BSODs: Likely driver related.

[Guest]

XP SP2, Dell Inspiron 6400/1505 Intel Duo Core 2. I've had it since since
11/06 and had BSODs since the day I got it. Lost count of number of times
reinstalling the OS (ghosting & by XP CD), finding driver updates, and have
given up on restore point (have long since deactivated it--tends to
attract/harbor worms & trojans) since it doesn't 'restore'. Finally tracked
down Sonic Roxio driver as one bad driver, another was recent Zone alarm
(first time I had no drivers showing up on Dell's Crash Analysis Tool), but
now Crash Analysis says 'fine' but Driver Verifier says 'corrupt' driver. But
which one?? All I know is when I do 'all drivers' on verifier, not just
'unsigned'. MSFT's KB does NOT help--it doesn't have a "Driver for Dummies
(and other idiots)" manual. Now the persisting problem is:
SPECIAL_POOL_DETECTED_MEMORY_CORRUPTION 0xC1 (0x92e6EFE0, 0x92E6E38A,
0x009F020, 0x23). -- 4th parameter always is 0x23. Other BSODs commonly seen
are: IRQL_NOT_LESS_OR_EQUAL 0xA , PFN_LIST_CORRUPT 0x4E ,
PAGE_FAULT_IN_NONE_PAGED_AREA 0x50, BAD_POOL_CALLER 0xC2 , and
DRIVER_VERIFIER_DETECTED_VIOLATION 0xC4 (this is the new one since setting
driver verifier to all drivers rather than 'all unsigned drivers').
Occasionally when it crashes a driver like ntfs.sys or win32k.sys (or the
'fatal system error' ndis.sys) will be identified. I think it's a system
driver (or two). How do I fix this? The KBs are not simple, and strangely
enough my event logs are not registering the crashes (much to my chagrin,
though I decided to give up on Avast! 4.7 when a .dll kept giving warnings
repeatedly). I'm not sure how to set the Minidumps (I found them empty using
the MS debugger, but I couldn't figure out how the symbols properly load).
chkdsk /r /f hasn't helped either. Where do I go from here? I can't quite
grasp the programming code on debugger--I need some basics, and for driver
verifier, it doesn't show why which setting is high or low, and how one can
do a process of elimination (in an understandable way) to find the balky
driver.

One problem is that no matter if I ghost or even installed from the XP
CD-ROM and start uninstalling much of the unnecessary stuff (including
PC-cillin--it seems to have a bogus firewall driver, or attracts one; I've
used Grisoft AVG since), but when I start downloading the 70+ Windows updates
is when I'm most likely to get my first BSOD (I can't recall but inclined to
think its PFN_LIST).

Where do I go from here? If not debugging? What else?

 

[Gerry]

You need to deal to problems as and when they occur. Reciting a history
of Stop Errors in the present and previous incarnations of your
operating system over the last 5 years is not helpful. You need to focus
on a single session, the latest one, and only look at earlier sessions
to see if it is a repeating problem. Often it can be pointless
investigating an error unless it happens more than once. You need to
capture a complete copy of the next Stop Error Report and post a full
copy here.

Disable automatic restart on system failure. This should help by
allowing time to write down the STOP code properly. Right click on
the My Computer icon on the Desktop and select Properties, Advanced,
Start-Up and Recovery, System Failure and uncheck box before
Automatically Restart.

Do not re-enable automatic restart on system failure even after you have
solved the problem as it's better disabled. Check for variants of the
Stop Error message.

An alternative is to keep pressing the F8 key during Start-Up and select
option - Disable automatic restart on system failure.

If you are using a wireless keyboard and the F8 key does not work
substitute a wired keyboard and mouse for this exercise only.

--



Hope this helps.

Gerry
~~~~
FCA
Stourport, England
Enquire, plan and execute
~~~~~~~~~~~~~~~~~~~

 

[Guest]

The auto restart is disabled (in fact I didn't know such a feature existed).
I wouldn't have been able to get as much information as I have otherwise.
However, my Event Log doesn't register any events, and my application log has
only register a problem with the Dell Service Center responding to AVG's
update service (a warning), so I uninstalled DSC (I didn't realize this until
now) but cannot correlate the warnings to BSODs. Recently I also uninstalled
Avast 4.7 because of a .dll error issue (it would put out a long repeating
sequence of warning/error) but cannot correlate it to a crash temporally,
either. The logs have not been useful, which concerns me.

Early on I was using the info on the Stop Errors--it would lead me to
'uninstall driver' but the problem was that most everything was long since
installed so I didn't know which was the culprit, or if it was a recent MS
update. The blue screens seldom implicated a driver (other than the
occasional system driver like ntfs.sys). Even when I'd reinstall the OS from
the beginning and go through the updates (70+) then a BSOD and 'uninstall' or
'disable' for instruction. There has to be a better way, like an algorithm
for process of elimination to identify the faulty culprit.

