problems with PC crashing; help/insight requested

Guest · Dec 3, 2006

Hi. I've basically asked this question before, but now I've done a lot of
research, which might lead to someone being able to give useful advice. ( I
have Windows XP service pack 2 Home Edition). I'D VERY MUCH APPRECIATE ANY
ADVICE THAT DOES NOT REQUIRE ME TO PAY FOR A FULL SYSTEMS CHECK BY AN EXPERT,
I'D AS WELL BUY A NEW COMPUTER !

Almost each time after I have turned off the PC for the night and reboot it
in the morning, the PC crashes ! It almost never crashes at other
times/occasions. This morning, I was for a while stuck with the "blue screen
of death", then a very limited version of my normal configuration loaded.

I've done a memory test, memtest86 or something like that. For some reason I
seem not to be able to test the low 100 MB of my RAM. I have 512 MB Ram.
This particular test gives, after many repeated passes, only a few errors,
something like 10 or 23, depending on the tests and the number of passes. I
suppose it's normal that a few bytes of my RAm aren't perfect ? I don't know.
These errors occur at the high end (near 512 MB) of my RAM. Again, I
emphasize that my PC works normal after I have reset my PC to the previous
system restore point.

I've used Microsoft's online crash analysis. They claimed that the cause was
an UNKNOWN software device. That does not help me. I've found that sometimes
installing a newer version of a driver can cause crashes ... And again, it's
"UNKNOWN"

I have wondered that the cooling-down (temperature!) of something in my PC
could be the cause, but that seems weird, especially since the temperature
never goes much below normal room temperature. A defect in the system timer
on the mainboard ?

I have used WinDBG to try to analyze the crash dump file. I've completed
three analyses. There is a reference to "unable to verify timestamp"for ..."
which seems to be consistent with the time-isssue (usually no crashes, only
when I reboot it in the morning, doesn't matter if I shut down computer
before or after midnight, so no date issue, and usually no problems if the
computer has been off for two hours.). There also may be a problem with the
kernel, but honestly, I'm way out of my leage here ! I'm no beginner, but I'm
also not enough of an expert to really know how to handle this. And yes, I'd
rather not pay a lot of money for some "expert" to diagnose the entire
computer, I'd be better off buying a new one !

There may be a problem with naiavf5x.sys, but I don't know what to do about
it. I use internet explorer 7 these days, but crashes were not uncommon with
internet explorer 6.x.

(I've also given a list of HIJACKTHIS with active services/programs and
such, but the manufacturer of my compouter cannot find a fault.)

Ok, this is a bit lengthy, now the three logs of WinDBG (the first log may
be the best):

Microsoft (R) Windows Debugger Version 6.6.0007.5
Copyright (c) Microsoft Corporation. All rights reserved.

Loading Dump File [C:\WINDOWS\Minidump\Mini120306-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: .sympath
Executable search path is:
Unable to load image ntoskrnl.exe, Win32 error 2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
*** ERROR: Module load completed but symbols could not be loaded for
ntoskrnl.exe
Windows XP Kernel Version 2600 (Service Pack 2) UP Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055a420
Debug session time: Sun Dec 3 12:45:16.375 2006 (GMT+1)
System Uptime: 0 days 0:02:09.968
Unable to load image ntoskrnl.exe, Win32 error 2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
*** ERROR: Module load completed but symbols could not be loaded for
ntoskrnl.exe
Loading Kernel Symbols
......................................................................................................................
Loading User Symbols
Loading unloaded module list
..........
Unable to load image naiavf5x.sys, Win32 error 2
*** WARNING: Unable to verify timestamp for naiavf5x.sys
*** ERROR: Module load completed but symbols could not be loaded for
naiavf5x.sys
*******************************************************************************
*
*
* Bugcheck Analysis
*
*
*
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1000008E, {c0000005, ece0b711, ed0ff6d8, 0}

ANALYSIS: Kernel with unknown size. Will force reload symbols with known size.
ANALYSIS: Force reload command: .reload /f
ntoskrnl.exe=FFFFFFFF804D7000,213F80,42250FF9
***** Kernel symbols are WRONG. Please fix symbols to do analysis.

***** Kernel symbols are WRONG. Please fix symbols to do analysis.

Probably caused by : naiavf5x.sys ( naiavf5x+12711 )

Followup: MachineOwner
---------

kd> !analyze -v
*******************************************************************************
*
*
* Bugcheck Analysis
*
*
*
*******************************************************************************

KERNEL_MODE_EXCEPTION_NOT_HANDLED_M (1000008e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003. This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG. This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG. This will let us see why this breakpoint is
happening.
Arguments:
Arg1: c0000005, The exception code that was not handled
Arg2: ece0b711, The address that the exception occurred at
Arg3: ed0ff6d8, Trap Frame
Arg4: 00000000

Debugging Details:
------------------

***** Kernel symbols are WRONG. Please fix symbols to do analysis.

***** Kernel symbols are WRONG. Please fix symbols to do analysis.

FAULTING_MODULE: 804d7000 nt

DEBUG_FLR_IMAGE_TIMESTAMP: 42ae0eb6

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - De instructie op 0x%08lx verwijst
naar geheugen op 0x%08lx. De lees- of schrijfbewerking ("%s") op het geheugen
is mislukt.

FAULTING_IP:
naiavf5x+12711
ece0b711 8b481c mov ecx,dword ptr [eax+1Ch]

TRAP_FRAME: ed0ff6d8 -- (.trap ffffffffed0ff6d8)
ErrCode = 00000000
eax=00ede000 ebx=82312238 ecx=81ddae44 edx=ece12380 esi=81ddae44 edi=81ddae44
eip=ece0b711 esp=ed0ff74c ebp=ed0ff760 iopl=0 nv up ei ng nz ac po nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010292
naiavf5x+0x12711:
ece0b711 8b481c mov ecx,dword ptr [eax+1Ch]
ds:0023:00ede01c=????????
Resetting default scope

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: WRONG_SYMBOLS

BUGCHECK_STR: 0x8E

LAST_CONTROL_TRANSFER: from ece08356 to ece0b711

STACK_TEXT:
WARNING: Stack unwind information not available. Following frames may be
wrong.
ed0ff760 ece08356 e10e3648 42900019 81e358a0 naiavf5x+0x12711
ed0ff7b4 ece00da9 00000000 82312238 00000001 naiavf5x+0xf356
ed0ff840 ece0111d 81ee5e00 ed0ff7e8 82312238 naiavf5x+0x7da9
ed0ff888 ecdfb950 00000000 81ee5e10 821fa1b0 naiavf5x+0x811d
ed0ff89c 804e37f7 821e6408 81ee5e00 81ee5e00 naiavf5x+0x2950
ed0ff98c 8056316c 82394e30 00000000 81ebcf30 nt+0xc7f7
ed0ffa14 8056729a 00000000 ed0ffa54 00000240 nt+0x8c16c
ed0ffa68 80570b73 00000000 00000000 56452f00 nt+0x9029a
ed0ffae4 80570c42 ed0ffc20 00000081 ed0ffb8c nt+0x99b73
ed0ffb40 80594a61 ed0ffc20 00000081 ed0ffb8c nt+0x99c42
ed0ffbb4 80595064 ed0ffbdc 00000081 ed0ffc14 nt+0xbda61
ed0ffc48 80594643 ed0ffc70 00000000 00000000 nt+0xbe064
ed0ffc88 805944bf e28e4000 00080000 81eb6920 nt+0xbd643
ed0ffd04 805811af 81eb6920 e10a40f8 00000000 nt+0xbd4bf
ed0ffd50 804fa4da 00000000 7c810665 00000001 nt+0xaa1af
00000000 00000000 00000000 00000000 00000000 nt+0x234da

STACK_COMMAND: kb

FOLLOWUP_IP:
naiavf5x+12711
ece0b711 8b481c mov ecx,dword ptr [eax+1Ch]

SYMBOL_STACK_INDEX: 0

SYMBOL_NAME: naiavf5x+12711

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: naiavf5x

IMAGE_NAME: naiavf5x.sys

BUCKET_ID: WRONG_SYMBOLS

Followup: MachineOwner
END FIRST LOG " De instructie op 0x%08lx verwijst naar geheugen op 0x%08lx.
De lees- of schrijfbewerking ("%s") op het geheugen is mislukt." MEANS THAT
INSTRUCTION 0x%08lx REFERS TO MEMORY AT 0x%08lx, READ OR WRITE TO MEMORY
("%s") HAS FAILED.

NEXT LOG:

Microsoft (R) Windows Debugger Version 6.6.0007.5
Copyright (c) Microsoft Corporation. All rights reserved.

Loading Dump File [C:\WINDOWS\Minidump\Mini120306-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: .symfix
Executable search path is:
Unable to load image ntoskrnl.exe, Win32 error 2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
*** ERROR: Module load completed but symbols could not be loaded for
ntoskrnl.exe
Windows XP Kernel Version 2600 (Service Pack 2) UP Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055a420
Debug session time: Sun Dec 3 12:45:16.375 2006 (GMT+1)
System Uptime: 0 days 0:02:09.968
Unable to load image ntoskrnl.exe, Win32 error 2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
*** ERROR: Module load completed but symbols could not be loaded for
ntoskrnl.exe
Loading Kernel Symbols
......................................................................................................................
Loading User Symbols
Loading unloaded module list
..........
Unable to load image naiavf5x.sys, Win32 error 2
*** WARNING: Unable to verify timestamp for naiavf5x.sys
*** ERROR: Module load completed but symbols could not be loaded for
naiavf5x.sys
*******************************************************************************
*
*
* Bugcheck Analysis
*
*
*
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1000008E, {c0000005, ece0b711, ed0ff6d8, 0}

ANALYSIS: Kernel with unknown size. Will force reload symbols with known size.
ANALYSIS: Force reload command: .reload /f
ntoskrnl.exe=FFFFFFFF804D7000,213F80,42250FF9
***** Kernel symbols are WRONG. Please fix symbols to do analysis.

***** Kernel symbols are WRONG. Please fix symbols to do analysis.

Probably caused by : naiavf5x.sys ( naiavf5x+12711 )

Followup: MachineOwner
---------
NEXT LOG

Microsoft (R) Windows Debugger Version 6.6.0007.5
Copyright (c) Microsoft Corporation. All rights reserved.

