How to troubleshoot Stop Code 0x00000044 - MULTIPL_IRP_COM..

Archived from groups: microsoft.public.windowsxp.help_and_support (More info?)

Not sure how to troubleshoot this error. It appears to be a driver
conflict from reading MS Knowledgebase but can't get any sense out of
the minidump created:

---- 32 bit Kernel Mini Dump Analysis

DUMP_HEADER32:
MajorVersion 0000000f
MinorVersion 00000a28
DirectoryTableBase 11768000
PfnDataBase 81053000
PsLoadedModuleList 8054c850
PsActiveProcessHead 8054e8b8
MachineImageType 0000014c
NumberProcessors 00000001
BugCheckCode 00000044
BugCheckParameter1 85ca2c91
BugCheckParameter2 00000d61
BugCheckParameter3 00000000
BugCheckParameter4 00000000
PaeEnabled 00000000
KdDebuggerDataBlock 8053e7e0
MiniDumpFields 00000dff

TRIAGE_DUMP32:
ServicePackBuild 00000100
SizeOfDump 00010000
ValidOffset 0000fffc
ContextOffset 00000320
ExceptionOffset 000007d0
MmOffset 00001068
UnloadedDriversOffset 000010a0
PrcbOffset 00001878
ProcessOffset 000024c8
ThreadOffset 00002720
CallStackOffset 00002978
SizeOfCallStack 00000fd0
DriverListOffset 00003bd8
DriverCount 00000082
StringPoolOffset 00006270
StringPoolSize 00001208
BrokenDriverOffset 00000000
TriageOptions 00000041
TopOfStack b88fa030
DebuggerDataOffset 00003948
DebuggerDataSize 00000290
DataBlocksOffset 00007478
DataBlocksCount 00000003


Windows XP Kernel Version 2600 (Service Pack 1) UP Free x86 compatible
Kernel base = 0x804d4000 PsLoadedModuleList = 0x8054c850
Debug session time: Mon Jul 11 17:53:59 2005
System Uptime: 0 days 0:00:24
start end module name
804d4000 806c6400 nt Checksum: 001FF5C4 Timestamp: Wed
Mar 02 01:33:24 2005 (422517E4)

Unloaded modules:
f7b2f000 f7b34000 Cdaudio.SYS Timestamp: unavailable (00000000)
f7d1f000 f7d22000 Sfloppy.SYS Timestamp: unavailable (00000000)

Finished dump check


The actual error from the Eventviewer is:

Error code 00000044, parameter1 85ca2c91, parameter2 00000d61,
parameter3 00000000, parameter4 00000000.

How do I go about tracing the problem driver? I have recently
reinstalled XP Pro, done all the windows updates but have not yet
installed SP2, I'm not convinced I need it.

Have installed Catalyst 5.5 for my ATI card as 5.6 caused problems
playing WMV files, DirectX 9.0c and Norton Syetmworks 2005, which is
the application that always gets corrupted when I reboot after the
0x00000044 stop code forcing me to reinstall Norton Antivirus each
time!

I've not experienced this problem previously with my system and the
same software installed.

Any advice please?
6 answers Last reply
More about troubleshoot stop code 0x00000044 multipl_irp_com
  1. Archived from groups: microsoft.public.windowsxp.help_and_support (More info?)

    Sounds like a driver to me - typical issues are bad hardware, bad drivers,
    incompatible hardware. First, ensure that the Catalyst drivers that you're
    using are WHQL certified - this'll eliminate one of the problem causes.
    Next, update your audio drivers - I say this because an audio file is
    mentioned in the dump rep, and I'm seeing more and more errors due to audio
    drivers than I ever have before. Once again, use WHQL certified drivers if
    available.

    If that doesn't work, try this KB article:
    http://support.microsoft.com/kb/q244617/

    It's quite a read, but it'll help to identify problem drivers.

    "Danny" wrote:

    > Not sure how to troubleshoot this error. It appears to be a driver
    > conflict from reading MS Knowledgebase but can't get any sense out of
    > the minidump created:
    >
    > ---- 32 bit Kernel Mini Dump Analysis
    >
    > DUMP_HEADER32:
    > MajorVersion 0000000f
    > MinorVersion 00000a28
    > DirectoryTableBase 11768000
    > PfnDataBase 81053000
    > PsLoadedModuleList 8054c850
    > PsActiveProcessHead 8054e8b8
    > MachineImageType 0000014c
    > NumberProcessors 00000001
    > BugCheckCode 00000044
    > BugCheckParameter1 85ca2c91
    > BugCheckParameter2 00000d61
    > BugCheckParameter3 00000000
    > BugCheckParameter4 00000000
    > PaeEnabled 00000000
    > KdDebuggerDataBlock 8053e7e0
    > MiniDumpFields 00000dff
    >
    > TRIAGE_DUMP32:
    > ServicePackBuild 00000100
    > SizeOfDump 00010000
    > ValidOffset 0000fffc
    > ContextOffset 00000320
    > ExceptionOffset 000007d0
    > MmOffset 00001068
    > UnloadedDriversOffset 000010a0
    > PrcbOffset 00001878
    > ProcessOffset 000024c8
    > ThreadOffset 00002720
    > CallStackOffset 00002978
    > SizeOfCallStack 00000fd0
    > DriverListOffset 00003bd8
    > DriverCount 00000082
    > StringPoolOffset 00006270
    > StringPoolSize 00001208
    > BrokenDriverOffset 00000000
    > TriageOptions 00000041
    > TopOfStack b88fa030
    > DebuggerDataOffset 00003948
    > DebuggerDataSize 00000290
    > DataBlocksOffset 00007478
    > DataBlocksCount 00000003
    >
    >
    > Windows XP Kernel Version 2600 (Service Pack 1) UP Free x86 compatible
    > Kernel base = 0x804d4000 PsLoadedModuleList = 0x8054c850
    > Debug session time: Mon Jul 11 17:53:59 2005
    > System Uptime: 0 days 0:00:24
    > start end module name
    > 804d4000 806c6400 nt Checksum: 001FF5C4 Timestamp: Wed
    > Mar 02 01:33:24 2005 (422517E4)
    >
    > Unloaded modules:
    > f7b2f000 f7b34000 Cdaudio.SYS Timestamp: unavailable (00000000)
    > f7d1f000 f7d22000 Sfloppy.SYS Timestamp: unavailable (00000000)
    >
    > Finished dump check
    >
    >
    > The actual error from the Eventviewer is:
    >
    > Error code 00000044, parameter1 85ca2c91, parameter2 00000d61,
    > parameter3 00000000, parameter4 00000000.
    >
    > How do I go about tracing the problem driver? I have recently
    > reinstalled XP Pro, done all the windows updates but have not yet
    > installed SP2, I'm not convinced I need it.
    >
    > Have installed Catalyst 5.5 for my ATI card as 5.6 caused problems
    > playing WMV files, DirectX 9.0c and Norton Syetmworks 2005, which is
    > the application that always gets corrupted when I reboot after the
    > 0x00000044 stop code forcing me to reinstall Norton Antivirus each
    > time!
    >
    > I've not experienced this problem previously with my system and the
    > same software installed.
    >
    > Any advice please?
    >
  2. Archived from groups: microsoft.public.windowsxp.help_and_support (More info?)

    Thanks for the info, when (not if) it BSOD's again I'll try the info
    suggested!

    BTW, Catalyst drivers are always WHQL certified so I doubt it could be
    that as these have been installed before with no problem.

    I've always used the standard windows audio drivers with my SB Live
    5.1 card too, and never had this problem with them!

    The only other thing I can think of is my Hot Rod 100 PCI Raid
    Controller card I've had for a while, when I reinstalled windows I
    couldn't rmember which driver I used so found one in a 'drivers'
    folder I made to keep all my drivers for my hardware, this wasn't WHQL
    though, so after the BSOD I installed the Windows driver for it but it
    still gave the same BSOD message!

    Will have to sit and wait for it to BSOD again now!