This is my Dell Inspiron 6400/E1505 XP SP2 duo core w/ 2GB RAM. No wireless
except the WLAN. I use the scratch pad.

Suggestion for next step?

 

[Gerry]

You seem to have partly destroyed the information support system which
can be used to troubleshoot. This makes it difficult to resolve any
problem.

Are there any yellow question marks in Device Manager? Right click on
the My Computer icon on your Desktop and select Properties,
Hardware,Device Manager. If yes what is the Device Error code?

Try Start, Run, type "sigverif.exe" without quotes and hit OK. What
drivers are listed as unsigned? Disregard those which are not checked.

--



Hope this helps.

Gerry
~~~~
FCA
Stourport, England
Enquire, plan and execute
~~~~~~~~~~~~~~~~~~~

 

[Guest]

I'm very familiar with device manager. A yellow "?" would have been so easy.
About the only time I ever see one is when I bollix a driver update; the DELL
WLAN card comes to mind with the wrong version.

The 'sigverif.exe' I'm not familiar with. On running this produced a
different output of an unsigned list (12) than what 'verifier.exe' outputs
for an unsigned *.sys (16). (I ran that for comparison.)

Sigverif.exe List (12): (there is no 'check' feature - did I do something
incorrectly?)
C:\WINDOWS\system32\spool\drivers\w32x86\3\mdiui.dll
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll
C:\WINDOWS\system32\spool\drivers\w32x86\3\unidrvui.dll
C:\WINDOWS\system32\spool\drivers\w32x86\3\unires.dll
C:\WINDOWS\system32\spool\drivers\w32x86\3\unidrv.dll
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.ini
C:\WINDOWS\system32\spool\drivers\w32x86\3\stddtype.gdl
C:\WINDOWS\system32\spool\drivers\w32x86\3\stdschem.gdl
C:\WINDOWS\system32\spool\drivers\w32x86\3\stdschmx.gdl
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.gpd
C:\WINDOWS\system32\drivers\omci.sys
C:\WINDOWS\system32\staco.dll

My printer isn't enabled (!). The omci.sys is the only one driver in common
on both lists. Interestingly, when I was looking for the 'staco.dll on my
'dll export viewer' it didn't show unlike the other 5 (but they are listed as
'app extentions; staco.dll is 'DLL file')


These are the 16 unsigned drivers (verifier.exe) from:
C:\WINDOWS\system32\drivers
APPDRV.SYS - application kernal driver
avg7core.sys - kernal driver/boot start (AVG)
avg7rsw.sys - kernal driver/boot start wrap (AVG)
avg7rsxp.sys - kernal driver/boot start resident (AVG)
AvgArCln.sys - kernal driver/boot start clean (AVG Anti-RootKit)
avgarkt.sys - kernal driver/boot start clean (AVG Anti-RootKit)
avgclean.sys - kernal driver/boot start clean (AVG)
avgtdi.sys - kernal driver/boot start network redirector (AVG)
BANTExt.sys - kernal driver/boot start (Belarc SMBios Access)
DLACDBHM.SYS - file system driver/boot start (Sonic Systems shared driver
comp)
DLARTL_N.SYS - file system driver/boot start (Sonic Stystems shared driver
comp)
DRVMCDB.SYS - file system driver/boot start (Sonic Systems device driver)
DRVNDDM.SYS -file system driver/boot start (Sonic Systems device driver mgr.)
omci.sys - kernal driver/boot start (Dell OMCI WDM Device driver)
pxhelp20.sys - kernal driver/boot start (Sonic Solutions Px Engine Device Dr
WinXP)
sp_rsdrv2.sys - kernal driver/boot start (Crawler.com Spyware Terminator dr.)

FYI - problems got worse when I did verifier.exe with 'auto select *all*
drivers'. Thats' when the frequency of "... Memory Corrupt ... 0xC4 (.,.,.,
0x23)" increased suddenly. This was one of the problems I had with the KB
about verifier -- the instructions about settings are not clear about how to
go about selectively enforcing which drivers and how. And which is what
settings that do it. It's too technical.

I did upgrade the Roxio DVD DLA from 3.0 to 5.2 recently--it's how I
eliminated a corrupt driver that showed in Dell's Crash Analysis tool
(tfstnsf.sys I think). But that was well after the 'verifier.exe' experiment,
and I don't think it has affected the 0xC4 issue significantly. Using the DVD
player other than for XP chkdsk /r /p, reloading MS Office 2003 (done that
twice, but not recently) and a educational DVD on occasion (it isn't audio or
video), it hasn't been integral to my life.

Hope there is a clue to what's going on in here.

 

[Gerry]

I was reading one of your other posts earlier. You have a lot going on
so the situation has the potential for confusion. It's like looking for
a needle in a haystack.

Sonic as I understand it is now part of Roxio. Historically Roxio caused
a lot of driver problems but that was some time ago. I am not sure how
they now stand.

