Win XP BSoD

[Integrator]

Hello everybody;

I am new to this forum, and I have to come clean...I joined because I am having a problem that I honestly don't have a clue how to fix. There I said it.

After reading some of the forum rules and whatnot, I've concluded that this is where I should post a Win XP blue screen of death question. I'll try to follow the guidelines laid out for Win Vista/7/8 BSoD as much as possible.

I am working on a PC that has been having blue screens recently. The BSoD's started happening after I started working on it. But everything I've done up to now has been within an application (modifying files that are part of a project within the app). I haven't made any changes to the OS that I am aware of. Even when I tried to restore windows to a prior date, it fails because no changes were detected. Mostly, I've used this PC to remote into a server using windows Remote Desktop Connection.

1. Download these 2 files; save to Documents
· A. SysInternals AutoRuns - Microsoft TechNet
· B. jcgriff2 BSOD File Collection app

2. RIGHT-click on B in Documents folder, select "Run as Administrator"
· Output = new folder Windows7_Vista_jcgriff2 in Documents

3. Run System Health Report -
START | type perfmon /report | save as HTML file

4. Zip up the output folder (#2) + PERFMON

1. downloaded
2. unable to run on XP
3. not sure how this works with XP, unable to save as HTML
4. nothing to zip

· OS - Vista/ Windows 7, Windows 8 ? XP
· x86 (32-bit) or x64 ? 32-bit
· What was original installed OS on system? XP
· Is the OS an OEM version (came pre-installed on system) or full retail version (YOU purchased it from retailer)? OEM
· Age of system (hardware) 3-5yrs
· Age of OS installation - have you re-installed the OS? 3-5yrs, no

· CPU - Intel Core 2 Duo E7400 2.8GHz
· Video Card - NVIDIA Quadro NVS 290
· MotherBoard - Don't know
· Power Supply - brand & wattage (if laptop, skip this one) - Don't know

· System Manufacturer - Dell
· Exact model number (if laptop, check label on bottom) Precision T3400 (service tag 65GTVK1)

I'll also include the MiniDump folder (C:/Windows/MiniDump)

View attachment Minidump.zip

Please let me know what other information may help. Thanks for your consideration.

 

[Patrick]

Hi,

Generally I don't debug XP dumps as my expertise is mostly in Vista / 7 / 8's architecture, but let's give this a whirl :+) We have a few varying bugchecks here:

IRQL_NOT_LESS_OR_EQUAL (a)

This indicates that Microsoft Windows or a kernel-mode driver accessed paged memory at DISPATCH_LEVEL or above.

This bug check is issued if paged memory (or invalid memory) is accessed when the IRQL is too high. The error that generates this bug check usually occurs after the installation of a faulty device driver, system service, or BIOS.

Let's take a look at our busy call stack here:

1: kd> kv
ChildEBP RetAddr  Args to Child              
a31130b8 8054b4b7 e4116000 e4116000 80659138 nt!VfDeadlockDeleteMemoryRange+0x6e (FPO: [Non-Fpo])
a31130fc a2df0602 e4116000 00000000 88b0e000 nt!ExFreePoolWithTag+0x1d7 (FPO: [Non-Fpo])
a3113114 a2de7d8a e3c59808 88b0e000 88fb5c00 [COLOR=#ff0000][I][B]kmixer!DisableSRC+0x42[/B][/I][/COLOR] (FPO: [Non-Fpo])
a31131cc a2dfad8f 88fb5be8 00000000 88b0e000 [COLOR=#ff0000][I][B]kmixer!ChangeSrc+0x35a[/B][/I][/COLOR] (FPO: [Non-Fpo])
a3113280 a2dfb0a5 88fb5be8 88b0e000 88b0e000 [COLOR=#ff0000][I][B]kmixer!ChangeOutputRate+0x1ff[/B][/I][/COLOR] (FPO: [Non-Fpo])
a31132a4 a2dec08b 88fb5be8 88f17c30 88e55c68 [COLOR=#ff0000][I][B]kmixer!OptimizeMix+0x2d5[/B][/I][/COLOR] (FPO: [Non-Fpo])
a31132d4 a2dec7ba 88fb5ca0 88e4ca20 00000008 [COLOR=#ff0000][I][B]kmixer!CreateSinkPin+0x9eb[/B][/I][/COLOR] (FPO: [Non-Fpo])
a3113300 b64adfdb 893f4ae8 88e4ca20 893f4ae8 [COLOR=#ff0000][I][B]kmixer!PinDispatchCreate+0xca[/B][/I][/COLOR] (FPO: [Non-Fpo])
a3113324 804ef19f 893f4ae8 00000000 806e6428 ks!DispatchCreate+0xc7 (FPO: [Non-Fpo])
a3113334 80658128 88f17c40 88f17c30 88d75888 nt!IopfCallDriver+0x31 (FPO: [0,0,0])
a3113358 805831fa 88e55c68 89210608 a3113528 nt!IovCallDriver+0xa0 (FPO: [Non-Fpo])
a3113438 8058361c 893f4ae8 00000000 88fd5628 nt!IopParseDevice+0xa12 (FPO: [Non-Fpo])
a3113470 805bf02d 88e55c68 00000000 88fd5628 nt!IopParseFile+0x46 (FPO: [Non-Fpo])
a31134e8 805bb9dc 800010d8 a3113528 00000240 nt!ObpLookupObjectName+0x119 (FPO: [Non-Fpo])
a311353c 80576033 00000000 00000000 00096300 nt!ObOpenObjectByName+0xea (FPO: [Non-Fpo])
a31135b8 805769aa e34240d8 40000000 a3113660 nt!IopCreateFile+0x407 (FPO: [Non-Fpo])
a3113614 b64ae4ee e34240d8 40000000 a3113660 nt!IoCreateFile+0x8e (FPO: [Non-Fpo])
a3113690 b64ada77 800010d8 b64ada80 88e036b0 ks!KsiCreateObjectType+0xd6 (FPO: [Non-Fpo])
a31136b0 ad412fdf 800010d8 88e036b0 40000200 ks!KsCreatePin+0x33 (FPO: [Non-Fpo])
WARNING: Stack unwind information not available. Following frames may be wrong.
a31136d4 ad41240d e3585fc0 e33311a0 e1a40c20[COLOR=#ff0000][I][B] sysaudio+0x4fdf[/B][/I][/COLOR]
a3113700 ad412b2a 00000000 88e036b0 00000000 [COLOR=#ff0000][I][B]sysaudio+0x440d[/B][/I][/COLOR]
a3113728 ad411574 e32fbbc8 e21d5d98 88e036b0 [COLOR=#ff0000][I][B]sysaudio+0x4b2a[/B][/I][/COLOR]
a3113758 ad4121e7 c0000010 88e036b0 00000000 [COLOR=#ff0000][I][B]sysaudio+0x3574[/B][/I][/COLOR]
a3113774 ad411718 88a997d8 ad4114e6 88e036b0 [COLOR=#ff0000][I][B]sysaudio+0x41e7[/B][/I][/COLOR]
a31137a8 b64adfdb 897f6bf0 88a997d8 897f6bf0 [COLOR=#ff0000][I][B]sysaudio+0x3718[/B][/I][/COLOR]
a31137cc 804ef19f 897f6bf0 00000000 806e6428 ks!DispatchCreate+0xc7 (FPO: [Non-Fpo])
a31137dc 80658128 88a997e8 88a997d8 88f77d08 nt!IopfCallDriver+0x31 (FPO: [0,0,0])
a3113800 805831fa 88f7f748 88e07388 a31139d0 nt!IovCallDriver+0xa0 (FPO: [Non-Fpo])
a31138e0 8058361c 897f6bf0 00000000 89254468 nt!IopParseDevice+0xa12 (FPO: [Non-Fpo])
a3113918 805bf02d 88f7f748 00000000 89254468 nt!IopParseFile+0x46 (FPO: [Non-Fpo])
a3113990 805bb9dc 80001ecc a31139d0 00000240 nt!ObpLookupObjectName+0x119 (FPO: [Non-Fpo])
a31139e4 80576033 00000000 00000000 00096300 nt!ObOpenObjectByName+0xea (FPO: [Non-Fpo])
a3113a60 805769aa a3113b88 40000000 a3113b08 nt!IopCreateFile+0x407 (FPO: [Non-Fpo])
a3113abc b64ae4ee a3113b88 40000000 a3113b08 nt!IoCreateFile+0x8e (FPO: [Non-Fpo])
a3113b38 b64ada77 80001ecc b64ada80 89237ba8 ks!KsiCreateObjectType+0xd6 (FPO: [Non-Fpo])
a3113b58 a418c3e2 80001ecc 89237ba8 40000200 ks!KsCreatePin+0x33 (FPO: [Non-Fpo])
a3113b8c a418c813 00000000 00000009 00000001 [COLOR=#ff0000][I][B]wdmaud+0x43e2[/B][/I][/COLOR]
a3113bc8 a418ba83 00000092 00000009 89273758 [COLOR=#ff0000][I][B]wdmaud+0x4813[/B][/I][/COLOR]
a3113bf4 a418b382 892637d0 89273758 00000000 [COLOR=#ff0000][I][B]wdmaud+0x3a83[/B][/I][/COLOR]
a3113c1c 804ef19f 00000010 88e0b000 806e6428 [COLOR=#ff0000][I][B]wdmaud+0x3382[/B][/I][/COLOR]
a3113c2c 80658128 88e45c80 806e6410 892637d0 nt!IopfCallDriver+0x31 (FPO: [0,0,0])
a3113c50 8057f982 89263864 88e45c80 892637d0 nt!IovCallDriver+0xa0 (FPO: [Non-Fpo])
a3113c64 805807f7 8975ef10 892637d0 88e45c80 nt!IopSynchronousServiceTail+0x70 (FPO: [Non-Fpo])
a3113d00 80579274 00000df8 00000f48 00000000 nt!IopXxxControlFile+0x5c5 (FPO: [Non-Fpo])
a3113d34 8054162c 00000df8 00000f48 00000000 nt!NtDeviceIoControlFile+0x2a (FPO: [Non-Fpo])
a3113d34 7c90e514 00000df8 00000f48 00000000 nt!KiFastCallEntry+0xfc (FPO: [0,0] TrapFrame @ a3113d64)
0b79fbbc 00000000 00000000 00000000 00000000 0x7c90e514

