WinXP BSoD ticking me off...

S

starhawk

[H]F Junkie
Joined
Oct 4, 2004
Messages
8,908
System is an HP Compaq tc4200 running XP SP3. I know I'm behind the curve a goodly bit, you don't need to tell me :p seriously tho, "just effing upgrade" is not a valid solution to this problem right now.

Here's the error that comes up, scribbled down quickly from (gasp) an actual bluescreen...

Code: 
0x0000008E (0xC0000005, 0xBF9543EE, 0xA8A30C00, 0x00000000)
win32k.sys Address BF9543EE at memory location BF800000 datestamp 4d1dd63f

I've got a screenie of the problem in Event Manager (this is a frequently recurring problem) here.

My local tech guy politely pointed me towards gooooooooooogle, but either my google-fu is weak (old man) or I've discovered a new error code, because Big G won't tell me shit. The stuff in the FAQ here (sticky in this forum) isn't helping, either.

So I put it to you, [H], what's the problem giving my system the sniffles?
 
You may have been searching for the wrong number of zeros; there's 5 zeroes and google for "error 1000008e" gets me lots of results.

First thing to do is check for bad RAM. Get MemTest86+ on a USB stick or a CD, unplug all USB devices (including keyboard and mouse) and let Memtest boot up and run for at least three passes.
 
I've got an older version on CD, although I've forgotten which one. Would run it tonight but Mom's using the thing right now, despite the bluescreens, and won't let it go.

I'll run it tomorrow. Should I bother downloading a newer version? IIRC the one I have is maybe a year or two out of date, but I don't know how often they release...
 
no need for newest version really, just let it run. I am pretty sure you'll see an error rather quickly. Also, make sure to reset your CMOS and in the BIOS make sure your RAM and CPU are getting the proper voltage(s)
 
starhawk said:
Would run it tonight but Mom's using the thing right now, despite the bluescreens, and won't let it go.
Click to expand...

That explains the no upgrade clause :D

Another thing to look into if the memory checking comes out ok is the hard drive. Something about that error made me think of Spinrite...
 
I've got HDTune free... I'll look into spinrite, if it's free I'll get it. TBH never heard of the program.

No-upgrade clause is not solely because of Mom herself. She's smart enough to switch between systems, and has several times. I live with her, she's disabled, and we're poor. There's simply no way to fit an upgrade into the budget. If the money was there, I'd get myself a nice Toshiba and her a nice VAIO and call it a day. Not gonna happen without illegal doings, and I'm neither stupid nor brave enough to even try that sort of shit.

We are the 99%.

EDIT: fuck, spinrite is $89... never mind that! I wonder if AlternativeTo can help me here (I doubt it but it's worth a shot)...
EDIT2: score! MHDD and HDAT2 are the ones I found. I'll try both, see which one I like more.
 
Last edited:
Just to keep people in the know... it, er, stopped BSoDing. No idea what's going on with that. When (if?) it comes back I'll revive this thread.
 
Did the temperature of the room change? Like, the weather suddenly got cooler? If so, that may indicate an overheating issue.

Has the computer case been cleaned out? If you have not done it in years, you may find the CPU cooler mostly clogged with dust.
 
We keep our thermostat within about 2degrees of variance.

Last time I pulled it apart, there was little if any dust present, although since we have a cat, that may warrant some reexamination. I will also mention that there are parts of this laptop (power button panel and hdd cover) attached partially with electrical tape (!) but that's what happens when I upgrade an eBay laptop that arrived in about 8/10 cosmetic condition. Bastard designers need to stop putting RAM under keyboards... grrrr aargh.
 
With blue screens, the first question I try to deduce is is the problem with software or hardware.

You can use Microsoft's Debugging Tools for Windows (advanced) or Nirsoft's BlueScreenView (easier) to get more information on a Blue Screen. In Nirsoft's BlueScreenView, check the "Caused by driver" column. If the blue screen is caused by a driver, this can point you in the right direction. It could also point to a potential trouble device.

