BSOD help

Hal.dll is Windows' Hardware Abstraction Layer, or HAL. The HAL implements a number of functions that are implemented in different ways by different hardware platforms, which in this context, refers mostly to the Chipset. Other components in the operating system can then call these functions in the same way on all platforms, without regard for the actual implementation. For example, responding to an interrupt is quite different on a machine with an APIC (Advanced Programmable Interrupt Controller) than on one without. The HAL abstracts such differences so that nothing outside the HAL need be concerned with them.

Microsoft Windows library files - Wikipedia, the free encyclopedia

Just as USBPORT.SYS is a Windows system file, so is hal.dll. Neither are very likely to be the real cause. In a dump analysis, either by WinDbug or BlueScreeView, the algorithms have to have a probably cause. If the dump program does not "see" the actualy cause, a Windows system file gets the blame. However, there is more to look at in the dump than just the probably cause line. One can examine the stacks, unloaded modules, etc, for further clues. Most of us here use WinDbug because we find it to be more accurate and more thorough. BlueScreenView is improving all the time. BlueScreenView and WinDbg both show the same bugcheck code, A.

In your latest dump, the stack shows USBPORT.SYS and USB drivers are shown as unloaded modules, which means they were uloaded from memory during the crash. From that we know something was going on with USB; what we don't know is what that something is. Out of date drivers can conflict with USB as can third party security programs. Obviously, hardware can cause it.

I hope this explanation helps.

I suggest that you start with step one. If you find through the clean boot method that you have a driver or hardware probem, it will save a lot of hassle. Step 2 is time consuming.

You can test your graphics card with Furmark following the instructions in this tutorial: Video Card - Stress Test with Furmark. I really don't have a lot of confidence in this test; but it does sometimes shows a bad graphics card. Give it a try.

Great hardware trouble shooting Carl.

fishlipsboy said:

I have a keyboard, mouse, webcam through the keyboard, ipod cable, receiver for wireless joystick, a 4 port hub that has a printer plugged into it.

I'll start on step 2.

I've attached what BlueScreenView was providing me. Just wondering why the dump points to the USB driver, but BlueScreenView says hal.dll? If you could explain it to me, that would be great. Just trying to learn and understand better. Thanks.

When using the hardware trouble shooting giude linked by Carl, as mentioned in #6 you need to disconnect all USB devices. You will need to borrow, or if you have, a PS/2 keyboard and mouse for this test.
If you have no crashes with no USB device connected, enable USB in BIOS and test with one USB device connected at a time.
If you still can't isolate the cause, connect all devices and then disconnect one at a time to find the cause.

I have seen USB devices causing crashes like yours including, keyboard, mouse, joysticks, etc. and even cables.

Be thorough, one of the above USB devices could be the cause.

Thank you, Dave.

When using the hardware trouble shooting giude linked by Carl, as mentioned in #6 you need to disconnect all USB devices. You will need to borrow, or if you have, a PS/2 keyboard and mouse for this test.
If you have no crashes with no USB device connected, enable USB in BIOS and test with one USB device connected at a time.
If you still can't isolate the cause, connect all devices and then disconnect one at a time to find the cause.

I have seen USB devices causing crashes like yours including, keyboard, mouse, joysticks, etc. and even cables.

Be thorough, one of the above USB devices could be the cause.

This is spot on advice.

Given that two of the app crashers are explorer.exe and one is taskhost.exe leads me to suspect a hardware problem. The dump is a memory management bugcheck and blames one of the Windows system core files. Do you not have a separate PS/2 port for a mouse and one for a keyboard?

Nope, I only have one PS/2 port. See.

Just got another dump too. Attaching it.

That makes it a little more difficult in that you won't be able to disable USB in BIOs. But you can try first your your USB keyboard and then your USB mouse as the only USB device plugged in.

Your dump is another bugcheck 1E blaming a Windows system core file. It does not tell us anything new.

Code:

Windows 7 Kernel Version 7600 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16617.amd64fre.win7_gdr.100618-1621
Machine Name:
Kernel base = 0xfffff800`02c15000 PsLoadedModuleList = 0xfffff800`02e52e50
Debug session time: Sun Feb  6 17:42:59.225 2011 (GMT-5)
System Uptime: 0 days 2:44:16.988
Loading Kernel Symbols
...............................................................
................................................................
...............................
Loading User Symbols
Loading unloaded module list
..........
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1E, {0, 0, 0, 0}

Probably caused by : ntkrnlmp.exe ( nt!KiKernelCalloutExceptionHandler+e )

Followup: MachineOwner
---------

2: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

KMODE_EXCEPTION_NOT_HANDLED (1e)
This is a very common bugcheck.  Usually the exception address pinpoints
the driver/function that caused the problem.  Always note this address
as well as the link date of the driver/image that contains this address.
Arguments:
Arg1: 0000000000000000, The exception code that was not handled
Arg2: 0000000000000000, The address that the exception occurred at
Arg3: 0000000000000000, Parameter 0 of the exception
Arg4: 0000000000000000, Parameter 1 of the exception

Debugging Details:
------------------


EXCEPTION_CODE: (Win32) 0 (0) - The operation completed successfully.

