Troubleshooting BSODs

[MrChad]

I've had a few BSODs on my XP machine in the past few days, and I'm unclear as to the cause.

Three of them were IRQL_NOT_LESS_OR_EQUAL caused by ntoskrnl.exe.
The latest one (today) was PAGE_FAULT_IN_NONPAGED_AREA caused by symevent.sys.

I know that symevent.sys is a Norton driver (I have Norton Antivirus Corporate 9.0 installed). But is it possible that there's an underlying hardware failure occuring?

Update 9/18: I got a few more BSODs this morning, and I decided to run MemTest. My computer actually shutdown at some point during MemTest. Has anyone seen this before? Anything else I should check?

Update 9/19: Thread moved from OS to Technical Support.

Update #2 9/19 I checked the voltages in my CMOS setup, and they're as follows:

VCORE: 1.76 V
3.3 V: 3.23 V
5.0 V: 4.40 V
12.0 V: 11.96 V

Update 9/20 Removed Symantec Anti-Virus and replaced it with AntiVir. Blue screened again this afternoon. Crash dump looks like this:

BugCheck 1000000A, {b7bfb580, 2, 1, 804e20fe}

*** ERROR: Symbol file could not be found. Defaulted to export symbols for NDIS.sys -
*** WARNING: Unable to verify timestamp for el90Xbc5.SYS
*** ERROR: Module load completed but symbols could not be loaded for el90Xbc5.SYS
Probably caused by : memory_corruption

Followup: memory_corruption

Update 9/21 I cleaned and reapplied my Arctic Silver 3 and HSF. Temperatures are now stable at about 49 degrees C with the case on.

Hopefully it was just a temp issue. I'll update this thread in a day or so.

 

[dclive]

Originally posted by: MrChad
I've had a few BSODs on my XP machine in the past few days, and I'm unclear as to the cause.

Three of them were IRQL_NOT_LESS_OR_EQUAL caused by ntoskrnl.exe.
The latest one (today) was PAGE_FAULT_IN_NONPAGED_AREA caused by symevent.sys.

I know that symevent.sys is a Norton driver (I have Norton Antivirus Corporate 9.0 installed). But is it possible that there's an underlying hardware failure occuring?

Anything is possible. If the dumps are pointing to symevent.sys, remove NAV, and see if the problems go away. Or use a debugger to analyze the dumps themselves. Or send them to me and I'll take a quick look. But since you already know that NAV may be a component in the failure, just remove it and see if everything is fixed. Or if you can reproduce it every time, boot in safe mode and see if the issue goes away.

 

[MrChad]

Originally posted by: dclive

Originally posted by: MrChad
I've had a few BSODs on my XP machine in the past few days, and I'm unclear as to the cause.

Three of them were IRQL_NOT_LESS_OR_EQUAL caused by ntoskrnl.exe.
The latest one (today) was PAGE_FAULT_IN_NONPAGED_AREA caused by symevent.sys.

I know that symevent.sys is a Norton driver (I have Norton Antivirus Corporate 9.0 installed). But is it possible that there's an underlying hardware failure occuring?

Anything is possible. If the dumps are pointing to symevent.sys, remove NAV, and see if the problems go away. Or use a debugger to analyze the dumps themselves. Or send them to me and I'll take a quick look. But since you already know that NAV may be a component in the failure, just remove it and see if everything is fixed. Or if you can reproduce it every time, boot in safe mode and see if the issue goes away.

Well, the problem is that I can't reproduce it. It happens at night when I'm asleep or when I'm at work. I'll zip up the dmp files and send them your way.

 

[dclive]

Originally posted by: MrChad

Originally posted by: dclive

Originally posted by: MrChad
I've had a few BSODs on my XP machine in the past few days, and I'm unclear as to the cause.

Three of them were IRQL_NOT_LESS_OR_EQUAL caused by ntoskrnl.exe.
The latest one (today) was PAGE_FAULT_IN_NONPAGED_AREA caused by symevent.sys.