I'd like to echo the advice that running diagnostic test can help. For Dells, it's usually a good idea to run the Dell Diagnostics utility, and HP should have similar software (reboot and press F2 at the boot screen and run the HP System Diagnostics or run the HP Support Assistant software in Windows - link). I also like running the Ultimate Boot CD to access MemTest86 or MemTest86+ and the Hard drive diagnostic software for my hard drive manufacturer (or IBM's Drive Fitness Test if not available).

If diagnostics return passing results, I start thinking software. This includes drivers, file corruption, and malware/viruses. For Windows, use the System File Checker (Start - Run, type cmd, press enter, type sfc /scannow and press enter). This command is supposed to check and address the integrity of the Windows system files. It will run through and not give you much information unless you check the Event Log for Windows File Protection (I think that works for Windows XP but in newer versions, look at %windir%\logs\cbs\cbs.log). Run Check Disk by going to My Computer, right-clicking Local Disk ( C: ), click Tools, and click Check Now... in the Error-checking section (use at least the first checkbox, add the second checkbox to check the whole disk including free space, I recommend both and click Start then Restart). If you're comfortable, sometimes reading the System section of the Event Viewer can yield useful information. Run a virus scan (Microsoft Security Essentials is free and I like running Windows Defender Offline by booting to a USB Flash Drive) and a Malwarebytes' Anti-Malware scan (HiJackThis is useful for those who know what they're looking at with that utility). Also, updating your drivers to the latest available from the manufacturer can sometimes help.
 
It's back :mad: different error this time.

Code: 
STOP 0x00000050 (0xE4020028, 0x00000000, 0xBF846561, 0x00000001)
win32k.sys Address BF846561 at BF800000 datestamp 4d1dd63f

I'll run MHDD in a little bit, soon as I can get it on a CD and throw my short-notice external CD drive back together (it's a DVD burner and IDE->USB adapter + power cord, looks like shit but works nicely). I'll keep folks posted.

EDIT: doing a drive scan in MHDD -- it's about 40% through. The drive is slowing down over time... started off with a lot of access times in the <3ms category, but now almost all are in the <10ms category... is that normal?
 
Last edited:
Drive passed its test, so almost certainly not that.

Running memtest... anyone know of a faster memory test utility? If the location reads and writes, it works IIRC, so I don't really need something that's gonna take all night.

Also, if it's not the HDD, and it turns out that the RAM is fine too, what do I look at next?

EDIT: ended memtest for now... I'll start it up again later. I have other stuff I need my desk for right now :p
 
Last edited:
I'll check the Memtest in an hour or so. If it hasn't turned up something, I'll see if I can find a FREE haxdoor removal tool -- after all, it has to detect it to remove it! (I say "free" because CNET wants $40 for it -- I don't think so, Tim!)

...suggestions for such a tool would be welcome ;)

EDIT: found one courtesy of Symantec. OH GOD I'M TRUSTING NORTON HERE COMES THE END OF THE WORLD.
 
Last edited:
Memtest completed a full pass, no errors.

Symantec didn't find shit.

Any other ideas, folks? I'm 'bout at wits end here...
 
Mom decided to use it anyways. She says that it only happens when she's doing a lot in Chrome... so it may be a memory issue that Memtest didn't pick up...
 
Could be a hardware issue, I suggest getting the power supply checked... wait your using a laptop.
 
As posted above, you're going to need to examine that memory dump to get the details of the crash. The BSoD message can sometimes get you close, but not always. I go right to windebug to look at BSoD problems now.

If you post the dump somewhere, I'll take a peek at it for you if you're intimidated by it.
 
I tried to fetch the dumps for a friend who's helping me (the tech shop dude in the first post), and they aren't there!

...I did get the error report info out of Event Viewer, it includes some hex stuff, dunno if it's useful, but I'll gladly upload the two text files to datafilehost if it's helpful...
 
Try these things to clean up the hard drive. Sometimes stuff gets corrupted in XP and can cause all sorts of weird issues like this.