When I looked thtrough the others nothing started ringing bells.

I did not suggest using Driver Verifier. Your feedback is, however, of
interest as I have trying to get feedback on it's use. Your remarks do
not surprise. There are a few Microsoft utilities which are difficult to
use.. The debugging tool is another.

--



Hope this helps.

Gerry
~~~~
FCA
Stourport, England
Enquire, plan and execute
~~~~~~~~~~~~~~~~~~~

 

[Guest]

When I ran the 'sigverif.exe'--a program I've never seen suggested over the
months scouring forums--I was sort of expecting to see drivers as you
suggested. When I saw a list of .dll files and .gpd files plus one driver I
was wondering if I did something wrong in running it. That's why I ran the
verifier.exe for the unsigned drivers as a countercheck. I id'ed them as a
convenience (I think).

You probably saw the open popup folder Q, I thought that a side
issue--that's resolved from a simple deleting of two registry keys involving
the ATI driver from about 3-4 weeks ago. But it underlies the knowledge
deficit that I can't tell if a key belongs there or not. I spent enough time
with Dell and am getting nowhere, I figure now put it out to the world at
large.

Having another crash today (IRQL ... 0xA (0x2,0x0,0x0,0x8053a8dc), no driver
identified, only software new is autoruns.exe, recently uninstalled Dell
Support Center) I was studying '... may need to disable BIOS memory option
such as cache or shadowing ...' something I hadn't followed through on, but a
search of microsoft.com I can't find anything that shows just how to do that.

 

[Gerry]

When you say you did this "simple deleting of two registry keys" it
worries me. Did you backup the keys before you did so? Are you able to
restore them?

Also this "I uninstalled DSC". Why did you do this?

I do not understand why this is so "However, my Event Log doesn't
register any events". Have you done anything to Stop System logging?

--



Hope this helps.

Gerry
~~~~
FCA
Stourport, England
Enquire, plan and execute
~~~~~~~~~~~~~~~~~~~

 

[Guest]

I 'deleted' the two keys by running 'autoruns.exe' and unchecked the two
keys. I can rerun the program and recheck the two boxes. Would the EventLog
have anything to do with the ATI CCC?

 

[Gerry]

Not really
http://ati.amd.com/developer/sdk/ccc/index.html

--



Hope this helps.

Gerry
~~~~
FCA
Stourport, England
Enquire, plan and execute
~~~~~~~~~~~~~~~~~~~

 

[Guest]

I've been having some problems with replying--for some reason it would not
post. My last message was brief because I lost several detailed ones.

I uninstalled the Dell Service Center because in the Computer Tools Service
Application Log there is a recurring WARNING which I cannot interpret nor do
the KB instructions help.

The description for Event ID ( 19011 ) in Source ( MSSQL$MICROSOFTSMLBIZ )
cannot be found. The local computer may not have the necessary registry
information or message DLL files to display messages from a remote computer.
You may be able to use the /AUXSOURCE= flag to retrieve this description; see
Help and Support for details. The following information is part of the event:
(SpnRegister) : Error 1355.

The DSC would be the last item listed prior to the Warning. This is the
sequence (from bottom to top, time is in seconds with Warning as t=0).

Warning Date 0:00:00 MSSQL$MICROSOFTSMLBIZ (8) 19011
(DSC)
Information "" -0:00:02 UPHClean None 1001
Information "" -0:00:03 AvgEms none 1
Information '' -0:00:06 Avg7UpdSvc None 1

Removing DSC has not made a difference in the presence of the Warning. The
UPHClean was a recent installation in response to another BSOD that I found
on a MS KB. The DSC was not used and obsolete anyway. The warning does not
correlate to any type of BSOD I am having though.

After several reinstallations (mainly by ghosting) the reporting of errors
to MS stopped (at least the notification dialogue box stopped). I don't know
why. I haven't looked for that. How should I evaluate this? I know that the
"performance logs" service will not start--it refuses to--that was something
needed in the debugging software.

The two keys I 'deleted' (maybe disabled is the right word) are:
* HKCU\Software\Microsoft\Windows\CurrentVersion\Run: [StartCCC] C: ...
\ati.ace\core-static\clistart.exe
* Startup: CCC.lnk = C: ... \ati.ace\core-static\ccc.exe

The windows folder that would automatically open on startup no longer opens
once I unchecked these two.

 

[Gerry]

Is your Microsoft Managment Console damaged?

Components include:
Event Viewer -not running!
Performance -not running!

Can you access Services? Start, Control Panel, Administrative Tools,
Services. Will you please check the Start-Up type for WMI (Windows
Management Information) and whether it has started? The Start Up Type
should be Automatic.

--



Hope this helps.

Gerry
~~~~
FCA
Stourport, England
Enquire, plan and execute
~~~~~~~~~~~~~~~~~~~

I've been having some problems with replying--for some reason it
would not post. My last message was brief because I lost several
detailed ones.

