CLINK! Whir! BSOD.

[Robbie Hatley]

Aaarg, if it isn't one thing it's another. Just a few minutes

ago I was just changing something in the appearance scheme of

my Win2K desktop. Only app running was task manager, minimized.

I right clicked an empty spot on my desktop, then CLINK!!!,

Whirrrr!!! The sound of one or more hard disks shutting down,

which shouldn't be happening, because my current "power settings"

demand that all hard disks stay on all the time.



A split second later, I get BSOD, with this message:



KMODE_EXCEPTION_NOT_HANDLED

Address A000A6CB, base at A0000000

Date stamp 4a850c90 - win32k.sys

Beginning memory dump.

Memory dump complete.

Contact your system administrator.



Well, I AM my system administrator, but I have no clue as to

what caused this crash.



No system, app, or security events were logged at time of crash.



No Dr. Watson activity at time of crash.



On using dumpchk to read the dump file, I got:



wd=C:\Minidump

%dumpchk Mini032410-01.dmp





Windows 2000 Crash Dump Analysis







Filename . . . . . . .Mini032410-01.dmp

Signature. . . . . . .PAGE

ValidDump. . . . . . .DUMP

MajorVersion . . . . .free system

MinorVersion . . . . .2195

DirectoryTableBase . .0x19666000

PfnDataBase. . . . . .0x85ecc000

PsLoadedModuleList . .0x804815c0

PsActiveProcessHead. .0x80483048

MachineImageType . . .i386

NumberProcessors . . .1

BugCheckCode . . . . .0x0000001e

BugCheckParameter1 . .0xc0000005

BugCheckParameter2 . .0xa000a6cb

BugCheckParameter3 . .0x00000000

BugCheckParameter4 . .0xa0258104



ExceptionCode. . . . .0x80000003

ExceptionFlags . . . .0x00000001

ExceptionAddress . . .0x8042eee8



wd=C:\Minidump

%



But I don't know what any of that means. Anyone have any clue

as to what's going on here?



--

Puzzled,

Robbie Hatley

lonewolf at well dot com

www dot well dot com slant tilde lonewolf slant

 

[Bob I]

http://support.microsoft.com/?kbid=294728



Robbie Hatley wrote:

> Aaarg, if it isn't one thing it's another. Just a few minutes

> ago I was just changing something in the appearance scheme of

> my Win2K desktop. Only app running was task manager, minimized.

> I right clicked an empty spot on my desktop, then CLINK!!!,

> Whirrrr!!! The sound of one or more hard disks shutting down,

> which shouldn't be happening, because my current "power settings"

> demand that all hard disks stay on all the time.

>

> A split second later, I get BSOD, with this message:

>

> KMODE_EXCEPTION_NOT_HANDLED

> Address A000A6CB, base at A0000000

> Date stamp 4a850c90 - win32k.sys

> Beginning memory dump.

> Memory dump complete.

> Contact your system administrator.

>

> Well, I AM my system administrator, but I have no clue as to

> what caused this crash.

>

> No system, app, or security events were logged at time of crash.

>

> No Dr. Watson activity at time of crash.

>

> On using dumpchk to read the dump file, I got:

>

> wd=C:\Minidump

> %dumpchk Mini032410-01.dmp

>

>

> Windows 2000 Crash Dump Analysis

>

>

>

> Filename . . . . . . .Mini032410-01.dmp

> Signature. . . . . . .PAGE

> ValidDump. . . . . . .DUMP

> MajorVersion . . . . .free system

> MinorVersion . . . . .2195

> DirectoryTableBase . .0x19666000

> PfnDataBase. . . . . .0x85ecc000

> PsLoadedModuleList . .0x804815c0

> PsActiveProcessHead. .0x80483048

> MachineImageType . . .i386

> NumberProcessors . . .1

> BugCheckCode . . . . .0x0000001e

> BugCheckParameter1 . .0xc0000005

> BugCheckParameter2 . .0xa000a6cb

> BugCheckParameter3 . .0x00000000

> BugCheckParameter4 . .0xa0258104

>

> ExceptionCode. . . . .0x80000003

> ExceptionFlags . . . .0x00000001

> ExceptionAddress . . .0x8042eee8

>

> wd=C:\Minidump

> %

>

> But I don't know what any of that means. Anyone have any clue

> as to what's going on here?

