Occasional BSOD on booting with Vista Home Premium Edition

pompomke · Apr 26, 2008

Hi

I've recently bought a dell laptop with Vista Home Edition. I've had it for just over 2 months and I've had about 2 to 3 BSOD when it boots.

The only things I've installed are AVG anti-virus, Commodo Firewall, but the main installation is Flight simulator 2004 with many addons.

I've managed to get a minidump debugged and pasted below

Microsoft (R) Windows Debugger Version 6.8.0004.0 X86
Copyright (c) Microsoft Corporation. All rights reserved.

Loading Dump File [C:\Windows\Minidump\Mini042608-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\windows\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows Vista Kernel Version 6000 MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 6000.16575.x86fre.vista_gdr.071009-1548
Kernel base = 0x81c00000 PsLoadedModuleList = 0x81d11e10
Debug session time: Sat Apr 26 19:00:33.234 2008 (GMT+1)
System Uptime: 0 days 0:00:20.124
Loading Kernel Symbols
..................................................................................................................................
Loading User Symbols
Loading unloaded module list
..
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1000008E, {c0000005, 81df17c7, 88653134, 0}

Probably caused by : ntkrpamp.exe ( nt!ObpCloseHandle+121 )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

KERNEL_MODE_EXCEPTION_NOT_HANDLED_M (1000008e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003. This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG. This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG. This will let us see why this breakpoint is
happening.
Arguments:
Arg1: c0000005, The exception code that was not handled
Arg2: 81df17c7, The address that the exception occurred at
Arg3: 88653134, Trap Frame
Arg4: 00000000

Debugging Details:
------------------

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

FAULTING_IP:
nt!ObpCloseHandle+121
81df17c7 c9 leave

TRAP_FRAME: 88653134 -- (.trap 0xffffffff88653134)
ErrCode = 00000000
eax=00000000 ebx=81df17ea ecx=889abba0 edx=83a33054 esi=88653248 edi=886531cc
eip=81df17c7 esp=886531a8 ebp=00000000 iopl=0 nv up ei pl zr na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010246
nt!ObpCloseHandle+0x121:
81df17c7 c9 leave
Resetting default scope

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT

BUGCHECK_STR: 0x8E

PROCESS_NAME: System

CURRENT_IRQL: 0

LAST_CONTROL_TRANSFER: from 00000000 to 81df17c7

STACK_TEXT:
00000000 00000000 00000000 00000000 00000000 nt!ObpCloseHandle+0x121

STACK_COMMAND: kb

FOLLOWUP_IP:
nt!ObpCloseHandle+121
81df17c7 c9 leave

SYMBOL_STACK_INDEX: 0

SYMBOL_NAME: nt!ObpCloseHandle+121

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nt

IMAGE_NAME: ntkrpamp.exe

DEBUG_FLR_IMAGE_TIMESTAMP: 470c2f52

FAILURE_BUCKET_ID: 0x8E_nt!ObpCloseHandle+121

BUCKET_ID: 0x8E_nt!ObpCloseHandle+121

Followup: MachineOwner
---------

0: kd> lmvm nt
start end module name
81c00000 81fa1000 nt (pdb symbols) c:\windows\symbols\ntkrpamp.pdb\E42190E0396449A3882CB6F322CB176E2\ntkrpamp.pdb
Loaded symbol image file: ntkrpamp.exe
Mapped memory image file: c:\windows\symbols\ntkrnlpa.exe\470C2F523a1000\ntkrnlpa.exe
Image path: ntkrpamp.exe
Image name: ntkrpamp.exe
Timestamp: Wed Oct 10 02:48:02 2007 (470C2F52)
CheckSum: 00365AD7
ImageSize: 003A1000
File version: 6.0.6000.16575
Product version: 6.0.6000.16575
File flags: 0 (Mask 3F)
File OS: 40004 NT Win32
File type: 1.0 App
File date: 00000000.00000000
Translations: 0409.04b0
CompanyName: Microsoft Corporation
ProductName: Microsoft® Windows® Operating System
InternalName: ntkrpamp.exe
OriginalFilename: ntkrpamp.exe
ProductVersion: 6.0.6000.16575
FileVersion: 6.0.6000.16575 (vista_gdr.071009-1548)
FileDescription: NT Kernel & System
LegalCopyright: © Microsoft Corporation. All rights reserved.
0: kd> .trap 0xffffffff88653134
ErrCode = 00000000
eax=00000000 ebx=81df17ea ecx=889abba0 edx=83a33054 esi=88653248 edi=886531cc
eip=81df17c7 esp=886531a8 ebp=00000000 iopl=0 nv up ei pl zr na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010246
nt!ObpCloseHandle+0x121:
81df17c7 c9 leave

Now I have no idea what all this means, but if anyone has any ideas please let me know, so I can decide whether to return it as it's still under warranty or fix it.

Any comments welcome

Thanks

jcgriff2 · Apr 27, 2008

pompomke

Hi pompomke -

Welcome to the Tech Support Forum - Vista Support!

Nice job that you did up there!

Please get all of the memory dump files and I'll take a look at them.

Two reports, please -
- Belarc Advisor report saved in "mht" format, as a web page (html) or as a Word document. You can download Belarc HERE

- DXDiag report - dxdiag.exe from an Elevated command prompt. Then save this report as a text file.

Please zip them up and attach to an email. Please DO NOT post any of these items - see my PM for my email.

Regards. . .

jcgriff2

pompomke · Apr 28, 2008

Hi

I've send the files. I hope you got them

Cheers

dai · Apr 28, 2008

how many firewalls are you running 1,2 or 3

pompomke · Apr 29, 2008

Just one, the Commodo firewall, although not sure if the windows firewall is on or off, probably on to come to think about it

Not sure if that helps

dai · Apr 29, 2008

disable one of them,2 running can cause problems

jcgriff2 · May 4, 2008

Hello dai -

.
Hi P-

I processed the one lonely memory dump file but was unable narrow down any specific cause. However, while going through the loaded module area, I did take note of several drivers from mid-2006 that I don't believe are 100% Vista compatible.

Two drivers belong to either or both versions of your installed program Saitek Configuration Software -
• saiH0461.sys Tue Aug 08 13:25:06 2006 (44D8C8F2)
• saiMini.sys Mon Aug 14 06:52:44 2006 (44E055FC)

The following are Microsoft system drivers:
• spldr.sys Wed Oct 25 18:40:44 2006
• iastorv.sys Fri Oct 06 14:01:40 2006

I listed these because I don't ever recall seeing a Microsoft Vista system driver with a date earlier than November 2, 2006 - at least not since Vista was released for sale to the public in January 2007. I know the dates are close - within 30 days - but it almost makes me wonder if you somehow have drivers from a beta version of Vista RC. Your Windows Updates are all in with the exception of three for Office 2007, and Vista SP1 itself. I would simply wait until SP1 is offered to you via Windows Updates.

There are a few tests that you can run in the meantime:

Windows System File Checker:
Go top an elevated command prompt and type:

sfc /scannow

it my run for hours.

Please note that I found no areas in the memory dumps to indicate a hardware issue, but during a BSOD onset it is always good to rule these things out. In addition, I would advise you to check the Event Viewer logs - Administrative to be specific, and check with the Device Manager as well looking for any red or yellow flags.

I wish you the Best of Luck and please let me know if you have any questions.

Regards. . .

jcgriff (JC)

Occasional BSOD on booting with Vista Home Premium Edition

Top Contributors this Month

Recommended Communities