help with bsod... stop: 0x8e

[bemeli]

trying to help out a friend who is getting the following stop error:
stop: 0x0000008e (0xc0000005, 0x806373f1, 0xb395599c, 0x00000000)
that appears after attempting to log on.

any help would be much appreciated

 

[Leonard Grey]

STOP 0x8E: KERNEL_MODE_EXCEPTION_NOT_HANDLED
http://www.aumha.org/a/stop.php#0x8e

 

[Patrick Keenan]

trying to help out a friend who is getting the following stop error:
stop: 0x0000008e (0xc0000005, 0x806373f1, 0xb395599c, 0x00000000)
that appears after attempting to log on.

any help would be much appreciated

This can sometimes be related to hardware accelleration - graphics - so try
rebooting, press F8, and choose VGA mode. If that works, change the video
settings to vanilla, and increase them till it breaks again.

It can also be related to basic memory issues, and that leads to somewhere
you don't really want to go. It can be difficult, which means expensive,
to track these down.

HTH
-pk

 

[bemeli]

This can sometimes be related to hardware accelleration - graphics - so try
rebooting, press F8, and choose VGA mode. If that works, change the video
settings to vanilla, and increase them till it breaks again.

It can also be related to basic memory issues, and that leads to somewhere
you don't really want to go. It can be difficult, which means expensive,
to track these down.

HTH
-pk

thanks to both (leonard and pk), but guess maybe its a memory problem? i
tried starting in vga mode but no good - still bsod. it starts up in safe
mode no problem...
i had already been to the link you posted leonard, and still need to try
removing one of the ram modules to see if thats causing the problem. guess
that'll have to wait for tomorrow, however. i'll post again afterwards.
thanks again for the suggestions!

 

[Patrick Keenan]

thanks to both (leonard and pk), but guess maybe its a memory problem? i
tried starting in vga mode but no good - still bsod. it starts up in safe
mode no problem...

THen restart in Safe MOde, run msconfig and turn everything off. Restart
and see if it boots cleanly to regular mode.

HTH
-pk

 

[Gerry]

bemeli

STOP: 0x0000008E (0xc0000005, 0x806373f1, 0xb395599c, 0x00000000)
What appears on the line below the one above?

If the computer starts in Safe Mode without BSOD that suggests to me
that the problem is not memory related. You are most likely looking for
a driver that does not load in safe mode. When you boot to safe mode you
will find a Report listing drivers that did not load. Please post a copy
of the list.

Have a look in the System and Application logs in Event Viewer for
Errors and Warnings and post copies here. Don't post any more than 48
hours ago.

You can access Event Viewer by selecting Start, Control Panel,
Administrative Tools, and Event Viewer. When researching the meaning
of the error, information regarding Event ID, Source and Description
are important.

HOW TO: View and Manage Event Logs in Event Viewer in Windows XP
http://support.microsoft.com/kb/308427/en-us

A tip for posting copies of Error Reports! Run Event Viewer and double
click on the error you want to copy. In the window, which appears is a
button resembling two pages. Click the button and close Event
Viewer.Now start your message (email) and do a paste into the body of
the message. Make sure this is the first paste after exiting from
Event Viewer.

Background information on Stop Error message 0x8E
http://msdn2.microsoft.com/en-us/library/ms794023.aspx

0x0000008E: KERNEL_MODE_EXCEPTION_NOT_HANDLED
A kernel mode program generated an exception which the error handler
didn't catch. These are nearly always hardware compatibility issues
(which sometimes means a driver issue or a need for a BIOS upgrade).
Source: http://aumha.org/a/stop.htm

Disconnect every hardware peripheral, except keyboard. mouse and
monitor. Try a Safe Mode option.-Last Known Good Configuration?
A description of the Safe Mode Boot options in Windows XP
http://support.microsoft.com/kb/315222/en-us

--



Hope this helps.

Gerry
~~~~
FCA
Stourport, England
Enquire, plan and execute
~~~~~~~~~~~~~~~~~~~

 

[bemeli]

THen restart in Safe MOde, run msconfig and turn everything off. Restart
and see if it boots cleanly to regular mode.

HTH
-pk

pk,
i'm not sure what you meant by "turning everything off", but i restarted in
safe mode, ran msconfig, and did a selective startup leaving all the buttons
unchecked (process system.ini files, process win.ini files, load system
services, and load startup items). restarted and same result (bsod) w/ same
stop error.
remembered reading something about the event viewer that was related to
diagnosing bsods, so i checked that out and found the minidump files and ran
them through windbg. the dump file i used was a newer crash, so the trap
frame? is different... anyway, here's what that produced:

Microsoft (R) Windows Debugger Version 6.11.0001.402 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\Ben\Desktop\Mini021809-08.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is:
SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows XP Kernel Version 2600 (Service Pack 3) MP (2 procs) Free x86
compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 2600.xpsp.080413-2111
Machine Name:
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055d720
Debug session time: Wed Feb 18 17:30:10.453 2009 (GMT-5)
System Uptime: 0 days 0:00:54.156
Loading Kernel Symbols
................................................................
............................................................
Loading User Symbols
Loading unloaded module list
........
*******************************************************************************
*
*
* Bugcheck Analysis
*
*

*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1000008E, {c0000005, 806373f1, f7ad699c, 0}

Probably caused by : ntkrpamp.exe ( nt!HvpGetCellMapped+5f )

Followup: MachineOwner
---------

1: kd> !analyze -
*******************************************************************************
*
*
* Bugcheck Analysis
*
*

*******************************************************************************

KERNEL_MODE_EXCEPTION_NOT_HANDLED_M (1000008e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003. This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG. This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG. This will let us see why this breakpoint is
happening.
Arguments:
Arg1: c0000005, The exception code that was not handled
Arg2: 806373f1, The address that the exception occurred at
Arg3: f7ad699c, Trap Frame
Arg4: 00000000

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx
referenced memory at 0x%08lx. The memory could not be %s.

