TechSpot

Help with Mini-Crash Dump Files

By kingkiddi
Dec 9, 2007
  1. I am having problems with my PC, the problem only occurs on a particular user,

    The computer either reboots without warning or i get the BSOD, I have included the minidump file,

    I have tried what i can to sort the problem, as far as i can tell its msn, but i stopped it from starting to no success...

    here is the mini-dump details


    Microsoft (R) Windows Debugger Version 6.8.0004.0 X86
    Copyright (c) Microsoft Corporation. All rights reserved.


    Loading Dump File [C:\Documents and Settings\Chris\Desktop\New Folder\Mini120407-01.dmp]
    Mini Kernel Dump File: Only registers and stack trace are available

    Symbol search path is: C:\WINDOWS\Symbols
    Executable search path is:
    Unable to load image ntoskrnl.exe, Win32 error 0n2
    *** WARNING: Unable to verify timestamp for ntoskrnl.exe
    Windows XP Kernel Version 2600 UP Free x86 compatible
    Product: WinNt
    Kernel base = 0x804d0000 PsLoadedModuleList = 0x80545b28
    Debug session time: Sun Dec 9 09:32:06.447 2007 (GMT+0)
    System Uptime: 0 days 0:17:22.070
    Unable to load image ntoskrnl.exe, Win32 error 0n2
    *** WARNING: Unable to verify timestamp for ntoskrnl.exe
    Loading Kernel Symbols
    ..................................................................................................................
    Loading User Symbols
    Loading unloaded module list
    ...............
    *******************************************************************************
    * *
    * Bugcheck Analysis *
    * *
    *******************************************************************************

    Use !analyze -v to get detailed debugging information.

    BugCheck C2, {7, cd4, 0, 814056cc}



    Probably caused by : ntoskrnl.exe ( nt!DbgLoadImageSymbols+4a )

    Followup: MachineOwner
    ---------

    kd> !analyze -v
    *******************************************************************************
    * *
    * Bugcheck Analysis *
    * *
    *******************************************************************************

    BAD_POOL_CALLER (c2)
    The current thread is making a bad pool request. Typically this is at a bad IRQL level or double freeing the same allocation, etc.
    Arguments:
    Arg1: 00000007, Attempt to free pool which was already freed
    Arg2: 00000cd4, (reserved)
    Arg3: 00000000, Memory contents of the pool block
    Arg4: 814056cc, Address of the block of pool being deallocated

    Debugging Details:
    ------------------




    BUGCHECK_STR: 0xc2_7

    CUSTOMER_CRASH_COUNT: 1

    DEFAULT_BUCKET_ID: DRIVER_FAULT

    PROCESS_NAME: msnmsgr.exe

    LAST_CONTROL_TRANSFER: from 8053757e to 804fc1bb

    STACK_TEXT:
    f43b6c20 8053757e 000000c2 00000007 00000cd4 nt!IopfCompleteRequest+0x214
    f43b6c68 8057879f 814056cc 00000000 814a75e8 nt!DbgLoadImageSymbols+0x4a
    f43b6ca8 8057036d 004a7600 814a75e8 00000000 nt!MiCreatePebOrTeb+0x12d
    f43b6cc4 804eb19b 814a7600 00000000 00000aec nt!SepTokenDeleteMethod+0x16
    f43b6ce8 805723f6 81457b30 e11947d0 81762da8 nt!MiUpdateWsle+0x124
    f43b6d00 80572341 e11947d0 814a7600 00000aec nt!RtlpDidUnicodeToOemWork+0x4f
    f43b6d48 805725da 00000aec 00000001 00000000 nt!CmpQueryKeyValueData+0x2ff
    f43b6d64 81fcea08 8141a020 f43b6cec f43b6d98 nt!NtSetValueKey+0xc0
    WARNING: Frame IP not in any known module. Following frames may be wrong.
    f43b6d80 00000000 00000000 0000a003 00000000 0x81fcea08


    STACK_COMMAND: kb

    FOLLOWUP_IP:
    nt!DbgLoadImageSymbols+4a
    8053757e ?? ???

    SYMBOL_STACK_INDEX: 1

    SYMBOL_NAME: nt!DbgLoadImageSymbols+4a

    FOLLOWUP_NAME: MachineOwner

    MODULE_NAME: nt

    IMAGE_NAME: ntoskrnl.exe

    DEBUG_FLR_IMAGE_TIMESTAMP: 3b7de38f

    FAILURE_BUCKET_ID: 0xc2_7_nt!DbgLoadImageSymbols+4a

    BUCKET_ID: 0xc2_7_nt!DbgLoadImageSymbols+4a

    Followup: MachineOwner
    ---------

    kd> lmvm nt
    start end module name
    804d0000 806b3f00 nt M (pdb symbols) C:\WINDOWS\Symbols\exe\ntoskrnl.pdb
    Loaded symbol image file: ntoskrnl.exe
    Image path: ntoskrnl.exe
    Image name: ntoskrnl.exe
    Timestamp: Sat Aug 18 04:39:59 2001 (3B7DE38F)
    CheckSum: 001EC8BB
    ImageSize: 001E3F00
    Translations: 0000.04b0 0000.04e0 0409.04b0 0409.04e0
     
  2. fastco

    fastco TS Booster Posts: 1,122

  3. kingkiddi

    kingkiddi TS Rookie Topic Starter

    I did replace the keyboard recently, turns out that someone spilled thier drink all over it and left it, as yet i still havn't found the culprit.

    i lost several keys on it... space, del, windows keys etc etc

    would the fact that it only seams to occur on a particular persons login have anything to do with it
     
  4. fastco

    fastco TS Booster Posts: 1,122

    It could and might be a registry issue or corrupt file in Windows. You could run sfc.exe /scannow from the run box to see if it finds any missing or corrupt Windows files. If the crashes continue I would do a Repair Install of Windows which should fix it if it's a file system issue and not a hardware issue and you won't lose anything as far as files and programs.
     
  5. kingkiddi

    kingkiddi TS Rookie Topic Starter

    I have tried to run sfc.exe, but it keeps saying that there is a problem with my cd drive or wrong cd.

    i used expand to replace ntoskrnl which appeared to correct the problem, but the error started a little while after, again only with a particular user and it appears to only be on MSN live. this user is the only administrator on the computer, i have created a new user as admin and changed everyone else to plain users. could this be anything to do with it...

    i have a recent minidump if you want it,
     
  6. kingkiddi

    kingkiddi TS Rookie Topic Starter

    on a lighter note, they have lost there xp disk so i copied my i386 folder, both systems are xp pro, could this be the fault
     
Topic Status:
Not open for further replies.

Similar Topics

Add New Comment

You need to be a member to leave a comment. Join thousands of tech enthusiasts and participate.
TechSpot Account You may also...