HeeZy01

i was fed up with trying to figure this out and couldn't stand the bsod's so i just reformatted. my pc has been on for a few days now and not a bsod in sight. and i am using the same apps so i guess it was just a bad/faulty driver somewhere that was messing things up. anyway, thanks for the help in trying to figure this out.

i guess the only explaination is that it is just a bug in XP. i had the same experience where this never happened before. now it happens at some point when i open the startmenu and move my cursor around. now i just pin that tooitips-fix.exe to the start menu or even put it in my quick launch menu for easy access.

you can try tooltips-fix.exe. you can download it from here, http://channel9.msdn.com/ShowPost.aspx?PostID=162436 scrolll to the bottom and download it from the last post.

i do leave utorrent running overnight to help seed files. i currently allow 60 total connections at a time. i also leave peerguardian running to block bad ip's from connecting. i think i'm going to start with disabling netlimiter first and see if my box crashes overnight. thanks for the help.

crashed again this morning. there was an error in the event log caused by Srv, and the savedump log happened about 20 minutes later. Event Type: Error Event Source: Srv Event Category: None Event ID: 2019 Date: 6/16/2007 Time: 10:11:23 AM User: N/A Computer: PC-1 Description: The server was unable to allocate from the system nonpaged pool because the pool was empty. For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp. Data: 0000: 00 00 04 00 01 00 54 00 ......T. 0008: 00 00 00 00 e3 07 00 c0 ....ã..À 0010: 00 00 00 00 9a 00 00 c0 ....š..À 0018: 00 00 00 00 00 00 00 00 ........ 0020: 00 00 00 00 00 00 00 00 ........ 0028: 02 00 00 00 .... here is the memory.dmp when ran through the debugger. Microsoft (R) Windows Debugger Version 6.7.0005.0 Copyright (c) Microsoft Corporation. All rights reserved. Loading Dump File [C:\WINDOWS\MEMORY.DMP] Kernel Complete Dump File: Full address space is available Symbol search path is: C:\symbols Executable search path is: Windows XP Kernel Version 2600 (Service Pack 2) UP Free x86 compatible Product: WinNt, suite: TerminalServer SingleUserTS Built by: 2600.xpsp_sp2_qfe.070227-2300 Kernel base = 0x80800000 PsLoadedModuleList = 0x80883820 Debug session time: Sat Jun 16 10:14:08.109 2007 (GMT-4) System Uptime: 0 days 14:40:56.469 Loading Kernel Symbols .................................................................................................... .................................. Loading User Symbols .............. Loading unloaded module list ....................*** ERROR: Symbol file could not be found. Defaulted to export symbols for ntdll.dll - ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* Use !analyze -v to get detailed debugging information. BugCheck F4, {3, 82032880, 820329f4, 80923428} *** ERROR: Symbol file could not be found. Defaulted to export symbols for winsrv.dll - *** ERROR: Module load completed but symbols could not be loaded for CSRSRV.dll Probably caused by : ntdll.dll ( ntdll!NlsMbOemCodePageTag+1e3c0 ) Followup: MachineOwner --------- kd> !analyze -v ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* CRITICAL_OBJECT_TERMINATION (f4) A process or thread crucial to system operation has unexpectedly exited or been terminated. Several processes and threads are necessary for the operation of the system; when