Jump to content

Welcome to Geeks to Go - Register now for FREE

Need help with your computer or device? Want to learn new tech skills? You're in the right place!
Geeks to Go is a friendly community of tech experts who can solve any problem you have. Just create a free account and post your question. Our volunteers will reply quickly and guide you through the steps. Don't let tech troubles stop you. Join Geeks to Go now and get the support you need!

How it Works Create Account
Photo

XP PRO BSOD


  • Please log in to reply

#1
littlepaws

littlepaws

    Member

  • Member
  • PipPip
  • 89 posts
Getting Intermitnt BSOD

IRQL_NOT_LESS_OR_EQUAL
STOP: 0X0000000A (0X006C280, 0X0000002, 0X00000000 , 0X80520689)

Below is details of memory dump


Microsoft ® Windows Debugger Version 6.12.0002.633 X86
Copyright © Microsoft Corporation. All rights reserved.


Loading Dump File [C:\WINDOWS\Minidump\Mini052510-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: *** Invalid ***
****************************************************************************
* Symbol loading may be unreliable without a symbol search path. *
* Use .symfix to have the debugger choose a symbol path. *
* After setting your symbol path, use .reload to refresh symbol locations. *
****************************************************************************
Executable search path is:
*********************************************************************
* Symbols can not be loaded because symbol path is not initialized. *
* *
* The Symbol Path can be set by: *
* using the _NT_SYMBOL_PATH environment variable. *
* using the -y <symbol_path> argument when starting the debugger. *
* using .sympath and .sympath+ *
*********************************************************************
Unable to load image ntoskrnl.exe, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
*** ERROR: Module load completed but symbols could not be loaded for ntoskrnl.exe
Windows XP Kernel Version 2600 (Service Pack 3) MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Machine Name:
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055d720
Debug session time: Mon May 24 21:57:24.109 2010 (UTC + 1:00)
System Uptime: 0 days 4:04:01.828
*********************************************************************
* Symbols can not be loaded because symbol path is not initialized. *
* *
* The Symbol Path can be set by: *
* using the _NT_SYMBOL_PATH environment variable. *
* using the -y <symbol_path> argument when starting the debugger. *
* using .sympath and .sympath+ *
*********************************************************************
Unable to load image ntoskrnl.exe, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
*** ERROR: Module load completed but symbols could not be loaded for ntoskrnl.exe
Loading Kernel Symbols
...............................................................
........................................................
Loading User Symbols
Loading unloaded module list
...............
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1000000A, {c006c280, 2, 0, 80520689}

***** Kernel symbols are WRONG. Please fix symbols to do analysis.

*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!KPRCB ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!KPRCB ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
*************************************************************************
Probably caused by : ntoskrnl.exe ( nt+49689 )

Followup: MachineOwner
---------

1: kd> .restart /f

Loading Dump File [C:\WINDOWS\Minidump\Mini052510-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: http://msdl.microsof...ownload/symbols
Executable search path is:
Windows XP Kernel Version 2600 (Service Pack 3) MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 2600.xpsp_sp3_gdr.100216-1514
Machine Name:
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055d720
Debug session time: Mon May 24 21:57:24.109 2010 (UTC + 1:00)
System Uptime: 0 days 4:04:01.828
Loading Kernel Symbols
...............................................................
........................................................
Loading User Symbols
Loading unloaded module list
...............
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1000000A, {c006c280, 2, 0, 80520689}

Probably caused by : Unknown_Image ( nt!KiTrap0E+d0 )

Followup: MachineOwner
---------

1: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: c006c280, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000000, bitfield :
bit 0 : value 0 = read operation, 1 = write operation
bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: 80520689, address which referenced memory

Debugging Details:
------------------


READ_ADDRESS: c006c280

CURRENT_IRQL: 2

FAULTING_IP:
nt!MmAccessFault+cab
80520689 8b07 mov eax,dword ptr [edi]

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: 0xA

PROCESS_NAME: QBMsgMgr.exe

TRAP_FRAME: b46f7b34 -- (.trap 0xffffffffb46f7b34)
ErrCode = 00000004
eax=00000000 ebx=00000000 ecx=5d090000 edx=7c90e514 esi=00000000 edi=00000000
eip=7c9102f6 esp=0012ecfc ebp=0012ed24 iopl=0 nv up ei pl zr na pe nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00010246
001b:7c9102f6 ?? ???
Resetting default scope

