Blue Screen Error related to Windows Search Service

[docbadwrench]

Greetings,

I'm having a somewhat-recurring issue wherein I'll play a PopCap or SOE Game and be interrupted by the dreaded BSOD. When I go into my event viewer and look at the only red-exclamation-point item I can, I see the following (two items, both appear in the log at exactly the same time.

In this case, the game was Free Realms. As you'll note from the error, it appears to be related to the Windows Search Service. I've attached the minidump to this link, for those of you uber-XP-experts that can understand it.

Also, I keep this PC maintained pretty well. I run anti-malware software on a regular basis, use ClamWin for my antivirus, and avoid iffy-websites.

My Computer:
AMD Athlon 64 FX-55 @ 2.61 GHz
2GB of Ram
Windows XP service pack 3


Finally, thanks in advance for any help you can offer. I visit Tom's Hardware whenever I need expert advice and no matter whether I actually fix the problem or not, you guys are helpful and kind.

Best regards.

 

[docbadwrench]

Bump. I'm wondering if there is any other data that I can provide to help with this. Someone on a different forum recommended a kernal report instead of the minidump. I have no idea how to produce this, though.

 

[docbadwrench]

I just had another blue-screen and thought I'd post the relevant information here. The last time this happened (above), it was an Application Error that triggered it, this time it's a System Error with a category of 102, whatever that means.

The Event Properties (with broken down Data info below):

Data (in bytes):
0000: 53 79 73 74 65 6d 20 45 System E
0008: 72 72 6f 72 20 20 45 72 rror Er
0010: 72 6f 72 20 63 6f 64 65 ror code
0018: 20 31 30 30 30 30 30 64 100000d
0020: 31 20 20 50 61 72 61 6d 1 Param
0028: 65 74 65 72 73 20 30 30 eters 00
0030: 34 64 38 64 65 30 2c 20 4d8de0,
0038: 30 30 30 30 30 30 31 63 0000001c
0040: 2c 20 30 30 30 30 30 30 , 000000
0048: 30 38 2c 20 30 30 34 64 08, 004d
0050: 38 64 65 30 8de0

Data (in words):
0000: 74737953 45206d65 726f7272 72452020
0010: 20726f72 65646f63 30303120 64303030
0020: 50202031 6d617261 72657465 30302073
0030: 64386434 202c3065 30303030 63313030
0040: 3030202c 30303030 202c3830 64343030
0050: 30656438

This is the minidump file. I'm still curious what else I can offer for help. Thanks.

 

[docbadwrench]

The hunt continues. I've been dealing with an assortment of blue screens. The newest tool I am attempting to use is the WinDbg program with the newest set of symbols. Here's what I'm learning (and let me know if any of it is useful, because I'm flying blind here):

There have been others, but the following is the most common source of my crashes.

Probably caused by : AmdPPM.sys ( AmdPPM+2832 )

DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: 006d8de0, memory referenced
Arg2: 0000001c, IRQL
Arg3: 00000008, value 0 = read operation, 1 = write operation
Arg4: 006d8de0, address which referenced memory

Debugging Details:
------------------


READ_ADDRESS: 006d8de0

CURRENT_IRQL: 1c

FAULTING_IP:
+399952f0316dfdc
006d8de0 ?? ???

CUSTOMER_CRASH_COUNT: 2

DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: 0xD1

TRAP_FRAME: 80549bbc -- (.trap 0xffffffff80549bbc)
ErrCode = 00000010
eax=00000000 ebx=80549cd0 ecx=00000002 edx=00000003 esi=ffdffc50 edi=ba23a832
eip=006d8de0 esp=80549c30 ebp=80549c40 iopl=0 nv up ei pl zr na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010246
006d8de0 ?? ???
Resetting default scope

LAST_CONTROL_TRANSFER: from 006d8de0 to 80540693

FAILED_INSTRUCTION_ADDRESS:
+399952f0316dfdc
006d8de0 ?? ???

STACK_TEXT:
80549bbc 006d8de0 badb0d00 00000003 80549c38 nt!KiTrap0E+0x243
WARNING: Frame IP not in any known module. Following frames may be wrong.
80549c2c 806d0e0f 00000000 80549c02 000000d1 0x6d8de0
80549c40 ba23a832 badb0d00 00000003 80549c80 hal!KiI8259MaskTable+0x2b
80549cd0 80541b00 00000000 0000000e 00000000 AmdPPM+0x2832
80549cd4 00000000 0000000e 00000000 00000000 nt!KiIdleLoop+0x20


STACK_COMMAND: kb

FOLLOWUP_IP:
AmdPPM+2832
ba23a832 ?? ???

SYMBOL_STACK_INDEX: 3

SYMBOL_NAME: AmdPPM+2832

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: AmdPPM

IMAGE_NAME: AmdPPM.sys

DEBUG_FLR_IMAGE_TIMESTAMP: 4623eeb9

FAILURE_BUCKET_ID: 0xD1_CODE_AV_BAD_IP_AmdPPM+2832

BUCKET_ID: 0xD1_CODE_AV_BAD_IP_AmdPPM+2832

 

[docbadwrench]

I have run a CheckDsk routine and found the following:

Checking file system on C:
The type of the file system is NTFS.
Volume label is Windows.

