After reboot i get another BSOD when loading Windows. What driver is causing this?
Memory looks fine i have done a MEMTEST for 24 hours without problems.
I get this often while web Browsing. I think the BSODs have often the ending 0E, 8A, 0A
Crash Dump Analysis provided by OSR Open Systems Resources, Inc. (http://www.osr.com)
Online Crash Dump Analysis Service
See http://www.osronline.com for more information
Windows XP Kernel Version 2600 (Service Pack 3) MP (2 procs) Free x86 compatible
Product: WinNt
Built by: 2600.xpsp_sp3_qfe.130704-0421
Machine Name:
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055d720
Debug session time: Thu Mar 5 08:32:11.825 2015 (UTC - 5:00)
System Uptime: 0 days 1:06:17.128
*************************************************************************** ****
* *
* Bugcheck Analysis *
* *
*************************************************************************** ****
IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: b85dbd52, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000000, bitfield :
bit 0 : value 0 = read operation, 1 = write operation
bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: 805288ed, address which referenced memory
Debugging Details:
------------------
TRIAGER: Could not open triage file : e:\dump_analysis\program\triage\modclass.ini, error 2
READ_ADDRESS: GetUlongFromAddress: unable to read from 80561f50
b85dbd52
CURRENT_IRQL: 2
FAULTING_IP:
nt!PopProcessorIdle+d5
805288ed c9 leave
DEFAULT_BUCKET_ID: DRIVER_FAULT
BUGCHECK_STR: 0xA
TRAP_FRAME: b84dbcd4 -- (.trap 0xffffffffb84dbcd4)
ErrCode = 00000000
eax=b8348cd0 ebx=b8348000 ecx=00000d6b edx=00000000 esi=b834ae20 edi=8055c0c0
eip=805288ed esp=b84dbd48 ebp=b85dbd52 iopl=0 nv up ei pl nz ac pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010216
nt!PopProcessorIdle+0xd5:
805288ed c9 leave
Resetting default scope
LAST_CONTROL_TRANSFER: from 805288ed to 8054480c
STACK_TEXT:
b84dbcd4 805288ed badb0d00 00000000 00000600 nt!KiTrap0E+0x180
b85dbd52 00000000 00000000 00000000 00000000 nt!PopProcessorIdle+0xd5
STACK_COMMAND: kb
FOLLOWUP_IP:
nt!PopProcessorIdle+d5
805288ed c9 leave
SYMBOL_STACK_INDEX: 1
SYMBOL_NAME: nt!PopProcessorIdle+d5
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrpamp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 51d4d90f
FAILURE_BUCKET_ID: 0xA_nt!PopProcessorIdle+d5
BUCKET_ID: 0xA_nt!PopProcessorIdle+d5
Followup: MachineOwner
---------
=========================================================================== =========
=========================================================================== =========
Full Dump at Debugging Tools For Windows:
Microsoft (R) Windows Debugger Version 6.12.0002.633 X86
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [C:\WINDOWS\MEMORY.DMP]
Kernel Summary Dump File: Only kernel address space is available
Symbol search path is: *** Invalid ***
*************************************************************************** *
* Symbol loading may be unreliable without a symbol search path. *
* Use .symfix to have the debugger choose a symbol path. *
* After setting your symbol path, use .reload to refresh symbol locations. *
*************************************************************************** *
Executable search path is:
*********************************************************************
* Symbols can not be loaded because symbol path is not initialized. *
* *
* The Symbol Path can be set by: *
* using the _NT_SYMBOL_PATH environment variable. *
* using the -y <symbol_path> argument when starting the debugger. *
* using .sympath and .sympath+ *
*********************************************************************
*** ERROR: Symbol file could not be found. Defaulted to export symbols for ntkrpamp.exe -
Windows XP Kernel Version 2600 (Service Pack 3) MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 2600.xpsp_sp3_qfe.130704-0421
Machine Name:
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055d720
Debug session time: Thu Mar 5 14:32:11.825 2015 (UTC + 1:00)
System Uptime: 0 days 1:06:17.128
*********************************************************************
* Symbols can not be loaded because symbol path is not initialized. *
* *
* The Symbol Path can be set by: *
* using the _NT_SYMBOL_PATH environment variable. *
* using the -y <symbol_path> argument when starting the debugger. *
* using .sympath and .sympath+ *
*********************************************************************
*** ERROR: Symbol file could not be found. Defaulted to export symbols for ntkrpamp.exe -
Loading Kernel Symbols
...............................................................
................................................................
..
Loading User Symbols
Loading unloaded module list
.................
*************************************************************************** ****
* *
* Bugcheck Analysis *
* *
*************************************************************************** ****
Use !analyze -v to get detailed debugging information.
