Blue screen - Can someone read a minidump *.dmp file?

Paul wrote:
> E wrote:
>

>
> It almost seems like two different problems, or like perhaps
> a new driver was installed for the sound card, somewhere through
> the period covered by the dumps.

I am reconsidering what you mention here and have been looking over the
debuging results. Although the system is up and running and back in the
owners posession, I'm starting to wonder if the Seagate Barracuda HD may
be starting to fail.

After reinstalling the OS, the HD seemed louder than it should be, but
then I'm not sure how it is supposed to sound. I was wondering if it was
actually up in DMA mode 5 when I was reinstalling applications and
navigating through directories on the disk. But the HD was indeed in DMA
mode 5. I never ran Seatools on the thing. As far as I could tell disk
throughput seemed fine. Application loaded as fast as one would would
expect.

Like I think you are trying to mention here, if emu10k1m.sys where
always at fault, then why is there a change in the debug output after a
certain date? Why are there complaints about,' "nt" was not found in the
image list ' in later dumpfile analysis?

Although quoted from here in reference to an
"UNEXPECTED_KERNEL_MODE_TRAP_M (1000007f)"...
http://www.osronline.com/DDKx/ddtools/bccodes_0ug7.htm

/quote
A double fault can occur when the kernel stack overflows. This can
happen if multiple drivers are attached to the same stack. For example,
two file system filter drivers can be attached to the same stack and
then the file system can recurse back in, overflowing the stack.
/end_quote

....other possible causes are also listed.


> I'd try a test with Prime95, and see how long it will run error
> free. I get bored after about four hours of that, so that is
> probably enough error free testing, if you want to stop. If
> you have a temperature measurement program like Speedfan, you can
> watch the temperature while the test is running.
>
> Sometimes, memory develops faulta, as time passes. I've had a
> couple pieces of generic RAM bought on sale at local stores,
> that lasted a little over a year. And then had a stuck fault
> that memtest86+ could find. The replacement RAM from Crucial
> has been fine to date.
>
> You could also get a copy of CPUZ from www.cpuid.com/cpuz.php
> and check that the clocks used and memory timing values, make
> sense for the hardware. That would be a basic check that
> something was not fouled up, along the way, in the BIOS.
> And you don't want to "clear" the BIOS, without understanding
> what the hardware is doing at this moment - studying the system
> as it now stands, may help you understand the root cause of the
> problems.
>

BIOS is current, and I doubt there will be anymore revisions.

I think I'm going to go to her house and boot the system into a Seatools
disk and run the diagnostics on the HD, run memtest on system memory,
run Prime95 up in Windows, some type of 'burn-in' test and something to
test hard disk throughput, to compare it with HDs in the same class.
Wish I would have kept it another day or so.

On Tue, 18 Mar 2008 07:12:41 -0400, E
<> wrote:

>Paul wrote:

>Like I think you are trying to mention here, if emu10k1m.sys where
>always at fault, then why is there a change in the debug output after a
>certain date? Why are there complaints about,' "nt" was not found in the
>image list ' in later dumpfile analysis?
>

If you're talking about a longer period of time, there could
easily be random and infrequent, _ different_ bugs causing
errors. Windows is meant to make MS a ton of money, not to
be bullet proof.

kony wrote:
> On Tue, 18 Mar 2008 03:43:49 -0400, E
> <> wrote:
>
>
>>>> No, the SoundBlaster is still using the 2001 dated driver that that comes
>>>> with a Windows XP install. Windows Update has a newer one dated 2003. This
>>>> might fix the problem, but I'm afraid to chance it now. I've read about
>>>> Creative drivers being buggy.
>>> 1) MS does not write your CL sound card driver. When
>>> Windows was first installed, unfortunately MS thrust that
>>> old driver upon you, it would have been better if MS never
>>> bundled any driver and you (or whoever installed the OS) had
>>> instead gotten the then-current driver from Creative.
>> Yes, I didn't think MS wrote it. But I read somewhere in the past that
>> the CL sound card driver bundled with XP install disk was stable.
>
> I'm sure they made a best effort to make it so, but if it
> was ok would they release newer versions?

