Blue Screen Crash Error 0x000000F4 (winxp)

supremeone

Limp Gawd
Joined
May 17, 2007
Messages
141
I was running firefox with noscript (but on regular settings) and trying to go to download some stuff, and the websites might have been on the untrustworthy side. But not sure, all I know is I went to a bunch of them and downloaded 1 file but pretty sure it's legit because i had the file before and file size matched exactly. Must have been the websites or something else. Anyways:

Error was Stop 0x000000F4 (0x00000003, 089E9FDAO, 0x89E9FF14, 0x80605628). I heard that you can identify the process that's being terminated based on these error codes, and also the terminating process. But not sure if you need the minidump or not to do that. If so, I don't know if I can get the dump because i don't think my settings in the startup and recovery, are set to do a complete memory dump, i think it's just set to the lowest one at 64k. And I can't get into safe mode to change it. Any ideas on what to do? I don't want to format, so it's like i'm looking to just eliminate the source of the problem after identifying it, or just do a reinstall of windows xp if that doesn't work.

As far as any recent changes goes, I did install a recent program, UTwarpix, it's some anti-cheat protection for Unreal Tournament, and it crashed my computer not to long ago. But i don't think that it's.
 

LoStMaTt

2[H]4U
Joined
Feb 26, 2003
Messages
3,181
Errors with lots of zeros like the Stop error you had are usually memory related.

Start testing your RAM and maybe take a stick out and see what happens.
 

supremeone

Limp Gawd
Joined
May 17, 2007
Messages
141
actually i checked using a boot cd to look at the files, and there's no recent minidump file, but there is a memory.dmp file but it's 0 bytes. I don't know how to make sure the debugging options are turned on without being in windows either ;\
 

supremeone

Limp Gawd
Joined
May 17, 2007
Messages
141
what should i do, i rebooted and now the addresses in parenthesis are different. Is there any way to make windows create a memory dump file without being able to get into windows the regular way.
 

der_jackal

Limp Gawd
Joined
Aug 11, 2006
Messages
412
Addresses are going to be different, but the first value should still be 0x00000003. If it isn't, you've got something worse going on.


Can you access the recovery console via the XP disk? You can try and repair some of the hives and see if that doesn't remove the app which is giving you fits from the load order. http://support.microsoft.com/kb/307545/en-us#kb1

If not you can modify the offloaded registry to enable crash dumps to be created, then place it back on the system.

The following registry value is used:
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\CrashControl

CrashDumpEnabled REG_DWORD 0x0 = None
CrashDumpEnabled REG_DWORD 0x1 = Complete memory dump
CrashDumpEnabled REG_DWORD 0x2 = Kernel memory dump
CrashDumpEnabled REG_DWORD 0x3 = Small memory dump (64KB)
 

supremeone

Limp Gawd
Joined
May 17, 2007
Messages
141
thanks der_jackal, was exactly what i was looking for :) here's my situation in more depth. I have 3 partitions, all on the same drive. C, D, E. C has most of the programs installed, D just has other data, and E: has windows on it. I made the E partition only 8-9 gigs or so. There's only currently around 700 or so megs of space on there now. So i'm kinda in a situation where i'd need to change the path location of the dump file, and i just opened registry edit and noticed i could change the path location. So I could just change it to c:\memory.dmp? But the other thing is, i heard you had to have a page file be bigger than the amount of ram in the system. And I currently have 2 gigs. So would i have to remove one stick of ram so it works? I think i have a over a gig of space for my page file, but maybe not ;\

So unless i can figure out what the pagefile is or how to change the size, i guess i'm stuck with just creating minidump files. But it might be okay because not sure if i mentioned this, but the pc blue screens right at startup, doesn't even show the windows xp logon screen.

