Blue Screen Issue

  • Thread starter Thread starter GS
  • Start date Start date
G

GS

I originally posted under the subject *Memory Issue* which is not the
problem and so I'm reposting here. I apologize for this misleading
topic!

Using XP SP3 with all current updates

I used to only reboot my Dell portable workstation when updates were
done OR once a week to clear memory. For some reason I started getting
notifications about not enough resources for whatever process/task was
trying to run. Once I got the infamous 'blue screen of death'! Seems to
occur within 24 hrs of bootup now. I suspect something is causing
memory to fill up but can't find any evidence as Task Manager shows I
have over half of the total memory (2GB) available.

Interestingly, the blue screen just appeared while I was viewing
procmon again after posting my reply. I was able to gather more info
this time...

Stop: 0x000000F4 (0x00000003,0x8A18F1C8,0x8A18F33C,0x805D22DA)

When I rebooted I got a "The system has recovered from a serious error"
'Send Error Report' notification. It shows the following 'Error
signature'...

BCCode:f4 BCP1:00000003 BCP2:8A18F1C8 BCP3:8A18F33C BCP4:805D22DA
OSVer:5_1_2600 SP:3_0 Product:256_1

...which matches the Stop: line on the blue screen. Also, it placed
manifest.txt, Mini092813-01.dmp and sysdata.xml files in my profile
under...

Local Settings\Temp\WER4c51.dir00

My original Q:
Is there a utility that I could run to find the culprit?

I'm following up the links that Paul posted. Unfortunately, it will
take considerable time to test the results of each recommended step and
so I'll post back according...

Meanwhile, I'm open to all suggestions!

--
Garry

Free usenet access at http://www.eternal-september.org
ClassicVB Users Regroup!
comp.lang.basic.visual.misc
microsoft.public.vb.general.discussion
 
GS said:
I originally posted under the subject *Memory Issue* which is not the
problem and so I'm reposting here. I apologize for this misleading topic!

Using XP SP3 with all current updates

I used to only reboot my Dell portable workstation when updates were
done OR once a week to clear memory. For some reason I started getting
notifications about not enough resources for whatever process/task was
trying to run. Once I got the infamous 'blue screen of death'! Seems to
occur within 24 hrs of bootup now. I suspect something is causing memory
to fill up but can't find any evidence as Task Manager shows I have over
half of the total memory (2GB) available.

Interestingly, the blue screen just appeared while I was viewing procmon
again after posting my reply. I was able to gather more info this time...

Stop: 0x000000F4 (0x00000003,0x8A18F1C8,0x8A18F33C,0x805D22DA)

When I rebooted I got a "The system has recovered from a serious error"
'Send Error Report' notification. It shows the following 'Error
signature'...

BCCode:f4 BCP1:00000003 BCP2:8A18F1C8 BCP3:8A18F33C BCP4:805D22DA
OSVer:5_1_2600 SP:3_0 Product:256_1

..which matches the Stop: line on the blue screen. Also, it placed
manifest.txt, Mini092813-01.dmp and sysdata.xml files in my profile
under...

Local Settings\Temp\WER4c51.dir00

My original Q:
Is there a utility that I could run to find the culprit?

I'm following up the links that Paul posted. Unfortunately, it will take
considerable time to test the results of each recommended step and so
I'll post back according...

Meanwhile, I'm open to all suggestions!
Click to expand...

