Can anyone help me decipher this BSOD?
This has happened to me several times with no new hardware or software being a common denominator: Problem signature: Problem Event Name: BlueScreen OS Version: 6.1.7100.2.0.0.256.1 Locale ID: 1033 Additional information about the problem: BCCode: 3b BCP1: 00000000C0000005 BCP2: FFFFF8000282BCF8 BCP3: FFFFF8800A910F60 BCP4: 0000000000000000 OS Version: 6_1_7100 Service Pack: 0_0 Product: 256_1 Files that help describe the problem: C:\Windows\Minidump\090209-26566-01.dmp C:\Windows\Temp\WER-33618-0.sysdata.xmlCan anyone point me in the right direction?
September 2nd, 2009 8:14pm

If you take a look into the minidump file, there should be a few references like the following:BugCheck A, {fffffa80897c1916, c, 0, fffff80001c5a914}Probably caused by : ntkrnlmp.exe andBugCheck 3B, {c0000005, fffff98000767c98, fffff980141b8dd0, 0}Probably caused by : eamon.sys That would tell you what the probable cause was/is.If you could post these, or take a look into it yourself, that would be great. Also you should take a look in Event Viewer for something like "Bugcheck" or "event 1001" and let us know what it says.-Ken | http://ken.wagnerfamily.co.uk
Free Windows Admin Tool Kit Click here and download it now
September 2nd, 2009 8:41pm

This is what it says when I open the crash dump file with WinDbg: Microsoft (R) Windows Debugger Version 6.11.0001.404 AMD64Copyright (c) Microsoft Corporation. All rights reserved. Loading Dump File 090209-26566-01.dmpMini Kernel Dump File: Only registers and stack trace are available Symbol search path is: *** Invalid ******************************************************************************** Symbol loading may be unreliable without a symbol search path. ** Use .symfix to have the debugger choose a symbol path. ** After setting your symbol path, use .reload to refresh symbol locations. *****************************************************************************Executable search path is: ********************************************************************** Symbols can not be loaded because symbol path is not initialized. ** ** The Symbol Path can be set by: ** using the _NT_SYMBOL_PATH environment variable. ** using the -y <symbol_path> argument when starting the debugger. ** using .sympath and .sympath+ **********************************************************************Unable to load image \SystemRoot\system32\ntoskrnl.exe, Win32 error 0n2*** WARNING: Unable to verify timestamp for ntoskrnl.exe*** ERROR: Module load completed but symbols could not be loaded for ntoskrnl.exeWindows 7 Kernel Version 7100 MP (4 procs) Free x64Product: WinNt, suite: TerminalServer SingleUserTSBuilt by: 7100.0.amd64fre.winmain_win7rc.090421-1700Machine Name:Kernel base = 0xfffff800`02810000 PsLoadedModuleList = 0xfffff800`02a49e90Debug session time: Wed Sep 2 13:00:01.526 2009 (GMT-4)System Uptime: 0 days 1:17:37.571********************************************************************** Symbols can not be loaded because symbol path is not initialized. ** ** The Symbol Path can be set by: ** using the _NT_SYMBOL_PATH environment variable. ** using the -y <symbol_path> argument when starting the debugger. ** using .sympath and .sympath+ **********************************************************************Unable to load image \SystemRoot\system32\ntoskrnl.exe, Win32 error 0n2*** WARNING: Unable to verify timestamp for ntoskrnl.exe*** ERROR: Module load completed but symbols could not be loaded for ntoskrnl.exeLoading Kernel Symbols..................................................................................................................................................Loading User SymbolsLoading unloaded module list......******************************************************************************** ** Bugcheck Analysis ** ******************************************************************************** Use !analyze -v to get detailed debugging information. BugCheck 3B, {c0000005, fffff8000282bcf8, fffff8800a910f60, 0} ***** Kernel symbols are WRONG. Please fix symbols to do analysis. **************************************************************************** ****** ****** Your debugger is not using the correct symbols ****** ****** In order for this command to work properly, your symbol path ****** must point to .pdb files that have full type information. ****** ****** Certain .pdb files (such as the public OS symbols) do not ****** contain the required information. Contact the group that ****** provided you with these symbols if you need this command to ****** work. ****** ****** Type referenced: nt!_KPRCB ****** ******************************************************************************************************************************************************** ****** ****** Your debugger is not using the correct symbols ****** ****** In order for this command to work properly, your symbol path ****** must point to .pdb files that have full type information. ****** ****** Certain .pdb files (such as the public OS symbols) do not ****** contain the required information. Contact the group that ****** provided you with these symbols if you need this command to ****** work. ****** ****** Type referenced: nt!_KPRCB ****** ******************************************************************************************************************************************************** ****** ****** Your debugger is not using the correct symbols ****** ****** In order for this command to work properly, your symbol path ****** must point to .pdb files that have full type information. ****** ****** Certain .pdb files (such as the public OS symbols) do not ****** contain the required information. Contact the group that ****** provided you with these symbols if you need this command to ****** work. ****** ****** Type referenced: nt!_KPRCB ****** ************************************************************************************************************************************************** Symbols can not be loaded because symbol path is not initialized. ** ** The Symbol Path can be set by: ** using the _NT_SYMBOL_PATH environment variable. ** using the -y <symbol_path> argument when starting the debugger. ** using .sympath and .sympath+ ******************************************************************************************************************************************** Symbols can not be loaded because symbol path is not initialized. ** ** The Symbol Path can be set by: ** using the _NT_SYMBOL_PATH environment variable. ** using the -y <symbol_path> argument when starting the debugger. ** using .sympath and .sympath+ **********************************************************************Probably caused by : ntoskrnl.exe ( nt+1bcf8 ) Followup: MachineOwner--------- There is this line: "BugCheck 3B, {c0000005, fffff8000282bcf8, fffff8800a910f60, 0}", but then it says, "Kernel symbols are WRONG. Please fix symbols to do analysis." and I don't know how to do that. And it sounds like it's real annoyed with me, too....:-/
September 2nd, 2009 9:03pm