I know that symevent.sys is a Norton driver (I have Norton Antivirus Corporate 9.0 installed). But is it possible that there's an underlying hardware failure occuring?

Anything is possible. If the dumps are pointing to symevent.sys, remove NAV, and see if the problems go away. Or use a debugger to analyze the dumps themselves. Or send them to me and I'll take a quick look. But since you already know that NAV may be a component in the failure, just remove it and see if everything is fixed. Or if you can reproduce it every time, boot in safe mode and see if the issue goes away.

Well, the problem is that I can't reproduce it. It happens at night when I'm asleep or when I'm at work. I'll zip up the dmp files and send them your way.

Please remove Symantec products from the machine, then see if the dumps continue.

 

[MrChad]

Update: I got a few more BSODs this morning, and I decided to run MemTest. My computer actually shutdown at some point during MemTest. Has anyone seen this before? Anything else I should check?

dclive: Thanks for your help. I have not yet removed the anti-virus yet. I am going to troubleshoot this new MemTest issue before I continue my Windows troubleshooting.

 

[dclive]

Does this "Memtest" run inside of Windows or from a floppy/CD of its' own?

 

[Hough NutZ]

What brand power supply you running?

 

[MrChad]

Originally posted by: dclive
Does this "Memtest" run inside of Windows or from a floppy/CD of its' own?

http://www.memtest86.com

Runs on a bootable CD on its own. There's no possibility of driver/software interference.

 

[MrChad]

Originally posted by: Hough NutZ
What brand power supply you running?

Antec TruePower 430W

 

[fuzzynavel]

I had similar problems when I had norton AV installed....

I ended up going into safe mode and disabling the norton auto protect service....not a blue screen since then.....Consequently I ditched norton AV and firewall....they are system hogs anyway...

 

[Rilex]

Anything is possible.

But it is much easier to find out exactly what is wrong. Look into the Debugging Tools of Windows at http://www.microsoft.com/ddk. Not the easiest things in the world to do, but once you get the hang of !analyze -v, !poolused, !process, !processes 0 7, and !thread, it becomes a little easier.

At the very least, it reduces the guessing game!

 

[MrChad]

Originally posted by: Rilex

Anything is possible.

But it is much easier to find out exactly what is wrong. Look into the Debugging Tools of Windows at http://www.microsoft.com/ddk. Not the easiest things in the world to do, but once you get the hang of !analyze -v, !poolused, !process, !processes 0 7, and !thread, it becomes a little easier.

At the very least, it reduces the guessing game!

I've done that. I also sent the mini dump files to dclive for confirmation. The majority of the crashes are IRQ_NOT_LESS_OR_EQUAL errors coming from ntoskrnl.exe. One or two have been PAGE_FAULT_IN_NONPAGED_AREA caused by symevent.sys. Consequently, a few people here have recommended that I uninstall Norton.

I am a bit skeptical that Norton is the culprit for three reasons.

1. Norton has given me no trouble thus far in the 1+ years it has been installed.
2. Not all of the memory dumps are originating from symevent.sys.
3. The shutdown during MemTest seems more indicative of hardware trouble.

 

[MrChad]

Since this thread seems more appropriate for Technical Support, I'm going to ask the mods to move it.

 

[TGHI]

Are you overclocking? The only time that I've EVER seen a stack dump is when my FSB is too high, and my RAM can't handle it.

 

[MrChad]

Originally posted by: TGHI
Are you overclocking? The only time that I've EVER seen a stack dump is when my FSB is too high, and my RAM can't handle it.

Nope. I've been running at stock speeds for years now.

 

[MrChad]

I checked the voltages in my CMOS setup, and they're as follows:

VCORE: 1.76 V
3.3 V: 3.23 V
5.0 V: 4.40 V
12.0 V: 11.96 V

 

[Rilex]

If you've already identified the problem child (in this case, Norton), uninstall it. You should probably set yourself up with Kernel dumps, as mini dumps don't give enough information.

