[Greg135]

Hi there,

Last week, I was doing a fairly large design using Paint.net and it was hammering the RAM. I had to close down everything else I had open so that I could finish the job.

Since then, on several occasions, a Windows message has popped up telling me that I was running out of memory and that either Firefox or Internet Explorer wanted to close down to protect the computer. Never ever seen this type of message before.....Unfortunately, I didn't take a screenshot of Windows message.

This is particularly strange as I normally have 2-3 IE windows open, all with several open tabs and at the same time, several Firefox windows open again with plenty of tabs open (sometimes as many as 40-50 tabs open).
Do you think the process could have damaged the memory in some way?

Yesterday, I ran the Vista Memory Diagnostics utility to check the memory...came up with nothing.

Also, since I completed the job, over the last couple of days, my PC has blue screened several times.
This morning, the first time it happened it came up with this error:

DRIVER_IRQL_NOT_LESS_OR_EQUAL
Tech info: STOP: 0x000000D1 (0x00000004,0x00000002,0x00000001,0x88CCA5CA)
ataport.sys - address 88CCA5CA base at 88CBF000 datestamp 49e01eee

After I rebooted, I started IE and restored previous open session....while that was happening the PC blue screened again:

This time it told me to disable any hardware, antivirus or backup software etc....(seen this generic screen before)

My PC is as follows:
Windows Vista Business Service Pack 2
2GB memory
Intel Mobile Core 2 Duo T7700 2.4GHz
Nvidia Quadro

Please tell me if there are any diagnostic tools that I can run?

Any insight into this problem will be greatly appreciated.....

Regards


Greg

Edited by Greg135, 01 September 2011 - 04:42 AM.

[Advertisements]

0x000000D1: DRIVER_IRQL_NOT_LESS_OR_EQUAL
(Click to consult the online Win XP Resource Kit article.)
The system attempted to access pageable memory using a kernel process IRQL that was too high. The most typical cause is a bad device driver (one that uses improper addresses). It can also be caused by caused by faulty or mismatched RAM, or a damaged pagefile.

Download BlueScreenView
No installation required.
Double click on BlueScreenView.exe file to run the program.
When scanning is done, go Edit>Select All.
Go File>Save Selected Items, and save the report as BSOD.txt.
Open BSOD.txt in Notepad, copy all content, and paste it into your next reply.

Thanks to Broni for the instructions and program




Download WhoCrashed from the link in my signature below
This program checks for any drivers which may have been causing your computer to crash....

Click on the file you just downloaded and run it.

Put a tick in Accept then click on Next
Put a tick in the Don't create a start menu folder then click Next
Put a tick in Create a Desktop Icon then click on Install and make sure there is a tick in Launch Whocrashed before clicking Finish
Click Analyze
It will want to download the Debugger and install it Say Yes
WhoCrashed will create report but you have to scroll down to see it
Copy and paste it into your next reply







http://www.resplendence.com/downloads

[rshaffer61]

0x000000D1: DRIVER_IRQL_NOT_LESS_OR_EQUAL
(Click to consult the online Win XP Resource Kit article.)
The system attempted to access pageable memory using a kernel process IRQL that was too high. The most typical cause is a bad device driver (one that uses improper addresses). It can also be caused by caused by faulty or mismatched RAM, or a damaged pagefile.

Download BlueScreenView
No installation required.
Double click on BlueScreenView.exe file to run the program.
When scanning is done, go Edit>Select All.
Go File>Save Selected Items, and save the report as BSOD.txt.
Open BSOD.txt in Notepad, copy all content, and paste it into your next reply.

Thanks to Broni for the instructions and program




Download WhoCrashed from the link in my signature below
This program checks for any drivers which may have been causing your computer to crash....

Click on the file you just downloaded and run it.

Put a tick in Accept then click on Next
Put a tick in the Don't create a start menu folder then click Next
Put a tick in Create a Desktop Icon then click on Install and make sure there is a tick in Launch Whocrashed before clicking Finish
Click Analyze
It will want to download the Debugger and install it Say Yes
WhoCrashed will create report but you have to scroll down to see it
Copy and paste it into your next reply







http://www.resplendence.com/downloads

[Greg135]

Hey there rshaffer,

Ok ran the BlueScreenView as described....

However, it comes up empty....bottom left corner states "0 Crashes" and there is zilch in the Dump File and Filename boxes...

Am I doing something wrong?

Regards

Greg

[rshaffer61]

How about the WhoCrashed report?

[Greg135]

How about the WhoCrashed report?

Just finished downloading and running it....same thing.

Crash Dump Analysis
--------------------------------------------------------------------------------

Crash dump directory: C:\Windows\Minidump

Crash dumps are enabled on your computer.


No valid crash dumps have been found on your computer
_____________________________________________________________

So I followed this:
To configure your system to write out crash dumps in case of a system error, take the following steps:
Right-click My Computer, and then click Properties. Click the Advanced tab, and then under Startup and Recovery, click Settings (or Startup and Recovery). Under write debugging information select small memory dump.

Does that mean that the crashes were not being recorded by Windows?

What should I do next?

