Please help diagnose my minidumps...

By kkokko
Oct 16, 2005
Topic Status:
Not open for further replies.
  1. Minidumps

    Please help diagnose my minidumps... Today in the morning my computer restarted without giving me a BSOD (which is weird since i have it set to dont restart when error happens) but when it booted back to windows it says windows has recoverd from serious problem. When i check the minidump it was in a different location then c:windows\minidump instead it was in a temp file.. after looking at the system events i took a look at the minidump

    after closing the window the minidump dispaered from the temp file so i could not post the original minidump file for thismorning here.. but i did manage to copy and paste the following:

    Microsoft (R) Windows Debugger Version 6.5.0003.7
    Copyright (c) Microsoft Corporation. All rights reserved.


    Loading Dump File [C:\Documents and Settings\Local Settings\Temp\WER6505.dir00\Mini100705-04.dmp]
    Mini Kernel Dump File: Only registers and stack trace are available

    Symbol search path is: *** Invalid ***
    ****************************************************************************
    * Symbol loading may be unreliable without a symbol search path. *
    * Use .symfix to have the debugger choose a symbol path. *
    * After setting your symbol path, use .reload to refresh symbol locations. *
    ****************************************************************************
    Executable search path is:
    *********************************************************************
    * Symbols can not be loaded because symbol path is not initialized. *
    * *
    * The Symbol Path can be set by: *
    * using the _NT_SYMBOL_PATH environment variable. *
    * using the -y argument when starting the debugger. *
    * using .sympath and .sympath+ *
    *********************************************************************
    Unable to load image ntoskrnl.exe, Win32 error 2
    *** WARNING: Unable to verify timestamp for ntoskrnl.exe
    *** ERROR: Module load completed but symbols could not be loaded for ntoskrnl.exe
    Windows XP Kernel Version 2600 (Service Pack 2) MP (2 procs) Free x86 compatible
    Product: WinNt, suite: TerminalServer SingleUserTS
    Kernel base = 0x804d7000 PsLoadedModuleList = 0x805624a0
    Debug session time: Fri Oct 7 22:10:41.718 2005 (GMT-7)
    System Uptime: 0 days 0:00:37.406
    *********************************************************************
    * Symbols can not be loaded because symbol path is not initialized. *
    * *
    * The Symbol Path can be set by: *
    * using the _NT_SYMBOL_PATH environment variable. *
    * using the -y argument when starting the debugger. *
    * using .sympath and .sympath+ *
    *********************************************************************
    Unable to load image ntoskrnl.exe, Win32 error 2
    *** WARNING: Unable to verify timestamp for ntoskrnl.exe
    *** ERROR: Module load completed but symbols could not be loaded for ntoskrnl.exe
    Loading Kernel Symbols
    ....................................................................................................................................................
    Loading unloaded module list
    .........
    Loading User Symbols
    *******************************************************************************
    * *
    * Bugcheck Analysis *
    * *
    *******************************************************************************

    Use !analyze -v to get detailed debugging information.

    BugCheck 1000008E, {c0000005, f75adf0e, f6d147d4, 0}

    ***** Kernel symbols are WRONG. Please fix symbols to do analysis.

    Unable to load image Ntfs.sys, Win32 error 2
    *** WARNING: Unable to verify timestamp for Ntfs.sys
    *** ERROR: Module load completed but symbols could not be loaded for Ntfs.sys
    Unable to load image sr.sys, Win32 error 2
    *** WARNING: Unable to verify timestamp for sr.sys
    *** ERROR: Module load completed but symbols could not be loaded for sr.sys
    *************************************************************************
    *** ***
    *** ***
    *** Your debugger is not using the correct symbols ***
    *** ***
    *** In order for this command to work properly, your symbol path ***
    *** must point to .pdb files that have full type information. ***
    *** ***
    *** Certain .pdb files (such as the public OS symbols) do not ***
    *** contain the required information. Contact the group that ***
    *** provided you with these symbols if you need this command to ***
    *** work. ***
    *** ***
    *** Type referenced: nt!_KPRCB ***
    *** ***
    *************************************************************************
    *** WARNING: Unable to verify timestamp for SYMEVENT.SYS
    *** ERROR: Module load completed but symbols could not be loaded for SYMEVENT.SYS
    Probably caused by : hardware ( SYMEVENT+80f1 )

    Followup: MachineOwner
    ---------

    * *
    * Bugcheck Analysis *
    * *
    *******************************************************************************