I can't argue with that.

>
>
>> If the
>> old CL was indeed the culprit I am glad to have finally identified it,
>> and have learned a lesson on that as well.
>
> Nothing is identified yet, just don't be afraid to try a
> newer driver. In general you should not use any drivers
> that came with windows if you have a newer alternative.
> That extends past the sound card to all other parts of the
> system.

Yes, I new better when I first started working with PCs. This has been
my instinct in the past. I've been stuck on a hardware failure on this
system for some reason. Hopefully it doesn't still have one. (crossing
fingers)

>
>
>> I have the same card in my old system, and it hasn't causes any obvious
>> problems running Windows XP. Works fine in Linux too it seems. But the
>> Linux Sound Blaster driver is part of ALSA (Advanced Linux Sound
>> Architecture) written by open source contributors.
>
> It may not be the sound card, but if it were obvious at
> first then there'd not be a problem, right? Trying a few
> things is the remaining course.

I am starting to wonder if it is the only problem. I need to spend some
more time on the system. I'm wondering about the HD.

>
>
>> I also had 'Plug and Play aware OS' set to NO in the BIOS. I changed it
>> to YES. I don't know if that makes any difference now, or would have, in
>> the past.
>>
>>> 2) Letting Windows Update take control of this would be
>>> doubly bad since you lose more control of what the default
>>> fallback driver is, versus having nothing associated after
>>> uninstalling an official Creative driver.
>> If MS didn't write the Creative Labs sound card driver bundled with the
>> XP install disk, then wouldn't this driver from Windows Update be a CL
>> written driver as well?
>
> Yes, but that makes it at best as recent as what CL has to
> offer and at worst, an older buggier driver. It isn't
> exactly new now, 2004, let alone 2001 was eons ago in a
> computer timeline.

I guess I trust MS on this to much.

This is no excuse for me not trying to install the latest Dell specific
driver by default (I'm a little buggy myself), but you would think
though, as common a piece of hardware as the SB Live! was, that MS, CL
and Dell would be in sync on this. And that at least CL, would have the
last stable driver ever written for the SB Live!, even for the Dell
version. After all, it is there card, and they apparently had Dell
specific drivers in the past, because it is in there little menu system.
But like so many other hardware venders, they all leave you to search
for it on places like driverguide.com . It only takes a little server
space, and with 300GB drives being so cheap and common place. Maybe they
are concerned over available bandwidth for legacy products. But I
thought we had a lot of that too. Sorry if I'm ranting.

How are Vista drivers for the SB Live! 5.1 I wonder? But then again, how
are Vista drivers for anything?

I'd almost be willing to bet that this Dell SB Live! would not cause
these type of problems in Linux. Maybe harder to get full functionality
out of the box, like MIDI support. But then I'm no Linux guru either.

Interestingly (I knew this long ago but forgot about it until getting
into the SB issue), there is independent WDM driver support for the SB
that may be worth looking into... http://kxproject.lugosoft.com/

Also this one... http://www.asio4all.com/

I wonder as to there stability.

Anyway, The SB Live! card is out of the system now. I've enabled the
onboard SoundMax hardware and installed its latest driver. I haven't
given up on it completely. I may do an extensive search for the latest
Dell specific driver, and download it if I can for the future. I think
its a good card overall.



>
>>> You should make a backup of the OS, so in worst case you
>>> just revert back to how it was before any changes are made,
>>> then download and install the latest XP driver from
>>> Creative's website, not Windows Update.
>> After I read what you say here, I went to Creative's site, and they
>> apparently have a different driver for a Soundblaster 5.1 from Dell.
>
> I had wondered about that but didn't write anything because
> my memory of the difference and which sound card model was
> vague. I know at least one Dell card was seemingly named to
> be the same model but didn't have some hardware support that
> the retail card did, so it needed to do some soft processing
> from a different driver - although it wouldn't have been
> uncommon for CL to have just merged all the files for both
> types of cards into one installer then the installer
> identifies the card and installs the appropriate files for
> it.

