BSoD - KMODE_EXCEPTION_NOT_HANDLED

[Berbe]

Hello,

I really need help...
I have Vista x64, and I have random crash with the code 1E. I checked msconfig to deactivate/remove entries which were not necessary but I can't say now if that worked or no... Maybe if I don't have any crash more until tonight, that would mean I managed to deactivate the failing component!

I put the debug log in attachment, made with DebugWiz.
It says that "ntkrnlmp.exe" would be responsible for that crash... Wow! System component...

The 2nd, 3rd and 4th parameters are strange : 0, 8 & 0!!
Does anyone have a suggestion?
Many thanks

 

[H2SO4]

NTKRNLMP.EXE is the on-disk image containing the OS kernel and Executive. It is very common for memory corruption issues to manifest themselves as crashes in the functions of that module. That doesn't necessarily mean the underlying fault is a bug in the kernel. In fact, it almost never means that

This minidump is not going to directly help you pinpoint the cause, but you could start bu updating the oldest drivers in that list. For example:

fffffa60`0357f000 fffffa60`0358d000 ElbyCDFL ElbyCDFL.sys Thu Dec 14 22:22:27 2006 (4581C093)
fffffa60`039fa000 fffffa60`039fd600 copperhd copperhd.sys Wed May 24 05:51:13 2006 (4473D831)

Some are relatively new but you might be able to do without them while you're troubleshooting:

fffffa60`00f32000 fffffa60`00fa1680 mfehidk mfehidk.sys Fri Sep 19 01:06:00 2008 (48D2DED8)
fffffa60`06363000 fffffa60`0636e500 VBoxUSBMon VBoxUSBMon.sys Mon Feb 16 18:26:18 2009 (4999A1BA)
fffffa60`0636f000 fffffa60`06391540 VBoxDrv VBoxDrv.sys Mon Feb 16 18:26:11 2009 (4999A1B3)

And so on... then you check the next dump - if there is one - to see the next crash pattern.

 

[Berbe]

ElbyCFDL.sys is part from CloneCD, which is updated to the latest release : 5.3.1.4! I can't do more, I think, as well as for copperhd.sys, my mouse driver, up to date.

I guess the fiels listed in the dump are loaded in memory? If it's the case, I can't find any Virtual Box process loaded (the VBox******.sys files). Maybe those files are listed only because they are located in the Windows directory?
How to make these files not to appear in the report? Have I to uninstall the related application?

I am waiting for the next crash... That's the 1st time I am waiting for a crash with such an impatience!

 

[H2SO4]

ElbyCFDL.sys is part from CloneCD, which is updated to the latest release : 5.3.1.4! I can't do more, I think, as well as for copperhd.sys, my mouse driver, up to date.

There is nothing particularly suspicious about any of those drivers, other than them being somewhat older and non-default.

Your problem is either caused by unreliable hardware or by one or more buggy drivers overwriting portions of kernel memory which they shouldn't be touching.

Stress-testing utilities like Memtest may be able to help you confirm hardware issues. If you're overclocking, it's almost pointless to troubleshoot further.

With respect to the driver situation, temporarily removing older drivers is really the only way to rule them out. The type of memory corruption manifested in this dump would not be caught by "special pool" - the standard monitoring mechanism to look for drivers which mishandle memory. No harm in trying though. Tun VERIFIER and follow the bouncing ball from there...

I guess the fiels listed in the dump are loaded in memory? If it's the case, I can't find any Virtual Box process loaded (the VBox******.sys files). Maybe those files are listed only because they are located in the Windows directory?

The drivers are listed because they're loaded in memory, not because of their on-disk presence.

How to make these files not to appear in the report? Have I to uninstall the related application?

Yes, uninstalling the related app is the safest method to stop the driver from loading. Otherwise, you could use SC CONFIG <driver> START= DISABLED to knock out any given driver, but that might have unforeseen side-effects and I wouldn't recommend it.

