[Help] - 'Serious System Error' What does the info mean?

[Jorolat]

Hiya,

About half an hour ago my system suddenly failed and I got a blue screen saying (something like) "If this is the first time you've seen this ... then restart ... else contact your system administrator" - which as far as I know is me ('gulp')

I'm use XP and I had to do several reboots and a system restore before I could get back on the net.

After the first reboot I was given the following info:

BCCode : fe BCP1 : 00000002 BCP2 : 82773108 BCP3 : 828B1A78

BCP4 : 82EA5E70 OSV er : 5_1_2600 SP : 2_0 Product : 768_1

C:\DOCUME~1\JOHNRO~1\LOCALS~1\Temp\WER4bbe.dir00\Mini021606-01.dmp

C:\DOCUME~1\JOHNRO~1\LOCALS~1\Temp\WER4bbe.dir00\sysdata.xml

Can anyone tell me what it means please and how I can go about finding

out exactly what happened?

John Latter

* Title edited *

Please, use [TAGS] in your topic's title.

Follow new rules

--Sonic

[cluberti]

Post that minidump here, if you would, and I can at least tell you what happened - since minidumps are usually devoid of good information (they're only good for determining what happened, but not where and why), also do the following:

Configure your machine (in system properties) to do a complete memory dump, make sure your page file is on C: and the minimum size is at least as large as the amount of RAM in your machine +50MB, and if the problem happens again you'll get a complete memory dump (which will be easier to tshoot).

[Jorolat]

Post that minidump here, if you would, and I can at least tell you what happened - since minidumps are usually devoid of good information (they're only good for determining what happened, but not where and why), also do the following:

Configure your machine (in system properties) to do a complete memory dump, make sure your page file is on C: and the minimum size is at least as large as the amount of RAM in your machine +50MB, and if the problem happens again you'll get a complete memory dump (which will be easier to tshoot).

Hi Cluberti,

Thank you for replying.

I've attached the minidump (I guess that's how you do it). I got a bit confused because it wasn't where the error message said it would be but on thinking about it, it looks like it was moved from a temporary folder to a permanent one.

Anyway, here it is and I've grateful for your help

I'll now go and confuse myself even more by following the rest of your advice!

Back again, it wouldn't let me upload a file with that extension so I'll try changing it..

John Latter

Copy_of_Mini021606_01.txt

[Jorolat]

Configure your machine (in system properties) to do a complete memory dump, make sure your page file is on C: and the minimum size is at least as large as the amount of RAM in your machine +50MB, and if the problem happens again you'll get a complete memory dump (which will be easier to tshoot).

I found out where to change from a mini to a complete memory dump in system properties but I don't know how to locate the page file to see what size it is. Er, Could you help please?

John

[CptMurphy]

You can't actually look at the page file. But if you want to know where it is, it's a hidden system file called pagefile.sys. It's in your root directory. To see it you have to uncheck the hide system files setting in foler options. To see any errors, you have to look at the log file in the %systemroot%\minidump folder.

[Sonic]

This errors happens while using Internet Explorer, isn't it ?

[Jorolat]

You can't actually look at the page file. But if you want to know where it is, it's a hidden system file called pagefile.sys. It's in your root directory. To see it you have to uncheck the hide system files setting in foler options. To see any errors, you have to look at the log file in the %systemroot%\minidump folder.

My memory must be going - I have a program called "Page File Usage Monitor" which says:

"Pagefile Physical Location: C:\pagefile.sys

Current Pagefile Usage: 20 MB

Session Peak Usage: 22 MB

Current Pagefile Size: 1151 MB"

I've got 768MB RAM so that should be ok.

There isn't any log file in the mini dump folder - just .dmp files

I've also got PageDefrag which says pagefile is in one fragment of 36840 clusters - it lists a lot of other system32 stuff and only 2 are in 2 clusters (the rest being in 1): System32\CONFIG\SECURITY and System32\CONFIG\SYSTEM

John

This errors happens while using Internet Explorer, isn't it ?

It could have been - mostly I use Firefox but for the last couple of weeks I've occasionally been using IE6 too because I'm setting up a blog using css.

