Faulty Device Driver, BSOD on Compaq Presario 710

**janaelise** · February 2nd, 2005, 04:02 PM

For the last couple months I have been getting random BSOD on my Compaq Presario 710US, usually when using Adobe Photoshop Elements or Photoshop Album, which makes me think this is related to a graphics driver. I have updated the drivers using Windows Update and also using HP's website of available downloads. This laptop is hooked up to a network at work, but I also use it at home, and have experienced errors when I am not on the network at work.

The errors in my Event Viewer look like this:
Source: System Error
Category: (102)
Type: Error
Event: 1003
Description: Error code 000000c4, parameter1 00000085, parameter 2 811bb6d0, parameter 3 00000020, parameter 4 000000e0.

The link to Microsoft Help and Support gives no helpful information.

I tried to run SiSoft Sandra so I could find out what motherboard I have and get the latest chipset drivers, and inadvertantly found a pattern to this error: the BSOD appears every time I try to double-click the mainboard icon within Sandra for more information. At the top of the BSOD, it says "A device driver attempting to corrupt the system has been caught. The faulty driver currently on the kernel stack must be repaired" or something like that. The error codes and parameters are always the same, with the exception of parameter 2, which has been different values. The recent ones are:
0x8117E580
0x8118F008
0x81186008
0xFF523BF8
0x811BB6D0

The only pattern I've noticed in the Event Viewer is that the same event is always listed 30 seconds before the error.
Source: Service Control Manager
Category: None
Type: Information
Event ID: 7036
Description: The Remote Access Connection Manager service entered the running state.

Maybe that has nothing to do with anything!

In the Event Viewer under Application, I see a lot of errors whose timing seem to correspond with my system error. One is:
Source: AutoEnrollment
Category: None
Type: Error
Event ID: 15
Description: Automatic certificate enrollment for local system failed to contact the active directory (0x8007054b). The specified domain either does not exist or could not be contacted. Enrollment will not be performed.

The other is:
Source: Userenv
Category: None
Type: Error
Event ID: 1054
Description: Windows cannot obtain the domain controller name for your computer network. (The specified domain either does not exist or could not be contacted). Group Policy processing aborted.

However, I also see instances of these errors which did not cause a crash!
At the end of the BSOD, it does a physical memory dump which takes about 2 minutes. I have gone into the display settings and turned off the hardware acceleration, but hasn't solved the problem.

Here is my Belarc info:

Operating System
Windows XP Professional Service Pack 2 (build 2600)

System Model
Compaq Presario 710US 267966-001 0F0C

Processor
1000 megahertz AMD Duron
16 kilobyte primary memory cache
64 kilobyte secondary memory cache

Main Circuit Board
Board: Compaq 0760h Rev.A
Bus Clock: 100 megahertz
BIOS: Phoenix 4.06CJ15 06/28/2002

Drives
20.00 Gigabytes Usable Hard Drive Capacity
11.63 Gigabytes Hard Drive Free Space

TOSHIBA DVD-ROM SD-C2502 [CD-ROM drive]
3.5" format removeable media [Floppy drive]

FUJITSU MHN2200AT [Hard drive] (20.00 GB) -- drive 0, s/n NHC0T1C14FT9, rev 7255, SMART Status: Healthy

Memory Modules
240 Megabytes Installed Memory

Slot 'M1' has 256 MB
Slot 'M2' is Empty

Local Drive Volumes
c: (on drive 0)20.00 GB11.63 GB free

Controllers
Standard floppy disk controller
Primary IDE Channel [Controller]
Secondary IDE Channel [Controller]
VIA Bus Master IDE Controller

Display
S3 Graphics TwisterK 00860E11 (Microsoft Corporation) [Display adapter]
Default Monitor
Digital Flat Panel (1024x768) [Monitor] (19.7"vis, January 2000)
Generic Television [Monitor] (19.7"vis, January 2000)

Bus Adapters
Texas Instruments PCI-1410 CardBus Controller
VIA Rev 5 or later USB Universal Host Controller

Multimedia
SoundMAX Integrated Digital Audio

Communications
Conexant HSFi V92 MiniPCI Modem
Realtek RTL8139/810x Family Fast Ethernet NIC

Other Devices
Microsoft AC Adapter
Microsoft ACPI-Compliant Control Method Battery
EPSON Perfection1200 #3
Compaq Easy Access Internet Keyboard
Logitech USB WheelMouse
PS/2 Compatible Mouse
Generic USB Hub
USB Root Hub

Please help! Thank you!