A disk check has been scheduled.
Windows will now check the disk.
Cleaning up minor inconsistencies on the drive.
Cleaning up 1802 unused index entries from index $SII of file 0x9.
Cleaning up 1802 unused index entries from index $SDH of file 0x9.
Cleaning up 1802 unused security descriptors.
CHKDSK is verifying Usn Journal...
Usn Journal verification completed.
CHKDSK is verifying file data (stage 4 of 5)...
File data verification completed.
CHKDSK is verifying free space (stage 5 of 5)...
Free space verification is complete.
CHKDSK discovered free space marked as allocated in the
master file table (MFT) bitmap.
Windows has made corrections to the file system.

72597703 KB total disk space.
34059336 KB in 100693 files.
38568 KB in 10893 indexes.
0 KB in bad sectors.
236755 KB in use by the system.
65536 KB occupied by the log file.
38263044 KB available on disk.

4096 bytes in each allocation unit.
18149425 total allocation units on disk.
9565761 allocation units available on disk.

Internal Info:
f0 fd 01 00 ed b3 01 00 d8 78 02 00 00 00 00 00 .........x......
c1 2b 00 00 02 00 00 00 c0 0b 00 00 00 00 00 00 .+..............
4c 95 5d 02 00 00 00 00 f6 8c 6c 24 00 00 00 00 L.].......l$....
72 7d b8 07 00 00 00 00 4a 3e d0 d6 02 00 00 00 r}......J>......
8c dc 95 b4 01 00 00 00 0c c3 31 c3 04 00 00 00 ..........1.....
99 9e 36 00 00 00 00 00 c0 3b 07 00 55 89 01 00 ..6......;..U...
00 00 00 00 00 20 d1 1e 08 00 00 00 8d 2a 00 00 ..... .......*..

I have no idea if this had anything to do with my problems, so I'm going to wait and see what happens.

 

[druben]

I've been having similar issues that I finally believe I've tracked down to the Windows Search Service. My machine had been blue screening once or twice a day, typically when I wasn't even using it. After rebulding the machine twice, once with XP SP3 and again with Windows 7 the problem still occurred, so I figured it was probably hardware related. Well, since then I've replaced the memory, hard drives, and video card and run numerous tests with almost every other device either switched out or removed and still get the blue screens. Recently I noticed some heavy disk activity and saw the Windows Search Service chugging away and also generating memory faults! I disabled that service and boom, no blue screen in 2 days now.

Best I can guess is that with XP SP3, the Windows Search Service requires a better CPU than my computer is running, which is a Pentium D dual core 2.8 Ghz. If the Windows Search Service delays access to a critical file for too long, the machine crashes. I've got upgrading the CPU on my list of things to do in the near future, so I'll reply back here once I've done that and tried re-enabling the Search Service.

 

[docbadwrench]

Back when my computer was first blue screening, I disabled Windows Search Service. For a few days, things seemed to be going fine. But then, the BSOD's resumed and I went on a month-long journey of constant irritation. Since then, I have now learned that my PC is generating more heat than it likes to.

I put out a whole bunch of threads, but will have to post a final follow-up so that more people can benefit from whatever the heck can be learned from this thread. Druben, I'm not sure that Windows Search Service requires a better CPU (with one caveat). I don't even have a dual core system, I'm running a pretty old hardware configuration.

The caveat I mentioned above, though, is this. Technical documentation seems to lack any reasonable way of assessing what the temperature-load of a system is. For instance: My video card is reasonably new (within the last year and a half), but my CPU is more like 3 years old. Right now, I only get intermittent blue screens when my wife plays Plants vs. Zombies (for god knows what reason).

While my card is pretty new, the fact is that my blue screen instances went way down after I took a compressed-air can to it and created a wind tunnel from the front to and through the back. My next step is to buy a card-fan to attempt to draw excess heat from the videocard and hopefully drop the temp a few more degrees.

Obviously, the one piece of advice you get from everyone is "swap every damned thing out of your PC and see when it stops failing". Of course, not all of us have an exact replacement part hanging around for this (my situation).

This is kind of rambling (apologies), but let me leave you with this observation, which I did not find enough of - or fully appreciate - until this happened. As our hardware ages, it gets less reliable. We all know that. But it hadn't really sunk in that - in addition to that lowered performance, it also has a lower tolerance to heat that may never have seemed to bother it just a year ago.

After what feels like an eternity, I have finally learned that lesson. I hope it's useful to you Druben, or to any other person frantically googling and searching for answers to an interminable series of blue screens that crush the soul.

 

[druben]

Well, not sure what the specific fix was, but I've upgraded the processor and power supply on my machine and was able to turn Windows Search Service back on. Hasn't crashed in over a week now.