I uninstalled the Dell Service Center because in the Computer Tools
Service Application Log there is a recurring WARNING which I cannot
interpret nor do the KB instructions help.

The description for Event ID ( 19011 ) in Source (
MSSQL$MICROSOFTSMLBIZ ) cannot be found. The local computer may not
have the necessary registry information or message DLL files to
display messages from a remote computer. You may be able to use the
/AUXSOURCE= flag to retrieve this description; see Help and Support
for details. The following information is part of the event:
(SpnRegister) : Error 1355.

The DSC would be the last item listed prior to the Warning. This is
the sequence (from bottom to top, time is in seconds with Warning as
t=0).

Warning Date 0:00:00 MSSQL$MICROSOFTSMLBIZ (8) 19011
(DSC)
Information "" -0:00:02 UPHClean None 1001
Information "" -0:00:03 AvgEms none
1 Information '' -0:00:06 Avg7UpdSvc None
1

Removing DSC has not made a difference in the presence of the
Warning. The UPHClean was a recent installation in response to
another BSOD that I found on a MS KB. The DSC was not used and
obsolete anyway. The warning does not correlate to any type of BSOD I
am having though.

After several reinstallations (mainly by ghosting) the reporting of
errors to MS stopped (at least the notification dialogue box
stopped). I don't know why. I haven't looked for that. How should I
evaluate this? I know that the "performance logs" service will not
start--it refuses to--that was something needed in the debugging
software.

The two keys I 'deleted' (maybe disabled is the right word) are:
* HKCU\Software\Microsoft\Windows\CurrentVersion\Run: [StartCCC] C:
... \ati.ace\core-static\clistart.exe
* Startup: CCC.lnk = C: ... \ati.ace\core-static\ccc.exe

The windows folder that would automatically open on startup no longer
opens once I unchecked these two.

Not really
http://ati.amd.com/developer/sdk/ccc/index.html

--



Hope this helps.

Gerry
~~~~
FCA
Stourport, England
Enquire, plan and execute
~~~~~~~~~~~~~~~~~~~

 

[Guest]

Gerry:

I thought you might like to know how this turned out. After looking at too
many '0xc4's STOP ERRORS at every turn (plus appearances from the other usual
suspects), I backed up everything and attempted to reinstall the XP OS
completely from the ground up. This got aborted because of 'missing set-up
files' in the original OS. Since nothing improved, but seemed more
inconvenient, I attempted to 'ghost' (re-image?) it, but that too got aborted
right at the end, and after that it failed to reboot completely; including
from the CD-ROM. After moving through several layer of techs at Dell (all
they did was re-hash everything I did already), I finally got action through
their Escalation support (thank you, DellHell.com), a senior managerial
technician just decided to replace the HDD, motherboard, and the memory chips
as well ... and sent a technician on site to do it (this was a learning
experience watching all this). The tech was certain this was a defective HDD.

All this took 4 weeks with a laptop that deaf, dumb & blind, and possessed.
But now, no more BSODs. I'm hoping the exorcism is complete.

Thank you for your help and patience.

-dn

Is your Microsoft Managment Console damaged?

Components include:
Event Viewer -not running!
Performance -not running!

Can you access Services? Start, Control Panel, Administrative Tools,
Services. Will you please check the Start-Up type for WMI (Windows
Management Information) and whether it has started? The Start Up Type
should be Automatic.

--



Hope this helps.

Gerry
~~~~
FCA
Stourport, England
Enquire, plan and execute
~~~~~~~~~~~~~~~~~~~

I've been having some problems with replying--for some reason it
would not post. My last message was brief because I lost several
detailed ones.

I uninstalled the Dell Service Center because in the Computer Tools
Service Application Log there is a recurring WARNING which I cannot
interpret nor do the KB instructions help.

The description for Event ID ( 19011 ) in Source (
MSSQL$MICROSOFTSMLBIZ ) cannot be found. The local computer may not
have the necessary registry information or message DLL files to
display messages from a remote computer. You may be able to use the
/AUXSOURCE= flag to retrieve this description; see Help and Support
for details. The following information is part of the event:
(SpnRegister) : Error 1355.

The DSC would be the last item listed prior to the Warning. This is
the sequence (from bottom to top, time is in seconds with Warning as
t=0).

Warning Date 0:00:00 MSSQL$MICROSOFTSMLBIZ (8) 19011
(DSC)
Information "" -0:00:02 UPHClean None 1001
Information "" -0:00:03 AvgEms none
1 Information '' -0:00:06 Avg7UpdSvc None
1

Removing DSC has not made a difference in the presence of the
Warning. The UPHClean was a recent installation in response to
another BSOD that I found on a MS KB. The DSC was not used and
obsolete anyway. The warning does not correlate to any type of BSOD I
am having though.