BugCheck A, {b85dbd52, 2, 0, 805288ed}
***** Kernel symbols are WRONG. Please fix symbols to do analysis.
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
*************************************************************************
Probably caused by : ntkrpamp.exe ( nt!PoSetPowerState+871 )
Followup: MachineOwner
---------
1: kd> !analyze -v
*************************************************************************** ****
* *
* Bugcheck Analysis *
* *
*************************************************************************** ****
IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: b85dbd52, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000000, bitfield :
bit 0 : value 0 = read operation, 1 = write operation
bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: 805288ed, address which referenced memory
Debugging Details:
------------------
***** Kernel symbols are WRONG. Please fix symbols to do analysis.
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
*************************************************************************
ADDITIONAL_DEBUG_TEXT:
Use '!findthebuild' command to search for the target build information.
If the build information is available, run '!findthebuild -s ; .reload' to set symbol path and load symbols.
MODULE_NAME: nt
FAULTING_MODULE: 804d7000 nt
DEBUG_FLR_IMAGE_TIMESTAMP: 51d4d90f
READ_ADDRESS: unable to get nt!MmSpecialPoolStart
unable to get nt!MmSpecialPoolEnd
unable to get nt!MmPoolCodeStart
unable to get nt!MmPoolCodeEnd
b85dbd52
CURRENT_IRQL: 2
FAULTING_IP:
nt!PoSetPowerState+871
805288ed c9 leave
DEFAULT_BUCKET_ID: DRIVER_FAULT
BUGCHECK_STR: 0xA
LAST_CONTROL_TRANSFER: from 805288ed to 8054480c
STACK_TEXT:
WARNING: Stack unwind information not available. Following frames may be wrong.
b84dbcd4 805288ed badb0d00 00000000 00000600 nt!Kei386EoiHelper+0x27a0
b84dbd50 80545e6c 00000000 0000000e e4f6e4f6 nt!PoSetPowerState+0x871
b84dbd54 00000000 0000000e e4f6e4f6 e4f6e4f6 nt!KiDispatchInterrupt+0x38c
STACK_COMMAND: kb
FOLLOWUP_IP:
nt!PoSetPowerState+871
805288ed c9 leave
SYMBOL_STACK_INDEX: 1
SYMBOL_NAME: nt!PoSetPowerState+871
FOLLOWUP_NAME: MachineOwner
IMAGE_NAME: ntkrpamp.exe
BUCKET_ID: WRONG_SYMBOLS
Followup: MachineOwner
---------
Memory looks fine i have done a MEMTEST for 24 hours without problems.
I get this often while web Browsing. I think the BSODs have often the ending 0E, 8A, 0A
Crash Dump Analysis provided by OSR Open Systems Resources, Inc. (http://www.osr.com)
Online Crash Dump Analysis Service
See http://www.osronline.com for more information
Windows XP Kernel Version 2600 (Service Pack 3) MP (2 procs) Free x86 compatible
Product: WinNt
Built by: 2600.xpsp_sp3_qfe.130704-0421
Machine Name:
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055d720
Debug session time: Thu Mar 5 08:32:11.825 2015 (UTC - 5:00)
System Uptime: 0 days 1:06:17.128
*************************************************************************** ****
* *
* Bugcheck Analysis *
* *
*************************************************************************** ****
IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: b85dbd52, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000000, bitfield :
bit 0 : value 0 = read operation, 1 = write operation
bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: 805288ed, address which referenced memory
Debugging Details:
------------------
TRIAGER: Could not open triage file : e:\dump_analysis\program\triage\modclass.ini, error 2
READ_ADDRESS: GetUlongFromAddress: unable to read from 80561f50
b85dbd52
CURRENT_IRQL: 2
FAULTING_IP:
nt!PopProcessorIdle+d5
805288ed c9 leave
DEFAULT_BUCKET_ID: DRIVER_FAULT
BUGCHECK_STR: 0xA
TRAP_FRAME: b84dbcd4 -- (.trap 0xffffffffb84dbcd4)
ErrCode = 00000000
eax=b8348cd0 ebx=b8348000 ecx=00000d6b edx=00000000 esi=b834ae20 edi=8055c0c0
eip=805288ed esp=b84dbd48 ebp=b85dbd52 iopl=0 nv up ei pl nz ac pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010216
nt!PopProcessorIdle+0xd5:
805288ed c9 leave
Resetting default scope
LAST_CONTROL_TRANSFER: from 805288ed to 8054480c
STACK_TEXT:
b84dbcd4 805288ed badb0d00 00000000 00000600 nt!KiTrap0E+0x180
b85dbd52 00000000 00000000 00000000 00000000 nt!PopProcessorIdle+0xd5
STACK_COMMAND: kb
FOLLOWUP_IP:
nt!PopProcessorIdle+d5
805288ed c9 leave
SYMBOL_STACK_INDEX: 1
SYMBOL_NAME: nt!PopProcessorIdle+d5
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrpamp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 51d4d90f
FAILURE_BUCKET_ID: 0xA_nt!PopProcessorIdle+d5
BUCKET_ID: 0xA_nt!PopProcessorIdle+d5
Followup: MachineOwner
---------
=========================================================================== =========
