Re: PLEASE HELP: STOP error and .dmp included

From: Will Denny (willdenny_at_mvps.org)
Date: 02/23/05


Date: Wed, 23 Feb 2005 05:58:47 -0000

Hi

Have you tried the following link to Jim Eshelman's web site - left hand
column(4E):

http://aumha.org/win5/kbestop.htm

-- 
Will Denny
MS-MVP Windows Shell/User
"Highlander" <Highlander@discussions.microsoft.com> wrote in message 
news:8CE4DBFD-BE0F-4907-8E96-46F8B779F52F@microsoft.com...
> Hi,
>
> I have a WinXP Pro pc, it crashes randomly, but after running for a few 
> day
> when you try to run any program it suddenly blinks off and restarts, no 
> error
> code, nothing logged in event viewer. It is most prone to crash when 
> playing
> games, especially saving or loading games.
>
> I configured the pc not to restart in the event of stop error and to log 
> the
> event, and I have now finnaly got an error message logged in the event 
> viewer.
>
>
> Here is a brief spec:
>
> OS: Windows XP SP2 (all patches up to date)
> AMD Athlon XP 2600
> Memory: 512MB RAM
> Motherboard: Gigabyte 7VAXP ULTRA (latest bios)
> Video: ATI Radeon 9600 XT (latest video driver)
> Harddrive: Primary Master old Maxtor 20GB (UDMA 4)
> Harddrive: Primary Slave Maxtor 80GB ATA133 (UDMA 6)
> DVD-drive: Secondary Master LG DVD 4x +-RW
>
> here is the event logged:
> ************************************************************
>
> Error code 0000004e, parameter1 00000099, parameter2 000033ef, parameter3
> 00000000, parameter4 00000000.
>
> For more information, see Help and Support Center at
> http://go.microsoft.com/fwlink/events.asp.
>
> 0000: 53 79 73 74 65 6d 20 45   System E
> 0008: 72 72 6f 72 20 20 45 72   rror  Er
> 0010: 72 6f 72 20 63 6f 64 65   ror code
> 0018: 20 30 30 30 30 30 30 34    0000004
> 0020: 65 20 20 50 61 72 61 6d   e  Param
> 0028: 65 74 65 72 73 20 30 30   eters 00
> 0030: 30 30 30 30 39 39 2c 20   000099,
> 0038: 30 30 30 30 33 33 65 66   000033ef
> 0040: 2c 20 30 30 30 30 30 30   , 000000
> 0048: 30 30 2c 20 30 30 30 30   00, 0000
> 0050: 30 30 30 30               0000
>
> ************************************************
>
> Not very helpful, so I downloaded Debugging tools for windows and loaded 
> the
> memory dump file using WinDbg, here is the output:
>
> ANY SUGGESTIONS WHAT DRIVER IS CAUSING PROBLEMS
>
> ********************************************************
>
>
> Microsoft (R) Windows Debugger  Version 6.4.0007.2
> Copyright (c) Microsoft Corporation. All rights reserved.
>
>
> Loading Dump File [C:\WINDOWS\Minidump\Mini022205-01.dmp]
> Mini Kernel Dump File: Only registers and stack trace are available
>
> Symbol search path is: C:\symbols
> Executable search path is:
> Windows XP Kernel Version 2600 (Service Pack 2) UP Free x86 compatible
> Product: WinNt, suite: TerminalServer SingleUserTS
> Built by: 2600.xpsp_sp2_rtm.040803-2158
> Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055ab20
> Debug session time: Mon Feb 21 23:47:05.574 2005 (GMT-7)
> System Uptime: 0 days 20:41:07.837
> Loading Kernel Symbols
> ................................................................................................................................................
> Loading unloaded module list
> ..............................
> Loading User Symbols
> *******************************************************************************
> *
> *
> *                        Bugcheck Analysis
> *
> *
> *
> *******************************************************************************
>
> Use !analyze -v to get detailed debugging information.
>
> BugCheck 4E, {99, 33ef, 0, 0}
>
> Probably caused by : memory_corruption ( nt!MiDecrementShareCount+53 )
>
> Followup: MachineOwner
> ---------
>
> kd> .restart
>
> Loading Dump File [C:\WINDOWS\Minidump\Mini022205-01.dmp]
> Mini Kernel Dump File: Only registers and stack trace are available
>
> Symbol search path is: C:\symbols
> Executable search path is:
> Windows XP Kernel Version 2600 (Service Pack 2) UP Free x86 compatible
> Product: WinNt, suite: TerminalServer SingleUserTS
> Built by: 2600.xpsp_sp2_rtm.040803-2158
> Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055ab20
> Debug session time: Mon Feb 21 23:47:05.574 2005 (GMT-7)
> System Uptime: 0 days 20:41:07.837
> Loading Kernel Symbols
> ................................................................................................................................................
> Loading unloaded module list
> ..............................
> Loading User Symbols
> *******************************************************************************
> *
> *
> *                        Bugcheck Analysis
> *
> *
> *
> *******************************************************************************
>
> Use !analyze -v to get detailed debugging information.
>
> BugCheck 4E, {99, 33ef, 0, 0}
>
> Probably caused by : memory_corruption ( nt!MiDecrementShareCount+53 )
>
> Followup: MachineOwner
> ---------
>
> kd> !analyze -v
> *******************************************************************************
> *
> *
> *                        Bugcheck Analysis
> *
> *
> *
> *******************************************************************************
>
> PFN_LIST_CORRUPT (4e)
> Typically caused by drivers passing bad memory descriptor lists (ie: 
> calling
> MmUnlockPages twice with the same list, etc).  If a kernel debugger is
> available get the stack trace.
> Arguments:
> Arg1: 00000099, A PTE or PFN is corrupt
> Arg2: 000033ef, page frame number
> Arg3: 00000000, current page state
> Arg4: 00000000, 0
>
> Debugging Details:
> ------------------
>
>
> OVERLAPPED_MODULE:  Udfs
>
> CUSTOMER_CRASH_COUNT:  1
>
> DEFAULT_BUCKET_ID:  DRIVER_FAULT
>
> BUGCHECK_STR:  0x4E
>
> LAST_CONTROL_TRANSFER:  from 80525182 to 805339ae
>
> STACK_TEXT:
> b8ababa4 80525182 0000004e 00000099 000033ef nt!KeBugCheckEx+0x1b
> b8ababd0 805042f1 c050409c 00000280 82942f98 nt!MiDecrementShareCount+0x53
> b8ababf0 8058ad9d 688f1201 82942da0 003ffffc nt!MiDeleteValidAddress+0x142
> b8abac10 805045b6 82942da0 82942ed8 82942da0
> nt!MiDeleteAddressesInWorkingSet+0x65
> b8abac48 8058b081 00942da0 82c40a08 c0000005
> nt!MmCleanProcessAddressSpace+0x18f
> b8abacf0 8058b341 c0000005 b8abad4c 804e6851 nt!PspExitThread+0x680
> b8abacfc 804e6851 82c40a08 b8abad48 b8abad3c nt!PsExitSpecialApc+0x22
> b8abad4c 804df0d4 00000001 00000000 b8abad64 nt!KiDeliverApc+0x1af
> b8abad4c 7c90eb94 00000001 00000000 b8abad64 nt!KiServiceExit+0x58
> WARNING: Frame IP not in any known module. Following frames may be wrong.
> 0076fec0 00000000 00000000 00000000 00000000 0x7c90eb94
>
>
> FOLLOWUP_IP:
> nt!MiDecrementShareCount+53
> 80525182 845804           test    [eax+0x4],bl
>
> SYMBOL_STACK_INDEX:  1
>
> FOLLOWUP_NAME:  MachineOwner
>
> SYMBOL_NAME:  nt!MiDecrementShareCount+53
>
> MODULE_NAME:  nt
>
> DEBUG_FLR_IMAGE_TIMESTAMP:  41108004
>
> STACK_COMMAND:  kb
>
> IMAGE_NAME:  memory_corruption
>
> FAILURE_BUCKET_ID:  0x4E_nt!MiDecrementShareCount+53
>
> BUCKET_ID:  0x4E_nt!MiDecrementShareCount+53
>
> Followup: MachineOwner
> ---------
>
> kd> !analyze -show
> Unknown bugcheck code (2999050)
> Unknown bugcheck description
> Arguments:
> Arg1: 00000000
> Arg2: 00000000
> Arg3: 00000000
> Arg4: 00000000
>
> ******************************************************
>
> Hope this helps, any suggestions
>
> Ahmed
>
>
>
> 


