only:

[snipped -- see original post for them]
--
"Is this stuff any good for ants?" "No, it kills them." --unknown
/\___/\
/ /\ /\ \ Phil/Ant @ http://antfarm.ma.cx (Personal Web Site)
| |o o| | Ant's Quality Foraged Links (AQFL): http://aqfl.net
\ _ / Nuke ANT from e-mail address: (E-Mail Removed)NT
( ) or (E-Mail Removed)
Ant is currently not listening to any songs on his home computer.

On 10/25/2009 5:31 PM PT, Dave Patrick typed:

> Almost always hardware or driver related.
>
> http://support.microsoft.com/kb/315263
> http://support.microsoft.com/kb/156280

Yeah, I did that with WinDbg, and they say IRQL or USB network drivers
(both devices I tried).

Also, I have seen MULTIPLE_IRP_COMPLETE_REQUESTS (44). Example from WinDbg:

Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [E:\dl\Mini082109-02.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is:
srv*c:\symbols\*http://msdl.microsoft.com/download/symbols
Executable search path is:
Unable to load image ntoskrnl.exe, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
*** ERROR: Module load completed but symbols could not be loaded for
ntoskrnl.exe
Windows 2000 Kernel Version 2195 (Service Pack 4) MP (2 procs) Free x86
compatible
Machine Name:
Kernel base = 0x80400000 PsLoadedModuleList = 0x80485b80
Debug session time: Fri Aug 21 00:12:39.625 2009 (GMT-7)
System Uptime: not available
Unable to load image ntoskrnl.exe, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
*** ERROR: Module load completed but symbols could not be loaded for
ntoskrnl.exe
Loading Kernel Symbols
................................................... ..............
................................................... ...............
.......
Loading User Symbols
Loading unloaded module list
.........
**************************************************
*****************************
*
*
* Bugcheck Analysis
*
*
*
**************************************************
*****************************

Use !analyze -v to get detailed debugging information.

BugCheck 44, {81ca6008, d39, 0, 0}

***** Kernel symbols are WRONG. Please fix symbols to do analysis.

************************************************** ***********************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
************************************************** ***********************
************************************************** ***********************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
************************************************** ***********************
Probably caused by : ntoskrnl.exe ( nt+1f004 )

Followup: MachineOwner
---------

0: kd> !analyze -v
**************************************************
*****************************
*
*
* Bugcheck Analysis
*
*
*
**************************************************
*****************************

MULTIPLE_IRP_COMPLETE_REQUESTS (44)
A driver has requested that an IRP be completed (IoCompleteRequest()), but
the packet has already been completed. This is a tough bug to find because
the easiest case, a driver actually attempted to complete its own packet
twice, is generally not what happened. Rather, two separate drivers each
believe that they own the packet, and each attempts to complete it. The
first actually works, and the second fails. Tracking down which drivers
in the system actually did this is difficult, generally because the trails
of the first driver have been covered by the second. However, the driver
stack for the current request can be found by examining the DeviceObject
fields in each of the stack locations.
Arguments:
Arg1: 81ca6008, Address of the IRP
Arg2: 00000d39
Arg3: 00000000
Arg4: 00000000

Debugging Details:
------------------

***** Kernel symbols are WRONG. Please fix symbols to do analysis.

************************************************** ***********************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
************************************************** ***********************
************************************************** ***********************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
************************************************** ***********************

ADDITIONAL_DEBUG_TEXT:
Use '!findthebuild' command to search for the target build information.
If the build information is available, run '!findthebuild -s ; .reload'
to set symbol path and load symbols.

MODULE_NAME: nt

FAULTING_MODULE: 80400000 nt

DEBUG_FLR_IMAGE_TIMESTAMP: 45ec3c8f

IRP_ADDRESS: 81ca6008

CUSTOMER_CRASH_COUNT: 2

DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: 0x44

LAST_CONTROL_TRANSFER: from 00000000 to 8041f004

STACK_TEXT:
80475e30 00000000 81ca6008 00000d39 00000000 nt+0x1f004


STACK_COMMAND: kb

FOLLOWUP_IP:
nt+1f004
8041f004 ?? ???