    On Mon, 11 Jul 2005 15:49:03 -0700, usasma
    <usasma@discussions.microsoft.com> wrote:

    >Sounds like a driver to me - typical issues are bad hardware, bad drivers,
    >incompatible hardware. First, ensure that the Catalyst drivers that you're
    >using are WHQL certified - this'll eliminate one of the problem causes.
    >Next, update your audio drivers - I say this because an audio file is
    >mentioned in the dump rep, and I'm seeing more and more errors due to audio
    >drivers than I ever have before. Once again, use WHQL certified drivers if
    >available.
    >
    >If that doesn't work, try this KB article:
    >http://support.microsoft.com/kb/q244617/
    >
    >It's quite a read, but it'll help to identify problem drivers.
    >
    >"Danny" wrote:
    >
    >> Not sure how to troubleshoot this error. It appears to be a driver
    >> conflict from reading MS Knowledgebase but can't get any sense out of
    >> the minidump created:
    >>
    >> ---- 32 bit Kernel Mini Dump Analysis
    >>
    >> DUMP_HEADER32:
    >> MajorVersion 0000000f
    >> MinorVersion 00000a28
    >> DirectoryTableBase 11768000
    >> PfnDataBase 81053000
    >> PsLoadedModuleList 8054c850
    >> PsActiveProcessHead 8054e8b8
    >> MachineImageType 0000014c
    >> NumberProcessors 00000001
    >> BugCheckCode 00000044
    >> BugCheckParameter1 85ca2c91
    >> BugCheckParameter2 00000d61
    >> BugCheckParameter3 00000000
    >> BugCheckParameter4 00000000
    >> PaeEnabled 00000000
    >> KdDebuggerDataBlock 8053e7e0
    >> MiniDumpFields 00000dff
    >>
    >> TRIAGE_DUMP32:
    >> ServicePackBuild 00000100
    >> SizeOfDump 00010000
    >> ValidOffset 0000fffc
    >> ContextOffset 00000320
    >> ExceptionOffset 000007d0
    >> MmOffset 00001068
    >> UnloadedDriversOffset 000010a0
    >> PrcbOffset 00001878
    >> ProcessOffset 000024c8
    >> ThreadOffset 00002720
    >> CallStackOffset 00002978
    >> SizeOfCallStack 00000fd0
    >> DriverListOffset 00003bd8
    >> DriverCount 00000082
    >> StringPoolOffset 00006270
    >> StringPoolSize 00001208
    >> BrokenDriverOffset 00000000
    >> TriageOptions 00000041
    >> TopOfStack b88fa030
    >> DebuggerDataOffset 00003948
    >> DebuggerDataSize 00000290
    >> DataBlocksOffset 00007478
    >> DataBlocksCount 00000003
    >>
    >>
    >> Windows XP Kernel Version 2600 (Service Pack 1) UP Free x86 compatible
    >> Kernel base = 0x804d4000 PsLoadedModuleList = 0x8054c850
    >> Debug session time: Mon Jul 11 17:53:59 2005
    >> System Uptime: 0 days 0:00:24
    >> start end module name
    >> 804d4000 806c6400 nt Checksum: 001FF5C4 Timestamp: Wed
    >> Mar 02 01:33:24 2005 (422517E4)
    >>
    >> Unloaded modules:
    >> f7b2f000 f7b34000 Cdaudio.SYS Timestamp: unavailable (00000000)
    >> f7d1f000 f7d22000 Sfloppy.SYS Timestamp: unavailable (00000000)
    >>
    >> Finished dump check
    >>
    >>
    >> The actual error from the Eventviewer is:
    >>
    >> Error code 00000044, parameter1 85ca2c91, parameter2 00000d61,
    >> parameter3 00000000, parameter4 00000000.
    >>
    >> How do I go about tracing the problem driver? I have recently
    >> reinstalled XP Pro, done all the windows updates but have not yet
    >> installed SP2, I'm not convinced I need it.
    >>
    >> Have installed Catalyst 5.5 for my ATI card as 5.6 caused problems
    >> playing WMV files, DirectX 9.0c and Norton Syetmworks 2005, which is
    >> the application that always gets corrupted when I reboot after the
    >> 0x00000044 stop code forcing me to reinstall Norton Antivirus each
    >> time!
    >>
    >> I've not experienced this problem previously with my system and the
    >> same software installed.
    >>
    >> Any advice please?
    >>
  3. Archived from groups: microsoft.public.windowsxp.help_and_support (More info?)

    Well it's BSOD'ed 3 times when booting today now so installed the
    Windows Debugger, installed the Symbols and followed the advice given
    and this is what I get:-

    Microsoft (R) Windows Debugger Version 6.5.0003.7
    Copyright (c) Microsoft Corporation. All rights reserved.


    Loading Dump File [C:\WINDOWS\Minidump\Mini072105-03.dmp]
    Mini Kernel Dump File: Only registers and stack trace are available

    Symbol search path is: C:\WINDOWS\Symbols
    Executable search path is:
    Windows XP Kernel Version 2600 (Service Pack 1) UP Free x86 compatible
    Product: WinNt, suite: TerminalServer SingleUserTS
    Built by: 2600.xpsp2.050301-1526
    Kernel base = 0x804d4000 PsLoadedModuleList = 0x8054c850
    Debug session time: Thu Jul 21 13:27:58.265 2005 (GMT+1)
    System Uptime: 0 days 0:00:24.843
    Loading Kernel Symbols
    ............................................................................................................................
    Loading unloaded module list
    ...
    Loading User Symbols
    *******************************************************************************
    *
    *
    * Bugcheck Analysis
    *
    *
    *
    *******************************************************************************

    Use !analyze -v to get detailed debugging information.

    BugCheck 44, {859b1ce1, d61, 0, 0}

    *** WARNING: Unable to verify timestamp for hptpro.sys
    *** ERROR: Module load completed but symbols could not be loaded for
    hptpro.sys
    Probably caused by : Fs_Rec.SYS ( Fs_Rec!UdfsRecFsControl+63 )

    Followup: MachineOwner
    ---------

    kd> !analyze -v
    *******************************************************************************
    *
    *
    * Bugcheck Analysis
    *
    *
    *
    *******************************************************************************

    MULTIPLE_IRP_COMPLETE_REQUESTS (44)
    A driver has requested that an IRP be completed (IoCompleteRequest()),
    but
    the packet has already been completed. This is a tough bug to find
    because
    the easiest case, a driver actually attempted to complete its own
    packet
    twice, is generally not what happened. Rather, two separate drivers
    each
    believe that they own the packet, and each attempts to complete it.
    The
    first actually works, and the second fails. Tracking down which
    drivers
    in the system actually did this is difficult, generally because the
    trails
    of the first driver have been covered by the second. However, the
    driver
    stack for the current request can be found by examining the
    DeviceObject
    fields in each of the stack locations.
    Arguments:
    Arg1: 859b1ce1, Address of the IRP
    Arg2: 00000d61
    Arg3: 00000000
    Arg4: 00000000

    Debugging Details:
    ------------------


    IRP_ADDRESS: 859b1ce1

    CUSTOMER_CRASH_COUNT: 3

    DEFAULT_BUCKET_ID: DRIVER_FAULT

    BUGCHECK_STR: 0x44

    LAST_CONTROL_TRANSFER: from 805179bf to 8052b591

    STACK_TEXT:
    b892a048 805179bf 00000044 859b1ce1 00000d61 nt!KeBugCheckEx+0x19
    b892a080 f7d4bc57 8608c8f0 f7c439b8 b892a0c8
    nt!IopfCompleteRequest+0x2c4
    b892a090 f7d4b59e 8608c8f0 859b1ce0 8608cda0
    Fs_Rec!UdfsRecFsControl+0x63
    b892a0a0 804dfdfd 8608c8f0 859b1ce0 859b1ce0
    Fs_Rec!FsRecFsControl+0x5a
    b892a0b0 f7c43bbf 85872980 8672d280 8606b820 nt!IopfCallDriver+0x31
    WARNING: Stack unwind information not available. Following frames may
    be wrong.
    b892a0c8 804dfdfd 00000000 85844528 859b1ce0 hptpro+0xbbf
    b892a0d8 8058c584 8606b820 806c9158 b892a220 nt!IopfCallDriver+0x31
    b892a128 80505ac6 86068150 b892a200 00000000 nt!IopMountVolume+0x1d1
    b892a158 8055aa4a b892a420 8606b820 b892a290
    nt!IopCheckVpbMounted+0x59
    b892a24c 8055253a 8606b820 00000000 858653f0 nt!IopParseDevice+0x3ba
    b892a2d0 805557a2 00000000 b892a310 00000040
    nt!ObpLookupObjectName+0x56a
    b892a324 8055be9a 00000000 00000000 ffffff01
    nt!ObOpenObjectByName+0xe9
    b892a4a4 804dad01 00bbef6c 00bbef44 b892a4d8
    nt!NtQueryAttributesFile+0xe9
    b892a4a4 7ffe0304 00bbef6c 00bbef44 b892a4d8 nt!KiSystemService+0xc4
    00bbef98 00000000 00000000 00000000 00000000
    SharedUserData!SystemCallStub+0x4


    FOLLOWUP_IP:
    Fs_Rec!UdfsRecFsControl+63
    f7d4bc57 8bc6 mov eax,esi

    SYMBOL_STACK_INDEX: 2

    FOLLOWUP_NAME: MachineOwner

    SYMBOL_NAME: Fs_Rec!UdfsRecFsControl+63

    MODULE_NAME: Fs_Rec

    IMAGE_NAME: Fs_Rec.SYS

    DEBUG_FLR_IMAGE_TIMESTAMP: 3b7d8361

    STACK_COMMAND: kb

    FAILURE_BUCKET_ID: 0x44_Fs_Rec!UdfsRecFsControl+63

    BUCKET_ID: 0x44_Fs_Rec!UdfsRecFsControl+63

    Followup: MachineOwner

    -----------------------------------------------------------------------------

    So, it looks like 2 files:

    Fs_Rec.sys from loading the 64k Memory Dump

    and

    hptpro.sys (Filter Driver if that helps anyone?) using !analyze -v

    I checked Fs_Rec.sys by doing a file compare on the installed one and
    the one extracted from the fs_rec.sy_ file on my Windows CD, they were
    identical, so it's not corrupted and so I think it can't directly be
    the problem.

