Googling these error codes gives no results

[Xietsu]

1. Error code 000000000000001e, parameter1 ffffffffc0000005, parameter2 fffff80001028f73, parameter3 0000000000000000, parameter4 ffffffffffffffff.

After having my computer automatically restart, I review the Event Viewer and find this error code. What can I do about this to inhibit automatic restarts when they aren't wanted?

Some other codes I get from prompts asking me to send a particular error code to Microsoft's help center include the following:

1. BCCode : 1e BCP1 : FFFFFFFFC0000005 BCP2 : FFFFF80001028F73 BCP3 : 0000000000000000 BCP4 : FFFFFFFFFFFFFFFF OSVer : 5_2_3790 SP : 2_0 Product : 256_1

2. BCCode : 24 BCP1 : 000000000019033D BCP2 : FFFFFADF14CB4030 BCP3 : FFFFFADF14CB3A40 BCP4 : FFFFF8000103C87B OSVer : 5_2_3790 SP : 2_0 Product : 256_1

3. BCCode : 3b BCP1 : 00000000C0000005 BCP2 : FFFFF8000102748C BCP3 : FFFFFADF13330360 BCP4 : 0000000000000000 OSVer : 5_2_3790 SP : 2_0 Product : 256_1

4. BCCode : 3b BCP1 : 00000000C0000005 BCP2 : FFFFF8000104A31A BCP3 : FFFFFADF1592B0C0 BCP4 : 0000000000000000 OSVer : 5_2_3790 SP : 2_0 Product : 256_1

The above are contained within dialogs that pop-up 2-5 minutes after logging into my user account. I used to get COM server application errors with default Local Service activation permissions, but I found a fix to that in an old thread found in the velocityreviews.com forum.

Having reviewed the source tag in the Event Viewer known as "Save Dump", it seems such error codes found in this event may be more relevant to my automatic reboots and causation. I filtered the event viewer by source and have Save Dump events going back til January, with most seemingly different. I went to the folder...and it has 337 files. Here is a sample of twelve.

1. The computer has rebooted from a bugcheck. The bugcheck was: 0x00000024 (0x000000000019033d, 0xfffffadf14cb4030, 0xfffffadf14cb3a40, 0xfffff8000103c87b). A dump was saved in: C:\WINDOWS\Minidump\Mini050509-05.dmp.

2. The computer has rebooted from a bugcheck. The bugcheck was: 0x0000001e (0xffffffffc0000005, 0xfffff80001028f73, 0x0000000000000000, 0xffffffffffffffff). A dump was saved in: C:\WINDOWS\Minidump\Mini050509-04.dmp.

3. The computer has rebooted from a bugcheck. The bugcheck was: 0x0000003b (0x00000000c0000005, 0xfffff8000102748c, 0xfffffadf13bd0540, 0x0000000000000000). A dump was saved in: C:\WINDOWS\Minidump\Mini050509-03.dmp.

4. The computer has rebooted from a bugcheck. The bugcheck was: 0x0000003b (0x00000000c0000005, 0xfffff800012b75e0, 0xfffffadf14015340, 0x0000000000000000). A dump was saved in: C:\WINDOWS\Minidump\Mini050509-02.dmp.

5. The computer has rebooted from a bugcheck. The bugcheck was: 0x0000001e (0xffffffffc0000005, 0xfffff80001028f73, 0x0000000000000000, 0xffffffffffffffff). A dump was saved in: C:\WINDOWS\Minidump\Mini050509-01.dmp.

6. The computer has rebooted from a bugcheck. The bugcheck was: 0x0000001e (0xffffffffc0000005, 0xfffff80001028f73, 0x0000000000000000, 0xffffffffffffffff). A dump was saved in: C:\WINDOWS\Minidump\Mini050409-10.dmp.

7. The computer has rebooted from a bugcheck. The bugcheck was: 0x0000001e (0xffffffffc0000005, 0xfffff80001028f73, 0x0000000000000000, 0xffffffffffffffff). A dump was saved in: C:\WINDOWS\Minidump\Mini050409-09.dmp.

