Please help with Blue Screen problem :(

[Guest]

Greetings, I have a new system that has a blue-screen issue that has me
totally stumped.

System information: P4-3.0ghz, Asus P5L VM1394, 2x1gig Corsair DDR 533,
using integrated audio, NIC and video. 1 SATA 160gig Seagate drive, Antec
Smart Power 450W.
Temps are good: 35C CPU, 38C peak. Sys temp: 33C-35C (has two 120mm fans
and stock. Voltages all look good. 12v hovers around 12.56v though but
seems okay.

System occasionally will blue-screen w/ minidump randomly. Maybe once/twice
a day. Programs open when this occurs: Outlook 2003 + AVG Free, systray
RealTek HD Manager, Intel Graphics Media Accelerator. Can come from a fresh
boot, fire up Outlook... send/receive new messages.. and periodically this
will spawn a blue screen/reboot.

I ran Memtest86+ overnight, 27 passes. No memory errors detected. I did
try upgrading to the latest BIOS (930) for the mainboard, no change. I also
ran Microsoft Update and it fetched numerous Outlook/Office updates. No
change.

The minidump isn't very helpful for trying to isolate what component/driver
may be having the issue. I've switched this to full memory dump and awaiting
my next bluescreen in hopes this might yield further insight. I'll
copy/paste the windgb from the minidumps in hopes someone can help further!

I'm at witts end and really unsure what to look at next. Any tips/insights
greatly appreciated!

===================================
BugCheck 1000008E, {c0000005, 80571fff, a7ee2908, 0}

Probably caused by : memory_corruption

Followup: memory_corruption
---------

0: kd> !analyze -v!
*******************************************************************************
*
*
* Bugcheck Analysis
*
*
*
*******************************************************************************

KERNEL_MODE_EXCEPTION_NOT_HANDLED_M (1000008e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003. This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG. This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG. This will let us see why this breakpoint is
happening.
Arguments:
Arg1: c0000005, The exception code that was not handled
Arg2: 80571fff, The address that the exception occurred at
Arg3: a7ee2908, Trap Frame
Arg4: 00000000

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx"
referenced memory at "0x%08lx". The memory could not be "%s".

FAULTING_IP:
nt!CmpRemoveFromDelayedClose+4e
80571fff 8902 mov [edx],eax

TRAP_FRAME: a7ee2908 -- (.trap ffffffffa7ee2908)
ErrCode = 00000002
eax=e10297bc ebx=a7ee2b90 ecx=e28f3440 edx=00000000 esi=e102ca44 edi=e28f3440
eip=80571fff esp=a7ee297c ebp=a7ee2980 iopl=0 nv up ei ng nz na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010282
nt!CmpRemoveFromDelayedClose+0x4e:
80571fff 8902 mov [edx],eax ds:0023:00000000=????????
Resetting default scope

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: CODE_CORRUPTION

BUGCHECK_STR: 0x8E

LAST_CONTROL_TRANSFER: from 80571f29 to 80571fff

STACK_TEXT:
a7ee2980 80571f29 e28f3440 00000000 a7ee29cc nt!CmpRemoveFromDelayedClose+0x4e
a7ee2990 80571af1 e28f3440 a7ee2bf4 00000200
nt!CmpReferenceKeyControlBlock+0x15
a7ee29cc 805718c8 a7ee29fc 00000000 a7ee2b7c nt!CmpCacheLookup+0x1f5
a7ee2bb0 80571ef1 00059750 89be7980 890cac08 nt!CmpParseKey+0x10d
a7ee2c28 8056f2a8 00000850 a7ee2c68 00000040 nt!ObpLookupObjectName+0x119
a7ee2c7c 80571dbe 00000000 89be7980 8056e901 nt!ObOpenObjectByName+0xea
a7ee2d50 804dd99f 00c9db34 00000001 00c9da88 nt!NtOpenKey+0x1af
a7ee2d50 7c90eb94 00c9db34 00000001 00c9da88 nt!KiFastCallEntry+0xfc
WARNING: Frame IP not in any known module. Following frames may be wrong.
00c9da64 00000000 00000000 00000000 00000000 0x7c90eb94


CHKIMG_EXTENSION: !chkimg -lo 50 -d !nt
80571ff4 - nt!CmpRemoveFromDelayedClose+43
[ 55:71 ]
1 error : !nt (80571ff4)

MODULE_NAME: memory_corruption

IMAGE_NAME: memory_corruption

FOLLOWUP_NAME: memory_corruption

DEBUG_FLR_IMAGE_TIMESTAMP: 0

MEMORY_CORRUPTOR: ONE_BYTE

STACK_COMMAND: .trap ffffffffa7ee2908 ; kb

FAILURE_BUCKET_ID: MEMORY_CORRUPTION_ONE_BYTE

BUCKET_ID: MEMORY_CORRUPTION_ONE_BYTE

Followup: memory_corruption

 

[Guest]

Boot with half your ram, and test, then the other half.
--
Was this post helpful to you? Then click the "Yes" button, below.
Voting helps others who use the web interface.
Mark L. Ferguson

Greetings, I have a new system that has a blue-screen issue that has me
totally stumped.

