TechSpot

MiniDumps

By Pjot
Oct 6, 2009
  1. Hi - I have a Windows 2003 SP2 which goes down/freeze almost every day - so are there somebody who can read the log file from the 5 steps below:
    1) Download and install the microsoft.com/whdc/devtools/debugging/installx86.mspx
    Debugging Tools from Microsoft
    2) Locate your latest memory.dmp file- C:\WINDOWS\ Minidump\Mini081505-01.dmp or whatever
    3) open a CMD prompt and cd\program files\debugging tools for windows\
    4) type the following stuff:
    Code:

    c:\program files\debugging tools>kd -z C:\WINDOWS\ Minidump\Mini081505-01.dmp
    (it will spew a bunch)
    kd> .logopen c:\debuglog.txt
    kd> .sympath srv*c:\symbols [msdl.microsoft.com/download/symbols
    kd> .reload;!analyze -v;r;kv;lmnt;.logclose;q

    5) You now have a debuglog.txt in c:\, open it in notepad and post the content here

    do have a clue about bad RAM/socket, but please have a look

    ********************************************************************

    IRQL_NOT_LESS_OR_EQUAL (a)
    An attempt was made to access a pageable (or completely invalid) address at an
    interrupt request level (IRQL) that is too high. This is usually
    caused by drivers using improper addresses.
    If a kernel debugger is available get the stack backtrace.
    Arguments:
    Arg1: 99c7c9c9, memory referenced
    Arg2: d0000002, IRQL
    Arg3: 00000001, bitfield :
    bit 0 : value 0 = read operation, 1 = write operation
    bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
    Arg4: 80875d87, address which referenced memory

    Debugging Details:
    ------------------
    WRITE_ADDRESS: 99c7c9c9

    CURRENT_IRQL: 2

    FAULTING_IP:
    nt!KiDumpParameterImages+e
    80875d87 89808945fc8b mov dword ptr [eax-7403BA77h],eax

    CUSTOMER_CRASH_COUNT: 1

    DEFAULT_BUCKET_ID: CODE_CORRUPTION

    BUGCHECK_STR: 0xA

    PROCESS_NAME: Idle

    TRAP_FRAME: 808bd554 -- (.trap 0xffffffff808bd554)
    .trap 0xffffffff808bd554
    ErrCode = 00000002
    eax=0dcb8440 ebx=f727768b ecx=ffdffa48 edx=01ca45cf esi=89d251dc edi=ffdffa40
    eip=80875d87 esp=808bd5c8 ebp=8089d600 iopl=0 nv up ei pl nz na po nc
    cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010202
    nt!KiDumpParameterImages+0xe:
    80875d87 89808945fc8b mov dword ptr [eax-7403BA77h],eax ds:0023:99c7c9c9=????????
    .trap
    Resetting default scope

    MISALIGNED_IP:
    nt!KiDumpParameterImages+e
    80875d87 89808945fc8b mov dword ptr [eax-7403BA77h],eax

    LAST_CONTROL_TRANSFER: from 80875d87 to 80826693

    STACK_TEXT:
    808bd554 80875d87 badb0d00 01ca45cf 00097173 nt!KiTrap0E+0x2a1
    808bd5c4 f0e9e85d 3300025b 5c89e9f6 db330002 nt!KiDumpParameterImages+0xe
    WARNING: Frame IP not in any known module. Following frames may be wrong.
    808bd5d8 e9f63300 00025ba8 90909090 55ff8b90 0xf0e9e85d
    808bd5dc 00025ba8 90909090 55ff8b90 a164ec8b 0xe9f63300
    808bd5e0 90909090 55ff8b90 a164ec8b 00000124 0x25ba8
    808bd5e4 55ff8b90 a164ec8b 00000124 7248ff66 0x90909090
    808bd5e8 a164ec8b 00000124 7248ff66 00b85756 0x55ff8b90
    808bd5ec 00000000 7248ff66 00b85756 b9000000 0xa164ec8b