Loading Dump File [C:\WINDOWS\Minidump\Mini120306-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: .sympath+
SRV*c:\tmp*http://msdl.microsoft.com/download/symbols
Executable search path is:
*** ERROR: Symbol file could not be found. Defaulted to export symbols for
ntoskrnl.exe -
Windows XP Kernel Version 2600 (Service Pack 2) UP Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 2600.xpsp_sp2_gdr.050301-1519
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055a420
Debug session time: Sun Dec 3 12:45:16.375 2006 (GMT+1)
System Uptime: 0 days 0:02:09.968
*** ERROR: Symbol file could not be found. Defaulted to export symbols for
ntoskrnl.exe -
Loading Kernel Symbols
......................................................................................................................
Loading User Symbols
Loading unloaded module list
..........
Unable to load image naiavf5x.sys, Win32 error 2
*** WARNING: Unable to verify timestamp for naiavf5x.sys
*** ERROR: Module load completed but symbols could not be loaded for
naiavf5x.sys
*******************************************************************************
*
*
* Bugcheck Analysis
*
*
*
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1000008E, {c0000005, ece0b711, ed0ff6d8, 0}

ANALYSIS: Kernel with unknown size. Will force reload symbols with known size.
ANALYSIS: Force reload command: .reload /f
ntoskrnl.exe=FFFFFFFF804D7000,213F80,42250FF9
***** Kernel symbols are WRONG. Please fix symbols to do analysis.

***** Kernel symbols are WRONG. Please fix symbols to do analysis.

Probably caused by : naiavf5x.sys ( naiavf5x+12711 )

Followup: MachineOwner
---------

kd> !analize -v
No export analize found
kd> analize -v
*** WARNING: Unable to verify timestamp for nv4_disp.dll
*** ERROR: Module load completed but symbols could not be loaded for
nv4_disp.dll
*** WARNING: Unable to verify timestamp for PCANDIS5.SYS
*** ERROR: Module load completed but symbols could not be loaded for
PCANDIS5.SYS
*** WARNING: Unable to verify timestamp for dump_nvidesm.sys
*** ERROR: Module load completed but symbols could not be loaded for
dump_nvidesm.sys
*** WARNING: Unable to verify timestamp for mdc8021x.sys
*** ERROR: Module load completed but symbols could not be loaded for
mdc8021x.sys
*** WARNING: Unable to verify timestamp for WlanUIG.sys
*** ERROR: Module load completed but symbols could not be loaded for
WlanUIG.sys
*** WARNING: Unable to verify timestamp for MpFirewall.sys
*** ERROR: Module load completed but symbols could not be loaded for
MpFirewall.sys
*** WARNING: Unable to verify timestamp for ikhlayer.sys
*** ERROR: Module load completed but symbols could not be loaded for
ikhlayer.sys
*** WARNING: Unable to verify timestamp for ikhfile.sys
*** ERROR: Module load completed but symbols could not be loaded for
ikhfile.sys
*** WARNING: Unable to verify timestamp for nv4_mini.sys
*** ERROR: Module load completed but symbols could not be loaded for
nv4_mini.sys
*** WARNING: Unable to verify timestamp for ALCXSENS.SYS
*** ERROR: Module load completed but symbols could not be loaded for
ALCXSENS.SYS
*** WARNING: Unable to verify timestamp for ALCXWDM.SYS
*** ERROR: Module load completed but symbols could not be loaded for
ALCXWDM.SYS
*** WARNING: Unable to verify timestamp for drmk.sys
*** ERROR: Module load completed but symbols could not be loaded for drmk.sys
*** WARNING: Unable to verify timestamp for SSIDRV.SYS
*** ERROR: Module load completed but symbols could not be loaded for
SSIDRV.SYS
*** WARNING: Unable to verify timestamp for SSHRMD.SYS
*** ERROR: Module load completed but symbols could not be loaded for
SSHRMD.SYS
*** WARNING: Unable to verify timestamp for SSFS0509.SYS
ENDLOGS

NewScience · Dec 3, 2006

I started reading through your post, and you need to update and use WINDBG
correctly.
It took me sometime to figure this out from MS, so don't feel bad about not
understanding.
They don't document well.

First, have you ever downloaded the most up-to-date Windows XP Symbols from
MS, http://www.microsoft.com/whdc/devtools/debugging/debugstart.mspx? If
not, do so (quite large - hope you have fast network downloads) and install
the correct up-to-date symbols package, you'll need them.

Second, create a shortcut for WINDBG and modify the properties to be:

"C:\Program Files\Debugging Tools for Windows\windbg.exe" -v -y
"SRV*C:\Windows\System32\Symbols*http://msdl.microsoft.com/download/symbols"
-i "c:\windows;c:\windows\system32;c:\windows\system32\drivers" -z
"C:\Windows\MEMORY.DMP"

Here's the argument breakout:

-v = verbose
-y
"SRV*C:\windows\System32\Symbols*http://msdl.microsoft.com/download/symbols
= pathname of where Windows XP Symbols are installed and Network Web-site
where to get updated symbols if local symbols out-of-date
-i "c:\windows;c:\windows\system32;c:\windows\system32\drivers" = pathname
where images (DLLS, EXEs) are located
-z "C:\Windows\MEMORY.DMP" = location of dump file (you can leave this off
or keep for this shortcut and create .DMP Registry change)

I have a kernel WINDBG on my Personal QuickLaunch bar (one I created) that
always opens WINDBG to debug the MEMORY.DMP. I created a registry
association for .dmp files so that I can Debug any .dmp file on the system.
I just right click and Click Debug, and the WINDBG program opens with
everything to go.

----------------CUT AND PASTE into dmp.reg
file -----------------------------------
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.dmp]
@="dmpfile"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\dmpfile]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\dmpfile\DefaultIcon]
@="\"C:\\Program Files\\Debugging Tools for Windows\\windbg.exe\",0"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\dmpfile\shell]
@="Debug"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\dmpfile\shell\Debug]
@="&Debug"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\dmpfile\shell\Debug\command]
@="\"C:\\Program Files\\Debugging Tools for Windows\\windbg.exe\" -v -y
\"SRV*C:\\Windows\\System32\\Symbols*http://msdl.microsoft.com/download/symbols\"
-i \"c:\\Windows;c:\\Windows\\system32;c:\\Windows\\system32\\drivers\" -z
\"%L\""

------------------------------------------------------------

Modify pathnames to match your system.

Once you have made any of the above changes, you should have no problem in
getting and exact system dump when the system crashes. Make sure you look
in the correct place when looking for dumps. Sometimes Windows does a
minidump (C:\Windows\Minidump\*.dmp) and other times a complete system dump
(C:\Windows\MEMORY.DMP).

You have to check based on date. And make sure you have the Control Panel |
System | Advanced | Startup and Recovery ... Settings configured correctly
for system dumps (Full Dumps) and to Overwrite set to Yes (Checked).

Remember, you will not get debug information for non-Windows-Microsoft
drivers, Dlls, ... unless you have the debugging symbols from that program
and/or manufacturer.

unstablemicrosoft said:
Hi. I've basically asked this question before, but now I've done a lot of
research, which might lead to someone being able to give useful advice.
( I
have Windows XP service pack 2 Home Edition). I'D VERY MUCH APPRECIATE ANY
ADVICE THAT DOES NOT REQUIRE ME TO PAY FOR A FULL SYSTEMS CHECK BY AN
EXPERT,
I'D AS WELL BUY A NEW COMPUTER !

Almost each time after I have turned off the PC for the night and reboot
it
in the morning, the PC crashes ! It almost never crashes at other
times/occasions. This morning, I was for a while stuck with the "blue
screen
of death", then a very limited version of my normal configuration loaded.

I've done a memory test, memtest86 or something like that. For some reason
I
seem not to be able to test the low 100 MB of my RAM. I have 512 MB Ram.
This particular test gives, after many repeated passes, only a few errors,
something like 10 or 23, depending on the tests and the number of passes.
I
suppose it's normal that a few bytes of my RAm aren't perfect ? I don't
know.
These errors occur at the high end (near 512 MB) of my RAM. Again, I
emphasize that my PC works normal after I have reset my PC to the previous
system restore point.

I've used Microsoft's online crash analysis. They claimed that the cause
was
an UNKNOWN software device. That does not help me. I've found that
sometimes
installing a newer version of a driver can cause crashes ... And again,
it's
"UNKNOWN"

I have wondered that the cooling-down (temperature!) of something in my PC
could be the cause, but that seems weird, especially since the temperature
never goes much below normal room temperature. A defect in the system
timer
on the mainboard ?

I have used WinDBG to try to analyze the crash dump file. I've completed
three analyses. There is a reference to "unable to verify timestamp"for
..."
which seems to be consistent with the time-isssue (usually no crashes,
only
when I reboot it in the morning, doesn't matter if I shut down computer
before or after midnight, so no date issue, and usually no problems if the
computer has been off for two hours.). There also may be a problem with
the
kernel, but honestly, I'm way out of my leage here ! I'm no beginner, but
I'm
also not enough of an expert to really know how to handle this. And yes,
I'd
rather not pay a lot of money for some "expert" to diagnose the entire
computer, I'd be better off buying a new one !

There may be a problem with naiavf5x.sys, but I don't know what to do
about
it. I use internet explorer 7 these days, but crashes were not uncommon
with
internet explorer 6.x.

(I've also given a list of HIJACKTHIS with active services/programs and
such, but the manufacturer of my compouter cannot find a fault.)

Ok, this is a bit lengthy, now the three logs of WinDBG (the first log may
be the best):

Microsoft (R) Windows Debugger Version 6.6.0007.5
Copyright (c) Microsoft Corporation. All rights reserved.