LAST_CONTROL_TRANSFER: from 805445b0 to 80520689

STACK_TEXT:
b46f7b1c 805445b0 00000000 5d090000 00000001 nt!MmAccessFault+0xcab
b46f7b1c 7c9102f6 00000000 5d090000 00000001 nt!KiTrap0E+0xd0
WARNING: Frame IP not in any known module. Following frames may be wrong.
0012ed24 00000000 00000000 00000000 00000000 0x7c9102f6


STACK_COMMAND: kb

FOLLOWUP_IP:
nt!KiTrap0E+d0
805445b0 85c0 test eax,eax

SYMBOL_STACK_INDEX: 1

SYMBOL_NAME: nt!KiTrap0E+d0

FOLLOWUP_NAME: MachineOwner

IMAGE_NAME: Unknown_Image

DEBUG_FLR_IMAGE_TIMESTAMP: 0

BUCKET_ID: RAISED_IRQL_USER_FAULT

MODULE_NAME: Unknown_Module

Followup: MachineOwner
---------

1: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: c006c280, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000000, bitfield :
bit 0 : value 0 = read operation, 1 = write operation
bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: 80520689, address which referenced memory

Debugging Details:
------------------


READ_ADDRESS: c006c280

CURRENT_IRQL: 2

FAULTING_IP:
nt!MmAccessFault+cab
80520689 8b07 mov eax,dword ptr [edi]

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: 0xA

PROCESS_NAME: QBMsgMgr.exe

TRAP_FRAME: b46f7b34 -- (.trap 0xffffffffb46f7b34)
ErrCode = 00000004
eax=00000000 ebx=00000000 ecx=5d090000 edx=7c90e514 esi=00000000 edi=00000000
eip=7c9102f6 esp=0012ecfc ebp=0012ed24 iopl=0 nv up ei pl zr na pe nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00010246
001b:7c9102f6 ?? ???
Resetting default scope

LAST_CONTROL_TRANSFER: from 805445b0 to 80520689

STACK_TEXT:
b46f7b1c 805445b0 00000000 5d090000 00000001 nt!MmAccessFault+0xcab
b46f7b1c 7c9102f6 00000000 5d090000 00000001 nt!KiTrap0E+0xd0
WARNING: Frame IP not in any known module. Following frames may be wrong.
0012ed24 00000000 00000000 00000000 00000000 0x7c9102f6


STACK_COMMAND: kb

FOLLOWUP_IP:
nt!KiTrap0E+d0
805445b0 85c0 test eax,eax

SYMBOL_STACK_INDEX: 1

SYMBOL_NAME: nt!KiTrap0E+d0

FOLLOWUP_NAME: MachineOwner

IMAGE_NAME: Unknown_Image

DEBUG_FLR_IMAGE_TIMESTAMP: 0

BUCKET_ID: RAISED_IRQL_USER_FAULT

MODULE_NAME: Unknown_Module

Followup: MachineOwner
---------

1: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: c006c280, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000000, bitfield :
bit 0 : value 0 = read operation, 1 = write operation
bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: 80520689, address which referenced memory

Debugging Details:
------------------


READ_ADDRESS: c006c280

CURRENT_IRQL: 2

FAULTING_IP:
nt!MmAccessFault+cab
80520689 8b07 mov eax,dword ptr [edi]

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: 0xA

PROCESS_NAME: QBMsgMgr.exe

TRAP_FRAME: b46f7b34 -- (.trap 0xffffffffb46f7b34)
ErrCode = 00000004
eax=00000000 ebx=00000000 ecx=5d090000 edx=7c90e514 esi=00000000 edi=00000000
eip=7c9102f6 esp=0012ecfc ebp=0012ed24 iopl=0 nv up ei pl zr na pe nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00010246
001b:7c9102f6 ?? ???
Resetting default scope

LAST_CONTROL_TRANSFER: from 805445b0 to 80520689

STACK_TEXT:
b46f7b1c 805445b0 00000000 5d090000 00000001 nt!MmAccessFault+0xcab
b46f7b1c 7c9102f6 00000000 5d090000 00000001 nt!KiTrap0E+0xd0
WARNING: Frame IP not in any known module. Following frames may be wrong.
0012ed24 00000000 00000000 00000000 00000000 0x7c9102f6


