Sign in with
Sign up | Sign in
Your question

How to troubleshoot Stop Code 0x00000044 - MULTIPL_IRP_COM..

Last response: in Windows XP
Share
July 12, 2005 2:04:00 AM

Archived from groups: microsoft.public.windowsxp.help_and_support (More info?)

Not sure how to troubleshoot this error. It appears to be a driver
conflict from reading MS Knowledgebase but can't get any sense out of
the minidump created:

---- 32 bit Kernel Mini Dump Analysis

DUMP_HEADER32:
MajorVersion 0000000f
MinorVersion 00000a28
DirectoryTableBase 11768000
PfnDataBase 81053000
PsLoadedModuleList 8054c850
PsActiveProcessHead 8054e8b8
MachineImageType 0000014c
NumberProcessors 00000001
BugCheckCode 00000044
BugCheckParameter1 85ca2c91
BugCheckParameter2 00000d61
BugCheckParameter3 00000000
BugCheckParameter4 00000000
PaeEnabled 00000000
KdDebuggerDataBlock 8053e7e0
MiniDumpFields 00000dff

TRIAGE_DUMP32:
ServicePackBuild 00000100
SizeOfDump 00010000
ValidOffset 0000fffc
ContextOffset 00000320
ExceptionOffset 000007d0
MmOffset 00001068
UnloadedDriversOffset 000010a0
PrcbOffset 00001878
ProcessOffset 000024c8
ThreadOffset 00002720
CallStackOffset 00002978
SizeOfCallStack 00000fd0
DriverListOffset 00003bd8
DriverCount 00000082
StringPoolOffset 00006270
StringPoolSize 00001208
BrokenDriverOffset 00000000
TriageOptions 00000041
TopOfStack b88fa030
DebuggerDataOffset 00003948
DebuggerDataSize 00000290
DataBlocksOffset 00007478
DataBlocksCount 00000003


Windows XP Kernel Version 2600 (Service Pack 1) UP Free x86 compatible
Kernel base = 0x804d4000 PsLoadedModuleList = 0x8054c850
Debug session time: Mon Jul 11 17:53:59 2005
System Uptime: 0 days 0:00:24
start end module name
804d4000 806c6400 nt Checksum: 001FF5C4 Timestamp: Wed
Mar 02 01:33:24 2005 (422517E4)

Unloaded modules:
f7b2f000 f7b34000 Cdaudio.SYS Timestamp: unavailable (00000000)
f7d1f000 f7d22000 Sfloppy.SYS Timestamp: unavailable (00000000)

Finished dump check


The actual error from the Eventviewer is:

Error code 00000044, parameter1 85ca2c91, parameter2 00000d61,
parameter3 00000000, parameter4 00000000.

How do I go about tracing the problem driver? I have recently
reinstalled XP Pro, done all the windows updates but have not yet
installed SP2, I'm not convinced I need it.

Have installed Catalyst 5.5 for my ATI card as 5.6 caused problems
playing WMV files, DirectX 9.0c and Norton Syetmworks 2005, which is
the application that always gets corrupted when I reboot after the
0x00000044 stop code forcing me to reinstall Norton Antivirus each
time!

I've not experienced this problem previously with my system and the
same software installed.

Any advice please?
Anonymous
July 12, 2005 2:04:01 AM

Archived from groups: microsoft.public.windowsxp.help_and_support (More info?)

Sounds like a driver to me - typical issues are bad hardware, bad drivers,
incompatible hardware. First, ensure that the Catalyst drivers that you're
using are WHQL certified - this'll eliminate one of the problem causes.
Next, update your audio drivers - I say this because an audio file is
mentioned in the dump rep, and I'm seeing more and more errors due to audio
drivers than I ever have before. Once again, use WHQL certified drivers if
available.

If that doesn't work, try this KB article:
http://support.microsoft.com/kb/q244617/

It's quite a read, but it'll help to identify problem drivers.

"Danny" wrote:

> Not sure how to troubleshoot this error. It appears to be a driver
> conflict from reading MS Knowledgebase but can't get any sense out of
> the minidump created:
>
> ---- 32 bit Kernel Mini Dump Analysis
>
> DUMP_HEADER32:
> MajorVersion 0000000f
> MinorVersion 00000a28
> DirectoryTableBase 11768000
> PfnDataBase 81053000
> PsLoadedModuleList 8054c850
> PsActiveProcessHead 8054e8b8
> MachineImageType 0000014c
> NumberProcessors 00000001
> BugCheckCode 00000044
> BugCheckParameter1 85ca2c91
> BugCheckParameter2 00000d61
> BugCheckParameter3 00000000
> BugCheckParameter4 00000000
> PaeEnabled 00000000
> KdDebuggerDataBlock 8053e7e0
> MiniDumpFields 00000dff
>
> TRIAGE_DUMP32:
> ServicePackBuild 00000100
> SizeOfDump 00010000
> ValidOffset 0000fffc
> ContextOffset 00000320
> ExceptionOffset 000007d0
> MmOffset 00001068
> UnloadedDriversOffset 000010a0
> PrcbOffset 00001878
> ProcessOffset 000024c8
> ThreadOffset 00002720
> CallStackOffset 00002978
> SizeOfCallStack 00000fd0
> DriverListOffset 00003bd8
> DriverCount 00000082
> StringPoolOffset 00006270
> StringPoolSize 00001208
> BrokenDriverOffset 00000000
> TriageOptions 00000041
> TopOfStack b88fa030
> DebuggerDataOffset 00003948
> DebuggerDataSize 00000290
> DataBlocksOffset 00007478
> DataBlocksCount 00000003
>
>
> Windows XP Kernel Version 2600 (Service Pack 1) UP Free x86 compatible
> Kernel base = 0x804d4000 PsLoadedModuleList = 0x8054c850
> Debug session time: Mon Jul 11 17:53:59 2005
> System Uptime: 0 days 0:00:24
> start end module name
> 804d4000 806c6400 nt Checksum: 001FF5C4 Timestamp: Wed
> Mar 02 01:33:24 2005 (422517E4)
>
> Unloaded modules:
> f7b2f000 f7b34000 Cdaudio.SYS Timestamp: unavailable (00000000)
> f7d1f000 f7d22000 Sfloppy.SYS Timestamp: unavailable (00000000)
>
> Finished dump check
>
>
> The actual error from the Eventviewer is:
>
> Error code 00000044, parameter1 85ca2c91, parameter2 00000d61,
> parameter3 00000000, parameter4 00000000.
>
> How do I go about tracing the problem driver? I have recently
> reinstalled XP Pro, done all the windows updates but have not yet
> installed SP2, I'm not convinced I need it.
>
> Have installed Catalyst 5.5 for my ATI card as 5.6 caused problems
> playing WMV files, DirectX 9.0c and Norton Syetmworks 2005, which is
> the application that always gets corrupted when I reboot after the
> 0x00000044 stop code forcing me to reinstall Norton Antivirus each
> time!
>
> I've not experienced this problem previously with my system and the
> same software installed.
>
> Any advice please?
>
July 13, 2005 2:57:01 AM

Archived from groups: microsoft.public.windowsxp.help_and_support (More info?)

Thanks for the info, when (not if) it BSOD's again I'll try the info
suggested!

BTW, Catalyst drivers are always WHQL certified so I doubt it could be
that as these have been installed before with no problem.

I've always used the standard windows audio drivers with my SB Live
5.1 card too, and never had this problem with them!

The only other thing I can think of is my Hot Rod 100 PCI Raid
Controller card I've had for a while, when I reinstalled windows I
couldn't rmember which driver I used so found one in a 'drivers'
folder I made to keep all my drivers for my hardware, this wasn't WHQL
though, so after the BSOD I installed the Windows driver for it but it
still gave the same BSOD message!

Will have to sit and wait for it to BSOD again now!