    So, seeing as the Hot Rod Driver is the latest one I did a BIOS update
    on the controller too and moved it to another PCI slot, but that has
    made no difference either.

    Going to Highpoints site lists the same driver version as the one I
    already have from A-Bits site who made the controller (Neither are
    WHQL certified) so there is no 'new' driver available other than the
    one I have already (and am sure I've used) previously.

    So does anyone more knowledgeable in Windows Debugging shed any light
    on a course of action please?

    Thanks,

    Dan.

    On Tue, 12 Jul 2005 22:57:01 GMT, Danny <f@tchance.com> wrote:

    >Thanks for the info, when (not if) it BSOD's again I'll try the info
    >suggested!
    >
    >BTW, Catalyst drivers are always WHQL certified so I doubt it could be
    >that as these have been installed before with no problem.
    >
    >I've always used the standard windows audio drivers with my SB Live
    >5.1 card too, and never had this problem with them!
    >
    >The only other thing I can think of is my Hot Rod 100 PCI Raid
    >Controller card I've had for a while, when I reinstalled windows I
    >couldn't rmember which driver I used so found one in a 'drivers'
    >folder I made to keep all my drivers for my hardware, this wasn't WHQL
    >though, so after the BSOD I installed the Windows driver for it but it
    >still gave the same BSOD message!
    >
    >Will have to sit and wait for it to BSOD again now!
    >
    >On Mon, 11 Jul 2005 15:49:03 -0700, usasma
    ><usasma@discussions.microsoft.com> wrote:
    >
    >>Sounds like a driver to me - typical issues are bad hardware, bad drivers,
    >>incompatible hardware. First, ensure that the Catalyst drivers that you're
    >>using are WHQL certified - this'll eliminate one of the problem causes.
    >>Next, update your audio drivers - I say this because an audio file is
    >>mentioned in the dump rep, and I'm seeing more and more errors due to audio
    >>drivers than I ever have before. Once again, use WHQL certified drivers if
    >>available.
    >>
    >>If that doesn't work, try this KB article:
    >>http://support.microsoft.com/kb/q244617/
    >>
    >>It's quite a read, but it'll help to identify problem drivers.
    >>
    >>"Danny" wrote:
    >>
    >>> Not sure how to troubleshoot this error. It appears to be a driver
    >>> conflict from reading MS Knowledgebase but can't get any sense out of
    >>> the minidump created:
    >>>
    >>> ---- 32 bit Kernel Mini Dump Analysis
    >>>
    >>> DUMP_HEADER32:
    >>> MajorVersion 0000000f
    >>> MinorVersion 00000a28
    >>> DirectoryTableBase 11768000
    >>> PfnDataBase 81053000
    >>> PsLoadedModuleList 8054c850
    >>> PsActiveProcessHead 8054e8b8
    >>> MachineImageType 0000014c
    >>> NumberProcessors 00000001
    >>> BugCheckCode 00000044
    >>> BugCheckParameter1 85ca2c91
    >>> BugCheckParameter2 00000d61
    >>> BugCheckParameter3 00000000
    >>> BugCheckParameter4 00000000
    >>> PaeEnabled 00000000
    >>> KdDebuggerDataBlock 8053e7e0
    >>> MiniDumpFields 00000dff
    >>>
    >>> TRIAGE_DUMP32:
    >>> ServicePackBuild 00000100
    >>> SizeOfDump 00010000
    >>> ValidOffset 0000fffc
    >>> ContextOffset 00000320
    >>> ExceptionOffset 000007d0
    >>> MmOffset 00001068
    >>> UnloadedDriversOffset 000010a0
    >>> PrcbOffset 00001878
    >>> ProcessOffset 000024c8
    >>> ThreadOffset 00002720
    >>> CallStackOffset 00002978
    >>> SizeOfCallStack 00000fd0
    >>> DriverListOffset 00003bd8
    >>> DriverCount 00000082
    >>> StringPoolOffset 00006270
    >>> StringPoolSize 00001208
    >>> BrokenDriverOffset 00000000
    >>> TriageOptions 00000041
    >>> TopOfStack b88fa030
    >>> DebuggerDataOffset 00003948
    >>> DebuggerDataSize 00000290
    >>> DataBlocksOffset 00007478
    >>> DataBlocksCount 00000003
    >>>
    >>>
    >>> Windows XP Kernel Version 2600 (Service Pack 1) UP Free x86 compatible
    >>> Kernel base = 0x804d4000 PsLoadedModuleList = 0x8054c850
    >>> Debug session time: Mon Jul 11 17:53:59 2005
    >>> System Uptime: 0 days 0:00:24
    >>> start end module name
    >>> 804d4000 806c6400 nt Checksum: 001FF5C4 Timestamp: Wed
    >>> Mar 02 01:33:24 2005 (422517E4)
    >>>
    >>> Unloaded modules:
    >>> f7b2f000 f7b34000 Cdaudio.SYS Timestamp: unavailable (00000000)
    >>> f7d1f000 f7d22000 Sfloppy.SYS Timestamp: unavailable (00000000)
    >>>
    >>> Finished dump check
    >>>
    >>>
    >>> The actual error from the Eventviewer is:
    >>>
    >>> Error code 00000044, parameter1 85ca2c91, parameter2 00000d61,
    >>> parameter3 00000000, parameter4 00000000.
    >>>
    >>> How do I go about tracing the problem driver? I have recently
    >>> reinstalled XP Pro, done all the windows updates but have not yet
    >>> installed SP2, I'm not convinced I need it.
    >>>
    >>> Have installed Catalyst 5.5 for my ATI card as 5.6 caused problems
    >>> playing WMV files, DirectX 9.0c and Norton Syetmworks 2005, which is
    >>> the application that always gets corrupted when I reboot after the
    >>> 0x00000044 stop code forcing me to reinstall Norton Antivirus each
    >>> time!
    >>>
    >>> I've not experienced this problem previously with my system and the
    >>> same software installed.
    >>>
    >>> Any advice please?
    >>>
  4. Archived from groups: microsoft.public.windowsxp.help_and_support (More info?)

    I *THINK* I know what's causing the stop code 0x00000044!

    I reinstalled windows xp from scratch and put my system back to
    something like normal. Applied SP1 and all Windows Critical Updates,
    flashed original BIOS back into my HotRod Controller and used the
    original driver. Then I installed (as normal) Norton Systemworks 2005
    and did a Liveupdate and after rebooting I got the dreaded BSOD again!

    So I used the Norton Removal Tool to uninstall 2005 and I rebooted
    windows at least 10 times one after the other, no BSOD at all! Then I
    reinstalled my older 2004 version, and after doing a liveupdate and
    rebooting I got a BSOD! So it appears to be something that gets
    installed AFTER doing a Liveupdate that has caused all the trauma, but
    I can't figure our what or why!

    So for now I'm manually downloading the Virus Defs and installing them
    rather than doing a liveupdate which downloads and applies various
    software updates as I believe one of those is responsible as I've
    rebooted windows about 4 or 5 times now without a problem.

    So until I do a Norton Liveupdate my system is fine! Next task is
    figuring out what component of liveupdate is causing the problem!

    I think it's going to be a long night/day!

    On Thu, 21 Jul 2005 14:09:06 GMT, Danny <f@tchance.com> wrote:

    >Well it's BSOD'ed 3 times when booting today now so installed the
    >Windows Debugger, installed the Symbols and followed the advice given
    >and this is what I get:-
    >
    >Microsoft (R) Windows Debugger Version 6.5.0003.7
    >Copyright (c) Microsoft Corporation. All rights reserved.
    >
    >
    >Loading Dump File [C:\WINDOWS\Minidump\Mini072105-03.dmp]
    >Mini Kernel Dump File: Only registers and stack trace are available
    >
    >Symbol search path is: C:\WINDOWS\Symbols
    >Executable search path is:
    >Windows XP Kernel Version 2600 (Service Pack 1) UP Free x86 compatible
    >Product: WinNt, suite: TerminalServer SingleUserTS
    >Built by: 2600.xpsp2.050301-1526
    >Kernel base = 0x804d4000 PsLoadedModuleList = 0x8054c850
    >Debug session time: Thu Jul 21 13:27:58.265 2005 (GMT+1)
    >System Uptime: 0 days 0:00:24.843
    >Loading Kernel Symbols
    >...........................................................................................................................
    >Loading unloaded module list
    >..
    >Loading User Symbols
    >*******************************************************************************
    >*
    >*
    >* Bugcheck Analysis
    >*
    >*
    >*
    >*******************************************************************************
    >
    >Use !analyze -v to get detailed debugging information.
    >
    >BugCheck 44, {859b1ce1, d61, 0, 0}
    >
    >*** WARNING: Unable to verify timestamp for hptpro.sys
    >*** ERROR: Module load completed but symbols could not be loaded for
    >hptpro.sys
    >Probably caused by : Fs_Rec.SYS ( Fs_Rec!UdfsRecFsControl+63 )
    >
    >Followup: MachineOwner
    >---------
    >
    >kd> !analyze -v
    >*******************************************************************************
    >*
    >*
    >* Bugcheck Analysis
    >*
    >*
    >*
    >*******************************************************************************
    >
    >MULTIPLE_IRP_COMPLETE_REQUESTS (44)
    >A driver has requested that an IRP be completed (IoCompleteRequest()),
    >but
    >the packet has already been completed. This is a tough bug to find
    >because
    >the easiest case, a driver actually attempted to complete its own
    >packet
    >twice, is generally not what happened. Rather, two separate drivers
    >each
    >believe that they own the packet, and each attempts to complete it.
    >The
    >first actually works, and the second fails. Tracking down which
    >drivers
    >in the system actually did this is difficult, generally because the
    >trails
    >of the first driver have been covered by the second. However, the
    >driver
    >stack for the current request can be found by examining the
    >DeviceObject
    >fields in each of the stack locations.
    >Arguments:
    >Arg1: 859b1ce1, Address of the IRP
    >Arg2: 00000d61
    >Arg3: 00000000
    >Arg4: 00000000
    >
    >Debugging Details:
    >------------------
    >
    >
    >IRP_ADDRESS: 859b1ce1
    >
    >CUSTOMER_CRASH_COUNT: 3
    >
    >DEFAULT_BUCKET_ID: DRIVER_FAULT
    >
    >BUGCHECK_STR: 0x44
    >
    >LAST_CONTROL_TRANSFER: from 805179bf to 8052b591
    >
    >STACK_TEXT:
    >b892a048 805179bf 00000044 859b1ce1 00000d61 nt!KeBugCheckEx+0x19
    >b892a080 f7d4bc57 8608c8f0 f7c439b8 b892a0c8
    >nt!IopfCompleteRequest+0x2c4
    >b892a090 f7d4b59e 8608c8f0 859b1ce0 8608cda0
    >Fs_Rec!UdfsRecFsControl+0x63
    >b892a0a0 804dfdfd 8608c8f0 859b1ce0 859b1ce0
    >Fs_Rec!FsRecFsControl+0x5a
    >b892a0b0 f7c43bbf 85872980 8672d280 8606b820 nt!IopfCallDriver+0x31
    >WARNING: Stack unwind information not available. Following frames may
    >be wrong.
    >b892a0c8 804dfdfd 00000000 85844528 859b1ce0 hptpro+0xbbf
    >b892a0d8 8058c584 8606b820 806c9158 b892a220 nt!IopfCallDriver+0x31
    >b892a128 80505ac6 86068150 b892a200 00000000 nt!IopMountVolume+0x1d1
    >b892a158 8055aa4a b892a420 8606b820 b892a290
    >nt!IopCheckVpbMounted+0x59
    >b892a24c 8055253a 8606b820 00000000 858653f0 nt!IopParseDevice+0x3ba
    >b892a2d0 805557a2 00000000 b892a310 00000040
    >nt!ObpLookupObjectName+0x56a
    >b892a324 8055be9a 00000000 00000000 ffffff01
    >nt!ObOpenObjectByName+0xe9
    >b892a4a4 804dad01 00bbef6c 00bbef44 b892a4d8
    >nt!NtQueryAttributesFile+0xe9
    >b892a4a4 7ffe0304 00bbef6c 00bbef44 b892a4d8 nt!KiSystemService+0xc4
    >00bbef98 00000000 00000000 00000000 00000000
    >SharedUserData!SystemCallStub+0x4
    >
    >
    >FOLLOWUP_IP:
    >Fs_Rec!UdfsRecFsControl+63
    >f7d4bc57 8bc6 mov eax,esi
    >
    >SYMBOL_STACK_INDEX: 2
    >
    >FOLLOWUP_NAME: MachineOwner
    >
    >SYMBOL_NAME: Fs_Rec!UdfsRecFsControl+63
    >
    >MODULE_NAME: Fs_Rec
    >
    >IMAGE_NAME: Fs_Rec.SYS
    >
    >DEBUG_FLR_IMAGE_TIMESTAMP: 3b7d8361
    >
    >STACK_COMMAND: kb
    >
    >FAILURE_BUCKET_ID: 0x44_Fs_Rec!UdfsRecFsControl+63
    >
    >BUCKET_ID: 0x44_Fs_Rec!UdfsRecFsControl+63
    >
    >Followup: MachineOwner
    >
    >-----------------------------------------------------------------------------
    >
    >So, it looks like 2 files:
    >
    >Fs_Rec.sys from loading the 64k Memory Dump
    >
    >and
    >
    >hptpro.sys (Filter Driver if that helps anyone?) using !analyze -v
    >
    >I checked Fs_Rec.sys by doing a file compare on the installed one and
    >the one extracted from the fs_rec.sy_ file on my Windows CD, they were
    >identical, so it's not corrupted and so I think it can't directly be
    >the problem.
    >
    >So, seeing as the Hot Rod Driver is the latest one I did a BIOS update
    >on the controller too and moved it to another PCI slot, but that has
    >made no difference either.
    >
    >Going to Highpoints site lists the same driver version as the one I
    >already have from A-Bits site who made the controller (Neither are
    >WHQL certified) so there is no 'new' driver available other than the
    >one I have already (and am sure I've used) previously.
    >
    >So does anyone more knowledgeable in Windows Debugging shed any light
    >on a course of action please?
    >
    >Thanks,
    >
    >Dan.
    >
    >On Tue, 12 Jul 2005 22:57:01 GMT, Danny <f@tchance.com> wrote:
    >
    >>Thanks for the info, when (not if) it BSOD's again I'll try the info
    >>suggested!
    >>
    >>BTW, Catalyst drivers are always WHQL certified so I doubt it could be
    >>that as these have been installed before with no problem.
    >>
    >>I've always used the standard windows audio drivers with my SB Live
    >>5.1 card too, and never had this problem with them!
    >>
    >>The only other thing I can think of is my Hot Rod 100 PCI Raid
    >>Controller card I've had for a while, when I reinstalled windows I
    >>couldn't rmember which driver I used so found one in a 'drivers'
    >>folder I made to keep all my drivers for my hardware, this wasn't WHQL
    >>though, so after the BSOD I installed the Windows driver for it but it
    >>still gave the same BSOD message!
    >>
    >>Will have to sit and wait for it to BSOD again now!
    >>
    >>On Mon, 11 Jul 2005 15:49:03 -0700, usasma
    >><usasma@discussions.microsoft.com> wrote:
    >>
    >>>Sounds like a driver to me - typical issues are bad hardware, bad drivers,
    >>>incompatible hardware. First, ensure that the Catalyst drivers that you're
    >>>using are WHQL certified - this'll eliminate one of the problem causes.
    >>>Next, update your audio drivers - I say this because an audio file is
    >>>mentioned in the dump rep, and I'm seeing more and more errors due to audio
    >>>drivers than I ever have before. Once again, use WHQL certified drivers if
    >>>available.
    >>>
    >>>If that doesn't work, try this KB article:
    >>>http://support.microsoft.com/kb/q244617/
    >>>
    >>>It's quite a read, but it'll help to identify problem drivers.
    >>>
    >>>"Danny" wrote:
    >>>
    >>>> Not sure how to troubleshoot this error. It appears to be a driver
    >>>> conflict from reading MS Knowledgebase but can't get any sense out of
    >>>> the minidump created:
    >>>>
    >>>> ---- 32 bit Kernel Mini Dump Analysis
    >>>>
    >>>> DUMP_HEADER32:
    >>>> MajorVersion 0000000f
    >>>> MinorVersion 00000a28
    >>>> DirectoryTableBase 11768000
    >>>> PfnDataBase 81053000
    >>>> PsLoadedModuleList 8054c850
    >>>> PsActiveProcessHead 8054e8b8
    >>>> MachineImageType 0000014c
    >>>> NumberProcessors 00000001
    >>>> BugCheckCode 00000044
    >>>> BugCheckParameter1 85ca2c91
    >>>> BugCheckParameter2 00000d61
    >>>> BugCheckParameter3 00000000
    >>>> BugCheckParameter4 00000000
    >>>> PaeEnabled 00000000
    >>>> KdDebuggerDataBlock 8053e7e0
    >>>> MiniDumpFields 00000dff
    >>>>
    >>>> TRIAGE_DUMP32:
    >>>> ServicePackBuild 00000100
    >>>> SizeOfDump 00010000
    >>>> ValidOffset 0000fffc
    >>>> ContextOffset 00000320
    >>>> ExceptionOffset 000007d0
    >>>> MmOffset 00001068
    >>>> UnloadedDriversOffset 000010a0
    >>>> PrcbOffset 00001878
    >>>> ProcessOffset 000024c8
    >>>> ThreadOffset 00002720
    >>>> CallStackOffset 00002978
    >>>> SizeOfCallStack 00000fd0
    >>>> DriverListOffset 00003bd8
    >>>> DriverCount 00000082
    >>>> StringPoolOffset 00006270
    >>>> StringPoolSize 00001208
    >>>> BrokenDriverOffset 00000000
    >>>> TriageOptions 00000041
    >>>> TopOfStack b88fa030
    >>>> DebuggerDataOffset 00003948
    >>>> DebuggerDataSize 00000290
    >>>> DataBlocksOffset 00007478
    >>>> DataBlocksCount 00000003
    >>>>
    >>>>
    >>>> Windows XP Kernel Version 2600 (Service Pack 1) UP Free x86 compatible
    >>>> Kernel base = 0x804d4000 PsLoadedModuleList = 0x8054c850
    >>>> Debug session time: Mon Jul 11 17:53:59 2005
    >>>> System Uptime: 0 days 0:00:24
    >>>> start end module name
    >>>> 804d4000 806c6400 nt Checksum: 001FF5C4 Timestamp: Wed
    >>>> Mar 02 01:33:24 2005 (422517E4)
    >>>>
    >>>> Unloaded modules:
    >>>> f7b2f000 f7b34000 Cdaudio.SYS Timestamp: unavailable (00000000)
    >>>> f7d1f000 f7d22000 Sfloppy.SYS Timestamp: unavailable (00000000)
    >>>>
    >>>> Finished dump check
    >>>>
    >>>>
    >>>> The actual error from the Eventviewer is:
    >>>>
    >>>> Error code 00000044, parameter1 85ca2c91, parameter2 00000d61,
    >>>> parameter3 00000000, parameter4 00000000.
    >>>>
    >>>> How do I go about tracing the problem driver? I have recently
    >>>> reinstalled XP Pro, done all the windows updates but have not yet
    >>>> installed SP2, I'm not convinced I need it.
    >>>>
    >>>> Have installed Catalyst 5.5 for my ATI card as 5.6 caused problems
    >>>> playing WMV files, DirectX 9.0c and Norton Syetmworks 2005, which is
    >>>> the application that always gets corrupted when I reboot after the
    >>>> 0x00000044 stop code forcing me to reinstall Norton Antivirus each
    >>>> time!
    >>>>
    >>>> I've not experienced this problem previously with my system and the
    >>>> same software installed.
    >>>>
    >>>> Any advice please?
    >>>>
  5. Archived from groups: microsoft.public.windowsxp.help_and_support (More info?)