    KERNEL_MODE_EXCEPTION_NOT_HANDLED_M (1000008e)
    This is a very common bugcheck. Usually the exception address pinpoints
    the driver/function that caused the problem. Always note this address
    as well as the link date of the driver/image that contains this address.
    Some common problems are exception code 0x80000003. This means a hard
    coded breakpoint or assertion was hit, but this system was booted
    /NODEBUG. This is not supposed to happen as developers should never have
    hardcoded breakpoints in retail code, but ...
    If this happens, make sure a debugger gets connected, and the
    system is booted /DEBUG. This will let us see why this breakpoint is
    happening.
    Arguments:
    Arg1: c0000005, The exception code that was not handled
    Arg2: f75adf0e, The address that the exception occurred at
    Arg3: f6d147d4, Trap Frame
    Arg4: 00000000

    Debugging Details:
    ------------------

    ***** Kernel symbols are WRONG. Please fix symbols to do analysis.

    *************************************************************************
    *** ***
    *** ***
    *** Your debugger is not using the correct symbols ***
    *** ***
    *** In order for this command to work properly, your symbol path ***
    *** must point to .pdb files that have full type information. ***
    *** ***
    *** Certain .pdb files (such as the public OS symbols) do not ***
    *** contain the required information. Contact the group that ***
    *** provided you with these symbols if you need this command to ***
    *** work. ***
    *** ***
    *** Type referenced: nt!_KPRCB ***
    *** ***
    *************************************************************************

    FAULTING_MODULE: 804d7000 nt

    DEBUG_FLR_IMAGE_TIMESTAMP: 0

    EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx". The memory could not be "%s".

    FAULTING_IP:
    Ntfs+24f0e
    f75adf0e f75353 not dword ptr [ebx+0x53]

    TRAP_FRAME: f6d147d4 -- (.trap fffffffff6d147d4)
    ErrCode = 00000002
    eax=f6d14850 ebx=00000000 ecx=f75a8820 edx=86725b90 esi=83e0bdb8 edi=86725b90
    eip=f75adf0e esp=f6d14848 ebp=f6d149d8 iopl=0 ov up ei ng nz na pe nc
    cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010a82
    Ntfs+0x24f0e:
    f75adf0e f75353 not dword ptr [ebx+0x53] ds:0023:00000053=????????
    Resetting default scope

    CUSTOMER_CRASH_COUNT: 4

    DEFAULT_BUCKET_ID: COMMON_SYSTEM_FAULT

    BUGCHECK_STR: 0x8E

    MISALIGNED_IP:
    Ntfs+24f0e
    f75adf0e f75353 not dword ptr [ebx+0x53]

    LAST_CONTROL_TRANSFER: from f7634f70 to f75adf0e

    STACK_TEXT:
    WARNING: Stack unwind information not available. Following frames may be wrong.
    f6d149d8 f7634f70 83e0bc28 f6d14c00 8676e770 Ntfs+0x24f0e
    f6d149f8 ae0b30f1 83e0bc28 f6d14c00 86725b90 sr+0x7f70
    f6d149fc 83e0bc28 f6d14c00 86725b90 f6d14c38 SYMEVENT+0x80f1
    f6d14a00 f6d14c00 86725b90 f6d14c38 83e0bc28 0x83e0bc28
    f6d14a04 86725b90 f6d14c38 83e0bc28 f6d14b04 0xf6d14c00
    f6d14c00 85de9438 83ce7fd0 ffffffff 000001ec 0x86725b90
    f6d14c04 83ce7fd0 ffffffff 000001ec 00000000 0x85de9438
    f6d14c08 ffffffff 000001ec 00000000 00000000 0x83ce7fd0
    f6d14c0c 00000000 00000000 00000000 f6d14c4c 0xffffffff


    FOLLOWUP_IP:
    SYMEVENT+80f1
    ae0b30f1 ?? ???

    SYMBOL_STACK_INDEX: 2

    FOLLOWUP_NAME: MachineOwner

    SYMBOL_NAME: SYMEVENT+80f1

    MODULE_NAME: hardware

    IMAGE_NAME: hardware

    STACK_COMMAND: .trap fffffffff6d147d4 ; kb

    FAILURE_BUCKET_ID: IP_MISALIGNED

    BUCKET_ID: IP_MISALIGNED

    Followup: MachineOwner
    ---------


    Event Type: Error
    Event Source: System Error
    Event Category: (102)
    Event ID: 1003
    Date: 10/16/2005
    Time: 3:07:06 AM
    User: N/A
    Computer: JASONYAP
    Description:
    Error code 1000008e, parameter1 c0000005, parameter2 f75adf0e, parameter3 f6d147d4, parameter4 00000000.