On Mon, 11 Jul 2005 15:49:03 -0700, usasma
<usasma@discussions.microsoft.com> wrote:

>Sounds like a driver to me - typical issues are bad hardware, bad drivers,
>incompatible hardware. First, ensure that the Catalyst drivers that you're
>using are WHQL certified - this'll eliminate one of the problem causes.
>Next, update your audio drivers - I say this because an audio file is
>mentioned in the dump rep, and I'm seeing more and more errors due to audio
>drivers than I ever have before. Once again, use WHQL certified drivers if
>available.
>
>If that doesn't work, try this KB article:
>http://support.microsoft.com/kb/q244617/
>
>It's quite a read, but it'll help to identify problem drivers.
>
>"Danny" wrote:
>
>> Not sure how to troubleshoot this error. It appears to be a driver
>> conflict from reading MS Knowledgebase but can't get any sense out of
>> the minidump created:
>>
>> ---- 32 bit Kernel Mini Dump Analysis
>>
>> DUMP_HEADER32:
>> MajorVersion 0000000f
>> MinorVersion 00000a28
>> DirectoryTableBase 11768000
>> PfnDataBase 81053000
>> PsLoadedModuleList 8054c850
>> PsActiveProcessHead 8054e8b8
>> MachineImageType 0000014c
>> NumberProcessors 00000001
>> BugCheckCode 00000044
>> BugCheckParameter1 85ca2c91
>> BugCheckParameter2 00000d61
>> BugCheckParameter3 00000000
>> BugCheckParameter4 00000000
>> PaeEnabled 00000000
>> KdDebuggerDataBlock 8053e7e0
>> MiniDumpFields 00000dff
>>
>> TRIAGE_DUMP32:
>> ServicePackBuild 00000100
>> SizeOfDump 00010000
>> ValidOffset 0000fffc
>> ContextOffset 00000320
>> ExceptionOffset 000007d0
>> MmOffset 00001068
>> UnloadedDriversOffset 000010a0
>> PrcbOffset 00001878
>> ProcessOffset 000024c8
>> ThreadOffset 00002720
>> CallStackOffset 00002978
>> SizeOfCallStack 00000fd0
>> DriverListOffset 00003bd8
>> DriverCount 00000082
>> StringPoolOffset 00006270
>> StringPoolSize 00001208
>> BrokenDriverOffset 00000000
>> TriageOptions 00000041
>> TopOfStack b88fa030
>> DebuggerDataOffset 00003948
>> DebuggerDataSize 00000290
>> DataBlocksOffset 00007478
>> DataBlocksCount 00000003
>>
>>
>> Windows XP Kernel Version 2600 (Service Pack 1) UP Free x86 compatible
>> Kernel base = 0x804d4000 PsLoadedModuleList = 0x8054c850
>> Debug session time: Mon Jul 11 17:53:59 2005
>> System Uptime: 0 days 0:00:24
>> start end module name
>> 804d4000 806c6400 nt Checksum: 001FF5C4 Timestamp: Wed
>> Mar 02 01:33:24 2005 (422517E4)
>>
>> Unloaded modules:
>> f7b2f000 f7b34000 Cdaudio.SYS Timestamp: unavailable (00000000)
>> f7d1f000 f7d22000 Sfloppy.SYS Timestamp: unavailable (00000000)
>>
>> Finished dump check
>>
>>
>> The actual error from the Eventviewer is:
>>
>> Error code 00000044, parameter1 85ca2c91, parameter2 00000d61,
>> parameter3 00000000, parameter4 00000000.
>>
>> How do I go about tracing the problem driver? I have recently
>> reinstalled XP Pro, done all the windows updates but have not yet
>> installed SP2, I'm not convinced I need it.
>>
>> Have installed Catalyst 5.5 for my ATI card as 5.6 caused problems
>> playing WMV files, DirectX 9.0c and Norton Syetmworks 2005, which is
>> the application that always gets corrupted when I reboot after the
>> 0x00000044 stop code forcing me to reinstall Norton Antivirus each
>> time!
>>
>> I've not experienced this problem previously with my system and the
>> same software installed.
>>
>> Any advice please?
>>
July 21, 2005 6:09:06 PM

Archived from groups: microsoft.public.windowsxp.help_and_support (More info?)

Well it's BSOD'ed 3 times when booting today now so installed the
Windows Debugger, installed the Symbols and followed the advice given
and this is what I get:-

Microsoft (R) Windows Debugger Version 6.5.0003.7
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\WINDOWS\Minidump\Mini072105-03.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: C:\WINDOWS\Symbols
Executable search path is:
Windows XP Kernel Version 2600 (Service Pack 1) UP Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 2600.xpsp2.050301-1526
Kernel base = 0x804d4000 PsLoadedModuleList = 0x8054c850
Debug session time: Thu Jul 21 13:27:58.265 2005 (GMT+1)
System Uptime: 0 days 0:00:24.843
Loading Kernel Symbols
............................................................................................................................
Loading unloaded module list
...
Loading User Symbols
*******************************************************************************
*
*
* Bugcheck Analysis
*
*
*
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 44, {859b1ce1, d61, 0, 0}

*** WARNING: Unable to verify timestamp for hptpro.sys
*** ERROR: Module load completed but symbols could not be loaded for
hptpro.sys
Probably caused by : Fs_Rec.SYS ( Fs_Rec!UdfsRecFsControl+63 )

Followup: MachineOwner
---------

kd> !analyze -v
*******************************************************************************
*
*
* Bugcheck Analysis
*
*
*
*******************************************************************************

MULTIPLE_IRP_COMPLETE_REQUESTS (44)
A driver has requested that an IRP be completed (IoCompleteRequest()),
but
the packet has already been completed. This is a tough bug to find
because
the easiest case, a driver actually attempted to complete its own
packet
twice, is generally not what happened. Rather, two separate drivers
each
believe that they own the packet, and each attempts to complete it.
The
first actually works, and the second fails. Tracking down which
drivers
in the system actually did this is difficult, generally because the
trails
of the first driver have been covered by the second. However, the
driver
stack for the current request can be found by examining the
DeviceObject
fields in each of the stack locations.
Arguments:
Arg1: 859b1ce1, Address of the IRP
Arg2: 00000d61
Arg3: 00000000
Arg4: 00000000

Debugging Details:
------------------


IRP_ADDRESS: 859b1ce1

CUSTOMER_CRASH_COUNT: 3

DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: 0x44

LAST_CONTROL_TRANSFER: from 805179bf to 8052b591

STACK_TEXT:
b892a048 805179bf 00000044 859b1ce1 00000d61 nt!KeBugCheckEx+0x19
b892a080 f7d4bc57 8608c8f0 f7c439b8 b892a0c8
nt!IopfCompleteRequest+0x2c4
b892a090 f7d4b59e 8608c8f0 859b1ce0 8608cda0
Fs_Rec!UdfsRecFsControl+0x63
b892a0a0 804dfdfd 8608c8f0 859b1ce0 859b1ce0
Fs_Rec!FsRecFsControl+0x5a
b892a0b0 f7c43bbf 85872980 8672d280 8606b820 nt!IopfCallDriver+0x31
WARNING: Stack unwind information not available. Following frames may
be wrong.
b892a0c8 804dfdfd 00000000 85844528 859b1ce0 hptpro+0xbbf
b892a0d8 8058c584 8606b820 806c9158 b892a220 nt!IopfCallDriver+0x31
b892a128 80505ac6 86068150 b892a200 00000000 nt!IopMountVolume+0x1d1
b892a158 8055aa4a b892a420 8606b820 b892a290
nt!IopCheckVpbMounted+0x59
b892a24c 8055253a 8606b820 00000000 858653f0 nt!IopParseDevice+0x3ba
b892a2d0 805557a2 00000000 b892a310 00000040
nt!ObpLookupObjectName+0x56a
b892a324 8055be9a 00000000 00000000 ffffff01
nt!ObOpenObjectByName+0xe9
b892a4a4 804dad01 00bbef6c 00bbef44 b892a4d8
nt!NtQueryAttributesFile+0xe9
b892a4a4 7ffe0304 00bbef6c 00bbef44 b892a4d8 nt!KiSystemService+0xc4
00bbef98 00000000 00000000 00000000 00000000
SharedUserData!SystemCallStub+0x4


FOLLOWUP_IP:
Fs_Rec!UdfsRecFsControl+63
f7d4bc57 8bc6 mov eax,esi

SYMBOL_STACK_INDEX: 2

FOLLOWUP_NAME: MachineOwner

SYMBOL_NAME: Fs_Rec!UdfsRecFsControl+63

MODULE_NAME: Fs_Rec

IMAGE_NAME: Fs_Rec.SYS

DEBUG_FLR_IMAGE_TIMESTAMP: 3b7d8361

STACK_COMMAND: kb

FAILURE_BUCKET_ID: 0x44_Fs_Rec!UdfsRecFsControl+63

BUCKET_ID: 0x44_Fs_Rec!UdfsRecFsControl+63

Followup: MachineOwner

-----------------------------------------------------------------------------

So, it looks like 2 files:

Fs_Rec.sys from loading the 64k Memory Dump

and

hptpro.sys (Filter Driver if that helps anyone?) using !analyze -v

I checked Fs_Rec.sys by doing a file compare on the installed one and
the one extracted from the fs_rec.sy_ file on my Windows CD, they were
identical, so it's not corrupted and so I think it can't directly be
the problem.