>

 

[John John - MVP]

This might be difficult to pin down, I would first run a RAM test on the

machine and make sure that the RAM is not at fault. If the RAM passes

the test I would then update the video drivers. If the problem persists

I would then disable all software that makes use of filter drivers.



Basically the 0x1E bugcheck message tells us that it's an access

violation (0xc5) by win32k.sys... it usually means that win32k.sys has a

conflict with a driver. If it were anything but win32k.sys it would be

easier to pin down.



Try these:



http://search.yahoo.com/search;_ylt...e:microsoft.com&fr2=sb-top&fr=yfp-t-501&sao=0

http://search.yahoo.com/search;_ylt..."++"win32k.sys"&fr2=sb-top&fr=yfp-t-501&sao=0

http://aumha.org/a/stop.php#0x1e



John





Robbie Hatley wrote:

> Aaarg, if it isn't one thing it's another. Just a few minutes

> ago I was just changing something in the appearance scheme of

> my Win2K desktop. Only app running was task manager, minimized.

> I right clicked an empty spot on my desktop, then CLINK!!!,

> Whirrrr!!! The sound of one or more hard disks shutting down,

> which shouldn't be happening, because my current "power settings"

> demand that all hard disks stay on all the time.

>

> A split second later, I get BSOD, with this message:

>

> KMODE_EXCEPTION_NOT_HANDLED

> Address A000A6CB, base at A0000000

> Date stamp 4a850c90 - win32k.sys

> Beginning memory dump.

> Memory dump complete.

> Contact your system administrator.

>

> Well, I AM my system administrator, but I have no clue as to

> what caused this crash.

>

> No system, app, or security events were logged at time of crash.

>

> No Dr. Watson activity at time of crash.

>

> On using dumpchk to read the dump file, I got:

>

> wd=C:\Minidump

> %dumpchk Mini032410-01.dmp

>

>

> Windows 2000 Crash Dump Analysis

>

>

>

> Filename . . . . . . .Mini032410-01.dmp

> Signature. . . . . . .PAGE

> ValidDump. . . . . . .DUMP

> MajorVersion . . . . .free system

> MinorVersion . . . . .2195

> DirectoryTableBase . .0x19666000

> PfnDataBase. . . . . .0x85ecc000

> PsLoadedModuleList . .0x804815c0

> PsActiveProcessHead. .0x80483048

> MachineImageType . . .i386

> NumberProcessors . . .1

> BugCheckCode . . . . .0x0000001e

> BugCheckParameter1 . .0xc0000005

> BugCheckParameter2 . .0xa000a6cb

> BugCheckParameter3 . .0x00000000

> BugCheckParameter4 . .0xa0258104

>

> ExceptionCode. . . . .0x80000003

> ExceptionFlags . . . .0x00000001

> ExceptionAddress . . .0x8042eee8

>

> wd=C:\Minidump

> %

>

> But I don't know what any of that means. Anyone have any clue

> as to what's going on here?

>

 

[Robbie Hatley]

"Bob I" posited:



> http://support.microsoft.com/?kbid=294728



That's the very first web site I looked at before posting here.

But I don't have any of the folders, files, processes, or services

mentioned present on my computer.



So that's not the cause.



--

Cheers,

Robbie Hatley

lonewolf at well dot com

www dot well dot com slant tilde lonewolf slant

 

[Robbie Hatley]

"John John - MVP" wrote:



> This might be difficult to pin down, I would first run a RAM test on the

> machine and make sure that the RAM is not at fault.