System information: P4-3.0ghz, Asus P5L VM1394, 2x1gig Corsair DDR 533,
using integrated audio, NIC and video. 1 SATA 160gig Seagate drive, Antec
Smart Power 450W.
Temps are good: 35C CPU, 38C peak. Sys temp: 33C-35C (has two 120mm fans
and stock. Voltages all look good. 12v hovers around 12.56v though but
seems okay.

System occasionally will blue-screen w/ minidump randomly. Maybe once/twice
a day. Programs open when this occurs: Outlook 2003 + AVG Free, systray
RealTek HD Manager, Intel Graphics Media Accelerator. Can come from a fresh
boot, fire up Outlook... send/receive new messages.. and periodically this
will spawn a blue screen/reboot.

I ran Memtest86+ overnight, 27 passes. No memory errors detected. I did
try upgrading to the latest BIOS (930) for the mainboard, no change. I also
ran Microsoft Update and it fetched numerous Outlook/Office updates. No
change.

The minidump isn't very helpful for trying to isolate what component/driver
may be having the issue. I've switched this to full memory dump and awaiting
my next bluescreen in hopes this might yield further insight. I'll
copy/paste the windgb from the minidumps in hopes someone can help further!

I'm at witts end and really unsure what to look at next. Any tips/insights
greatly appreciated!

===================================
BugCheck 1000008E, {c0000005, 80571fff, a7ee2908, 0}

Probably caused by : memory_corruption

Followup: memory_corruption
---------

0: kd> !analyze -v!
*******************************************************************************
*
*
* Bugcheck Analysis
*
*
*
*******************************************************************************

KERNEL_MODE_EXCEPTION_NOT_HANDLED_M (1000008e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003. This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG. This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG. This will let us see why this breakpoint is
happening.
Arguments:
Arg1: c0000005, The exception code that was not handled
Arg2: 80571fff, The address that the exception occurred at
Arg3: a7ee2908, Trap Frame
Arg4: 00000000

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx"
referenced memory at "0x%08lx". The memory could not be "%s".

FAULTING_IP:
nt!CmpRemoveFromDelayedClose+4e
80571fff 8902 mov [edx],eax

TRAP_FRAME: a7ee2908 -- (.trap ffffffffa7ee2908)
ErrCode = 00000002
eax=e10297bc ebx=a7ee2b90 ecx=e28f3440 edx=00000000 esi=e102ca44 edi=e28f3440
eip=80571fff esp=a7ee297c ebp=a7ee2980 iopl=0 nv up ei ng nz na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010282
nt!CmpRemoveFromDelayedClose+0x4e:
80571fff 8902 mov [edx],eax ds:0023:00000000=????????
Resetting default scope

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: CODE_CORRUPTION

BUGCHECK_STR: 0x8E

LAST_CONTROL_TRANSFER: from 80571f29 to 80571fff

STACK_TEXT:
a7ee2980 80571f29 e28f3440 00000000 a7ee29cc nt!CmpRemoveFromDelayedClose+0x4e
a7ee2990 80571af1 e28f3440 a7ee2bf4 00000200
nt!CmpReferenceKeyControlBlock+0x15
a7ee29cc 805718c8 a7ee29fc 00000000 a7ee2b7c nt!CmpCacheLookup+0x1f5
a7ee2bb0 80571ef1 00059750 89be7980 890cac08 nt!CmpParseKey+0x10d
a7ee2c28 8056f2a8 00000850 a7ee2c68 00000040 nt!ObpLookupObjectName+0x119
a7ee2c7c 80571dbe 00000000 89be7980 8056e901 nt!ObOpenObjectByName+0xea
a7ee2d50 804dd99f 00c9db34 00000001 00c9da88 nt!NtOpenKey+0x1af
a7ee2d50 7c90eb94 00c9db34 00000001 00c9da88 nt!KiFastCallEntry+0xfc
WARNING: Frame IP not in any known module. Following frames may be wrong.
00c9da64 00000000 00000000 00000000 00000000 0x7c90eb94


CHKIMG_EXTENSION: !chkimg -lo 50 -d !nt
80571ff4 - nt!CmpRemoveFromDelayedClose+43
[ 55:71 ]
1 error : !nt (80571ff4)

MODULE_NAME: memory_corruption

IMAGE_NAME: memory_corruption

FOLLOWUP_NAME: memory_corruption

DEBUG_FLR_IMAGE_TIMESTAMP: 0

MEMORY_CORRUPTOR: ONE_BYTE

STACK_COMMAND: .trap ffffffffa7ee2908 ; kb

FAILURE_BUCKET_ID: MEMORY_CORRUPTION_ONE_BYTE

BUCKET_ID: MEMORY_CORRUPTION_ONE_BYTE

Followup: memory_corruption

 

[Guest]

Hi Mark and thank you for your speedy reply.