I knew at one point in the past, that it did need a slightly different
driver, but it was one of the many little things that got pushed back
into the recesses of my little brain.

It would be nice if they had merged it into one installer. But CL lists
the Dell SB 5.1 seperately, and seems to have taken any version of the
driver for it off there servers.

>
>
>> This SB 5.1 is indeed from her old Dell Dimension 4100. When I selected
>> my SB Live! 5.1 Digital (Dell) through Creative's menu system I was
>> eventually taken to a page that told me, "Please note that the product
>> you have selected has been classified as 'End of Service Life'". With no
>> apparent option to download a driver. I then went to Dell's site looking
>> for the driver and they have no option to select Windows XP as the
>> operating system for the Dell Dimension 4100. So it seems I was stuck
>> with Microsoft supplied drivers, or doing a web search to find
>> something. The common SB Live! 5.1's latest driver at Creative's site is
>> dated 2003, like the driver on at Windows Update.
>
> You might have some luck with a Google search like,
> http://www.google.com/search?q=Live+5.1+Dell+driver
> maybe throwing the word "XP" in as well.
>
> 2003 is an entire year, not a driver version number which is
> what you'd need to compare them. Also there can be some
> lag, when a driver is posted it may not be posted at both
> the manufacturer's site and windows update simultaneously.

Like I said above. I assume to much I suppose, but a card as common as
this, one would think that there was some concistancy. But I think I
have noticed this phenomenon in the past, even with nVidia drivers. I
usualy try to get driver directly from the manufacturer. But I know, it
takes vigilance.

>
>> I think I might have went through this when I first built the system,
>> and just settled for the bundled driver. A poor decision I suppose. I
>> wanted her to keep the SB Live! 5.1 because I thought it would provide
>> better gaming performance.
>>
>> It doesn't much matter now though. I have removed the Sound Blaster 5.1,
>> a TI chipset Firewire card that I had transfered from the old Dell,
>> moved critical data to the designated data partition, reformatted the C
>> partition, installed XP from scratch, enabled onboard SoundMax hardware
>> and installed its latest driver from Asus.
>>
>> I did the clean install because AVG Anti-virus has detected several
>> viruses over the last few months (although I don't think they where the
>> cause of the fatal stop errors and blue screens).
>
> It feels like we've been missing some critical info here.
> Why wouldn't a virus be a suspect? Just because AVG can't
> find anything now isn't always telling, some of them mutate
> and let's face it, the ultimate goal of the virus writer is
> for their creation not to be detected unless they want it to
> be so, and AVG is a pretty popular AV due to being free so
> any savvy malware writer would check whether AVG can detect
> their payload.

The blue screen problem has been occuring since I built the system, not
a daily occurance, maybe once every couple months, maybe a couple days
apart. I've always assumed there was a hardware problem (and there may
still be). When I made my original post, I had not even checked the AVG
test results.

>
> I'm not suggesting it's probably a virus, could still be a
> driver or something else.

The WinDbg application seems to point to a driver problem.

>
> Better question now is how did they get onto the system as
> this is a potential security hole (even if a user opening
> email with attachments) that needs closed to ensure a secure
> environment.

There are two people now that use this system, the owner, and her
boyfriend. I think his web browsing habits are behind the increase in
malware found in AVG logs, and seemingly in jest (or maybe with a hint
of seriousness), she suggested that malware brought on by his browsing
habits where the reason for the latest blue screen. I didn't take this
seriously at first because of the blue screen problems that predate
there aquaintance and subsequent relationship. Also, they have had a DSL
connection for a couple months now. This PC has only been connected by
dial-up for most of its history.

The broadband connection, and where he is taking IE, may be the reason
for the increase in malware. The system seemed to have a lot of up to
date software components that I did not install, like IE 7 and WM Player
11. So I think she had been manualy updating the system, or the system
has been updating itself. But I did not try to see how recent its patch
level was before I reinstalled Windows XP.