I've run RAM tests on this machine before without finding

any problem. But these tests are full of holes, because it's

impossible to test the entire RAM with a RAM-resident RAM tester,

because it can't access those parts in use by the OS or apps.



I can't see how any RAM tester residing in RAM could be complete.

If it was in ROM, and ran before anything was loaded into RAM, yes.

If the MB manufacturer had been so thoughtful. My BIOS has a simple

tester that runs during POST (and has never found any problem), but I

don't think a 15-second test of 1GiB of RAM could be very thorough.



> If the RAM passes the test I would then update the video drivers.



None available. My card because obsolete a month after I bought it

(indeed, the entire concept of "AGP video card" became obsolete when

the PCIE bus came out a few months later), so the driver shipped with

the card is the same the driver pushed by nVidia on their site as

being "latest and greatest". (I ran treecomp on the two trees.

Every byte of every file is identical.)



> If the problem persists I would then disable all software that

> makes use of filter drivers.



What is a "filter driver"?



> Basically the 0x1E bugcheck message tells us that it's an access

> violation (0xc5) by win32k.sys... it usually means that win32k.sys

> has a conflict with a driver.



Same drivers for 7 years, so why did the "driver conflict" wait for

7 years? Unless it's one of those Win2K bugs that crops up every

2555 days or so, so to troubleshoot it, you have to make incremental

changes every 2560 days. Of course, your computer and OS will both

become obsolete long before you succeed, and indeed, you may die of

old age; but then, that's part of Bill's plan, you see. :-/



As to what has changed on my system recently, I moved RAM to

different sockets and found that "DDR Dual Channel Mode" is now

enabled, and I disabled "AGP8x" and "AGP fast write" in BIOS

(because my MB was wrongly using 1.5V AGP voltage, wherease

AGP8x requires 0.8V, which may explain the bulging, leaking

capacitors on my video card). But if those were going to cause a

problem, why didn't they do so while I was taxing the system to the

max earlier with multiple apps running while playing a video-intensive

online game? But no, the BSOD occured when NO apps were running

(other than Task Manager, running minimized).



> If it were anything but win32k.sys it would be easier to pin down.



Yes, and if Microsoft error messages contained more (and more LEGIBLE)

information, it would also be easier to pin down.



Pssst: Bill: humans don't think or talk in hex.

0x19666000 0x85ecc000 0x804815c0 0x80483048 0x0000001e 0xc0000005

0xa000a6cb 0x00000000 0xa0258104 0x80000003 0x00000001 0x8042eee8

right back at you, big fella.



How about, "module pwjsgfvm overwrote module woishdvzy in RAM,

must halt system, so sorry". But that would be too easy.



> [search links]



Seems to be a huge plethora of different things that can cause

a similar error message. But none with the same exactly "bug check

parameters" as my error.



I see on one of those links, though, that this kind of error

can be caused by something so simple as "attempting to access

thread information on a window that has been closed". So if a

program (or part of Win2K itself) tries to access a window, but

that window just closed a split second earlier, then you get BSOD.

Very stupid OS design. This should be a "don't-care" situation,

not a "OMG, HALT THE SYSTEM!!!" situation. Appropriate system

action would be to pop up a box saying "Sorry, couldn't find that

window. [Close]", and let the app and system continue to run unimpeded.

I guess "fault tolerance" was not in vogue in Redmond back in 2000.



--

Cheers,

Robbie Hatley

lonewolf at well dot com

www dot well dot com slant tilde lonewolf slant

 

[John John - MVP]

Robbie Hatley wrote:

> "John John - MVP" wrote:

>

>> This might be difficult to pin down, I would first run a RAM test on the

>> machine and make sure that the RAM is not at fault.

>

> I've run RAM tests on this machine before without finding

> any problem. But these tests are full of holes, because it's

> impossible to test the entire RAM with a RAM-resident RAM tester,

> because it can't access those parts in use by the OS or apps.



