SP4 BSOD/Failure

[Clyde]

Win2K Pro SP4 (Current with WindowsUpdate)
P4 2.8GHz 1GB RAM
MSI MS-9249 1U Server (No BIOS updates available from mfg)

Ran memtestx86 for 9 hours. No errors reported.
Ran Prime95 for 8 hours. No errors reported.


This is a webserver box running IIS 5.

I'm getting random system lockups/BSODs on the system.

I have enabled "Log an Event" and "Write complete dump file" but when
I restart the system there are no related Events and there is no dump
file.

I have also tried starting Win2K in debug mode.

The system crashed again tonight. When I got to the system and
flipped my KVM switch to that system, there was no video to display to
the monitor, so I have no idea what the BSOD message was. I guess I'll
need to run this system on it's own monitor for a while.

What can I do to at least determine what error is happening?

 

[Clyde]

Found out that since I have the OS installed on drive D and my swap on
drive C that Windows can't create a dump file. Placed the swapfile on
D, removed the swapfile on C, followed the KB article about how to
configure CrashOnCtrlScroll and forced crash. Mem dump file was
written to target location.

Now maybe I'll at least be able to get a dump file to try to find out
what's going on.

 

[Ripper]

Let me know if you can make any sense out of the dump files. Mine are
usually complete gibberish.
I installed SP4 and tried to install FP extensions (needed to install IIS
first). I was never able to finish installing IIS. I was bombed with error
messages during the install. I can't uninstall IIS because it never
installed fully, yet there are components of it all over the system. Ever
since then, my system has crashed 4 or 5 times per day. My install disk was
damaged so I can't even reformat and start over, for now. I'm waiting on a
new disk. My system crashes constantly.

My favorite error message in the log files....
There was an error starting (pick a process). The error was no attempt to
start (the same process) has been made since the last boot.
So....if no attempt to start that particular process has been made, how
could there have been an error starting that process?

Here's another good one. I was getting error messages that suggested I
disable Disk Performance Counters on my system. I did. So now I get this
every time I boot:
Unable to read the disk performance information from the system. Disk
performance counters must be enabled for at least one physical disk or
logical volume in order for these counters to appear. Disk performance
counters can be enabled by using the Hardware Device Manager property pages.
Status code returned is data DWORD 0.

And the best part is there's no option to re-enable it in the Hardware
Device Manager.

I had better luck when I was running Millennium.

 

[Clyde]

Here's the BSOD info:

STOP: 0x0000000A (0x00BB2190, 0x00000002, 0x00000000, 0x80437D8C)
IRQL_LESS_OR_EQUAL
Address: 80437D8C base at 8040000, DateStamp 40d1d19a - ntoskrnl.exe

 

[Clyde]

Here's the WinDBG info:


*******************************************************************************
* Bugcheck Analysis
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid)
address at an interrupt request level (IRQL) that is too high. This
is usually caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 00bb2190, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000000, value 0 = read operation, 1 = write operation
Arg4: 80437d8c, address which referenced memory

Debugging Details:
------------------

READ_ADDRESS: 00bb2190 Paged pool

CURRENT_IRQL: 2

FAULTING_IP:
nt!MiRemovePteTracker+72
80437d8c 8a11 mov dl,[ecx]

DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: 0xA

LAST_CONTROL_TRANSFER: from 5349203a to 80469d1c

STACK_TEXT:
80474378 5349203a 38382d4f 312d3935 6674752c nt!KiTrap13
WARNING: Frame IP not in any known module. Following frames may be
wrong.
74657372 00000000 00000000 00000000 00000000 0x5349203a


STACK_COMMAND: .bugcheck ; kb

FOLLOWUP_IP:
nt!MiRemovePteTracker+72
80437d8c 8a11 mov dl,[ecx]

FOLLOWUP_NAME: MachineOwner

SYMBOL_NAME: nt!MiRemovePteTracker+72

MODULE_NAME: nt

DEBUG_FLR_IMAGE_TIMESTAMP: 40d1d19a

IMAGE_NAME: memory_corruption

BUCKET_ID: 0xA_nt!MiRemovePteTracker+72

Followup: MachineOwner

 

[Clyde]

Found out that since I have the OS installed on drive D and my swap on
drive C that Windows can't create a dump file. Placed the swapfile on
D, removed the swapfile on C, followed the KB article about how to
configure CrashOnCtrlScroll and forced crash. Mem dump file was
written to target location.

Now maybe I'll at least be able to get a dump file to try to find out
what's going on.

 

[Clyde]

Here's the BSOD info:

STOP: 0x0000000A (0x00BB2190, 0x00000002, 0x00000000, 0x80437D8C)
IRQL_LESS_OR_EQUAL
Address: 80437D8C base at 8040000, DateStamp 40d1d19a - ntoskrnl.exe

 

[Clyde]

Here's the WinDBG info:


*******************************************************************************
* Bugcheck Analysis
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid)
address at an interrupt request level (IRQL) that is too high. This
is usually caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 00bb2190, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000000, value 0 = read operation, 1 = write operation
Arg4: 80437d8c, address which referenced memory

Debugging Details:
------------------

READ_ADDRESS: 00bb2190 Paged pool

CURRENT_IRQL: 2

FAULTING_IP:
nt!MiRemovePteTracker+72
80437d8c 8a11 mov dl,[ecx]

DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: 0xA

LAST_CONTROL_TRANSFER: from 5349203a to 80469d1c

STACK_TEXT:
80474378 5349203a 38382d4f 312d3935 6674752c nt!KiTrap13
WARNING: Frame IP not in any known module. Following frames may be
wrong.
74657372 00000000 00000000 00000000 00000000 0x5349203a


STACK_COMMAND: .bugcheck ; kb

FOLLOWUP_IP:
nt!MiRemovePteTracker+72
80437d8c 8a11 mov dl,[ecx]

FOLLOWUP_NAME: MachineOwner

SYMBOL_NAME: nt!MiRemovePteTracker+72

MODULE_NAME: nt

DEBUG_FLR_IMAGE_TIMESTAMP: 40d1d19a

IMAGE_NAME: memory_corruption

BUCKET_ID: 0xA_nt!MiRemovePteTracker+72

Followup: MachineOwner

 

[Clyde]

Got another BSOD today. Looks like the BSODs all share the same
"address which referenced memory" location of 80437d8c.


IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid)
address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 00bc6558, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000000, value 0 = read operation, 1 = write operation
Arg4: 80437d8c, address which referenced memory