    For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
    Data:
    0000: 53 79 73 74 65 6d 20 45 System E
    0008: 72 72 6f 72 20 20 45 72 rror Er
    0010: 72 6f 72 20 63 6f 64 65 ror code
    0018: 20 31 30 30 30 30 30 38 1000008
    0020: 65 20 20 50 61 72 61 6d e Param
    0028: 65 74 65 72 73 20 63 30 eters c0
    0030: 30 30 30 30 30 35 2c 20 000005,
    0038: 66 37 35 61 64 66 30 65 f75adf0e
    0040: 2c 20 66 36 64 31 34 37 , f6d147
    0048: 64 34 2c 20 30 30 30 30 d4, 0000
    0050: 30 30 30 30 0000
  2. howard_hopkinso

    howard_hopkinso Newcomer, in training Posts: 25,948   +17

    Your most recent minidumps crash with a hardware error.

    This probably caused by, faulty ram/psu/mobo/cpu

    If you are overclocking any components, reset to the default settings.

    Check your ram.

    Look HERE for instructions on solving ram issues.

    Regards Howard :wave: :wave:
  3. kkokko

    kkokko Newcomer, in training Topic Starter Posts: 27

    i have already ran memtest on individual ram dimms and it has passed 7 tests

    and did all the following..

    any idea why the latest minidump did not save itself in the usual c:\windows\minidump

    instead it created itsel in the temp folder and then was later deleted when i click close on the "Windows has recoevered from serious error" popup?
  4. howard_hopkinso

    howard_hopkinso Newcomer, in training Posts: 25,948   +17

    I don`t know why your last minidump was saved to the temp folder.

    Hardware errors are very difficult to diagnose.

    It really is a case of elimination.

    Just because you ram has passed memtest, doesn`t mean that your ram is good. It could also be your cpu`s L2 cache ram that is bad.

    Check all connections, and cables. Also check the capacitors on your mobo. See if any are leaking, or have domed(swollen) tops.

    Disconnect anything that is not required to run your system.

    Test everything you can think of, untill you find the culprit.

    Regards Howard :)
  5. kkokko

    kkokko Newcomer, in training Topic Starter Posts: 27

    allrite thanks...

    i will bring my ram in to the store for them to test it to make sure.. the ram isnt faulty tomorow

    by anychance could it be the harrdive? since it keeps refering to ntfs.sys?
  6. kkokko

    kkokko Newcomer, in training Topic Starter Posts: 27

    is there a way to test the cpu l2 cache?
  7. howard_hopkinso

    howard_hopkinso Newcomer, in training Posts: 25,948   +17

    I doubt it`s your hard drive, but hey you never know.

    Click start/run and type cmd into the run box, and press enter.

    In the window that appears at the prompt type chkdsk /r /f and follow the onscreen instructions. Then type exit, and reboot your computer.

    Type the above command thus. chkdsk (space) forward slash r (space) forward slash f

    During reboot, your computer will check your hard drive for errors.

    Regards Howard :)
  8. kkokko

    kkokko Newcomer, in training Topic Starter Posts: 27

    ok i will try that...

    howard could the minidump i copy and paste be software related? i am asking this because.. i havent had any bsod for 1 week of running my computer on 24/7...

    after installing my new ram last a week and a half ago i kept getting bsods.. and then when i change the performance mode in the bios to standard mode the bsods went away...

    but 1 week later.. (today) my comp restarted and said it has recovered from a serious error.. and the minidump i posted was from today..

    the ones in the zip files are the ones i was getting with turbo mode on .. 1.5 weeks ago
  9. howard_hopkinso

    howard_hopkinso Newcomer, in training Posts: 25,948   +17

    It still points to somekind of hardware error.

    I don`t know what else I can tell you really.

    I`ll see if I can get cpc2004 to have a quick look, and see what he thinks.

    Regards Howard :)
  10. cpc2004

    cpc2004 Newcomer, in training Posts: 2,044

    Hi,

    The information is insufficient. Probablly it is memoory related. Attach the minidumps here for further analysis.
  11. kkokko

    kkokko Newcomer, in training Topic Starter Posts: 27

    hi cpc2004 i have attached the minidumps in a zip file on the very top of my first post
    please take a look if you can. there are about 5 minidumps attached
  12. kkokko

    kkokko Newcomer, in training Topic Starter Posts: 27

    how do stores test the rams? if a customer brings them in and says they are faulty?
  13. cpc2004

    cpc2004 Newcomer, in training Posts: 2,044

    Hi kkokko,

    Your windows has a lot of problems.