Loading Dump File [C:\WINDOWS\Minidump\Mini120306-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: .sympath
Executable search path is:
Unable to load image ntoskrnl.exe, Win32 error 2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
*** ERROR: Module load completed but symbols could not be loaded for
ntoskrnl.exe
Windows XP Kernel Version 2600 (Service Pack 2) UP Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055a420
Debug session time: Sun Dec 3 12:45:16.375 2006 (GMT+1)
System Uptime: 0 days 0:02:09.968
Unable to load image ntoskrnl.exe, Win32 error 2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
*** ERROR: Module load completed but symbols could not be loaded for
ntoskrnl.exe
Loading Kernel Symbols
....................................................................................................................
Loading User Symbols
Loading unloaded module list
.........
Unable to load image naiavf5x.sys, Win32 error 2
*** WARNING: Unable to verify timestamp for naiavf5x.sys
*** ERROR: Module load completed but symbols could not be loaded for
naiavf5x.sys
*******************************************************************************
*
*
* Bugcheck Analysis
*
*
*
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1000008E, {c0000005, ece0b711, ed0ff6d8, 0}

ANALYSIS: Kernel with unknown size. Will force reload symbols with known
size.
ANALYSIS: Force reload command: .reload /f
ntoskrnl.exe=FFFFFFFF804D7000,213F80,42250FF9
***** Kernel symbols are WRONG. Please fix symbols to do analysis.

***** Kernel symbols are WRONG. Please fix symbols to do analysis.

Probably caused by : naiavf5x.sys ( naiavf5x+12711 )

Followup: MachineOwner
---------

kd> !analyze -v
*******************************************************************************
*
*
* Bugcheck Analysis
*
*
*
*******************************************************************************

KERNEL_MODE_EXCEPTION_NOT_HANDLED_M (1000008e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003. This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG. This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG. This will let us see why this breakpoint is
happening.
Arguments:
Arg1: c0000005, The exception code that was not handled
Arg2: ece0b711, The address that the exception occurred at
Arg3: ed0ff6d8, Trap Frame
Arg4: 00000000

Debugging Details:
------------------

***** Kernel symbols are WRONG. Please fix symbols to do analysis.

***** Kernel symbols are WRONG. Please fix symbols to do analysis.

FAULTING_MODULE: 804d7000 nt

DEBUG_FLR_IMAGE_TIMESTAMP: 42ae0eb6

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - De instructie op 0x%08lx verwijst
naar geheugen op 0x%08lx. De lees- of schrijfbewerking ("%s") op het
geheugen
is mislukt.

FAULTING_IP:
naiavf5x+12711
ece0b711 8b481c mov ecx,dword ptr [eax+1Ch]

TRAP_FRAME: ed0ff6d8 -- (.trap ffffffffed0ff6d8)
ErrCode = 00000000
eax=00ede000 ebx=82312238 ecx=81ddae44 edx=ece12380 esi=81ddae44
edi=81ddae44
eip=ece0b711 esp=ed0ff74c ebp=ed0ff760 iopl=0 nv up ei ng nz ac po
nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000
efl=00010292
naiavf5x+0x12711:
ece0b711 8b481c mov ecx,dword ptr [eax+1Ch]
ds:0023:00ede01c=????????
Resetting default scope

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: WRONG_SYMBOLS

BUGCHECK_STR: 0x8E

LAST_CONTROL_TRANSFER: from ece08356 to ece0b711

STACK_TEXT:
WARNING: Stack unwind information not available. Following frames may be
wrong.
ed0ff760 ece08356 e10e3648 42900019 81e358a0 naiavf5x+0x12711
ed0ff7b4 ece00da9 00000000 82312238 00000001 naiavf5x+0xf356
ed0ff840 ece0111d 81ee5e00 ed0ff7e8 82312238 naiavf5x+0x7da9
ed0ff888 ecdfb950 00000000 81ee5e10 821fa1b0 naiavf5x+0x811d
ed0ff89c 804e37f7 821e6408 81ee5e00 81ee5e00 naiavf5x+0x2950
ed0ff98c 8056316c 82394e30 00000000 81ebcf30 nt+0xc7f7
ed0ffa14 8056729a 00000000 ed0ffa54 00000240 nt+0x8c16c
ed0ffa68 80570b73 00000000 00000000 56452f00 nt+0x9029a
ed0ffae4 80570c42 ed0ffc20 00000081 ed0ffb8c nt+0x99b73
ed0ffb40 80594a61 ed0ffc20 00000081 ed0ffb8c nt+0x99c42
ed0ffbb4 80595064 ed0ffbdc 00000081 ed0ffc14 nt+0xbda61
ed0ffc48 80594643 ed0ffc70 00000000 00000000 nt+0xbe064
ed0ffc88 805944bf e28e4000 00080000 81eb6920 nt+0xbd643
ed0ffd04 805811af 81eb6920 e10a40f8 00000000 nt+0xbd4bf
ed0ffd50 804fa4da 00000000 7c810665 00000001 nt+0xaa1af
00000000 00000000 00000000 00000000 00000000 nt+0x234da

STACK_COMMAND: kb

FOLLOWUP_IP:
naiavf5x+12711
ece0b711 8b481c mov ecx,dword ptr [eax+1Ch]

SYMBOL_STACK_INDEX: 0

SYMBOL_NAME: naiavf5x+12711

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: naiavf5x

IMAGE_NAME: naiavf5x.sys

BUCKET_ID: WRONG_SYMBOLS

Followup: MachineOwner
END FIRST LOG " De instructie op 0x%08lx verwijst naar geheugen op
0x%08lx.
De lees- of schrijfbewerking ("%s") op het geheugen is mislukt." MEANS
THAT
INSTRUCTION 0x%08lx REFERS TO MEMORY AT 0x%08lx, READ OR WRITE TO MEMORY
("%s") HAS FAILED.

NEXT LOG:

Microsoft (R) Windows Debugger Version 6.6.0007.5
Copyright (c) Microsoft Corporation. All rights reserved.

Loading Dump File [C:\WINDOWS\Minidump\Mini120306-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: .symfix
Executable search path is:
Unable to load image ntoskrnl.exe, Win32 error 2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
*** ERROR: Module load completed but symbols could not be loaded for
ntoskrnl.exe
Windows XP Kernel Version 2600 (Service Pack 2) UP Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055a420
Debug session time: Sun Dec 3 12:45:16.375 2006 (GMT+1)
System Uptime: 0 days 0:02:09.968
Unable to load image ntoskrnl.exe, Win32 error 2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
*** ERROR: Module load completed but symbols could not be loaded for
ntoskrnl.exe
Loading Kernel Symbols
....................................................................................................................
Loading User Symbols
Loading unloaded module list
.........
Unable to load image naiavf5x.sys, Win32 error 2
*** WARNING: Unable to verify timestamp for naiavf5x.sys
*** ERROR: Module load completed but symbols could not be loaded for
naiavf5x.sys
*******************************************************************************
*
*
* Bugcheck Analysis
*
*
*
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1000008E, {c0000005, ece0b711, ed0ff6d8, 0}

ANALYSIS: Kernel with unknown size. Will force reload symbols with known
size.
ANALYSIS: Force reload command: .reload /f
ntoskrnl.exe=FFFFFFFF804D7000,213F80,42250FF9
***** Kernel symbols are WRONG. Please fix symbols to do analysis.

***** Kernel symbols are WRONG. Please fix symbols to do analysis.

Probably caused by : naiavf5x.sys ( naiavf5x+12711 )

Followup: MachineOwner
---------
NEXT LOG

Microsoft (R) Windows Debugger Version 6.6.0007.5
Copyright (c) Microsoft Corporation. All rights reserved.

Loading Dump File [C:\WINDOWS\Minidump\Mini120306-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: .sympath+
SRV*c:\tmp*http://msdl.microsoft.com/download/symbols
Executable search path is:
*** ERROR: Symbol file could not be found. Defaulted to export symbols
for
ntoskrnl.exe -
Windows XP Kernel Version 2600 (Service Pack 2) UP Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 2600.xpsp_sp2_gdr.050301-1519
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055a420
Debug session time: Sun Dec 3 12:45:16.375 2006 (GMT+1)
System Uptime: 0 days 0:02:09.968
*** ERROR: Symbol file could not be found. Defaulted to export symbols
for
ntoskrnl.exe -
Loading Kernel Symbols
....................................................................................................................
Loading User Symbols
Loading unloaded module list
.........
Unable to load image naiavf5x.sys, Win32 error 2
*** WARNING: Unable to verify timestamp for naiavf5x.sys
*** ERROR: Module load completed but symbols could not be loaded for
naiavf5x.sys
*******************************************************************************
*
*
* Bugcheck Analysis
*
*
*
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1000008E, {c0000005, ece0b711, ed0ff6d8, 0}

ANALYSIS: Kernel with unknown size. Will force reload symbols with known
size.
ANALYSIS: Force reload command: .reload /f
ntoskrnl.exe=FFFFFFFF804D7000,213F80,42250FF9
***** Kernel symbols are WRONG. Please fix symbols to do analysis.

***** Kernel symbols are WRONG. Please fix symbols to do analysis.

Probably caused by : naiavf5x.sys ( naiavf5x+12711 )

Followup: MachineOwner
---------

kd> !analize -v
No export analize found
kd> analize -v
*** WARNING: Unable to verify timestamp for nv4_disp.dll
*** ERROR: Module load completed but symbols could not be loaded for
nv4_disp.dll
*** WARNING: Unable to verify timestamp for PCANDIS5.SYS
*** ERROR: Module load completed but symbols could not be loaded for
PCANDIS5.SYS
*** WARNING: Unable to verify timestamp for dump_nvidesm.sys
*** ERROR: Module load completed but symbols could not be loaded for
dump_nvidesm.sys
*** WARNING: Unable to verify timestamp for mdc8021x.sys
*** ERROR: Module load completed but symbols could not be loaded for
mdc8021x.sys
*** WARNING: Unable to verify timestamp for WlanUIG.sys
*** ERROR: Module load completed but symbols could not be loaded for
WlanUIG.sys
*** WARNING: Unable to verify timestamp for MpFirewall.sys
*** ERROR: Module load completed but symbols could not be loaded for
MpFirewall.sys
*** WARNING: Unable to verify timestamp for ikhlayer.sys
*** ERROR: Module load completed but symbols could not be loaded for
ikhlayer.sys
*** WARNING: Unable to verify timestamp for ikhfile.sys
*** ERROR: Module load completed but symbols could not be loaded for
ikhfile.sys
*** WARNING: Unable to verify timestamp for nv4_mini.sys
*** ERROR: Module load completed but symbols could not be loaded for
nv4_mini.sys
*** WARNING: Unable to verify timestamp for ALCXSENS.SYS
*** ERROR: Module load completed but symbols could not be loaded for
ALCXSENS.SYS
*** WARNING: Unable to verify timestamp for ALCXWDM.SYS
*** ERROR: Module load completed but symbols could not be loaded for
ALCXWDM.SYS
*** WARNING: Unable to verify timestamp for drmk.sys
*** ERROR: Module load completed but symbols could not be loaded for
drmk.sys
*** WARNING: Unable to verify timestamp for SSIDRV.SYS
*** ERROR: Module load completed but symbols could not be loaded for
SSIDRV.SYS
*** WARNING: Unable to verify timestamp for SSHRMD.SYS
*** ERROR: Module load completed but symbols could not be loaded for
SSHRMD.SYS
*** WARNING: Unable to verify timestamp for SSFS0509.SYS
ENDLOGS

PeteK · Dec 3, 2006

If the problem appears to be associated with temperature, then you might try
removing and reseating your RAM. Make sure that any PCI cards are firmly
located. Do make sure that you are properly earthed before touching the
innards though as static can do a lot of harm and I wouldn't want to make
your problems worse.

