Plague of BSOD on older XP box

[Gesture III]

I'm just looking to see if anyone can suggest avenues that I haven't
followed, short of full stack debugging and such. My client has 6 year-old
Dimension towers. When I first approached the problem box, it would blue
screen within minutes of being put under any load, generally with 8E or 50
codes. Ran utilities to clean up reported problems with Redirector Buffer
Manager and misc. registry issues and got a highly suspect Dell graphics
driver out of the mix by replacing the onboard adapter with a PCI model.

The above resulted in a dramatically more stable -- days, now, rather than
fractions of an hour under load -- system, but one still plagued by BSOD.
The codes, however, have changed. The consistent error is now 4E (99, 0, 0,
0), with the kernel apparently implicated.

Not interested in heavy stack debugging here, since my advice to the client
from day one has been to replace the hardware and bypass the problem (pure
economics). Client also runs WinPoint financial software and a hosting-site
web-app that downloads a number of plug-ins that are beyond my control. Note
that client has a number of similar systems, with only this one experiencing
the problems.

Any ideas? I'm about out.

Thanks.

JDEverett

 

[Gurpreet Singh]

Your problems mostly seem to be related with a kernel mode driver.

8E indicates: KERNEL_MODE_EXCEPTION_NOT_HANDLED_M
50 indiactes: _FAULT_IN_NONPAGED_AREA, Rememer Nonpaged and paged pools are
used by drivers
4E indicates: PFN is corrupt, PFN is Page frame entry

There is a driver which is definitely causing all these problems however
since you are not interested in heavy debugging, I would suggest using a
driver verifier to start with if you would be interested to troubleshooting
it yourself. or have the kernel/full memory dump to pin point the driver.
Maybe upgrading the faulty device driver would simply resolve your issue. If
you dont want to go that route, have all the drivers including your
BIOS/Firmware upgraded to the most recent versions along with ensuring that
your system is fully patched.

Hope this helps.

 

[Gesture III]

Thanks. You've basically confirmed what I've been telling the client. The
issue is that of the value of the system involved vs. the cost to the client
of continuing to fight what I think is multiple compatibility issues.
Personally, I think that a clean build on new hardware is the most economical
and productive approach, but I wanted confirmation before presenting the
client with their current options (cost, as you can imagine, is an issue).

Again, thanks.

JDEverett

 

[Gesture III]

I had to dig into the dumps, out of curiousity.

Symantec files NavEng.sys, NavEx15.sys are identified in an 8E. Symtdi.sys,
another Symantec file, is associated with a 4E error; a 4th Symantec file,
Srtsp.sys with a 19 error later the same day as the 8E; two 4E errors merely
identifying Memory_Corruption. Kmixer.sys is listed as an unloaded module in
every case.

Given the level of privilege of an anti-virus, I think that the primary
culprit is identified. Kmixer worries me, however, seeing how many problems
have been associated with it.

 

[Gurpreet Singh]

You are correct buddy. There are some issues I too have observed with these
drivers. In most cases I remove the faulting driver completely by
uninstalling the associated application/service or simply disabling driver
using autoruns. For symantec they are very proactive in coming out with
updates. even if you register an issue with the symantec driver, they will
update that pretty soon. I think disabling a driver is a better option then
to reinstall the OS all over again or going to a new hadware. You may end up
with the same issue again on the new installation since it is not a hardware
issue but a driver issue

 

[Gerry]

Gesture III

Only errors occuring in the last 48 hours are worth investigating, except
where the same error has been occuring for some time. In that situation the
first in the series of errors can remind you of a change made at that time.
Also ignore errors that do not repeat when you restart the computer.

Have a look in the System and Application logs in Event Viewer for
Errors and Warnings and post copies here. Don't post any more than 48
hours ago.

You can access Event Viewer by selecting Start, Control Panel,
Administrative Tools, and Event Viewer. When researching the meaning
of the error, information regarding Event ID, Source and Description
are important.

HOW TO: View and Manage Event Logs in Event Viewer in Windows XP
http://support.microsoft.com/kb/308427/en-us

A tip for posting copies of Error Reports! Run Event Viewer and double
click on the error you want to copy. In the window, which appears is a
button resembling two pages. Click the button and close Event
Viewer.Now start your message (email) and do a paste into the body of
the message. Make sure this is the first paste after exiting from
Event Viewer.


--


Hope this helps.

Gerry
~~~~
FCA
Stourport, England
Enquire, plan and execute
~~~~~~~~~~~~~~~~~~~