cluberti

I can't remember the post, but there was another issue on this board that I debugged about a week ago with the same issue, and that poster ended up having to reinstall Windows and the latest Radeon driver, and the problem went away.

Well, unless some other program installed that file, that's what it is, yes

Have you looked at this?

Is the serial retail or OEM, and is the copy of XP Pro you're installing retail or OEM? If you try to use a retail key on an OEM install, or an OEM key on a retail install, this is the exact error you're going to get.

The key on the laptop is specific to the MCE version of XP, and you can't use it on XP Pro (that's considered a different version), just like you can't use it on XP Home either.

That's a lot of shared locks, more than I would expect to see. Is there any way you can FTP that file to me? I've PM'ed you a location.

Well, I'm not sure the card is at fault - go to ATI's site and get the latest drivers for your card first. Then, uninstall any ATI drivers/software you currently have installed, and reboot. Last, install the new ATI software and drivers you downloaded, and see if that helps.

ezekiel, F4's can get in a situation where a dump cannot be written, even when the paging file is configured properly on the Windows volume and the box is configured to get a dump. If Dell insists it's a software problem, have them open a case with Microsoft for you (this really looks like a hardware problem, though).

So..... what is dvd43.sys? It's probably DVD Region+CSS Free, and that's the culprit, according to your notes...

I... don't think win32k.sys is the culprit, but a victim of the display driver itself. Just because !analyze -v tells you a module is at fault doesn't mean it's right (it is usually, but not in situations like gde32 or win32k or ntdll, etc, api .dlls - these are usually victims, because some driver called an API they expose, and because we were using that API during the crash, !analyze -v tags that system file as the culprit). // The STOP 0x50 1: kd> .bugcheck Bugcheck code 10000050 Arguments 819af42f 00000000 bf9e14fe 00000000 // Thread running at the time of the bugcheck 1: kd> kb ChildEBP RetAddr Args to Child WARNING: Stack unwind information not available. Following frames may be wrong. afd9409c bf9df4fa afd946b0 000004c0 00000494 ati2dvag+0xc4fe afd94680 bfa0f837 e21f72d8 00000000 00000001 ati2dvag+0xa4fa afd946f0 bf805da2 e2ae0e90 e3ca8010 00000000 ati2dvag+0x3a837 afd9473c bf86e78d e2ae0e90 e3ca8010 00000000 win32k!WatchdogDrvCopyBits+0x53 afd94784 bf86e5a5 bf805d56 afd9482c e2ae0e90 win32k!OffCopyBits+0x7d afd94838 bf86e7da e2ae0e90 e3ca8010 00000000 win32k!SpBitBlt+0xfc afd9486c bf80a587 e2ae0e90 e3ca8010 00000000 win32k!SpCopyBits+0x27 afd94900 804dd99f e2ae0e80 bf9a5740 e15c2de0 win32k!NtGdiBitBlt+0x51c afd94900 7c90eb94 e2ae0e80 bf9a5740 e15c2de0 nt!KiFastCallEntry+0xfc 0012e31c 00000000 00000000 00000000 00000000 0x7c90eb94 // Registers - note that we're trying to write the data located in the memory pointed to // by the esi register into the memory address at eax (0x000004c0), which is invalid, // which is why we bugchecked: 1: kd> r eax=000004c0 ebx=afd946b0 ecx=40cd7a17 edx=00000000 esi=819af42f edi=89b53240 eip=bf9e14fe esp=afd9408c ebp=afd9409c iopl=0 ov up ei pl nz na pe cy cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010a07 ati2dvag+0xc4fe: bf9e14fe 8b06 mov eax,dword ptr [esi] ds:0023:819af42f=???????? // Invalid memory address, within the first 64K of VA which is marked // PAGE_NO_ACCESS (always): 1: kd> dc 0x000004c0 000004c0 ???????? ???????? ???????? ???????? ???????????????? 000004d0 ???????? ???????? ???????? ???????? ???????????????? 000004e0 ???????? ???????? ???????? ???????? ???????????????? 000004f0 ???????? ???????? ???????? ???????? ???????????????? 00000500 ???????? ???????? ???????? ???????? ???????????????? 00000510 ???????? ???????? ???????? ???????? ???????????????? 00000520 ???????? ???????? ???????? ???????? ???????????????? 00000530 ???????? ???????? ???????? ???????? ???????????????? // Driver responsible: 1: kd> lmvm ati2dvag start end module name bf9d5000 bfa18000 ati2dvag T (no symbols) Loaded symbol image file: ati2dvag.dll Image path: ati2dvag.dll Image name: ati2dvag.dll Timestamp: Wed May 03 12:51:00 2006 (4458DF74) CheckSum: 0004D547 ImageSize: 00043000 Translations: 0000.04b0 0000.04e0 0409.04b0 0409.04e0 // The STOP 0xA 2: kd> .bugcheck Bugcheck code 1000000A Arguments 00000188 00000002 00000001 804e7f3a // Looks like pool corruption, caused by a kernel-mode driver (usermode drivers don't // corrupt pool directly in most cases): 2: kd> .trap 0xffffffffb0526498 ErrCode = 00000002 eax=00ffffff ebx=0000004b ecx=0000001d edx=0000010f esi=02de0000 edi=02de5000 eip=804e5160 esp=b052650c ebp=b0526540 iopl=0 nv up ei pl nz na pe nc cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010206 nt!RtlFillMemoryUlong+0x10: 804e5160 f3ab rep stos dword ptr es:[edi] es:0023:02de5000=???????? // The thread running at the time of the bugcheck: 2: kd> kb *** Stack trace for last set context - .thread/.cxr resets it ChildEBP RetAddr Args to Child b052650c bf82f237 02de4c38 0000043c 00ffffff nt!RtlFillMemoryUlong+0x10 b0526540 bf82f0ae b05267b4 0000010f 02de0000 win32k!vSolidFillRect1+0x108 b05266c0 bf82bfa5 bf82f170 b05267b4 00000000 win32k!vDIBSolidBlt+0x19b b052672c bf8053fb e1c012d8 00000000 00000000 win32k!EngBitBlt+0xe1 b052677c bf80c955 e176f424 b05267d0 b05267b4 win32k!GrePatBltLockedDC+0x1ea b0526814 bf82f562 b052684c 0000f0f0 0012e7cc win32k!GrePolyPatBltInternal+0x17c b0526868 804dd99f a9010cbd 00f00021 0012e7cc win32k!NtGdiPolyPatBlt+0xb5 b0526868 7c90eb94 a9010cbd 00f00021 0012e7cc nt!KiFastCallEntry+0xfc WARNING: Frame IP not in any known module. Following frames may be wrong. 0012e7a8 00000000 00000000 00000000 00000000 0x7c90eb94 // Since this is a minidump, I can't see the driver that we're using, but these // functions are for modifying video memory, so it's highly likely it is the same // video driver as the previous dump, ati2dvag.sys.