    STACK_COMMAND: kb

    CHKIMG_EXTENSION: !chkimg -lo 50 -d !nt
    !chkimg -lo 50 -d !nt
    808bd53c-808bd555 26 bytes - nt!IopPnPDispatch+252

    [ ff e9 94 89 02 00 3b 05:0a 00 00 00 c9 c9 c7 99 ]
    808bd557-808bd563 13 bytes - nt!MmLoadSystemImage+b9 (+0x1b)

    [ 45 d8 e9 0b d6 02 00 f6:80 87 5d 87 80 00 0d db ]
    808bd580-808bd583 4 bytes - nt!ObpIncrementUnnamedHandleCount+89 (+0x29)

    [ 85 3a 71 09:00 00 00 00 ]
    808bd585 - nt!ObpIncrementUnnamedHandleCount+8a (+0x05)

    [ 39:00 ]
    808bd588-808bd589 2 bytes - nt!ObpIncrementUnnamedHandleCount+8d (+0x03)

    [ 0f 85:23 00 ]
    808bd58c - nt!ObpIncrementUnnamedHandleCount+91 (+0x04)

    [ 09:23 ]
    808bd590-808bd59b 12 bytes - nt!ObpIncrementUnnamedHandleCount+91 (+0x04)

    [ 0f 85 29 71 09 00 c6 45:cf 45 ca 01 48 fa df ff ]
    808bd5a0-808bd5a5 6 bytes - nt!ObpIncrementUnnamedHandleCount+130 (+0x10)

    [ b6 47 0e 8b cf 2b:ff ff ff ff 30 00 ]
    808bd5a8-808bd5c7 32 bytes - nt!ObpIncrementUnnamedHandleCount+138 (+0x08)

    [ 45 0c 89 41 0c e9 31 a7:40 fa df ff dc 51 d2 89 ]
    97 errors : !nt (808bd53c-808bd5c7)

