Help with Crash Dump XPsp2

[teqmod]

I have a XP machine that was recently updated to SP2 and now occaisionally when an external firewire drive is removed from the system the machine will crash. They are Maxtor drives and not always the same drive that crashes the machine. I have reloaded the drivers and the Maxtor software with no luck. Here is the dump analysis:

*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

SYSTEM_THREAD_EXCEPTION_NOT_HANDLED (7e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Arguments:
Arg1: c0000005, The exception code that was not handled
Arg2: f7669515, The address that the exception occurred at
Arg3: f78d6c00, Exception Record Address
Arg4: f78d68fc, Context Record Address

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx". The memory could not be "%s".

FAULTING_IP:
1394BUS!Bus1394IOCtl+737
f7669515 f3a5 rep movsd

EXCEPTION_RECORD: f78d6c00 -- (.exr fffffffff78d6c00)
ExceptionAddress: f7669515 (1394BUS!Bus1394IOCtl+0x00000737)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 00000000
Parameter[1]: 00000000
Attempt to read from address 00000000

CONTEXT: f78d68fc -- (.cxr fffffffff78d68fc)
eax=00000018 ebx=88d4fea8 ecx=00000006 edx=886cd200 esi=00000000 edi=899f9700
eip=f7669515 esp=f78d6cc8 ebp=f78d6ce4 iopl=0 nv up ei pl nz na po nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010206
1394BUS!Bus1394IOCtl+0x737:
f7669515 f3a5 rep movsd ds:00000000=???????? es:899f9700=306f0404
Resetting default scope

ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx". The memory could not be "%s".

READ_ADDRESS: 00000000

BUGCHECK_STR: 0x7E

DEFAULT_BUCKET_ID: NULL_DEREFERENCE

LAST_CONTROL_TRANSFER: from 804e37f7 to f7669515

STACK_TEXT:
f78d6ce4 804e37f7 8ad81008 88210308 88210308 1394BUS!Bus1394IOCtl+0x737
f78d6cf4 b595c0c3 899f9728 899f95c8 00040001 nt!IopfCallDriver+0x31
WARNING: Stack unwind information not available. Following frames may be wrong.
f78d6d14 b595c20e 899f95c8 88210308 88d4fea8 mxofwfp+0x10c3
f78d6d34 b595cb6f 00000000 88210308 88bc0ac0 mxofwfp+0x120e
00000000 00000000 00000000 00000000 00000000 mxofwfp+0x1b6f


STACK_COMMAND: .bugcheck ; kb

FOLLOWUP_IP:
1394BUS!Bus1394IOCtl+737
f7669515 f3a5 rep movsd

FAULTING_SOURCE_CODE:


SYMBOL_STACK_INDEX: 0

FOLLOWUP_NAME: MachineOwner

SYMBOL_NAME: 1394BUS!Bus1394IOCtl+737

MODULE_NAME: 1394BUS

IMAGE_NAME: 1394BUS.SYS

DEBUG_FLR_IMAGE_TIMESTAMP: 41107dbb

FAILURE_BUCKET_ID: 0x7E_1394BUS!Bus1394IOCtl+737

BUCKET_ID: 0x7E_1394BUS!Bus1394IOCtl+737

Followup: MachineOwner
---------

Any help would be greatly appreciated.

 

[noobtechie]

Go to this link

http://support.microsoft.com/?kbid=315263

download and install the tool and point it to memory dump. You might need to read on how to use it in the help menu.

============================
Hope this helps.

 

[teqmod]

That tool is where I got the above output.

I just cannot decipher it enough to resolve the problem. The drives are connected via firewire, it seems the issue is with 1394BUS.sys which I was assuming might be the firewire drivers so I reloaded the driver with no results. Google has been no help either.

 

[noobtechie]

When you remove the firewire, do you unplug it or right click on the USB icon on the bottom right hand corner/stop/remove process?

http://www.windll.com/sys-0_000.php

============================
Hope this helps.

 

[linney]

Have you checked for updated drivers or software at the Maxter's Web Site?

The file version I have is 5.1.2600.2180, 52.0 KB (53,248 bytes) it is a Microsoft file. It resides in C:\WINDOWS\Driver Cache\i386\sp2.cab and can be Extracted from there to its final location which may be the System32 (or System32/Drivers) folder, or wherever it is currently installed on your machine. I don't have it anywhere else on this machine as I probably don't use it, not having the necessary hardware.

Surprise removal of 1394 device can cause bluescreen error

http://support.microsoft.com/kb/811789/en-us?FR=1&PA=1&SD=HSCH

These threads will lead you in to the higher level of Debugging if you want to go down that path.

Getting more friendly logs from Drwatson.
thread779-947690

Windows Debugger, part of Never-Ending-Problem
thread779-1064535

How to enable verbose debug tracing in various drivers and subsystems

http://support.microsoft.com/kb/314743/en-us?FR=1&PA=1&SD=HSCH

 

[teqmod]

I will contact MS for this I guess. This user says she always ejects it using the icon in the task bar but who knows. That seems like the best first step. I will let you know what happens with it.

 

[teqmod]

I have been on the phone with Dell and MS for an hour and a half now. Microsoft sent me to Dell since this is a factory installed OS. Now Dell has contacted MS and I am on hold while they try to resolve the issue and keep coming back for more information. This is unbelievable.

 

[teqmod]

OK I have hte patch now and will give it a try first thing tomorrow. I now know where to call in Microsoft to get through. I eventually found it on their site so I guess that is my ignorance that caused the extensive time on the phone today.

I will update whether or not it worked and fixed the issue.

 

[linney]

Two questions which may help others. Where do you call in Microsoft, and what patch are you referring to?

Do keep us informed, I hope it all works out for you.

 

[teqmod]

Well the patch outlined in the KB article was for machines without SP2 so that did not resolve my issue. MS also seemed a little off since the article was for a camera being disconnected and not a hard drive. The guy was kind of an a$$. What I have done is went ahead and grabbed the old 1394bus.sys file and put it back since the problem did not occur until SP2 was installed. No problems reported yet but this was done on Saturday and no one was working.

Linney,
To contact MS for a patch the number to call is 800-936-4900 and select opt. 2. I called the main number I saw listed on their site and was thrown all around. That was my mistake, if I had read through the support sites more I would have found the number I listed above.

I was referring to the patch in the link above KB 811789. This is one of the "Restricted Patches" you need to call to get.

 

[directlyconnected]

I had similar issues with sound card drivers. Have you tried the firewire manufacturer for this problem? Or is it integrated on the motherboard (in which case it would be the mobo manufacturer)? Try disconnecting the drive without stopping it via the system tray thing first. If this is causing the lockup, then it should do it every time. If not, then I would not look at that as a culprit anymore. When you right click on My Computer, or go to System in Control Panel, in the Advanced tab, under Startup and Recovery, do you have Automatically Restart unchecked? If you do not, you won't get the BSOD---with it unchecked, this will give you the blue screen of death, along with the error code that you can Google. In case you have done that already and I sound stupid, I apologize. If not, well them try that. If this is an HP machine with SP2, good luck!