Also i assume i edit the registry by loading the sam file or one of the files and opening the registry hive and editting it like that? Not to savvy about what file i'd need to open though atm.
 

supremeone

Limp Gawd
Joined
May 17, 2007
Messages
141
okay just checked by loading hives, memory dump is turned off completely, and the pagefile i saw on the system is currently only 50 megs.
 

supremeone

Limp Gawd
Joined
May 17, 2007
Messages
141
and i also just set the registry hive to take a minidump, but it didn't do it. So i guess i might just have to reinstall
 

supremeone

Limp Gawd
Joined
May 17, 2007
Messages
141
kk nevemind, i somehow managed to get a minidump file created. I changed the value from 3 (minidump) to (2 kernel dump) and that made it count from 1 to 62 ;o maybe gave it more time to do something. Here's the link, could someone please analyze this? I'm going to attempt to do it myself but idk how much luck i'll have as i'm a beginner at this

http://www.megaupload.com/?d=MLUEUOTX
 

der_jackal

Limp Gawd
Joined
Aug 11, 2006
Messages
412
It's possible you got hit with a virus somewhere, I can't pull the image information for the .exe from a minidump to see if it's kosher, but smss.exe is a session manager .exe from MSFT. It's also possible that there are session elements in your registry that are corrupt.

Code:
1: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

CRITICAL_OBJECT_TERMINATION (f4)
A process or thread crucial to system operation has unexpectedly exited or been
terminated.
Several processes and threads are necessary for the operation of the
system; when they are terminated (for any reason), the system can no
longer function.
Arguments:
Arg1: 00000003, Process
Arg2: 89ea5990, Terminating object
Arg3: 89ea5b04, Process image file name
Arg4: 80605628, Explanatory message (ascii)

1: kd> da 89ea5b04
89ea5b04  "smss.exe"
1: kd> da 80605628
80605628  "Terminating critical process 0x%"
80605648  "p (%s)."

You can try and extract and replace the smss.exe on the system with the one from your Windows XP CD in the recovery console.
 

supremeone

Limp Gawd
Joined
May 17, 2007
Messages
141
okay i copied the smss.exe file off the nonworking pc, and to another pc to scan it with nod32, and it detected no infection. So I don't know. But I've been looking for a good boot cd scanner, and at first was going to customize bart pe to do that, but than remember hearing about UBCD, and than found the ubcd4win. So going to use that and run some scans, and someone recommended that i do a chkdsk /p and /r as well. Because i told them i was trying to search for some free games in google and might have stumbled upon a untrustworthy site.

Going to run the tests than, so if there's no virus detected or file system type problem, um, idk what to do besides a reinstall. Unless I could analyze another minidump file. Because i can't do a complete memory dump unless i know how to somehow switch the paging file locations and increase the size as well. Might also have to remove 1 1gb stick of ram to pull that off, as I don't think i have enough space for a 2 gig paging file.

I'll post back here with my results.
 

supremeone

Limp Gawd
Joined
May 17, 2007
Messages
141
okay interesting, somehow this time when i had the blue screen i was able to save a kernel memory dump. And it's also around the same size as my paging file so maybe we're finally getting somewhere. This file should have all the information needed to pinpoint what's wrong. I used the ultimate boot cd 4 windows, to run a lot of the anti virus tools, and kaspersky seemed to locate the most viruses/trojans. So going to analyze the report and figure out what each of them do.

Also going to try to run windbg and figure out if i get some answers, but here's the memory.dmp file incase anyone else is interested in debugging it: http://www.megaupload.com/?d=TNFKUS6V

Edit: turns out the dump file is partially corrupt according to windbg, but i did retrieve this piece of information:
DEFAULT_BUCKET_ID: DRIVER_FAULT
BUGCHECK_STR: 0xF4
 

supremeone

Limp Gawd
Joined
May 17, 2007
Messages
141
okay so i just attempted to do a reinstall, and after coping files it reboots and gets ready to start the reinstall, and i get a blue screen once again. what's going on? :( i was able however to somehow get a bigger memory dump that was actually 60 megs this time and not corrupt but after running it through windbg, i get same result, saying it's likely smss.exe

So far i have ran a memcheck, did chkdsk which did say it found 1 or a few errors, so i did chkdsk /r. And i ran virus scans, found a lot of trojan downloaders. I can post the memory dump here but i don't know if that'll help now since i think i got the dump while trying to run windows installer.
 

supremeone

Limp Gawd
Joined
May 17, 2007
Messages
141
i just tried an older harddrive and it worked fine, so it can't be hardware related. I also ran another chkdsk ;o I'm going to try a more thorough harddrive scan and a virus scan on my other drives. But yeah not sure what the deal is

I mean normally i'd just reinstall and give up right there, but i can't even reinstall. Is there any type of windows install i can do that might just copy over old files with new ones? I think the ubcd has something like that, but not sure. If anyone can offer some tips let me know, problem has been going on for 3 days now ;((
 
Top