Please help diagnose my minidumps...

[kkokko]

Minidumps

Please help diagnose my minidumps... Today in the morning my computer restarted without giving me a BSOD (which is weird since i have it set to dont restart when error happens) but when it booted back to windows it says windows has recoverd from serious problem. When i check the minidump it was in a different location then c:windows\minidump instead it was in a temp file.. after looking at the system events i took a look at the minidump

after closing the window the minidump dispaered from the temp file so i could not post the original minidump file for thismorning here.. but i did manage to copy and paste the following:

Microsoft (R) Windows Debugger Version 6.5.0003.7
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Documents and Settings\Local Settings\Temp\WER6505.dir00\Mini100705-04.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: *** Invalid ***
****************************************************************************
* Symbol loading may be unreliable without a symbol search path. *
* Use .symfix to have the debugger choose a symbol path. *
* After setting your symbol path, use .reload to refresh symbol locations. *
****************************************************************************
Executable search path is:
*********************************************************************
* Symbols can not be loaded because symbol path is not initialized. *
* *
* The Symbol Path can be set by: *
* using the _NT_SYMBOL_PATH environment variable. *
* using the -y argument when starting the debugger. *
* using .sympath and .sympath+ *
*********************************************************************
Unable to load image ntoskrnl.exe, Win32 error 2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
*** ERROR: Module load completed but symbols could not be loaded for ntoskrnl.exe
Windows XP Kernel Version 2600 (Service Pack 2) MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Kernel base = 0x804d7000 PsLoadedModuleList = 0x805624a0
Debug session time: Fri Oct 7 22:10:41.718 2005 (GMT-7)
System Uptime: 0 days 0:00:37.406
*********************************************************************
* Symbols can not be loaded because symbol path is not initialized. *
* *
* The Symbol Path can be set by: *
* using the _NT_SYMBOL_PATH environment variable. *
* using the -y argument when starting the debugger. *
* using .sympath and .sympath+ *
*********************************************************************
Unable to load image ntoskrnl.exe, Win32 error 2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
*** ERROR: Module load completed but symbols could not be loaded for ntoskrnl.exe
Loading Kernel Symbols
....................................................................................................................................................
Loading unloaded module list
.........
Loading User Symbols
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1000008E, {c0000005, f75adf0e, f6d147d4, 0}

***** Kernel symbols are WRONG. Please fix symbols to do analysis.

Unable to load image Ntfs.sys, Win32 error 2
*** WARNING: Unable to verify timestamp for Ntfs.sys
*** ERROR: Module load completed but symbols could not be loaded for Ntfs.sys
Unable to load image sr.sys, Win32 error 2
*** WARNING: Unable to verify timestamp for sr.sys
*** ERROR: Module load completed but symbols could not be loaded for sr.sys
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
*************************************************************************
*** WARNING: Unable to verify timestamp for SYMEVENT.SYS
*** ERROR: Module load completed but symbols could not be loaded for SYMEVENT.SYS
Probably caused by : hardware ( SYMEVENT+80f1 )

Followup: MachineOwner
---------

* *
* Bugcheck Analysis *
* *
*******************************************************************************

KERNEL_MODE_EXCEPTION_NOT_HANDLED_M (1000008e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003. This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG. This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG. This will let us see why this breakpoint is
happening.
Arguments:
Arg1: c0000005, The exception code that was not handled
Arg2: f75adf0e, The address that the exception occurred at
Arg3: f6d147d4, Trap Frame
Arg4: 00000000

Debugging Details:
------------------

***** Kernel symbols are WRONG. Please fix symbols to do analysis.

*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
*************************************************************************

FAULTING_MODULE: 804d7000 nt

DEBUG_FLR_IMAGE_TIMESTAMP: 0

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx". The memory could not be "%s".

FAULTING_IP:
Ntfs+24f0e
f75adf0e f75353 not dword ptr [ebx+0x53]

TRAP_FRAME: f6d147d4 -- (.trap fffffffff6d147d4)
ErrCode = 00000002
eax=f6d14850 ebx=00000000 ecx=f75a8820 edx=86725b90 esi=83e0bdb8 edi=86725b90
eip=f75adf0e esp=f6d14848 ebp=f6d149d8 iopl=0 ov up ei ng nz na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010a82
Ntfs+0x24f0e:
f75adf0e f75353 not dword ptr [ebx+0x53] ds:0023:00000053=????????
Resetting default scope