So, seeing as the Hot Rod Driver is the latest one I did a BIOS update
on the controller too and moved it to another PCI slot, but that has
made no difference either.

Going to Highpoints site lists the same driver version as the one I
already have from A-Bits site who made the controller (Neither are
WHQL certified) so there is no 'new' driver available other than the
one I have already (and am sure I've used) previously.

So does anyone more knowledgeable in Windows Debugging shed any light
on a course of action please?

Thanks,

Dan.

On Tue, 12 Jul 2005 22:57:01 GMT, Danny <f@tchance.com> wrote:

>Thanks for the info, when (not if) it BSOD's again I'll try the info
>suggested!
>
>BTW, Catalyst drivers are always WHQL certified so I doubt it could be
>that as these have been installed before with no problem.
>
>I've always used the standard windows audio drivers with my SB Live
>5.1 card too, and never had this problem with them!
>
>The only other thing I can think of is my Hot Rod 100 PCI Raid
>Controller card I've had for a while, when I reinstalled windows I
>couldn't rmember which driver I used so found one in a 'drivers'
>folder I made to keep all my drivers for my hardware, this wasn't WHQL
>though, so after the BSOD I installed the Windows driver for it but it
>still gave the same BSOD message!
>
>Will have to sit and wait for it to BSOD again now!
>
>On Mon, 11 Jul 2005 15:49:03 -0700, usasma
><usasma@discussions.microsoft.com> wrote:
>
>>Sounds like a driver to me - typical issues are bad hardware, bad drivers,
>>incompatible hardware. First, ensure that the Catalyst drivers that you're
>>using are WHQL certified - this'll eliminate one of the problem causes.
>>Next, update your audio drivers - I say this because an audio file is
>>mentioned in the dump rep, and I'm seeing more and more errors due to audio
>>drivers than I ever have before. Once again, use WHQL certified drivers if
>>available.
>>
>>If that doesn't work, try this KB article:
>>http://support.microsoft.com/kb/q244617/
>>
>>It's quite a read, but it'll help to identify problem drivers.
>>
>>"Danny" wrote:
>>
>>> Not sure how to troubleshoot this error. It appears to be a driver
>>> conflict from reading MS Knowledgebase but can't get any sense out of
>>> the minidump created:
>>>
>>> ---- 32 bit Kernel Mini Dump Analysis
>>>
>>> DUMP_HEADER32:
>>> MajorVersion 0000000f
>>> MinorVersion 00000a28
>>> DirectoryTableBase 11768000
>>> PfnDataBase 81053000
>>> PsLoadedModuleList 8054c850
>>> PsActiveProcessHead 8054e8b8
>>> MachineImageType 0000014c
>>> NumberProcessors 00000001
>>> BugCheckCode 00000044
>>> BugCheckParameter1 85ca2c91
>>> BugCheckParameter2 00000d61
>>> BugCheckParameter3 00000000
>>> BugCheckParameter4 00000000
>>> PaeEnabled 00000000
>>> KdDebuggerDataBlock 8053e7e0
>>> MiniDumpFields 00000dff
>>>
>>> TRIAGE_DUMP32:
>>> ServicePackBuild 00000100
>>> SizeOfDump 00010000
>>> ValidOffset 0000fffc
>>> ContextOffset 00000320
>>> ExceptionOffset 000007d0
>>> MmOffset 00001068
>>> UnloadedDriversOffset 000010a0
>>> PrcbOffset 00001878
>>> ProcessOffset 000024c8
>>> ThreadOffset 00002720
>>> CallStackOffset 00002978
>>> SizeOfCallStack 00000fd0
>>> DriverListOffset 00003bd8
>>> DriverCount 00000082
>>> StringPoolOffset 00006270
>>> StringPoolSize 00001208
>>> BrokenDriverOffset 00000000
>>> TriageOptions 00000041
>>> TopOfStack b88fa030
>>> DebuggerDataOffset 00003948
>>> DebuggerDataSize 00000290
>>> DataBlocksOffset 00007478
>>> DataBlocksCount 00000003
>>>
>>>
>>> Windows XP Kernel Version 2600 (Service Pack 1) UP Free x86 compatible
>>> Kernel base = 0x804d4000 PsLoadedModuleList = 0x8054c850
>>> Debug session time: Mon Jul 11 17:53:59 2005
>>> System Uptime: 0 days 0:00:24
>>> start end module name
>>> 804d4000 806c6400 nt Checksum: 001FF5C4 Timestamp: Wed
>>> Mar 02 01:33:24 2005 (422517E4)
>>>
>>> Unloaded modules:
>>> f7b2f000 f7b34000 Cdaudio.SYS Timestamp: unavailable (00000000)
>>> f7d1f000 f7d22000 Sfloppy.SYS Timestamp: unavailable (00000000)
>>>
>>> Finished dump check
>>>
>>>
>>> The actual error from the Eventviewer is:
>>>
>>> Error code 00000044, parameter1 85ca2c91, parameter2 00000d61,
>>> parameter3 00000000, parameter4 00000000.
>>>
>>> How do I go about tracing the problem driver? I have recently
>>> reinstalled XP Pro, done all the windows updates but have not yet
>>> installed SP2, I'm not convinced I need it.
>>>
>>> Have installed Catalyst 5.5 for my ATI card as 5.6 caused problems
>>> playing WMV files, DirectX 9.0c and Norton Syetmworks 2005, which is
>>> the application that always gets corrupted when I reboot after the
>>> 0x00000044 stop code forcing me to reinstall Norton Antivirus each
>>> time!
>>>
>>> I've not experienced this problem previously with my system and the
>>> same software installed.
>>>
>>> Any advice please?
>>>
July 23, 2005 1:51:10 AM

Archived from groups: microsoft.public.windowsxp.help_and_support (More info?)

I *THINK* I know what's causing the stop code 0x00000044!

I reinstalled windows xp from scratch and put my system back to
something like normal. Applied SP1 and all Windows Critical Updates,
flashed original BIOS back into my HotRod Controller and used the
original driver. Then I installed (as normal) Norton Systemworks 2005
and did a Liveupdate and after rebooting I got the dreaded BSOD again!

So I used the Norton Removal Tool to uninstall 2005 and I rebooted
windows at least 10 times one after the other, no BSOD at all! Then I
reinstalled my older 2004 version, and after doing a liveupdate and
rebooting I got a BSOD! So it appears to be something that gets
installed AFTER doing a Liveupdate that has caused all the trauma, but
I can't figure our what or why!

So for now I'm manually downloading the Virus Defs and installing them
rather than doing a liveupdate which downloads and applies various
software updates as I believe one of those is responsible as I've
rebooted windows about 4 or 5 times now without a problem.

So until I do a Norton Liveupdate my system is fine! Next task is
figuring out what component of liveupdate is causing the problem!

I think it's going to be a long night/day!

On Thu, 21 Jul 2005 14:09:06 GMT, Danny <f@tchance.com> wrote:

>Well it's BSOD'ed 3 times when booting today now so installed the
>Windows Debugger, installed the Symbols and followed the advice given
>and this is what I get:-
>
>Microsoft (R) Windows Debugger Version 6.5.0003.7
>Copyright (c) Microsoft Corporation. All rights reserved.
>
>
>Loading Dump File [C:\WINDOWS\Minidump\Mini072105-03.dmp]
>Mini Kernel Dump File: Only registers and stack trace are available
>
>Symbol search path is: C:\WINDOWS\Symbols
>Executable search path is:
>Windows XP Kernel Version 2600 (Service Pack 1) UP Free x86 compatible
>Product: WinNt, suite: TerminalServer SingleUserTS
>Built by: 2600.xpsp2.050301-1526
>Kernel base = 0x804d4000 PsLoadedModuleList = 0x8054c850
>Debug session time: Thu Jul 21 13:27:58.265 2005 (GMT+1)
>System Uptime: 0 days 0:00:24.843
>Loading Kernel Symbols
>...........................................................................................................................
>Loading unloaded module list
>..
>Loading User Symbols
>*******************************************************************************
>*
>*
>* Bugcheck Analysis
>*
>*
>*
>*******************************************************************************
>
>Use !analyze -v to get detailed debugging information.
>
>BugCheck 44, {859b1ce1, d61, 0, 0}
>
>*** WARNING: Unable to verify timestamp for hptpro.sys
>*** ERROR: Module load completed but symbols could not be loaded for
>hptpro.sys
>Probably caused by : Fs_Rec.SYS ( Fs_Rec!UdfsRecFsControl+63 )
>
>Followup: MachineOwner
>---------
>
>kd> !analyze -v
>*******************************************************************************
>*
>*
>* Bugcheck Analysis
>*
>*
>*
>*******************************************************************************
>
>MULTIPLE_IRP_COMPLETE_REQUESTS (44)
>A driver has requested that an IRP be completed (IoCompleteRequest()),
>but
>the packet has already been completed. This is a tough bug to find
>because
>the easiest case, a driver actually attempted to complete its own
>packet
>twice, is generally not what happened. Rather, two separate drivers
>each
>believe that they own the packet, and each attempts to complete it.
>The
>first actually works, and the second fails. Tracking down which
>drivers
>in the system actually did this is difficult, generally because the
>trails
>of the first driver have been covered by the second. However, the
>driver
>stack for the current request can be found by examining the
>DeviceObject
>fields in each of the stack locations.
>Arguments:
>Arg1: 859b1ce1, Address of the IRP
>Arg2: 00000d61
>Arg3: 00000000
>Arg4: 00000000
>
>Debugging Details:
>------------------
>
>
>IRP_ADDRESS: 859b1ce1
>
>CUSTOMER_CRASH_COUNT: 3
>
>DEFAULT_BUCKET_ID: DRIVER_FAULT
>
>BUGCHECK_STR: 0x44
>
>LAST_CONTROL_TRANSFER: from 805179bf to 8052b591
>
>STACK_TEXT:
>b892a048 805179bf 00000044 859b1ce1 00000d61 nt!KeBugCheckEx+0x19
>b892a080 f7d4bc57 8608c8f0 f7c439b8 b892a0c8
>nt!IopfCompleteRequest+0x2c4
>b892a090 f7d4b59e 8608c8f0 859b1ce0 8608cda0
>Fs_Rec!UdfsRecFsControl+0x63
>b892a0a0 804dfdfd 8608c8f0 859b1ce0 859b1ce0
>Fs_Rec!FsRecFsControl+0x5a
>b892a0b0 f7c43bbf 85872980 8672d280 8606b820 nt!IopfCallDriver+0x31
>WARNING: Stack unwind information not available. Following frames may
>be wrong.
>b892a0c8 804dfdfd 00000000 85844528 859b1ce0 hptpro+0xbbf
>b892a0d8 8058c584 8606b820 806c9158 b892a220 nt!IopfCallDriver+0x31
>b892a128 80505ac6 86068150 b892a200 00000000 nt!IopMountVolume+0x1d1
>b892a158 8055aa4a b892a420 8606b820 b892a290
>nt!IopCheckVpbMounted+0x59
>b892a24c 8055253a 8606b820 00000000 858653f0 nt!IopParseDevice+0x3ba
>b892a2d0 805557a2 00000000 b892a310 00000040
>nt!ObpLookupObjectName+0x56a
>b892a324 8055be9a 00000000 00000000 ffffff01
>nt!ObOpenObjectByName+0xe9
>b892a4a4 804dad01 00bbef6c 00bbef44 b892a4d8
>nt!NtQueryAttributesFile+0xe9
>b892a4a4 7ffe0304 00bbef6c 00bbef44 b892a4d8 nt!KiSystemService+0xc4
>00bbef98 00000000 00000000 00000000 00000000
>SharedUserData!SystemCallStub+0x4
>
>
>FOLLOWUP_IP:
>Fs_Rec!UdfsRecFsControl+63
>f7d4bc57 8bc6 mov eax,esi
>
>SYMBOL_STACK_INDEX: 2
>
>FOLLOWUP_NAME: MachineOwner
>
>SYMBOL_NAME: Fs_Rec!UdfsRecFsControl+63
>
>MODULE_NAME: Fs_Rec
>
>IMAGE_NAME: Fs_Rec.SYS
>
>DEBUG_FLR_IMAGE_TIMESTAMP: 3b7d8361
>
>STACK_COMMAND: kb
>
>FAILURE_BUCKET_ID: 0x44_Fs_Rec!UdfsRecFsControl+63
>
>BUCKET_ID: 0x44_Fs_Rec!UdfsRecFsControl+63
>
>Followup: MachineOwner
>
>-----------------------------------------------------------------------------
>
>So, it looks like 2 files:
>
>Fs_Rec.sys from loading the 64k Memory Dump
>
>and
>
>hptpro.sys (Filter Driver if that helps anyone?) using !analyze -v
>
>I checked Fs_Rec.sys by doing a file compare on the installed one and
>the one extracted from the fs_rec.sy_ file on my Windows CD, they were
>identical, so it's not corrupted and so I think it can't directly be
>the problem.
>
>So, seeing as the Hot Rod Driver is the latest one I did a BIOS update
>on the controller too and moved it to another PCI slot, but that has
>made no difference either.
>
>Going to Highpoints site lists the same driver version as the one I
>already have from A-Bits site who made the controller (Neither are
>WHQL certified) so there is no 'new' driver available other than the
>one I have already (and am sure I've used) previously.
>
>So does anyone more knowledgeable in Windows Debugging shed any light
>on a course of action please?
>
>Thanks,
>
>Dan.
>
>On Tue, 12 Jul 2005 22:57:01 GMT, Danny <f@tchance.com> wrote:
>
>>Thanks for the info, when (not if) it BSOD's again I'll try the info
>>suggested!
>>
>>BTW, Catalyst drivers are always WHQL certified so I doubt it could be
>>that as these have been installed before with no problem.
>>
>>I've always used the standard windows audio drivers with my SB Live
>>5.1 card too, and never had this problem with them!
>>
>>The only other thing I can think of is my Hot Rod 100 PCI Raid
>>Controller card I've had for a while, when I reinstalled windows I
>>couldn't rmember which driver I used so found one in a 'drivers'
>>folder I made to keep all my drivers for my hardware, this wasn't WHQL
>>though, so after the BSOD I installed the Windows driver for it but it
>>still gave the same BSOD message!
>>
>>Will have to sit and wait for it to BSOD again now!
>>
>>On Mon, 11 Jul 2005 15:49:03 -0700, usasma
>><usasma@discussions.microsoft.com> wrote:
>>
>>>Sounds like a driver to me - typical issues are bad hardware, bad drivers,
>>>incompatible hardware. First, ensure that the Catalyst drivers that you're
>>>using are WHQL certified - this'll eliminate one of the problem causes.
>>>Next, update your audio drivers - I say this because an audio file is
>>>mentioned in the dump rep, and I'm seeing more and more errors due to audio
>>>drivers than I ever have before. Once again, use WHQL certified drivers if
>>>available.
>>>
>>>If that doesn't work, try this KB article:
>>>http://support.microsoft.com/kb/q244617/
>>>
>>>It's quite a read, but it'll help to identify problem drivers.
>>>
>>>"Danny" wrote:
>>>
>>>> Not sure how to troubleshoot this error. It appears to be a driver
>>>> conflict from reading MS Knowledgebase but can't get any sense out of
>>>> the minidump created:
>>>>
>>>> ---- 32 bit Kernel Mini Dump Analysis
>>>>
>>>> DUMP_HEADER32:
>>>> MajorVersion 0000000f
>>>> MinorVersion 00000a28
>>>> DirectoryTableBase 11768000
>>>> PfnDataBase 81053000
>>>> PsLoadedModuleList 8054c850
>>>> PsActiveProcessHead 8054e8b8
>>>> MachineImageType 0000014c
>>>> NumberProcessors 00000001
>>>> BugCheckCode 00000044
>>>> BugCheckParameter1 85ca2c91
>>>> BugCheckParameter2 00000d61
>>>> BugCheckParameter3 00000000
>>>> BugCheckParameter4 00000000
>>>> PaeEnabled 00000000
>>>> KdDebuggerDataBlock 8053e7e0
>>>> MiniDumpFields 00000dff
>>>>
>>>> TRIAGE_DUMP32:
>>>> ServicePackBuild 00000100
>>>> SizeOfDump 00010000
>>>> ValidOffset 0000fffc
>>>> ContextOffset 00000320
>>>> ExceptionOffset 000007d0
>>>> MmOffset 00001068
>>>> UnloadedDriversOffset 000010a0
>>>> PrcbOffset 00001878
>>>> ProcessOffset 000024c8
>>>> ThreadOffset 00002720
>>>> CallStackOffset 00002978
>>>> SizeOfCallStack 00000fd0
>>>> DriverListOffset 00003bd8
>>>> DriverCount 00000082
>>>> StringPoolOffset 00006270
>>>> StringPoolSize 00001208
>>>> BrokenDriverOffset 00000000
>>>> TriageOptions 00000041
>>>> TopOfStack b88fa030
>>>> DebuggerDataOffset 00003948
>>>> DebuggerDataSize 00000290
>>>> DataBlocksOffset 00007478
>>>> DataBlocksCount 00000003
>>>>
>>>>
>>>> Windows XP Kernel Version 2600 (Service Pack 1) UP Free x86 compatible
>>>> Kernel base = 0x804d4000 PsLoadedModuleList = 0x8054c850
>>>> Debug session time: Mon Jul 11 17:53:59 2005
>>>> System Uptime: 0 days 0:00:24
>>>> start end module name
>>>> 804d4000 806c6400 nt Checksum: 001FF5C4 Timestamp: Wed
>>>> Mar 02 01:33:24 2005 (422517E4)
>>>>
>>>> Unloaded modules:
>>>> f7b2f000 f7b34000 Cdaudio.SYS Timestamp: unavailable (00000000)
>>>> f7d1f000 f7d22000 Sfloppy.SYS Timestamp: unavailable (00000000)
>>>>
>>>> Finished dump check
>>>>
>>>>
>>>> The actual error from the Eventviewer is:
>>>>
>>>> Error code 00000044, parameter1 85ca2c91, parameter2 00000d61,
>>>> parameter3 00000000, parameter4 00000000.
>>>>
>>>> How do I go about tracing the problem driver? I have recently
>>>> reinstalled XP Pro, done all the windows updates but have not yet
>>>> installed SP2, I'm not convinced I need it.
>>>>
>>>> Have installed Catalyst 5.5 for my ATI card as 5.6 caused problems
>>>> playing WMV files, DirectX 9.0c and Norton Syetmworks 2005, which is
>>>> the application that always gets corrupted when I reboot after the
>>>> 0x00000044 stop code forcing me to reinstall Norton Antivirus each
>>>> time!
>>>>
>>>> I've not experienced this problem previously with my system and the
>>>> same software installed.
>>>>
>>>> Any advice please?
>>>>
July 23, 2005 4:18:57 AM