http://support.microsoft.com/default.aspx/kb/315263Look at sample #2. Create a directory on your PC where the symbol files can be downloaded (c:\symbols in that example), and run with that command line. Then the debugger will be less annoyed with you :)Want to know if your hardware will work on Windows 7? Check out these links: **Windows 7 Upgrade Advisor ** **Microsoft Logo'd Hardware List**
Free Windows Admin Tool Kit Click here and download it now
September 3rd, 2009 3:56am

Thanks, Mark. Well, starting with that kb, I finally found my way to the Microsoft Symbol Serverdownloaded the symbols, and now WinDbg says this:Microsoft (R) Windows Debugger Version 6.11.0001.404 AMD64Copyright (c) Microsoft Corporation. All rights reserved. Loading Dump File [F:\Documents\Win 7 BSOD files\090209-26566-01.dmp]Mini Kernel Dump File: Only registers and stack trace are available Symbol search path is: C:\SymbolsExecutable search path is: Windows 7 Kernel Version 7100 MP (4 procs) Free x64Product: WinNt, suite: TerminalServer SingleUserTSBuilt by: 7100.0.amd64fre.winmain_win7rc.090421-1700Machine Name:Kernel base = 0xfffff800`02810000 PsLoadedModuleList = 0xfffff800`02a49e90Debug session time: Wed Sep 2 13:00:01.526 2009 (GMT-4)System Uptime: 0 days 1:17:37.571Loading Kernel Symbols..................................................................................................................................................Loading User SymbolsLoading unloaded module list......******************************************************************************** ** Bugcheck Analysis ** ******************************************************************************** Use !analyze -v to get detailed debugging information. BugCheck 3B, {c0000005, fffff8000282bcf8, fffff8800a910f60, 0} Probably caused by : ntkrnlmp.exe ( nt!RealSuccessor+30 ) Followup: MachineOwner--------- I should mention that I have never gotten this BSOD running Windows XP since I built this systm a year ago.
September 3rd, 2009 7:11pm

http://msdn.microsoft.com/en-us/library/ms793232.aspx This error has been linked to excessive paged pool usage and may occur due to user-mode graphics drivers crossing over and passing bad data to the kernel code. Event Viewer should have information regarding what module is causing the crash. And, based on a little looking around, this error is seldom alone. Review Event Viewer to see if there is more than one culprit and if they are pointing in the same direction (ie. video driver, webcam, whatever)
Free Windows Admin Tool Kit Click here and download it now
September 3rd, 2009 7:51pm

