Blue Screen Errors : DRIVER_CORRUPTED_EXPOOL 0x100000c5 and IRQL_NOT_LESS_OR_EQUAL 0x1000000a in Windows 2003 R2 Server SP2

Question

Original Title : 0x100000c5 0x00000000 0xd0000002 0x00000001 0x8089c4bb __0x1000000a 0x00000000 0xd000001b 0x00000001 0x8083df4c

Hello, guys

This is a windows 2003 R2 server at SP2, I got BSOD two times these days, what I got from bluescreenview are:

Mini090810-01.dmp	9/8/2010 11:56:23 AM	DRIVER_CORRUPTED_EXPOOL	0x100000c5	0x00000000	0xd0000002	0x00000001	0x8089c4bb	hal.dll	hal.dll+6456	Hardware Abstraction Layer DLL	Microsoft® Windows® Operating System	Microsoft Corporation	5.1.2600.5512 (xpsp.080413-2111)	32-bit		C:\WINDOWS\Minidump\Mini090810-01.dmp	2	15	3790
Mini090610-01.dmp	9/6/2010 3:28:52 AM	IRQL_NOT_LESS_OR_EQUAL	0x1000000a	0x00000000	0xd000001b	0x00000001	0x8083df4c	Ntfs.sys	Ntfs.sys+23608	NT File System Driver	Microsoft® Windows® Operating System	Microsoft Corporation	5.1.2600.5512 (xpsp.080413-2111)	32-bit		C:\WINDOWS\Minidump\Mini090610-01.dmp	2	15	3790

is that becasue of the system files corrupt?

Answer 1

Hello, guys

This is a windows 2003 R2 server at SP2, I got BSOD two times these days, what I got from bluescreenview are:

Mini090810-01.dmp	9/8/2010 11:56:23 AM	DRIVER_CORRUPTED_EXPOOL	0x100000c5	0x00000000	0xd0000002	0x00000001	0x8089c4bb	hal.dll	hal.dll+6456	Hardware Abstraction Layer DLL	Microsoft® Windows® Operating System	Microsoft Corporation	5.1.2600.5512 (xpsp.080413-2111)	32-bit		C:\WINDOWS\Minidump\Mini090810-01.dmp	2	15	3790
Mini090610-01.dmp	9/6/2010 3:28:52 AM	IRQL_NOT_LESS_OR_EQUAL	0x1000000a	0x00000000	0xd000001b	0x00000001	0x8083df4c	Ntfs.sys	Ntfs.sys+23608	NT File System Driver	Microsoft® Windows® Operating System	Microsoft Corporation	5.1.2600.5512 (xpsp.080413-2111)	32-bit		C:\WINDOWS\Minidump\Mini090610-01.dmp	2	15	3790

is that becasue of the system files corrupt?

Check the System Log in Event Viewer for error messages that might identify the device or driver that caused the error. Check you have installed any new software and do a chkdsk on your server

Answer 2

We do need the DMP file as it contains the only record of the sequence of events leading up to the crash, what drivers were loaded, and what was responsible.

If you are overclocking STOP

You may be able to get the DMP files without crashing by booting into safe mode (F8) with networking.

Please follow these instructions to collect data from the crashes and upload them here, to your Skydrive or a file sharing service like Rapidshare.

http://www.sysnative.com/forums/showthread.php/68-Blue-Screen-of-Death-%28BSOD%29-Posting-Instructions-Windows-8-7-amp-Vista?p=303&viewfull=1#post303

http://sysnative.com/0x8/BSOD\_Windows7\_Vista\_v2.64\_jcgriff2\_.exe

To enable us to assist you with your computer's BSOD symptoms, upload the contents of your "\Windows\Minidump" folder.

The procedure:

* Copy the contents of \Windows\Minidump to another (temporary) location somewhere on your machine.

* Zip up the contents of that folder

Please upload them to skydrive or a file sharing service and put a link to them in your next post.

Please also go to start>search/run>cmd>msinfo32 and include it in the upload

To ensure minidumps are enabled:

* Go to Start, in the Search Box type: sysdm.cpl, press Enter.

* Under the Advanced tab, click on the Startup and Recovery Settings... button.

* Ensure that Automatically restart is unchecked.

* Under the Write Debugging Information header select Small memory dump (256 kB) in the dropdown box (the 256kb varies).

* Ensure that the Small Dump Directory is listed as %systemroot%\Minidump.

* OK your way out.

* Reboot if changes have been made.

http://www.sysnative.com/forums/showthread.php/325-BSODs-but-no-Dump-Files

http://www.osronline.com/article.cfm?article=545

Please also go to start>run>msinfo32 and save the results.  Upload it with the DMP files, thanks.

Answer 3

I personally have never found anything helpful looking at Event Viewer logs for a BSOD, so I don't even look at them - I am not sure if these ideas I use for Windows XP will help you, but they might help you get started:

The next time your system crashes, provide more information about what you see.

Here is a BSOD example showing information you need to provide:

http://techrepublic.com.com/i/tr/downloads/images/bsod_a.jpg

Send the information pointed to with the red arrows (3-4 lines total).