Relevant Pages

  • PLEASE HELP: STOP error and .dmp included
    ... Mini Kernel Dump File: Only registers and stack trace are available ... Loading Kernel Symbols ... Use!analyze -v to get detailed debugging information. ... Followup: MachineOwner ...
    (microsoft.public.windowsxp.help_and_support)
  • Re: problems with PC crashing; help/insight requested
    ... I hope my instructions in Debugging Windows and How to Setup helped. ... Loading Kernel Symbols ... 8051cd0f, address which referenced memory ...
    (microsoft.public.windowsxp.general)
  • Re: problems with PC crashing; help/insight requested
    ... This is going to be a bit lengthy, including two logs of the windows debug ... Loading Kernel Symbols ... Use!analyze -v to get detailed debugging information. ... 8051cd0f, address which referenced memory ...
    (microsoft.public.windowsxp.general)
  • Re: problems with PC crashing; help/insight requested
    ... This is going to be a bit lengthy, including two logs of the windows debug ... Loading Kernel Symbols ... Use!analyze -v to get detailed debugging information. ... 8051cd0f, address which referenced memory ...
    (microsoft.public.windowsxp.general)
  • Re: XP crashes, dmp files added.
    ... This page refers to an error message but doesn't say what the error message ... >> Unable to load image ntoskrnl.exe, Win32 error 2 ... >> Loading Kernel Symbols ... >> Use!analyze -v to get detailed debugging information. ...
    (microsoft.public.windowsxp.general)

Loading