STACK_COMMAND: kb

FOLLOWUP_IP:
nt!KiTrap0E+d0
805445b0 85c0 test eax,eax

SYMBOL_STACK_INDEX: 1

SYMBOL_NAME: nt!KiTrap0E+d0

FOLLOWUP_NAME: MachineOwner

IMAGE_NAME: Unknown_Image

DEBUG_FLR_IMAGE_TIMESTAMP: 0

BUCKET_ID: RAISED_IRQL_USER_FAULT

MODULE_NAME: Unknown_Module

Followup: MachineOwner
---------

1: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: c006c280, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000000, bitfield :
bit 0 : value 0 = read operation, 1 = write operation
bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: 80520689, address which referenced memory

Debugging Details:
------------------


READ_ADDRESS: c006c280

CURRENT_IRQL: 2

FAULTING_IP:
nt!MmAccessFault+cab
80520689 8b07 mov eax,dword ptr [edi]

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: 0xA

PROCESS_NAME: QBMsgMgr.exe

TRAP_FRAME: b46f7b34 -- (.trap 0xffffffffb46f7b34)
ErrCode = 00000004
eax=00000000 ebx=00000000 ecx=5d090000 edx=7c90e514 esi=00000000 edi=00000000
eip=7c9102f6 esp=0012ecfc ebp=0012ed24 iopl=0 nv up ei pl zr na pe nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00010246
001b:7c9102f6 ?? ???
Resetting default scope

LAST_CONTROL_TRANSFER: from 805445b0 to 80520689

STACK_TEXT:
b46f7b1c 805445b0 00000000 5d090000 00000001 nt!MmAccessFault+0xcab
b46f7b1c 7c9102f6 00000000 5d090000 00000001 nt!KiTrap0E+0xd0
WARNING: Frame IP not in any known module. Following frames may be wrong.
0012ed24 00000000 00000000 00000000 00000000 0x7c9102f6


STACK_COMMAND: kb

FOLLOWUP_IP:
nt!KiTrap0E+d0
805445b0 85c0 test eax,eax

SYMBOL_STACK_INDEX: 1

SYMBOL_NAME: nt!KiTrap0E+d0

FOLLOWUP_NAME: MachineOwner

IMAGE_NAME: Unknown_Image

DEBUG_FLR_IMAGE_TIMESTAMP: 0

BUCKET_ID: RAISED_IRQL_USER_FAULT

MODULE_NAME: Unknown_Module

Followup: MachineOwner
---------
  • 0

Advertisements


#2
Broni

Broni

    Kraków my love :)

  • Member
  • PipPipPipPipPipPipPipPip
  • 12,300 posts

Memory dump show QBMsgMgr.exe

You're looking for the culprit in incorrect place.
This:

PROCESS_NAME: QBMsgMgr.exe

shows only, when and where the error happened, but it doesn't show the culprit.
Culprit is listed here:

IMAGE_NAME: Unknown_Image

However, it doesn't show much ("Unknown_Image").

Let's see, if we can get more info...

Download BlueScreenView
No installation required.
Double click on BlueScreenView.exe file to run the program.
When scanning is done, go Edit>Select All.
Go File>Save Selected Items, and save the report as BSOD.txt.
Open BSOD.txt in Notepad, copy all content, and paste it into your next reply.

Edited by Broni, 25 May 2010 - 07:45 PM.

  • 0

#3
littlepaws

littlepaws

    Member

  • Topic Starter
  • Member
  • PipPip
  • 89 posts
THank for the help

==================================================
Dump File : Mini052510-04.dmp
Crash Time : 25/05/2010 11:13:27
Bug Check String : IRQL_NOT_LESS_OR_EQUAL
Bug Check Code : 0x1000000a
Parameter 1 : 0xb2f4e98c
Parameter 2 : 0x00000002
Parameter 3 : 0x00000000
Parameter 4 : 0x8050ef28
Caused By Driver : ntoskrnl.exe
Caused By Address : ntoskrnl.exe+37f28
File Description : NT Kernel & System
Product Name : Microsoft® Windows® Operating System
Company : Microsoft Corporation
File Version : 5.1.2600.5938 (xpsp_sp3_gdr.100216-1514)
Processor : 32-bit
Computer Name :
Full Path : C:\WINDOWS\Minidump\Mini052510-04.dmp
Processors Count : 2
Major Version : 15
Minor Version : 2600
==================================================