John

[cluberti]

This error appears to be happening in your USB driver, glausb.sys:

kd> !analyze -v

*******************************************************************************

* *

* Bugcheck Analysis *

* *

*******************************************************************************

BUGCODE_USB_DRIVER (fe)

USB Driver bugcheck, first parameter is USB bugcheck code.

Arguments:

Arg1: 00000002, BAD_URB The USB client driver has submitted a URB that is

still attached to another IRP still pending in the bus

driver.

Arg2: 82773108, Address of pending IRP.

Arg3: 828b1a78, Address of IRP passed in.

Arg4: 82ea5e70, Address URB that caused the error.

Debugging Details:

------------------

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: 0xFE

LAST_CONTROL_TRANSFER: from f6ed83b5 to 8053331e

STACK_TEXT:

f79669e4 f6ed83b5 000000fe 00000002 82773108 nt!KeBugCheckEx+0x1b

f7966a14 f6ede07e 82af7028 82e71008 586b6b66 USBPORT!USBPORT_FindUrbInIrpTable+0x115

f7966a78 f6edf1f6 00d88008 ffffffff 804e2eb4 USBPORT!USBPORT_FlushPendingList+0x346

f7966aa8 f6ee615a 82d0e4f0 f7966ae0 f6ee5d5c USBPORT!USBPORT_QueueTransferUrb+0x248

f7966ab4 f6ee5d5c 82af7028 828b1a78 82ea5e70 USBPORT!USBPORT_SCT_VendorClassCommand+0x5c

f7966ae0 f6eeadfe 82c27030 82af7028 00000170 USBPORT!USBPORT_ProcessURB+0x3f4

f7966b00 f6ed41e2 82c27030 828b1a78 828b1a78 USBPORT!USBPORT_PdoInternalDeviceControlIrp+0x7e

f7966b24 804e37f7 828b1b30 82c27188 82ea5e70 USBPORT!USBPORT_Dispatch+0x148

f7966b34 f767f50a f7966b5c f76832d9 828b1a78 nt!IopfCallDriver+0x31

f7966b3c f76832d9 828b1a78 82c27030 828b1a78 usbhub!USBH_PassIrp+0x18

f7966b5c f7683afa 82e8cd50 828b1a78 8298f000 usbhub!USBH_PdoUrbFilter+0xbd

f7966b78 f76811d8 82ea5e70 828b1a78 f7966bc8 usbhub!USBH_PdoDispatch+0x202

f7966b88 804e37f7 82d6c270 828b1a78 00000000 usbhub!USBH_HubDispatch+0x48

f7966b98 f19f21d0 00000000 82b939a8 8298f000 nt!IopfCallDriver+0x31

f7966bc8 f19f2416 8298f000 82ea5e70 829e4000 glausb+0x91d0

f7966bdc f19f476b 8298f000 8298f0dd 829e0802 glausb+0x9416

f7966c04 f19f486a 8298f037 8298f0dd 829e0802 glausb+0xb76b

f7966c24 f19f4a24 8298f037 8298f037 f1a00167 glausb+0xb86a

f7966c30 f1a00167 8298f037 8298f037 82b93404 glausb+0xba24

f7966ce0 f19ffb99 8298f037 00000022 f1a00dfd glausb+0x17167

f7966cec f1a00dfd 8298f037 82b939a8 00000003 glausb+0x16b99

f7966d04 f19f26a7 82b93404 8298f000 8298f000 glausb+0x17dfd

f7966d1c f19f2bbd 8298f000 00000003 8298f000 glausb+0x96a7

f7966d58 f19f24c6 8298f000 00000003 829922d6 glausb+0x9bbd

f7966d74 804e426b 0098f000 00000000 82fc7640 glausb+0x94c6

f7966dac 8057be15 8298f000 00000000 00000000 nt!ExpWorkerThread+0x100

f7966ddc 804fa4da 804e4196 00000000 00000000 nt!PspSystemThreadStartup+0x34

00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16

STACK_COMMAND: kb

FOLLOWUP_IP:

glausb+91d0

f19f21d0 3d03010000 cmp eax,0x103

SYMBOL_STACK_INDEX: e

SYMBOL_NAME: glausb+91d0

MODULE_NAME: glausb

IMAGE_NAME: glausb.sys

---------

I tried to walk it back further to see what IRP was still out there that was causing this, but because it's a minidump and not a kernel memory dump (memory.dmp), I can't see what's going on. I can at least see the thread, but there's no real info there:

kd> !thread

GetPointerFromAddress: unable to read from 8055ee34

THREAD 82fc7640 Cid 0004.0020 Teb: 00000000 Win32Thread: 00000000 RUNNING on processor 0