they are terminated (for any reason), the system can no longer function. Arguments: Arg1: 00000003, Process Arg2: 82032880, Terminating object Arg3: 820329f4, Process image file name Arg4: 80923428, Explanatory message (ascii) Debugging Details: ------------------ PROCESS_OBJECT: 82032880 IMAGE_NAME: ntdll.dll DEBUG_FLR_IMAGE_TIMESTAMP: 411096b4 FAULTING_MODULE: 4a680000 csrss PROCESS_NAME: csrss.exe EXCEPTION_RECORD: f9a209d8 -- (.exr 0xfffffffff9a209d8) ExceptionAddress: 7c936bd1 (ntdll!RtlFindMessage+0x0000007c) ExceptionCode: c0000006 (In-page I/O error) ExceptionFlags: 00000000 NumberParameters: 3 Parameter[0]: 00000000 Parameter[1]: 7c99a3d8 Parameter[2]: c000009a Inpage operation failed at 7c99a3d8, due to I/O error c000009a EXCEPTION_CODE: (NTSTATUS) 0xc000009a - Insufficient system resources exist to complete the API. DEFAULT_BUCKET_ID: DRIVER_FAULT ERROR_CODE: (NTSTATUS) 0xc0000006 - The instruction at "0x%08lx" referenced memory at "0x%08lx". The required data was not placed into memory because of an I/O error status of "0x%08lx". IO_ERROR: (NTSTATUS) 0xc000009a - Insufficient system resources exist to complete the API. EXCEPTION_STR: 0xc0000006_c000009a FAULTING_IP: ntdll!NlsMbOemCodePageTag+1e3c0 7c99a3d8 ?? ??? BUGCHECK_STR: 0xF4_IOERR_C000009A STACK_TEXT: f9a20520 80955b19 000000f4 00000003 82032880 nt!KeBugCheckEx+0x1b f9a20544 809233e6 80923428 82032880 820329f4 nt!PspCatchCriticalBreak+0x75 f9a20574 808077ec 82032ac8 c0000006 f9a209b0 nt!NtTerminateProcess+0x7d f9a20574 80806ae1 82032ac8 c0000006 f9a209b0 nt!KiFastCallEntry+0xf8 f9a205f4 80846864 ffffffff c0000006 f9a209f8 nt!ZwTerminateProcess+0x11 f9a209b0 8082f74c f9a209d8 00000000 f9a20d64 nt!KiDispatchException+0x3a0 f9a20d34 8080b06b 0056f26c 0056f28c 00000000 nt!KiRaiseException+0x175 f9a20d50 808077ec 0056f26c 0056f28c 00000000 nt!NtRaiseException+0x31 f9a20d50 7c936bd1 0056f26c 0056f28c 00000000 nt!KiFastCallEntry+0xf8 WARNING: Stack unwind information not available. Following frames may be wrong. 0056f568 75b7a5c5 7c900000 7c981080 7c981420 ntdll!RtlFindMessage+0x7c 0056fe9c 75b7b1ff 00183938 0000000c 00000001 winsrv!UserTestTokenForInteractive+0x5a21 0056febc 75b7b3cb 00000000 0056feec 00000000 winsrv!UserTestTokenForInteractive+0x665b 0056fed0 75b447a0 00000000 0056feec 00000005 winsrv!UserTestTokenForInteractive+0x6827 0056fff4 00000000 00000084 00000000 00000000 CSRSRV+0x47a0 STACK_COMMAND: kb FOLLOWUP_IP: ntdll!NlsMbOemCodePageTag+1e3c0 7c99a3d8 ?? ??? SYMBOL_NAME: ntdll!NlsMbOemCodePageTag+1e3c0 FOLLOWUP_NAME: MachineOwner MODULE_NAME: ntdll FAILURE_BUCKET_ID: 0xF4_IOERR_C000009A_ntdll!NlsMbOemCodePageTag+1e3c0 BUCKET_ID: 0xF4_IOERR_C000009A_ntdll!NlsMbOemCodePageTag+1e3c0 Followup: MachineOwner --------- kd> .reload;!analyze -v;r;kv;lmnt; Loading Kernel Symbols .................................................................................................... .................................. Loading User Symbols .............. Loading unloaded module list ....................