Very cool - keep us posted.

If it's an Intel or AMD x64 chip, yes, it will work just fine.

Hmmm, very interesting. What happens if you boot that machine using a WinPE or BartPE disc to look at that array? How large is the array reported there?

Check google out.

Get a network trace from a failing client and see where it's actually trying to go, because the error indicates wherever it thinks it's going, that location doesn't exist .

I currently don't have anything but a laptop and an old server at home, nothing to bother with (I deal with this stuff at work enough to not want to come home to a PC ), but I just got myself an 8 core HP xw8400 with 16GB of RAM, 4x 500GB drives in a RAID10, and a Nvidia QuadroFX 1500 for a VM/home workstation rig. I'll have it next week, and I can't help but say I'm really geeked about it .

Yeah, a PS/2 keyboard request is an interrupt - it's possible for it not to be hardware, but that chance is really, really remote. If your box can't even handle an interrupt, I start checking hardware right away

Speak for yourself So we know a driver is causing it then, and since safe mode doesn't load the video driver, that's likely it. In looking at the dump, the next call after the win32k.sys "watchdog" function will be a call into ati2dvag!DrvGetDirectDrawInfo, which is failing. Either you have a bad video card, or the driver itself is messed up.

ERROR_INSTALL_SOURCE_ABSENT winerror.h # The installation source for this product is not available. # Verify that the source exists and that you can access it. # as an HRESULT: Severity: SUCCESS (0), FACILITY_NULL (0x0), Code 0x64c What source are you pointing your clients to? CNAMEs and SD GPO's generally don't like each other, btw. You'd be better off with a domain-based DFS that replicated to all sites to point to a single location rather than using CNAMEs to put a virtual location at each site.

OK, that points to win32k.sys - which is involved in (amongst other things) graphics display - those functions are involved in sending graphics data to your video driver, so have you tried running in safe mode or vga mode? Also, can you post that .dmp file here?

Configure your box for a complete memory dump and make sure you've got a PS/2 keyboard attached. The next time your box hangs, hold down the right-hand ctrl key and press the scroll lock key twice. If your box DOESN'T bugcheck with a STOP 0xE2, you have a hardware problem. If it does bugcheck, zip it up and host it somewhere we can get to the .dmp file and look at it (or open it yourself in windbg and run !locks on it and post that here in code tags, although providing the file is much easier for us).

If the memory tests OK, then this will be a kernel mode driver misbehaving. Can you enable your machine to do a complete memory dump, and provide the zipped .dmp file somewhere for us to look at the next time it crashes?

If you're good at following directions and don't need a fancy GUI, I find WUD and HFSLIP to be all you need to make fantastically quick and easy installation CDs. http://www.msfn.org/board/HFSLIP-f129.html

Client for Netware is only needed if you need to logon to a Novell network. If your workgroup or domain doesn't contain netware servers that you need access to, you can remove it.

The Windows 2000 scripting guide should be fine, there never will be a book for 2003. Since printer ports are technically just registry keys, you could write a script that stopped the print spooler service, read in the reg keys for the current values and wrote back the port values you wanted, then started the print spooler service.