    I'm sure I've found the problem, but not the solution!

    Running Liveupdate in Interactive Mode I selected each update one by
    one and found my machine gave the 0x00000044 error after installing
    this component:

    Symantec Common Driver: SymEvent

    and rebooting windows?

    Can't see anything on Symantecs site about my particlular stop code so
    I'm just skipping this update when doing a liveupdate!

    I deleted/reinstalled Norton and skipped this component and so far no
    problems.

    Now to find out why?

    On Fri, 22 Jul 2005 21:51:10 GMT, Danny <f@tchance.com> wrote:

    >I *THINK* I know what's causing the stop code 0x00000044!
    >
    >I reinstalled windows xp from scratch and put my system back to
    >something like normal. Applied SP1 and all Windows Critical Updates,
    >flashed original BIOS back into my HotRod Controller and used the
    >original driver. Then I installed (as normal) Norton Systemworks 2005
    >and did a Liveupdate and after rebooting I got the dreaded BSOD again!
    >
    >So I used the Norton Removal Tool to uninstall 2005 and I rebooted
    >windows at least 10 times one after the other, no BSOD at all! Then I
    >reinstalled my older 2004 version, and after doing a liveupdate and
    >rebooting I got a BSOD! So it appears to be something that gets
    >installed AFTER doing a Liveupdate that has caused all the trauma, but
    >I can't figure our what or why!
    >
    >So for now I'm manually downloading the Virus Defs and installing them
    >rather than doing a liveupdate which downloads and applies various
    >software updates as I believe one of those is responsible as I've
    >rebooted windows about 4 or 5 times now without a problem.
    >
    >So until I do a Norton Liveupdate my system is fine! Next task is
    >figuring out what component of liveupdate is causing the problem!
    >
    >I think it's going to be a long night/day!
    >
    >On Thu, 21 Jul 2005 14:09:06 GMT, Danny <f@tchance.com> wrote:
    >
    >>Well it's BSOD'ed 3 times when booting today now so installed the
    >>Windows Debugger, installed the Symbols and followed the advice given
    >>and this is what I get:-
    >>
    >>Microsoft (R) Windows Debugger Version 6.5.0003.7
    >>Copyright (c) Microsoft Corporation. All rights reserved.
    >>
    >>
    >>Loading Dump File [C:\WINDOWS\Minidump\Mini072105-03.dmp]
    >>Mini Kernel Dump File: Only registers and stack trace are available
    >>
    >>Symbol search path is: C:\WINDOWS\Symbols
    >>Executable search path is:
    >>Windows XP Kernel Version 2600 (Service Pack 1) UP Free x86 compatible
    >>Product: WinNt, suite: TerminalServer SingleUserTS
    >>Built by: 2600.xpsp2.050301-1526
    >>Kernel base = 0x804d4000 PsLoadedModuleList = 0x8054c850
    >>Debug session time: Thu Jul 21 13:27:58.265 2005 (GMT+1)
    >>System Uptime: 0 days 0:00:24.843
    >>Loading Kernel Symbols
    >>...........................................................................................................................
    >>Loading unloaded module list
    >>..
    >>Loading User Symbols
    >>*******************************************************************************
    >>*
    >>*
    >>* Bugcheck Analysis
    >>*
    >>*
    >>*
    >>*******************************************************************************
    >>
    >>Use !analyze -v to get detailed debugging information.
    >>
    >>BugCheck 44, {859b1ce1, d61, 0, 0}
    >>
    >>*** WARNING: Unable to verify timestamp for hptpro.sys
    >>*** ERROR: Module load completed but symbols could not be loaded for
    >>hptpro.sys
    >>Probably caused by : Fs_Rec.SYS ( Fs_Rec!UdfsRecFsControl+63 )
    >>
    >>Followup: MachineOwner
    >>---------
    >>
    >>kd> !analyze -v
    >>*******************************************************************************
    >>*
    >>*
    >>* Bugcheck Analysis
    >>*
    >>*
    >>*
    >>*******************************************************************************
    >>
    >>MULTIPLE_IRP_COMPLETE_REQUESTS (44)
    >>A driver has requested that an IRP be completed (IoCompleteRequest()),
    >>but
    >>the packet has already been completed. This is a tough bug to find
    >>because
    >>the easiest case, a driver actually attempted to complete its own
    >>packet
    >>twice, is generally not what happened. Rather, two separate drivers
    >>each
    >>believe that they own the packet, and each attempts to complete it.
    >>The
    >>first actually works, and the second fails. Tracking down which
    >>drivers
    >>in the system actually did this is difficult, generally because the
    >>trails
    >>of the first driver have been covered by the second. However, the
    >>driver
    >>stack for the current request can be found by examining the
    >>DeviceObject
    >>fields in each of the stack locations.
    >>Arguments:
    >>Arg1: 859b1ce1, Address of the IRP
    >>Arg2: 00000d61
    >>Arg3: 00000000
    >>Arg4: 00000000
    >>
    >>Debugging Details:
    >>------------------
    >>
    >>
    >>IRP_ADDRESS: 859b1ce1
    >>
    >>CUSTOMER_CRASH_COUNT: 3
    >>
    >>DEFAULT_BUCKET_ID: DRIVER_FAULT
    >>
    >>BUGCHECK_STR: 0x44
    >>
    >>LAST_CONTROL_TRANSFER: from 805179bf to 8052b591
    >>
    >>STACK_TEXT:
    >>b892a048 805179bf 00000044 859b1ce1 00000d61 nt!KeBugCheckEx+0x19
    >>b892a080 f7d4bc57 8608c8f0 f7c439b8 b892a0c8
    >>nt!IopfCompleteRequest+0x2c4
    >>b892a090 f7d4b59e 8608c8f0 859b1ce0 8608cda0
    >>Fs_Rec!UdfsRecFsControl+0x63
    >>b892a0a0 804dfdfd 8608c8f0 859b1ce0 859b1ce0
    >>Fs_Rec!FsRecFsControl+0x5a
    >>b892a0b0 f7c43bbf 85872980 8672d280 8606b820 nt!IopfCallDriver+0x31
    >>WARNING: Stack unwind information not available. Following frames may
    >>be wrong.
    >>b892a0c8 804dfdfd 00000000 85844528 859b1ce0 hptpro+0xbbf
    >>b892a0d8 8058c584 8606b820 806c9158 b892a220 nt!IopfCallDriver+0x31
    >>b892a128 80505ac6 86068150 b892a200 00000000 nt!IopMountVolume+0x1d1
    >>b892a158 8055aa4a b892a420 8606b820 b892a290
    >>nt!IopCheckVpbMounted+0x59
    >>b892a24c 8055253a 8606b820 00000000 858653f0 nt!IopParseDevice+0x3ba
    >>b892a2d0 805557a2 00000000 b892a310 00000040
    >>nt!ObpLookupObjectName+0x56a
    >>b892a324 8055be9a 00000000 00000000 ffffff01
    >>nt!ObOpenObjectByName+0xe9
    >>b892a4a4 804dad01 00bbef6c 00bbef44 b892a4d8
    >>nt!NtQueryAttributesFile+0xe9
    >>b892a4a4 7ffe0304 00bbef6c 00bbef44 b892a4d8 nt!KiSystemService+0xc4
    >>00bbef98 00000000 00000000 00000000 00000000
    >>SharedUserData!SystemCallStub+0x4
    >>
    >>
    >>FOLLOWUP_IP:
    >>Fs_Rec!UdfsRecFsControl+63
    >>f7d4bc57 8bc6 mov eax,esi
    >>