After several reinstallations (mainly by ghosting) the reporting of
errors to MS stopped (at least the notification dialogue box
stopped). I don't know why. I haven't looked for that. How should I
evaluate this? I know that the "performance logs" service will not
start--it refuses to--that was something needed in the debugging
software.

The two keys I 'deleted' (maybe disabled is the right word) are:
* HKCU\Software\Microsoft\Windows\CurrentVersion\Run: [StartCCC] C:
... \ati.ace\core-static\clistart.exe
* Startup: CCC.lnk = C: ... \ati.ace\core-static\ccc.exe

The windows folder that would automatically open on startup no longer
opens once I unchecked these two.

Not really
http://ati.amd.com/developer/sdk/ccc/index.html

--



Hope this helps.

Gerry
~~~~
FCA
Stourport, England
Enquire, plan and execute
~~~~~~~~~~~~~~~~~~~


dr nemo wrote:
I 'deleted' the two keys by running 'autoruns.exe' and unchecked the
two keys. I can rerun the program and recheck the two boxes. Would
the EventLog have anything to do with the ATI CCC?



:

When you say you did this "simple deleting of two registry keys" it
worries me. Did you backup the keys before you did so? Are you able
to restore them?

Also this "I uninstalled DSC". Why did you do this?

I do not understand why this is so "However, my Event Log doesn't
register any events". Have you done anything to Stop System
logging?

--



Hope this helps.

Gerry
~~~~
FCA
Stourport, England
Enquire, plan and execute
~~~~~~~~~~~~~~~~~~~


dr nemo wrote:
When I ran the 'sigverif.exe'--a program I've never seen suggested
over the months scouring forums--I was sort of expecting to see
drivers as you suggested. When I saw a list of .dll files and .gpd
files plus one driver I was wondering if I did something wrong in
running it. That's why I ran the verifier.exe for the unsigned
drivers as a countercheck. I id'ed them as a convenience (I
think).

You probably saw the open popup folder Q, I thought that a side
issue--that's resolved from a simple deleting of two registry keys
involving the ATI driver from about 3-4 weeks ago. But it
underlies the knowledge deficit that I can't tell if a key
belongs there or not. I spent enough time with Dell and am
getting nowhere, I figure now put it out to the world at large.

Having another crash today (IRQL ... 0xA (0x2,0x0,0x0,0x8053a8dc),
no driver identified, only software new is autoruns.exe, recently
uninstalled Dell Support Center) I was studying '... may need to
disable BIOS memory option such as cache or shadowing ...'
something I hadn't followed through on, but a search of
microsoft.com I can't find anything that shows just how to do
that.

:

I was reading one of your other posts earlier. You have a lot
going on so the situation has the potential for confusion. It's
like looking for a needle in a haystack.

Sonic as I understand it is now part of Roxio. Historically Roxio
caused a lot of driver problems but that was some time ago. I am
not sure how they now stand.

When I looked thtrough the others nothing started ringing bells.

I did not suggest using Driver Verifier. Your feedback is,
however, of interest as I have trying to get feedback on it's
use. Your remarks do not surprise. There are a few Microsoft
utilities which are difficult to use.. The debugging tool is
another.

--



Hope this helps.

Gerry
~~~~
FCA
Stourport, England
Enquire, plan and execute
~~~~~~~~~~~~~~~~~~~

dr nemo wrote:
I'm very familiar with device manager. A yellow "?" would have
been so easy. About the only time I ever see one is when I
bollix a driver update; the DELL WLAN card comes to mind with
the wrong version.

The 'sigverif.exe' I'm not familiar with. On running this
produced a different output of an unsigned list (12) than what
'verifier.exe' outputs for an unsigned *.sys (16). (I ran that
for comparison.)

Sigverif.exe List (12): (there is no 'check' feature - did I do
something incorrectly?)
C:\WINDOWS\system32\spool\drivers\w32x86\3\mdiui.dll
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll
C:\WINDOWS\system32\spool\drivers\w32x86\3\unidrvui.dll
C:\WINDOWS\system32\spool\drivers\w32x86\3\unires.dll
C:\WINDOWS\system32\spool\drivers\w32x86\3\unidrv.dll
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.ini
C:\WINDOWS\system32\spool\drivers\w32x86\3\stddtype.gdl
C:\WINDOWS\system32\spool\drivers\w32x86\3\stdschem.gdl
C:\WINDOWS\system32\spool\drivers\w32x86\3\stdschmx.gdl
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.gpd
C:\WINDOWS\system32\drivers\omci.sys
C:\WINDOWS\system32\staco.dll

My printer isn't enabled (!). The omci.sys is the only one
driver in common on both lists. Interestingly, when I was
looking for the 'staco.dll on my 'dll export viewer' it didn't
show unlike the other 5 (but they are listed as 'app
extentions; staco.dll is 'DLL file')


