Hi there! I'm from the UK but currently over in Spain trying to sort out my dad's XP2 SP2 PC, which keeps crashing. I'm only here until tomorrow morning so it's very urgent!

HISTORY OF PROBLEM
About five months ago, XP would restart after my dad shuts down (and would, as a result, not allow Windows Update to do its job properly. Weird. He went into Services, went to terminal services, changed to Startup type to disabled or manual, and this problem went away.

However, as soon as he did this, and ever since, almost every time you shut down (but not every time), you get the BSOD. Has nothing to do with how long PC has been on or anything.

The BSOD would be of the INVALID_WORK_QUEUE_ITEM type, telling you to remove any newly installed hardware (none had been installed at the time, although in the past five months a number of updates will have been installed), and if problems continue to disable new hardware/software (none), disable BIOS memory, blahdiblah (you know the screen I mean). Technical info is typically something like STOP 0x00000096 (0x8509E6C, 0x80561440, 0x80561440, 0xF7684BF0, with message
NDIS.sys - Address F7684BF0 base at F767E000, DateStamp 41107ec3

This is not the latest BSOD message, but one I copied down earlier.

On restarting, a Minidump is created. Although it says it saves the Minidump in Local Settings Temp it doesn´t (found some older Minidumps in there but not the latest). However, it does save the Minidump in Windows\Minidump.

Ran a debugging report on a typical Minidump... Not exactly sure what to do next. I'm only in Spain until tomorrow and won't be back for some time, so want to try and fix it now. Am hoping that a reinstall of Windows XP won't be necessary, as the time involved to then do all the MS updates etc on this connection sounds pretty timeconsuming....

Here's the report, anyway.... I haven't checked yet whether the debuglog.txt is the same on all the previous days' Minidumps.... that'll be my next job if this doesn't answer the question.....

Likewise, if you think that the problem is not a serious one (ie, the BSOD and resulting error report is a mere inconvenience, cannot harm the PC data, and is unlikely to get worse, we'd rather leave it and live with it than reinstall XP; however, if it could get worse then let us know. Ta!)

************************************************** *****************************
* *
* Bugcheck Analysis *
* *
************************************************** *****************************

INVALID_WORK_QUEUE_ITEM (96)
This message occurs when KeRemoveQueue removes a queue entry whose flink
or blink field is null. This is almost always called by code misusing
worker thread work items, but any queue misuse can cause this. The rule
is that an entry on a queue may only be inserted on the list once. When an
item is removed from a queue, it's flink field is set to NULL. This bugcheck
occurs when remove queue attempts to remove an entry, but the flink or blink
field is NULL. In order to debug this problem, you need to know the queue being
referenced.
In an attempt to help identify the guilty driver, this bugcheck assumes the
queue is a worker queue (ExWorkerQueue) and prints the worker routine as
parameter 4 below.
Arguments:
Arg1: 84f7263c, The address of the queue entry whose flink/blink field is NULL
Arg2: 80561440, The address of the queue being references. Usually this is one
of the ExWorkerQueues.
Arg3: 80561440, The base address of the ExWorkerQueue array. This will help determine
if the queue in question is an ExWorkerQueue and if so, the offset from
this parameter will isolate the queue.
Arg4: f7684bf0, If this is an ExWorkerQueue (which it usually is), this is the address
of the worker routine that would have been called if the work item was
valid. This can be used to isolate the driver that is misusing the work
queue.

Debugging Details:
------------------

ANALYSIS: Kernel with unknown size. Will force reload symbols with known size.
ANALYSIS: Force reload command: .reload /f ntoskrnl.exe=FFFFFFFF804D7000,213F80,42250FF9

Is this a stand alone computer? No network? Are there multiple Users?

Fast User Switching (if enabled) depends on Terminal Services. This is just a possible conflict if Terminal Services was disabled and Fast User Switching enabled.

I would set Terminal Services to Manual which is default.

Otherwise we would get into tracing drivers which probably cannot be done quickly.

There are two approaches here: Install Support Tools from the XP CD or download HERE to trace your drivers with pstat from a command prompt; and or Run verifier from start/run. (verifier does not require the installation of the support tools).

http://articles.techrepublic.com.com...-5714091.html#