TechSpot

5 Minidumps decrypted. Please help read them

By Takin_a_Dump
Oct 4, 2006
  1. I decrypted 5 minidumps, but I can't see what is the cause of my BSOD's.

    My computer will just take a dump every now and then, and its really annoying.

    Can someone tell me what's causing this?

    5 Decrypted Minidumps attached.


    Here's the top of one of them.



    Opened log file 'c:\mini2.txt'
    3: kd> .sympath srv*c:\symbols*http://msdl.microsoft.com/download/symbols
    Symbol search path is: srv*c:\symbols*http://msdl.microsoft.com/download/symbols
    3: kd> .reload;!analyze -v;r;kv;lmnt;.logclose;q
    Loading Kernel Symbols
    ...................................................................................................................................
    Loading User Symbols
    Loading unloaded module list
    ..............
    *******************************************************************************
    * *
    * Bugcheck Analysis *
    * *
    *******************************************************************************

    IRQL_NOT_LESS_OR_EQUAL (a)
    An attempt was made to access a pageable (or completely invalid) address at an
    interrupt request level (IRQL) that is too high. This is usually
    caused by drivers using improper addresses.
    If a kernel debugger is available get the stack backtrace.
    Arguments:
    Arg1: 00000004, memory referenced
    Arg2: 00000002, IRQL
    Arg3: 00000001, value 0 = read operation, 1 = write operation
    Arg4: 804f7ba8, address which referenced memory

    Debugging Details:
    ------------------

    *** WARNING: Unable to verify timestamp for SiWinAcc.sys
    *** ERROR: Module load completed but symbols could not be loaded for SiWinAcc.sys

    WRITE_ADDRESS: 00000004

    CURRENT_IRQL: 2

    FAULTING_IP:
    nt!KeQuerySystemTime+e
    804f7ba8 894804 mov dword ptr [eax+4],ecx

    CUSTOMER_CRASH_COUNT: 1

    DEFAULT_BUCKET_ID: DRIVER_FAULT

    BUGCHECK_STR: 0xA









    and another one






    Opened log file 'c:\mini5.txt'
    3: kd> .sympath srv*c:\symbols*http://msdl.microsoft.com/download/symbols
    Symbol search path is: srv*c:\symbols*http://msdl.microsoft.com/download/symbols
    3: kd> .reload;!analyze -v;r;kv;lmnt;.logclose;q
    Loading Kernel Symbols
    ...................................................................................................................................
    Loading User Symbols
    Loading unloaded module list
    ..................................................
    *******************************************************************************
    * *
    * Bugcheck Analysis *
    * *
    *******************************************************************************

    PAGE_FAULT_IN_NONPAGED_AREA (50)
    Invalid system memory was referenced. This cannot be protected by try-except,
    it must be protected by a Probe. Typically the address is just plain bad or it
    is pointing at freed memory.
    Arguments:
    Arg1: fffffffc, memory referenced.
    Arg2: 00000001, value 0 = read operation, 1 = write operation.
    Arg3: b3fd0447, If non-zero, the instruction address which referenced the bad memory
    address.
    Arg4: 00000000, (reserved)

    Debugging Details:
    ------------------


    Could not read faulting driver name

    WRITE_ADDRESS: fffffffc

    FAULTING_IP:
    Fastfat!FatDeferredCleanVolume+fc
    b3fd0447 834dfcff or dword ptr [ebp-4],0FFFFFFFFh

    MM_INTERNAL_CODE: 0

    CUSTOMER_CRASH_COUNT: 1

    DEFAULT_BUCKET_ID: DRIVER_FAULT

    BUGCHECK_STR: 0x50

    TRAP_FRAME: bacffca0 -- (.trap ffffffffbacffca0)
    .trap ffffffffbacffca0
    ErrCode = 00000002
    eax=bacffd50 ebx=00000000 ecx=00000000 edx=00000000 esi=890f1d28 edi=00000000
    eip=b3fd0447 esp=bacffd14 ebp=00000000 iopl=0 nv up ei pl zr na pe nc
    cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010246
    Fastfat!FatDeferredCleanVolume+0xfc:
    b3fd0447 834dfcff or dword ptr [ebp-4],0FFFFFFFFh ss:0010:fffffffc=????????
    .trap
    Resetting default scope

    LAST_CONTROL_TRANSFER: from 8051f478 to 804f9c37







    Then you can see the rest of them in the attachments.

    Thanks
     
  2. Tedster

    Tedster Techspot old timer..... Posts: 6,000   +15

    run memtest 86+ to check your memory. Run for 7 or more passes.
     
  3. Takin_a_Dump

    Takin_a_Dump TS Rookie Topic Starter

    Those are a couple different errors. Its not just memory errors though
     
Topic Status:
Not open for further replies.

Similar Topics

Add New Comment

You need to be a member to leave a comment. Join thousands of tech enthusiasts and participate.
TechSpot Account You may also...