BSOD

[MikeR]

3 times in the past couple of weeks, I've gotten a BSOD on my XP Pro SP3 box.
Event viewer records:

The computer has rebooted from a bugcheck. The bugcheck was: 0x1000000a (0x00000014,
0x00000002, 0x00000000, 0x804f05de). A dump was saved in:
C:\WINDOWS\Minidump\Mini090408-01.dmp.

I need a plan to solve this. Google hasn't been my friend on this one ;-<

Thanks,
Mike

 

[Leonard Grey]

This search term:

bugcheck 0x1000000a

provides lots of useful hits. In any case, keep in mind that with
respect to Windows XP, 'bugcheck' followed by 0x... usually refers to a
STOP error. In your case, the full description of the error is:

STOP: 0x0000000A IRQL_NOT_LESS_OR_EQUAL

You would have seen a blue screen with this description if your computer
was set to display BSODs. (XP's default is to skip the blue screen and
restart your computer - not very helpful IMHO.)

Either way, here is one of the better places to get the deal on your crash:
http://www.aumha.org/a/stop.php#0x0a

With this type of crash you may have to do a little figuring on your
own, since there's no one particular cause.

The dump file contains information from RAM in highly geek-ified form.
You can usually figure out the problem on your own in less time than it
would take someone to decipher it for you,

 

[MikeR]

This search term:

bugcheck 0x1000000a

provides lots of useful hits. In any case, keep in mind that with
respect to Windows XP, 'bugcheck' followed by 0x... usually refers to a
STOP error. In your case, the full description of the error is:

STOP: 0x0000000A IRQL_NOT_LESS_OR_EQUAL

You would have seen a blue screen with this description if your computer
was set to display BSODs. (XP's default is to skip the blue screen and
restart your computer - not very helpful IMHO.)

Either way, here is one of the better places to get the deal on your crash:
http://www.aumha.org/a/stop.php#0x0a

I did see that screen, but didn't write it down. Thanks for all the info, Leonard.
It's gonna take some time to go thru it all.

With this type of crash you may have to do a little figuring on your
own, since there's no one particular cause.

So far the stops have occured when I close a particular program, but I can't tell if
that's coincidence or cause.

 

[Leonard Grey]

Sounds like the "particular program" could be the problem. The program's
technical support should be able to help you. It may be that all you
need to do is to update the program.

 

[MikeR]

Sounds like the "particular program" could be the problem. The program's
technical support should be able to help you. It may be that all you
need to do is to update the program.

Unfortunately, it's one I wrote myself. I can't imagine anything I've changed that
would cause this. It makes use of serial (and USB as serial) ports. Maybe the USB
driver? It doesn't happen all the time, which is of course the worst troubleshooting
scenario. If I could narrow it down to a single device it would help.

 

[Gerry]

Mike

Does the error occur during or after the computer is booted? Does the
error occur if you boot to safe mode?

Disable automatic restart on system failure. This should help by
allowing time to write down the STOP code properly. Right click on
the My Computer icon on the Desktop and select Properties, Advanced,
Start-Up and Recovery, System Failure and uncheck box before
Automatically Restart.

Do not re-enable automatic restart on system failure. Check for variants
of the Stop Error message.

Sometimes the Stop Error Report names the problematic driver. Look on
the line below:
0x1000000a (0x00000014, 0x00000002, 0x00000000, 0x804f05de).

You do not have to wait for another BSOD if you know how to cause one to
occur.

You may also find clues in Event Viewer but often the the Report there
does not name the driver, when it may be named in the Stop Error Report.

Background information on Stop Error message
http://msdn2.microsoft.com/en-us/library/ms793589.aspx

0x0000000A: IRQL_NOT_LESS_OR_EQUAL
Typically due to a bad driver, or faulty or incompatible hardware or
software. Use the General Troubleshooting of STOP Messages checklist
above. Technically, this error condition means that a kernel-mode
process or driver tried to access a memory location to which it did not
have permission, or at a kernel Interrupt ReQuest Level (IRQL) that was
too high. (A kernel-mode process can access only other processes that
have an IRQL lower than, or equal to, its own.)
Source: http://aumha.org/a/stop.htm

Are there any yellow question marks in Device Manager? Right click on
the My Computer icon on your Desktop and select Properties,
Hardware,Device Manager. If yes what is the Device Error code?

Try Start, Run, type "sigverif.exe" without quotes and hit OK. What
drivers are listed as unsigned? Disregard those which are not checked.


--



Hope this helps.

Gerry
~~~~
FCA
Stourport, England
Enquire, plan and execute
~~~~~~~~~~~~~~~~~~~

 

[MikeR]

Gerry wrote:
Gerry -
Thanks for the response.