Pete K

Rock · Dec 3, 2006

Hi. I've basically asked this question before, but now I've done a lot of
research, which might lead to someone being able to give useful advice.
( I
have Windows XP service pack 2 Home Edition).

Almost each time after I have turned off the PC for the night and reboot
it
in the morning, the PC crashes ! It almost never crashes at other
times/occasions. This morning, I was for a while stuck with the "blue
screen
of death", then a very limited version of my normal configuration loaded.

I've done a memory test, memtest86 or something like that. For some reason
I
seem not to be able to test the low 100 MB of my RAM. I have 512 MB Ram.
This particular test gives, after many repeated passes, only a few errors,
something like 10 or 23, depending on the tests and the number of passes.
I
suppose it's normal that a few bytes of my RAm aren't perfect ? I don't
know.
These errors occur at the high end (near 512 MB) of my RAM. Again, I
emphasize that my PC works normal after I have reset my PC to the previous
system restore point.

<snip>

You shouldn't get any errors when testing memory. Troubleshoot by removing
all memory by on stick and see what happens. Do this with each of the
memory sticks individually, or replace the memory with known good memory to
test.

Ken Blake, MVP · Dec 3, 2006

unstablemicrosoft said:
I've done a memory test, memtest86 or something like that. For some
reason I seem not to be able to test the low 100 MB of my RAM. I have
512 MB Ram. This particular test gives, after many repeated passes,
only a few errors, something like 10 or 23, depending on the tests
and the number of passes. I suppose it's normal that a few bytes of
my RAm aren't perfect ?

No, it's not normal to have *any* bad bytes. Depending on what's using it at
the time, a single bad byte can cause the system to crash, or can corrupt
your data.

If you have bad bytes, try to isolate what stick(s) they are on by removing
the sticks one at a time and retesting. When you've isolated the bad sticks,
replace them.

john7 · Dec 4, 2006

Hi,

From your post it is clear you have RAM problems.
It is not normal to have bad RAM locations, not even 1.
Bad RAM leads to unpredictable results and instability.
This needs to be taken care of FIRST !

NOTES:
a. Before touching the PC internals, touch the bare metal case inside.
(this avoids fatal electro static discharge through electronic parts)
b. Pull the power cord when (re)seating RAM modules as the standby
power may damage RAM / motherboard / or both.

Compare motherboard power supply voltages against manual specs.
A deviation of +/-20% or more is generaly not accepatable.

Sources of RAM problems (check in this order):
1. Check Bios settings for your RAM.
RAM timing should be set to: By SPD or Auto or similar.
Avoid custom / tweaked settings.
RAM voltage should be set to Auto or Default.
Turn off features like Performace Mode / Turbo Mode.
2. Brandless (OEM) RAM has poor quality and should be avoided in general.
If so, change it for a good brand.
3. Check the RAM compatibility page on the motherboard manufacturer site.
If your RAM brand is listed, that is a good sign but nothing more,
continue reading.
If it is not on the list it MAY still work provided it is a good brand
(e.g. Kingston, Micron, Infineon, Samsung).
4. Start testing with simmtester and only 1 RAM module seated (see NOTES
above)
If it failes try another RAM slot.
If it fails in all slots it is definately incompatible / bad. Change it
for a listed brand.
If it works well in all slots, take it out and do the same with the next
module.
When RAM fails in only 1 slot, motherboard or slot connector might be
damaged.
If so, your only options are to replace the board or avoid the slot.
5 If all RAM modules are fine separately, the combination could pose the
problem
Mixing too many different speeds should be avoided.
Some motherboards need to be set to lower RAM speed the more modules are
seated.
6. If RAM fails only in the first few minutes after power up, there is a
thermal break
in the motherboard or RAM module.

Hope this helps,
John7

---------------------------

unstablemicrosoft said:
Hi. I've basically asked this question before, but now I've done a lot of
research, which might lead to someone being able to give useful advice.
( I
have Windows XP service pack 2 Home Edition). I'D VERY MUCH APPRECIATE ANY
ADVICE THAT DOES NOT REQUIRE ME TO PAY FOR A FULL SYSTEMS CHECK BY AN
EXPERT,
I'D AS WELL BUY A NEW COMPUTER !

Almost each time after I have turned off the PC for the night and reboot
it
in the morning, the PC crashes ! It almost never crashes at other
times/occasions. This morning, I was for a while stuck with the "blue
screen
of death", then a very limited version of my normal configuration loaded.

I've done a memory test, memtest86 or something like that. For some reason
I
seem not to be able to test the low 100 MB of my RAM. I have 512 MB Ram.
This particular test gives, after many repeated passes, only a few errors,
something like 10 or 23, depending on the tests and the number of passes.
I
suppose it's normal that a few bytes of my RAm aren't perfect ? I don't
know.
These errors occur at the high end (near 512 MB) of my RAM. Again, I
emphasize that my PC works normal after I have reset my PC to the previous
system restore point.

I've used Microsoft's online crash analysis. They claimed that the cause
was
an UNKNOWN software device. That does not help me. I've found that
sometimes
installing a newer version of a driver can cause crashes ... And again,
it's
"UNKNOWN"

I have wondered that the cooling-down (temperature!) of something in my PC
could be the cause, but that seems weird, especially since the temperature
never goes much below normal room temperature. A defect in the system
timer
on the mainboard ?

I have used WinDBG to try to analyze the crash dump file. I've completed
three analyses. There is a reference to "unable to verify timestamp"for
..."
which seems to be consistent with the time-isssue (usually no crashes,
only
when I reboot it in the morning, doesn't matter if I shut down computer
before or after midnight, so no date issue, and usually no problems if the
computer has been off for two hours.). There also may be a problem with
the
kernel, but honestly, I'm way out of my leage here ! I'm no beginner, but
I'm
also not enough of an expert to really know how to handle this. And yes,
I'd
rather not pay a lot of money for some "expert" to diagnose the entire
computer, I'd be better off buying a new one !

There may be a problem with naiavf5x.sys, but I don't know what to do
about
it. I use internet explorer 7 these days, but crashes were not uncommon
with
internet explorer 6.x.

(I've also given a list of HIJACKTHIS with active services/programs and
such, but the manufacturer of my compouter cannot find a fault.)

Ok, this is a bit lengthy, now the three logs of WinDBG (the first log may
be the best):

Microsoft (R) Windows Debugger Version 6.6.0007.5
Copyright (c) Microsoft Corporation. All rights reserved.

Loading Dump File [C:\WINDOWS\Minidump\Mini120306-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: .sympath
Executable search path is:
Unable to load image ntoskrnl.exe, Win32 error 2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
*** ERROR: Module load completed but symbols could not be loaded for
ntoskrnl.exe
Windows XP Kernel Version 2600 (Service Pack 2) UP Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055a420
Debug session time: Sun Dec 3 12:45:16.375 2006 (GMT+1)
System Uptime: 0 days 0:02:09.968
Unable to load image ntoskrnl.exe, Win32 error 2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
*** ERROR: Module load completed but symbols could not be loaded for
ntoskrnl.exe
Loading Kernel Symbols
.....................................................................................................................
Loading User Symbols
Loading unloaded module list
.........
Unable to load image naiavf5x.sys, Win32 error 2
*** WARNING: Unable to verify timestamp for naiavf5x.sys
*** ERROR: Module load completed but symbols could not be loaded for
naiavf5x.sys
*******************************************************************************
*
*
* Bugcheck Analysis
*
*
*
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1000008E, {c0000005, ece0b711, ed0ff6d8, 0}

ANALYSIS: Kernel with unknown size. Will force reload symbols with known
size.
ANALYSIS: Force reload command: .reload /f
ntoskrnl.exe=FFFFFFFF804D7000,213F80,42250FF9
***** Kernel symbols are WRONG. Please fix symbols to do analysis.

***** Kernel symbols are WRONG. Please fix symbols to do analysis.

Probably caused by : naiavf5x.sys ( naiavf5x+12711 )

Followup: MachineOwner
---------

kd> !analyze -v
*******************************************************************************
*
*
* Bugcheck Analysis
*
*
*
*******************************************************************************

KERNEL_MODE_EXCEPTION_NOT_HANDLED_M (1000008e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003. This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG. This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG. This will let us see why this breakpoint is
happening.
Arguments:
Arg1: c0000005, The exception code that was not handled
Arg2: ece0b711, The address that the exception occurred at
Arg3: ed0ff6d8, Trap Frame
Arg4: 00000000

Debugging Details:
------------------

***** Kernel symbols are WRONG. Please fix symbols to do analysis.

***** Kernel symbols are WRONG. Please fix symbols to do analysis.

FAULTING_MODULE: 804d7000 nt

DEBUG_FLR_IMAGE_TIMESTAMP: 42ae0eb6

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - De instructie op 0x%08lx verwijst
naar geheugen op 0x%08lx. De lees- of schrijfbewerking ("%s") op het
geheugen
is mislukt.