BAD_POOL_CALLER (c2)

This indicates that the current thread is making a bad pool request.

Same as above, audio calls throughout stack.

DRIVER_CORRUPTED_EXPOOL (c5)

This indicates that the system attempted to access invalid memory at a process IRQL that was too high.

The kernel attempted to access pageable memory (or perhaps completely invalid memory) when the IRQL was too high. The ultimate cause of this problem is almost certainly a driver that has corrupted the system pool.

---------------------------------------------

We can see we go from a few wdmaud.sys (Microsoft Windows WDM sound system driver file) calls, to a few sysaudio.sys (System Audio WDM Filter) calls, and then finally to kmixer.sys (Kernel Mode Audio Mixer).

We likely have some sort of device driver or piece of software conflicting with your Windows sound drivers. Interesingly enough, in all of the crashes, we have a consistent process at the time of the crash - PROCESS_NAME: Citect32.exe

^^ I know what this software is, who it's developed by, etc. But what exactly is its purpose, what is it used for?

Regards,

Patrick

 

[Integrator]

We likely have some sort of device driver or piece of software conflicting with your Windows sound drivers. Interesingly enough, in all of the crashes, we have a consistent process at the time of the crash - PROCESS_NAME: Citect32.exe

^^ I know what this software is, who it's developed by, etc. But what exactly is its purpose, what is it used for?

Thanks for your response. Citect32.exe is a SCADA application used to interact with the PLC's that operate a unit at an industrial plant. This workstation is used primarily for the purpose of running Citect, i.e., it has to run.

Other than some minor modifications to the Citect project, the only other change was to swap this workstation (named EWS2) with another (OWS1, essentially trading keyboard, mouse, and dual monitors).

It may be worth mentioning that there was a blue screen on the aforementioned OWS1 workstation a few days prior to being swapped with EWS2. View attachment Minidump.zip

 

[Patrick]

Hi,

That attached crash is the same as the above, wdmaud.sys culprits. Process crash was Citect32 as well. Have you guys performed any software updates, etc, that may conflict with this program on all workstations (or namely the ones crashing)?

I would suggest wiping a test workstation and only installing latest drivers and necessary updates and seeing what happens.

Regards,

Patrick