**hudsonsmith** · February 3rd, 2005, 09:22 AM

Welcome to windrivers jana. The bsod while running sandra is a known issue which is addressed in the program documentation. There is a toggle you need to disable in the options for that module (try "include dmi information" first - if that doesn't work try "include MSR info"). This issue is likely unrelated to your other bsod issue.

It would be helpful if you could post the exact text of the bsod when it occurs (rather than from event viewer). It will ususally provide a file name. If your system is rebooting rather than leaving the bsod on screen, go to system properties\advanced\startup & recovery and uncheck the box for "automatically reboot"

**janaelise** · February 8th, 2005, 05:52 PM

Hello again! Thanks for the Sandra info. I have also been experiementing with WinDbg... it found an error in an ASPI layer file I had installed, and after I deleted it, the BSOD went away for awhile.

Now it is back! I was using Photshop Elements and Photoshop Album, and I got a BSOD which said there was an error. PFN_LIST_CORRUPT. This is the only information it gives, other than strings of numbers, but no file name!

I used WinDbg to open the Memory dump file, this is the information it gives me:

PFN_LIST_CORRUPT (4e)

Typically caused by drivers passing bad memory descriptor lists (ie: calling

MmUnlockPages twice with the same list, etc). If a kernel debugger is

available get the stack trace.

Arguments:

Arg1: 00000099, A PTE or PFN is corrupt

Arg2: 0000eebd, page frame number

Arg3: 00000007, current page state

Arg4: 00000000, 0

Debugging Details:
------------------
DEFAULT_BUCKET_ID: DRIVER_FAULT
BUGCHECK_STR: 0x4E

LAST_CONTROL_TRANSFER: from 8051e497 to 805339ae

STACK_TEXT:

f9cc6c68 8051e497 0000004e 00000099 0000eebd nt!KeBugCheckEx+0x1b

f9cc6c98 80507e92 000066bf 010233f8 8109a1e8 nt!MiEliminateWorkingSetEntry+0x264

f9cc6cc0 805354a5 00003940 c050369c c00233f8 nt!MiFreeWsle+0x45

f9cc6cec 80523494 000018f0 c050369c 00000002 nt!MiTrimWorkingSet+0x6e

f9cc6d38 804e5acd 00000000 81329020 00000000 nt!MmWorkingSetManager+0x151

f9cc6dac 8057dfed 00000000 00000000 00000000 nt!KeBalanceSetManager+0x92

f9cc6ddc 804fa477 804e5a41 00000000 00000000 nt!PspSystemThreadStartup+0x34

00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16

FOLLOWUP_IP:

nt!MiEliminateWorkingSetEntry+264

8051e497 008b461cc1e0 add [ebx+0xe0c11c46],cl

SYMBOL_STACK_INDEX: 1

FOLLOWUP_NAME: MachineOwner

SYMBOL_NAME: nt!MiEliminateWorkingSetEntry+264

MODULE_NAME: nt

DEBUG_FLR_IMAGE_TIMESTAMP: 41108004

STACK_COMMAND: kb

IMAGE_NAME: memory_corruption

FAILURE_BUCKET_ID: 0x4E_nt!MiEliminateWorkingSetEntry+264

BUCKET_ID: 0x4E_nt!MiEliminateWorkingSetEntry+264

Followup: MachineOwner

***DonJ*** · February 8th, 2005, 06:24 PM

Just to make sure, is this where you went for HP's Downloads & Software for your Presario 710US for WinXP.

You can find manuals - Compaq Presario 700 Notebook PC series here.

Just to make sure that it is Adobe or drivers or whatever it is that is causing the problems, you might want to check out My Computer Stops Responding when Using a Program Just some good basic info there.

How to Troubleshoot a "STOP 0x0000004E PFN_LIST_CORRUPT" Error Message

CAUSE
This behavior occurs because a driver or other problem damaged the input/output (I/O) driver structures.

Do you see any Exclamation Marks or other error messages in Device Manger?

If you think it is a driver issue, try booting into Safe Mode and go into Device Manager and Remove the offending device (video adapter). Reboot and let Windows try to Find New Hardware and load the drivers again. You might need your Windows Install CD or Restore Cd for this.