There are no graphics driver errors in the log at the time of the BSOD (BugCheck in the log). Could it be due to ZoneAlarm Antivirus? It installs drivers. Also, it's a beta, annd the BSOD, when it has occurred, has always happened when I start ZAAV too soon after booting up.
September 3rd, 2009 10:07pm

To troubleshoot BSOD crash issues, we need to debug the crashed system dump. Unfortunately, debugging is beyond what we can do in the forum. A suggestion would be to contact Microsoft Customer Service and Support (CSS) via telephone so that a dedicated Support Professional can assist with your request. Please be advised that contacting phone support will be a charged call. To obtain the phone numbers for specific technology request please take a look at the web site listed below: http://support.microsoft.com/default.aspx?scid=fh;EN-US;OfferProPhone#faq607 Sean Zhu - MSFT
Free Windows Admin Tool Kit Click here and download it now
September 4th, 2009 6:43am

I think the fastest way to track this down is to use a testing tool called Driver Verifier.If this tool finds a problem, your machine will crash again. Hopefully with it enabled, it will allow you to easily identify the bad driver.Enable driver verifier1) Open an elevated command prompt2) Type "verifier /standard /all" (no quotes)3) Reboot your machine4) Use machine again until it crashes (hopefully this will be fast :)After the crash & reboot, go into safe mode. http://windowshelp.microsoft.com/Windows/en-US/Help/323ef48f-7b93-4079-a48a-5c58eec904a11033.mspxDisable driver verifier1) Open an elevated command prompt2) Type "verifier /reset" (no quotes)3) Reboot your machineThen using the steps you followed before, take a look at the new memory dump. Want to know if your hardware will work on Windows 7? Check out these links: **Windows 7 Upgrade Advisor ** **Microsoft Logo'd Hardware List**
September 4th, 2009 6:43am

Hi, The incompatible programs will also casue the blue screen error. You can test the problem in Clean Boot mode. Can you send the latest minidump file to me (thoml@live.com) for research? Thomas Lin
Free Windows Admin Tool Kit Click here and download it now
September 4th, 2009 11:18am

I believe Mark [MSFT] is going down the path that will tell you the exact answer to your problem. But, as you mention two "words in the same sentence... "beta" and "BSOD", I have to comment on why this wasn't mentioned from the start. Oh well... turn off/uninstall ZA and see if the BSODs stop.If not, it wasn't ZA.
September 4th, 2009 2:41pm

After my last post the BSOD happened again, and I bing'ed the graphics driver message that I did find in the System log, even though it hadn't happened at the time the BSODs had. It was: "The NVIDIA Display Driver Service service has reported an invalid current state 32."I found this citeda number of times in gamers forums as the cause of BSODs with the 190.xx nVidia drivers. Apparently this error had been occurring randomly since install, it just didn't cause BSODs--maybe something about the more recent nVidia drivers or ZAAV got corrupted; I don't know. So I tried a couple of the driver versions that were mentioned on the gamer forums as being stable, and found one that has not generated any errors in the log since install yesterday, so here's hoping.Judging by recent experience I'd expect to have seen at least one by now. Part of this is my bad for simply not knowing to check the System logespecially if I didn't observe anythingamiss at the time. I know better now.I've uninstalled ZoneAlarm AntiVirus beta. It was acting up so badly today I couldn't even get online. No BSOD, though...ZoneAlarm 2010 is out so I downloaded it but aparently not compatible with 64-bit ; neither is the current beta. Downloading other AVs to try.
Free Windows Admin Tool Kit Click here and download it now
September 4th, 2009 7:24pm

This topic is archived. No further replies will be accepted.

Other recent topics Other recent topics