|
Mike has a good point - but if it is the RAM, CPU, or CPU fan that's failing, there's a good chance that each dump you analyze will show a different location and/or bugcheck codes.
If the dumps are consistent, I'd do some further digging and/or start speculating on drivers and such.
Again as Mike mentioned, it's unlikely that NtWaitForMultipleObjects is the real culprit. Looks like you're going to have to dig a little deeper into the dump to find the problem. This initial analysis isn't giving you the stack trace you need, which I think is a result of trapping into the exception dispatcher.
Here's a doc that might be helpful:
http://www.wd-3.com/archive/registercontext.htm[^]
You may need more than a mini dump to work with - not sure.
If you've got the time, you might try using WinDbg on a remote machine. I'm pretty sure that you would break into the debugger before the bugcheck call in response to a first chance exception, which might give you a better context to work with.
|
|
|
|
|
Wow, thank you very much for the responses.
I've though about it more and here is some additional information to possibly filter out or confirm any theories.
Here is the reasons from other dumps from the series of crashes:
IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: f000e2d9, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000000, value 0 = read operation, 1 = write operation
Arg4: 8042d37c, address which referenced memory
PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced. This cannot be protected by try-except,
it must be protected by a Probe. Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: e3522097, memory referenced.
Arg2: 00000001, value 0 = read operation, 1 = write operation.
Arg3: bcfb127c, If non-zero, the instruction address which referenced the bad memory address.
Arg4: 00000001, (reserved)
DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: 00000028, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000000, value 0 = read operation, 1 = write operation
Arg4: bd525f25, address which referenced memory
I doubt it is overheating. I don't overclock and I monitor my chipset, CPU, power, and case fans. I also keep the case open 24/7.
There's been no recent hardware or driver changes in the system.
I am actually on day 2 without a crash now. But it went down about 6 times earlier this week. This also happened about 2 months ago and then magically started working fine.
Is it possible for the ntorkrnl.exe to be corrupt? I dunno.
When it crashes, sometimes I'd be playing a game, sometimes web browsing. One time it crashed while I was trying to log off of windows the exact second I clicked "OK".
I would try debugging on a remote machine, my all my other computers are either some kind of unix or linux.
-Mike
|
|
|
|
|
I would think that the dumps for these should reference some kind of .sys file, not ntoskrnl.exe - that would help.
Sure looks wonky though.
Anonymous wrote:
Is it possible for the ntorkrnl.exe to be corrupt?
Anythings possible - you can actually update your ntoskrnl.exe and HAL files directly from the install disk if you like - there are usually checked and free versions for single and multiple CPUs available (hmmm - actually, I think the checked one is multi cpu). Google for 'partially checked' etc for instructions.
It is possible for a reeely bad driver to produce seemingly random BSODs - I know - I've done it!  But its hard to shake the hardware idea in this case - do these crashes repeat with the same data?
Will ponder till morning. Keep us posted!
|
|
|
|
|
Anonymous wrote:
I also keep the case open 24/7.
Don't. Airflow is typically better if you assemble the case properly. If it still gets too hot, you need an exhaust fan in the box and reasonable airflow in the room - if you put the back of the system too close to the wall, the hot air has nowhere to go and simply gets sucked straight back into the system. Cooling systems work best with a low ambient temperature.
My P4 2.8GHz system has the normal PSU fan, CPU fan and a fan on the graphics card, but it also has a smallish 8cm fan in the front of the case and a 12cm fan in the back. All those fans are quite noisy, which is why I used a case which comes with a large amount of acoustic wadding (from QuietPC.com[^]). The fans mostly came from QuietPC as well, but five fans still make quite a bit of noise.
Stability. What an interesting concept. -- Chris Maunder
|
|
|
|
|
Blah. Another crash after 2 days. The computer was idle. It crashed while I was in the other room. There was no programs running.
Microsoft (R) Windows Debugger Version 6.3.0017.0
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [C:\WINNT\Minidump\Mini070904-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: C:\WINNT\Symbols
Executable search path is:
Unable to load image ntoskrnl.exe, Win32 error 2
Windows 2000 Kernel Version 2195 (Service Pack 4) UP Free x86 compatible
Kernel base = 0x80400000 PsLoadedModuleList = 0x8046e8f0
Debug session time: Fri Jul 09 18:15:50 2004
System Uptime: not available
Unable to load image ntoskrnl.exe, Win32 error 2
Loading Kernel Symbols
........................................................................................................