You don't run memory tests when booted to Windows, these test utilities

are usually on a minimal DOS floppy or CD and you run the test in that

environment.



http://oca.microsoft.com/en/windiag.asp

http://www.memtest.org/







> I can't see how any RAM tester residing in RAM could be complete.

> If it was in ROM, and ran before anything was loaded into RAM, yes.

> If the MB manufacturer had been so thoughtful. My BIOS has a simple

> tester that runs during POST (and has never found any problem), but I

> don't think a 15-second test of 1GiB of RAM could be very thorough.



The RAM POST test is not a reliable memory test, an exhaustive memory

test usually takes hours to run, you run the test at night before you

go to sleep and check the results the following day.







>> If the RAM passes the test I would then update the video drivers.

>

> None available. My card because obsolete a month after I bought it

> (indeed, the entire concept of "AGP video card" became obsolete when

> the PCIE bus came out a few months later), so the driver shipped with

> the card is the same the driver pushed by nVidia on their site as

> being "latest and greatest". (I ran treecomp on the two trees.

> Every byte of every file is identical.)

>

>> If the problem persists I would then disable all software that

>> makes use of filter drivers.

>

> What is a "filter driver"?



http://blogs.technet.com/askperf/archive/2008/08/08/two-minute-drill-file-system-filter-drivers.aspx

Ask the Performance Team - Two Minute Drill: File System Filter Drivers







>> Basically the 0x1E bugcheck message tells us that it's an access

>> violation (0xc5) by win32k.sys... it usually means that win32k.sys

>> has a conflict with a driver.

>

> Same drivers for 7 years, so why did the "driver conflict" wait for

> 7 years? Unless it's one of those Win2K bugs that crops up every

> 2555 days or so, so to troubleshoot it, you have to make incremental

> changes every 2560 days. Of course, your computer and OS will both

> become obsolete long before you succeed, and indeed, you may die of

> old age; but then, that's part of Bill's plan, you see. :-/

>

> As to what has changed on my system recently, I moved RAM to

> different sockets and found that "DDR Dual Channel Mode" is now

> enabled, and I disabled "AGP8x" and "AGP fast write" in BIOS

> (because my MB was wrongly using 1.5V AGP voltage, wherease

> AGP8x requires 0.8V, which may explain the bulging, leaking

> capacitors on my video card). But if those were going to cause a

> problem, why didn't they do so while I was taxing the system to the

> max earlier with multiple apps running while playing a video-intensive

> online game? But no, the BSOD occured when NO apps were running

> (other than Task Manager, running minimized).



It isn't caused by an app, it's most likely caused by a driver. Maybe

you should reset the BIOS to it's default values. Why did you disable

AGP8X? Is your card not 8X capable? And speaking of problems...

bulging capacitors on the video card? Maybe you should replace the

card, AGP cards are still available and they aren't that expensive.







>> If it were anything but win32k.sys it would be easier to pin down.

>

> Yes, and if Microsoft error messages contained more (and more LEGIBLE)

> information, it would also be easier to pin down.

>

> Pssst: Bill: humans don't think or talk in hex.



No, but computers do talk in hex, and much like a patient's medical

records some of the text might appear foreign to the patient but the

doctor needs to use the proper terminology in his charts and records.

You won't see a medical chart stating that the patient has a "broken

arm"... instead you might see something like "...linear fracture right

radial..."







> 0x19666000 0x85ecc000 0x804815c0 0x80483048 0x0000001e 0xc0000005

> 0xa000a6cb 0x00000000 0xa0258104 0x80000003 0x00000001 0x8042eee8

> right back at you, big fella.

>

> How about, "module pwjsgfvm overwrote module woishdvzy in RAM,

> must halt system, so sorry". But that would be too easy.



Back to the arm bones...







>> [search links]

>

> Seems to be a huge plethora of different things that can cause

> a similar error message. But none with the same exactly "bug check

> parameters" as my error.