    MODULE_NAME: memory_corruption

    IMAGE_NAME: memory_corruption

    FOLLOWUP_NAME: memory_corruption

    DEBUG_FLR_IMAGE_TIMESTAMP: 0

    MEMORY_CORRUPTOR: LARGE

    FAILURE_BUCKET_ID: MEMORY_CORRUPTION_LARGE

    BUCKET_ID: MEMORY_CORRUPTION_LARGE

    Followup: memory_corruption
    ---------

    eax=ffdff13c ebx=d0000002 ecx=00000001 edx=40000000 esi=ffdff120 edi=99c7c9c9
    eip=80826693 esp=808bd53c ebp=808bd554 iopl=0 nv up ei ng nz na pe nc
    cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00000286
    nt!KiTrap0E+0x2a1:
    80826693 833dc0828a8000 cmp dword ptr [nt!KiFreezeFlag (808a82c0)],0 ds:0023:808a82c0=????????
    ChildEBP RetAddr Args to Child
    808bd554 80875d87 badb0d00 01ca45cf 00097173 nt!KiTrap0E+0x2a1 (FPO: [0,0] TrapFrame @ 808bd554)
    808bd5c4 f0e9e85d 3300025b 5c89e9f6 db330002 nt!KiDumpParameterImages+0xe (FPO: [4,42,0])
    WARNING: Frame IP not in any known module. Following frames may be wrong.
    808bd5d8 e9f63300 00025ba8 90909090 55ff8b90 0xf0e9e85d
    808bd5dc 00025ba8 90909090 55ff8b90 a164ec8b 0xe9f63300
    808bd5e0 90909090 55ff8b90 a164ec8b 00000124 0x25ba8
    808bd5e4 55ff8b90 a164ec8b 00000124 7248ff66 0x90909090
    808bd5e8 a164ec8b 00000124 7248ff66 00b85756 0x55ff8b90
    808bd5ec 00000000 7248ff66 00b85756 b9000000 0xa164ec8b
    start end module name
    80800000 80a73000 nt ntoskrnl.exe Thu Mar 19 12:40:24 2009 (49C22F28)
    80a73000 80a9f000 hal halaacpi.dll Sat Feb 17 06:48:25 2007 (45D69729)
    b8f7e000 b8fa8000 Fastfat Fastfat.SYS Sat Feb 17 07:27:55 2007 (45D6A06B)
    (48D2DF6F)
    b98d1000 b98e1780 mfeapfk mfeapfk.sys Fri Sep 19 01:07:03 2008 (48D2DF17)
    b9a2a000 b9a32a60 mfebopk mfebopk.sys Fri Sep 19 01:09:24 2008 (48D2DFA4)
    b9dd4000 b9de0000 USBSTOR USBSTOR.SYS Sat Feb 17 07:13:05 2007 (45D69CF1)
    ba15c000 ba1ba000 srv srv.sys Thu Dec 11 12:35:59 2008 (4940FB1F)
    ba52a000 ba547000 dump_atapi dump_atapi.sys Sat Feb 17 07:07:34 2007 (45D69BA6)
    ba547000 ba55c000 Cdfs Cdfs.SYS Sat Feb 17 07:27:08 2007 (45D6A03C)
    ba58c000 ba596000 ndisuio ndisuio.sys Sat Feb 17 06:58:25 2007 (45D69981)
    ba5fc000 ba60d000 Fips Fips.SYS Sat Feb 17 07:26:33 2007 (45D6A019)
    ba60d000 ba683000 mrxsmb mrxsmb.sys Fri Sep 05 17:26:52 2008 (48C14FBC)
    ba683000 ba6b3000 rdbss rdbss.sys Sat Feb 17 07:27:37 2007 (45D6A059)
    ba6b3000 ba6dd000 afd afd.sys Thu Oct 16 17:44:36 2008 (48F76164)
    ba6dd000 ba742000 fweng fweng.sys Sun May 10 16:18:44 2009 (4A06E244)
    ba742000 ba773000 netbt netbt.sys Sat Feb 17 07:28:57 2007 (45D6A0A9)
    ba79b000 ba82f000 tcpip tcpip.sys Sat Aug 15 11:53:38 2009 (4A8685A2)
    ba82f000 ba848000 ipsec ipsec.sys Sat Feb 17 07:29:28 2007 (45D6A0C8)
    ba958000 ba96d000 usbhub usbhub.sys Sat Feb 17 07:13:05 2007 (45D69CF1)
    ba9b5000 baa14000 update update.sys Mon May 28 14:15:16 2007 (465AC7D4)
    baa14000 baa4b000 rdpdr rdpdr.sys Sat Feb 17 06:51:00 2007 (45D697C4)
    baa4b000 baa5d000 raspptp raspptp.sys Sat Feb 17 07:29:20 2007 (45D6A0C0)
    baa7d000 baa87000 Dxapi Dxapi.sys Tue Mar 25 08:06:01 2003 (3E7FFFD9)
    baa8d000 baa96000 dump_WMILIB dump_WMILIB.SYS Tue Mar 25 08:13:00 2003 (3E80017C)
    baaed000 baafa000 wanarp wanarp.sys Sat Feb 17 06:59:17 2007 (45D699B5)
    baafd000 bab16000 ndiswan ndiswan.sys Sat Feb 17 07:29:22 2007 (45D6A0C2)
    bab16000 bab2a000 rasl2tp rasl2tp.sys Sat Feb 17 07:29:02 2007 (45D6A0AE)
    bab2a000 bab3f000 drmk drmk.sys Sat Feb 17 07:12:29 2007 (45D69CCD)
    bab3f000 bab68000 portcls portcls.sys Sat Feb 17 07:30:03 2007 (45D6A0EB)
    bab68000 babeb980 smwdm smwdm.sys Thu Dec 19 23:48:46 2002 (3E024CCE)
    babec000 bac13000 ks ks.sys Sat Feb 17 07:30:40 2007 (45D6A110)
    bac13000 bac27000 redbook redbook.sys Sat Feb 17 07:07:26 2007 (45D69B9E)
    bac27000 bac3c000 cdrom cdrom.sys Sat Feb 17 07:07:48 2007 (45D69BB4)