I am waiting for the next crash... That's the 1st time I am waiting for a crash with such an impatience!

Is the hardware new? Are you overclocking? Have you recently added more RAM or upgraded the processor?

 

[Berbe]

Thanks for all that information!

No I'm not overclocking, and I haven't made any change to the hardware I bought 4 months ago.

I tested the memory with the diagnostic tool given in Vista. I read some articles saying that memory testing tools doesn't use the same mode than Windows' one : if I understood well, those tolls would run in read/write mode whereas Windows use the memory in execution mode, which would create a totally different memory stress-response.
Anyway, I'll try MemTest and verifier utility.

 

[Berbe]

Hello,

I had 4 more crashes... You'll find the reports as attachments.
As you can see, I haven't yet uninstalled VirtualBox. I thought the problem was solved because it took time before new crashes took place again. For example, today, I started my computer at 12:00 am and the first crash occured at 06:30 pm!

Yesterday, I have deactivated most of the programs which were set to start automatically and which were not really necessary. They are consequently not responsible for the last crash :D
I am uninstalling Virtual Box right now...

If you can identify some other drivers, that might help me.

EDIT : Another crash just occured while I was writing this post! I join the report as well.

 

[H2SO4]

4 wildly different types of bugcheck in 5 crashes - I'd be very surprised if you didn't have a hardware problem.

The second one is perhaps the most indicative of an obvious hardware issue:

STACK_TEXT:
fffff800`03fb1a98 fffff800`026737af : 00000000`00000050 fffffd7f`8bae9a73 00000000`00000001 fffff800`03fb1b90 : nt!KeBugCheckEx
fffff800`03fb1aa0 fffff800`026641d9 : 00000000`00000001 fffff800`0263d7e5 fffffa80`30745300 00000000`00000000 : nt!MmAccessFault+0x4af
fffff800`03fb1b90 fffff800`02680a01 : fffffa80`08532bb0 fffff800`0278ab80 fffff800`03fb1db0 fffff800`02668ced : nt!KiPageFault+0x119
fffff800`03fb1d20 fffff800`0266fe31 : fffff800`02785680 fffff800`02785680 00000000`00000000 00000000`00000000 : nt!PoIdle+0x81
fffff800`03fb1d80 fffff800`0283e5c0 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiIdleLoop+0x21
fffff800`03fb1db0 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!zzz_AsmCodeRange_End+0x4

A page fault while attempting to set processor power state? It's possible that this is caused by a bad driver, but relatively unlikely.

I'd suggest ripping out all non-essential hardware and testing again.

 

[Berbe]

Hi,

Thanks for that tip...
That's annoying... I don't have non-essential hardware ! I will disconnect the DVD drive...

The only other peripherals I have are:
- 2 HD in RAID 0
- 1 mouse & keyboard

I tested my RAM with Windows built-in memory testing process (as instructed by some bug report advice) and nothing was found, so I think my RAM is working well.

I updated the firmware of:
- DVD drive
- mouse
... and my BIOS
Maybe something happened during those process? I didn't notice anything...

 

[H2SO4]

RAM testers are at best hit and miss. Just because the test did not reveal anything amiss doesn't prove the RAM is OK.

I don't think your HDD or mouse/keyboard have anything to do with it. Once you've removed all non-default drivers, if you're still facing the same exotic bugchecks it'll generally come down to RAM, processor, or the motherboard. Minidumps are next to useless in this type of troubleshooting. All they tell you is that something that ought not be possible - has happened.

 

[Berbe]

Oh!

That reminds me something...
I use Vista x64 because I couldn't install XP. Each time I tried, I got a BSoD just after the installation program tried to load extra drivers from floppy.
It's possible, in fact, that Windows doesn't have SATA drivers for my HDs, but why did that lead into BSoD? The error code was related to hardware problem (or non-recognized).

Would that mean that it's my motherboard which goes wrong? Anyway that would disculp the RAM... Am I wrong?