8. The computer has rebooted from a bugcheck. The bugcheck was: 0x0000003b (0x00000000c0000005, 0xfffff8000102748c, 0xfffffadf1782e360, 0x0000000000000000). A dump was saved in: C:\WINDOWS\Minidump\Mini050409-08.dmp.

9. The computer has rebooted from a bugcheck. The bugcheck was: 0x0000001e (0xffffffffc0000005, 0xfffff80001028f73, 0x0000000000000000, 0xffffffffffffffff). A dump was saved in: C:\WINDOWS\Minidump\Mini050409-07.dmp.

10. The computer has rebooted from a bugcheck. The bugcheck was: 0x000000d3 (0xfffff97fff3e3d6c, 0x000000000000000c, 0x0000000000000000, 0xfffff800010486c4). A dump was saved in: C:\WINDOWS\Minidump\Mini050409-06.dmp.

11. The computer has rebooted from a bugcheck. The bugcheck was: 0x0000001e (0xffffffffc0000005, 0xfffff80001028f73, 0x0000000000000000, 0xffffffffffffffff). A dump was saved in: C:\WINDOWS\Minidump\Mini050409-05.dmp.

12. The computer has rebooted from a bugcheck. The bugcheck was: 0x0000003b (0x00000000c0000005, 0xfffff800012b75e0, 0xfffffadf15eea340, 0x0000000000000000). A dump was saved in: C:\WINDOWS\Minidump\Mini050409-04.dmp.

System Specifications:

CPU: Core 2 Duo Wolfdale E8400 3.0GHz (stock)

GPU: ATI Radeon 4870 HD (stock)

Mobo: ASRock P43 Twins 1600

HDD: WD VelociRaptor 300GB 10K RPM

RAM: 8 GB OCZ Platinum DDR2 1066 MHZ (stock)

PSU: Corsair CMPSU-750TX

Audio: Creative X-Fi Platinum

OS: Windows XP x64 SP2

CD/DVD ROM: Asus DVD-E818A3T

CD/DVD burner: Samsung SH-S223Q

[cluberti]

Bug check 0x1E:

Bug Check 0x1E: KMODE_EXCEPTION_NOT_HANDLED
The KMODE_EXCEPTION_NOT_HANDLED bug check has a value of 0x0000001E. This indicates that a kernel-mode program generated an exception which the error handler did not catch.

Parameters
The following parameters are displayed on the blue screen.

Parameter Description 
1 The exception code that was not handled 
2 The address at which the exception occurred 
3 Parameter 0 of the exception 
4 Parameter 1 of the exception 


Cause
This is a very common bug check. To interpret it, you must identify which exception was generated.

Common exception codes include:

0x80000002: STATUS_DATATYPE_MISALIGNMENT
An unaligned data reference was encountered.

0x80000003: STATUS_BREAKPOINT
A breakpoint or ASSERT was encountered when no kernel debugger was attached to the system.

0xC0000005: STATUS_ACCESS_VIOLATION
A memory access violation occurred. (Parameter 4 of the bug check is the address that the driver attempted to access.)


For a complete list of exception codes, see the ntstatus.h file located in the inc directory of the Windows Driver Kit.

Bug check 0x24:

Bug Check 0x24: NTFS_FILE_SYSTEM
The NTFS_FILE_SYSTEM bug check has a value of 0x00000024. This indicates a problem occurred in ntfs.sys, the driver file that allows the system to read and write to NTFS drives.

Parameters
The following parameters are displayed on the blue screen.

Parameter Description 
1 Specifies source file and line number information. The high 16 bits (the first four hexadecimal digits after the "0x") identify the source file by its identifier number. The low 16 bits identify the source line in the file where the bug check occurred. 
2 If NtfsExceptionFilter is on the stack, this parameter specifies the address of the exception record. 
3 If NtfsExceptionFilter is on the stack, this parameter specifies the address of the context record. 
4 Reserved  


Cause
One possible cause of this bug check is disk corruption. Corruption in the NTFS file system or bad blocks (sectors) on the hard disk can induce this error. Corrupted SCSI and IDE drivers can also adversely affect the system's ability to read and write to disk, thus causing the error.