Archived from groups: microsoft.public.windowsxp.help_and_support (More info?)

I'm sure I've found the problem, but not the solution!

Running Liveupdate in Interactive Mode I selected each update one by
one and found my machine gave the 0x00000044 error after installing
this component:

Symantec Common Driver: SymEvent

and rebooting windows?

Can't see anything on Symantecs site about my particlular stop code so
I'm just skipping this update when doing a liveupdate!

I deleted/reinstalled Norton and skipped this component and so far no
problems.

Now to find out why?

On Fri, 22 Jul 2005 21:51:10 GMT, Danny <f@tchance.com> wrote:

>I *THINK* I know what's causing the stop code 0x00000044!
>
>I reinstalled windows xp from scratch and put my system back to
>something like normal. Applied SP1 and all Windows Critical Updates,
>flashed original BIOS back into my HotRod Controller and used the
>original driver. Then I installed (as normal) Norton Systemworks 2005
>and did a Liveupdate and after rebooting I got the dreaded BSOD again!
>
>So I used the Norton Removal Tool to uninstall 2005 and I rebooted
>windows at least 10 times one after the other, no BSOD at all! Then I
>reinstalled my older 2004 version, and after doing a liveupdate and
>rebooting I got a BSOD! So it appears to be something that gets
>installed AFTER doing a Liveupdate that has caused all the trauma, but
>I can't figure our what or why!
>
>So for now I'm manually downloading the Virus Defs and installing them
>rather than doing a liveupdate which downloads and applies various
>software updates as I believe one of those is responsible as I've
>rebooted windows about 4 or 5 times now without a problem.
>
>So until I do a Norton Liveupdate my system is fine! Next task is
>figuring out what component of liveupdate is causing the problem!
>
>I think it's going to be a long night/day!
>
>On Thu, 21 Jul 2005 14:09:06 GMT, Danny <f@tchance.com> wrote:
>
>>Well it's BSOD'ed 3 times when booting today now so installed the
>>Windows Debugger, installed the Symbols and followed the advice given
>>and this is what I get:-
>>
>>Microsoft (R) Windows Debugger Version 6.5.0003.7
>>Copyright (c) Microsoft Corporation. All rights reserved.
>>
>>
>>Loading Dump File [C:\WINDOWS\Minidump\Mini072105-03.dmp]
>>Mini Kernel Dump File: Only registers and stack trace are available
>>
>>Symbol search path is: C:\WINDOWS\Symbols
>>Executable search path is:
>>Windows XP Kernel Version 2600 (Service Pack 1) UP Free x86 compatible
>>Product: WinNt, suite: TerminalServer SingleUserTS
>>Built by: 2600.xpsp2.050301-1526
>>Kernel base = 0x804d4000 PsLoadedModuleList = 0x8054c850
>>Debug session time: Thu Jul 21 13:27:58.265 2005 (GMT+1)
>>System Uptime: 0 days 0:00:24.843
>>Loading Kernel Symbols
>>...........................................................................................................................
>>Loading unloaded module list
>>..
>>Loading User Symbols
>>*******************************************************************************
>>*
>>*
>>* Bugcheck Analysis
>>*
>>*
>>*
>>*******************************************************************************
>>
>>Use !analyze -v to get detailed debugging information.
>>
>>BugCheck 44, {859b1ce1, d61, 0, 0}
>>
>>*** WARNING: Unable to verify timestamp for hptpro.sys
>>*** ERROR: Module load completed but symbols could not be loaded for
>>hptpro.sys
>>Probably caused by : Fs_Rec.SYS ( Fs_Rec!UdfsRecFsControl+63 )
>>
>>Followup: MachineOwner
>>---------
>>
>>kd> !analyze -v
>>*******************************************************************************
>>*
>>*
>>* Bugcheck Analysis
>>*
>>*
>>*
>>*******************************************************************************
>>
>>MULTIPLE_IRP_COMPLETE_REQUESTS (44)
>>A driver has requested that an IRP be completed (IoCompleteRequest()),
>>but
>>the packet has already been completed. This is a tough bug to find
>>because
>>the easiest case, a driver actually attempted to complete its own
>>packet
>>twice, is generally not what happened. Rather, two separate drivers
>>each
>>believe that they own the packet, and each attempts to complete it.
>>The
>>first actually works, and the second fails. Tracking down which
>>drivers
>>in the system actually did this is difficult, generally because the
>>trails
>>of the first driver have been covered by the second. However, the
>>driver
>>stack for the current request can be found by examining the
>>DeviceObject
>>fields in each of the stack locations.
>>Arguments:
>>Arg1: 859b1ce1, Address of the IRP
>>Arg2: 00000d61
>>Arg3: 00000000
>>Arg4: 00000000
>>
>>Debugging Details:
>>------------------
>>
>>
>>IRP_ADDRESS: 859b1ce1
>>
>>CUSTOMER_CRASH_COUNT: 3
>>
>>DEFAULT_BUCKET_ID: DRIVER_FAULT
>>
>>BUGCHECK_STR: 0x44
>>
>>LAST_CONTROL_TRANSFER: from 805179bf to 8052b591
>>
>>STACK_TEXT:
>>b892a048 805179bf 00000044 859b1ce1 00000d61 nt!KeBugCheckEx+0x19
>>b892a080 f7d4bc57 8608c8f0 f7c439b8 b892a0c8
>>nt!IopfCompleteRequest+0x2c4
>>b892a090 f7d4b59e 8608c8f0 859b1ce0 8608cda0
>>Fs_Rec!UdfsRecFsControl+0x63
>>b892a0a0 804dfdfd 8608c8f0 859b1ce0 859b1ce0
>>Fs_Rec!FsRecFsControl+0x5a
>>b892a0b0 f7c43bbf 85872980 8672d280 8606b820 nt!IopfCallDriver+0x31
>>WARNING: Stack unwind information not available. Following frames may
>>be wrong.
>>b892a0c8 804dfdfd 00000000 85844528 859b1ce0 hptpro+0xbbf
>>b892a0d8 8058c584 8606b820 806c9158 b892a220 nt!IopfCallDriver+0x31
>>b892a128 80505ac6 86068150 b892a200 00000000 nt!IopMountVolume+0x1d1
>>b892a158 8055aa4a b892a420 8606b820 b892a290
>>nt!IopCheckVpbMounted+0x59
>>b892a24c 8055253a 8606b820 00000000 858653f0 nt!IopParseDevice+0x3ba
>>b892a2d0 805557a2 00000000 b892a310 00000040
>>nt!ObpLookupObjectName+0x56a
>>b892a324 8055be9a 00000000 00000000 ffffff01
>>nt!ObOpenObjectByName+0xe9
>>b892a4a4 804dad01 00bbef6c 00bbef44 b892a4d8
>>nt!NtQueryAttributesFile+0xe9
>>b892a4a4 7ffe0304 00bbef6c 00bbef44 b892a4d8 nt!KiSystemService+0xc4
>>00bbef98 00000000 00000000 00000000 00000000
>>SharedUserData!SystemCallStub+0x4
>>
>>
>>FOLLOWUP_IP:
>>Fs_Rec!UdfsRecFsControl+63