*** ERROR: Symbol file could not be found. Defaulted to export symbols for ntdll.dll - ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* CRITICAL_OBJECT_TERMINATION (f4) A process or thread crucial to system operation has unexpectedly exited or been terminated. Several processes and threads are necessary for the operation of the system; when they are terminated (for any reason), the system can no longer function. Arguments: Arg1: 00000003, Process Arg2: 82032880, Terminating object Arg3: 820329f4, Process image file name Arg4: 80923428, Explanatory message (ascii) Debugging Details: ------------------ *** ERROR: Symbol file could not be found. Defaulted to export symbols for winsrv.dll - *** ERROR: Module load completed but symbols could not be loaded for CSRSRV.dll PROCESS_OBJECT: 82032880 IMAGE_NAME: ntdll.dll DEBUG_FLR_IMAGE_TIMESTAMP: 411096b4 FAULTING_MODULE: 4a680000 csrss PROCESS_NAME: csrss.exe EXCEPTION_RECORD: f9a209d8 -- (.exr 0xfffffffff9a209d8) ExceptionAddress: 7c936bd1 (ntdll!RtlFindMessage+0x0000007c) ExceptionCode: c0000006 (In-page I/O error) ExceptionFlags: 00000000 NumberParameters: 3 Parameter[0]: 00000000 Parameter[1]: 7c99a3d8 Parameter[2]: c000009a Inpage operation failed at 7c99a3d8, due to I/O error c000009a EXCEPTION_CODE: (NTSTATUS) 0xc000009a - Insufficient system resources exist to complete the API. DEFAULT_BUCKET_ID: DRIVER_FAULT ERROR_CODE: (NTSTATUS) 0xc0000006 - The instruction at "0x%08lx" referenced memory at "0x%08lx". The required data was not placed into memory because of an I/O error status of "0x%08lx". IO_ERROR: (NTSTATUS) 0xc000009a - Insufficient system resources exist to complete the API. EXCEPTION_STR: 0xc0000006_c000009a FAULTING_IP: ntdll!NlsMbOemCodePageTag+1e3c0 7c99a3d8 ?? ??? BUGCHECK_STR: 0xF4_IOERR_C000009A STACK_TEXT: f9a20520 80955b19 000000f4 00000003 82032880 nt!KeBugCheckEx+0x1b f9a20544 809233e6 80923428 82032880 820329f4 nt!PspCatchCriticalBreak+0x75 f9a20574 808077ec 82032ac8 c0000006 f9a209b0 nt!NtTerminateProcess+0x7d f9a20574 80806ae1 82032ac8 c0000006 f9a209b0 nt!KiFastCallEntry+0xf8 f9a205f4 80846864 ffffffff c0000006 f9a209f8 nt!ZwTerminateProcess+0x11 f9a209b0 8082f74c f9a209d8 00000000 f9a20d64 nt!KiDispatchException+0x3a0 f9a20d34 8080b06b 0056f26c 0056f28c 00000000 nt!KiRaiseException+0x175 f9a20d50 808077ec 0056f26c 0056f28c 00000000 nt!NtRaiseException+0x31 f9a20d50 7c936bd1 0056f26c 0056f28c 00000000 nt!KiFastCallEntry+0xf8 WARNING: Stack unwind information not available. Following frames may be wrong. 0056f568 75b7a5c5 7c900000 7c981080 7c981420 ntdll!RtlFindMessage+0x7c 0056fe9c 75b7b1ff 00183938 0000000c 00000001 winsrv!UserTestTokenForInteractive+0x5a21 0056febc 75b7b3cb 00000000 0056feec 00000000 winsrv!UserTestTokenForInteractive+0x665b 0056fed0 75b447a0 00000000 0056feec 00000005 winsrv!UserTestTokenForInteractive+0x6827 0056fff4 00000000 00000084 00000000 00000000 CSRSRV+0x47a0 STACK_COMMAND: kb FOLLOWUP_IP: ntdll!NlsMbOemCodePageTag+1e3c0 7c99a3d8 ?? ??? SYMBOL_NAME: ntdll!NlsMbOemCodePageTag+1e3c0 FOLLOWUP_NAME: MachineOwner MODULE_NAME: ntdll FAILURE_BUCKET_ID: 0xF4_IOERR_C000009A_ntdll!NlsMbOemCodePageTag+1e3c0 BUCKET_ID: 0xF4_IOERR_C000009A_ntdll!NlsMbOemCodePageTag+1e3c0 Followup: MachineOwner --------- eax=ffdff13c ebx=82032880 ecx=00000000 edx=82032868 esi=82032880 edi=821f2a28 eip=8085c736 esp=f9a20508 ebp=f9a20520 iopl=0 nv up ei ng nz na pe nc cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00000286 nt!KeBugCheckEx+0x1b: 8085c736 5d pop ebp ChildEBP RetAddr Args to Child f9a20520 80955b19 000000f4 00000003 82032880 nt!KeBugCheckEx+0x1b (FPO: [Non-Fpo]) f9a20544 809233e6 80923428 82032880 820329f4 nt!PspCatchCriticalBreak+0x75 (FPO: [Non-Fpo]) f9a20574 808077ec 82032ac8 c0000006 f9a209b0 nt!NtTerminateProcess+0x7d (FPO: [Non-Fpo]) f9a20574 80806ae1 82032ac8 c0000006 f9a209b0 