FAULTING_IP: 
+605b952f01b6d8bc
00000000`00000000 ??              ???

EXCEPTION_PARAMETER1:  0000000000000000

EXCEPTION_PARAMETER2:  0000000000000000

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0x1E

PROCESS_NAME:  System

CURRENT_IRQL:  0

EXCEPTION_RECORD:  fffff88002d8ca68 -- (.exr 0xfffff88002d8ca68)
ExceptionAddress: fffff80002c932c1 (nt!PoIdle+0x00000000000005b1)
   ExceptionCode: c0000005 (Access violation)
  ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 0000000000000000
   Parameter[1]: ffffffffffffffff
Attempt to read from address ffffffffffffffff

TRAP_FRAME:  fffff88002d8cb10 -- (.trap 0xfffff88002d8cb10)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000732553e9a rbx=0000000000000000 rcx=0000000000000000
rdx=fffffa8008157888 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80002c932c1 rsp=fffff88002d8cca0 rbp=0000000000000000
 r8=0000000000000000  r9=0000000721a7d5cb r10=0000000000021ad3
r11=fffff88002d64180 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl zr na po nc
nt!PoIdle+0x5b1:
fffff800`02c932c1 ff15198f1200    call    qword ptr [nt!_imp_KeQueryPerformanceCounter (fffff800`02dbc1e0)] ds:a42d:fffff800`02dbc1e0=00000000005a28e6
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff80002c7d46e to fffff80002c85710

STACK_TEXT:  
fffff880`02d8bb58 fffff800`02c7d46e : fffff880`02d8bb58 fffffa80`078b3b40 fffff880`02d8c2d0 fffff800`02cb2668 : nt!KeBugCheck
fffff880`02d8bb60 fffff800`02cab40d : fffff800`02e93edc fffff800`02dccdac fffff800`02c15000 fffff880`02d8ca68 : nt!KiKernelCalloutExceptionHandler+0xe
fffff880`02d8bb90 fffff800`02cb2a90 : fffff800`02dd4b14 fffff880`02d8bc08 fffff880`02d8ca68 fffff800`02c15000 : nt!RtlpExecuteHandlerForException+0xd
fffff880`02d8bbc0 fffff800`02cbf9ef : fffff880`02d8ca68 fffff880`02d8c2d0 fffff880`00000000 00000000`00000001 : nt!RtlDispatchException+0x410
fffff880`02d8c2a0 fffff800`02c84d82 : fffff880`02d8ca68 00000000`00000000 fffff880`02d8cb10 fffff880`02d64180 : nt!KiDispatchException+0x16f
fffff880`02d8c930 fffff800`02c8368a : fffff880`02d64180 00000000`00000001 fffffa80`0811bf30 00001f80`00000000 : nt!KiExceptionDispatch+0xc2
fffff880`02d8cb10 fffff800`02c932c1 : 00000000`002fd892 fffffa80`080df418 fffff880`02d6efc0 00000000`00000001 : nt!KiGeneralProtectionFault+0x10a
fffff880`02d8cca0 fffff800`02c8debc : fffff880`02d64180 fffff880`00000000 00000000`00000000 fffff880`03e52db0 : nt!PoIdle+0x5b1
fffff880`02d8cd80 00000000`00000000 : fffff880`02d8d000 fffff880`02d87000 fffff880`02d8cd40 00000000`00000000 : nt!KiIdleLoop+0x2c


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt!KiKernelCalloutExceptionHandler+e
fffff800`02c7d46e 90              nop

SYMBOL_STACK_INDEX:  1

SYMBOL_NAME:  nt!KiKernelCalloutExceptionHandler+e

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  4c1c44a9

FAILURE_BUCKET_ID:  X64_0x1E_nt!KiKernelCalloutExceptionHandler+e

BUCKET_ID:  X64_0x1E_nt!KiKernelCalloutExceptionHandler+e

Followup: MachineOwner
---------