>>f7d4bc57 8bc6 mov eax,esi
>>
>>SYMBOL_STACK_INDEX: 2
>>
>>FOLLOWUP_NAME: MachineOwner
>>
>>SYMBOL_NAME: Fs_Rec!UdfsRecFsControl+63
>>
>>MODULE_NAME: Fs_Rec
>>
>>IMAGE_NAME: Fs_Rec.SYS
>>
>>DEBUG_FLR_IMAGE_TIMESTAMP: 3b7d8361
>>
>>STACK_COMMAND: kb
>>
>>FAILURE_BUCKET_ID: 0x44_Fs_Rec!UdfsRecFsControl+63
>>
>>BUCKET_ID: 0x44_Fs_Rec!UdfsRecFsControl+63
>>
>>Followup: MachineOwner
>>
>>-----------------------------------------------------------------------------
>>
>>So, it looks like 2 files:
>>
>>Fs_Rec.sys from loading the 64k Memory Dump
>>
>>and
>>
>>hptpro.sys (Filter Driver if that helps anyone?) using !analyze -v
>>
>>I checked Fs_Rec.sys by doing a file compare on the installed one and
>>the one extracted from the fs_rec.sy_ file on my Windows CD, they were
>>identical, so it's not corrupted and so I think it can't directly be
>>the problem.
>>
>>So, seeing as the Hot Rod Driver is the latest one I did a BIOS update
>>on the controller too and moved it to another PCI slot, but that has
>>made no difference either.
>>
>>Going to Highpoints site lists the same driver version as the one I
>>already have from A-Bits site who made the controller (Neither are
>>WHQL certified) so there is no 'new' driver available other than the
>>one I have already (and am sure I've used) previously.
>>
>>So does anyone more knowledgeable in Windows Debugging shed any light
>>on a course of action please?
>>
>>Thanks,
>>
>>Dan.
>>
>>On Tue, 12 Jul 2005 22:57:01 GMT, Danny <f@tchance.com> wrote:
>>
>>>Thanks for the info, when (not if) it BSOD's again I'll try the info
>>>suggested!
>>>
>>>BTW, Catalyst drivers are always WHQL certified so I doubt it could be
>>>that as these have been installed before with no problem.
>>>
>>>I've always used the standard windows audio drivers with my SB Live
>>>5.1 card too, and never had this problem with them!
>>>
>>>The only other thing I can think of is my Hot Rod 100 PCI Raid
>>>Controller card I've had for a while, when I reinstalled windows I
>>>couldn't rmember which driver I used so found one in a 'drivers'
>>>folder I made to keep all my drivers for my hardware, this wasn't WHQL
>>>though, so after the BSOD I installed the Windows driver for it but it
>>>still gave the same BSOD message!
>>>
>>>Will have to sit and wait for it to BSOD again now!
>>>
>>>On Mon, 11 Jul 2005 15:49:03 -0700, usasma
>>><usasma@discussions.microsoft.com> wrote:
>>>
>>>>Sounds like a driver to me - typical issues are bad hardware, bad drivers,
>>>>incompatible hardware. First, ensure that the Catalyst drivers that you're
>>>>using are WHQL certified - this'll eliminate one of the problem causes.
>>>>Next, update your audio drivers - I say this because an audio file is
>>>>mentioned in the dump rep, and I'm seeing more and more errors due to audio
>>>>drivers than I ever have before. Once again, use WHQL certified drivers if
>>>>available.
>>>>
>>>>If that doesn't work, try this KB article:
>>>>http://support.microsoft.com/kb/q244617/
>>>>
>>>>It's quite a read, but it'll help to identify problem drivers.
>>>>
>>>>"Danny" wrote:
>>>>
>>>>> Not sure how to troubleshoot this error. It appears to be a driver
>>>>> conflict from reading MS Knowledgebase but can't get any sense out of
>>>>> the minidump created:
>>>>>
>>>>> ---- 32 bit Kernel Mini Dump Analysis
>>>>>
>>>>> DUMP_HEADER32:
>>>>> MajorVersion 0000000f
>>>>> MinorVersion 00000a28
>>>>> DirectoryTableBase 11768000
>>>>> PfnDataBase 81053000
>>>>> PsLoadedModuleList 8054c850
>>>>> PsActiveProcessHead 8054e8b8
>>>>> MachineImageType 0000014c
>>>>> NumberProcessors 00000001
>>>>> BugCheckCode 00000044
>>>>> BugCheckParameter1 85ca2c91
>>>>> BugCheckParameter2 00000d61
>>>>> BugCheckParameter3 00000000
>>>>> BugCheckParameter4 00000000
>>>>> PaeEnabled 00000000
>>>>> KdDebuggerDataBlock 8053e7e0
>>>>> MiniDumpFields 00000dff
>>>>>
>>>>> TRIAGE_DUMP32:
>>>>> ServicePackBuild 00000100
>>>>> SizeOfDump 00010000
>>>>> ValidOffset 0000fffc
>>>>> ContextOffset 00000320
>>>>> ExceptionOffset 000007d0
>>>>> MmOffset 00001068
>>>>> UnloadedDriversOffset 000010a0
>>>>> PrcbOffset 00001878
>>>>> ProcessOffset 000024c8
>>>>> ThreadOffset 00002720
>>>>> CallStackOffset 00002978
>>>>> SizeOfCallStack 00000fd0
>>>>> DriverListOffset 00003bd8
>>>>> DriverCount 00000082
>>>>> StringPoolOffset 00006270
>>>>> StringPoolSize 00001208
>>>>> BrokenDriverOffset 00000000
>>>>> TriageOptions 00000041
>>>>> TopOfStack b88fa030
>>>>> DebuggerDataOffset 00003948
>>>>> DebuggerDataSize 00000290
>>>>> DataBlocksOffset 00007478
>>>>> DataBlocksCount 00000003
>>>>>
>>>>>
>>>>> Windows XP Kernel Version 2600 (Service Pack 1) UP Free x86 compatible
>>>>> Kernel base = 0x804d4000 PsLoadedModuleList = 0x8054c850
>>>>> Debug session time: Mon Jul 11 17:53:59 2005
>>>>> System Uptime: 0 days 0:00:24
>>>>> start end module name
>>>>> 804d4000 806c6400 nt Checksum: 001FF5C4 Timestamp: Wed
>>>>> Mar 02 01:33:24 2005 (422517E4)
>>>>>
>>>>> Unloaded modules:
>>>>> f7b2f000 f7b34000 Cdaudio.SYS Timestamp: unavailable (00000000)
>>>>> f7d1f000 f7d22000 Sfloppy.SYS Timestamp: unavailable (00000000)
>>>>>
>>>>> Finished dump check
>>>>>
>>>>>
>>>>> The actual error from the Eventviewer is:
>>>>>
>>>>> Error code 00000044, parameter1 85ca2c91, parameter2 00000d61,
>>>>> parameter3 00000000, parameter4 00000000.
>>>>>
>>>>> How do I go about tracing the problem driver? I have recently
>>>>> reinstalled XP Pro, done all the windows updates but have not yet
>>>>> installed SP2, I'm not convinced I need it.
>>>>>
>>>>> Have installed Catalyst 5.5 for my ATI card as 5.6 caused problems
>>>>> playing WMV files, DirectX 9.0c and Norton Syetmworks 2005, which is
>>>>> the application that always gets corrupted when I reboot after the
>>>>> 0x00000044 stop code forcing me to reinstall Norton Antivirus each
>>>>> time!
>>>>>
>>>>> I've not experienced this problem previously with my system and the
>>>>> same software installed.
>>>>>
>>>>> Any advice please?
>>>>>
July 27, 2005 5:56:20 AM

Archived from groups: microsoft.public.windowsxp.help_and_support (More info?)