    >>SYMBOL_STACK_INDEX: 2
    >>
    >>FOLLOWUP_NAME: MachineOwner
    >>
    >>SYMBOL_NAME: Fs_Rec!UdfsRecFsControl+63
    >>
    >>MODULE_NAME: Fs_Rec
    >>
    >>IMAGE_NAME: Fs_Rec.SYS
    >>
    >>DEBUG_FLR_IMAGE_TIMESTAMP: 3b7d8361
    >>
    >>STACK_COMMAND: kb
    >>
    >>FAILURE_BUCKET_ID: 0x44_Fs_Rec!UdfsRecFsControl+63
    >>
    >>BUCKET_ID: 0x44_Fs_Rec!UdfsRecFsControl+63
    >>
    >>Followup: MachineOwner
    >>
    >>-----------------------------------------------------------------------------
    >>
    >>So, it looks like 2 files:
    >>
    >>Fs_Rec.sys from loading the 64k Memory Dump
    >>
    >>and
    >>
    >>hptpro.sys (Filter Driver if that helps anyone?) using !analyze -v
    >>
    >>I checked Fs_Rec.sys by doing a file compare on the installed one and
    >>the one extracted from the fs_rec.sy_ file on my Windows CD, they were
    >>identical, so it's not corrupted and so I think it can't directly be
    >>the problem.
    >>
    >>So, seeing as the Hot Rod Driver is the latest one I did a BIOS update
    >>on the controller too and moved it to another PCI slot, but that has
    >>made no difference either.
    >>
    >>Going to Highpoints site lists the same driver version as the one I
    >>already have from A-Bits site who made the controller (Neither are
    >>WHQL certified) so there is no 'new' driver available other than the
    >>one I have already (and am sure I've used) previously.
    >>
    >>So does anyone more knowledgeable in Windows Debugging shed any light
    >>on a course of action please?
    >>
    >>Thanks,
    >>
    >>Dan.
    >>
    >>On Tue, 12 Jul 2005 22:57:01 GMT, Danny <f@tchance.com> wrote:
    >>
    >>>Thanks for the info, when (not if) it BSOD's again I'll try the info
    >>>suggested!
    >>>
    >>>BTW, Catalyst drivers are always WHQL certified so I doubt it could be
    >>>that as these have been installed before with no problem.
    >>>
    >>>I've always used the standard windows audio drivers with my SB Live
    >>>5.1 card too, and never had this problem with them!
    >>>
    >>>The only other thing I can think of is my Hot Rod 100 PCI Raid
    >>>Controller card I've had for a while, when I reinstalled windows I
    >>>couldn't rmember which driver I used so found one in a 'drivers'
    >>>folder I made to keep all my drivers for my hardware, this wasn't WHQL
    >>>though, so after the BSOD I installed the Windows driver for it but it
    >>>still gave the same BSOD message!
    >>>
    >>>Will have to sit and wait for it to BSOD again now!
    >>>
    >>>On Mon, 11 Jul 2005 15:49:03 -0700, usasma
    >>><usasma@discussions.microsoft.com> wrote:
    >>>
    >>>>Sounds like a driver to me - typical issues are bad hardware, bad drivers,
    >>>>incompatible hardware. First, ensure that the Catalyst drivers that you're
    >>>>using are WHQL certified - this'll eliminate one of the problem causes.
    >>>>Next, update your audio drivers - I say this because an audio file is
    >>>>mentioned in the dump rep, and I'm seeing more and more errors due to audio
    >>>>drivers than I ever have before. Once again, use WHQL certified drivers if
    >>>>available.
    >>>>
    >>>>If that doesn't work, try this KB article:
    >>>>http://support.microsoft.com/kb/q244617/
    >>>>
    >>>>It's quite a read, but it'll help to identify problem drivers.
    >>>>
    >>>>"Danny" wrote:
    >>>>
    >>>>> Not sure how to troubleshoot this error. It appears to be a driver
    >>>>> conflict from reading MS Knowledgebase but can't get any sense out of
    >>>>> the minidump created:
    >>>>>
    >>>>> ---- 32 bit Kernel Mini Dump Analysis
    >>>>>
    >>>>> DUMP_HEADER32:
    >>>>> MajorVersion 0000000f
    >>>>> MinorVersion 00000a28
    >>>>> DirectoryTableBase 11768000
    >>>>> PfnDataBase 81053000
    >>>>> PsLoadedModuleList 8054c850
    >>>>> PsActiveProcessHead 8054e8b8
    >>>>> MachineImageType 0000014c
    >>>>> NumberProcessors 00000001
    >>>>> BugCheckCode 00000044
    >>>>> BugCheckParameter1 85ca2c91
    >>>>> BugCheckParameter2 00000d61
    >>>>> BugCheckParameter3 00000000
    >>>>> BugCheckParameter4 00000000
    >>>>> PaeEnabled 00000000
    >>>>> KdDebuggerDataBlock 8053e7e0
    >>>>> MiniDumpFields 00000dff
    >>>>>
    >>>>> TRIAGE_DUMP32:
    >>>>> ServicePackBuild 00000100
    >>>>> SizeOfDump 00010000
    >>>>> ValidOffset 0000fffc
    >>>>> ContextOffset 00000320
    >>>>> ExceptionOffset 000007d0
    >>>>> MmOffset 00001068
    >>>>> UnloadedDriversOffset 000010a0
    >>>>> PrcbOffset 00001878
    >>>>> ProcessOffset 000024c8
    >>>>> ThreadOffset 00002720
    >>>>> CallStackOffset 00002978
    >>>>> SizeOfCallStack 00000fd0
    >>>>> DriverListOffset 00003bd8
    >>>>> DriverCount 00000082
    >>>>> StringPoolOffset 00006270
    >>>>> StringPoolSize 00001208
    >>>>> BrokenDriverOffset 00000000
    >>>>> TriageOptions 00000041
    >>>>> TopOfStack b88fa030
    >>>>> DebuggerDataOffset 00003948
    >>>>> DebuggerDataSize 00000290
    >>>>> DataBlocksOffset 00007478
    >>>>> DataBlocksCount 00000003
    >>>>>
    >>>>>
    >>>>> Windows XP Kernel Version 2600 (Service Pack 1) UP Free x86 compatible
    >>>>> Kernel base = 0x804d4000 PsLoadedModuleList = 0x8054c850
    >>>>> Debug session time: Mon Jul 11 17:53:59 2005
    >>>>> System Uptime: 0 days 0:00:24
    >>>>> start end module name
    >>>>> 804d4000 806c6400 nt Checksum: 001FF5C4 Timestamp: Wed
    >>>>> Mar 02 01:33:24 2005 (422517E4)
    >>>>>
    >>>>> Unloaded modules:
    >>>>> f7b2f000 f7b34000 Cdaudio.SYS Timestamp: unavailable (00000000)
    >>>>> f7d1f000 f7d22000 Sfloppy.SYS Timestamp: unavailable (00000000)
    >>>>>
    >>>>> Finished dump check
    >>>>>
    >>>>>
    >>>>> The actual error from the Eventviewer is:
    >>>>>
    >>>>> Error code 00000044, parameter1 85ca2c91, parameter2 00000d61,
    >>>>> parameter3 00000000, parameter4 00000000.
    >>>>>
    >>>>> How do I go about tracing the problem driver? I have recently
    >>>>> reinstalled XP Pro, done all the windows updates but have not yet
    >>>>> installed SP2, I'm not convinced I need it.
    >>>>>
    >>>>> Have installed Catalyst 5.5 for my ATI card as 5.6 caused problems
    >>>>> playing WMV files, DirectX 9.0c and Norton Syetmworks 2005, which is
    >>>>> the application that always gets corrupted when I reboot after the
    >>>>> 0x00000044 stop code forcing me to reinstall Norton Antivirus each
    >>>>> time!
    >>>>>
    >>>>> I've not experienced this problem previously with my system and the
    >>>>> same software installed.
    >>>>>
    >>>>> Any advice please?
    >>>>>
  6. Archived from groups: microsoft.public.windowsxp.help_and_support (More info?)