I don't think they are running any file sharing apps. I wish I would
have kept the AVG logs so I could give a closer look at directories
where the malware was being found. I do remember a few being found in
the Java cache. Also AVG seemed to think that the executable for the
Kodak Easy Share application installed on the system was a virus or that
it had been infected. Whatever the case, the icon for the Easy Share
..exe was missing, and Easy Share software would not run.

While at there place, setting the the system back up, I told him about
the number the viruses found by AVG and warned that some of the sites he
visits can be somewhat shady. And that you can expect these sites to try
to take over your browser and worse.

I'm not 100% sure, but I think the XP firewall was turned on. They only
use webmail, so its not coming in through an email client like OE or
Incredimail. I'm thinking they are coming in through IE.

>
>
>> Plus there was some
>> spyware, and three tool bars on the system. Could have stripped it all
>> away with Ad-Aware. But I was worried about viruses that AVG may not
>> have detected.
>
> Yes, I've came across plenty of systems AVG couldn't clean,
> some of the more aggressive viri will copy themselves
> everywhere as fast as anything can find them, even have
> separate threads just monitoring whether anything happened
> to each (other) so if you or AVG gets rid of a file the
> alternate thread just replaces it again. Real PITA to
> clean, can take as much time as doing a clean install or
> more, considering it's time spent at the keyboard instead of
> letting the windows installer run unattended.

Yes, I have seen comparisons on the web between virus apps and AVG did
not always finish on top.

>
>
>
>>>> I have the Asus Probe software installed now. Its running pretty cool, but
>>>> the case is open and there is no load, exept for me typing on the keyboard.
>>>>
>>> Hopefully this is correct, but on occasion Asus Probe has
>>> been known to not be accurate for any given board. You
>>> might double-check what the bios health/hardware monitor
>>> screen displays for temps, though for CPU it may be a little
>>> higher reading in the bios because the bios doesn't have
>>> Halt-Idle cooling mechanism like Windows does.
>> Yes, Asus probe read 33C at idol, while the environmental monitor in the
>> BIOS measured 38C. I'll wait and see. Hopefully I won't get another call
>> saying "it blue screened again". When I hooked her system back up at
>> here place, I noticed the lights dim for a split second when I turned
>> the system on, or even when I flipped the switch on the power strip.
>> Hopefully not more cause for problems and will ruin my reputation as the
>> family system builder.
>
>
> Quite a few systems with a fair amount of capacitance in the
> PSU will momentarily dim the lights due to inrush current to
> the caps. Not a big deal so long as the (household) wiring
> isn't intermittent which would tend to effect more than just
> the PC.
>
> You haven't mentioned if windows was fully patched (or I
> overlooked it), there might be something more fundamental
> wrong with windows itself as we do know it's windows after
> all, plenty of things that don't effect everyone slip
> through the cracks.

I'm not sure if Windows was 100% up to date before I reinstalled. It is
now though.

>
> The clean OS installation was probably the best start
> towards a solution, but if it ends up bluescreening once
> every month or some similarly infrequent period then just
> explain that they need to try more to isolate what the
> common variable is each time it does, isolating something
> that is rare and intermittent is difficult enough on a
> simple electro/electronic/mechanical system let alone a PC
> running windows.

I plan to go back over there soon and boot up into Seatools to do diags
on the HD. Also run some benchmark and burn-in type of applications to
check for hardware failures. Also I will check AVG logs to see if
infections are getting in even though the system is patched as of this
writing.

Thanks
Eddie

> Also AVG seemed to think that the executable for the
> Kodak Easy Share application installed on the system was a virus or that
> it had been infected. Whatever the case, the icon for the Easy Share
> .exe was missing, and Easy Share software would not run.

Correction

I meant to say, that the Easy Share executable's file icon image file
was not present in the icon. The Easy Share executable had, for lack of
better terminology, a generic icon, as if Windows could not identify the
file type. The Easy Share executable was still where is was supposed to
be, in the Easy Share directory, but Easy Share would not run. Did
malware infect the Easy Share executable, which AVG detected and
stripped out?