nt!KiFastCallEntry+0xf8 (FPO: [0,0] TrapFrame @ f9a20584) f9a205f4 80846864 ffffffff c0000006 f9a209f8 nt!ZwTerminateProcess+0x11 (FPO: [2,0,0]) f9a209b0 8082f74c f9a209d8 00000000 f9a20d64 nt!KiDispatchException+0x3a0 (FPO: [Non-Fpo]) f9a20d34 8080b06b 0056f26c 0056f28c 00000000 nt!KiRaiseException+0x175 (FPO: [Non-Fpo]) f9a20d50 808077ec 0056f26c 0056f28c 00000000 nt!NtRaiseException+0x31 f9a20d50 7c936bd1 0056f26c 0056f28c 00000000 nt!KiFastCallEntry+0xf8 (FPO: [0,0] TrapFrame @ f9a20d64) WARNING: Stack unwind information not available. Following frames may be wrong. 0056f568 75b7a5c5 7c900000 7c981080 7c981420 ntdll!RtlFindMessage+0x7c 0056fe9c 75b7b1ff 00183938 0000000c 00000001 winsrv!UserTestTokenForInteractive+0x5a21 0056febc 75b7b3cb 00000000 0056feec 00000000 winsrv!UserTestTokenForInteractive+0x665b 0056fed0 75b447a0 00000000 0056feec 00000005 winsrv!UserTestTokenForInteractive+0x6827 0056fff4 00000000 00000084 00000000 00000000 CSRSRV+0x47a0 start end module name 4a680000 4a685000 csrss csrss.exe Wed Aug 04 02:03:11 2004 (41107C1F) 629c0000 629c9000 LPK LPK.DLL Wed Aug 04 03:56:26 2004 (411096AA) 74d90000 74dfb000 USP10 USP10.dll Wed Aug 04 03:56:42 2004 (411096BA) 75b40000 75b4b000 CSRSRV CSRSRV.dll Wed Aug 04 03:56:10 2004 (4110969A) 75b50000 75b60000 basesrv basesrv.dll Wed Aug 04 02:03:45 2004 (41107C41) 75b60000 75bab000 winsrv winsrv.dll Sat Mar 17 09:45:03 2007 (45FBF0DF) 75e90000 75f40000 sxs sxs.dll Thu Oct 19 09:59:53 2006 (453784D9) 77c10000 77c68000 msvcrt msvcrt.dll Wed Aug 04 03:59:14 2004 (41109752) 77dd0000 77e6b000 ADVAPI32 ADVAPI32.dll Wed Aug 04 03:56:23 2004 (411096A7) 77e70000 77f01000 RPCRT4 RPCRT4.dll Wed Mar 08 01:12:19 2006 (440E75C3) 77f10000 77f57000 GDI32 GDI32.dll Thu Mar 08 10:48:36 2007 (45F03054) 7c800000 7c8f5000 KERNEL32 KERNEL32.dll Mon Apr 16 12:07:27 2007 (46239F3F) 7c900000 7c9b0000 ntdll ntdll.dll Wed Aug 04 03:56:36 2004 (411096B4) 7e410000 7e4a1000 USER32 USER32.dll Thu Mar 08 10:48:36 2007 (45F03054) 80800000 80a14c00 nt ntoskrnl.exe Wed Feb 28 04:54:58 2007 (45E55172) 80a15000 80a28d00 hal halacpi.dll Mon Nov 15 20:37:02 2004 (419959BE) bf800000 bf9c2300 win32k win32k.sys Thu Mar 08 08:49:35 2007 (45F0146F) bf9c3000 bf9d4580 dxg dxg.sys Wed Aug 04 02:00:51 2004 (41107B93) bf9d5000 bfa09c00 s3savg4 s3savg4.dll Mon Jun 26 19:30:20 2000 (3957E78C) ee72f000 ee735000 pgfilter pgfilter.sys Tue Jan 30 03:16:42 2007 (45BEFEEA) ee872000 ee87a900 npf npf.sys Thu Jan 25 12:18:17 2007 (45B8E659) ee902000 ee90bd80 NMnt NMnt.sys Wed Aug 04 01:59:49 2004 (41107B55) ee922000 ee92a080 ipfltdrv ipfltdrv.sys Fri Aug 17 16:55:07 2001 (3B7D84AB) f2190000 f21b7f00 secdrv secdrv.sys Tue Aug 31 09:42:55 2004 (4134805F) f21e0000 f2231480 srv srv.sys Mon Aug 14 08:00:40 2006 (44E065E8) f23c2000 f23d9280 vmx86 vmx86.sys Fri Aug 04 13:52:41 2006 (44D38969) f23ea000 f23ecd00 vstor2 vstor2.sys Fri Aug 04 14:28:33 2006 (44D391D1) f23f2000 f23f5d00 vmnetuserif vmnetuserif.sys Fri Aug 04 14:20:02 2006 (44D38FD2) f242a000 f243d000 avgntflt avgntflt.sys Fri Apr 27 10:31:25 2007 (4632093D) f248b000 f249f400 wdmaud wdmaud.sys Wed Jun 14 05:17:03 2006 (448FD40F) f24a0000 f24a3e60 Aspi32 Aspi32.SYS Wed Jul 17 11:53:00 2002 (3D3592DC) f25c8000 f25d6d80 sysaudio sysaudio.sys Wed Aug 04 02:15:54 2004 (41107F1A) f2708000 f270a800 VMNET VMNET.SYS Thu Dec 16 03:13:19 2004 (41C1439F) f8810000 f8827480 dump_atapi dump_atapi.sys Wed Aug 04 01:59:41 2004 (41107B4D) f8828000 