    Well I eventually found the reason!

    It's a conflict between hptpro.sys and certain norton components.
    Searching Symantecs site I found reference to a similar error:

    NO_MORE_IRP_STACK_LOCATIONS

    This was for Norton Internet Security 2003 and a HPT370/374 controller
    (I have a 370 controller) and Symantecs solution:

    Solution:
    This problem is due to a conflict between some components of NIS and
    drivers for the HighPoint controller. To resolve the problem, remove
    the HighPoint controller driver, Hptpro.sys. Note that removing the
    driver does not prevent the computer from accessing your IDE devices.

    Seeing as I had already installed an older driver which did not have
    the hptpro.sys file, I installed the Symevent update and have had no
    crashes for the past 4 days! Just to make doubly sure I deleted all
    hptpro.sys files from my system!

    So that was the problem for me, an incompatability with hptpro.sys and
    the updated Symevent driver!

    Funny old things computers!

    On Sat, 23 Jul 2005 00:18:57 GMT, Danny <f@tchance.com> wrote:

    >I'm sure I've found the problem, but not the solution!
    >
    >Running Liveupdate in Interactive Mode I selected each update one by
    >one and found my machine gave the 0x00000044 error after installing
    >this component:
    >
    >Symantec Common Driver: SymEvent
    >
    >and rebooting windows?
    >
    >Can't see anything on Symantecs site about my particlular stop code so
    >I'm just skipping this update when doing a liveupdate!
    >
    >I deleted/reinstalled Norton and skipped this component and so far no
    >problems.
    >
    >Now to find out why?
    >
    >On Fri, 22 Jul 2005 21:51:10 GMT, Danny <f@tchance.com> wrote:
    >
    >>I *THINK* I know what's causing the stop code 0x00000044!
    >>
    >>I reinstalled windows xp from scratch and put my system back to
    >>something like normal. Applied SP1 and all Windows Critical Updates,
    >>flashed original BIOS back into my HotRod Controller and used the
    >>original driver. Then I installed (as normal) Norton Systemworks 2005
    >>and did a Liveupdate and after rebooting I got the dreaded BSOD again!
    >>
    >>So I used the Norton Removal Tool to uninstall 2005 and I rebooted
    >>windows at least 10 times one after the other, no BSOD at all! Then I
    >>reinstalled my older 2004 version, and after doing a liveupdate and
    >>rebooting I got a BSOD! So it appears to be something that gets
    >>installed AFTER doing a Liveupdate that has caused all the trauma, but
    >>I can't figure our what or why!
    >>
    >>So for now I'm manually downloading the Virus Defs and installing them
    >>rather than doing a liveupdate which downloads and applies various
    >>software updates as I believe one of those is responsible as I've
    >>rebooted windows about 4 or 5 times now without a problem.
    >>
    >>So until I do a Norton Liveupdate my system is fine! Next task is
    >>figuring out what component of liveupdate is causing the problem!
    >>
    >>I think it's going to be a long night/day!
    >>
    >>On Thu, 21 Jul 2005 14:09:06 GMT, Danny <f@tchance.com> wrote:
    >>
    >>>Well it's BSOD'ed 3 times when booting today now so installed the
    >>>Windows Debugger, installed the Symbols and followed the advice given
    >>>and this is what I get:-
    >>>
    >>>Microsoft (R) Windows Debugger Version 6.5.0003.7
    >>>Copyright (c) Microsoft Corporation. All rights reserved.
    >>>
    >>>
    >>>Loading Dump File [C:\WINDOWS\Minidump\Mini072105-03.dmp]
    >>>Mini Kernel Dump File: Only registers and stack trace are available
    >>>
    >>>Symbol search path is: C:\WINDOWS\Symbols
    >>>Executable search path is:
    >>>Windows XP Kernel Version 2600 (Service Pack 1) UP Free x86 compatible
    >>>Product: WinNt, suite: TerminalServer SingleUserTS
    >>>Built by: 2600.xpsp2.050301-1526
    >>>Kernel base = 0x804d4000 PsLoadedModuleList = 0x8054c850
    >>>Debug session time: Thu Jul 21 13:27:58.265 2005 (GMT+1)
    >>>System Uptime: 0 days 0:00:24.843
    >>>Loading Kernel Symbols
    >>>...........................................................................................................................
    >>>Loading unloaded module list
    >>>..
    >>>Loading User Symbols
    >>>*******************************************************************************
    >>>*
    >>>*
    >>>* Bugcheck Analysis
    >>>*
    >>>*
    >>>*
    >>>*******************************************************************************
    >>>
    >>>Use !analyze -v to get detailed debugging information.
    >>>
    >>>BugCheck 44, {859b1ce1, d61, 0, 0}
    >>>
    >>>*** WARNING: Unable to verify timestamp for hptpro.sys
    >>>*** ERROR: Module load completed but symbols could not be loaded for
    >>>hptpro.sys
    >>>Probably caused by : Fs_Rec.SYS ( Fs_Rec!UdfsRecFsControl+63 )
    >>>
    >>>Followup: MachineOwner
    >>>---------
    >>>
    >>>kd> !analyze -v
    >>>*******************************************************************************
    >>>*
    >>>*
    >>>* Bugcheck Analysis
    >>>*
    >>>*
    >>>*
    >>>*******************************************************************************
    >>>
    >>>MULTIPLE_IRP_COMPLETE_REQUESTS (44)
    >>>A driver has requested that an IRP be completed (IoCompleteRequest()),
    >>>but
    >>>the packet has already been completed. This is a tough bug to find
    >>>because
    >>>the easiest case, a driver actually attempted to complete its own
    >>>packet
    >>>twice, is generally not what happened. Rather, two separate drivers
    >>>each
    >>>believe that they own the packet, and each attempts to complete it.
    >>>The
    >>>first actually works, and the second fails. Tracking down which
    >>>drivers
    >>>in the system actually did this is difficult, generally because the
    >>>trails
    >>>of the first driver have been covered by the second. However, the
    >>>driver
    >>>stack for the current request can be found by examining the
    >>>DeviceObject
    >>>fields in each of the stack locations.
    >>>Arguments:
    >>>Arg1: 859b1ce1, Address of the IRP
    >>>Arg2: 00000d61
    >>>Arg3: 00000000
    >>>Arg4: 00000000
    >>>
    >>>Debugging Details:
    >>>------------------
    >>>
    >>>
    >>>IRP_ADDRESS: 859b1ce1
    >>>
    >>>CUSTOMER_CRASH_COUNT: 3
    >>>
    >>>DEFAULT_BUCKET_ID: DRIVER_FAULT
    >>>
    >>>BUGCHECK_STR: 0x44
    >>>
    >>>LAST_CONTROL_TRANSFER: from 805179bf to 8052b591
    >>>
    >>>STACK_TEXT:
    >>>b892a048 805179bf 00000044 859b1ce1 00000d61 nt!KeBugCheckEx+0x19
    >>>b892a080 f7d4bc57 8608c8f0 f7c439b8 b892a0c8
    >>>nt!IopfCompleteRequest+0x2c4
    >>>b892a090 f7d4b59e 8608c8f0 859b1ce0 8608cda0
    >>>Fs_Rec!UdfsRecFsControl+0x63
    >>>b892a0a0 804dfdfd 8608c8f0 859b1ce0 859b1ce0
    >>>Fs_Rec!FsRecFsControl+0x5a
    >>>b892a0b0 f7c43bbf 85872980 8672d280 8606b820 nt!IopfCallDriver+0x31
    >>>WARNING: Stack unwind information not available. Following frames may
    >>>be wrong.
    >>>b892a0c8 804dfdfd 00000000 85844528 859b1ce0 hptpro+0xbbf
    >>>b892a0d8 8058c584 8606b820 806c9158 b892a220 nt!IopfCallDriver+0x31
    >>>b892a128 80505ac6 86068150 b892a200 00000000 nt!IopMountVolume+0x1d1
    >>>b892a158 8055aa4a b892a420 8606b820 b892a290
    >>>nt!IopCheckVpbMounted+0x59