Regards

Greg

But I saw that the dump files were not being saved. So I just changed those settings

[rshaffer61]

No worry we can try the built in Event Viewer.


Please follow the steps below to enter the Event Viewer program in Vista. This will give me more information into what is causing your issue. You can get to Event viewer two ways and I will post both for you.

Method One

• Go to
• Start
• In the Search box type in Event Viewer in the search box and press Enter
• From this point you can follow from step four from the below method as they will be the same.
Method Two

• Go to Start
• Right click on the Computer Icon and select Manage
• Navigate to the Event Viewer, You will be prompted to accept the action you are going to perform. Click continue
• On the left window pane click on Local and then expand the Windows entry. This will allow you to see every error for the past 24 hours as well as the last 7 days in the right window pane.
• Look for the ones that correspond to the times that your issue occurred.
• If any are found please double click and expand the error. This will open and give you more information on the error.
• Please include that in your next reply.

[Greg135]

Hey rshaffer,

OK I think I found the right area in the Event Viewer....hopefully...

I went to Computer Management > System Tools > Event Viewer > Windows Logs >

Under Windows Logs there are:
Application
Security
Setup
System
Forwarded Events

There are multiple entries for each of the above....which must I focus on?

Regards

Greg

[rshaffer61]

• Look for the ones that correspond to the times that your issue occurred.

We are only interested in the ones for the last 2 days that correspond with the times your BSOD happened.

[Greg135]

• Look for the ones that correspond to the times that your issue occurred.

We are only interested in the ones for the last 2 days that correspond with the times your BSOD happened.

Sorry these might be newbie questions but are you looking for all the entries (around the times of the BSOD) under each of the headings mentioned:

Under Windows Logs there are:
Application
Security
Setup
System
Forwarded Events

Firstly, is that the correct area to look?
Secondly, are you looking for details under all the headings above?
Thirdly, there are "Warnings" and "Errors".....do you want everything?

Thanks
Greg

Edited by Greg135, 01 September 2011 - 10:00 AM.

[rshaffer61]

Errors more then likely and I would concentrate on Applications and System areas.

[Greg135]

Hi there,

Please tell me if this is what you are looking for:

Under the Applications Tab:

Warning:
The COM+ Event System failed to fire the Logoff method on subscription {4C2E468D-2D11-43E9-93C0-327D6BAE597E}-{00000000-0000-0000-0000-000000000000}-{00000000-0000-0000-0000-000000000000}. The subscriber returned HRESULT 80070490.
_______________________________________________________________________________________________________

Warning:
Windows detected your registry file is still in use by other applications or services. The file will be unloaded now. The applications or services that hold your registry file may not function properly afterwards.

DETAIL -
5 user registry handles leaked from \Registry\User\S-1-5-21-1468280668-1198558150-790981102-1000:
Process 2860 (\Device\HarddiskVolume1\PROGRA~1\SPEEDB~1\VideoAcceleratorService.exe) has opened key \REGISTRY\USER\S-1-5-21-1468280668-1198558150-790981102-1000
Process 3728 (\Device\HarddiskVolume1\PROGRA~1\SPEEDB~1\VideoAcceleratorEngine.exe) has opened key \REGISTRY\USER\S-1-5-21-1468280668-1198558150-790981102-1000
Process 1568 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-1468280668-1198558150-790981102-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Process 1568 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-1468280668-1198558150-790981102-1000\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings
Process 3728 (\Device\HarddiskVolume1\PROGRA~1\SPEEDB~1\VideoAcceleratorEngine.exe) has opened key \REGISTRY\USER\S-1-5-21-1468280668-1198558150-790981102-1000\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-21-1468280668-1198558150-790981102-1000
______________________________________________________________________________________________________

Warning:
The configuration of the AdminConnection\TCP protocol in the SQL instance MSSMLBIZ is not valid.
_____________________________________________________________________________________________________

Error:
conflictManagerTypeValue
_________________________________________________________________________________________________________

Warning:
[UNS] Failed to get EAC Status.
______________________________________________________________________________________________________

[UNS] Failed to subscribe to local Intel® AMT.
___________________________________________________________________________________________________

Warning:
Event ID 3013 for the Windows Search Service has been suppressed 12 time(s) since 11:09:55 PM. This event is used to suppress Windows Search Service events that have occurred frequently within a short period of time. See Event ID 3013 for further details on this event.
____________________________________________________________________________

Error:
The Collect Procedure for the "EmdCache" service in DLL "C:\Windows\system32\emdmgmt.dll" generated an exception or returned an invalid status. The performance data returned by the counter DLL will not be returned in the Perf Data Block. The first four bytes (DWORD) of the Data section contains the exception code or status code.
_____________________________________________________________________________________

Error:
The Open Procedure for service "PNRPsvc" in DLL "C:\Windows\system32\pnrpperf.dll" failed. Performance data for this service will not be available. The first four bytes (DWORD) of the Data section contains the error code.
___________________________________________________________________________________________

Warning:
The COM+ Event System failed to fire the Logoff method on subscription {4C2E468D-2D11-43E9-93C0-327D6BAE597E}-{00000000-0000-0000-0000-000000000000}-{00000000-0000-0000-0000-000000000000}. The subscriber returned HRESULT 80070490.
_________________________________________________________________________________________
Warning:
Windows detected your registry file is still in use by other applications or services. The file will be unloaded now. The applications or services that hold your registry file may not function properly afterwards.