Well I eventually found the reason!

It's a conflict between hptpro.sys and certain norton components.
Searching Symantecs site I found reference to a similar error:

NO_MORE_IRP_STACK_LOCATIONS

This was for Norton Internet Security 2003 and a HPT370/374 controller
(I have a 370 controller) and Symantecs solution:

Solution:
This problem is due to a conflict between some components of NIS and
drivers for the HighPoint controller. To resolve the problem, remove
the HighPoint controller driver, Hptpro.sys. Note that removing the
driver does not prevent the computer from accessing your IDE devices.

Seeing as I had already installed an older driver which did not have
the hptpro.sys file, I installed the Symevent update and have had no
crashes for the past 4 days! Just to make doubly sure I deleted all
hptpro.sys files from my system!

So that was the problem for me, an incompatability with hptpro.sys and
the updated Symevent driver!

Funny old things computers!

On Sat, 23 Jul 2005 00:18:57 GMT, Danny <f@tchance.com> wrote:

>I'm sure I've found the problem, but not the solution!
>
>Running Liveupdate in Interactive Mode I selected each update one by
>one and found my machine gave the 0x00000044 error after installing
>this component:
>
>Symantec Common Driver: SymEvent
>
>and rebooting windows?
>
>Can't see anything on Symantecs site about my particlular stop code so
>I'm just skipping this update when doing a liveupdate!
>
>I deleted/reinstalled Norton and skipped this component and so far no
>problems.
>
>Now to find out why?
>
>On Fri, 22 Jul 2005 21:51:10 GMT, Danny <f@tchance.com> wrote:
>
>>I *THINK* I know what's causing the stop code 0x00000044!
>>
>>I reinstalled windows xp from scratch and put my system back to
>>something like normal. Applied SP1 and all Windows Critical Updates,
>>flashed original BIOS back into my HotRod Controller and used the
>>original driver. Then I installed (as normal) Norton Systemworks 2005
>>and did a Liveupdate and after rebooting I got the dreaded BSOD again!
>>
>>So I used the Norton Removal Tool to uninstall 2005 and I rebooted
>>windows at least 10 times one after the other, no BSOD at all! Then I
>>reinstalled my older 2004 version, and after doing a liveupdate and
>>rebooting I got a BSOD! So it appears to be something that gets
>>installed AFTER doing a Liveupdate that has caused all the trauma, but
>>I can't figure our what or why!
>>
>>So for now I'm manually downloading the Virus Defs and installing them
>>rather than doing a liveupdate which downloads and applies various
>>software updates as I believe one of those is responsible as I've
>>rebooted windows about 4 or 5 times now without a problem.
>>
>>So until I do a Norton Liveupdate my system is fine! Next task is
>>figuring out what component of liveupdate is causing the problem!
>>
>>I think it's going to be a long night/day!
>>
>>On Thu, 21 Jul 2005 14:09:06 GMT, Danny <f@tchance.com> wrote:
>>
>>>Well it's BSOD'ed 3 times when booting today now so installed the
>>>Windows Debugger, installed the Symbols and followed the advice given
>>>and this is what I get:-
>>>
>>>Microsoft (R) Windows Debugger Version 6.5.0003.7
>>>Copyright (c) Microsoft Corporation. All rights reserved.
>>>
>>>
>>>Loading Dump File [C:\WINDOWS\Minidump\Mini072105-03.dmp]
>>>Mini Kernel Dump File: Only registers and stack trace are available
>>>
>>>Symbol search path is: C:\WINDOWS\Symbols
>>>Executable search path is:
>>>Windows XP Kernel Version 2600 (Service Pack 1) UP Free x86 compatible
>>>Product: WinNt, suite: TerminalServer SingleUserTS
>>>Built by: 2600.xpsp2.050301-1526
>>>Kernel base = 0x804d4000 PsLoadedModuleList = 0x8054c850
>>>Debug session time: Thu Jul 21 13:27:58.265 2005 (GMT+1)
>>>System Uptime: 0 days 0:00:24.843
>>>Loading Kernel Symbols
>>>...........................................................................................................................
>>>Loading unloaded module list
>>>..
>>>Loading User Symbols
>>>*******************************************************************************
>>>*
>>>*
>>>* Bugcheck Analysis
>>>*
>>>*
>>>*
>>>*******************************************************************************
>>>
>>>Use !analyze -v to get detailed debugging information.
>>>
>>>BugCheck 44, {859b1ce1, d61, 0, 0}
>>>
>>>*** WARNING: Unable to verify timestamp for hptpro.sys
>>>*** ERROR: Module load completed but symbols could not be loaded for
>>>hptpro.sys
>>>Probably caused by : Fs_Rec.SYS ( Fs_Rec!UdfsRecFsControl+63 )
>>>
>>>Followup: MachineOwner
>>>---------
>>>
>>>kd> !analyze -v
>>>*******************************************************************************
>>>*
>>>*
>>>* Bugcheck Analysis
>>>*
>>>*
>>>*
>>>*******************************************************************************
>>>
>>>MULTIPLE_IRP_COMPLETE_REQUESTS (44)
>>>A driver has requested that an IRP be completed (IoCompleteRequest()),
>>>but
>>>the packet has already been completed. This is a tough bug to find
>>>because
>>>the easiest case, a driver actually attempted to complete its own
>>>packet
>>>twice, is generally not what happened. Rather, two separate drivers
>>>each
>>>believe that they own the packet, and each attempts to complete it.
>>>The
>>>first actually works, and the second fails. Tracking down which
>>>drivers
>>>in the system actually did this is difficult, generally because the
>>>trails
>>>of the first driver have been covered by the second. However, the
>>>driver
>>>stack for the current request can be found by examining the
>>>DeviceObject
>>>fields in each of the stack locations.
>>>Arguments:
>>>Arg1: 859b1ce1, Address of the IRP
>>>Arg2: 00000d61
>>>Arg3: 00000000
>>>Arg4: 00000000
>>>
>>>Debugging Details:
>>>------------------
>>>
>>>
>>>IRP_ADDRESS: 859b1ce1
>>>
>>>CUSTOMER_CRASH_COUNT: 3
>>>
>>>DEFAULT_BUCKET_ID: DRIVER_FAULT
>>>
>>>BUGCHECK_STR: 0x44
>>>
>>>LAST_CONTROL_TRANSFER: from 805179bf to 8052b591
>>>
>>>STACK_TEXT:
>>>b892a048 805179bf 00000044 859b1ce1 00000d61 nt!KeBugCheckEx+0x19
>>>b892a080 f7d4bc57 8608c8f0 f7c439b8 b892a0c8
>>>nt!IopfCompleteRequest+0x2c4
>>>b892a090 f7d4b59e 8608c8f0 859b1ce0 8608cda0
>>>Fs_Rec!UdfsRecFsControl+0x63
>>>b892a0a0 804dfdfd 8608c8f0 859b1ce0 859b1ce0
>>>Fs_Rec!FsRecFsControl+0x5a
>>>b892a0b0 f7c43bbf 85872980 8672d280 8606b820 nt!IopfCallDriver+0x31
>>>WARNING: Stack unwind information not available. Following frames may
>>>be wrong.
>>>b892a0c8 804dfdfd 00000000 85844528 859b1ce0 hptpro+0xbbf
>>>b892a0d8 8058c584 8606b820 806c9158 b892a220 nt!IopfCallDriver+0x31
>>>b892a128 80505ac6 86068150 b892a200 00000000 nt!IopMountVolume+0x1d1
>>>b892a158 8055aa4a b892a420 8606b820 b892a290