Loading unloaded module list
.......................................
Loading User Symbols
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 7F, {d, 0, 0, 0}
Probably caused by : ntoskrnl.exe ( nt!KiSystemFatalException+e )
Followup: MachineOwner
---------
kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
UNEXPECTED_KERNEL_MODE_TRAP (7f)
This means a trap occurred in kernel mode, and it's a trap of a kind
that the kernel isn't allowed to have/catch (bound trap) or that
is always instant death (double fault). The first number in the
bugcheck params is the number of the trap (8 = double fault, etc)
Consult an Intel x86 family manual to learn more about what these
traps are. Here is a *portion* of those codes:
If kv shows a taskGate
use .tss on the part before the colon, then kv.
Else if kv shows a trapframe
use .trap on that value
Else
.trap on the appropriate frame will show where the trap was taken
(on x86, this will be the ebp that goes with the procedure KiTrap)
Endif
kb will then show the corrected stack.
Arguments:
Arg1: 0000000d, EXCEPTION_GP_FAULT
Arg2: 00000000
Arg3: 00000000
Arg4: 00000000
Debugging Details:
------------------
BUGCHECK_STR: 0x7f_d
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: DRIVER_FAULT
LAST_CONTROL_TRANSFER: from 8049747e to 80469822
STACK_TEXT:
ed17f7dc 8049747e ed17f84c e37194b0 00000000 nt!KiSystemFatalException+0xe
ed17f854 8049803f e32ff728 00200080 ed17f8b8 nt!HvpGetCellPaged+0x35
ed17f864 80497b44 e37f0568 ed17f8f8 00000000 nt!CmpQuerySecurityDescriptorInfo+0x10
ed17f8b8 804507ac e3e99140 00000001 ed17f8f8 nt!CmpSecurityMethod+0xb4
ed17f8f0 8045043d 0000000f ed17f91c ed17f910 nt!ObGetObjectSecurity+0x60
ed17f920 80497dd1 e3e99140 ed17fbf4 00000001 nt!ObCheckObjectAccess+0x28
ed17f948 804976f2 e32ff728 0000e500 e331f504 nt!CmpDoOpen+0x210
ed17fb40 804516eb e32ff728 818a89e0 ed17fbf4 nt!CmpParseKey+0x389
ed17fbb4 80496299 000001e0 ed17fcb0 00000040 nt!ObpLookupObjectName+0xdf
ed17fcc4 80497c7c 00000000 818a89e0 8122da01 nt!ObOpenObjectByName+0xc5
ed17fd50 80465b91 0006fd2c 00020019 0006f59c nt!NtOpenKey+0x151
ed17fd50 77f833c0 0006fd2c 00020019 0006f59c nt!KiSystemService+0xc4
WARNING: Frame IP not in any known module. Following frames may be wrong.
0006f540 00000000 00000000 00000000 00000000 0x77f833c0
FOLLOWUP_IP:
nt!KiSystemFatalException+e
80469822 ?? ???
SYMBOL_STACK_INDEX: 0
FOLLOWUP_NAME: MachineOwner
SYMBOL_NAME: nt!KiSystemFatalException+e
MODULE_NAME: nt
IMAGE_NAME: ntoskrnl.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 4047db83
STACK_COMMAND: kb
BUCKET_ID: 0x7f_d_nt!KiSystemFatalException+e
Followup: MachineOwner
I havent had this error yet. Whats this one all about?
|
|
|
|
|
I have new RAM on order BTW. It's my guess that the RAM is the possible culprit.
|
|
|
|
|
See Win32 Error Codes[^] for clues. For one thing, Win32 Error 2 indicates that a file could not be found. Secondly, a driver fault is indicated. The line:
"WARNING: Frame IP not in any known module. Following frames may be wrong.
0006f540 00000000 00000000 00000000 00000000 0x77f833c0"
Indicates that the Instruction pointer is referencing a memory address that Windows doesn't recognize as being in use, hence the data there is probably invalid. Executing it will most likely cause a serious failure.
