How to diagnose a STOP: 0x0000008E?

[Bruce.]

XP SP3 and all current patches.

I rarely reboot my system and did so last night for the first time in quite
a while. During that time I've installed several software packages so I
can't easily tell if one of those might be responsible for the BSOD I am now
getting, assuming one is, which I'm not sure of.

Just as the reboot nears completion and the initial blank blue screen
appears (prior to the loading of the desktop background), it intermittently
crashes to a BSOD with a

STOP: 0x0000008E

It is very intermittent and doesn't crash every reboot. I can't predict if
or when it will do it. Sometimes a few times in a row, sometimes not for
several reboots.

I have the latest ASUS P5E BIOS.

I believe it is a faulty device driver (I've read 8E's are generally
drivers) but the screen makes no mention of WHICH device driver it was in
when the fault happened.


The entire BSOD screen is here:

http://www.bachastain.com/temp/crash.jpg

If it boots, then it will run error free forever, until the next reboot.

I have run the MS RAM diagnostic overnight with no errors, and I run ECC
RAM.

Considering it isn't predictable, iIs there any way to diagnose which device
driver is causing the STOP: 0x0000008E error?

Bruce.

 

[Andrew E.]

Try looking into event viewer for OS details,also,usually a driver issue
gets you RIVER_IRQL_NOT_LESS_OR_EQUAL
Also,the XP support tools have some utilities for diagnosing that issue.

 

[PA Bear [MS MVP]]

<QP>
0x0000008E: KERNEL_MODE_EXCEPTION_NOT_HANDLED
A kernel mode program generated an exception which the error handler didn’t
catch. These are nearly always hardware compatibility issues (which
sometimes means a driver issue or a need for a BIOS upgrade).
</QP>
Source & more: http://aumha.org/a/stop.htm

Also see http://msdn.microsoft.com/en-gb/library/ms794023.aspx

Related: http://support.microsoft.com/?kbid=315335

 

[Gerry]

Bruce

The link to the Stop Error Report does not display so I cannot see what
your report says.

Background information on Stop Error message 0x8E
http://msdn2.microsoft.com/en-us/library/ms794023.aspx

0x0000008E: KERNEL_MODE_EXCEPTION_NOT_HANDLED
A kernel mode program generated an exception which the error handler
didn't catch. These are nearly always hardware compatibility issues
(which sometimes means a driver issue or a need for a BIOS upgrade).
Source: http://aumha.org/a/stop.htm

Are there any yellow question marks in Device Manager? Right click on
the My Computer icon on your Desktop and select Properties,
Hardware,Device Manager. If yes what is the Device Error code?

Try Start, Run, type "sigverif.exe" without quotes and hit OK. What
drivers are listed as unsigned? Disregard those which are not checked.

Remove any dust bunnies from inside the computer casing using an Air
Duster and check all fans are running.

Check the hard drive for bad sectors by running chkdsk /f /r

You need to be aware that running chkdsk can take hours

Faulty RAM. You might test your RAM memory
http://www.memtest.org/

http://www.elephantboycomputers.com/page2.html#Hardware_Tshoot

--



Hope this helps.

Gerry
~~~~
FCA
Stourport, England
Enquire, plan and execute
~~~~~~~~~~~~~~~~~~~

 

[Bruce.]

Try looking into event viewer for OS details,also,usually a driver issue
gets you RIVER_IRQL_NOT_LESS_OR_EQUAL
Also,the XP support tools have some utilities for diagnosing that issue.

The only interesting one is:

"The computer has rebooted from a bugcheck. The bugcheck was: 0x0000008e
(0xc0000005, 0x804ef186, 0xbad0774c, 0x00000000). A full dump was not
saved."

All the events show the computer being rebooted at crash time, but not the
reason for the crash.

Thanks for the pointer though.

Bruce.

 

[Bruce.]

<QP>
0x0000008E: KERNEL_MODE_EXCEPTION_NOT_HANDLED
A kernel mode program generated an exception which the error handler didn’t
catch. These are nearly always hardware compatibility issues (which
sometimes means a driver issue or a need for a BIOS upgrade).
</QP>
Source & more: http://aumha.org/a/stop.htm

Also see http://msdn.microsoft.com/en-gb/library/ms794023.aspx

Related: http://support.microsoft.com/?kbid=315335

Thanks, I did learn that my crash is a 0xC0000005: STATUS_ACCESS_VIOLATION
indicates that a memory access violation occurred.

But those links don''t offer any tips on identifying which driver caused the
crash.

Bruce.

 

[Bruce.]

Background information on Stop Error message 0x8E
http://msdn2.microsoft.com/en-us/library/ms794023.aspx
Thanks.

Are there any yellow question marks in Device Manager?

Everything there looks normal. No exclamation or question marks.

Try Start, Run, type "sigverif.exe" without quotes and hit OK. What
drivers are listed as unsigned? Disregard those which are not checked.

It identified 8 files, but I think I've accounted for all of them. 2 are
from Acronis True Image backup software:

tifsfilt.sys 6/12/2008 4.0.0.469 Not Signed
N/A
timntr.sys 6/12/2008 4.0.0.469 Not Signed
N/A

1 from F5 Networks VPN:

urvpndrv.sys 2/22/2007 6010.2007.206.1755 Not Signed
N/A

and 5 were MS files having something to do with the print spooler:

mxdwdrv.dll 3/22/2007 0.3.6000.0 Not Signed
N/A
mxdwdui.dll 3/22/2007 0.3.6000.16438 Not Signed
N/A
mxdwdui.gpd 8/31/2006 None Not Signed
N/A
mxdwdui.ini 4/21/2006 None Not Signed
N/A
unires.dll 3/22/2007 0.3.6000.16438 Not Signed
N/A

That's all of them.