    f777f000 f7786000 Null Null.SYS Tue Mar 25 08:03:05 2003 (3E7FFF29)
    f7787000 f778e000 Beep Beep.SYS Tue Mar 25 08:03:04 2003 (3E7FFF28)
    f778f000 f7795300 HIDPARSE HIDPARSE.SYS Sat Feb 17 07:12:35 2007 (45D69CD3)
    f7797000 f779f000 mnmdd mnmdd.SYS Tue Mar 25 08:07:53 2003 (3E800049)
    f779f000 f77a7000 RDPCDD RDPCDD.sys Tue Mar 25 08:03:05 2003 (3E7FFF29)
    f77a7000 f77af000 rasacd rasacd.sys Tue Mar 25 08:11:50 2003 (3E800136)
    f77bf000 f77c6000 dxgthk dxgthk.sys Tue Mar 25 08:05:52 2003 (3E7FFFD0)
    f77ff000 f7806000 parvdm parvdm.sys Tue Mar 25 08:03:49 2003 (3E7FFF55)
    f798b000 f798c120 aeaudio aeaudio.sys Mon Apr 01 16:39:14 2002 (3CA87112)
    f798d000 f798e280 swenum swenum.sys Sat Feb 17 07:05:56 2007 (45D69B44)
    f798f000 f7990580 USBD USBD.SYS Tue Mar 25 08:10:39 2003 (3E8000EF)

    Unloaded modules:
    baabd000 baacb000 HIDCLASS.SYS
    Timestamp: unavailable (00000000)
    Checksum: 00000000
    baacd000 baad6000 hidusb.sys
    Timestamp: unavailable (00000000)
    Checksum: 00000000
    f77af000 f77b7000 usbccgp.sys
    Timestamp: unavailable (00000000)
    Checksum: 00000000
    baaad000 baab6000 kbdhid.sys
    Timestamp: unavailable (00000000)
    Checksum: 00000000
    f77b7000 f77bf000 mouhid.sys
    Timestamp: unavailable (00000000)
    Checksum: 00000000
    f76b7000 f76c3000 vga.sys
    Timestamp: unavailable (00000000)
    Checksum: 00000000
    f76a7000 f76b0000 kbdhid.sys
    Timestamp: unavailable (00000000)
    Checksum: 00000000
    f776f000 f7777000 Sfloppy.SYS
    Timestamp: unavailable (00000000)
    Checksum: 00000000
    Closing open log file c:\debuglog.txt
     
  2. Route44

    Route44 TechSpot Ambassador Posts: 11,966   +70

    Okay, 0xA errors are usually caused by hardware or drivers attempting an IRQ Level that they shouldn't. Your minidump read out specifically tells us your issue: Memory Corruption.

    At this point we don't know if one or all of your RAM is bad. So the next step you want to do is to run the free and completely safe Memtest.

    See the link below and follow the instructions. There is a newer version than is listed but either one should work. If you need to see what the Memtest screen looks like go to reply #21. The third screen is the Memtest screen.

    Let it run for a LONG time. The rule is a minimum of 7 Passes; the more Passes after 7 so much the better. There are 8 individual tests per Pass. Once it goes through the 8 individual Tests it will equal 1 Pass. It will begin again but don't mistake that it is the same thing over again because it isn't. Many people will start this test before going to bed and check it the next day.

    If you have errors you have corrupted memory and it needs to be replaced.

    Also, with errors you need to run this test per stick of RAM. Take out one and run the test. Then take that one out and put the other in and run the test. If you start getting errors before 7 Passes you know that stick is corrupted and you don’t need to run the test any further on that stick.

    Link: http://www.techspot.com/vb/topic62524.html

    * Get back to us with the results.
     
Topic Status:
Not open for further replies.

Similar Topics

Add New Comment

You need to be a member to leave a comment. Join thousands of tech enthusiasts and participate.
TechSpot Account You may also...