I suspect that a driver has become corrupted; isolating it will be a tedious process. Boot in Step-by-Step Confirmation mode and disable all driver loading except the basics - disk controller, keyboard, mouse, video, etc. If the failure happens on this load, you may have a motherboard or firmware (BIOS) problem. If the problem doesn't recur, boot again and enable loading of a few drivers, then wait for a failure. If none occurs, reboot again and add a few more drivers to the allowed set, repeating this procedure until a failure happens. Go back a step and enable the most recent group of enabled drivers one at a time to determine which one causes the failure. Replace that driver from the original media or with an updated version compatible with your OS version.
You might also have a version conflict among the many dlls used by Windows, but the error logs don't look like that's the problem this time. Running SFC from the Start/Run menu may reveal something useful.
"My kid was Inmate of the Month at Adobe Mountain Juvenile Corrections Center" - Bumper Sticker in Bullhead City
|
|
|
|
|
Sad, sad day...
Microsoft (R) Windows Debugger Version 6.3.0017.0
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [C:\WINNT\Minidump\Mini070904-02.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: C:\WINNT\Symbols
Executable search path is:
Unable to load image ntoskrnl.exe, Win32 error 2
Windows 2000 Kernel Version 2195 (Service Pack 4) UP Free x86 compatible
Kernel base = 0x80400000 PsLoadedModuleList = 0x8046e8f0
Debug session time: Fri Jul 09 19:19:50 2004
System Uptime: not available
Unable to load image ntoskrnl.exe, Win32 error 2
Loading Kernel Symbols
.......................................................................................................
Loading unloaded module list
..........
Loading User Symbols
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck A, {a668c4d0, 2, 1, 80448ed8}
Unable to load image SYMEVENT.SYS, Win32 error 2
*** WARNING: Unable to verify timestamp for SYMEVENT.SYS
*** ERROR: Module load completed but symbols could not be loaded for SYMEVENT.SYS
Probably caused by : SYMEVENT.SYS ( SYMEVENT+4a7e )
Followup: MachineOwner
---------
kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: a668c4d0, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000001, value 0 = read operation, 1 = write operation
Arg4: 80448ed8, address which referenced memory
Debugging Details:
------------------
WRITE_ADDRESS: unable to read from 80483450
unable to read from 80482ea8
unable to read from 80482d78
unable to read from 80475234
unable to read from 80482d90
unable to read from 80482ea4
unable to read from 80475238
unable to read from 80482f64
unable to read from 80483420
a668c4d0
CURRENT_IRQL: 2
FAULTING_IP:
nt!MiRemovePageFromList+55
80448ed8 ?? ???
CUSTOMER_CRASH_COUNT: 2
DEFAULT_BUCKET_ID: DRIVER_FAULT
BUGCHECK_STR: 0xA
LAST_CONTROL_TRANSFER: from 804494c9 to 80448ed8
TRAP_FRAME: bd1b4938 -- (.trap ffffffffbd1b4938)
ErrCode = 00000002
eax=649b6a99 ebx=ffffffff ecx=818d7000 edx=81a56e20 esi=818d6fe8 edi=80474c30
eip=80448ed8 esp=bd1b49ac ebp=bd1b49ec iopl=0 nv up ei ng nz ac pe cy
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010293
nt!MiRemovePageFromList+0x55:
80448ed8 ?? ???
Resetting default scope
STACK_TEXT:
bd1b49b4 804494c9 863b3c28 80442b78 e39610a4 nt!MiRemovePageFromList+0x55
bd1b49bc 80442b78 e39610a4 fffff000 004884d0 nt!MiRemoveAnyPage+0x6f
bd1b49ec 804425e1 ffb977c0 863b3c7c 00001000 nt!MiResolveMappedFileFault+0x319
bd1b4a18 80441960 00000000 cfbe909c c033efa4 nt!MiResolveProtoPteFault+0x128
bd1b4a60 8044ad48 00000000 cfbe909c c033efa4 nt!MiDispatchFault+0x13d
bd1b4aac 80447c52 00000000 00000000 00000000 nt!MmAccessFault+0x682
bd1b4adc 8040dbc8 cfbe909c 00000000 ffba1028 nt!MmCheckCachedPageState+0x28e
bd1b4b9c 804c971a ffba1028 0002909c 00000400 nt!CcFastCopyRead+0x1d5
bd1b4c20 bd050a7e ffba1028 bd1b4cfc 00000400 nt!FsRtlCopyRead+0x1c9
WARNING: Stack unwind information not available. Following frames may be wrong.
00000000 00000000 00000000 00000000 00000000 SYMEVENT+0x4a7e
FOLLOWUP_IP:
SYMEVENT+4a7e
bd050a7e ?? ???