1. Disable the swap file

2. Clean out C:\Windows\Temp (delete everything it will let you)

3. Clean out C:\Windows\Prefetch

4. Clear the windows update cache : http://en.kioskea.net/faq/2471-cleaning-the-update-cache-in-windows

5. Run a disk cleanup (Start-> Computer -> right click on drive C: and select properties.) There will be a "disk cleanup button". Have it cleanup everything.

6. Open up a command prompt and run "chkdsk c: /f" and then restart the computer so it will run. I am betting it will find stuff and fix it.

7. The index gets screwed up in XP a lot and can cause anything from files not opening to BSODs. Go to (Start -> Computer -> Right click on drive C: and select properties. Disable anything that has to do with indexing. This will take a bit, especially on an older machine.

8. Go download MyDefrag http://www.mydefrag.com/. Run a monthly System disk defrag. If you haven't run a Windows defrag very recently, you may have to run this two or more times to get stuff back like it should be.

9. Re-enable the swap file.. Better yet, make it a static size.

You can now re-enable indexing if you really want to... but it will screw up again.
 
I've done most of that.

Page file purged, then set at a fixed size.
Mom uses CCleaner religiously, so no temp files to worry about. It also replaces (the function of) disk cleanup.
Last time I ran chkdsk it blew up the drive I was trying to use it on. Not doing that again!
Mom defrags /almost/ religiously.

...Indexing service screws things up...? That's a new one for me. I've never figured out what that service does, anyways -- enlighten me, please!
 
It's configured, I checked when I was trying to figure out why they aren't there. It just doesn't seem to bother /retaining/ them.

...%systemroot%\Minidump is where it's supposed to be. IIRC that translates into C:\Windows\Minidump. Folder is empty.
 
starhawk said:
I've done most of that.

Page file purged, then set at a fixed size.
Mom uses CCleaner religiously, so no temp files to worry about. It also replaces (the function of) disk cleanup.
Last time I ran chkdsk it blew up the drive I was trying to use it on. Not doing that again!
Mom defrags /almost/ religiously.

...Indexing service screws things up...? That's a new one for me. I've never figured out what that service does, anyways -- enlighten me, please!
Click to expand...

I still think it's a hard drive issue when I see how you described chkdsk (which is lousy) and how often the hard drive is getting used with lots of defrags.

Unfortuantly I don't think you can get a trial of Spinrite but it really does sound like the drive is on its last legs and you keep bumping into a bad sector(s) or corrupted spots every now and then which is why the BSODs aren't constant anymore
 
I did a scan with MHDD. Drive was fine according to that. I suppose I can take it down to the local tech shop and have my friend check it out, but they're really busy these days, and I don't really have money to spend at all. EDIT: although, if someone here wants to donate a couple $20 bills to the cause, that changes things... ah, that's what I thought you'd say. Never mind, then...

...the chkdsk failure, by the way, happened a long time ago on another drive. It's quite a story, especially how it ended. I'll put it up here purely for your entertainment.

Ever heard of a company named "Giga Bank"? I bought one of their external drives back when flash storage was brand new. It was a 2.2gig model, not exactly what one would call "compact", and it seems it actually had a microdrive in it. The drive had a habit of getting very, very hot. One day I ran chkdsk on it, and it froze my laptop solid smack in the middle of the scan. I decided to reboot and hope for the best... alas, the drive was shot.

Some years later I posted it on the Freebies thread. Someone snagged it, and opened the case to confirm that it was indeed a microdrive-based device. They then opened the drive itself... I don't still have the pix, but there was actual physical damage to the platter in a couple spots. Chkdsk actually very nearly pulled a literal, real-life HCF on that drive!

...last I heard, the fellow had put a proper CF card in it, and the thing was working just fine as a result -- although that was some time ago...

...now you know why I'm a little antsy (OK, a LOT antsy) about running chkdsk...
 
starhawk said:
It's configured, I checked when I was trying to figure out why they aren't there. It just doesn't seem to bother /retaining/ them.

...%systemroot%\Minidump is where it's supposed to be. IIRC that translates into C:\Windows\Minidump. Folder is empty.
Click to expand...

it might be empty because ccleaner does empty it if not configured correctly.
 
...ah. I'll get Mom to toggle that option for me.