These are the 16 unsigned drivers (verifier.exe) from:
C:\WINDOWS\system32\drivers
APPDRV.SYS - application kernal driver
avg7core.sys - kernal driver/boot start (AVG)
avg7rsw.sys - kernal driver/boot start wrap (AVG)
avg7rsxp.sys - kernal driver/boot start resident (AVG)
AvgArCln.sys - kernal driver/boot start clean (AVG Anti-RootKit)
avgarkt.sys - kernal driver/boot start clean (AVG Anti-RootKit)
avgclean.sys - kernal driver/boot start clean (AVG)
avgtdi.sys - kernal driver/boot start network redirector (AVG)
BANTExt.sys - kernal driver/boot start (Belarc SMBios Access)
DLACDBHM.SYS - file system driver/boot start (Sonic Systems
shared driver comp)
DLARTL_N.SYS - file system driver/boot start (Sonic Stystems
shared driver comp)
DRVMCDB.SYS - file system driver/boot start (Sonic Systems
device driver) DRVNDDM.SYS -file system driver/boot start
(Sonic Systems device driver mgr.) omci.sys - kernal
driver/boot start (Dell OMCI WDM Device driver) pxhelp20.sys -
kernal driver/boot start (Sonic Solutions Px Engine Device Dr
WinXP)
sp_rsdrv2.sys - kernal driver/boot start (Crawler.com Spyware
Terminator dr.)

FYI - problems got worse when I did verifier.exe with 'auto
select *all* drivers'. Thats' when the frequency of "... Memory
Corrupt ... 0xC4 (.,.,., 0x23)" increased suddenly. This was
one of the problems I had with the KB about verifier -- the
instructions about settings are not clear about how to go about
selectively enforcing which drivers and how. And which is what
settings that do it. It's too technical.

I did upgrade the Roxio DVD DLA from 3.0 to 5.2 recently--it's
how I eliminated a corrupt driver that showed in Dell's Crash
Analysis tool (tfstnsf.sys I think). But that was well after the
'verifier.exe' experiment, and I don't think it has affected the
0xC4 issue significantly. Using the DVD player other than for XP
chkdsk /r /p, reloading MS Office 2003 (done that twice, but not
recently) and a educational DVD on occasion (it isn't audio or
video), it hasn't been integral to my life.

Hope there is a clue to what's going on in here.

:

You seem to have partly destroyed the information support
system which can be used to troubleshoot. This makes it
difficult to resolve any problem.

Are there any yellow question marks in Device Manager? Right
click on the My Computer icon on your Desktop and select
Properties, Hardware,Device Manager. If yes what is the Device
Error code?

Try Start, Run, type "sigverif.exe" without quotes and hit OK.
What drivers are listed as unsigned? Disregard those which are
not checked.

--



Hope this helps.

Gerry
~~~~
FCA
Stourport, England
Enquire, plan and execute
~~~~~~~~~~~~~~~~~~~


dr nemo wrote:
The auto restart is disabled (in fact I didn't know such a
feature existed). I wouldn't have been able to get as much
information as I have otherwise. However, my Event Log doesn't
register any events, and my application log has only register
a problem with the Dell Service Center responding to AVG's
update service (a warning), so I uninstalled DSC (I didn't
realize this until now) but cannot correlate the warnings to
BSODs. Recently I also uninstalled Avast
4.7 because of a .dll error issue (it would put out a long
repeating sequence of warning/error) but cannot correlate it
to a crash temporally, either. The logs have not been useful,

 

[Gerry]

Glad it's sorted. Thanks for reporting the outcome.


--
Regards.

Gerry
~~~~
FCA
Stourport, England
Enquire, plan and execute
~~~~~~~~~~~~~~~~~~~

Gerry:

I thought you might like to know how this turned out. After looking
at too many '0xc4's STOP ERRORS at every turn (plus appearances from
the other usual suspects), I backed up everything and attempted to
reinstall the XP OS completely from the ground up. This got aborted
because of 'missing set-up files' in the original OS. Since nothing
improved, but seemed more inconvenient, I attempted to 'ghost'
(re-image?) it, but that too got aborted right at the end, and after
that it failed to reboot completely; including from the CD-ROM. After
moving through several layer of techs at Dell (all they did was
re-hash everything I did already), I finally got action through their
Escalation support (thank you, DellHell.com), a senior managerial
technician just decided to replace the HDD, motherboard, and the
memory chips as well ... and sent a technician on site to do it (this
was a learning experience watching all this). The tech was certain
this was a defective HDD.

All this took 4 weeks with a laptop that deaf, dumb & blind, and
possessed. But now, no more BSODs. I'm hoping the exorcism is
complete.

Thank you for your help and patience.

-dn

Is your Microsoft Managment Console damaged?

Components include:
Event Viewer -not running!
Performance -not running!

Can you access Services? Start, Control Panel, Administrative Tools,
Services. Will you please check the Start-Up type for WMI (Windows
Management Information) and whether it has started? The Start Up Type
should be Automatic.