IRP List:

828b1a78: (0006,01d8) Flags: 00000000 Mdl: 00000000

Not impersonating

GetUlongFromAddress: unable to read from 8055ee44

Owning Process 82fc8a00 Image: System

ffdf0000: Unable to get shared data

Wait Start TickCount 1636493

Context Switch Count 42943 NoStackSwap

ReadMemory error: Cannot get nt!KeMaximumIncrement value.

UserTime 00:00:00.0000

KernelTime 00:00:00.0000

Start Address nt!ExpWorkerThread (0x804e4196)

Stack Init f7967000 Current f7966d1c Base f7967000 Limit f7964000 Call 0

Priority 13 BasePriority 13 PriorityDecrement 0 DecrementCount 16

ChildEBP RetAddr Args to Child

f79669e4 f6ed83b5 000000fe 00000002 82773108 nt!KeBugCheckEx+0x1b (FPO: [Non-Fpo]) (CONV: stdcall)

f7966a14 f6ede07e 82af7028 82e71008 586b6b66 USBPORT!USBPORT_FindUrbInIrpTable+0x115 (FPO: [Non-Fpo]) (CONV: stdcall)

f7966a78 f6edf1f6 00d88008 ffffffff 804e2eb4 USBPORT!USBPORT_FlushPendingList+0x346 (FPO: [Non-Fpo]) (CONV: stdcall)

f7966aa8 f6ee615a 82d0e4f0 f7966ae0 f6ee5d5c USBPORT!USBPORT_QueueTransferUrb+0x248 (FPO: [Non-Fpo]) (CONV: stdcall)

f7966ab4 f6ee5d5c 82af7028 828b1a78 82ea5e70 USBPORT!USBPORT_SCT_VendorClassCommand+0x5c (FPO: [Non-Fpo]) (CONV: stdcall)

f7966ae0 f6eeadfe 82c27030 82af7028 00000170 USBPORT!USBPORT_ProcessURB+0x3f4 (FPO: [Non-Fpo]) (CONV: stdcall)

f7966b00 f6ed41e2 82c27030 828b1a78 828b1a78 USBPORT!USBPORT_PdoInternalDeviceControlIrp+0x7e (FPO: [Non-Fpo]) (CONV: stdcall)

f7966b24 804e37f7 828b1b30 82c27188 82ea5e70 USBPORT!USBPORT_Dispatch+0x148 (FPO: [Non-Fpo]) (CONV: stdcall)

f7966b34 f767f50a f7966b5c f76832d9 828b1a78 nt!IopfCallDriver+0x31 (FPO: [0,0,0]) (CONV: fastcall)

f7966b3c f76832d9 828b1a78 82c27030 828b1a78 usbhub!USBH_PassIrp+0x18 (FPO: [Non-Fpo]) (CONV: stdcall)

f7966b5c f7683afa 82e8cd50 828b1a78 8298f000 usbhub!USBH_PdoUrbFilter+0xbd (FPO: [Non-Fpo]) (CONV: stdcall)

f7966b78 f76811d8 82ea5e70 828b1a78 f7966bc8 usbhub!USBH_PdoDispatch+0x202 (FPO: [Non-Fpo]) (CONV: stdcall)

f7966b88 804e37f7 82d6c270 828b1a78 00000000 usbhub!USBH_HubDispatch+0x48 (FPO: [Non-Fpo]) (CONV: stdcall)

f7966b98 f19f21d0 00000000 82b939a8 8298f000 nt!IopfCallDriver+0x31 (FPO: [0,0,0]) (CONV: fastcall)

f7966bc8 f19f2416 8298f000 82ea5e70 829e4000 glausb+0x91d0 (FPO: [Non-Fpo])