EDIT: got it fixed... the box for deleting minidump files was indeed checked. Not any more!
 
Last edited:
Here's the info I have... I've removed (as noted in the text) the name of the computer in question...

Code: 
Event Type:	Error
Event Source:	System Error
Event Category:	(102)
Event ID:	1003
Date:		8/30/2012
Time:		10:28:31 PM
User:		N/A
Computer:	[deleted]
Description:
Error code 1000008e, parameter1 c0000005, parameter2 bf9543ee, parameter3 a8a30c00, parameter4 00000000.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 53 79 73 74 65 6d 20 45   System E
0008: 72 72 6f 72 20 20 45 72   rror  Er
0010: 72 6f 72 20 63 6f 64 65   ror code
0018: 20 31 30 30 30 30 30 38    1000008
0020: 65 20 20 50 61 72 61 6d   e  Param
0028: 65 74 65 72 73 20 63 30   eters c0
0030: 30 30 30 30 30 35 2c 20   000005, 
0038: 62 66 39 35 34 33 65 65   bf9543ee
0040: 2c 20 61 38 61 33 30 63   , a8a30c
0048: 30 30 2c 20 30 30 30 30   00, 0000
0050: 30 30 30 30               0000

Code: 
Event Type:	Error
Event Source:	System Error
Event Category:	(102)
Event ID:	1003
Date:		9/4/2012
Time:		12:13:18 AM
User:		N/A
Computer:	[deleted]
Description:
Error code 10000050, parameter1 e4020028, parameter2 00000000, parameter3 bf846561, parameter4 00000001.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 53 79 73 74 65 6d 20 45   System E
0008: 72 72 6f 72 20 20 45 72   rror  Er
0010: 72 6f 72 20 63 6f 64 65   ror code
0018: 20 31 30 30 30 30 30 35    1000005
0020: 30 20 20 50 61 72 61 6d   0  Param
0028: 65 74 65 72 73 20 65 34   eters e4
0030: 30 32 30 30 32 38 2c 20   020028, 
0038: 30 30 30 30 30 30 30 30   00000000
0040: 2c 20 62 66 38 34 36 35   , bf8465
0048: 36 31 2c 20 30 30 30 30   61, 0000
0050: 30 30 30 31               0001
 
starhawk, this is a complete shot in the dark: go onto youtube start a vid up , right click on it and select settings, then untick the "enable hardware acceleration" box, and see if this remedies the BSOD issues.

If this works remember to untick this box everytime you upgrade flash (or if you regularly clear your cache etc). Good luck with it!
 
...that's definitely not the problem. Mom's watching videos right now and it's not bluescreening 5sec in.
 
:mad: here we go again. Mom's an ardent Democrat (I'm not quite as strong in my political convictions) so, as it turns out, she only gets the bluescreen when she's doing "googlebombing" to get the word out. (Does that crap even work anymore?)

IN SOVIET RUSSIA, GOOGLE BOMB YOU!

All jokes aside...
Code: 
STOP 0x0000008E (0xC0000005, 0xBF9543EE, 0xA9F77C00, 0x00000000)
win32k.sys Address BF9543EE base at BF800000 datestamp 4d1dd63f

I've also got a *.dmp file for you folks, it's here --> http://www.datafilehost.com/download-70f4a16d.html

I'm curious... is there any way to match the physical addresses with the logical addresses? i.e. figure out which stick of RAM (there are two) this BF800000 address is located on, and replace that one stick?
 
It's Chrome, or maybe a plugin in chrome, that is causing it:

Code: 
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

KERNEL_MODE_EXCEPTION_NOT_HANDLED_M (1000008e)
This is a very common bugcheck.  Usually the exception address pinpoints
the driver/function that caused the problem.  Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003.  This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG.  This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG.  This will let us see why this breakpoint is
happening.
Arguments:
Arg1: c0000005, The exception code that was not handled
Arg2: bf9543ee, The address that the exception occurred at
Arg3: a9f77c00, Trap Frame
Arg4: 00000000

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

FAULTING_IP: 
win32k!GreGetGlyphIndicesW+af
bf9543ee 8b4004          mov     eax,dword ptr [eax+4]