SYMBOL_STACK_INDEX: 0

SYMBOL_NAME: nt+1f004

FOLLOWUP_NAME: MachineOwner

IMAGE_NAME: ntoskrnl.exe

BUCKET_ID: WRONG_SYMBOLS

Followup: MachineOwner
---------

0: kd> lmvm nt
start end module name
80400000 805a2940 nt T (no symbols)
Loaded symbol image file: ntoskrnl.exe
Image path: ntoskrnl.exe
Image name: ntoskrnl.exe
Timestamp: Mon Mar 05 07:51:43 2007 (45EC3C8F)
CheckSum: 001AB628
ImageSize: 001A2940
Translations: 0000.04b0 0000.04e4 0409.04b0 0409.04e4

I can't think of what else to try beside reinstalling Windows 2000 SP4
from scratch.
--
"It's kind of an insane case ... 6,000 ants dressed up as rice and
robbed a Chinese restaurant." --Steven Wright
/\___/\
/ /\ /\ \ Phil/Ant @ http://antfarm.ma.cx (Personal Web Site)
| |o o| | Ant's Quality Foraged Links (AQFL): http://aqfl.net
\ _ / Nuke ANT from e-mail address: (E-Mail Removed)NT
( ) or (E-Mail Removed)
Ant is currently not listening to any songs on his home computer.

I don't know if this could be related? "irql errors are a pain. Though
I would put money on that its is still a thermal issue. Almost every
time i see it, it is because of a power flux in the fan system. Being
it is also throwing usb errors, i'd say you have a traveling short in
the mb."

What do you guys think?


On 10/25/2009 2:16 PM PT, Ant typed:

> I forgot to mention that the blue screen errors sometimes said IRQL or
> USB network drivers. They are random errors, but all related to each other.
>
> The blue screen can happen when not downloading, surfing, etc. It can be
> idling too.
>
>
> On 10/25/2009 1:38 PM PT, Ant typed:
>
>> I am trying to fix my client's old Dell Optiplex GX260 PC that is
>> getting a lot of blue screens lately. It can happen a few minutes
>> after booting up old Windows 2000 SP4 (has all critical updates and
>> latest drivers even though years old) or takes random hours to
>> reproduce. There are no forced specific patterns to reproduce the
>> crash, but there are patterns from what I saw in Windows' event logs.
>>
>> I also tried another wireless USB network devices (already tried
>> uninstalling in safe mode too), but it still had the same blue screens
>> so it is not the wireless devices. The problem started a few months
>> ago, and seems to be slowly getting worse. Note this is an old PC from
>> early 2000s, so it could be failing hardwares (USB inside?) in the PC
>> and had to replace its CPU fan a couple months ago. The client uses
>> USB a lot for his flash drives/sticks (old and new -- various brands
>> and sizes), old Palm Treo 680, an old tiny four ports hub, Sony
>> digital camera, an old HP multi-office machine
>> (scanner+printer+copier), etc.
>>
>> I exported the event logs for system and cleaned them up for logged
>> memory dump crashes only:
>
> [snipped -- see original post for them]
--
"It is certain that there may be extraordinary mental activity with an
extremely small absolute mass of nervous matter: thus the wonderfully
diversified instincts, mental powers, and affections of ants are
notorious, yet their cerebral ganglia are not so large as the quarter of
a small pin's head. Under this point of view, the brain of an ant is one
of the most marvellous atoms of matter in the world, perhaps more so
than the brain of a man." --Charles Darwin (from The Origin of Species,
1859)
/\___/\
/ /\ /\ \ Phil/Ant @ http://antfarm.ma.cx (Personal Web Site)
| |o o| | Ant's Quality Foraged Links (AQFL): http://aqfl.net
\ _ / Nuke ANT from e-mail address: (E-Mail Removed)NT
( ) or (E-Mail Removed)
Ant is currently not listening to any songs on his home computer.