FAULTING_IP:
naiavf5x+12711
ece0b711 8b481c mov ecx,dword ptr [eax+1Ch]

TRAP_FRAME: ed0ff6d8 -- (.trap ffffffffed0ff6d8)
ErrCode = 00000000
eax=00ede000 ebx=82312238 ecx=81ddae44 edx=ece12380 esi=81ddae44
edi=81ddae44
eip=ece0b711 esp=ed0ff74c ebp=ed0ff760 iopl=0 nv up ei ng nz ac po
nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000
efl=00010292
naiavf5x+0x12711:
ece0b711 8b481c mov ecx,dword ptr [eax+1Ch]
ds:0023:00ede01c=????????
Resetting default scope

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: WRONG_SYMBOLS

BUGCHECK_STR: 0x8E

LAST_CONTROL_TRANSFER: from ece08356 to ece0b711

STACK_TEXT:
WARNING: Stack unwind information not available. Following frames may be
wrong.
ed0ff760 ece08356 e10e3648 42900019 81e358a0 naiavf5x+0x12711
ed0ff7b4 ece00da9 00000000 82312238 00000001 naiavf5x+0xf356
ed0ff840 ece0111d 81ee5e00 ed0ff7e8 82312238 naiavf5x+0x7da9
ed0ff888 ecdfb950 00000000 81ee5e10 821fa1b0 naiavf5x+0x811d
ed0ff89c 804e37f7 821e6408 81ee5e00 81ee5e00 naiavf5x+0x2950
ed0ff98c 8056316c 82394e30 00000000 81ebcf30 nt+0xc7f7
ed0ffa14 8056729a 00000000 ed0ffa54 00000240 nt+0x8c16c
ed0ffa68 80570b73 00000000 00000000 56452f00 nt+0x9029a
ed0ffae4 80570c42 ed0ffc20 00000081 ed0ffb8c nt+0x99b73
ed0ffb40 80594a61 ed0ffc20 00000081 ed0ffb8c nt+0x99c42
ed0ffbb4 80595064 ed0ffbdc 00000081 ed0ffc14 nt+0xbda61
ed0ffc48 80594643 ed0ffc70 00000000 00000000 nt+0xbe064
ed0ffc88 805944bf e28e4000 00080000 81eb6920 nt+0xbd643
ed0ffd04 805811af 81eb6920 e10a40f8 00000000 nt+0xbd4bf
ed0ffd50 804fa4da 00000000 7c810665 00000001 nt+0xaa1af
00000000 00000000 00000000 00000000 00000000 nt+0x234da

STACK_COMMAND: kb

FOLLOWUP_IP:
naiavf5x+12711
ece0b711 8b481c mov ecx,dword ptr [eax+1Ch]

SYMBOL_STACK_INDEX: 0

SYMBOL_NAME: naiavf5x+12711

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: naiavf5x

IMAGE_NAME: naiavf5x.sys

BUCKET_ID: WRONG_SYMBOLS

Followup: MachineOwner
END FIRST LOG " De instructie op 0x%08lx verwijst naar geheugen op
0x%08lx.
De lees- of schrijfbewerking ("%s") op het geheugen is mislukt." MEANS
THAT
INSTRUCTION 0x%08lx REFERS TO MEMORY AT 0x%08lx, READ OR WRITE TO MEMORY
("%s") HAS FAILED.

NEXT LOG:

Microsoft (R) Windows Debugger Version 6.6.0007.5
Copyright (c) Microsoft Corporation. All rights reserved.

Loading Dump File [C:\WINDOWS\Minidump\Mini120306-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: .symfix
Executable search path is:
Unable to load image ntoskrnl.exe, Win32 error 2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
*** ERROR: Module load completed but symbols could not be loaded for
ntoskrnl.exe
Windows XP Kernel Version 2600 (Service Pack 2) UP Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055a420
Debug session time: Sun Dec 3 12:45:16.375 2006 (GMT+1)
System Uptime: 0 days 0:02:09.968
Unable to load image ntoskrnl.exe, Win32 error 2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
*** ERROR: Module load completed but symbols could not be loaded for
ntoskrnl.exe
Loading Kernel Symbols
.....................................................................................................................
Loading User Symbols
Loading unloaded module list
.........
Unable to load image naiavf5x.sys, Win32 error 2
*** WARNING: Unable to verify timestamp for naiavf5x.sys
*** ERROR: Module load completed but symbols could not be loaded for
naiavf5x.sys
*******************************************************************************
*
*
* Bugcheck Analysis
*
*
*
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1000008E, {c0000005, ece0b711, ed0ff6d8, 0}

ANALYSIS: Kernel with unknown size. Will force reload symbols with known
size.
ANALYSIS: Force reload command: .reload /f
ntoskrnl.exe=FFFFFFFF804D7000,213F80,42250FF9
***** Kernel symbols are WRONG. Please fix symbols to do analysis.

***** Kernel symbols are WRONG. Please fix symbols to do analysis.

Probably caused by : naiavf5x.sys ( naiavf5x+12711 )

Followup: MachineOwner
---------
NEXT LOG

Microsoft (R) Windows Debugger Version 6.6.0007.5
Copyright (c) Microsoft Corporation. All rights reserved.

Loading Dump File [C:\WINDOWS\Minidump\Mini120306-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: .sympath+
SRV*c:\tmp*http://msdl.microsoft.com/download/symbols
Executable search path is:
*** ERROR: Symbol file could not be found. Defaulted to export symbols
for
ntoskrnl.exe -
Windows XP Kernel Version 2600 (Service Pack 2) UP Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 2600.xpsp_sp2_gdr.050301-1519
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055a420
Debug session time: Sun Dec 3 12:45:16.375 2006 (GMT+1)
System Uptime: 0 days 0:02:09.968
*** ERROR: Symbol file could not be found. Defaulted to export symbols
for
ntoskrnl.exe -
Loading Kernel Symbols
.....................................................................................................................
Loading User Symbols
Loading unloaded module list
.........
Unable to load image naiavf5x.sys, Win32 error 2
*** WARNING: Unable to verify timestamp for naiavf5x.sys
*** ERROR: Module load completed but symbols could not be loaded for
naiavf5x.sys
*******************************************************************************
*
*
* Bugcheck Analysis
*
*
*
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1000008E, {c0000005, ece0b711, ed0ff6d8, 0}

ANALYSIS: Kernel with unknown size. Will force reload symbols with known
size.
ANALYSIS: Force reload command: .reload /f
ntoskrnl.exe=FFFFFFFF804D7000,213F80,42250FF9
***** Kernel symbols are WRONG. Please fix symbols to do analysis.

***** Kernel symbols are WRONG. Please fix symbols to do analysis.

Probably caused by : naiavf5x.sys ( naiavf5x+12711 )

Followup: MachineOwner
---------

kd> !analize -v
No export analize found
kd> analize -v
*** WARNING: Unable to verify timestamp for nv4_disp.dll
*** ERROR: Module load completed but symbols could not be loaded for
nv4_disp.dll
*** WARNING: Unable to verify timestamp for PCANDIS5.SYS
*** ERROR: Module load completed but symbols could not be loaded for
PCANDIS5.SYS
*** WARNING: Unable to verify timestamp for dump_nvidesm.sys
*** ERROR: Module load completed but symbols could not be loaded for
dump_nvidesm.sys
*** WARNING: Unable to verify timestamp for mdc8021x.sys
*** ERROR: Module load completed but symbols could not be loaded for
mdc8021x.sys
*** WARNING: Unable to verify timestamp for WlanUIG.sys
*** ERROR: Module load completed but symbols could not be loaded for
WlanUIG.sys
*** WARNING: Unable to verify timestamp for MpFirewall.sys
*** ERROR: Module load completed but symbols could not be loaded for
MpFirewall.sys
*** WARNING: Unable to verify timestamp for ikhlayer.sys
*** ERROR: Module load completed but symbols could not be loaded for
ikhlayer.sys
*** WARNING: Unable to verify timestamp for ikhfile.sys
*** ERROR: Module load completed but symbols could not be loaded for
ikhfile.sys
*** WARNING: Unable to verify timestamp for nv4_mini.sys
*** ERROR: Module load completed but symbols could not be loaded for
nv4_mini.sys
*** WARNING: Unable to verify timestamp for ALCXSENS.SYS
*** ERROR: Module load completed but symbols could not be loaded for
ALCXSENS.SYS
*** WARNING: Unable to verify timestamp for ALCXWDM.SYS
*** ERROR: Module load completed but symbols could not be loaded for
ALCXWDM.SYS
*** WARNING: Unable to verify timestamp for drmk.sys
*** ERROR: Module load completed but symbols could not be loaded for
drmk.sys
*** WARNING: Unable to verify timestamp for SSIDRV.SYS
*** ERROR: Module load completed but symbols could not be loaded for
SSIDRV.SYS
*** WARNING: Unable to verify timestamp for SSHRMD.SYS
*** ERROR: Module load completed but symbols could not be loaded for
SSHRMD.SYS
*** WARNING: Unable to verify timestamp for SSFS0509.SYS
ENDLOGS

NewScience · Dec 6, 2006

I hope my instructions in Debugging Windows and How to Setup helped.

I will tell you ... depending on your system .... I have had problems with
McAfee on every system. As well as Norton.

Maybe someone can help you further ... I hear ZoneAlarm is pretty good.
Good luck in uninstalling McAfee. I just did that last weekend on my
sisters system. Ran all the uninstall programs from Add/Remove Programs....
and it still didn't uninstall everything.

Had to download all the McAfee Cleanup Tool Scripts from
forums.mcafeehelp.com, and it still get everything. I had to manually edit
the Registry and cleanup Services and HKLM\Software and HKCU\Software
registry entries.

unstablemicrosoft said:
Hi. Thanks to you all.

This is going to be a bit lengthy, including two logs of the windows debug
utility, sorry for that. At the end of that there is more info, also more
important I think. The second log pertains the crash that followed shortly
after the first one, while I was trying to investigate the situation. Feel
free to skip some stuff, the end of this message is probably the most
important.