f898c000 HCWUSB2 HCWUSB2.sys unavailable (FFFFFFFE) f898c000 f8996000 hcmon hcmon.sys Fri Aug 04 14:18:45 2006 (44D38F85) f8a54000 f8ac3000 mrxsmb mrxsmb.sys Tue Jun 20 10:02:37 2006 (4497FFFD) f8ac3000 f8aeda00 rdbss rdbss.sys Thu Jun 15 05:35:00 2006 (449129C4) f8aee000 f8b0fd00 afd afd.sys Wed Aug 04 02:14:13 2004 (41107EB5) f8b10000 f8b37c00 netbt netbt.sys Wed Aug 04 02:14:36 2004 (41107ECC) f8b38000 f8b6f180 tcpip6 tcpip6.sys Wed Aug 16 06:13:37 2006 (44E2EFD1) f8b70000 f8b91480 ipnat ipnat.sys Thu Apr 13 20:20:40 2006 (443EEAD8) f8bba000 f8bcce00 nltdi nltdi.sys Mon Apr 23 07:02:47 2007 (462C9257) f8bcd000 f8c25080 tcpip tcpip.sys Thu Apr 20 08:18:33 2006 (44477C19) f8c26000 f8c38400 ipsec ipsec.sys Wed Aug 04 02:14:27 2004 (41107EC3) f8c39000 f8c57000 fwdrv fwdrv.sys Mon Apr 15 06:28:31 2002 (3CBAAB4F) f8ccf000 f8cd1900 Dxapi Dxapi.sys Fri Aug 17 16:53:19 2001 (3B7D843F) f8ceb000 f8cedee0 xbcd xbcd.sys Fri May 13 16:59:42 2005 (4285153E) f8d17000 f8d4a180 update update.sys Wed Sep 01 18:27:22 2004 (41364CCA) f8d4b000 f8d7b100 rdpdr rdpdr.sys Wed Aug 04 02:01:10 2004 (41107BA6) f8d7c000 f8d8ce00 psched psched.sys Wed Aug 04 02:04:16 2004 (41107C60) f8e2d000 f8e43680 ndiswan ndiswan.sys Wed Aug 04 02:14:30 2004 (41107EC6) f8e44000 f8eaa000 apokdfs3 apokdfs3.SYS Wed Apr 11 13:59:50 2007 (461D2216) f8eaa000 f8f10000 adp6wck7 adp6wck7.SYS Mon Jun 04 01:12:12 2007 (46639F2C) f8f10000 f8f33a80 portcls portcls.sys Wed Jul 12 09:49:59 2006 (44B4FE07) f8f34000 f8f79500 emu10k1m emu10k1m.sys Fri Aug 03 22:36:34 2001 (3B6B5FB2) f8f7a000 f8f9d080 USBPORT USBPORT.SYS Mon Oct 23 07:14:41 2006 (453CA421) f8f9e000 f8fc0680 ks ks.sys Wed Aug 04 02:15:20 2004 (41107EF8) f8fc1000 f8fd4f00 VIDEOPRT VIDEOPRT.SYS Thu Aug 03 10:02:07 2006 (44D201DF) f8fd5000 f8fe8680 s3savg4m s3savg4m.sys Mon Jun 26 19:30:29 2000 (3957E795) f8ff5000 f8ff7580 ndistapi ndistapi.sys Fri Aug 17 16:55:29 2001 (3B7D84C1) f957d000 f957f280 rasacd rasacd.sys Fri Aug 17 16:55:39 2001 (3B7D84CB) f95ad000 f95af980 gameenum gameenum.sys Wed Aug 04 02:08:20 2004 (41107D54) f95bd000 f95c0080 tunmp tunmp.sys Wed Aug 04 02:03:15 2004 (41107C23) f95d5000 f95d8c80 mssmbios mssmbios.sys Wed Aug 04 02:07:47 2004 (41107D33) f960e000 f9627900 Mup Mup.sys Thu Sep 08 22:24:19 2005 (4320F253) f9628000 f96405c0 snapman snapman.sys Thu Mar 30 08:03:12 2006 (442BC900) f9641000 f966da80 NDIS NDIS.sys Wed Aug 04 02:14:27 2004 (41107EC3) f966e000 f96fa400 Ntfs Ntfs.sys Fri Feb 09 06:10:31 2007 (45CC56A7) f96fb000 f9711780 KSecDD KSecDD.sys Wed Aug 04 01:59:45 2004 (41107B51) f9712000 f9731700 fltMgr fltMgr.sys Mon Aug 21 05:43:31 2006 (44E98043) f9732000 f9749480 atapi atapi.sys Wed Aug 04 01:59:41 2004 (41107B4D) f974a000 f976f700 dmio dmio.sys Wed Aug 04 02:07:13 2004 (41107D11) f9770000 f978e880 ftdisk ftdisk.sys Fri Aug 17 16:52:41 2001 (3B7D8419) f978f000 f979fa80 pci pci.sys Wed Aug 04 02:07:45 2004 (41107D31) f97a0000 f97cdd80 ACPI ACPI.sys Wed Aug 04 02:07:35 2004 (41107D27) f97ce000 f97e5800 SCSIPORT SCSIPORT.SYS Wed Aug 04 01:59:39 2004 (41107B4B) f97e6000 f98d0000 sptd sptd.sys Tue May 29 20:47:33 2007 (465CC9A5) f98f1000 f98f9c00 isapnp isapnp.sys Fri Aug 17 16:58:01 2001 (3B7D8559) f9901000 f990ff80 ohci1394 ohci1394.sys Fri Aug 12 20:11:00 2005 (42FD3A94) f9911000 f991e000 1394BUS 1394BUS.SYS Wed Aug 04 02:10:03 2004 (41107DBB) f9921000 f992b500 MountMgr MountMgr.sys Wed Aug 04 01:58:29 2004 (41107B05) f9931000 f993dc80 