DETAIL -
5 user registry handles leaked from \Registry\User\S-1-5-21-1468280668-1198558150-790981102-1000:
Process 2924 (\Device\HarddiskVolume1\PROGRA~1\SPEEDB~1\VideoAcceleratorService.exe) has opened key \REGISTRY\USER\S-1-5-21-1468280668-1198558150-790981102-1000
Process 1128 (\Device\HarddiskVolume1\PROGRA~1\SPEEDB~1\VideoAcceleratorEngine.exe) has opened key \REGISTRY\USER\S-1-5-21-1468280668-1198558150-790981102-1000
Process 1544 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-1468280668-1198558150-790981102-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Process 1544 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-1468280668-1198558150-790981102-1000\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings
Process 1128 (\Device\HarddiskVolume1\PROGRA~1\SPEEDB~1\VideoAcceleratorEngine.exe) has opened key \REGISTRY\USER\S-1-5-21-1468280668-1198558150-790981102-1000\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-21-1468280668-1198558150-790981102-1000
______________________________________________________________________________________________

Regards

Greg

[Greg135]

Hey there,

Under SYSTEM there are the following Errors:

THIS ERROR OCCURRED TWICE...
Crash dump initialization failed!

Device\HarddiskVolume1
0000000001000000000000002E0004C001100000010000C000000000000000000000000000000000
--------------------------------------------------------------------------------

Binary data:

In Words
0000: 00000000 00000001 00000000 C004002E
0008: 00001001 C0000001 00000000 00000000
0010: 00000000 00000000

In Bytes

0000: 00 00 00 00 01 00 00 00 ........
0008: 00 00 00 00 2E 00 04 C0 .......À
0010: 01 10 00 00 01 00 00 C0 .......À
0018: 00 00 00 00 00 00 00 00 ........
0020: 00 00 00 00 00 00 00 00 ........
______________________________________________________________________________________________________

This Warning appeared twice:

The speed of processor 1 is being limited by system firmware. The processor has been in this reduced performance state for 0 seconds since the last report.
_________________________________________________________________________________________________________

The Windows Time service terminated with the following error:
An attempt was made to logon, but the network logon service was not started.
______________________________________________________________________________________

ERROR:
The previous system shutdown at 11:58:38 AM on 2011/09/01 was unexpected.

11:58:38 AM
2011/09/01


9625


DB070900040001000B003A0026003502DB0709000400010009003A0026003502600900003C000000010000006009000000000000B00400000100000000000000


--------------------------------------------------------------------------------

Binary data:


In Words

0000: 000907DB 00010004 003A000B 02350026
0008: 000907DB 00010004 003A0009 02350026
0010: 00000960 0000003C 00000001 00000960
0018: 00000000 000004B0 00000001 00000000


In Bytes

0000: DB 07 09 00 04 00 01 00 Û.......
0008: 0B 00 3A 00 26 00 35 02 ..:.&.5.
0010: DB 07 09 00 04 00 01 00 Û.......
0018: 09 00 3A 00 26 00 35 02 ..:.&.5.
0020: 60 09 00 00 3C 00 00 00 `...<...
0028: 01 00 00 00 60 09 00 00 ....`...
0030: 00 00 00 00 B0 04 00 00 ....°...
0038: 01 00 00 00 00 00 00 00 ........

___________________________________________________________________________________

Crash dump initialization failed!

\Device\HarddiskVolume1
0000000001000000000000002E0004C001100000010000C000000000000000000000000000000000


--------------------------------------------------------------------------------

Binary data:


In Words

0000: 00000000 00000001 00000000 C004002E
0008: 00001001 C0000001 00000000 00000000
0010: 00000000 00000000


In Bytes

0000: 00 00 00 00 01 00 00 00 ........
0008: 00 00 00 00 2E 00 04 C0 .......À
0010: 01 10 00 00 01 00 00 C0 .......À
0018: 00 00 00 00 00 00 00 00 ........
0020: 00 00 00 00 00 00 00 00 ........

_________________________________________________________________________________

Crash dump initialization failed! a second time....


And then some later Errors and Warnings which are probably not relevant...

Hopefully this will give you an idea of what uis going on...

Regards


Greg

[rshaffer61]

Yep now we get to work. First thing i need you to do is:

Tutorial for running chkdsk in Vista\Win 7 located HERE.

[Greg135]

Yep now we get to work. First thing i need you to do is:

Tutorial for running chkdsk in Vista\Win 7 located HERE.

Thanks rshaffer,

OK busy running CHKDSK on my D drive partition.....the other drive partitions C, E and F all say there were no problems/bad sectors.

Do you want me to post those results?

Regards

Greg

[rshaffer61]

the other drive partitions C, E and F all say there were no problems/bad sectors.

Well is it no problems or bad sectors?
One could be a potential issue.