"Microsoft (R) Windows Debugger Version 6.6.0007.5
Copyright (c) Microsoft Corporation. All rights reserved.

Loading Dump File [C:\WINDOWS\Minidump\Mini120506-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is:
SRV*C:\windows\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
c:\windows;c:windows\system32;\c:\windows\system32\drivers
Windows XP Kernel Version 2600 (Service Pack 2) UP Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 2600.xpsp_sp2_gdr.050301-1519
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055a420
Debug session time: Tue Dec 5 14:47:35.328 2006 (GMT+1)
System Uptime: 0 days 0:01:53.921
Loading Kernel Symbols
...................................................................................................................
Loading User Symbols
Loading unloaded module list
..........
*******************************************************************************
*
*
* Bugcheck Analysis
*
*
*
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1000008E, {c0000005, bf8345ea, ba398bdc, 0}

*** ERROR: Symbol file could not be found. Defaulted to export symbols
for
nv4_disp.dll -
Probably caused by : nv4_disp.dll ( nv4_disp+607e )

Followup: MachineOwner
---------

kd> !analyze -v
*******************************************************************************
*
*
* Bugcheck Analysis
*
*
*
*******************************************************************************

KERNEL_MODE_EXCEPTION_NOT_HANDLED_M (1000008e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003. This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG. This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG. This will let us see why this breakpoint is
happening.
Arguments:
Arg1: c0000005, The exception code that was not handled
Arg2: bf8345ea, The address that the exception occurred at
Arg3: ba398bdc, Trap Frame
Arg4: 00000000

Debugging Details:
------------------

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - De instructie op 0x%08lx verwijst
naar geheugen op 0x%08lx. De lees- of schrijfbewerking ("%s") op het
geheugen
is mislukt.

FAULTING_IP:
win32k!BltLnkRect+246
bf8345ea 837e3400 cmp dword ptr [esi+34h],0

TRAP_FRAME: ba398bdc -- (.trap ffffffffba398bdc)
ErrCode = 00000002
eax=e2a21368 ebx=00000000 ecx=ba3991e4 edx=00000000 esi=ba39935c
edi=00000010
eip=bf8345ea esp=ba398c50 ebp=ba3991c4 iopl=0 nv up ei pl zr na pe
nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000
efl=00010246
win32k!BltLnkRect+0x246:
bf8345ea 837e3400 cmp dword ptr [esi+34h],0
ds:0023:ba399390=00000001
Resetting default scope

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: 0x8E

PROCESS_NAME: explorer.exe

LAST_CONTROL_TRANSFER: from bf833a65 to bf8345ea

STACK_TEXT:
ba3991c4 bf833a65 ba39935c ba3991e4 e192d810 win32k!BltLnkRect+0x246
ba399460 bf82f649 00000000 e2a975b0 00000000 win32k!BltLnk+0x796
ba3994e4 bf9da07e e163f008 e2a975c0 e163f008 win32k!EngBitBlt+0x3cb
WARNING: Stack unwind information not available. Following frames may be
wrong.
ba399630 bf81863f 00000000 00000000 00000104 nv4_disp+0x607e
ba39972c bf8612c1 ba399814 e2a21368 00000000 win32k!GreDrawStream+0x56e
ba399848 804de7ec 210109a5 000000ab 00000008 win32k!GreMaskBlt+0x71c
ba399848 7c90eb94 210109a5 000000ab 00000008 nt!KiFastCallEntry+0xf8
00fef37c 00000000 00000000 00000000 00000000 0x7c90eb94

STACK_COMMAND: kb

FOLLOWUP_IP:
nv4_disp+607e
bf9da07e 8b4c2410 mov ecx,dword ptr [esp+10h]

SYMBOL_STACK_INDEX: 3

SYMBOL_NAME: nv4_disp+607e

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nv4_disp

IMAGE_NAME: nv4_disp.dll

DEBUG_FLR_IMAGE_TIMESTAMP: 453bdc7a

FAILURE_BUCKET_ID: 0x8E_nv4_disp+607e

BUCKET_ID: 0x8E_nv4_disp+607e

Followup: MachineOwner"

LOG 2 "Microsoft (R) Windows Debugger Version 6.6.0007.5
Copyright (c) Microsoft Corporation. All rights reserved.

Loading Dump File [C:\WINDOWS\Minidump\Mini120506-02.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is:
SRV*C\windows\symbols\*http://msdl.microsoft.com/download/symbols
Executable search path is:
c:\windows;c:\windowssystem32;c:\windows\system32\drivers
Windows XP Kernel Version 2600 (Service Pack 2) UP Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 2600.xpsp_sp2_gdr.050301-1519
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055a420
Debug session time: Tue Dec 5 15:11:42.968 2006 (GMT+1)
System Uptime: 0 days 0:23:46.551
Loading Kernel Symbols
...................................................................................................................
Loading User Symbols
Loading unloaded module list
............
*******************************************************************************
*
*
* Bugcheck Analysis
*
*
*
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1000000A, {fff, 2, 1, 8051cd0f}

Probably caused by : ntoskrnl.exe ( nt!KiAttachProcess+6b )

Followup: MachineOwner
---------

kd> !analyze -v
*******************************************************************************
*
*
* Bugcheck Analysis
*
*
*
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address
at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 00000fff, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000001, value 0 = read operation, 1 = write operation
Arg4: 8051cd0f, address which referenced memory

Debugging Details:
------------------

WRITE_ADDRESS: 00000fff

CURRENT_IRQL: 2

FAULTING_IP:
nt!KiAttachProcess+6b
8051cd0f 8910 mov dword ptr [eax],edx

CUSTOMER_CRASH_COUNT: 2

DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: 0xA

LAST_CONTROL_TRANSFER: from 804f178f to 8051cd0f

STACK_TEXT:
ba187b78 804f178f 8210cb30 822aebf8 822aeb00 nt!KiAttachProcess+0x6b
ba187b98 8057d1dc 822aeb00 ba187c0c ba187d00 nt!KeStackAttachProcess+0x7b
ba187c70 8057d321 822aebf8 000dbb90 820eb978 nt!MiDoMappedCopy+0x65
ba187ca0 80588c7d 822aec78 000dbb90 820eb978 nt!MmCopyVirtualMemory+0x63
ba187d20 80588cd5 00000000 000002e8 000ba380 nt!LpcpCopyRequestData+0x1fc
ba187d44 804de7ec 000002e8 000ba380 00000000 nt!NtReadRequestData+0x1e
ba187d44 7c90eb94 000002e8 000ba380 00000000 nt!KiFastCallEntry+0xf8
WARNING: Frame IP not in any known module. Following frames may be wrong.
00befdf4 00000000 00000000 00000000 00000000 0x7c90eb94

STACK_COMMAND: kb

FOLLOWUP_IP:
nt!KiAttachProcess+6b
8051cd0f 8910 mov dword ptr [eax],edx

SYMBOL_STACK_INDEX: 0

SYMBOL_NAME: nt!KiAttachProcess+6b

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nt

IMAGE_NAME: ntoskrnl.exe

DEBUG_FLR_IMAGE_TIMESTAMP: 42250ff9

FAILURE_BUCKET_ID: 0xA_W_nt!KiAttachProcess+6b

BUCKET_ID: 0xA_W_nt!KiAttachProcess+6b

Followup: MachineOwner"

The file nv4_disp.dll is mentioned, and it seems to be part of the McAfee
software. Deleting that file (including the McAfee software) is an option
for
further consideration, if necessary.

Now, about the memory: memory seems to be really tricky. I'll save you
some
trouble by skipping the less important details. First of all, I used the
memtest86 and the Windows memory diagnostic tool. (I have Windows XP
service
pack 2, Home Edition) Recently, I received a few errors with a few RAM
tests,
but most tests indicated that everything was fine. But not Memtest86 test
5
and 8. And not test stride6 of the Windows memory tool. The Windows memory
diagnostic Memtest86 sort of "calls" my chipset (or perhaps driver??,
probably chipset) Nvidia nForce SPP/FSB 166 Mhz. When I bought this
system, I
had 256 MB RAM, one module. I've never gotten an error message in that RAM
module. Recently I noticed some errors in the second 256 MB RAM module
that I
bought some months ago, possibly causing the crashes. The second module
was
different from the first. I've tried a lot.

But now, after tweaking the bios (or CMOS ? I haven't done those things in
ages) I switched something from SP to Auto. Guess what ?? Further memory
tests did not discover a single error !

Can anyone explain to me what SP is ??

I hope that this does solve my problem, and if not, I'll consider deleting
all Mcafee software, including nv4_disp.dll.

I've tried to get for all relevant things to get the latest drivers. I
intended to update my mainboard M7NCD (not PRO !), but no update seemed
available.

So the RAM itself was not faulty. Any further advice/insight appreciated.

Thank you.

john7 · Dec 8, 2006

Hi, (lees verder)

By 'SP' you meant most likely 'SPD'. SPD means Serial Presence Detect.
There is a small additional chip on the memory module which holds timing
parameters.
The BIOS reads these parameters to auto-configure RAM timing..
Normally this is the best option but in rare cases a parameters is damaged
which causes system instability.

You have definately RAM problems.
Don't waste your time on digging in crash logs etc.
DON'T delete 'nv4_disp.dll' as is belong to your display driver.
There is also no need to delete Mc Afee!

Did you check out my post in this thread?
Set RAM timing to SPD and run memory tests on the suspected memory module
ONLY.
If it fails, return it to the shop (if under warranty).

Suc6,
John7 @ Home.nl

unstablemicrosoft said:
Hi. Thanks to you all.

This is going to be a bit lengthy, including two logs of the windows debug
utility, sorry for that. At the end of that there is more info, also more
important I think. The second log pertains the crash that followed shortly
after the first one, while I was trying to investigate the situation. Feel
free to skip some stuff, the end of this message is probably the most
important.

"Microsoft (R) Windows Debugger Version 6.6.0007.5
Copyright (c) Microsoft Corporation. All rights reserved.