>>>nt!IopCheckVpbMounted+0x59
>>>b892a24c 8055253a 8606b820 00000000 858653f0 nt!IopParseDevice+0x3ba
>>>b892a2d0 805557a2 00000000 b892a310 00000040
>>>nt!ObpLookupObjectName+0x56a
>>>b892a324 8055be9a 00000000 00000000 ffffff01
>>>nt!ObOpenObjectByName+0xe9
>>>b892a4a4 804dad01 00bbef6c 00bbef44 b892a4d8
>>>nt!NtQueryAttributesFile+0xe9
>>>b892a4a4 7ffe0304 00bbef6c 00bbef44 b892a4d8 nt!KiSystemService+0xc4
>>>00bbef98 00000000 00000000 00000000 00000000
>>>SharedUserData!SystemCallStub+0x4
>>>
>>>
>>>FOLLOWUP_IP:
>>>Fs_Rec!UdfsRecFsControl+63
>>>f7d4bc57 8bc6 mov eax,esi
>>>
>>>SYMBOL_STACK_INDEX: 2
>>>
>>>FOLLOWUP_NAME: MachineOwner
>>>
>>>SYMBOL_NAME: Fs_Rec!UdfsRecFsControl+63
>>>
>>>MODULE_NAME: Fs_Rec
>>>
>>>IMAGE_NAME: Fs_Rec.SYS
>>>
>>>DEBUG_FLR_IMAGE_TIMESTAMP: 3b7d8361
>>>
>>>STACK_COMMAND: kb
>>>
>>>FAILURE_BUCKET_ID: 0x44_Fs_Rec!UdfsRecFsControl+63
>>>
>>>BUCKET_ID: 0x44_Fs_Rec!UdfsRecFsControl+63
>>>
>>>Followup: MachineOwner
>>>
>>>-----------------------------------------------------------------------------
>>>
>>>So, it looks like 2 files:
>>>
>>>Fs_Rec.sys from loading the 64k Memory Dump
>>>
>>>and
>>>
>>>hptpro.sys (Filter Driver if that helps anyone?) using !analyze -v
>>>
>>>I checked Fs_Rec.sys by doing a file compare on the installed one and
>>>the one extracted from the fs_rec.sy_ file on my Windows CD, they were
>>>identical, so it's not corrupted and so I think it can't directly be
>>>the problem.
>>>
>>>So, seeing as the Hot Rod Driver is the latest one I did a BIOS update
>>>on the controller too and moved it to another PCI slot, but that has
>>>made no difference either.
>>>
>>>Going to Highpoints site lists the same driver version as the one I
>>>already have from A-Bits site who made the controller (Neither are
>>>WHQL certified) so there is no 'new' driver available other than the
>>>one I have already (and am sure I've used) previously.
>>>
>>>So does anyone more knowledgeable in Windows Debugging shed any light
>>>on a course of action please?
>>>
>>>Thanks,
>>>
>>>Dan.
>>>
>>>On Tue, 12 Jul 2005 22:57:01 GMT, Danny <f@tchance.com> wrote:
>>>
>>>>Thanks for the info, when (not if) it BSOD's again I'll try the info
>>>>suggested!
>>>>
>>>>BTW, Catalyst drivers are always WHQL certified so I doubt it could be
>>>>that as these have been installed before with no problem.
>>>>
>>>>I've always used the standard windows audio drivers with my SB Live
>>>>5.1 card too, and never had this problem with them!
>>>>
>>>>The only other thing I can think of is my Hot Rod 100 PCI Raid
>>>>Controller card I've had for a while, when I reinstalled windows I
>>>>couldn't rmember which driver I used so found one in a 'drivers'
>>>>folder I made to keep all my drivers for my hardware, this wasn't WHQL
>>>>though, so after the BSOD I installed the Windows driver for it but it
>>>>still gave the same BSOD message!
>>>>
>>>>Will have to sit and wait for it to BSOD again now!
>>>>
>>>>On Mon, 11 Jul 2005 15:49:03 -0700, usasma
>>>><usasma@discussions.microsoft.com> wrote:
>>>>
>>>>>Sounds like a driver to me - typical issues are bad hardware, bad drivers,
>>>>>incompatible hardware. First, ensure that the Catalyst drivers that you're
>>>>>using are WHQL certified - this'll eliminate one of the problem causes.
>>>>>Next, update your audio drivers - I say this because an audio file is
>>>>>mentioned in the dump rep, and I'm seeing more and more errors due to audio
>>>>>drivers than I ever have before. Once again, use WHQL certified drivers if
>>>>>available.
>>>>>
>>>>>If that doesn't work, try this KB article:
>>>>>http://support.microsoft.com/kb/q244617/
>>>>>
>>>>>It's quite a read, but it'll help to identify problem drivers.
>>>>>
>>>>>"Danny" wrote:
>>>>>
>>>>>> Not sure how to troubleshoot this error. It appears to be a driver
>>>>>> conflict from reading MS Knowledgebase but can't get any sense out of
>>>>>> the minidump created:
>>>>>>
>>>>>> ---- 32 bit Kernel Mini Dump Analysis
>>>>>>
>>>>>> DUMP_HEADER32:
>>>>>> MajorVersion 0000000f
>>>>>> MinorVersion 00000a28
>>>>>> DirectoryTableBase 11768000
>>>>>> PfnDataBase 81053000
>>>>>> PsLoadedModuleList 8054c850
>>>>>> PsActiveProcessHead 8054e8b8
>>>>>> MachineImageType 0000014c
>>>>>> NumberProcessors 00000001
>>>>>> BugCheckCode 00000044
>>>>>> BugCheckParameter1 85ca2c91
>>>>>> BugCheckParameter2 00000d61
>>>>>> BugCheckParameter3 00000000
>>>>>> BugCheckParameter4 00000000
>>>>>> PaeEnabled 00000000
>>>>>> KdDebuggerDataBlock 8053e7e0
>>>>>> MiniDumpFields 00000dff
>>>>>>
>>>>>> TRIAGE_DUMP32:
>>>>>> ServicePackBuild 00000100
>>>>>> SizeOfDump 00010000
>>>>>> ValidOffset 0000fffc
>>>>>> ContextOffset 00000320
>>>>>> ExceptionOffset 000007d0
>>>>>> MmOffset 00001068
>>>>>> UnloadedDriversOffset 000010a0
>>>>>> PrcbOffset 00001878
>>>>>> ProcessOffset 000024c8
>>>>>> ThreadOffset 00002720
>>>>>> CallStackOffset 00002978
>>>>>> SizeOfCallStack 00000fd0
>>>>>> DriverListOffset 00003bd8
>>>>>> DriverCount 00000082
>>>>>> StringPoolOffset 00006270
>>>>>> StringPoolSize 00001208
>>>>>> BrokenDriverOffset 00000000
>>>>>> TriageOptions 00000041
>>>>>> TopOfStack b88fa030
>>>>>> DebuggerDataOffset 00003948
>>>>>> DebuggerDataSize 00000290
>>>>>> DataBlocksOffset 00007478
>>>>>> DataBlocksCount 00000003
>>>>>>
>>>>>>
>>>>>> Windows XP Kernel Version 2600 (Service Pack 1) UP Free x86 compatible
>>>>>> Kernel base = 0x804d4000 PsLoadedModuleList = 0x8054c850
>>>>>> Debug session time: Mon Jul 11 17:53:59 2005
>>>>>> System Uptime: 0 days 0:00:24
>>>>>> start end module name
>>>>>> 804d4000 806c6400 nt Checksum: 001FF5C4 Timestamp: Wed
>>>>>> Mar 02 01:33:24 2005 (422517E4)
>>>>>>
>>>>>> Unloaded modules:
>>>>>> f7b2f000 f7b34000 Cdaudio.SYS Timestamp: unavailable (00000000)
>>>>>> f7d1f000 f7d22000 Sfloppy.SYS Timestamp: unavailable (00000000)
>>>>>>
>>>>>> Finished dump check
>>>>>>
>>>>>>
>>>>>> The actual error from the Eventviewer is:
>>>>>>
>>>>>> Error code 00000044, parameter1 85ca2c91, parameter2 00000d61,
>>>>>> parameter3 00000000, parameter4 00000000.
>>>>>>
>>>>>> How do I go about tracing the problem driver? I have recently
>>>>>> reinstalled XP Pro, done all the windows updates but have not yet
>>>>>> installed SP2, I'm not convinced I need it.
>>>>>>
>>>>>> Have installed Catalyst 5.5 for my ATI card as 5.6 caused problems
>>>>>> playing WMV files, DirectX 9.0c and Norton Syetmworks 2005, which is
>>>>>> the application that always gets corrupted when I reboot after the
>>>>>> 0x00000044 stop code forcing me to reinstall Norton Antivirus each
>>>>>> time!
>>>>>>
>>>>>> I've not experienced this problem previously with my system and the
>>>>>> same software installed.
>>>>>>
>>>>>> Any advice please?
>>>>>>
!