SYMBOL_STACK_INDEX: 9
FOLLOWUP_NAME: MachineOwner
SYMBOL_NAME: SYMEVENT+4a7e
MODULE_NAME: SYMEVENT
IMAGE_NAME: SYMEVENT.SYS
DEBUG_FLR_IMAGE_TIMESTAMP: 3f31ac37
STACK_COMMAND: .trap ffffffffbd1b4938 ; kb
BUCKET_ID: 0xA_W_SYMEVENT+4a7e
Followup: MachineOwner
---------
|
|
|
|
|
This is so frustrating, because I'm good with computers and I take good care of this on. The only damn reason I'm using windows is so I can play counter-strike.
|
|
|
|
|
This looks to me like pesky hardware failure.
The double fault above is particularly indicative - essentially, it couldn't even blue screen [edit]/trap the exception[/edit] properly.
Verifying a solution will be tough.
You could remove the paint and slip a new machine underneath, but that seems overly pessimistic.
I wonder if you could monitor the CPU temp somehow. I have seen machines bs when their fans got stuck, and these are the sort of [edit]useless[/edit] bugchecks you get. If we had a graph of CPU temp redlining, or not, it might give us something to work with.
A colleague had a open box at the office that would bs if you touched the ram. Often, we would taunt him a second time! 
I leave you now with some pithy quotes:
"If you would see the invisible, you must look carefully at the visible" Santayana
"Eliminate the impossible, and all that is left, however improbable, must be the truth" S. Holmes.
"The Force Luke... use the Force" O.Kenobi
Whatever. Keep us posted, and good luck.
|
|
|
|
|
Hi all..
I've installed an IIS WebServer in a server and all the users in the LAN must be able to access that.When we are trying to develop a web application and run it on a different system,It is posting an error saying "Error while trying to run project:Unable to start debugging on the web server.Access is denied"
Though i've given debugger permissions for all on the server,its not working.can any one help me out in this issue.
|
|
|
|
|
|
My ASP.NET web applicaton includes a window media player (wmp) object. I'm using that wmp object to play a .wmv file in the network share folder.
something like
<object style="Z-INDEX: 0; LEFT: 0px; RIGHT: 0px; TOP: 0px; BOTTOM= 0px; WIDTH= 100%; HEIGHT= 100%" classid="clsid:6BF52A52-394A-11D3-B153-00C04F79FAA6" id="winMediaPlayer">
<param name="URL" value="\\192.168.100.100\sharefolder\video.wmv" />
Form1.winMediaPlayer.controls.stop();
However, since at the moment I can not include the username/password to access the folder in the url, Windows Media Player gives an error message
"Windows Media Player can not copy or play the file because the server denied access to it. Verify that you have access rights to the file, and then try again".
Note that no authentication window appeared so that I could authenticate. wmp simply gave the above error message. That is the reason I want to include the username and password in the URL.
Is it possible to include the username and password within the URL \\serverIP\sharedFolder\filename.wmv ?
I know how to do that in a ftp or http URL such as ftp://username:password@serverIP/filename http://username:password@serverIP/filename.html, but not with the above URL.
Thanks.
|
|
|
|
|
I want to format my win98 and install it again. I have a dial up connection on it which I forget its password. I want to use it again after I format/install myy win98. I know some utility like pwl tool or unlock password which I can get that password, but I can't find them. Could someone please give me FREE download of one of these utilities.
Mazy
"One who dives deep gets the pearls,the burning desire for realization brings the goal nearer." - Babuji
|
|
|
|
|
How about your ISP? if it is possible you could ask your ISP for your password. Once you have it, you could proceed your task.
Roath Kanel
APO-CEDC
Save Children Norway-Cambodia Office
|
|
|
|
|
i mean upgrading as of releasing patches, giving support, etc
Anybody know anything about this?
this made me wonder about that:
<url>http://user.cs.tu-berlin.de/~normanb/
|
|
|
|
|
|
This news article[^] from April says that Microsoft will be working on Windows 2000 SP5 once XP SP2 is released (although there's probably quite a bit of parallel running). An interview with Bob Muglia[^] confirms what will be in SP5.
Extended support continues until 2010 - see the Lifecycle Support Policy FAQ[^]:
"Extended support includes all paid support options and security-related hotfix support that is provided at no charge. Hotfix support that is not security-related requires a separate extended hotfix support contract to be purchased within 90 days after mainstream support ends. Microsoft will not accept requests for warranty support, design changes, or new features during the extended support phase."