"E" <> wrote in message
news:...
> > Also AVG seemed to think that the executable for the
> > Kodak Easy Share application installed on the system was a virus or that
> > it had been infected. Whatever the case, the icon for the Easy Share
> > .exe was missing, and Easy Share software would not run.
>
> Correction
>
> I meant to say, that the Easy Share executable's file icon image file
> was not present in the icon. The Easy Share executable had, for lack of
> better terminology, a generic icon, as if Windows could not identify the
> file type. The Easy Share executable was still where is was supposed to
> be, in the Easy Share directory, but Easy Share would not run. Did
> malware infect the Easy Share executable, which AVG detected and
> stripped out?
>
>

I am not going to say it wasnt a virus, or that a virus wasnt embedded in
some way..

But it's not uncommon for AV programs to detect valid software as
malware/virus
http://www.google.co.uk/search?hl=en...+%2Bavg+detect
Your not alone either ;P
It looks like a lot of "possible false positives" have been happing with
EasyShare and AGV since jan 08...
AGV removes some registry componets of EasyShare so it isnt going to run..

mr deo wrote:
> "E" <> wrote in message
> news:...
>>
>> ...that the Easy Share executable's file icon image file
>> was not present in the icon. The Easy Share executable had, for lack of
>> better terminology, a generic icon, as if Windows could not identify the
>> file type. The Easy Share executable was still where is was supposed to
>> be, in the Easy Share directory, but Easy Share would not run. Did
>> malware infect the Easy Share executable, which AVG detected and
>> stripped out?
>>
>>
>
> I am not going to say it wasnt a virus, or that a virus wasnt embedded in
> some way..
>
> But it's not uncommon for AV programs to detect valid software as
> malware/virus
> http://www.google.co.uk/search?hl=en...+%2Bavg+detect
> Your not alone either ;P
> It looks like a lot of "possible false positives" have been happing with
> EasyShare and AGV since jan 08...
> AGV removes some registry componets of EasyShare so it isnt going to run..
>
>
I didn't do a google search on this, and didn't even check out the link
to the google search you did. But I am apt to believe that what you have
suggested here is the case.

Because I have had this experience with another box, AVG and a telephone
answering/voice mail application called Callstation. AVG doesn't like
Callstation (or maybe just this particular version) and will tamper with
its main executable, everytime. Re-installing the app is pointless.

So on the current PC, I did not bother reinstalling Easyshare. The
Windows Scanner and Camera wizard will work, is simple and to the point.

On Tue, 18 Mar 2008 09:44:54 -0400, E
<> wrote:

> > Also AVG seemed to think that the executable for the
>> Kodak Easy Share application installed on the system was a virus or that
>> it had been infected. Whatever the case, the icon for the Easy Share
>> .exe was missing, and Easy Share software would not run.
>
>Correction
>
>I meant to say, that the Easy Share executable's file icon image file
>was not present in the icon. The Easy Share executable had, for lack of
>better terminology, a generic icon, as if Windows could not identify the
>file type. The Easy Share executable was still where is was supposed to
>be, in the Easy Share directory, but Easy Share would not run. Did
>malware infect the Easy Share executable, which AVG detected and
>stripped out?
>

Probably a false detection, uninstall then reinstall the EZ
Share SW.

On Tue, 18 Mar 2008 15:58:25 -0400, E
<> wrote:


>Because I have had this experience with another box, AVG and a telephone
>answering/voice mail application called Callstation. AVG doesn't like
>Callstation (or maybe just this particular version) and will tamper with
>its main executable, everytime. Re-installing the app is pointless.
>
>So on the current PC, I did not bother reinstalling Easyshare. The
>Windows Scanner and Camera wizard will work, is simple and to the point.

One thing worth mentioning is some viri found in pirated
software is actually attached to the exe or dll for the
program itself, so there's no reasonable way to get rid of
the viri permanently except to avoid that infected copy of
the software.