Loading Dump File [C:\WINDOWS\Minidump\Mini120506-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is:
SRV*C:\windows\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
c:\windows;c:windows\system32;\c:\windows\system32\drivers
Windows XP Kernel Version 2600 (Service Pack 2) UP Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 2600.xpsp_sp2_gdr.050301-1519
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055a420
Debug session time: Tue Dec 5 14:47:35.328 2006 (GMT+1)
System Uptime: 0 days 0:01:53.921
Loading Kernel Symbols
...................................................................................................................
Loading User Symbols
Loading unloaded module list
..........
*******************************************************************************
*
*
* Bugcheck Analysis
*
*
*
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1000008E, {c0000005, bf8345ea, ba398bdc, 0}

*** ERROR: Symbol file could not be found. Defaulted to export symbols
for
nv4_disp.dll -
Probably caused by : nv4_disp.dll ( nv4_disp+607e )

Followup: MachineOwner
---------

kd> !analyze -v
*******************************************************************************
*
*
* Bugcheck Analysis
*
*
*
*******************************************************************************

KERNEL_MODE_EXCEPTION_NOT_HANDLED_M (1000008e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003. This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG. This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG. This will let us see why this breakpoint is
happening.
Arguments:
Arg1: c0000005, The exception code that was not handled
Arg2: bf8345ea, The address that the exception occurred at
Arg3: ba398bdc, Trap Frame
Arg4: 00000000

Debugging Details:
------------------

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - De instructie op 0x%08lx verwijst
naar geheugen op 0x%08lx. De lees- of schrijfbewerking ("%s") op het
geheugen
is mislukt.

FAULTING_IP:
win32k!BltLnkRect+246
bf8345ea 837e3400 cmp dword ptr [esi+34h],0

TRAP_FRAME: ba398bdc -- (.trap ffffffffba398bdc)
ErrCode = 00000002
eax=e2a21368 ebx=00000000 ecx=ba3991e4 edx=00000000 esi=ba39935c
edi=00000010
eip=bf8345ea esp=ba398c50 ebp=ba3991c4 iopl=0 nv up ei pl zr na pe
nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000
efl=00010246
win32k!BltLnkRect+0x246:
bf8345ea 837e3400 cmp dword ptr [esi+34h],0
ds:0023:ba399390=00000001
Resetting default scope

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: 0x8E

PROCESS_NAME: explorer.exe

LAST_CONTROL_TRANSFER: from bf833a65 to bf8345ea

STACK_TEXT:
ba3991c4 bf833a65 ba39935c ba3991e4 e192d810 win32k!BltLnkRect+0x246
ba399460 bf82f649 00000000 e2a975b0 00000000 win32k!BltLnk+0x796
ba3994e4 bf9da07e e163f008 e2a975c0 e163f008 win32k!EngBitBlt+0x3cb
WARNING: Stack unwind information not available. Following frames may be
wrong.
ba399630 bf81863f 00000000 00000000 00000104 nv4_disp+0x607e
ba39972c bf8612c1 ba399814 e2a21368 00000000 win32k!GreDrawStream+0x56e
ba399848 804de7ec 210109a5 000000ab 00000008 win32k!GreMaskBlt+0x71c
ba399848 7c90eb94 210109a5 000000ab 00000008 nt!KiFastCallEntry+0xf8
00fef37c 00000000 00000000 00000000 00000000 0x7c90eb94

STACK_COMMAND: kb

FOLLOWUP_IP:
nv4_disp+607e
bf9da07e 8b4c2410 mov ecx,dword ptr [esp+10h]

SYMBOL_STACK_INDEX: 3

SYMBOL_NAME: nv4_disp+607e

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nv4_disp

IMAGE_NAME: nv4_disp.dll

DEBUG_FLR_IMAGE_TIMESTAMP: 453bdc7a

FAILURE_BUCKET_ID: 0x8E_nv4_disp+607e

BUCKET_ID: 0x8E_nv4_disp+607e

Followup: MachineOwner"

LOG 2 "Microsoft (R) Windows Debugger Version 6.6.0007.5
Copyright (c) Microsoft Corporation. All rights reserved.

Loading Dump File [C:\WINDOWS\Minidump\Mini120506-02.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is:
SRV*C\windows\symbols\*http://msdl.microsoft.com/download/symbols
Executable search path is:
c:\windows;c:\windowssystem32;c:\windows\system32\drivers
Windows XP Kernel Version 2600 (Service Pack 2) UP Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 2600.xpsp_sp2_gdr.050301-1519
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055a420
Debug session time: Tue Dec 5 15:11:42.968 2006 (GMT+1)
System Uptime: 0 days 0:23:46.551
Loading Kernel Symbols
...................................................................................................................
Loading User Symbols
Loading unloaded module list
............
*******************************************************************************
*
*
* Bugcheck Analysis
*
*
*
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1000000A, {fff, 2, 1, 8051cd0f}

Probably caused by : ntoskrnl.exe ( nt!KiAttachProcess+6b )

Followup: MachineOwner
---------

kd> !analyze -v
*******************************************************************************
*
*
* Bugcheck Analysis
*
*
*
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address
at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 00000fff, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000001, value 0 = read operation, 1 = write operation
Arg4: 8051cd0f, address which referenced memory

Debugging Details:
------------------

WRITE_ADDRESS: 00000fff

CURRENT_IRQL: 2

FAULTING_IP:
nt!KiAttachProcess+6b
8051cd0f 8910 mov dword ptr [eax],edx

CUSTOMER_CRASH_COUNT: 2

DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: 0xA

LAST_CONTROL_TRANSFER: from 804f178f to 8051cd0f

STACK_TEXT:
ba187b78 804f178f 8210cb30 822aebf8 822aeb00 nt!KiAttachProcess+0x6b
ba187b98 8057d1dc 822aeb00 ba187c0c ba187d00 nt!KeStackAttachProcess+0x7b
ba187c70 8057d321 822aebf8 000dbb90 820eb978 nt!MiDoMappedCopy+0x65
ba187ca0 80588c7d 822aec78 000dbb90 820eb978 nt!MmCopyVirtualMemory+0x63
ba187d20 80588cd5 00000000 000002e8 000ba380 nt!LpcpCopyRequestData+0x1fc
ba187d44 804de7ec 000002e8 000ba380 00000000 nt!NtReadRequestData+0x1e
ba187d44 7c90eb94 000002e8 000ba380 00000000 nt!KiFastCallEntry+0xf8
WARNING: Frame IP not in any known module. Following frames may be wrong.
00befdf4 00000000 00000000 00000000 00000000 0x7c90eb94

STACK_COMMAND: kb

FOLLOWUP_IP:
nt!KiAttachProcess+6b
8051cd0f 8910 mov dword ptr [eax],edx

SYMBOL_STACK_INDEX: 0

SYMBOL_NAME: nt!KiAttachProcess+6b

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nt

IMAGE_NAME: ntoskrnl.exe

DEBUG_FLR_IMAGE_TIMESTAMP: 42250ff9

FAILURE_BUCKET_ID: 0xA_W_nt!KiAttachProcess+6b

BUCKET_ID: 0xA_W_nt!KiAttachProcess+6b

Followup: MachineOwner"

The file nv4_disp.dll is mentioned, and it seems to be part of the McAfee
software. Deleting that file (including the McAfee software) is an option
for
further consideration, if necessary.

Now, about the memory: memory seems to be really tricky. I'll save you
some
trouble by skipping the less important details. First of all, I used the
memtest86 and the Windows memory diagnostic tool. (I have Windows XP
service
pack 2, Home Edition) Recently, I received a few errors with a few RAM
tests,
but most tests indicated that everything was fine. But not Memtest86 test
5
and 8. And not test stride6 of the Windows memory tool. The Windows memory
diagnostic Memtest86 sort of "calls" my chipset (or perhaps driver??,
probably chipset) Nvidia nForce SPP/FSB 166 Mhz. When I bought this
system, I
had 256 MB RAM, one module. I've never gotten an error message in that RAM
module. Recently I noticed some errors in the second 256 MB RAM module
that I
bought some months ago, possibly causing the crashes. The second module
was
different from the first. I've tried a lot.

But now, after tweaking the bios (or CMOS ? I haven't done those things in
ages) I switched something from SP to Auto. Guess what ?? Further memory
tests did not discover a single error !

Can anyone explain to me what SP is ??

I hope that this does solve my problem, and if not, I'll consider deleting
all Mcafee software, including nv4_disp.dll.

I've tried to get for all relevant things to get the latest drivers. I
intended to update my mainboard M7NCD (not PRO !), but no update seemed
available.

So the RAM itself was not faulty. Any further advice/insight appreciated.

Thank you.

Rock · Dec 9, 2006

Hi. Thanks to you all.

This is going to be a bit lengthy, including two logs of the windows debug
utility, sorry for that. At the end of that there is more info, also more
important I think. The second log pertains the crash that followed shortly
after the first one, while I was trying to investigate the situation. Feel
free to skip some stuff, the end of this message is probably the most
important.

"Microsoft (R) Windows Debugger Version 6.6.0007.5
Copyright (c) Microsoft Corporation. All rights reserved.

Loading Dump File [C:\WINDOWS\Minidump\Mini120506-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is:
SRV*C:\windows\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
c:\windows;c:windows\system32;\c:\windows\system32\drivers
Windows XP Kernel Version 2600 (Service Pack 2) UP Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 2600.xpsp_sp2_gdr.050301-1519
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055a420
Debug session time: Tue Dec 5 14:47:35.328 2006 (GMT+1)
System Uptime: 0 days 0:01:53.921
Loading Kernel Symbols
...................................................................................................................
Loading User Symbols
Loading unloaded module list
..........
*******************************************************************************
*
*
* Bugcheck Analysis
*
*
*
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1000008E, {c0000005, bf8345ea, ba398bdc, 0}

*** ERROR: Symbol file could not be found. Defaulted to export symbols
for
nv4_disp.dll -
Probably caused by : nv4_disp.dll ( nv4_disp+607e )

Followup: MachineOwner
---------

kd> !analyze -v
*******************************************************************************
*
*
* Bugcheck Analysis
*
*
*
*******************************************************************************

KERNEL_MODE_EXCEPTION_NOT_HANDLED_M (1000008e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003. This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG. This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG. This will let us see why this breakpoint is
happening.
Arguments:
Arg1: c0000005, The exception code that was not handled
Arg2: bf8345ea, The address that the exception occurred at
Arg3: ba398bdc, Trap Frame
Arg4: 00000000

Debugging Details:
------------------

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - De instructie op 0x%08lx verwijst
naar geheugen op 0x%08lx. De lees- of schrijfbewerking ("%s") op het
geheugen
is mislukt.