Stability. What an interesting concept. -- Chris Maunder
|
|
|
|
|
Hi, i have a problem with my outlook express and outlook. I create new account for an e-mail system, i choose POP3/SMTP account type from the screen wizard. I type my user name and password. I also type pop.mail.yahoo.com and smtp.mail.yahoo.com for POP and SMTP. But when I connect to get an e-mail the machine is asking me many time to fill the information about user name and password. Does anyone know about this problem?
Roath Kanel
APO-CEDC
Save Children Norway-Cambodia Office
|
|
|
|
|
I have a harddisk which has 2 partitions. The first one C:(active partition) contains Windows 2000. Now i wish to move this OS to the second partition D: and make my computer boot from this partition. Is it possible? If so, how should i go about doing it?
<font=arial>Weiye Chen
When pursuing your dreams, don't forget to enjoy your life...
|
|
|
|
|
You'll have to reinstall Windows, and repartition the drive to make D: the primary partition. Extended partitions can be renamed, but not the boot partition. It gets really interesting on multiple drive systems - mine, for instance, boots to drive J: because of the peculiar arrangement of primary and extended partitions I had on the existing drives before I reinstalled Windows. Why do you want to make this move?
Some people think of it as a six-pack; I consider it more of a support group.
|
|
|
|
|
I'm hoping someone knows enough about the history of Windows to explain some things. First, why would trackbars send WM_SCROLL messages? Even if they were going for a sort of backward compatibility that would have allowed programs that used scrollbars as trackbars to be upgraded just from resource changes, it seems to me that trackbars could have supported a mode that would have allowed them to send messages of a type that frameworks wouldn't already use for scrolling. Why did they make it so hard to use?
Also, the MSDN documentation says that TB_THUMBPOSITION is "WM_LBUTTONUP following a TB_THUMBTRACK notification message." This message would actually be useful if it were sent when the trackbar's position were updated by the keyboard. Instead, I have to check for every message except TB_THUMBTRACK and see if the position is different from my last recorded position to decide when a lasting adjustment to a thumb position is made. Why didn't they make TB_THUMBPOSITION work for that?
Nathan Holt
|
|
|
|
|
I'm currently running Windows XP on a LAN.
Using the OS ability to share folders and drives, I can enable my collegues to gain access to various parts of my PC. However I don't seem to be able to do this for mapped networked drives:
+ My Documents
- My Computer
+ (C)
+ DVD Drive(D)
+ (F) \\Somewhere\Somehow\
+ (G) \\Somewhere\Somehow\
+ (H) \\Somewhere\Somehow\
+ (I) \\Somewhere\Somehow\
So, from the above example, I can share my 'C' and 'D' drives and even parts of the 'My Documents' folder; but I cannot enable others to see my mapped 'F', 'G' etc, networked drives. Is there anyway that this can be done?
I Dream of Absolute Zero
|
|
|
|
|
If you can it is a bug in windows, at least by some arguments. Just because you have access to something does not mean you should be allowed to share it. Others who want access should get it from the origional server.
Note that there isn't much consences in the security community over this. However Microsoft appears to have taken the above position, and overall I'd say it is a good decision.
|
|
|
|
|
Hello, I have tried unsuccessfully on many sites to find the answer to this so kudos if you have any insight.
I am using schtasks
schtasks /Create /S WS2 /RU Administrator /RP Foobar /SC ONSTART /TN MyTask /TR C:\Admin\RunMe.bat
to create a task on a windows xp workstation remotely that runs a SYSTEM boot up. When I create the task remotely, occasionnaly it works fine, but usually i get a:
"trust relationship for this workstation and the primary domain failed"
error. I believe this might have something to do with the task trying to run before the network is fully set up etc, or somethign funky with active directory. If I run the task immedietly it works fine, only when I try to run the task on start, and only occasionally. The funny thing is, when I create the task I use the local Admin username and password, but I think it may fail because it seems to try to authenticate the credentials that I used to log into the machine to create the task FROM. Anyone know why this is happening and how to fix it?
thanks
steve
|
|
|
|
|
General 
News 
Suggestion 
Question 
Bug 
Answer 
Joke 
Praise 
Rant 
Admin 
Submit an article or tip