Mike

Does the error occur during or after the computer is booted? Does the
error occur if you boot to safe mode?

After. It occurs when I close a program.

Disable automatic restart on system failure. This should help by
allowing time to write down the STOP code properly. Right click on
the My Computer icon on the Desktop and select Properties, Advanced,
Start-Up and Recovery, System Failure and uncheck box before
Automatically Restart.

Do not re-enable automatic restart on system failure. Check for variants
of the Stop Error message. That's the way I'm set.

Sometimes the Stop Error Report names the problematic driver. Look on
the line below:
0x1000000a (0x00000014, 0x00000002, 0x00000000, 0x804f05de).

Do you mean one of these hex numbers, or something below that?

You do not have to wait for another BSOD if you know how to cause one to
occur.

As I said, it's intermittent. I haven't worked thru all the permutations of the
program (if it's the cause).

You may also find clues in Event Viewer but often the the Report there
does not name the driver, when it may be named in the Stop Error Report.

The latest one was a 0x00000048 CANCEL_START_IN_COMPLETED_IRP. This after I rolled
back a driver on a usb to serial adapter. What I see on the MS site is
"An IRP that had a Cancel routine set was completed normally, without cancellation.
But after it was complete, a driver called the IRP's Cancel routine.

This could be caused by a driver that completed the IRP and then attempted to cancel it.

It could also be caused by two drivers each trying to access the same IRP in an
improper way.

Resolving the Problem

The cancel routine parameter can be used to determine which driver or stack caused
the bug check."

I don't know what the cancel routine parameter is.

Background information on Stop Error message
http://msdn2.microsoft.com/en-us/library/ms793589.aspx

0x0000000A: IRQL_NOT_LESS_OR_EQUAL
Typically due to a bad driver, or faulty or incompatible hardware or
software. Use the General Troubleshooting of STOP Messages checklist
above. Technically, this error condition means that a kernel-mode
process or driver tried to access a memory location to which it did not
have permission, or at a kernel Interrupt ReQuest Level (IRQL) that was
too high. (A kernel-mode process can access only other processes that
have an IRQL lower than, or equal to, its own.)
Source: http://aumha.org/a/stop.htm

I'll check out the links you gave. I'm not finding much on either website on my own.
Lots of 404s. ;-(

Are there any yellow question marks in Device Manager? Right click on
the My Computer icon on your Desktop and select Properties,
Hardware,Device Manager. If yes what is the Device Error code?

No yellow. Device Manager thinks everything is good.

 

[Gerry]

Mike

Replies inline

Gerry wrote:
Gerry -
Thanks for the response.
After. It occurs when I close a program.
Do you mean one of these hex numbers, or something below that?

The name of a driver can appear below that.

As I said, it's intermittent. I haven't worked thru all the
permutations of the program (if it's the cause).
The latest one was a 0x00000048 CANCEL_START_IN_COMPLETED_IRP. This
after I rolled back a driver on a usb to serial adapter. What I see on
the MS site is
"An IRP that had a Cancel routine set was completed normally,
without cancellation. But after it was complete, a driver called the
IRP's Cancel routine.
This could be caused by a driver that completed the IRP and then
attempted to cancel it.
It could also be caused by two drivers each trying to access the same
IRP in an improper way.

Resolving the Problem

The cancel routine parameter can be used to determine which driver or
stack caused the bug check."

I don't know what the cancel routine parameter is.

Has the error occurred more than once? Any error that fails to reoccur
after restarting the computer is usually not worth investigating.

I'll check out the links you gave. I'm not finding much on either
website on my own. Lots of 404s. ;-(
No yellow. Device Manager thinks everything is good.
ser2pl.sys

USB-to-Serial Cable Driver - Prolific USB-to-Serial Bridge Cable -
Prolific Technology Inc.
Source: http://www.runscanner.net/filelibrary/ser2pl.sys.html
More information here: http://www.file.net/process/ser2pl.sys.html

tifsfilt.sys

Tifsfilt.sys is related to Acronis True Image software
Source: http://www.greatis.com/appdata/a/t/tifsfilt.sys.htm

mxdwdrv.dll

Driver for Microsoft Document writer.

mxdwdui.dll

Driver for Microsoft Document writer.

mxdwdui.gpd

Driver for Microsoft Document writer

mxdwdui.ini

Driver for Microsoft Document writer

unires.dll

unires.dll is a Unidrv Printer Driver Resource DLL from Microsoft
Corporation belonging to Microsoft® Windows® Operating System
Source: http://www.processlibrary.com/directory/files/unires/64352

--



Hope this helps.