==================================================
Dump File : Mini052510-03.dmp
Crash Time : 25/05/2010 10:00:16
Bug Check String : PAGE_FAULT_IN_NONPAGED_AREA
Bug Check Code : 0x10000050
Parameter 1 : 0xe48c0f40
Parameter 2 : 0x00000000
Parameter 3 : 0xba63c64a
Parameter 4 : 0x00000001
Caused By Driver : Ntfs.sys
Caused By Address : Ntfs.sys+2864a
File Description : NT File System Driver
Product Name : Microsoft® Windows® Operating System
Company : Microsoft Corporation
File Version : 5.1.2600.5512 (xpsp.080413-2111)
Processor : 32-bit
Computer Name :
Full Path : C:\WINDOWS\Minidump\Mini052510-03.dmp
Processors Count : 2
Major Version : 15
Minor Version : 2600
==================================================

==================================================
Dump File : Mini052510-02.dmp
Crash Time : 25/05/2010 09:11:46
Bug Check String : NTFS_FILE_SYSTEM
Bug Check Code : 0x00000024
Parameter 1 : 0x001902fe
Parameter 2 : 0xb4a3f940
Parameter 3 : 0xb4a3f63c
Parameter 4 : 0x8052d16f
Caused By Driver : Ntfs.sys
Caused By Address : Ntfs.sys+dff0
File Description : NT File System Driver
Product Name : Microsoft® Windows® Operating System
Company : Microsoft Corporation
File Version : 5.1.2600.5512 (xpsp.080413-2111)
Processor : 32-bit
Computer Name :
Full Path : C:\WINDOWS\Minidump\Mini052510-02.dmp
Processors Count : 2
Major Version : 15
Minor Version : 2600
==================================================

==================================================
Dump File : Mini052510-01.dmp
Crash Time : 25/05/2010 07:19:14
Bug Check String : IRQL_NOT_LESS_OR_EQUAL
Bug Check Code : 0x1000000a
Parameter 1 : 0xc006c280
Parameter 2 : 0x00000002
Parameter 3 : 0x00000000
Parameter 4 : 0x80520689
Caused By Driver : ntoskrnl.exe
Caused By Address : ntoskrnl.exe+49689
File Description : NT Kernel & System
Product Name : Microsoft® Windows® Operating System
Company : Microsoft Corporation
File Version : 5.1.2600.5938 (xpsp_sp3_gdr.100216-1514)
Processor : 32-bit
Computer Name :
Full Path : C:\WINDOWS\Minidump\Mini052510-01.dmp
Processors Count : 2
Major Version : 15
Minor Version : 2600
==================================================
  • 0

#4
Broni

Broni

    Kraków my love :)

  • Member
  • PipPipPipPipPipPipPipPip
  • 12,300 posts
Let's start with checking your RAM.

A. If you have more than one RAM module installed, try starting computer with one RAM stick at a time.

NOTE Keep in mind, the manual check listed above is always superior to the software check, listed below. DO NOT proceed with memtest, if you can go with option A

B. If you have only one RAM stick installed...
...run memtest...

1. Download - Pre-Compiled Bootable ISO (.zip)
2. Unzip downloaded memtest86+-....iso.zip file.
3. Inside, you'll find memtest86+-....iso file.
4. Download, and install ImgBurn: http://www.imgburn.com/
5. Insert blank CD into your CD drive.
6. Open ImgBurn, and click on Write image file to disc
7. Click on Browse for a file... icon:

Posted Image

8. Locate memtest86+-....iso file, and click Open button.
9. Click on ImgBurn green arrow to start burning bootable memtest86 CD:

Posted Image

10. Once the CD is created, boot from it, and memtest will automatically start to run.

The running program will look something like this depending on the size and number of ram modules installed:


Posted Image

It's recommended to run 5-6 passes. Each pass contains very same 8 tests.

This will show the progress of the test. It can take a while. Be patient, or leave it running overnight.

Posted Image

The following image is the test results area:

Posted Image

The most important item here is the “errors” line. If you see ANY errors, even one, most likely, you have bad RAM.
  • 0

#5
littlepaws

littlepaws

    Member

  • Topic Starter
  • Member
  • PipPip
  • 89 posts
THanks for the tip.

I just decided to replace all the memory in the computer.

No blue screens for about a day now. :)
  • 0

#6
Broni

Broni

    Kraków my love :)

  • Member
  • PipPipPipPipPipPipPipPip
  • 12,300 posts
Good news :)
Keep it that way :)
  • 0






Similar Topics

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

As Featured On:

Microsoft Yahoo BBC MSN PC Magazine Washington Post HP