You probably won't find one with the exact same parameters, it is fairly

rare to see bugcheck messages with all the exact same parameters. Some

of the parameters are specific to each machine, for example one of the

parameters points to a memory address, the memory address will not

necessarily be the same on all the machines. See here:



http://support.microsoft.com/kb/275678

How to Troubleshoot a STOP 0x0000001E KMODE_EXCEPTION_NOT_HANDLED Error

Message





> I see on one of those links, though, that this kind of error

> can be caused by something so simple as "attempting to access

> thread information on a window that has been closed". So if a

> program (or part of Win2K itself) tries to access a window, but

> that window just closed a split second earlier, then you get BSOD.

> Very stupid OS design. This should be a "don't-care" situation,

> not a "OMG, HALT THE SYSTEM!!!" situation. Appropriate system

> action would be to pop up a box saying "Sorry, couldn't find that

> window. [Close]", and let the app and system continue to run unimpeded.

> I guess "fault tolerance" was not in vogue in Redmond back in 2000.



If it was really that simple do you think that Microsoft would

deliberately make it shut down the machine just to annoy users? What

you say happens all the time with user processes, you can crash almost

any user process and it will not cause the machine to crash. Your

problem is caused by something closer to the hardware layer (drivers)

and it isn't so simple to keep a machine running when drivers misbehave

and corrupt certain areas of memory, not shutting down the machine in

cases like that would result in an even more unstable machine which

could then lead to more serious problems or data loss. This is somewhat

like saying that you should just keep on driving when you get a flat or

if your engine is overheating...



John

 

[Buffalo]

John John - MVP wrote:



I believe that Robbie also stated that he had leaking and/or bulging

capacitors on his motherboard, besides his video card.

This was in another post by him.

Buffalo

 

[John John - MVP]

Buffalo wrote:

> John John - MVP wrote:

>

> I believe that Robbie also stated that he had leaking and/or bulging

> capacitors on his motherboard, besides his video card.

> This was in another post by him.



In that case, IMHO, the box is kaput! It looks like he has been having

all kinds problems with this computer for a while now, and running on

marginal or failing hardware could very well be the cause of many of his

problems.



John

 

[Robbie Hatley]

"John John - MVP" wrote:



> You don't run memory tests when booted to Windows, these test

> utilities are usually on a minimal DOS floppy or CD and you

> run the test in that environment.



That's what I figured, but I don't have any such programs.



> http://oca.microsoft.com/en/windiag.asp



Well, now I do. Thanks! I just DLed that and printed the

instructions. I'll put in on a floppy and run in.



> http://www.memtest.org/



Cool, got that one too. According to its instructions, though it

can do a pass in maybe a half hour, it recommends running several

passes over night. Apparently keeps running track of progress on

screen (accrdng to the readme). Odd that it uses a non-std file

system, so can't be read by DOS or Windows. Doesn't matter though,

the disk basically is acting as a boot ROM.



> The RAM POST test is not a reliable memory test, an exhaustive memory

> test usually takes hours to run, you run the test at night before you

> go to sleep and check the results the following day.



I figured.



> > What is a "filter driver"?

>

>[link to info on File System Filter Drivers]



Ah, ok. I don't think I have any of those, though. No antivirus

installed at all right now. And even when I did have AVG installed,

I kept its Resident Shield (a driver which filters the file system...

perfect example of a "File System Filter Driver", then) turned off.



> It isn't caused by an app, it's most likely caused by a driver.



Or by hardware, or by a stray cosmic ray. I've been having these

BSODs about once every 7 years or so. Not bad, actually.



Unlike the "crash" problem I've been having the last few months:

sporadic usb-mouse/sound/network crashes about twice a day, every

day, for 6 months. That's been calming down lately, though. I'm

pretty sure I'm finally getting a handle on that. The big clue was

the fact that the crashes were often preceded by a video-mode reset

event (screen freezes for 3 seconds, then goes black for 3 seconds,

then returns to normal). That was screaming "VIDEO CARD ISSUE!!!".