Gerry
~~~~
FCA
Stourport, England
Enquire, plan and execute
~~~~~~~~~~~~~~~~~~~

 

[MikeR]

Thanks for hanging with me Gerry -

Replies inline

The name of a driver can appear below that.

It didn't.
Any idea what MS means by this?

Has the error occurred more than once? Any error that fails to reoccur
after restarting the computer is usually not worth investigating.

Three times so far. It happens after the program has been running for some time, say
2 or 3 hours. I'm trying to exercise only specific functions, but so far no luck in
pinning it down. AAAaaaarrrrrrrrrrggggggggghhhhhhhhhhhhhhhhhhh!

USB-to-Serial Cable Driver - Prolific USB-to-Serial Bridge Cable -
Prolific Technology Inc.
Source: http://www.runscanner.net/filelibrary/ser2pl.sys.html
More information here: http://www.file.net/process/ser2pl.sys.html

The USB-to-serial adapters are my main suspect, based on the fact that the program
uses two of them, and not a lot of others (video, printer but I haven't used the
printer when the crash occurs).

In Device Manager, one is named 'Prolific USB-To-Serial comm port(com4)' and the
other as 'USB serial port(com3)'. The package that they come in has no brand name.
I tried to reinstall the drivers, but it seems that nothing changes.

What I did.

Device manager - Uninstall driver for both adapters.

Unplug the com4 cable and plug it back in. The found new hardware dialog comes up,
and I install the driver from the CD. The com4 one wants ser2pl.sys, which is NOT on
the CD, leading me to believe it's not a Prolific device. So I get it from one I
downloaded from somewhere that I can't remember.

Unplug the com3 cable and plug it back in. The port reappears in Device Manager, and
no dialog pops up. I reinstall anyway from the CD, and driver details don't change.

Com4 driver details: ser2pl.sys and sernum.sys

Com3 driver details: ftser2k.sys, sernum.sys and ftserui.dll

I can't get them to match.

Tifsfilt.sys is related to Acronis True Image software
Source: http://www.greatis.com/appdata/a/t/tifsfilt.sys.htm


Driver for Microsoft Document writer.


Driver for Microsoft Document writer.


Driver for Microsoft Document writer


Driver for Microsoft Document writer


unires.dll is a Unidrv Printer Driver Resource DLL from Microsoft
Corporation belonging to Microsoft® Windows® Operating System
Source: http://www.processlibrary.com/directory/files/unires/64352

What is the implication of unsigned drivers? Can I just get the newer (if available)
ones, and copy them over the old files?

 

[Gerry]

Mike
Mike

Replies inline

Thanks for hanging with me Gerry -


It didn't.

The only way therefore would seem to be to examine the dump report.

snipped
snipped


Any idea what MS means by this?

Unfortunately not.

Three times so far. It happens after the program has been running for
some time, say 2 or 3 hours. I'm trying to exercise only specific
functions, but so far no luck in pinning it down.
AAAaaaarrrrrrrrrrggggggggghhhhhhhhhhhhhhhhhhh!

The USB-to-serial adapters are my main suspect, based on the fact
that the program uses two of them, and not a lot of others (video,
printer but I haven't used the printer when the crash occurs).

In Device Manager, one is named 'Prolific USB-To-Serial comm
port(com4)' and the other as 'USB serial port(com3)'. The package
that they come in has no brand name. I tried to reinstall the
drivers, but it seems that nothing changes.
What I did.

Device manager - Uninstall driver for both adapters.

Unplug the com4 cable and plug it back in. The found new hardware
dialog comes up, and I install the driver from the CD. The com4 one
wants ser2pl.sys, which is NOT on the CD, leading me to believe it's
not a Prolific device. So I get it from one I downloaded from
somewhere that I can't remember.
Unplug the com3 cable and plug it back in. The port reappears in
Device Manager, and no dialog pops up. I reinstall anyway from the
CD, and driver details don't change.

What happens with regard to Stop Error Reports if you disable the
device. How / where did you get the device from?

Com4 driver details: ser2pl.sys and sernum.sys

Com3 driver details: ftser2k.sys, sernum.sys and ftserui.dll

Do you mean serenum.sys? serenum.sys is for a serial port
http://www.file.net/process/serenum.sys.html

ser2pl.sys is for a USB port.

I can't get them to match.


What is the implication of unsigned drivers? Can I just get the newer
(if available) ones, and copy them over the old files?

Just because drivers are unsigned does not mean they need to be
replaced.



--



Hope this helps.

Gerry
~~~~
FCA
Stourport, England
Enquire, plan and execute
~~~~~~~~~~~~~~~~~~~

 

[MikeR]

Mike
Mike

Replies inline


The only way therefore would seem to be to examine the dump report.