Remove any dust bunnies from inside the computer casing using an Air
Duster and check all fans are running.

Case is clean.

Check the hard drive for bad sectors by running chkdsk /f /r

I'll run that overnight tonight.

You need to be aware that running chkdsk can take hours

Faulty RAM. You might test your RAM memory
http://www.memtest.org/

I did run the MS RAM tester overnight and it passed clean.

http://www.elephantboycomputers.com/page2.html#Hardware_Tshoot

Thanks Gerry.

 

[Bruce.]

Try looking into event viewer for OS details,also,usually a driver issue
gets you RIVER_IRQL_NOT_LESS_OR_EQUAL
Also,the XP support tools have some utilities for diagnosing that issue.

The only one I could find is dumpchk.exe. I ran that on
c:\windows\memory.dmp and got this, which doesn't tell me much of anything:

Loading dump file c:\windows\memory.dmp
----- 32 bit Kernel Full Dump Analysis

DUMP_HEADER32:
MajorVersion 0000000f
MinorVersion 00000a28
DirectoryTableBase 0adc0020
PfnDataBase 81a86000
PsLoadedModuleList 8055d720
PsActiveProcessHead 805638b8
MachineImageType 0000014c
NumberProcessors 00000002
BugCheckCode 0000008e
BugCheckParameter1 c0000005
BugCheckParameter2 804ef186
BugCheckParameter3 bacf374c
BugCheckParameter4 00000000
PaeEnabled 00000001
KdDebuggerDataBlock 8054d2e0

Physical Memory Description:
Number of runs: 3
FileOffset Start Address Length
00001000 00001000 0009e000
0009f000 00100000 00eff000
00f9e000 01000000 7ef80000
Last Page: 7ff1d000 7ff7f000

KiProcessorBlock at 8055c5a0
2 KiProcessorBlock entries:
ffdff120 bab38120

Windows XP Kernel Version 2600 (Service Pack 3) MP (2 procs) Free x86
compatible

Built by: 2600.xpsp.080413-2111
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055d720
Debug session time: Mon Jul 07 18:50:24 2008
System Uptime: 0 days 0:00:28
start end module name
804d7000 806e4000 nt Checksum: 001F442E Timestamp: Sun Apr 13
13:31:06 2008 (4802516A)

Unloaded modules:
baaa8000 baab1000 processr.sys Timestamp: Mon Jul 07 18:50:10 2008
(4872ABB2)
b6fbd000 b6feb000 anvioctl.sys Timestamp: Mon Jul 07 18:50:10 2008
(4872ABB2)
ba46e000 ba472000 kbdhid.sys Timestamp: Mon Jul 07 18:50:10 2008
(4872ABB2)
bab80000 bab85000 Cdaudio.SYS Timestamp: Mon Jul 07 18:50:10 2008
(4872ABB2)
ba47a000 ba47d000 Sfloppy.SYS Timestamp: Mon Jul 07 18:50:10 2008
(4872ABB2)
ba9a8000 ba9b5000 i8042prt.sys Timestamp: Mon Jul 07 18:50:07 2008
(4872ABAF)

Finished dump check

Bruce.

 

[Rey Santos]

How to read the small memory dump files that Windows creates for debugging
http://support.microsoft.com/kb/315263

 

[Bruce.]

How to read the small memory dump files that Windows creates for debugging
http://support.microsoft.com/kb/315263

A new piece of critical information happened last night. One recent change
is I was given the gift of a Flip Video camcorder (a USB flash based
device). After lots of rebooting and experiementing, it seemed that it only
BSOD at boot time when the Flip was connected.

The problem with that theory is the Flip doesn't install any software on
your hard drive. The Flip software is resident on the Flip flash drive and
stays there. Nothing from it runs at boot time.

So it seemed likely that the Flip was somehow causing a Windows USB driver
(Intel I think) to crash and I might be able to find an update if I knew the
driver name.

While I wouldn't recommend the procedure for everyone, I happen to be a
programmer and have used WinDbg a couple of times before, but never to
diagnose kernel or driver crashes. After reading the information you linked
me too and after a couple of hours of downloading tools and symbol files for
XP SP3, the WinDbg call stack pointed me to a driver named PQV2i which I
just happen to know is the PowerQuest V2i Protector, which is part of Norton
Ghost or an old copy of Drive Image 7. I located the driver file:

06/03/2003 03:52 PM 123,957 PQV2i.sys

Of note here is that I can't ever remember installing Norton Ghost and the
file is dated 2003. It can't possibly still be used for anything so there
was no point in loading it at boot time.

While I was there, I found 2 more files, another PowerQuest one, and one
associated with a LinkSys device I no longer have. These were from 2003 as
well.

06/03/2003 03:52 PM 46,900 PQIMount.sys
04/10/2003 06:43 PM 636,416 PRISMUSB.sys

So I renamed all 3 to *.old to prevent them from loading at boot time.
Bingo. I've now rebooted 3 times with the Flip connected and no BSOD. So I
think, I hope, the BSOD of death are fixed and I no longer have to worry
about leaving the Flip connected.

Being able to track down which driver was involved was the key. I sure
which MS could figure out how to better report that on the BSOD screeen.

Thanks very much for the help Rey!

Bruce.

 

[Rey Santos]

You're wlcome. Thanks for getting back to us and letting us know.