ministryofmind

Dear Forum,

I have been lurking for literally years and have finally decided to join. I'm actually a tech so I'll give back in karma in the future but need help with this user and her BSODs. She keeps getting these 0x000008e stop errors of different shapes and forms.

She's running a Dell Dimension 4600 with Windows XP Pro SP3. There's some proprietary chemistry software, MS suite and Adobe creative suite. I've done a chkdsk and fixed some errors, did a CCleaner scan and ran the computer through two separate online viral scanners AND checked for the Rustock rootkit. Everything came up clean. User was fine for about a week but is having some errors again. I ran memtest too. Clean.

So, I grabbed the minidump and ran windbg and got this but need some help deciphering it. It says something about acrobat and then a lot of corrupt memory stuff but I memtest came back clean? Help!

Microsoft (R) Windows Debugger Version 6.9.0003.113 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\WINDOWS\Minidump\Mini.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows XP Kernel Version 2600 (Service Pack 3) MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 2600.xpsp_sp3_gdr.080814-1236
Kernel base = 0x804d7000 PsLoadedModuleList = 0x805634c0
Debug session time: Tue Oct 28 11:01:44.437 2008 (GMT-4)
System Uptime: 4 days 7:54:33.178
Loading Kernel Symbols
......................................................................................................................................................
Loading User Symbols
Loading unloaded module list
..............................................
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1000008E, {c000001d, f843e287, f8ae1e80, 0}

Probably caused by : memory_corruption

Followup: memory_corruption
---------

1: kd>
Implicit thread is now f9753998
1: kd> !analyz -v
No export analyz found
1: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

KERNEL_MODE_EXCEPTION_NOT_HANDLED_M (1000008e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003. This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG. This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG. This will let us see why this breakpoint is
happening.
Arguments:
Arg1: c000001d, The exception code that was not handled
Arg2: f843e287, The address that the exception occurred at
Arg3: f8ae1e80, Trap Frame
Arg4: 00000000

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc000001d - {EXCEPTION} Illegal Instruction An attempt was made to execute an illegal instruction.

FAULTING_IP:
USBPORT!USBPORT_FlushPendingList+35f
f843e287 da ???

TRAP_FRAME: f8ae1e80 -- (.trap 0xfffffffff8ae1e80)
ErrCode = 00000000
eax=82e85028 ebx=82ddedf4 ecx=823c0bd0 edx=00000000 esi=82ddedb0 edi=804e56fc
eip=f843e287 esp=f8ae1ef4 ebp=f8ae1f44 iopl=0 nv up ei ng nz na po nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010282
USBPORT!USBPORT_FlushPendingList+0x35f:
f843e287 da ???
Resetting default scope

DEFAULT_BUCKET_ID: CODE_CORRUPTION

BUGCHECK_STR: 0x8E

PROCESS_NAME: Acrobat.exe

MISALIGNED_IP:
USBPORT!USBPORT_FlushPendingList+35f
f843e287 da ???

LAST_CONTROL_TRANSFER: from f843f0a8 to f843e287

FAILED_INSTRUCTION_ADDRESS:
USBPORT!USBPORT_FlushPendingList+35f
f843e287 da ???

STACK_TEXT:
f8ae1f44 f843f0a8 02ddedb0 ffffffff 804e56fc USBPORT!USBPORT_FlushPendingList+0x35f
f8ae1f74 f844d24b 82e85028 804e56fc 82e85028 USBPORT!USBPORT_DpcWorker+0x192
f8ae1fb0 f844d3c2 82e85028 00000001 82d71928 USBPORT!USBPORT_IsrDpcWorker+0x38f
f8ae1fcc 804dcd22 82e8564c 6b755044 00000000 USBPORT!USBPORT_IsrDpc+0x166
f8ae1ff4 804dc88d b7702230 00000000 00000000 nt!KiRetireDpcList+0x61
f8ae1ff8 b7702230 00000000 00000000 00000000 nt!KiDispatchInterrupt+0x2b
WARNING: Frame IP not in any known module. Following frames may be wrong.
804dc88d 00000000 00000009 0081850f bb830000 0xb7702230


STACK_COMMAND: kb

CHKIMG_EXTENSION: !chkimg -lo 50 -d !USBPORT
f843e2fd - USBPORT!USBPORT_FlushPendingList+3d5
[ 8d:89 ]
1 error : !USBPORT (f843e2fd)

MODULE_NAME: memory_corruption

IMAGE_NAME: memory_corruption

FOLLOWUP_NAME: memory_corruption

DEBUG_FLR_IMAGE_TIMESTAMP: 0

MEMORY_CORRUPTOR: ONE_BIT

FAILURE_BUCKET_ID: MEMORY_CORRUPTION_ONE_BIT

BUCKET_ID: MEMORY_CORRUPTION_ONE_BIT

Followup: memory_corruption
---------

ministryofmind

BUMP, please take a gander.

peterdiva

You've got one bit memory corruption along with ntstatus c000001d. Both are signs of a RAM problem. As memtest isn't perfect you'll need to run one stick of RAM at a time (assuming there's more than one).

EXCEPTION_CODE: (NTSTATUS) 0xc000001d - {EXCEPTION} Illegal Instruction An attempt was made to execute an illegal instruction.

FAILURE_BUCKET_ID: MEMORY_CORRUPTION_ONE_BIT

ministryofmind

Got it!

I will swap out the RAM for the user and test it at my office. Thanks for all your help.