**centizen** · February 9th, 2005, 06:11 PM

I have been having simular problems with my presario 710us. I just barely unchecked the reboot automatically so that I can examine the bsod more closely. (I learned that on this thread, thank you for the start)

The bsods are not associated with any particular program. They usually occur imediately after the computer starts.

I feel kind of silly posting without all the information that janaelise had about her computer. I will see if I can get it for next time.

**janaelise** · February 16th, 2005, 10:23 AM

Yes, that is the page I went to for driver downloads. I did not see any exclamation marks in my device manager, but I tried uninstalling the device anyway, and restarting. Now I DO have an exclamation mark on my display adapter, S3 Graphics TwisterK 00860E11. It says "Windows cannot load the device driver for this hardware. The driver may be corrupted or missing. (Code 39)"

I went to the driver download page (HP's Downloads & Software for your Presario 710US for WinXP) and downloaded SP20057, which is the driver update they have posted for display adapter. However, when I try to install it, I get an error, whose txt file reads:

=========== S3SETUP LOG FILE - Started at 09:10:27 on 2-16-2005 ===========
S3Setup v1.00.05-TW
Setup is in UNATTENDED mode.
bAllowReboot is TRUE
bSilentReboot is TRUE
bPromptReboot is TRUE
bPromptSilentReboot is FALSE
VendorID to find:5333
INF File Located at: C:\COMPAQ\SP20057\tw0E11.inf
No S3 display adapter can be detected, or hardware detection could not determine display adapter type.
Hardware detect returned -2.
DestroyTimerWindow returned an error!
-> Setup was unable to complete the installation. Check the progress log in your Windows directory for more details.

I tried going to Via Arena and downloading the correct chipset and AGP drivers for my motherboard (VIA KN133).

Any ideas? Thanks!

**janaelise** · February 16th, 2005, 10:54 AM

Hooray! I just installed a Twister Graphics Driver for Windows XP from this site: http://ranger.s3graphics.com/xplib/380xpdrv/ and now my screen looks pretty again, and the exclamation mark is gone from my device manager! Now I'll just hold my breath and wait for the next BSOD...

**janaelise** · February 17th, 2005, 05:03 PM

OK, it's back! This time while I was using Photoshop Elements. The BSOD appears and says IRQL_NOT_LESS_OR_EQUAL. It does not give a file name or anything. When I submit the error report after restarting, Microsoft tells me I have an error caused by a device driver, but not which one.

I've been learning a little bit about WinDbg. I found out which BSODs were caused by that issue in Sandra, and when I couldn't figure out what to toggle, I just uninstalled it and used CPU-Z instead.

Last night, using this laptop at home with a D-Link wireless card, I got more BSODs, which the debugger says was probably caused by anio.sys. There are two programs which installed with my wireless card, ANIO Service and ANIWZCS Service, which I think other people have had problems with too. They have something to do with the WPA security for the wireless network? I can't figure out how to fix that BSOD issue, so I just plugged in an ethernet cord for now.

But now, I'm not using the wireless card OR Sandra. Here is the information the debugger gives me:

Bugcheck Analysis

Use !analyze -v to get detailed debugging information.
BugCheck A, {b1303038, 2, 1, 80500ce6}
*** WARNING: Unable to verify checksum for VariationsEL.8BF
*** ERROR: Symbol file could not be found. Defaulted to export symbols for VariationsEL.8BF -
Probably caused by : memory_corruption ( nt!MiRemovePageFromList+71 )
Followup: MachineOwner
---------

kd> !analyze -v

Bugcheck Analysis

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: b1303038, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000001, value 0 = read operation, 1 = write operation
Arg4: 80500ce6, address which referenced memory

