Windows XP Help analysing dump data

[theoutlander]

My Windows XP Professional machine has recently started automatically restarting when I try to turn off. I've taken a minidump and run it through the Microsoft debugger but I'm not sure what it's telling me. I hope there is someone out there who can decipher these better than me. The output is:

Microsoft (R) Windows Debugger Version 6.6.0007.5
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [c:\windows\minidump\mini092506-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: srv*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: c:\windows
Windows XP Kernel Version 2600 (Service Pack 2) UP Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 2600.xpsp_sp2_gdr.050301-1519
Kernel base = 0x804d7000 PsLoadedModuleList = 0x805531a0
Debug session time: Mon Sep 25 23:05:15.984 2006 (GMT+1)
System Uptime: 0 days 0:36:18.536
Loading Kernel Symbols
.......................................................................................................................................................
Loading User Symbols
Loading unloaded module list
..............
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 100000D1, {2040002, 2, 8, 2040002}

Probably caused by : ntkrnlpa.exe ( nt!IoCancelIrp+6f )

Followup: MachineOwner
---------

kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: 02040002, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000008, value 0 = read operation, 1 = write operation
Arg4: 02040002, address which referenced memory

Debugging Details:
------------------


WRITE_ADDRESS: 02040002

CURRENT_IRQL: 2

FAULTING_IP:
+2040002
02040002 ?? ???

PROCESS_NAME: CCPROXY.EXE

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: 0xD1

LAST_CONTROL_TRANSFER: from 804f02a7 to 02040002

STACK_TEXT:
WARNING: Frame IP not in any known module. Following frames may be wrong.
b8699c04 804f02a7 00000000 85244588 8519a56c 0x2040002
b8699c20 80571cd0 85244588 00000000 85244588 nt!IoCancelIrp+0x6f
b8699c3c 80573bbb 8519a56c 85244588 85244664 nt!IopCancelAlertedRequest+0x28
b8699c58 805749c9 85f85880 00000103 8519a510 nt!IopSynchronousServiceTail+0xe1
b8699d00 8056d326 00000514 000004e8 00000000 nt!IopXxxControlFile+0x5e7
b8699d34 8053c808 00000514 000004e8 00000000 nt!NtDeviceIoControlFile+0x2a
b8699d34 7c90eb94 00000514 000004e8 00000000 nt!KiFastCallEntry+0xf8
00bcfc34 00000000 00000000 00000000 00000000 0x7c90eb94


STACK_COMMAND: kb

FOLLOWUP_IP:
nt!IoCancelIrp+6f
804f02a7 b001 mov al,1

SYMBOL_STACK_INDEX: 1

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nt

IMAGE_NAME: ntkrnlpa.exe

DEBUG_FLR_IMAGE_TIMESTAMP: 42250a1d

SYMBOL_NAME: nt!IoCancelIrp+6f

FAILURE_BUCKET_ID: 0xD1_W_nt!IoCancelIrp+6f

BUCKET_ID: 0xD1_W_nt!IoCancelIrp+6f

Followup: MachineOwner
-----------------------------

 

[muckshifter]

Turn off "automatic restart" and post exactly and all what the Blue Screen of Death (BSOD) reads.

I can 'read' the BSOD better than those error log files.

This can also be caused by a Worm re-writen some important windows files.

A computer worm is a self-contained program (or set of programs) that can spread functional copies of itself to other computer system and usually takes place via network connections or email attachments. Make sure that your version of ntkrnlpa.exe is not actually a worm.

... but then again, DRIVER_IRQL_NOT_LESS_OR_EQUAL is a catch 22 error ... for anything PC related.

 

[theoutlander]

Thx muckshifter, I'll try that tonight when I'm back home and post the results here.

 

[theoutlander]

The BSOD reads:

IRQL_NOT_LESS_OR_EQUAL

Technical Information:

STOP : 0x0000000A (0x00000014, 0x00000002, 0x00000000, 0x804F02A2)

Just before that I got a popup when I was trying to turn off saying that it was waiting for CCApp to shut down.

 

[muckshifter]

huh oh ...

Just before that I got a popup when I was trying to turn off saying that it was waiting for CCApp to shut down.

Good old Norton/Symantec ... rubbish. Un-install it, you'll have to use it's own clean-up tool ... then go get Anti-Vir, it's free and will do a better job.

Right, that was the easy part ...

Now then, you did not "upgrade" this XP from another OS, did you?

IRQL_NOT_LESS_OR_EQUAL

This is a "catch 22" error message ... Possibly the most annoying Stop error that you will ever see ... essentially is a memory error caused by a driver or piece of software that has caused an error accessing memory. It can also be caused by defective/unsupported hardware, so pretty much anything ... ain't MS just great.

Typically, this error occurs when a driver uses an incorrect memory address. Other possible causes of this error are an incompatible device driver, a general hardware problem, and incompatible software.

Are all your driver up-to-date? Some hardware may be failing?

http://support.microsoft.com/kb/314063/


We now play the 20 questions game ...

 

[theoutlander]

I've uninstalled Norton and installed a trial version of Nod32. So far so good, no more problems shutting down, but I'll keep monitoring and report back if any further probs.

Thanks for your help.