    >>>b892a24c 8055253a 8606b820 00000000 858653f0 nt!IopParseDevice+0x3ba
    >>>b892a2d0 805557a2 00000000 b892a310 00000040
    >>>nt!ObpLookupObjectName+0x56a
    >>>b892a324 8055be9a 00000000 00000000 ffffff01
    >>>nt!ObOpenObjectByName+0xe9
    >>>b892a4a4 804dad01 00bbef6c 00bbef44 b892a4d8
    >>>nt!NtQueryAttributesFile+0xe9
    >>>b892a4a4 7ffe0304 00bbef6c 00bbef44 b892a4d8 nt!KiSystemService+0xc4
    >>>00bbef98 00000000 00000000 00000000 00000000
    >>>SharedUserData!SystemCallStub+0x4
    >>>
    >>>
    >>>FOLLOWUP_IP:
    >>>Fs_Rec!UdfsRecFsControl+63
    >>>f7d4bc57 8bc6 mov eax,esi
    >>>
    >>>SYMBOL_STACK_INDEX: 2
    >>>
    >>>FOLLOWUP_NAME: MachineOwner
    >>>
    >>>SYMBOL_NAME: Fs_Rec!UdfsRecFsControl+63
    >>>
    >>>MODULE_NAME: Fs_Rec
    >>>
    >>>IMAGE_NAME: Fs_Rec.SYS
    >>>
    >>>DEBUG_FLR_IMAGE_TIMESTAMP: 3b7d8361
    >>>
    >>>STACK_COMMAND: kb
    >>>
    >>>FAILURE_BUCKET_ID: 0x44_Fs_Rec!UdfsRecFsControl+63
    >>>
    >>>BUCKET_ID: 0x44_Fs_Rec!UdfsRecFsControl+63
    >>>
    >>>Followup: MachineOwner
    >>>
    >>>-----------------------------------------------------------------------------
    >>>
    >>>So, it looks like 2 files:
    >>>
    >>>Fs_Rec.sys from loading the 64k Memory Dump
    >>>
    >>>and
    >>>
    >>>hptpro.sys (Filter Driver if that helps anyone?) using !analyze -v
    >>>
    >>>I checked Fs_Rec.sys by doing a file compare on the installed one and
    >>>the one extracted from the fs_rec.sy_ file on my Windows CD, they were
    >>>identical, so it's not corrupted and so I think it can't directly be
    >>>the problem.
    >>>
    >>>So, seeing as the Hot Rod Driver is the latest one I did a BIOS update
    >>>on the controller too and moved it to another PCI slot, but that has
    >>>made no difference either.
    >>>
    >>>Going to Highpoints site lists the same driver version as the one I
    >>>already have from A-Bits site who made the controller (Neither are
    >>>WHQL certified) so there is no 'new' driver available other than the
    >>>one I have already (and am sure I've used) previously.
    >>>
    >>>So does anyone more knowledgeable in Windows Debugging shed any light
    >>>on a course of action please?
    >>>
    >>>Thanks,
    >>>
    >>>Dan.
    >>>
    >>>On Tue, 12 Jul 2005 22:57:01 GMT, Danny <f@tchance.com> wrote:
    >>>
    >>>>Thanks for the info, when (not if) it BSOD's again I'll try the info
    >>>>suggested!
    >>>>
    >>>>BTW, Catalyst drivers are always WHQL certified so I doubt it could be
    >>>>that as these have been installed before with no problem.
    >>>>
    >>>>I've always used the standard windows audio drivers with my SB Live
    >>>>5.1 card too, and never had this problem with them!
    >>>>
    >>>>The only other thing I can think of is my Hot Rod 100 PCI Raid
    >>>>Controller card I've had for a while, when I reinstalled windows I
    >>>>couldn't rmember which driver I used so found one in a 'drivers'
    >>>>folder I made to keep all my drivers for my hardware, this wasn't WHQL
    >>>>though, so after the BSOD I installed the Windows driver for it but it
    >>>>still gave the same BSOD message!
    >>>>
    >>>>Will have to sit and wait for it to BSOD again now!
    >>>>
    >>>>On Mon, 11 Jul 2005 15:49:03 -0700, usasma
    >>>><usasma@discussions.microsoft.com> wrote:
    >>>>
    >>>>>Sounds like a driver to me - typical issues are bad hardware, bad drivers,
    >>>>>incompatible hardware. First, ensure that the Catalyst drivers that you're
    >>>>>using are WHQL certified - this'll eliminate one of the problem causes.
    >>>>>Next, update your audio drivers - I say this because an audio file is
    >>>>>mentioned in the dump rep, and I'm seeing more and more errors due to audio
    >>>>>drivers than I ever have before. Once again, use WHQL certified drivers if
    >>>>>available.
    >>>>>
    >>>>>If that doesn't work, try this KB article:
    >>>>>http://support.microsoft.com/kb/q244617/
    >>>>>
    >>>>>It's quite a read, but it'll help to identify problem drivers.
    >>>>>
    >>>>>"Danny" wrote:
    >>>>>
    >>>>>> Not sure how to troubleshoot this error. It appears to be a driver
    >>>>>> conflict from reading MS Knowledgebase but can't get any sense out of
    >>>>>> the minidump created:
    >>>>>>
    >>>>>> ---- 32 bit Kernel Mini Dump Analysis
    >>>>>>
    >>>>>> DUMP_HEADER32:
    >>>>>> MajorVersion 0000000f
    >>>>>> MinorVersion 00000a28
    >>>>>> DirectoryTableBase 11768000
    >>>>>> PfnDataBase 81053000
    >>>>>> PsLoadedModuleList 8054c850
    >>>>>> PsActiveProcessHead 8054e8b8
    >>>>>> MachineImageType 0000014c
    >>>>>> NumberProcessors 00000001
    >>>>>> BugCheckCode 00000044
    >>>>>> BugCheckParameter1 85ca2c91
    >>>>>> BugCheckParameter2 00000d61
    >>>>>> BugCheckParameter3 00000000
    >>>>>> BugCheckParameter4 00000000
    >>>>>> PaeEnabled 00000000
    >>>>>> KdDebuggerDataBlock 8053e7e0
    >>>>>> MiniDumpFields 00000dff
    >>>>>>
    >>>>>> TRIAGE_DUMP32:
    >>>>>> ServicePackBuild 00000100
    >>>>>> SizeOfDump 00010000
    >>>>>> ValidOffset 0000fffc
    >>>>>> ContextOffset 00000320
    >>>>>> ExceptionOffset 000007d0
    >>>>>> MmOffset 00001068
    >>>>>> UnloadedDriversOffset 000010a0
    >>>>>> PrcbOffset 00001878
    >>>>>> ProcessOffset 000024c8
    >>>>>> ThreadOffset 00002720
    >>>>>> CallStackOffset 00002978
    >>>>>> SizeOfCallStack 00000fd0
    >>>>>> DriverListOffset 00003bd8
    >>>>>> DriverCount 00000082
    >>>>>> StringPoolOffset 00006270
    >>>>>> StringPoolSize 00001208
    >>>>>> BrokenDriverOffset 00000000
    >>>>>> TriageOptions 00000041
    >>>>>> TopOfStack b88fa030
    >>>>>> DebuggerDataOffset 00003948
    >>>>>> DebuggerDataSize 00000290
    >>>>>> DataBlocksOffset 00007478
    >>>>>> DataBlocksCount 00000003
    >>>>>>
    >>>>>>
    >>>>>> Windows XP Kernel Version 2600 (Service Pack 1) UP Free x86 compatible
    >>>>>> Kernel base = 0x804d4000 PsLoadedModuleList = 0x8054c850
    >>>>>> Debug session time: Mon Jul 11 17:53:59 2005
    >>>>>> System Uptime: 0 days 0:00:24
    >>>>>> start end module name
    >>>>>> 804d4000 806c6400 nt Checksum: 001FF5C4 Timestamp: Wed
    >>>>>> Mar 02 01:33:24 2005 (422517E4)
    >>>>>>
    >>>>>> Unloaded modules:
    >>>>>> f7b2f000 f7b34000 Cdaudio.SYS Timestamp: unavailable (00000000)
    >>>>>> f7d1f000 f7d22000 Sfloppy.SYS Timestamp: unavailable (00000000)
    >>>>>>
    >>>>>> Finished dump check
    >>>>>>
    >>>>>>
    >>>>>> The actual error from the Eventviewer is:
    >>>>>>
    >>>>>> Error code 00000044, parameter1 85ca2c91, parameter2 00000d61,
    >>>>>> parameter3 00000000, parameter4 00000000.
    >>>>>>
    >>>>>> How do I go about tracing the problem driver? I have recently
    >>>>>> reinstalled XP Pro, done all the windows updates but have not yet
    >>>>>> installed SP2, I'm not convinced I need it.
    >>>>>>
    >>>>>> Have installed Catalyst 5.5 for my ATI card as 5.6 caused problems
    >>>>>> playing WMV files, DirectX 9.0c and Norton Syetmworks 2005, which is
    >>>>>> the application that always gets corrupted when I reboot after the
    >>>>>> 0x00000044 stop code forcing me to reinstall Norton Antivirus each
    >>>>>> time!
    >>>>>>
    >>>>>> I've not experienced this problem previously with my system and the
    >>>>>> same software installed.
    >>>>>>
    >>>>>> Any advice please?
    >>>>>>
Ask a new question

Read More

Windows XP