Debugging Details:
------------------

WRITE_ADDRESS: b1303038 Nonpaged pool
CURRENT_IRQL: 2
FAULTING_IP:
nt!MiRemovePageFromList+71
80500ce6 834cc208ff or dword ptr [edx+eax*8+0x8],0xffffffff
DEFAULT_BUCKET_ID: DRIVER_FAULT
BUGCHECK_STR: 0xA
LAST_CONTROL_TRANSFER: from 80500a36 to 80500ce6
TRAP_FRAME: f4101b94 -- (.trap fffffffff4101b94)
ErrCode = 00000002
eax=06060606 ebx=000022d4 ecx=00000000 edx=81000000 esi=810343e0 edi=80550d80
eip=80500ce6 esp=f4101c08 ebp=f4101c18 iopl=0 nv up ei pl nz ac po cy
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00210217
nt!MiRemovePageFromList+0x71:
80500ce6 834cc208ff or dword ptr [edx+eax*8+0x8],0xffffffff ds:0023:b1303038=????????
Resetting default scope
STACK_TEXT:
f4101c18 80500a36 811f9130 804fb2a4 e16e04b8 nt!MiRemovePageFromList+0x71
f4101c20 804fb2a4 e16e04b8 00004c64 ffb25b38 nt!MiRemoveAnyPage+0x56
f4101c50 804fae8a 00006000 e16e04b8 811f9198 nt!MiResolveMappedFileFault+0x47f
f4101c80 804e9a5f 00000000 77c54cbf c01df150 nt!MiResolveProtoPteFault+0x122
f4101cfc 804e97de 00000000 77c54cbf c01df150 nt!MiDispatchFault+0x13b
f4101d4c 804e1ff1 00000000 77c54cbf 01000001 nt!MmAccessFault+0xc09
f4101d4c 77c54cbf 00000000 77c54cbf 01000001 nt!KiTrap0E+0xcc
0012e1a0 03804b77 43a00000 406359ea 0bdbed18 msvcrt!_ceil_default
WARNING: Stack unwind information not available. Following frames may be wrong.
000001bf 00000000 00000000 00000000 00000000 VariationsEL!ENTRYPOINT1+0x3477

FOLLOWUP_IP:
nt!MiRemovePageFromList+71
80500ce6 834cc208ff or dword ptr [edx+eax*8+0x8],0xffffffff
SYMBOL_STACK_INDEX: 0
FOLLOWUP_NAME: MachineOwner
SYMBOL_NAME: nt!MiRemovePageFromList+71
MODULE_NAME: nt
DEBUG_FLR_IMAGE_TIMESTAMP: 41108004
STACK_COMMAND: .trap fffffffff4101b94 ; kb
IMAGE_NAME: memory_corruption
FAILURE_BUCKET_ID: 0xA_W_VRF_nt!MiRemovePageFromList+71
BUCKET_ID: 0xA_W_VRF_nt!MiRemovePageFromList+71
Followup: MachineOwner
---------

**janaelise** · February 18th, 2005, 01:31 PM

Two more BSODs! Both while using Photoshop Elements 2.0. Do you think Elements just hates my display driver? I changed the driver to something called "S3 Graphics Twister K Compaq" instead of "S3 Graphics Twister K + S3Hotkey Version: 6.13.10.1102" which is the one I downloaded from S3's website. I'll see if this makes any difference. My device driver doesn't show any exclamation marks after restarting.

The most recent crash produced an error log that seemed identical to the one I posted in the previous post. Here is the log of the other crash:

Bugcheck Analysis

Use !analyze -v to get detailed debugging information.
BugCheck A, {a1a2a2af, ff, 0, 804d954b}
*** ERROR: Module load completed but symbols could not be loaded for icntflt5.sys
*** WARNING: Unable to verify checksum for PhotoshopElements.exe
*** ERROR: Module load completed but symbols could not be loaded for PhotoshopElements.exe
Probably caused by : icntflt5.sys ( icntflt5+1b9f )
Followup: MachineOwner

kd> !analyze -v
Bugcheck Analysis

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: a1a2a2af, memory referenced
Arg2: 000000ff, IRQL
Arg3: 00000000, value 0 = read operation, 1 = write operation
Arg4: 804d954b, address which referenced memory