I'm on the first 1gig stick only right now and it's already blue-screened
again. This time, I have full memory dump on and the stack appears to be
more descriptive. I'm going to power down and switch sticks once more, but
as Memtest86+ got through 20+ passes without a single error, I'm not entirely
confident this is a memory error. It also is directly related to Outlook
since I can use the PC for hours on end with Firefox, Yahoo messenger, even
play some games without a single problem. Fire up Outlook 2003, send/receive
or read/write email- boom; blue-screen.

I did get a full memory dump this time (attached below). It looks to be
coming from comctl32, which after searching appears I may have an older
version something in the installation path has overwritten.

The active/registered comctrl32.dll in Windows\System32 is a version
5.80.xxxxx. Yet, I have some in the Windows\WinSxS and
Windows\Software\Distribution that are 6.0.2900.xxx. I did get IE7.0 but is
it possible something since automatic updates + IE7.0 has caused a version
conflict?

I've been all over MSDN and MS downloads looking for a way to update the
common controls library. I'm going to switch the other stick out and also
hope anyone that knows of an ms hotfix or update that may update this is
available!

Thanks again!


STACK_TEXT:
a86efa4c 805299e2 0000004e 00000099 00071d79 nt!KeBugCheckEx+0x1b
a86efa78 80508ecf beff015c 00000090 beff00d8 nt!MiDecrementShareCount+0x4f
a86efb24 805e7fdc bc577000 00000089 899e2178 nt!MiRemoveMappedPtes+0x226
a86efb4c 805e8047 01ff015c bc570000 a86efb6c nt!MiUnmapViewInSystemSpace+0x9d
a86efb5c bf8bd909 bc570000 e4d10c28 a86efbbc nt!MmUnmapViewInSessionSpace+0x31
a86efb6c bf809c48 bc570008 0185000f e43e4398 win32k!vFreeKernelSection+0x2b
a86efbbc bf809e86 00000000 b5050bab a86efbe0
win32k!SURFACE::bDeleteSurface+0x1a8
a86efbcc bf80fa0c 00000000 b5050bab e4d10c28
win32k!SURFREF::bDeleteSurface+0x12
a86efbe0 bf8063f9 b5050bab e43e4398 a86efc00 win32k!bDeleteSurface+0x20
a86efbf0 bf85d900 b5050bab 03010036 a86efc30 win32k!GreDeleteObject+0x91
a86efc00 bf85dae9 e43e4398 bbe5d8d8 e4d91d40 win32k!FreeSpb+0x39
a86efc30 bf8293cc bbe5d8d8 0104004e a86efc70 win32k!RestoreSpb+0x155
a86efc7c bf8276bf bf9aaf60 00000000 bbe5d8d8 win32k!zzzBltValidBits+0x399
a86efcd4 bf82a3da 00000001 00000000 a86efd24
win32k!xxxEndDeferWindowPosEx+0x121
a86efcf4 bf82b646 bbe5d8d8 00000000 00000000 win32k!xxxSetWindowPos+0x101
a86efd40 804dd99f bbe5d8d8 00000000 00000000 win32k!NtUserSetWindowPos+0x163
a86efd40 7c90eb94 bbe5d8d8 00000000 00000000 nt!KiFastCallEntry+0xfc
00fcf4a8 7e41c027 7ca1ec6b 000201a2 00000000 ntdll!KiFastSystemCallRet
00fcf4e4 7ca190d6 000fca48 00000000 01948a78 USER32!NtUserSetWindowPos+0xc
00fcf4f8 7ca190a0 000bf084 00000000 000fca48 SHELL32!IUnknown_OnSelect+0x2d
00fcf50c 7ca5b156 00000000 00000000 00fcf534
SHELL32!CMenuBand::_SiteOnSelect+0x15
00fcf51c 7ca1ec1e 0013c660 00000000 00000000 SHELL32!CMenuBand::OnSelect+0xd9
00fcf534 7ca190d6 01948a78 00000000 019566d8
SHELL32!CMenuDeskBar::OnSelect+0x69
00fcf548 7ca190a0 01949f9c 00000000 01948a78 SHELL32!IUnknown_OnSelect+0x2d
00fcf55c 7ca5b156 00000000 00000000 00fcf584
SHELL32!CMenuBand::_SiteOnSelect+0x15
00fcf56c 7ca1ec1e 01973160 00000000 00000000 SHELL32!CMenuBand::OnSelect+0xd9
00fcf584 7ca190d6 019566d8 00000000 0198a48c
SHELL32!CMenuDeskBar::OnSelect+0x69
00fcf598 7ca190a0 0013c41c 00000000 019566d8 SHELL32!IUnknown_OnSelect+0x2d
00fcf5ac 7cb9418d 00000000 00000000 0198a48c
SHELL32!CMenuBand::_SiteOnSelect+0x15
00fcf5d0 7ca5cde3 00000000 00000000 00fcfaa8
SHELL32!CMenuToolbarBase::_DropDownOrExec+0x9e
00fcf800 7ca14455 00fcfaa8 000f3298 0198a48c
SHELL32!CMenuToolbarBase::_OnNotify+0x2bf
00fcf818 7ca143e9 00fcfaa8 000f3298 0198a3a8
SHELL32!CMenuSFToolbar::_OnNotify+0x109
00fcf830 7ca14398 0198a48c 00060300 0000004e
SHELL32!CMenuToolbarBase::OnWinEvent+0x60
00fcf854 7ca1431a 0198a3a8 00060300 0000004e
SHELL32!CMenuSFToolbar::OnWinEvent+0x6b
00fcf8a4 7ca141cc 000f3298 00060300 0000004e
SHELL32!CMenuBand::OnWinEvent+0x1f8
00fcf8e8 7ca20e84 000802ce 0000004e 00000000 SHELL32!CMenuSite::v_WndProc+0xd9
00fcf90c 7e418734 000802ce 0000004e 00000000
SHELL32!CImpWndProc::s_WndProc+0x65
00fcf938 7e418816 7ca20e45 000802ce 0000004e USER32!InternalCallWinProc+0x28
00fcf9a0 7e41b89b 00095500 7ca20e45 000802ce
USER32!UserCallWinProcCheckWow+0x150
00fcf9dc 7e41b903 005a1b50 0058d9a0 00000000 USER32!SendMessageWorker+0x4a5
00fcf9fc 773eaff1 000802ce 0000004e 00000000 USER32!SendMessageW+0x7f
00fcfa94 7743f890 01a0daf8 fffffffe 00fcfaa8 comctl32!CCSendNotify+0xc20
00fcfac8 774448b3 01a0daf8 00000000 000f0040 comctl32!TBSendUpClick+0x5f
00fcfaec 7744570b 01a0daf8 00060300 00000202 comctl32!TBOnLButtonUp+0x13b
00fcfb9c 7e418734 00060300 00000202 00000000 comctl32!ToolbarWndProc+0xb30
00fcfbc8 7e418816 77444bdb 00060300 00000202 USER32!InternalCallWinProc+0x28
00fcfc30 7e41c63f 00095500 77444bdb 00060300
USER32!UserCallWinProcCheckWow+0x150
00fcfc60 7e41c665 77444bdb 00060300 00000202 USER32!CallWindowProcAorW+0x98
00fcfc80 773e1b57 77444bdb 00060300 00000202 USER32!CallWindowProcW+0x1b
00fcfc9c 773e1eaa 00060300 00000202 00000000 comctl32!CallOriginalWndProc+0x1a