    Finding and Suggestion
    1. If you are using Norton Internet Security Version 8.0.5.14, it may crash your windows. There have a confirmed case at this forum.
    http://www.techspot.com/vb/topic35044.html
    2. Two minidumps have memory corruption. It may be caused by faulty ram or software error of Internet Security
    Mini100705-03.dmp and Mini100705-02.dmp
    3. One minidump crash at iaStor.sys. You have sata hard disk you to install
    Intel Matrix Storage Manager
    http://www.intel.com/design/motherbd/cv2/cv2_drive.htm
    Mini100705-01.dmp
    BugCheck 1000007E, {c0000005, f76a8a49, f7ce6c9c, f7ce6998}
    Probably caused by : iaStor.sys ( iaStor+32a49 )
     
  14. kkokko

    kkokko Newcomer, in training Topic Starter Posts: 27

    cpc2004

    i do not have norton internet security. althuogh i do have nav 2005...
    and i do have 2 sata hardives in raid 0 config.. installed using intel matrix storage manager im not sure what the problem you are refering to is?
  15. kkokko

    kkokko Newcomer, in training Topic Starter Posts: 27

    does the minidump crash at iaStor.sys mean that my harddrive is physically broken? or just software related?
  16. cpc2004

    cpc2004 Newcomer, in training Posts: 2,044

    Hi,

    Do you install Intel Matrix Storage Manager? The running process of one your minidump is ccapp.exe which is symantec common client CC application. From the module list of your minidumps, I also find Norton AV is installed. Hence the problem is not related to Internet Security. Maybe the memory corruption it is related to some device driver has conflict with Norton AV or it is caused by faulty ram.

    Assume the problem is related to faulty memory.
    Suggestion
    1. Check the temperature of the CPU and make sure that it is not overheat (ie temperature < 60C)
    2. Reseat the memory stick to another memory slot
    3. Downclock the ram
    4. Clean the dust inside the computer case
    5. Make sure that the ram is compatible to the motherboard
    If it still crashes, diagnostic which memory stick is faulty
    1. Take out one memory stick. If windows does not crash, the removed memory stick is faulty.
    2. If you have only one memory stick, replace the ram
  17. kkokko

    kkokko Newcomer, in training Topic Starter Posts: 27

    yes i installed intel matrix storage manager?

    thank for trying to help cpc2004
  18. kkokko

    kkokko Newcomer, in training Topic Starter Posts: 27

    well i replaced both the ram... with new ones.. and i got iastor.sys bsod right after.. :(
  19. kkokko

    kkokko Newcomer, in training Topic Starter Posts: 27

  20. cpc2004

    cpc2004 Newcomer, in training Posts: 2,044

    Hi,

    You've installed a new Gigbit Ethernet card and the driver crashed.

    BugCheck 100000D1, {4, 2, 0, f757562b}
    Probably caused by : yk51x86.sys ( yk51x86+cd65 )
  21. kkokko

    kkokko Newcomer, in training Topic Starter Posts: 27

    cpc is it possible if lets say for example you change the ram settings in the bios to an unstable one.. and then when it loads widnows the memory corrupts and give you a blue screen.. then when you restart.. you go into the bios and change it back to stable setting. but then.. when u exit and save changes in bios and when it boots back to windows.. it give another blue screen... but after u reboot everything seems to be fine...

    does then 2nd blue screen mean that the stable settings might also not be stable??
    or could it just mean.. that the settings change on the bios might not have fully taken effect until you reboot the computer?
  22. cpc2004

    cpc2004 Newcomer, in training Posts: 2,044

    Hi,

    I am not a hardware guy. I hope some hardware experts can answer your question.
  23. kkokko

    kkokko Newcomer, in training Topic Starter Posts: 27

    ok thanks anyway cpc2004 :)
  24. kkokko

    kkokko Newcomer, in training Topic Starter Posts: 27

    pls check this cpc

    Attached Files:

  25. cpc2004

    cpc2004 Newcomer, in training Posts: 2,044

    Hi kkokko,

    This is hardware problem. Attach the minidumps here cannot resolved your problem. Post your problem at hardware forum.
Topic Status:
Not open for further replies.


Add New Comment

TechSpot Members
Login or sign up for free,
it takes about 30 seconds.
You may also...


Get complete access to the TechSpot community. Join thousands of technology enthusiasts that contribute and share knowledge in our forum. Get a private inbox, upload your own photo gallery and more.