TRAP_FRAME:  a9f77c00 -- (.trap 0xffffffffa9f77c00)
ErrCode = 00000000
eax=00000000 ebx=00000100 ecx=000000b9 edx=e3af1ffc esi=e1a16000 edi=e3af1c00
eip=bf9543ee esp=a9f77c74 ebp=a9f77c8c iopl=0         nv up ei pl zr na pe nc
cs=0008  ss=0010  ds=0023  es=0023  fs=0030  gs=0000             efl=00010246
win32k!GreGetGlyphIndicesW+0xaf:
bf9543ee 8b4004          mov     eax,dword ptr [eax+4] ds:0023:00000004=????????
Resetting default scope

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  DRIVER_FAULT

BUGCHECK_STR:  0x8E

PROCESS_NAME:  chrome.exe

LAST_CONTROL_TRANSFER:  from bf94ba7b to bf9543ee

STACK_TEXT:  
a9f77c8c bf94ba7b e3c8c830 e1a16200 e2ff2008 win32k!GreGetGlyphIndicesW+0xaf
a9f77d28 bf94baf7 5a011022 0013d330 00000100 win32k!NtGdiGetGlyphIndicesWInternal+0xf2
a9f77d48 8053d6d8 5a011022 0013d330 00000100 win32k!NtGdiGetGlyphIndicesW+0x1b
a9f77d48 7c90e514 5a011022 0013d330 00000100 nt!KiFastCallEntry+0xf8
WARNING: Frame IP not in any known module. Following frames may be wrong.
0013d2c0 00000000 00000000 00000000 00000000 0x7c90e514


STACK_COMMAND:  kb

FOLLOWUP_IP: 
win32k!GreGetGlyphIndicesW+af
bf9543ee 8b4004          mov     eax,dword ptr [eax+4]

SYMBOL_STACK_INDEX:  0

SYMBOL_NAME:  win32k!GreGetGlyphIndicesW+af

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: win32k

IMAGE_NAME:  win32k.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4d1dd63f

FAILURE_BUCKET_ID:  0x8E_win32k!GreGetGlyphIndicesW+af

BUCKET_ID:  0x8E_win32k!GreGetGlyphIndicesW+af

Followup: MachineOwner
 
OK, what sorta plugin would do that?

er... I will mention that she's never heard of adblock...
 
starhawk said:
OK, what sorta plugin would do that?

er... I will mention that she's never heard of adblock...
Click to expand...

If its only crashing during Chrome, stop using Chrome. Or at the very least, remove Chrome and reinstall it. Could be a browser issue and you are just wasting your time.
 
She doesn't believe in chrome sync, either... so I'm assuming I'd have to delete all personal settings and then put the bookmarks back and hope that's all she needs?

...she's gonna have a fit.
 
starhawk said:
She doesn't believe in chrome sync, either... so I'm assuming I'd have to delete all personal settings and then put the bookmarks back and hope that's all she needs?

...she's gonna have a fit.
Click to expand...

Or just have her use Firefox for a bit to see if it still crashes.

Also go through Add/Remove Programs and rip out anything she may not need.
 
She won't touch Firefox. I've tried. Hard.

She went from IE8 to Chrome -- and not because of me, but because the Farmville support people wouldn't help her much without it. I may be the person who fixes her computer, but I don't get a lot of say in what she does with it once I'm done.
 
I think the answers are all there... it's chrome. If you want to test it, use IE or firefox and if the problem goes away, then you know you got it. If it doesn't go away, look at the common plugins (java, flash, etc) and start stripping them out one by one.

If she doesn't believe in chrome sync, well, you're going to have to do it the old fashioned way. If I were you, I'd tell mom that if you wanted my help to get it fixed, deal with a little change for a day while we figure out what the problem is. At minimum, turn on sync, remove chrome, put it back, let it sync, then disable it. That'll make it easier to back up.
 
She doesn't even have gmail. She uses yahoo -- can chrome sync without a google account?

*sigh* I'll have a chat with her.
 
You must log in or register to reply here.
Back
Top