VolSnap VolSnap.sys Wed Aug 04 02:00:14 2004 (41107B6E) f9941000 f9949e00 disk disk.sys Wed Aug 04 01:59:53 2004 (41107B59) f9951000 f995d180 CLASSPNP CLASSPNP.SYS Wed Oct 05 19:53:44 2005 (43446788) f9961000 f9969b80 PxHelp20 PxHelp20.sys Fri Feb 02 16:23:57 2007 (45C3ABED) f9971000 f997b580 agp440 agp440.sys Wed Aug 04 02:07:40 2004 (41107D2C) f9991000 f9999880 Fips Fips.SYS Fri Aug 17 21:31:49 2001 (3B7DC585) f99a1000 f99aa400 avipbb avipbb.sys Mon Mar 19 12:41:09 2007 (45FEBD25) f99b1000 f99bce80 STREAM STREAM.SYS Fri Nov 04 20:55:09 2005 (436C02ED) f99c1000 f99d0380 rspndr rspndr.sys Wed Nov 08 05:28:09 2006 (4551B139) f99d1000 f99e0900 Cdfs Cdfs.SYS Wed Aug 04 02:14:09 2004 (41107EB1) f99e1000 f99ea000 HIDCLASS HIDCLASS.SYS Fri Sep 01 07:09:05 2006 (44F814D1) f9a31000 f9a39a80 processr processr.sys Fri Aug 27 17:42:44 2004 (412FAAD4) f9a41000 f9a4de00 i8042prt i8042prt.sys Wed Aug 04 02:14:36 2004 (41107ECC) f9a51000 f9a5b400 imapi imapi.sys Tue Jul 05 19:45:39 2005 (42CB1BA3) f9a61000 f9a6d180 cdrom cdrom.sys Wed Aug 04 01:59:52 2004 (41107B58) f9a71000 f9a7f080 redbook redbook.sys Wed Aug 04 01:59:34 2004 (41107B46) f9a81000 f9a8fb80 drmk drmk.sys Wed Aug 04 02:07:54 2004 (41107D3A) f9a91000 f9a99e80 sfmanm sfmanm.sys Fri Aug 03 22:36:35 2001 (3B6B5FB3) f9aa1000 f9aaa880 AN983 AN983.sys Wed Jan 12 20:27:59 2005 (41E5CE9F) f9ab1000 f9abd880 rasl2tp rasl2tp.sys Wed Aug 04 02:14:21 2004 (41107EBD) f9ac1000 f9acb200 raspppoe raspppoe.sys Wed Aug 04 02:05:06 2004 (41107C92) f9ad1000 f9adcd00 raspptp raspptp.sys Wed Aug 04 02:14:26 2004 (41107EC2) f9ae1000 f9ae9900 msgpc msgpc.sys Wed Aug 04 02:04:11 2004 (41107C5B) f9af1000 f9afc900 pcouffin pcouffin.sys Tue Dec 05 09:39:53 2006 (457584B9) f9b01000 f9b0af00 termdd termdd.sys Wed Aug 04 01:58:52 2004 (41107B1C) f9b11000 f9b1a480 NDProxy NDProxy.SYS Fri Aug 17 16:55:30 2001 (3B7D84C2) f9b31000 f9b3f780 usbhub usbhub.sys Mon Oct 23 07:14:42 2006 (453CA422) f9b41000 f9b49700 wanarp wanarp.sys Wed Aug 04 02:04:57 2004 (41107C89) f9b51000 f9b59700 netbios netbios.sys Wed Aug 04 02:03:19 2004 (41107C27) f9b71000 f9b77200 PCIIDEX PCIIDEX.SYS Wed Aug 04 01:59:40 2004 (41107B4C) f9b79000 f9b7d900 PartMgr PartMgr.sys Fri Aug 17 21:32:23 2001 (3B7DC5A7) f9ba1000 f9ba7180 HIDPARSE HIDPARSE.SYS Wed Aug 04 02:08:15 2004 (41107D4F) f9ba9000 f9baf000 kbdclass kbdclass.sys Wed Aug 04 01:58:32 2004 (41107B08) f9bb1000 f9bb6a00 mouclass mouclass.sys Wed Aug 04 01:58:32 2004 (41107B08) f9bb9000 f9bbe080 usbuhci usbuhci.sys Mon Oct 23 07:14:42 2006 (453CA422) f9bc1000 f9bc5300 usbohci usbohci.sys Mon Oct 23 07:14:41 2006 (453CA421) f9bc9000 f9bd0600 usbehci usbehci.sys Mon Oct 23 07:14:40 2006 (453CA420) f9bd1000 f9bd5ca0 xbreader xbreader.sys Tue Jan 02 16:53:28 2001 (3A524DD8) f9bd9000 f9bdd500 watchdog watchdog.sys Wed Aug 04 02:07:32 2004 (41107D24) f9bf1000 f9bf6b00 vmnetbridge vmnetbridge.sys Fri Aug 04 14:20:06 2006 (44D38FD6) f9c21000 f9c25720 pstrip pstrip.sys Mon Nov 08 07:02:53 2004 (418F606D) f9c89000 f9c8d880 TDI TDI.SYS Wed Aug 04 02:07:47 2004 (41107D33) f9c91000 f9c95580 ptilink ptilink.sys Fri Aug 17 16:49:53 2001 (3B7D8371) f9c99000 f9c9d080 raspti raspti.sys Fri Aug 17 16:55:32 2001 (3B7D84C4) f9cc1000 f9cc6200 vga vga.sys Wed Aug 04 02:07:06 2004 (41107D0A) f9cc9000 f9cce000 Msfs Msfs.SYS unavailable (FFFFFFFE) f9cd1000 f9cd8880 Npfs Npfs.SYS Wed Aug 04 02:00:38 2004 (41107B86) f9ce9000 f9cee880 ssmdrv ssmdrv.sys Wed Feb 