--



Hope this helps.

Gerry
~~~~
FCA
Stourport, England
Enquire, plan and execute
~~~~~~~~~~~~~~~~~~~

I've been having some problems with replying--for some reason it
would not post. My last message was brief because I lost several
detailed ones.

I uninstalled the Dell Service Center because in the Computer Tools
Service Application Log there is a recurring WARNING which I cannot
interpret nor do the KB instructions help.

The description for Event ID ( 19011 ) in Source (
MSSQL$MICROSOFTSMLBIZ ) cannot be found. The local computer may not
have the necessary registry information or message DLL files to
display messages from a remote computer. You may be able to use the
/AUXSOURCE= flag to retrieve this description; see Help and Support
for details. The following information is part of the event:
(SpnRegister) : Error 1355.

The DSC would be the last item listed prior to the Warning. This is
the sequence (from bottom to top, time is in seconds with Warning as
t=0).

Warning Date 0:00:00 MSSQL$MICROSOFTSMLBIZ (8) 19011
(DSC)
Information "" -0:00:02 UPHClean None
1001 Information "" -0:00:03 AvgEms
none 1 Information '' -0:00:06 Avg7UpdSvc
None 1

Removing DSC has not made a difference in the presence of the
Warning. The UPHClean was a recent installation in response to
another BSOD that I found on a MS KB. The DSC was not used and
obsolete anyway. The warning does not correlate to any type of BSOD
I am having though.

After several reinstallations (mainly by ghosting) the reporting of
errors to MS stopped (at least the notification dialogue box
stopped). I don't know why. I haven't looked for that. How should I
evaluate this? I know that the "performance logs" service will not
start--it refuses to--that was something needed in the debugging
software.

The two keys I 'deleted' (maybe disabled is the right word) are:
* HKCU\Software\Microsoft\Windows\CurrentVersion\Run: [StartCCC] C:
... \ati.ace\core-static\clistart.exe
* Startup: CCC.lnk = C: ... \ati.ace\core-static\ccc.exe

The windows folder that would automatically open on startup no
longer opens once I unchecked these two.


:

Not really
http://ati.amd.com/developer/sdk/ccc/index.html

--



Hope this helps.

Gerry
~~~~
FCA
Stourport, England
Enquire, plan and execute
~~~~~~~~~~~~~~~~~~~


dr nemo wrote:
I 'deleted' the two keys by running 'autoruns.exe' and unchecked
the two keys. I can rerun the program and recheck the two boxes.
Would the EventLog have anything to do with the ATI CCC?



:

When you say you did this "simple deleting of two registry keys"
it worries me. Did you backup the keys before you did so? Are
you able to restore them?

Also this "I uninstalled DSC". Why did you do this?

I do not understand why this is so "However, my Event Log doesn't
register any events". Have you done anything to Stop System
logging?

--



Hope this helps.

Gerry
~~~~
FCA
Stourport, England
Enquire, plan and execute
~~~~~~~~~~~~~~~~~~~


dr nemo wrote:
When I ran the 'sigverif.exe'--a program I've never seen
suggested over the months scouring forums--I was sort of
expecting to see drivers as you suggested. When I saw a list of
.dll files and .gpd files plus one driver I was wondering if I
did something wrong in running it. That's why I ran the
verifier.exe for the unsigned drivers as a countercheck. I
id'ed them as a convenience (I think).

You probably saw the open popup folder Q, I thought that a side
issue--that's resolved from a simple deleting of two registry
keys involving the ATI driver from about 3-4 weeks ago. But it
underlies the knowledge deficit that I can't tell if a key
belongs there or not. I spent enough time with Dell and am
getting nowhere, I figure now put it out to the world at large.

Having another crash today (IRQL ... 0xA
(0x2,0x0,0x0,0x8053a8dc), no driver identified, only software
new is autoruns.exe, recently uninstalled Dell Support Center)
I was studying '... may need to disable BIOS memory option such
as cache or shadowing ...' something I hadn't followed through
on, but a search of microsoft.com I can't find anything that
shows just how to do that.

:

I was reading one of your other posts earlier. You have a lot
going on so the situation has the potential for confusion. It's
like looking for a needle in a haystack.

Sonic as I understand it is now part of Roxio. Historically
Roxio caused a lot of driver problems but that was some time
ago. I am not sure how they now stand.

When I looked thtrough the others nothing started ringing
bells.

I did not suggest using Driver Verifier. Your feedback is,
however, of interest as I have trying to get feedback on it's
use. Your remarks do not surprise. There are a few Microsoft
utilities which are difficult to use.. The debugging tool is
another.

--



Hope this helps.

Gerry
~~~~
FCA
Stourport, England
Enquire, plan and execute
~~~~~~~~~~~~~~~~~~~

dr nemo wrote:
I'm very familiar with device manager. A yellow "?" would have
been so easy. About the only time I ever see one is when I
bollix a driver update; the DELL WLAN card comes to mind with
the wrong version.