Boot with half your ram, and test, then the other half.
--
Was this post helpful to you? Then click the "Yes" button, below.
Voting helps others who use the web interface.
Mark L. Ferguson

Greetings, I have a new system that has a blue-screen issue that has me
totally stumped.

System information: P4-3.0ghz, Asus P5L VM1394, 2x1gig Corsair DDR 533,
using integrated audio, NIC and video. 1 SATA 160gig Seagate drive, Antec
Smart Power 450W.
Temps are good: 35C CPU, 38C peak. Sys temp: 33C-35C (has two 120mm fans
and stock. Voltages all look good. 12v hovers around 12.56v though but
seems okay.

System occasionally will blue-screen w/ minidump randomly. Maybe once/twice
a day. Programs open when this occurs: Outlook 2003 + AVG Free, systray
RealTek HD Manager, Intel Graphics Media Accelerator. Can come from a fresh
boot, fire up Outlook... send/receive new messages.. and periodically this
will spawn a blue screen/reboot.

I ran Memtest86+ overnight, 27 passes. No memory errors detected. I did
try upgrading to the latest BIOS (930) for the mainboard, no change. I also
ran Microsoft Update and it fetched numerous Outlook/Office updates. No
change.

The minidump isn't very helpful for trying to isolate what component/driver
may be having the issue. I've switched this to full memory dump and awaiting
my next bluescreen in hopes this might yield further insight. I'll
copy/paste the windgb from the minidumps in hopes someone can help further!

I'm at witts end and really unsure what to look at next. Any tips/insights
greatly appreciated!

===================================
BugCheck 1000008E, {c0000005, 80571fff, a7ee2908, 0}

Probably caused by : memory_corruption

Followup: memory_corruption
---------

0: kd> !analyze -v!
*******************************************************************************
*
*
* Bugcheck Analysis
*
*
*
*******************************************************************************

KERNEL_MODE_EXCEPTION_NOT_HANDLED_M (1000008e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003. This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG. This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG. This will let us see why this breakpoint is
happening.
Arguments:
Arg1: c0000005, The exception code that was not handled
Arg2: 80571fff, The address that the exception occurred at
Arg3: a7ee2908, Trap Frame
Arg4: 00000000

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx"
referenced memory at "0x%08lx". The memory could not be "%s".