Look up your error here. This seldom describes every possible
root cause, but it's a start.

http://aumha.org/a/stop.htm

"0x000000F4: CRITICAL_OBJECT_TERMINATION

One of the many processes or threads crucial to system operation
has unexpectedly exited or been terminated. As a result, the system
can no longer function. Specific causes are many, and often best
resolved by a careful history of the problem and the circumstances
of the error message. One user, who experienced this on return from
Standby mode on Win XP SP2, found the cause was that Windows was
installed on a slave drive; compare KB 330100.
"

Similar useless description here.

http://msdn.microsoft.com/en-us/library/windows/hardware/ff560372(v=vs.85).aspx

In this example, the OP notes the failure of csrss.exe.
The "I/O Error" in my opinion, is a red herring. Something
caused the I/O Error, such as a rootkit running underneath
the OS. Systems don't just go around "failing" when you
attempt to page in a portion of csrss.exe :-) Someone just
a couple of days ago, had something similar, a critical component
failure, and hardware faults don't go around clobbering
just precisely one or two code files like that. If you
had disk problems, the problems would have affected other
things before it got this bad.

http://answers.microsoft.com/en-us/...000000f4/57339220-6a1f-41a7-b6b1-3405e499793f

Now that you have the Mini092813-01.dmp , you can feed that
to BlueScreenView to gain access to any other interesting info.
If you don't wish to use that program, there is also dumpchk.exe
from Microsoft, which would be more work to track down a copy.
It's too bad Microsoft doesn't just stick all their "useful"
utilities on the one web page.

My copy of dumpchk is in my WindowsXPSupportTools folder, so it
*might* have come from here. I don't keep good note, of all the
gigabytes of wasted downloads from Microsoft, that didn't
deliver the 12KB utility I happened to be looking for at the
time :-(

http://www.microsoft.com/en-us/download/details.aspx?id=18546

*******

Occasionally, other hardware can cause problems, such as a
memory fault in the area the OS normally loads into. And then
you need an offline memory check to verify it isn't system memory.
You can use memtest86+ for this. When you get a computer *new*, it
pays to run this and verify the vendor didn't ship crap RAM to you.
If you establish a baseline ("my system has no memory errors"),
that can be interesting later if memory errors start to show up. On my
current motherboard, when this happened ("good RAM goes bad"),
bumping the Northbridge voltage setting one notch, returned things
to normal. I've had a number of sticks of RAM on other systems,
that failed around the 1.5 to 2 year range, so actual failures
do happen.

http://www.memtest.org (downloads 1/2 way down the page)

Again, I have no reason to think this is the case.

You will need to collect more crash events, to get some
idea whether it's a "random hardware failure". For example,
if the Blue Screen error number is *different* each time,
that tells you to start looking at memory or bad hard drive,
or cabling/jumpering mistake. But when the same damn error number
happens over and over again, and it's an error that is related
to system security, that's when I begin to suspect malware
of some sort.

Some of the AV companies offer free tools for specific pests.
Kaspersky offers TDSSKiller for example, which is a specific
flavor of rootkit (TDSS/Alureon). I don't know if your
error is symptomatic of that, but it's just an idea to
keep in mind, as you collect more blue screen events.

(TDSSKiller info)

http://support.kaspersky.com/viruses/solutions/2663

( http://media.kaspersky.com/utilities/VirusUtilities/EN/tdsskiller.exe )

(237MB boot CD with offline malware scanning)

http://support.kaspersky.com/8092

You could also try researching csrss.exe, to see what
other malware or worm had a "taste" for it.

Paul
 
Hi Paul,
Again big thanks for the detailed reply!

I ran a scan with my a/v software and it found 12 fies ("AmRes_??.dll")
with suspected malware/trojan content so I put them into the 'sandbox'
instead of doing a repair. I also had it do a pre-boot scan and it
found 5 more files that I also sent to the 'sandbox'. This all took
place about 12 hours ago so I won't know if any of this affected a
solution for awhile yet.

I downloaded blueScreenView and ran it after the scan. didn't see
anything that jumps out, though!

Not sure this is a factor but the left side Ctrl key on my keyboard
doesn't fire a keydown/keypress event every time. The machine is a Dell
Precision M90 portable workstation that ran out of warranty a few years
ago. Otherwise, I guess it's "hurry up & wait" for now!<g>

--
Garry

Free usenet access at http://www.eternal-september.org
ClassicVB Users Regroup!
comp.lang.basic.visual.misc
microsoft.public.vb.general.discussion
 
Back
Top