Since the problem is also occuring within the kernel, and you have a secondary issue identified as Norton (which has kernel hooks)....Norton is a great place to start.

 

[MrChad]

Originally posted by: Rilex
If you've already identified the problem child (in this case, Norton), uninstall it. You should probably set yourself up with Kernel dumps, as mini dumps don't give enough information.

Since the problem is also occuring within the kernel, and you have a secondary issue identified as Norton (which has kernel hooks)....Norton is a great place to start.

Ok, ok, I'll uninstall Norton and report back.

 

[dclive]

Originally posted by: MrChad

Originally posted by: Rilex
If you've already identified the problem child (in this case, Norton), uninstall it. You should probably set yourself up with Kernel dumps, as mini dumps don't give enough information.

Since the problem is also occuring within the kernel, and you have a secondary issue identified as Norton (which has kernel hooks)....Norton is a great place to start.

Ok, ok, I'll uninstall Norton and report back.

That's what the dump said on 9/16-9/17 when I looked at it. Let us know how it turns out.

 

[MrChad]

Removed Symantec Anti-Virus and replaced it with AntiVir. Blue screened again this afternoon. Crash dump looks like this:

BugCheck 1000000A, {b7bfb580, 2, 1, 804e20fe}

*** ERROR: Symbol file could not be found. Defaulted to export symbols for NDIS.sys -
*** WARNING: Unable to verify timestamp for el90Xbc5.SYS
*** ERROR: Module load completed but symbols could not be loaded for el90Xbc5.SYS
Probably caused by : memory_corruption

Followup: memory_corruption

 

[Rilex]

At this point, either update, or rollback your NIC drivers.

 

[dclive]

Originally posted by: MrChad
Removed Symantec Anti-Virus and replaced it with AntiVir. Blue screened again this afternoon. Crash dump looks like this:

BugCheck 1000000A, {b7bfb580, 2, 1, 804e20fe}

*** ERROR: Symbol file could not be found. Defaulted to export symbols for NDIS.sys -
*** WARNING: Unable to verify timestamp for el90Xbc5.SYS
*** ERROR: Module load completed but symbols could not be loaded for el90Xbc5.SYS
Probably caused by : memory_corruption

Followup: memory_corruption

el90Xbc5 el90Xbc5.SYS Tue Aug 13 23:27:20 2002 (3D59DC28)

...

is the current EL90Xbc5 driver you're using - pretty old. Update it and try again.

 

[MrChad]

My NIC is a 3COM 3C920B-EMB integrated controller on my ASUS A7N8X Deluxe.

The drivers are fully up-to-date. I cannot find newer ones on the ASUS or 3COM website.

 

[dclive]

Can you temporarily try / use another NIC (and disable, in BIOS, that NIC) to eliminate that driver as a possible issue?

 

[MrChad]

Originally posted by: dclive
Can you temporarily try / use another NIC (and disable, in BIOS, that NIC) to eliminate that driver as a possible issue?

I disabled the onboard 3COM, and I've switch to the onboard nVidia NIC instead.

I received a series of Windows System Errors ("Do you want to send an error report to Microsoft?") when I rebooted, but other than that the system is running ok so far. Here are the event log messages:

Error code 1000000a, parameter1 00000030, parameter2 00000002, parameter3 00000001, parameter4 804dc0ac.

Error code 10000050, parameter1 fcd5d3ff, parameter2 00000000, parameter3 fcd5d3ff, parameter4 00000000.

Error code 1000000a, parameter1 d5ddfd3c, parameter2 00000002, parameter3 00000001, parameter4 804dc0ac.

Error code 1000000a, parameter1 d5dddd0c, parameter2 00000002, parameter3 00000001, parameter4 804dc0ac.

Error code 1000000a, parameter1 b7bfb580, parameter2 00000002, parameter3 00000001, parameter4 804e20fe.