The 'sigverif.exe' I'm not familiar with. On running this
produced a different output of an unsigned list (12) than what
'verifier.exe' outputs for an unsigned *.sys (16). (I ran that
for comparison.)

Sigverif.exe List (12): (there is no 'check' feature - did I
do something incorrectly?)
C:\WINDOWS\system32\spool\drivers\w32x86\3\mdiui.dll
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll
C:\WINDOWS\system32\spool\drivers\w32x86\3\unidrvui.dll
C:\WINDOWS\system32\spool\drivers\w32x86\3\unires.dll
C:\WINDOWS\system32\spool\drivers\w32x86\3\unidrv.dll
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.ini
C:\WINDOWS\system32\spool\drivers\w32x86\3\stddtype.gdl
C:\WINDOWS\system32\spool\drivers\w32x86\3\stdschem.gdl
C:\WINDOWS\system32\spool\drivers\w32x86\3\stdschmx.gdl
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.gpd
C:\WINDOWS\system32\drivers\omci.sys
C:\WINDOWS\system32\staco.dll

My printer isn't enabled (!). The omci.sys is the only one
driver in common on both lists. Interestingly, when I was
looking for the 'staco.dll on my 'dll export viewer' it didn't
show unlike the other 5 (but they are listed as 'app
extentions; staco.dll is 'DLL file')


These are the 16 unsigned drivers (verifier.exe) from:
C:\WINDOWS\system32\drivers
APPDRV.SYS - application kernal driver
avg7core.sys - kernal driver/boot start (AVG)
avg7rsw.sys - kernal driver/boot start wrap (AVG)
avg7rsxp.sys - kernal driver/boot start resident (AVG)
AvgArCln.sys - kernal driver/boot start clean (AVG
Anti-RootKit) avgarkt.sys - kernal driver/boot start clean
(AVG Anti-RootKit) avgclean.sys - kernal driver/boot start
clean (AVG)
avgtdi.sys - kernal driver/boot start network redirector (AVG)
BANTExt.sys - kernal driver/boot start (Belarc SMBios Access)
DLACDBHM.SYS - file system driver/boot start (Sonic Systems
shared driver comp)
DLARTL_N.SYS - file system driver/boot start (Sonic Stystems
shared driver comp)
DRVMCDB.SYS - file system driver/boot start (Sonic Systems
device driver) DRVNDDM.SYS -file system driver/boot start
(Sonic Systems device driver mgr.) omci.sys - kernal
driver/boot start (Dell OMCI WDM Device driver) pxhelp20.sys -
kernal driver/boot start (Sonic Solutions Px Engine Device Dr
WinXP)
sp_rsdrv2.sys - kernal driver/boot start (Crawler.com Spyware
Terminator dr.)

FYI - problems got worse when I did verifier.exe with 'auto
select *all* drivers'. Thats' when the frequency of "...
Memory Corrupt ... 0xC4 (.,.,., 0x23)" increased suddenly.
This was one of the problems I had with the KB about verifier
-- the instructions about settings are not clear about how to
go about selectively enforcing which drivers and how. And
which is what settings that do it. It's too technical.

I did upgrade the Roxio DVD DLA from 3.0 to 5.2 recently--it's
how I eliminated a corrupt driver that showed in Dell's Crash
Analysis tool (tfstnsf.sys I think). But that was well after
the 'verifier.exe' experiment, and I don't think it has
affected the 0xC4 issue significantly. Using the DVD player
other than for XP chkdsk /r /p, reloading MS Office 2003
(done that twice, but not recently) and a educational DVD on
occasion (it isn't audio or video), it hasn't been integral
to my life.

Hope there is a clue to what's going on in here.

:

You seem to have partly destroyed the information support
system which can be used to troubleshoot. This makes it
difficult to resolve any problem.

Are there any yellow question marks in Device Manager? Right
click on the My Computer icon on your Desktop and select
Properties, Hardware,Device Manager. If yes what is the
Device Error code?

Try Start, Run, type "sigverif.exe" without quotes and hit
OK. What drivers are listed as unsigned? Disregard those
which are not checked.

--



Hope this helps.

Gerry
~~~~
FCA
Stourport, England
Enquire, plan and execute
~~~~~~~~~~~~~~~~~~~


dr nemo wrote:
The auto restart is disabled (in fact I didn't know such a
feature existed). I wouldn't have been able to get as much
information as I have otherwise. However, my Event Log
doesn't register any events, and my application log has
only register a problem with the Dell Service Center
responding to AVG's update service (a warning), so I
uninstalled DSC (I didn't realize this until now) but
cannot correlate the warnings to BSODs. Recently I also
uninstalled Avast
4.7 because of a .dll error issue (it would put out a long
repeating sequence of warning/error) but cannot correlate it
to a crash temporally, either. The logs have not been
useful,