So I removed, cleaned, and inspected my video card, and noticed

3 damaged capacitors. That got me researching info on the video card,

and I found that two things were set wrong:



1. AGP Aperture size was 256MB (mfg demands 128MB). After changing

this, crashes were happening once every 10 days (as opposed to

twice a day).



2. A few days later, I discovered that my MB was injecting TWICE the

correct voltage into the AGP card (1.5V, whereas 0.8V is correct).

Hmmm... 1000uF 1.6V electrolytic cap.... drive to 95% of rated

voltage for 5 years in a 110F-ambient-temperature environment...

yep, they'll bulge, split, and leak. I disabled AGP8x. Since the

card is 4X(1.5V)/8X(0.8V), I think that will turn off the 0.8V

portion of the card, and feed the 1.5V into the 1.5V portion only.

STUPID error on the part of DFI (MB mfg). Can't fix by BIOS

upgrade either. Botched hardware design.



> Maybe you should reset the BIOS to it's default values.



The default settings are buggy, and cause the hardware to be

destroyed, so it's not that simple.



> Why did you disable AGP8X? Is your card not 8X capable?



See above under item "2".



> And speaking of problems... bulging capacitors on the video card?

> Maybe you should replace the card, AGP cards are still available and

> they aren't that expensive.



Yes, I should replace it. But first, I need to verify what caused

the damage. If the crashes stop for at least 20 days after setting

board to 4X (hence diverting the 1.5V from the 0.8V part of the

board), then I'll know what the cause was. THEN I'll look for

an AGP 4X video card ( NOT an 8X, as my MB doesn't actually

support that, even though it says it does), or maybe even a PCI card.



What kind of moron invents a video bus system with several different

versions, all with different voltage levels (0.8V, 1.5V, 3.3V, etc),

and no foolproof way to prevent accidental overvoltages? Idiocy.

I'm guessing this is part of why AGP went the way of the dodo.



> ... it is fairly rare to see bugcheck messages with all the exact

> same parameters. Some of the parameters are specific to each machine,

> for example one of the parameters points to a memory address ...



Which is differs from day to day as well as from machine to machine.

So it's meaningless gibberish. Just like most of the rest of

Microsoft's error messages. Oh well. It's kinda quaint, actually.

First get the message ("Warning: hydrolytic anamorphic quadroceph

error in 3rd-order megalithic amalgamated therophon system causing

unhandled archaeophilic Chebyshev exception in llbj7523 module

at 0xA7B34F32 offset 0x03b8CE73, 0:47:32UTC 2010-03-26").

Then go to Microsoft website and get the translation.

("You ran out of memory. Buy more RAM or increase your pagefile size.)

Or maybe even: ("We never did figure that one out, and this operating

system is obsolete now, so please go yourself.") Sigh.



> http://support.microsoft.com/kb/275678



Basically says, "could be caused by everything but the kitchen

sink... and on a bad day, maybe that, too". Can't spend the

decades required to t'shoot it. If it's only going to happen

every 7 years, just let it crash.



> ... do you think that Microsoft would deliberately make it shut down

> the machine just to annoy users? ...



Why not? Hey, sadism does have it's appeal.



> ... not shutting down the machine in cases like that would result

> in an even more unstable machine which could then lead to more

> serious problems ...



http://www.youtube.com/watch?v=MSZzMaCwekg



"Oops, a 1-bit error in the hardware drivers, bumped up the voltage

to the ICs by an order of magnitude, oh gawd that SMELL!" >:-D



--

Cheers,

Robbie Hatley

perl -le 'print "\154o\156e\167o\154f\100w\145ll\56c\157m"'

perl -le 'print "\150ttp\72//\167ww.\167ell.\143om/~\154onewolf/"'