FAULTING_IP:
nt!CmpRemoveFromDelayedClose+4e
80571fff 8902 mov [edx],eax

TRAP_FRAME: a7ee2908 -- (.trap ffffffffa7ee2908)
ErrCode = 00000002
eax=e10297bc ebx=a7ee2b90 ecx=e28f3440 edx=00000000 esi=e102ca44 edi=e28f3440
eip=80571fff esp=a7ee297c ebp=a7ee2980 iopl=0 nv up ei ng nz na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010282
nt!CmpRemoveFromDelayedClose+0x4e:
80571fff 8902 mov [edx],eax ds:0023:00000000=????????
Resetting default scope

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: CODE_CORRUPTION

BUGCHECK_STR: 0x8E

LAST_CONTROL_TRANSFER: from 80571f29 to 80571fff

STACK_TEXT:
a7ee2980 80571f29 e28f3440 00000000 a7ee29cc nt!CmpRemoveFromDelayedClose+0x4e
a7ee2990 80571af1 e28f3440 a7ee2bf4 00000200
nt!CmpReferenceKeyControlBlock+0x15
a7ee29cc 805718c8 a7ee29fc 00000000 a7ee2b7c nt!CmpCacheLookup+0x1f5
a7ee2bb0 80571ef1 00059750 89be7980 890cac08 nt!CmpParseKey+0x10d
a7ee2c28 8056f2a8 00000850 a7ee2c68 00000040 nt!ObpLookupObjectName+0x119
a7ee2c7c 80571dbe 00000000 89be7980 8056e901 nt!ObOpenObjectByName+0xea
a7ee2d50 804dd99f 00c9db34 00000001 00c9da88 nt!NtOpenKey+0x1af
a7ee2d50 7c90eb94 00c9db34 00000001 00c9da88 nt!KiFastCallEntry+0xfc
WARNING: Frame IP not in any known module. Following frames may be wrong.
00c9da64 00000000 00000000 00000000 00000000 0x7c90eb94


CHKIMG_EXTENSION: !chkimg -lo 50 -d !nt
80571ff4 - nt!CmpRemoveFromDelayedClose+43
[ 55:71 ]
1 error : !nt (80571ff4)

MODULE_NAME: memory_corruption

IMAGE_NAME: memory_corruption

FOLLOWUP_NAME: memory_corruption

DEBUG_FLR_IMAGE_TIMESTAMP: 0

MEMORY_CORRUPTOR: ONE_BYTE

STACK_COMMAND: .trap ffffffffa7ee2908 ; kb

FAILURE_BUCKET_ID: MEMORY_CORRUPTION_ONE_BYTE

BUCKET_ID: MEMORY_CORRUPTION_ONE_BYTE

Followup: memory_corruption

 

[Guest]

I have all those same versions. It would surprize me greatlly to see any file
cause a blue screen that was not a hardware driver of some kind.
The common controls access the hard drive, so I would look to a drive error
of some kind.
--
Was this post helpful to you? Then click the "Yes" button, below.
Voting helps others who use the web interface.
Mark L. Ferguson

Hi Mark and thank you for your speedy reply.

I'm on the first 1gig stick only right now and it's already blue-screened
again. This time, I have full memory dump on and the stack appears to be
more descriptive. I'm going to power down and switch sticks once more, but
as Memtest86+ got through 20+ passes without a single error, I'm not entirely
confident this is a memory error. It also is directly related to Outlook
since I can use the PC for hours on end with Firefox, Yahoo messenger, even
play some games without a single problem. Fire up Outlook 2003, send/receive
or read/write email- boom; blue-screen.

I did get a full memory dump this time (attached below). It looks to be
coming from comctl32, which after searching appears I may have an older
version something in the installation path has overwritten.

The active/registered comctrl32.dll in Windows\System32 is a version
5.80.xxxxx. Yet, I have some in the Windows\WinSxS and
Windows\Software\Distribution that are 6.0.2900.xxx. I did get IE7.0 but is
it possible something since automatic updates + IE7.0 has caused a version
conflict?

I've been all over MSDN and MS downloads looking for a way to update the
common controls library. I'm going to switch the other stick out and also
hope anyone that knows of an ms hotfix or update that may update this is
available!

Thanks again!