Another possible cause is depletion of nonpaged pool memory. If the nonpaged pool memory is completely depleted, this error can stop the system. However, during the indexing process, if the amount of available nonpaged pool memory is very low, another kernel-mode driver requiring nonpaged pool memory can also trigger this error.

Bug check 0x3b:

Bug Check 0x3B: SYSTEM_SERVICE_EXCEPTION
The SYSTEM_SERVICE_EXCEPTION bug check has a value of 0x0000003B. This indicates that an exception happened while executing a routine that transitions from non-privileged code to privileged code. 

Parameters
The following parameters are displayed on the blue screen.

Parameter Description 
1 The exception that caused the bug check 
2 The address of the exception record for the exception that caused the bug check 
3 The address of the context record for the exception that caused the bug check 
4 0  



Cause
This error has been linked to excessive paged pool usage and may occur due to user-mode graphics drivers crossing over and passing bad data to the kernel code.

Bug check 0xd3:

Bug Check 0xD3: DRIVER_PORTION_MUST_BE_NONPAGED
The DRIVER_PORTION_MUST_BE_NONPAGED bug check has a value of 0x000000D3. This indicates that the system attempted to access pageable memory at a process IRQL that was too high.

Parameters
The following parameters are displayed on the blue screen.

Parameter Description 
1 Memory referenced 
2 IRQL at time of reference 
3 0: Read

1: Write


4 Address that referenced memory 


If the driver responsible for the error can be identified, its name is printed on the blue screen and stored in memory at the location (PUNICODE_STRING) KiBugCheckDriver.

Cause
This bug check is usually caused by drivers that have incorrectly marked their own code or data as pageable.

If you want more than that, you'll have to get memory dumps of the actual problems uploaded somewhere for us to look at. However, seeing that these are generally all 0x1e, 0x24, and 0x3b bugchecks, I'd think this could be a filter driver installed by a firewall, or antivirus, or even potentially malicious code running in kernel. It *could* be a video driver issue, but that would be a pretty bizzare string of bugchecks from a video driver (again, it's possible, but probability is low). I'd make sure the system was clean, any antivirus software was updated to the latest version, and the same with firewall software (and any virtual CD drive software you may have on the box as well, if any exist - this seems to potentially be a driver issue that can access the disk subsystem, so that would include antivirus, firewall, virtual drive software, etc).

[Xietsu]

I've had Avira Antivir updated (as my anti-virus) and Comodo Internet Security as my firewall, with no threats being discovered. They both have virus scanners and sometimes I double scan. I maybe defragment every two months, but my low priority with that doesn't seem to be an issue as I didn't begin having crashing issues until I switched to Windows 64 bit. Do you think not utilizing the latest edition of DirectX (DirectX10) is creating some discrepancies with my GPU, the ATI Radeon 4870 HD?

Visit this thread at OCForums.com to have access to 26 of the 341 minidumps.

Edited May 7, 2009 by Xietsu

[cluberti]

Well, this is why we check - looks can be deceiving. It does look like your video driver (well, actually a supporting file, but part of the driver set) is indeed at fault:

1: kd> !thread
GetPointerFromAddress: unable to read from fffff800011b2758
THREAD fffffadf34ce9040  Cid 1020.036c  Teb: 00000000fffdb000 Win32Thread: fffffa8006ce99b0 RUNNING on processor 1
IRP List:
	Unable to read nt!_IRP @ fffffadf35332cf0
Not impersonating
GetUlongFromAddress: unable to read from fffff800011d1908
Owning Process			fffffadf34a532a0	   Image:		 EverQuest2.exe
Attached Process		  N/A			Image:		 N/A
fffff78000000000: Unable to get shared data
Wait Start TickCount	  163757	   
Context Switch Count	  1011787				 LargeStack
ReadMemory error: Cannot get nt!KeMaximumIncrement value.
UserTime				  00:00:00.000
KernelTime				00:00:00.000
Win32 Start Address 0x0000000000c46ede
Start Address 0x0000000077d59680
Stack Init fffffadf17598e00 Current fffffadf17597e30
Base fffffadf17599000 Limit fffffadf1758f000 Call 0
Priority 8 BasePriority 8 PriorityDecrement 0
Child-SP		  RetAddr		   : Args to Child														   : Call Site
fffffadf`17596f58 fffff800`0102e5b4 : 00000000`0000003b 00000000`c0000005 fffff97f`ff51cdef fffffadf`17597910 : nt!KeBugCheckEx
fffffadf`17596f60 fffff800`0102e03b : 00000000`00000000 fffff800`010486c4 fffffadf`17597220 00000000`00000000 : nt!KiBugCheckDispatch+0x74
fffffadf`175970e0 fffff800`0105492d : fffffadf`17597f00 00000000`17597910 00000000`00000000 00000000`00000000 : nt!KiSystemServiceHandler+0x7b
fffffadf`17597120 fffff800`01054ec3 : fffffadf`175975e4 fffffadf`17598bb0 00000000`00000000 00000000`17597910 : nt!RtlpExecuteHandlerForException+0xd
fffffadf`17597150 fffff800`0100b901 : fffffadf`00000000 fffffadf`17597910 fffffadf`17597f00 fffffadf`17598010 : nt!RtlDispatchException+0x2c0
fffffadf`17597810 fffff800`0102e6af : fffffadf`17597f00 fffffa80`07baa598 fffffadf`17597f90 00000000`00010600 : nt!KiDispatchException+0xd9
fffffadf`17597e10 fffff800`0102d30d : fffffadf`175984f0 fffffadf`17598280 fffffadf`00001f80 fffff97f`ff5288e7 : nt!KiExceptionExit
fffffadf`17597f90 fffff97f`ff51cdef : fffffa80`017e6268 00000000`00000000 fffffa80`014ced00 fffffa80`00000004 : nt!KiGeneralProtectionFault+0xcd (TrapFrame @ fffffadf`17597f90)
fffffadf`17598120 fffffa80`017e6268 : 00000000`00000000 fffffa80`014ced00 fffffa80`00000004 fffffa80`017e6268 : ati2cqag+0xcdef
fffffadf`17598128 00000000`00000000 : fffffa80`014ced00 fffffa80`00000004 fffffa80`017e6268 fffff97f`ff51a9d6 : 0xfffffa80`017e6268

1: kd> lmvm ati2cqag
start			 end				 module name
fffff97f`ff510000 fffff97f`ff5ca000   ati2cqag T (no symbols)		   
	Loaded symbol image file: ati2cqag.dll
	Image path: ati2cqag.dll
	Image name: ati2cqag.dll
	Timestamp:		Mon Dec 01 14:48:11 2008 (49343F7B)
	CheckSum:		 000B984C
	ImageSize:		000BA000
	Translations:	 0000.04b0 0000.04e4 0409.04b0 0409.04e4

All of the GPFs and Timer Expiry dumps you have all come back to the ATI driver not clearing a timer before freeing it's pool allocation, causing the DPC issue (which generates a protection fault on timer expiry, causing the bulk of the crash dumps you are seeing).

Time to go to ATI/AMD to get a driver that has this fixed, it seems. Good luck.

[Xietsu]

Where do I learn how all the debugger commands work, like the 2 I saw you use, "!thread" and "lmvm ati2cqag"? How did you know to use these two?

[cluberti]

Where do I learn how all the debugger commands work, like the 2 I saw you use, "!thread" and "lmvm ati2cqag"? How did you know to use these two?

Well, you really should have some development skills in the language(s) used in the apps you're debugging first (otherwise you are likely not to understand how the app works, therefore you'll have a hard time spotting 'non-working' behavior), in this case it's Windows so C and C++. Next, you'll need to actually study the debugger help (there's documentation in the actual windbg help files, installed with the debugging tools for windows package), and it also helps to read some books and do some debugging on your own. Debugging is more art than science too, so keep that in mind - experience is the best teacher.