CUSTOMER_CRASH_COUNT: 4

DEFAULT_BUCKET_ID: COMMON_SYSTEM_FAULT

BUGCHECK_STR: 0x8E

MISALIGNED_IP:
Ntfs+24f0e
f75adf0e f75353 not dword ptr [ebx+0x53]

LAST_CONTROL_TRANSFER: from f7634f70 to f75adf0e

STACK_TEXT:
WARNING: Stack unwind information not available. Following frames may be wrong.
f6d149d8 f7634f70 83e0bc28 f6d14c00 8676e770 Ntfs+0x24f0e
f6d149f8 ae0b30f1 83e0bc28 f6d14c00 86725b90 sr+0x7f70
f6d149fc 83e0bc28 f6d14c00 86725b90 f6d14c38 SYMEVENT+0x80f1
f6d14a00 f6d14c00 86725b90 f6d14c38 83e0bc28 0x83e0bc28
f6d14a04 86725b90 f6d14c38 83e0bc28 f6d14b04 0xf6d14c00
f6d14c00 85de9438 83ce7fd0 ffffffff 000001ec 0x86725b90
f6d14c04 83ce7fd0 ffffffff 000001ec 00000000 0x85de9438
f6d14c08 ffffffff 000001ec 00000000 00000000 0x83ce7fd0
f6d14c0c 00000000 00000000 00000000 f6d14c4c 0xffffffff


FOLLOWUP_IP:
SYMEVENT+80f1
ae0b30f1 ?? ???

SYMBOL_STACK_INDEX: 2

FOLLOWUP_NAME: MachineOwner

SYMBOL_NAME: SYMEVENT+80f1

MODULE_NAME: hardware

IMAGE_NAME: hardware

STACK_COMMAND: .trap fffffffff6d147d4 ; kb

FAILURE_BUCKET_ID: IP_MISALIGNED

BUCKET_ID: IP_MISALIGNED

Followup: MachineOwner
---------


Event Type: Error
Event Source: System Error
Event Category: (102)
Event ID: 1003
Date: 10/16/2005
Time: 3:07:06 AM
User: N/A
Computer: JASONYAP
Description:
Error code 1000008e, parameter1 c0000005, parameter2 f75adf0e, parameter3 f6d147d4, parameter4 00000000.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 53 79 73 74 65 6d 20 45 System E
0008: 72 72 6f 72 20 20 45 72 rror Er
0010: 72 6f 72 20 63 6f 64 65 ror code
0018: 20 31 30 30 30 30 30 38 1000008
0020: 65 20 20 50 61 72 61 6d e Param
0028: 65 74 65 72 73 20 63 30 eters c0
0030: 30 30 30 30 30 35 2c 20 000005,
0038: 66 37 35 61 64 66 30 65 f75adf0e
0040: 2c 20 66 36 64 31 34 37 , f6d147
0048: 64 34 2c 20 30 30 30 30 d4, 0000
0050: 30 30 30 30 0000

 

[howard_hopkinso]

Your most recent minidumps crash with a hardware error.

This probably caused by, faulty ram/psu/mobo/cpu

If you are overclocking any components, reset to the default settings.

Check your ram.

Look HERE for instructions on solving ram issues.

Regards Howard :wave: :wave:

 

[kkokko]

i have already ran memtest on individual ram dimms and it has passed 7 tests

and did all the following..

any idea why the latest minidump did not save itself in the usual c:\windows\minidump

instead it created itsel in the temp folder and then was later deleted when i click close on the "Windows has recoevered from serious error" popup?

 

[howard_hopkinso]

I don`t know why your last minidump was saved to the temp folder.

Hardware errors are very difficult to diagnose.

It really is a case of elimination.

Just because you ram has passed memtest, doesn`t mean that your ram is good. It could also be your cpu`s L2 cache ram that is bad.

Check all connections, and cables. Also check the capacitors on your mobo. See if any are leaking, or have domed(swollen) tops.

Disconnect anything that is not required to run your system.

Test everything you can think of, untill you find the culprit.

Regards Howard

 

[kkokko]

allrite thanks...

i will bring my ram in to the store for them to test it to make sure.. the ram isnt faulty tomorow

by anychance could it be the harrdive? since it keeps refering to ntfs.sys?

 

[kkokko]

is there a way to test the cpu l2 cache?

 

[howard_hopkinso]

I doubt it`s your hard drive, but hey you never know.

Click start/run and type cmd into the run box, and press enter.

In the window that appears at the prompt type chkdsk /r /f and follow the onscreen instructions. Then type exit, and reboot your computer.