STACK_TEXT:
a86efa4c 805299e2 0000004e 00000099 00071d79 nt!KeBugCheckEx+0x1b
a86efa78 80508ecf beff015c 00000090 beff00d8 nt!MiDecrementShareCount+0x4f
a86efb24 805e7fdc bc577000 00000089 899e2178 nt!MiRemoveMappedPtes+0x226
a86efb4c 805e8047 01ff015c bc570000 a86efb6c nt!MiUnmapViewInSystemSpace+0x9d
a86efb5c bf8bd909 bc570000 e4d10c28 a86efbbc nt!MmUnmapViewInSessionSpace+0x31
a86efb6c bf809c48 bc570008 0185000f e43e4398 win32k!vFreeKernelSection+0x2b
a86efbbc bf809e86 00000000 b5050bab a86efbe0
win32k!SURFACE::bDeleteSurface+0x1a8
a86efbcc bf80fa0c 00000000 b5050bab e4d10c28
win32k!SURFREF::bDeleteSurface+0x12
a86efbe0 bf8063f9 b5050bab e43e4398 a86efc00 win32k!bDeleteSurface+0x20
a86efbf0 bf85d900 b5050bab 03010036 a86efc30 win32k!GreDeleteObject+0x91
a86efc00 bf85dae9 e43e4398 bbe5d8d8 e4d91d40 win32k!FreeSpb+0x39
a86efc30 bf8293cc bbe5d8d8 0104004e a86efc70 win32k!RestoreSpb+0x155
a86efc7c bf8276bf bf9aaf60 00000000 bbe5d8d8 win32k!zzzBltValidBits+0x399
a86efcd4 bf82a3da 00000001 00000000 a86efd24
win32k!xxxEndDeferWindowPosEx+0x121
a86efcf4 bf82b646 bbe5d8d8 00000000 00000000 win32k!xxxSetWindowPos+0x101
a86efd40 804dd99f bbe5d8d8 00000000 00000000 win32k!NtUserSetWindowPos+0x163
a86efd40 7c90eb94 bbe5d8d8 00000000 00000000 nt!KiFastCallEntry+0xfc
00fcf4a8 7e41c027 7ca1ec6b 000201a2 00000000 ntdll!KiFastSystemCallRet
00fcf4e4 7ca190d6 000fca48 00000000 01948a78 USER32!NtUserSetWindowPos+0xc
00fcf4f8 7ca190a0 000bf084 00000000 000fca48 SHELL32!IUnknown_OnSelect+0x2d
00fcf50c 7ca5b156 00000000 00000000 00fcf534
SHELL32!CMenuBand::_SiteOnSelect+0x15
00fcf51c 7ca1ec1e 0013c660 00000000 00000000 SHELL32!CMenuBand::OnSelect+0xd9
00fcf534 7ca190d6 01948a78 00000000 019566d8
SHELL32!CMenuDeskBar::OnSelect+0x69
00fcf548 7ca190a0 01949f9c 00000000 01948a78 SHELL32!IUnknown_OnSelect+0x2d
00fcf55c 7ca5b156 00000000 00000000 00fcf584
SHELL32!CMenuBand::_SiteOnSelect+0x15
00fcf56c 7ca1ec1e 01973160 00000000 00000000 SHELL32!CMenuBand::OnSelect+0xd9
00fcf584 7ca190d6 019566d8 00000000 0198a48c
SHELL32!CMenuDeskBar::OnSelect+0x69
00fcf598 7ca190a0 0013c41c 00000000 019566d8 SHELL32!IUnknown_OnSelect+0x2d
00fcf5ac 7cb9418d 00000000 00000000 0198a48c
SHELL32!CMenuBand::_SiteOnSelect+0x15
00fcf5d0 7ca5cde3 00000000 00000000 00fcfaa8
SHELL32!CMenuToolbarBase::_DropDownOrExec+0x9e
00fcf800 7ca14455 00fcfaa8 000f3298 0198a48c
SHELL32!CMenuToolbarBase::_OnNotify+0x2bf
00fcf818 7ca143e9 00fcfaa8 000f3298 0198a3a8
SHELL32!CMenuSFToolbar::_OnNotify+0x109
00fcf830 7ca14398 0198a48c 00060300 0000004e
SHELL32!CMenuToolbarBase::OnWinEvent+0x60
00fcf854 7ca1431a 0198a3a8 00060300 0000004e
SHELL32!CMenuSFToolbar::OnWinEvent+0x6b
00fcf8a4 7ca141cc 000f3298 00060300 0000004e
SHELL32!CMenuBand::OnWinEvent+0x1f8
00fcf8e8 7ca20e84 000802ce 0000004e 00000000 SHELL32!CMenuSite::v_WndProc+0xd9
00fcf90c 7e418734 000802ce 0000004e 00000000
SHELL32!CImpWndProc::s_WndProc+0x65
00fcf938 7e418816 7ca20e45 000802ce 0000004e USER32!InternalCallWinProc+0x28
00fcf9a0 7e41b89b 00095500 7ca20e45 000802ce
USER32!UserCallWinProcCheckWow+0x150
00fcf9dc 7e41b903 005a1b50 0058d9a0 00000000 USER32!SendMessageWorker+0x4a5
00fcf9fc 773eaff1 000802ce 0000004e 00000000 USER32!SendMessageW+0x7f
00fcfa94 7743f890 01a0daf8 fffffffe 00fcfaa8 comctl32!CCSendNotify+0xc20
00fcfac8 774448b3 01a0daf8 00000000 000f0040 comctl32!TBSendUpClick+0x5f
00fcfaec 7744570b 01a0daf8 00060300 00000202 comctl32!TBOnLButtonUp+0x13b
00fcfb9c 7e418734 00060300 00000202 00000000 comctl32!ToolbarWndProc+0xb30
00fcfbc8 7e418816 77444bdb 00060300 00000202 USER32!InternalCallWinProc+0x28
00fcfc30 7e41c63f 00095500 77444bdb 00060300
USER32!UserCallWinProcCheckWow+0x150
00fcfc60 7e41c665 77444bdb 00060300 00000202 USER32!CallWindowProcAorW+0x98
00fcfc80 773e1b57 77444bdb 00060300 00000202 USER32!CallWindowProcW+0x1b
00fcfc9c 773e1eaa 00060300 00000202 00000000 comctl32!CallOriginalWndProc+0x1a