Ouch! Off to MS support then I suppose.
Me: 'I have a problem I suspect is a driver issue'.
MS: 'Do I understand you believe you have a driver issue?'
Me: 'Yes. The issue is(long description here)'
MS: 'Do I understand you believe your issue is (long description)?'
etc,etc,etc

snipped


Unfortunately not. Dang!



What happens with regard to Stop Error Reports if you disable the
device. How / where did you get the device from?

Then the program can't find a serial port, so it doesn't use the portion I suspect is
the problem.
The adapters are from a company that sells ham radio gear and software.

After toying with this, I seem to remember that the problem started after I stupidly
fell for one of those programs which purports to find old drivers, and update them.
That may be why the disparity between the two devices drivers. I also tried a
rollback to no effect.

Do you mean serenum.sys? serenum.sys is for a serial port
http://www.file.net/process/serenum.sys.html

Yes, serenum.sys
That seems odd. Com3 is a USB-to-serial. Hmmmmm........
I just installed on a fresh box, and the files are: ftser2k.sys, serenum.sys,
FTLang.dll, adn ftserui2.dll

 

[Gerry]

Replies Inline

The Offline Crash Diagnostic tool for Windows XP is available
http://support.microsoft.com/kb/923800

Snipped

Then the program can't find a serial port, so it doesn't use the
portion I suspect is the problem.
The adapters are from a company that sells ham radio gear and
software.

What programme / company?

After toying with this, I seem to remember that the problem started
after I stupidly fell for one of those programs which purports to
find old drivers, and update them. That may be why the disparity
between the two devices drivers. I also tried a rollback to no effect.
Yes, serenum.sys
That seems odd. Com3 is a USB-to-serial. Hmmmmm........
I just installed on a fresh box, and the files are: ftser2k.sys,
serenum.sys, FTLang.dll, adn ftserui2.dll

In Device Manager USB Ports are listed under Universal Serial Bus
Controllers. Com3 and Com 4 should be listed under Ports (Com & LPT). On
my computer I only have Com 1 and Com 2.

USB Port
http://en.wikipedia.org/wiki/USB_hub

Serial Com Port
http://en.wikipedia.org/wiki/Serial_port

Parallel Com Port
http://en.wikipedia.org/wiki/IEEE_1284



--



Hope this helps.

Gerry
~~~~
FCA
Stourport, England
Enquire, plan and execute
~~~~~~~~~~~~~~~~~~~

 

[MikeR]

Gerry wrote:

The Offline Crash Diagnostic tool for Windows XP is available
http://support.microsoft.com/kb/923800

Thanks for that. I'll take a look. The dump however has disappeared, so I'll haave to
wait for the crash again.

What programme / company?

The program is one I'm writing. The adapters can be purchased all over the place.
Thesee came from http://www.hosenose.com/interfaces.asp

In Device Manager USB Ports are listed under Universal Serial Bus
Controllers. Com3 and Com 4 should be listed under Ports (Com & LPT). On
my computer I only have Com 1 and Com 2.

If you buy and install one of these, you'll add Comx (where x is come number not
already in use) eg Com3

USB Port
http://en.wikipedia.org/wiki/USB_hub

Serial Com Port
http://en.wikipedia.org/wiki/Serial_port

Parallel Com Port
http://en.wikipedia.org/wiki/IEEE_1284

What I'm working with is USB-to-serial converters. They show up in device manager
under Ports, titled as I said earlier.

 

[MikeR]

In Device Manager USB Ports are listed under Universal Serial Bus
Controllers. Com3 and Com 4 should be listed under Ports (Com & LPT). On
my computer I only have Com 1 and Com 2.

USB Port
http://en.wikipedia.org/wiki/USB_hub

Serial Com Port
http://en.wikipedia.org/wiki/Serial_port

Parallel Com Port
http://en.wikipedia.org/wiki/IEEE_1284

I just looked under USB Controllers and the is one entry labeled USB Serial
Converter. Driver files: listftdibus.sys, ftbusui.dll, ftd2xx.dll, FTLang.dll

 

[MikeR]

The Offline Crash Diagnostic tool for Windows XP is available
http://support.microsoft.com/kb/923800

I tried this. After the download, when I ran the exe I get

'Setup has detected that the Service Pack version of this system is newer than the
update you are applying. There is no need to install this update.'

I've written to MS, we'll see if they have anything useful to say about it...... ;-<

 

[MikeR]

The Offline Crash Diagnostic tool for Windows XP is available
http://support.microsoft.com/kb/923800

This tool doesn't work for SP3. After querying MS if something comparable exists,
they direct me to a sales phone number after the usual go-round of misunderstanding
what I'm asking.

Anyone here know what to use?