28 10:43:23 2007 (45E5A31B) f9cf9000 f9d00180 Ip6Fw Ip6Fw.sys Wed Aug 04 02:00:04 2004 (41107B64) f9d01000 f9d04000 BOOTVID BOOTVID.dll Fri Aug 17 16:49:09 2001 (3B7D8345) f9df1000 f9df2b80 kdcom kdcom.dll Fri Aug 17 16:49:10 2001 (3B7D8346) f9df3000 f9df4100 WMILIB WMILIB.SYS Fri Aug 17 17:07:23 2001 (3B7D878B) f9df5000 f9df6580 intelide intelide.sys Wed Aug 04 01:59:40 2004 (41107B4C) f9df7000 f9df9000 dmload dmload.sys unavailable (FFFFFFFE) f9e0b000 f9e0cb00 ctlfacem ctlfacem.sys Fri Aug 03 22:36:32 2001 (3B6B5FB0) f9e17000 f9e18100 swenum swenum.sys Wed Aug 04 01:58:41 2004 (41107B11) f9e19000 f9e1a280 USBD USBD.SYS Fri Aug 17 17:02:58 2001 (3B7D8682) f9e1b000 f9e1d000 Fs_Rec Fs_Rec.SYS unavailable (FFFFFFFE) f9e1d000 f9e1e080 Beep Beep.SYS Fri Aug 17 16:47:33 2001 (3B7D82E5) f9e1f000 f9e20080 mnmdd mnmdd.SYS Fri Aug 17 16:57:28 2001 (3B7D8538) f9e21000 f9e22080 RDPCDD RDPCDD.sys Fri Aug 17 16:46:56 2001 (3B7D82C0) f9e25000 f9e26800 avgio avgio.sys Thu Feb 22 09:57:32 2007 (45DDAF5C) f9e29000 f9e2a100 dump_WMILIB dump_WMILIB.SYS Fri Aug 17 17:07:23 2001 (3B7D878B) f9e47000 f9e48a20 PROCEXP100 PROCEXP100.SYS Tue Sep 26 09:46:39 2006 (45192F3F) f9ebf000 f9ebfc00 audstub audstub.sys Fri Aug 17 16:59:40 2001 (3B7D85BC) f9f2f000 f9f30000 Null Null.SYS unavailable (FFFFFFFE) f9fbc000 f9fbcd00 dxgthk dxgthk.sys Fri Aug 17 16:53:12 2001 (3B7D8438) Unloaded modules: ee817000 ee842000 kmixer.sys Timestamp: unavailable (00000000) Checksum: 00000000 f8a0c000 f8a15000 ipfltdrv.sys Timestamp: unavailable (00000000) Checksum: 00000000 f9ce1000 f9ce7000 pgfilter.sys Timestamp: unavailable (00000000) Checksum: 00000000 f2018000 f2021000 ipfltdrv.sys Timestamp: unavailable (00000000) Checksum: 00000000 f9cd9000 f9cdf000 pgfilter.sys Timestamp: unavailable (00000000) Checksum: 00000000 f9ea1000 f9ea3000 MSPCLOCK.sys Timestamp: unavailable (00000000) Checksum: 00000000 f9eb5000 f9eb7000 MSPQM.sys Timestamp: unavailable (00000000) Checksum: 00000000 ee817000 ee842000 kmixer.sys Timestamp: unavailable (00000000) Checksum: 00000000 ef142000 ef16d000 kmixer.sys Timestamp: unavailable (00000000) Checksum: 00000000 f9e2d000 f9e2f000 MSPCLOCK.sys Timestamp: unavailable (00000000) Checksum: 00000000 f0cd5000 f0d00000 kmixer.sys Timestamp: unavailable (00000000) Checksum: 00000000 f9eed000 f9eee000 drmkaud.sys Timestamp: unavailable (00000000) Checksum: 00000000 f243d000 f2468000 kmixer.sys Timestamp: unavailable (00000000) Checksum: 00000000 f27c8000 f27d5000 DMusic.sys Timestamp: unavailable (00000000) Checksum: 00000000 f2468000 f248b000 aec.sys Timestamp: unavailable (00000000) Checksum: 00000000 f27d8000 f27e6000 swmidi.sys Timestamp: unavailable (00000000) Checksum: 00000000 f9e45000 f9e47000 splitter.sys Timestamp: unavailable (00000000) Checksum: 00000000 f9b61000 f9b71000 serial.sys Timestamp: unavailable (00000000) Checksum: 00000000 f9cb9000 f9cbe000 Cdaudio.SYS Timestamp: unavailable (00000000) Checksum: 00000000 f9581000 f9584000 Sfloppy.SYS Timestamp: unavailable (00000000) Checksum: 00000000 it says something about ntdll.dll which i think is a file from netlimiter which i use. hopefully someone can find a culprit.

i will do that. it crashed again this morning with the same error. i used to be able to leave my PC on for weeks without even restarting or bsod'ing. now this happens. if i can't figure this out, i might as well re-format. i'll post the complete dump here tomorrow morning.