Boot with half your ram, and test, then the other half.
--
Was this post helpful to you? Then click the "Yes" button, below.
Voting helps others who use the web interface.
Mark L. Ferguson

Greetings, I have a new system that has a blue-screen issue that has me
totally stumped.

System information: P4-3.0ghz, Asus P5L VM1394, 2x1gig Corsair DDR 533,
using integrated audio, NIC and video. 1 SATA 160gig Seagate drive, Antec
Smart Power 450W.
Temps are good: 35C CPU, 38C peak. Sys temp: 33C-35C (has two 120mm fans
and stock. Voltages all look good. 12v hovers around 12.56v though but
seems okay.

System occasionally will blue-screen w/ minidump randomly. Maybe once/twice
a day. Programs open when this occurs: Outlook 2003 + AVG Free, systray
RealTek HD Manager, Intel Graphics Media Accelerator. Can come from a fresh
boot, fire up Outlook... send/receive new messages.. and periodically this
will spawn a blue screen/reboot.

I ran Memtest86+ overnight, 27 passes. No memory errors detected. I did
try upgrading to the latest BIOS (930) for the mainboard, no change. I also
ran Microsoft Update and it fetched numerous Outlook/Office updates. No
change.

The minidump isn't very helpful for trying to isolate what component/driver
may be having the issue. I've switched this to full memory dump and awaiting
my next bluescreen in hopes this might yield further insight. I'll
copy/paste the windgb from the minidumps in hopes someone can help further!

I'm at witts end and really unsure what to look at next. Any tips/insights
greatly appreciated!

===================================
BugCheck 1000008E, {c0000005, 80571fff, a7ee2908, 0}

Probably caused by : memory_corruption

Followup: memory_corruption
---------

0: kd> !analyze -v!
*******************************************************************************
*
*
* Bugcheck Analysis
*
*
*
*******************************************************************************

KERNEL_MODE_EXCEPTION_NOT_HANDLED_M (1000008e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003. This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG. This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG. This will let us see why this breakpoint is
happening.
Arguments:
Arg1: c0000005, The exception code that was not handled
Arg2: 80571fff, The address that the exception occurred at
Arg3: a7ee2908, Trap Frame
Arg4: 00000000

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx"
referenced memory at "0x%08lx". The memory could not be "%s".

FAULTING_IP:
nt!CmpRemoveFromDelayedClose+4e
80571fff 8902 mov [edx],eax

TRAP_FRAME: a7ee2908 -- (.trap ffffffffa7ee2908)
ErrCode = 00000002
eax=e10297bc ebx=a7ee2b90 ecx=e28f3440 edx=00000000 esi=e102ca44 edi=e28f3440
eip=80571fff esp=a7ee297c ebp=a7ee2980 iopl=0 nv up ei ng nz na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010282
nt!CmpRemoveFromDelayedClose+0x4e:
80571fff 8902 mov [edx],eax ds:0023:00000000=????????
Resetting default scope

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: CODE_CORRUPTION

BUGCHECK_STR: 0x8E

LAST_CONTROL_TRANSFER: from 80571f29 to 80571fff

STACK_TEXT:
a7ee2980 80571f29 e28f3440 00000000 a7ee29cc nt!CmpRemoveFromDelayedClose+0x4e
a7ee2990 80571af1 e28f3440 a7ee2bf4 00000200
nt!CmpReferenceKeyControlBlock+0x15
a7ee29cc 805718c8 a7ee29fc 00000000 a7ee2b7c nt!CmpCacheLookup+0x1f5
a7ee2bb0 80571ef1 00059750 89be7980 890cac08 nt!CmpParseKey+0x10d
a7ee2c28 8056f2a8 00000850 a7ee2c68 00000040 nt!ObpLookupObjectName+0x119
a7ee2c7c 80571dbe 00000000 89be7980 8056e901 nt!ObOpenObjectByName+0xea
a7ee2d50 804dd99f 00c9db34 00000001 00c9da88 nt!NtOpenKey+0x1af
a7ee2d50 7c90eb94 00c9db34 00000001 00c9da88 nt!KiFastCallEntry+0xfc
WARNING: Frame IP not in any known module. Following frames may be wrong.
00c9da64 00000000 00000000 00000000 00000000 0x7c90eb94