FAULTING_IP:
win32k!BltLnkRect+246
bf8345ea 837e3400 cmp dword ptr [esi+34h],0

TRAP_FRAME: ba398bdc -- (.trap ffffffffba398bdc)
ErrCode = 00000002
eax=e2a21368 ebx=00000000 ecx=ba3991e4 edx=00000000 esi=ba39935c
edi=00000010
eip=bf8345ea esp=ba398c50 ebp=ba3991c4 iopl=0 nv up ei pl zr na pe
nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000
efl=00010246
win32k!BltLnkRect+0x246:
bf8345ea 837e3400 cmp dword ptr [esi+34h],0
ds:0023:ba399390=00000001
Resetting default scope

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: 0x8E

PROCESS_NAME: explorer.exe

LAST_CONTROL_TRANSFER: from bf833a65 to bf8345ea

STACK_TEXT:
ba3991c4 bf833a65 ba39935c ba3991e4 e192d810 win32k!BltLnkRect+0x246
ba399460 bf82f649 00000000 e2a975b0 00000000 win32k!BltLnk+0x796
ba3994e4 bf9da07e e163f008 e2a975c0 e163f008 win32k!EngBitBlt+0x3cb
WARNING: Stack unwind information not available. Following frames may be
wrong.
ba399630 bf81863f 00000000 00000000 00000104 nv4_disp+0x607e
ba39972c bf8612c1 ba399814 e2a21368 00000000 win32k!GreDrawStream+0x56e
ba399848 804de7ec 210109a5 000000ab 00000008 win32k!GreMaskBlt+0x71c
ba399848 7c90eb94 210109a5 000000ab 00000008 nt!KiFastCallEntry+0xf8
00fef37c 00000000 00000000 00000000 00000000 0x7c90eb94

STACK_COMMAND: kb

FOLLOWUP_IP:
nv4_disp+607e
bf9da07e 8b4c2410 mov ecx,dword ptr [esp+10h]

SYMBOL_STACK_INDEX: 3

SYMBOL_NAME: nv4_disp+607e

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nv4_disp

IMAGE_NAME: nv4_disp.dll

DEBUG_FLR_IMAGE_TIMESTAMP: 453bdc7a

FAILURE_BUCKET_ID: 0x8E_nv4_disp+607e

BUCKET_ID: 0x8E_nv4_disp+607e

Followup: MachineOwner"

LOG 2 "Microsoft (R) Windows Debugger Version 6.6.0007.5
Copyright (c) Microsoft Corporation. All rights reserved.

Loading Dump File [C:\WINDOWS\Minidump\Mini120506-02.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is:
SRV*C\windows\symbols\*http://msdl.microsoft.com/download/symbols
Executable search path is:
c:\windows;c:\windowssystem32;c:\windows\system32\drivers
Windows XP Kernel Version 2600 (Service Pack 2) UP Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 2600.xpsp_sp2_gdr.050301-1519
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055a420
Debug session time: Tue Dec 5 15:11:42.968 2006 (GMT+1)
System Uptime: 0 days 0:23:46.551
Loading Kernel Symbols
...................................................................................................................
Loading User Symbols
Loading unloaded module list
............
*******************************************************************************
*
*
* Bugcheck Analysis
*
*
*
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1000000A, {fff, 2, 1, 8051cd0f}

Probably caused by : ntoskrnl.exe ( nt!KiAttachProcess+6b )

Followup: MachineOwner
---------

kd> !analyze -v
*******************************************************************************
*
*
* Bugcheck Analysis
*
*
*
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address
at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 00000fff, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000001, value 0 = read operation, 1 = write operation
Arg4: 8051cd0f, address which referenced memory

Debugging Details:
------------------

WRITE_ADDRESS: 00000fff

CURRENT_IRQL: 2

FAULTING_IP:
nt!KiAttachProcess+6b
8051cd0f 8910 mov dword ptr [eax],edx

CUSTOMER_CRASH_COUNT: 2

DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: 0xA

LAST_CONTROL_TRANSFER: from 804f178f to 8051cd0f

STACK_TEXT:
ba187b78 804f178f 8210cb30 822aebf8 822aeb00 nt!KiAttachProcess+0x6b
ba187b98 8057d1dc 822aeb00 ba187c0c ba187d00 nt!KeStackAttachProcess+0x7b
ba187c70 8057d321 822aebf8 000dbb90 820eb978 nt!MiDoMappedCopy+0x65
ba187ca0 80588c7d 822aec78 000dbb90 820eb978 nt!MmCopyVirtualMemory+0x63
ba187d20 80588cd5 00000000 000002e8 000ba380 nt!LpcpCopyRequestData+0x1fc
ba187d44 804de7ec 000002e8 000ba380 00000000 nt!NtReadRequestData+0x1e
ba187d44 7c90eb94 000002e8 000ba380 00000000 nt!KiFastCallEntry+0xf8
WARNING: Frame IP not in any known module. Following frames may be wrong.
00befdf4 00000000 00000000 00000000 00000000 0x7c90eb94

STACK_COMMAND: kb

FOLLOWUP_IP:
nt!KiAttachProcess+6b
8051cd0f 8910 mov dword ptr [eax],edx

SYMBOL_STACK_INDEX: 0

SYMBOL_NAME: nt!KiAttachProcess+6b

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nt

IMAGE_NAME: ntoskrnl.exe

DEBUG_FLR_IMAGE_TIMESTAMP: 42250ff9

FAILURE_BUCKET_ID: 0xA_W_nt!KiAttachProcess+6b

BUCKET_ID: 0xA_W_nt!KiAttachProcess+6b

Followup: MachineOwner"

The file nv4_disp.dll is mentioned, and it seems to be part of the McAfee
software. Deleting that file (including the McAfee software) is an option
for
further consideration, if necessary.

Now, about the memory: memory seems to be really tricky. I'll save you
some
trouble by skipping the less important details. First of all, I used the
memtest86 and the Windows memory diagnostic tool. (I have Windows XP
service
pack 2, Home Edition) Recently, I received a few errors with a few RAM
tests,
but most tests indicated that everything was fine. But not Memtest86 test
5
and 8. And not test stride6 of the Windows memory tool. The Windows memory
diagnostic Memtest86 sort of "calls" my chipset (or perhaps driver??,
probably chipset) Nvidia nForce SPP/FSB 166 Mhz. When I bought this
system, I
had 256 MB RAM, one module. I've never gotten an error message in that RAM
module. Recently I noticed some errors in the second 256 MB RAM module
that I
bought some months ago, possibly causing the crashes. The second module
was
different from the first. I've tried a lot.

But now, after tweaking the bios (or CMOS ? I haven't done those things in
ages) I switched something from SP to Auto. Guess what ?? Further memory
tests did not discover a single error !

Can anyone explain to me what SP is ??

I hope that this does solve my problem, and if not, I'll consider deleting
all Mcafee software, including nv4_disp.dll.

I've tried to get for all relevant things to get the latest drivers. I
intended to update my mainboard M7NCD (not PRO !), but no update seemed
available.

So the RAM itself was not faulty. Any further advice/insight appreciated.

Thank you.

The system has memory problems. Why are you wasting time with debuggers.
Replace the memory. There should be no memory errors when running a memory
diagnostic utility - none, zero, nada, zilch.

Guest · Dec 9, 2006

Hi.

Quote: "By 'SP' you meant most likely 'SPD'. SPD means Serial Presence Detect.
There is a small additional chip on the memory module which holds timing
parameters.
The BIOS reads these parameters to auto-configure RAM timing..
Normally this is the best option but in rare cases a parameters is damaged
which causes system instability."

Well, in my BIOS (at least I think it's in my BIOS, I can access it by
pressing the delelete key when I boot up, something with regard to memory
(memory configuration/detection ? I don't recall the exact words) was set to
SP. In my Bios it's called SP according to my recollection, not SPD.

You mention timing parameters. That could explain why I got crashes when my
computer had been "cold" for a night and I'd get a crash when I activated my
computer in the morning or afternoon after that, and why I didn't get any
crashes when I just briefly turned off my computer. Getting those crashes was
a daily experience.

However, a few days ago I did set the memory configuration (correct words?)
in the BIOS from SP to Auto. After that, memtest86 and the windows memory
diagnostic tools did give zero errors !

Also, for the past three or four days I never got a crash (when turning on
my computer) at all !!

So, it seems that my problem is solved !

Everyone, thank you very much for your input !

I'm just wondering, is there really a defect in the second (and most recent)
memory module ? Or did the problem occur because that module was in some way
incompatible with my M7NCD socket 462 mainboard, or because the memory
modules (each 256 MB RAM) were too different from each other ? I don't recall
getting daily crashes immediately after I had installed the second module.
And I vaguely recall getting some occasional crashes before I installed the
second module.

Aside from the issue of crashes, would switching from SP to Auto decrease
memory performence ? I haven't noticed any, but I normally don't tax my
system heavily.

Anyway, thanks.

Guest · Dec 9, 2006

Just some clarification: in my BIOS, my memory configuration was set to SPD,
and not SP as I had said. Changing it to automatic fixed my problem.

john7 · Dec 11, 2006

Glad we could help.

Better leave Bios Shadow OFF in windows.

Mzzl,
John7

Using WinDebug	3	Apr 18, 2008
XP crashes, dmp files added.	6	Jan 29, 2006
HTTP blue screen error	2	May 15, 2006
bluescreen, dumpfile, please help	2	Jun 17, 2006
crash dump reviews. Help	1	Mar 4, 2004
Windows XP with bluescreen parport.sys	1	Jun 19, 2006
Multiple save dumps (with debug info)	4	Jul 25, 2008
rebooted from bugcheck?	2	Aug 22, 2009

problems with PC crashing; help/insight requested

Guest

NewScience

PeteK

Rock

Ken Blake, MVP

john7

NewScience

john7

Rock

Guest

Guest

john7

Ask a Question

Similar Threads