Send the entire *** STOP message line since there are clues in the 4 parameters.

If there is a file name listed under the STOP message, be sure to include that information too.

Skip the boring text unless it looks important to you.  We know what a BSOD looks like, we need to know what your BSOD looks like.

Now provide more information about your system and information from the most recent crashes.

Click Start, Run and in the box enter:

msinfo32

Click OK, and when the System Summary info appears, click Edit, Select All, Copy and then paste the information back here.

For video driver information, expand the Components, click Display, click Edit, Select All, Copy and then paste the information back here.

There will be some personal information (like System Name and User Name), and whatever appears to be private information to you, just delete it from the pasted information.

This will minimize back and forth Q&A and eliminate guesswork.

Download BlueScreenView from here:

http://www.nirsoft.net/utils/blue_screen_view.html

Unzip and run it (BSV installs nothing) and let it finish scanning all your crash dump files.

If you double click on of the dumps, you will get some information about it (including the Caused By Driver field) and you may be able to spot the problem right away - especially if you see a pattern in the dumps where the Caused by Driver field is the same (start with that driver).

BlueScreenView tries to locate the right driver or module that caused the blue screen by looking inside the crash stack. However, be aware that the driver detection mechanism is not 100% accurate, and you should also look in the lower pane, that display all drivers/modules found in the stack.

Sometimes BlueScreenView will implicate XP files as the cause of the crash (ntoskrnl.exe, win32k.sys, hal.dll etc.) but they are probably not the real cause of the crash (BSV does the best it can) and you need to look at some other crash dumps or use the Windows debugging tools to dig a little deeper into the crash dump to find the real cause.

You would have to either gather up some more example crashes and look through them, or find some where XP files are not the "cause" or you could upload your crash dump files to your SkyDrive and somebody with the Windows debugging tools can help take a look at them in more detail.

Select (highlight) one or more of the most recent dump files by clicking them and holding down the Ctrl key to select multiples files.  Try to select just the most recent ones that relate to your issue (maybe five or so dump files to get started).

Click File, Save Selected Items and save the information from the dumps to a text file on your desktop called BSOD.txt.

Open BSOD.txt with a text editor Notepad, WordPad, etc.), select all the text (Ctrl-A), copy all the text to the Windows clipboard (Ctrl-C) and paste the text from the clipboard (Ctrl-V) back here in your next reply.

Here is an example of the BSV report from a single BSOD that I initiated on purpose that shows the cause of the crash as the i8042prt.sys driver belonging to Microsoft Corporation:

==================================================

Dump File         : Mini102911-02.dmp

Crash Time        : 10/29/2011 4:54:36 AM

Bug Check String  : MANUALLY_INITIATED_CRASH

Bug Check Code    : 0x000000e2

Parameter 1       : 0x00000000

Parameter 2       : 0x00000000

Parameter 3       : 0x00000000

Parameter 4       : 0x00000000

Caused By Driver  : i8042prt.sys

Caused By Address : i8042prt.sys+27fb

File Description  : i8042 Port Driver

Product Name      : Microsoft® Windows® Operating System

Company           : Microsoft Corporation

File Version      : 5.1.2600.5512 (xpsp.080413-2108)

Processor         : 32-bit

Crash Address     : ntoskrnl.exe+22f43

Stack Address 1   : i8042prt.sys+27fb

Stack Address 2   : i8042prt.sys+2033

Stack Address 3   : ntoskrnl.exe+6e715

Computer Name     :

Full Path         : C:\WINDOWS\Minidump\Mini102911-02.dmp

Processors Count  : 4

Major Version     : 15

Minor Version     : 2600

Dump File Size    : 94,208

==================================================

Send the BlueScreenView information from the last 5 memory dumps (if you don't have 5 memory dumps yet, send the most recent ones you have).

Sometimes it is easiest to just upload the memory dump files from your most recent crashes to your SkyDrive (everybody has a SkyDrive for sharing file).   Then somebody that already has the Windows debugging tools can take a closer look at things and figure out what is going on.

The memory dump files from the recent crashes and BSODs are usually in this folder:

c:\windows\minidump

The files will be named something like this:

Mini120311-01.dmp

You need to upload the most recent ones...  maybe 5-10 of the most recent crash dump files ought to be enough if you have that many.  If you do not have that many, send what you do have.

Getting started with SkyDrive:

http://explore.live.com/skydrive-get-started

After you get your files uploaded and are looking at them on your SkyDrive, you need to "share" your folders/files so others can see them.

Here is a link that tells you how to do that:

http://explore.live.com/windows-live-skydrive-change-access-permissions-faq

Then choose the "Get a link" button.  When you click that, a window will open that contains the link to your SkyDrive files.

Copy the contents of the box "Copy this link to share:" by selecting the link contents (it will all become highlighted), press Ctrl-C (copy) and then come back to the forum and in your next message press Ctrl-V to paste the contents of the link back here.

What you paste back will look something like this link to my SkyDrive:

https://skydrive.live.com/redir.aspx?cid=6a7e789cab1d6f39&resid=6A7E789CAB1D6F39!311