heres my setup. i have 2 hard drives on the primary IDE. the primary HDD is 25 GB and the secondary HDD is 80 GB and split into 2 partitions, a 5GB and a 71GB. i use the 5 GB partition to install a secondary OS like server 2003 or a custom XP i make. the 71 GB partition is used to store data. i have been using my secondary OS (server 2003) for weeks without any problems. never got a BSOD....ever. i leave it on overnight with utorrent and peerguardian running. but then i decided to switch back to XP because some apps i really need to use don't work properly in 2003. heres where the bsods begin. ever since i switched back to XP, i get BSOD's overnight with an 0xF4 error. and sometimes an 0x8E when i reboot. its something to do with a pagefile or HDD error. i have a 768 MB pagefile on the D: drive that i use in XP (i have an older system with 256 MB of RAM). i tried different variations of firewall/AV combinations, but no matter what, i get a bsod overnight. i had Sygate Personal firewall installed and the dumps would say that one of the drivers caused the error, so i uninstalled it and installed comodo. i got a bsod the next morning. i uninstalled it and now i tried kerio 2.1.5 firewall and just got a 0xF4 bsod this morning. the screen doesn't specify a driver or the cause of the bsod, but just the 0xF4 error. i never had this problem before i started using server 2003 on my D: drive. i switch back to XP and all hell breaks loose with these bsods. here is the latest dump file, Loading Dump File [C:\WINDOWS\Minidump\Mini061307-01.dmp] Mini Kernel Dump File: Only registers and stack trace are available Symbol search path is: C:\symbols Executable search path is: Windows XP Kernel Version 2600 (Service Pack 2) UP Free x86 compatible Product: WinNt, suite: TerminalServer SingleUserTS Built by: 2600.xpsp_sp2_qfe.070227-2300 Kernel base = 0x80800000 PsLoadedModuleList = 0x80883820 Debug session time: Wed Jun 13 03:48:09.172 2007 (GMT-4) System Uptime: 0 days 14:26:04.983 Loading Kernel Symbols .................................................................................................... .................................... Loading User Symbols Loading unloaded module list ....................... ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* Use !analyze -v to get detailed debugging information. BugCheck F4, {3, 82040da0, 82040f14, 80923428} Probably caused by : hardware_disk Followup: MachineOwner --------- kd> !analyze -v ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* CRITICAL_OBJECT_TERMINATION (f4) A process or thread crucial to system operation has unexpectedly exited or been terminated. Several processes and threads are necessary for the operation of the system; when they are terminated (for any reason), the system can no longer function. Arguments: Arg1: 00000003, Process Arg2: 82040da0, Terminating object Arg3: 82040f14, Process image file name Arg4: 80923428, Explanatory message (ascii) Debugging Details: ------------------ PROCESS_OBJECT: 82040da0 IMAGE_NAME: hardware_disk DEBUG_FLR_IMAGE_TIMESTAMP: 0 FAULTING_MODULE: 00000000 PROCESS_NAME: csrss.exe EXCEPTION_RECORD: f279f9d8 -- (.exr 0xfffffffff279f9d8) ExceptionAddress: 7c936bd1 ExceptionCode: c0000006 (In-page I/O error) ExceptionFlags: 00000000 NumberParameters: 3 Parameter[0]: 00000000 Parameter[1]: 7c99a3d8 Parameter[2]: c000009a Inpage operation failed at 7c99a3d8, due to I/O error c000009a EXCEPTION_CODE: (NTSTATUS) 0xc000009a - Insufficient system resources exist to complete the API. CUSTOMER_CRASH_COUNT: 1 DEFAULT_BUCKET_ID: DRIVER_FAULT ERROR_CODE: (NTSTATUS) 0xc0000006 - The instruction at "0x%08lx" referenced memory at "0x%08lx". The required data was not placed into memory because of an I/O error status of "0x%08lx". IO_ERROR: (NTSTATUS) 0xc000009a - Insufficient system resources exist to complete the API. EXCEPTION_STR: 0xc0000006_c000009a FAULTING_IP: +7c936bd1 7c936bd1 ?? ??? BUGCHECK_STR: 0xF4_IOERR_C000009A STACK_TEXT: f279f520 80955b19 000000f4 00000003 82040da0 nt!KeBugCheckEx+0x1b f279f544 809233e6 80923428 82040da0 82040f14 nt!PspCatchCriticalBreak+0x75 f279f574 808077ec 82040fe8 c0000006 f279f9b0 nt!NtTerminateProcess+0x7d f279f574 80806ae1 82040fe8 c0000006 f279f9b0 nt!KiFastCallEntry+0xf8 f279f5f4 80846864 ffffffff c0000006 f279f9f8 nt!ZwTerminateProcess+0x11 f279f9b0 8082f74c f279f9d8 00000000 f279fd64 nt!KiDispatchException+0x3a0 f279fd34 8080b06b 0354f26c 0354f28c 00000000 nt!KiRaiseException+0x175 f279fd50 808077ec 0354f26c 0354f28c 00000000 nt!NtRaiseException+0x31 f279fd50 7c936bd1 0354f26c 0354f28c 00000000 nt!KiFastCallEntry+0xf8 WARNING: Frame IP not in any known module. Following frames may be wrong. 0354f568 00000000 00000000 00000000 00000000 0x7c936bd1 STACK_COMMAND: kb FOLLOWUP_IP: +7c99a3d8 7c99a3d8 ?? ??? FOLLOWUP_NAME: MachineOwner MODULE_NAME: hardware_disk FAILURE_BUCKET_ID: 0xF4_IOERR_C000009A_IMAGE_hardware_disk BUCKET_ID: 0xF4_IOERR_C000009A_IMAGE_hardware_disk Followup: MachineOwner --------- what could be causing this error? a bad HDD? maybe someone can help me solve this. i am currently scanning my system with spybot.