f7966bdc f19f476b 8298f000 8298f0dd 829e0802 glausb+0x9416 (FPO: [Non-Fpo])

f7966c04 f19f486a 8298f037 8298f0dd 829e0802 glausb+0xb76b (FPO: [Non-Fpo])

f7966c24 f19f4a24 8298f037 8298f037 f1a00167 glausb+0xb86a (FPO: [1,0,1])

f7966c30 f1a00167 8298f037 8298f037 82b93404 glausb+0xba24 (FPO: [1,0,1])

f7966ce0 f19ffb99 8298f037 00000022 f1a00dfd glausb+0x17167 (FPO: [Non-Fpo])

f7966cec f1a00dfd 8298f037 82b939a8 00000003 glausb+0x16b99 (FPO: [2,0,0])

f7966d04 f19f26a7 82b93404 8298f000 8298f000 glausb+0x17dfd (FPO: [1,0,3])

f7966d1c f19f2bbd 8298f000 00000003 8298f000 glausb+0x96a7 (FPO: [Non-Fpo])

f7966d58 f19f24c6 8298f000 00000003 829922d6 glausb+0x9bbd (FPO: [Non-Fpo])

f7966d74 804e426b 0098f000 00000000 82fc7640 glausb+0x94c6 (FPO: [Non-Fpo])

f7966dac 8057be15 8298f000 00000000 00000000 nt!ExpWorkerThread+0x100 (FPO: [Non-Fpo]) (CONV: stdcall)

f7966ddc 804fa4da 804e4196 00000000 00000000 nt!PspSystemThreadStartup+0x34 (FPO: [Non-Fpo]) (CONV: stdcall)

00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16

If you can provide me with the actual memory.dmp file in the Windows directory, I may be able to tell you where the actual IRP that caused the bugcheck is, and who owns it.

Edited February 16, 2006 by cluberti

[Jorolat]

This error appears to be happening in your USB driver, glausb.sys:

If you can provide me with the actual memory.dmp file in the Windows directory, I may be able to tell you where the actual IRP that caused the bugcheck is, and who owns it.

Wow Cluberti, I was godsmacked when I saw all that data - just glad that it makes some kind of sense to you!

The minidump in the Minidump folder is called Mini021606-01.dmp but I've uploaded it as minidump to:

http://members.aol.com/jorolat/minidump.dmp

Is that any good - or should I try and cut&paste into here? (if so, will converting it into a notepad file do?)

Is there anything I can do about glausb.sys? (like get a new one from 'somewhere'?). I've been online for several hours since the crash and nothing further has happened - do you think that doing a system restore might have cleared the problem or should I investigate further?

I am very grateful for your help

John

[cluberti]

I wouldn't be able to answer the question about the system restore doing anything good or bad, because I have no way of knowing when the problem was initially occurring.

As to the dump, thank you for uploading it, but I need a more complete dump, not a minidump. The dump file I'm looking for would be named memory.dmp, and be in the Windows directory itself, not the minidump folder. Minidumps don't contain much data, which is why I need to look at a real dump with real stack and thread data.

Also, as to the glausb.sys file, I believe this belongs to your USB DSL modem, so you'd have to contact that vendor to see if they have an update (which is likely your ISP).

[Jorolat]

I wouldn't be able to answer the question about the system restore doing anything good or bad, because I have no way of knowing when the problem was initially occurring.

As to the dump, thank you for uploading it, but I need a more complete dump, not a minidump. The dump file I'm looking for would be named memory.dmp, and be in the Windows directory itself, not the minidump folder. Minidumps don't contain much data, which is why I need to look at a real dump with real stack and thread data.

Also, as to the glausb.sys file, I believe this belongs to your USB DSL modem, so you'd have to contact that vendor to see if they have an update (which is likely your ISP).

Hi Cluberti,

I've done a search but couldn't find a file called memory.dmp - its a new day and things are still ok ('fingers crossed'). I'm with AOL and when I get a bit more time I'll post there and see what they say.

Thank you very much indeed for your help - if the problem happens again I'll come running back so please keep an eye out for posts with panic-stricken titles

John Latter