Type the above command thus. chkdsk (space) forward slash r (space) forward slash f

During reboot, your computer will check your hard drive for errors.

Regards Howard

 

[kkokko]

ok i will try that...

howard could the minidump i copy and paste be software related? i am asking this because.. i havent had any bsod for 1 week of running my computer on 24/7...

after installing my new ram last a week and a half ago i kept getting bsods.. and then when i change the performance mode in the bios to standard mode the bsods went away...

but 1 week later.. (today) my comp restarted and said it has recovered from a serious error.. and the minidump i posted was from today..

the ones in the zip files are the ones i was getting with turbo mode on .. 1.5 weeks ago

 

[howard_hopkinso]

It still points to somekind of hardware error.

I don`t know what else I can tell you really.

I`ll see if I can get cpc2004 to have a quick look, and see what he thinks.

Regards Howard

 

[cpc2004]

Hi,

The information is insufficient. Probablly it is memoory related. Attach the minidumps here for further analysis.

 

[kkokko]

hi cpc2004 i have attached the minidumps in a zip file on the very top of my first post
please take a look if you can. there are about 5 minidumps attached

 

[kkokko]

how do stores test the rams? if a customer brings them in and says they are faulty?

 

[cpc2004]

Hi kkokko,

Your windows has a lot of problems.

Finding and Suggestion
1. If you are using Norton Internet Security Version 8.0.5.14, it may crash your windows. There have a confirmed case at this forum.
https://www.techspot.com/vb/topic35044.html
2. Two minidumps have memory corruption. It may be caused by faulty ram or software error of Internet Security
Mini100705-03.dmp and Mini100705-02.dmp
3. One minidump crash at iaStor.sys. You have sata hard disk you to install
Intel Matrix Storage Manager
http://www.intel.com/design/motherbd/cv2/cv2_drive.htm
Mini100705-01.dmp
BugCheck 1000007E, {c0000005, f76a8a49, f7ce6c9c, f7ce6998}
Probably caused by : iaStor.sys ( iaStor+32a49 )

 

[kkokko]

cpc2004

i do not have norton internet security. althuogh i do have nav 2005...
and i do have 2 sata hardives in raid 0 config.. installed using intel matrix storage manager im not sure what the problem you are refering to is?

 

[kkokko]

does the minidump crash at iaStor.sys mean that my harddrive is physically broken? or just software related?

 

[cpc2004]

Hi,

Do you install Intel Matrix Storage Manager? The running process of one your minidump is ccapp.exe which is symantec common client CC application. From the module list of your minidumps, I also find Norton AV is installed. Hence the problem is not related to Internet Security. Maybe the memory corruption it is related to some device driver has conflict with Norton AV or it is caused by faulty ram.

Assume the problem is related to faulty memory.
Suggestion
1. Check the temperature of the CPU and make sure that it is not overheat (ie temperature < 60C)
2. Reseat the memory stick to another memory slot
3. Downclock the ram
4. Clean the dust inside the computer case
5. Make sure that the ram is compatible to the motherboard
If it still crashes, diagnostic which memory stick is faulty
1. Take out one memory stick. If windows does not crash, the removed memory stick is faulty.
2. If you have only one memory stick, replace the ram

 

[kkokko]

yes i installed intel matrix storage manager?

thank for trying to help cpc2004

 

[kkokko]

well i replaced both the ram... with new ones.. and i got iastor.sys bsod right after..

 

[kkokko]

More minidumps

 

[cpc2004]

Hi,

You've installed a new Gigbit Ethernet card and the driver crashed.

BugCheck 100000D1, {4, 2, 0, f757562b}
Probably caused by : yk51x86.sys ( yk51x86+cd65 )

 

[kkokko]

cpc is it possible if lets say for example you change the ram settings in the bios to an unstable one.. and then when it loads widnows the memory corrupts and give you a blue screen.. then when you restart.. you go into the bios and change it back to stable setting. but then.. when u exit and save changes in bios and when it boots back to windows.. it give another blue screen... but after u reboot everything seems to be fine...

does then 2nd blue screen mean that the stable settings might also not be stable??
or could it just mean.. that the settings change on the bios might not have fully taken effect until you reboot the computer?

 

[cpc2004]

Hi,

I am not a hardware guy. I hope some hardware experts can answer your question.

 

[kkokko]

ok thanks anyway cpc2004

 

[kkokko]

Pls check this cpc

 

[cpc2004]

Hi kkokko,

This is hardware problem. Attach the minidumps here cannot resolved your problem. Post your problem at hardware forum.