=========================================================================== =========
Full Dump at Debugging Tools For Windows:
Microsoft (R) Windows Debugger Version 6.12.0002.633 X86
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [C:\WINDOWS\MEMORY.DMP]
Kernel Summary Dump File: Only kernel address space is available
Symbol search path is: *** Invalid ***
*************************************************************************** *
* Symbol loading may be unreliable without a symbol search path. *
* Use .symfix to have the debugger choose a symbol path. *
* After setting your symbol path, use .reload to refresh symbol locations. *
*************************************************************************** *
Executable search path is:
*********************************************************************
* Symbols can not be loaded because symbol path is not initialized. *
* *
* The Symbol Path can be set by: *
* using the _NT_SYMBOL_PATH environment variable. *
* using the -y <symbol_path> argument when starting the debugger. *
* using .sympath and .sympath+ *
*********************************************************************
*** ERROR: Symbol file could not be found. Defaulted to export symbols for ntkrpamp.exe -
Windows XP Kernel Version 2600 (Service Pack 3) MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 2600.xpsp_sp3_qfe.130704-0421
Machine Name:
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055d720
Debug session time: Thu Mar 5 14:32:11.825 2015 (UTC + 1:00)
System Uptime: 0 days 1:06:17.128
*********************************************************************
* Symbols can not be loaded because symbol path is not initialized. *
* *
* The Symbol Path can be set by: *
* using the _NT_SYMBOL_PATH environment variable. *
* using the -y <symbol_path> argument when starting the debugger. *
* using .sympath and .sympath+ *
*********************************************************************
*** ERROR: Symbol file could not be found. Defaulted to export symbols for ntkrpamp.exe -
Loading Kernel Symbols
...............................................................
................................................................
..
Loading User Symbols
Loading unloaded module list
.................
*************************************************************************** ****
* *
* Bugcheck Analysis *
* *
*************************************************************************** ****
Use !analyze -v to get detailed debugging information.
BugCheck A, {b85dbd52, 2, 0, 805288ed}
***** Kernel symbols are WRONG. Please fix symbols to do analysis.
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
*************************************************************************
Probably caused by : ntkrpamp.exe ( nt!PoSetPowerState+871 )
Followup: MachineOwner
---------
1: kd> !analyze -v
*************************************************************************** ****
* *
* Bugcheck Analysis *
* *
*************************************************************************** ****
IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: b85dbd52, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000000, bitfield :
bit 0 : value 0 = read operation, 1 = write operation
bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: 805288ed, address which referenced memory
Debugging Details:
------------------
***** Kernel symbols are WRONG. Please fix symbols to do analysis.
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
*************************************************************************
ADDITIONAL_DEBUG_TEXT:
Use '!findthebuild' command to search for the target build information.
If the build information is available, run '!findthebuild -s ; .reload' to set symbol path and load symbols.
MODULE_NAME: nt
FAULTING_MODULE: 804d7000 nt
DEBUG_FLR_IMAGE_TIMESTAMP: 51d4d90f
READ_ADDRESS: unable to get nt!MmSpecialPoolStart
unable to get nt!MmSpecialPoolEnd
unable to get nt!MmPoolCodeStart
unable to get nt!MmPoolCodeEnd
b85dbd52
CURRENT_IRQL: 2
FAULTING_IP:
nt!PoSetPowerState+871
805288ed c9 leave
DEFAULT_BUCKET_ID: DRIVER_FAULT
BUGCHECK_STR: 0xA
LAST_CONTROL_TRANSFER: from 805288ed to 8054480c
STACK_TEXT:
WARNING: Stack unwind information not available. Following frames may be wrong.
b84dbcd4 805288ed badb0d00 00000000 00000600 nt!Kei386EoiHelper+0x27a0
b84dbd50 80545e6c 00000000 0000000e e4f6e4f6 nt!PoSetPowerState+0x871
b84dbd54 00000000 0000000e e4f6e4f6 e4f6e4f6 nt!KiDispatchInterrupt+0x38c
STACK_COMMAND: kb
FOLLOWUP_IP:
nt!PoSetPowerState+871
805288ed c9 leave
SYMBOL_STACK_INDEX: 1
SYMBOL_NAME: nt!PoSetPowerState+871
FOLLOWUP_NAME: MachineOwner
IMAGE_NAME: ntkrpamp.exe
BUCKET_ID: WRONG_SYMBOLS
Followup: MachineOwner
---------