FAULTING_IP:
nt!HvpGetCellMapped+5f
806373f1 8b4304 mov eax,dword ptr [ebx+4]

TRAP_FRAME: f7ad699c -- (.trap 0xfffffffff7ad699c)
ErrCode = 00000000
eax=00000500 ebx=00000500 ecx=831ba338 edx=00000003 esi=e1037008 edi=00000074
eip=806373f1 esp=f7ad6a10 ebp=f7ad6a58 iopl=0 nv up ei pl zr na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010246
nt!HvpGetCellMapped+0x5f:
806373f1 8b4304 mov eax,dword ptr [ebx+4]
ds:0023:00000504=????????
Resetting default scope

CUSTOMER_CRASH_COUNT: 8

DEFAULT_BUCKET_ID: COMMON_SYSTEM_FAULT

BUGCHECK_STR: 0x8E

PROCESS_NAME: services.exe

LAST_CONTROL_TRANSFER: from 8062faba to 806373f1

STACK_TEXT:
f7ad6a58 8062faba e1037008 00650074 e1037008 nt!HvpGetCellMapped+0x5f
f7ad6a74 80638c4e e1037008 e12feac4 e1037008 nt!CmpMarkValueDataDirty+0x44
f7ad6a90 80638ef3 e1037008 002fd620 e11f1544 nt!CmpMarkKeyValuesDirty+0xcc
f7ad6aac 80638f90 e1037008 002fd620 e133d624 nt!CmpFreeKeyValues+0x17
f7ad6ae8 806397ce e1037008 00160e60 e11a0e64 nt!CmpSyncKeyValues+0x26
f7ad6b2c 80639941 e234c000 00000400 00000001 nt!CmpCopySyncTree2+0x1f4
f7ad6b5c 80626042 e1037008 000001b8 e1037008 nt!CmpCopySyncTree+0x4f
f7ad6ccc 8062193a 00010002 f7ad6d64 f7ad6ce8 nt!CmpSaveBootControlSet+0x2b0
f7ad6cdc 8054161c 00000004 f7ad6d64 8050046d nt!NtInitializeRegistry+0x5e
f7ad6cdc 8050046d 00000004 f7ad6d64 8050046d nt!KiFastCallEntry+0xfc
f7ad6d58 8054161c 00000004 0079f8b0 7c90e4f4 nt!ZwInitializeRegistry+0x11
f7ad6d58 7c90e4f4 00000004 0079f8b0 7c90e4f4 nt!KiFastCallEntry+0xfc
WARNING: Frame IP not in any known module. Following frames may be wrong.
0079f8b0 00000000 00000000 00000000 00000000 0x7c90e4f4


STACK_COMMAND: kb

FOLLOWUP_IP:
nt!HvpGetCellMapped+5f
806373f1 8b4304 mov eax,dword ptr [ebx+4]

SYMBOL_STACK_INDEX: 0

SYMBOL_NAME: nt!HvpGetCellMapped+5f

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nt

IMAGE_NAME: ntkrpamp.exe

DEBUG_FLR_IMAGE_TIMESTAMP: 4802516a

FAILURE_BUCKET_ID: 0x8E_nt!HvpGetCellMapped+5f

BUCKET_ID: 0x8E_nt!HvpGetCellMapped+5f

Followup: MachineOwner
---------

 

[bemeli]

thanks gerry!
i've tried restarting with last known good config, but no good.
my friends computer isn't connected to the internet so i can't easily
copy/paste the event log, but i think i've found the dump file(s) related to
the crash(es) through the event viewer. i ran them through windbg and posted
the results above...
i haven't yet messed with the memory (its pretty crowded in there) and i'm
hoping someone will be able to find something that would make it unnecessary
to do so.
thanks for all your help and suggestions!
-bemeli

 

[Gerry]

bemeli

Have you tried creating another User Profile and logging on using the
new profile?

Create another User Account with Administrators rights,

HOW TO Create and Configure User Accounts in Windows XP
http://support.microsoft.com/?id=279783

How to Copy a User Profile
http://www.kellys-korner-xp.com/win_xp_logon.htm

Corrupt User Profile Especially
How to Copy User Data to a New User Profile
http://support.microsoft.com

What anti-virus and anti-spyware software is installed? Also what
firewall is being used?

I tried researching the dump report but I cannot find any leads to what
might be the cause from searching Google.

--



Hope this helps.

Gerry
~~~~
FCA
Stourport, England
Enquire, plan and execute
~~~~~~~~~~~~~~~~~~~