Debugging Details:
------------------

OVERLAPPED_MODULE: kmixer
READ_ADDRESS: a1a2a2af Nonpaged pool
CURRENT_IRQL: ff
FAULTING_IP:
nt!ExAcquireResourceSharedLite+65
804d954b 66395e0c cmp [esi+0xc],bx
DEFAULT_BUCKET_ID: DRIVER_FAULT
BUGCHECK_STR: 0xA
LAST_CONTROL_TRANSFER: from bae50844 to 804d954b
TRAP_FRAME: f4434958 -- (.trap fffffffff4434958)
ErrCode = 00000000
eax=81228708 ebx=00000000 ecx=00000000 edx=00000000 esi=a1a2a2a3 edi=81228708
eip=804d954b esp=f44349cc ebp=f44349d8 iopl=0 nv up di pl zr na po nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010046
nt!ExAcquireResourceSharedLite+0x65:
804d954b 66395e0c cmp [esi+0xc],bx ds:0023:a1a2a2af=????
Resetting default scope
STACK_TEXT:
f44349d8 bae50844 a1a2a2a3 00000001 f4434a08 nt!ExAcquireResourceSharedLite+0x65
f44349e8 bae529ac f4434ae8 e12e6008 00000001 Ntfs!NtfsAcquireResourceShared+0x20
f4434a08 bae77dc2 f4434ae8 e12e6008 e12e60d0 Ntfs!NtfsAcquireSharedFcb+0x25
f4434a70 bae764b4 f4434ae8 81830e28 81335770 Ntfs!NtfsCommonQueryInformation+0x138
f4434ad4 bae764ed f4434ae8 81830e28 00000001 Ntfs!NtfsFsdDispatchSwitch+0x12a
f4434bf8 804e3d77 81335770 81830e28 806ed2a4 Ntfs!NtfsFsdDispatchWait+0x1c
f4434c08 8066a2c5 81335020 812d5988 ffab2700 nt!IopfCallDriver+0x31
f4434c2c baef4459 f4434c68 804e3d77 81335020 nt!IovCallDriver+0xa0
f4434c34 804e3d77 81335020 81830e28 806ed2a4 sr!SrPassThrough+0x31
f4434c44 8066a2c5 81830fdc 81831000 ffab2748 nt!IopfCallDriver+0x31
f4434c68 f40cfb9f ffab2690 ffadaf38 806ed000 nt!IovCallDriver+0xa0
WARNING: Stack unwind information not available. Following frames may be wrong.
f4434cac 80573429 f4434d64 0012ea94 80572d12 icntflt5+0x1b9f
f4434d48 804df06b 000001b8 0012eaac 0012ea94 nt!NtQueryInformationFile+0x471
f4434d48 7c90eb94 000001b8 0012eaac 0012ea94 nt!KiFastCallEntry+0xf8
0012ea74 7c90dfe8 7c810c3e 000001b8 0012eaac ntdll!KiFastSystemCallRet
0012ea78 7c810c3e 000001b8 0012eaac 0012ea94 ntdll!ZwQueryInformationFile+0xc
0012eab4 7c810ca2 000001b8 0012eac4 0207f3c0 kernel32!GetFileSizeEx+0x1d
0012eacc 00bc45a9 000001b8 00000000 00bc4927 kernel32!GetFileSize+0x13
000003a1 00000000 00000000 00000000 00000000 PhotoshopElements+0x7c45a9

FOLLOWUP_IP:
icntflt5+1b9f
f40cfb9f 5f pop edi
SYMBOL_STACK_INDEX: b
FOLLOWUP_NAME: MachineOwner
SYMBOL_NAME: icntflt5+1b9f
MODULE_NAME: icntflt5
IMAGE_NAME: icntflt5.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 41b5dba0
STACK_COMMAND: .trap fffffffff4434958 ; kb
FAILURE_BUCKET_ID: 0xA_VRF_icntflt5+1b9f
BUCKET_ID: 0xA_VRF_icntflt5+1b9f
Followup: MachineOwner

**geoscomp** · February 18th, 2005, 03:08 PM

Are you using sophos antivirus?

these listings seem to point to that as the causative agent here:

Probably caused by : icntflt5.sys

FOLLOWUP_IP:
icntflt5+1b9f
f40cfb9f 5f pop edi
SYMBOL_STACK_INDEX: b
FOLLOWUP_NAME: MachineOwner
SYMBOL_NAME: icntflt5+1b9f
MODULE_NAME: icntflt5
IMAGE_NAME: icntflt5.sys

**Headbored** · May 30th, 2005, 12:13 AM

Don't know if this is a fix for your problem, although, my problem was the exact same. Constant BSOD/self-reboots; and computer slowed to a crawl.

I do believe strongly that my problem was due to an SCSI/RAID driver, the problem arose as soon as i installed a virtual drive which used those drivers and so i followed by a clean re-insall and the problem has vanished completly.

My BSOD error code was 0xc4 (0x0000000C4)

hope this is of some help