CHKIMG_EXTENSION: !chkimg -lo 50 -d !nt
80571ff4 - nt!CmpRemoveFromDelayedClose+43
[ 55:71 ]
1 error : !nt (80571ff4)

MODULE_NAME: memory_corruption

IMAGE_NAME: memory_corruption

FOLLOWUP_NAME: memory_corruption

DEBUG_FLR_IMAGE_TIMESTAMP: 0

MEMORY_CORRUPTOR: ONE_BYTE

STACK_COMMAND: .trap ffffffffa7ee2908 ; kb

FAILURE_BUCKET_ID: MEMORY_CORRUPTION_ONE_BYTE

BUCKET_ID: MEMORY_CORRUPTION_ONE_BYTE

Followup: memory_corruption

 

[Ron Martell]

===================================
BugCheck 1000008E, {c0000005, 80571fff, a7ee2908, 0}

With this error code, paramter 2 gives the address where the exception
occurred, in your case 80571fff.

You can see if this was caused by a device driver, and identify that
driver, with the following procedure:

******
Identifying the cause of STOP errors using PSTAT & Excel

Many times when a STOP error occurs the information provided does not
specifically identify the application, device driver, or other
component file where the error occurred. However the 4 parameters
associated with the STOP (bugcheck) code will very often include one
that is the address where the error occurred. You first need to look
up the detailed information about the specific STOP code in order to
determine if the address is included and if so which of the 4
parameters has the address.

You can identify the meaning of each of the parameters for your
specific STOP code at:
http://msdn2.microsoft.com/en-us/library/ms789516.aspx

The second step in the procedure is to identify the addresses that
each active process is being loaded at. The PSTAT utility will
provide this information. On some systems the PSTAT utility may
already be present. Check this by opening a Command Prompt window
(Start - Run - CMD) and entering the following command:

PSTAT /?

If PSTAT is not on your computer you can download it free from
Microsoft. The download is called "Windows XP Service Pack 2 Support
Tools" and it is available from
http://www.microsoft.com/downloads/...76-9BB9-4126-9761-BA8011FABF38&displaylang=en
With PSTAT installed on your computer the next step is to open a
Command Prompt window again (Start - Run - CMD) and generate a report
with PSTAT. Because you need to copy part of the information from
this report (and only part) it is best to create the report as a text
file. In the Command Prompt window enter the following command:

PSTAT > C:\JUNK\PSTAT.TXT

You may change C:\JUNK\ to whatever drive and folder that you want to
save the report into.

Now open the saved file in Notepad. Start - Run - NOTEPAD
C:\JUNK\PSTAT.TXT

Scroll down the file, about 80% of the way to the end of the file and
you will find a head line:

ModuleName Load Addr Code Data Paged LinkDate

It is the information from this line to the end of the file that we
want to copy from this file and save as a separate file. Select the
block of text and copy it to the clipboard. Open a new notepad window
and paste the clipboard contents into it. Save this file under a
different name. I use PSTAT2.TXT and put it into the same C:\JUNK
folder.

Now launch Microsoft Excel and use File - Open to bring the PSTAT2.TXT
file into Excel. Excel will automatically parse the file into
columns. Once this is done use DATA - SORT to sort the entire
spreadsheet based on the value in Column B (Load Addr).

It is now a simple task to read down the addresses until you find the
highest value that is less than the address where the error occurred.
That module (name in column A) is the prime suspect for the cause of
your error.


Good luck

Ron Martell Duncan B.C. Canada
--
Microsoft MVP (1997 - 2008)
On-Line Help Computer Service
http://onlinehelp.bc.ca
Syberfix Remote Computer Repair

"Anyone who thinks that they are too small to make a difference
has never been in bed with a mosquito."

 

[Guest]

Many thanks to both of you, Ron and Mark!

I was still obtaining blue-screens with the 2nd stick of memory, so I've
returned both (needed for proper dual-channel operation).

Many thanks for the tips on pstat, which I've ran before/after a few
blue-screens today. I've achieved a pretty reliable way to force them to
happen and did so five times with PSTAT's prior to the exercise (basically
sending/receiving a slew of emails to myself and opening/closing the New
email windows and clicking to open existing emails, etc.etc.).

Of the five PSTAT's, the address was found to be pretty consistently in an
avg dll (AVG anti-virus), which I've now removed and so far (knock on wood),
so good. Too early to tell but this series pretty reliably reproduced the
blue-screen all day.

Thanks again for your wonderful, timely support guys.