How do I read minidumps?

[chrisjv2000]

Crash dump

I have at least 2 BSOD's in a week. Attached is my windbg log, can somebody help me here please ?

Thanks

 

[Ndoan]

I bought this new asus motherboard and a new dual core cpu... since i started using it, it keeps rebooting... thought it was the RAM but i checked by replacing the sticks with new ones but its the same...

got this on the event viewer:
Event Type: Error
Event Source: System Error
Event Category: (102)
Event ID: 1003
Date: 17/10/2007
Time: 12:22:10 PM
User: N/A
Computer: THE-MATRIX
Description:
Error code 0000009c, parameter1 00000000, parameter2 f7795050, parameter3 b2000000, parameter4 1040080f.


Data:
0000: 53 79 73 74 65 6d 20 45 System E
0008: 72 72 6f 72 20 20 45 72 rror Er
0010: 72 6f 72 20 63 6f 64 65 ror code
0018: 20 30 30 30 30 30 30 39 0000009
0020: 63 20 20 50 61 72 61 6d c Param
0028: 65 74 65 72 73 20 30 30 eters 00
0030: 30 30 30 30 30 30 2c 20 000000,
0038: 66 37 37 39 35 30 35 30 f7795050
0040: 2c 20 62 32 30 30 30 30 , b20000
0048: 30 30 2c 20 31 30 34 30 00, 1040
0050: 30 38 30 66 080f



can someone plis help me... got the minidump but how do i attach it in here...

cheers
Nicky

 

[Tedster]

Howard pointed out some were having difficulty with the previous link on minidumps and has suggested this one as a tutorial. http://forums.majorgeeks.com/showthread.php?t=35246

enjoy!

 

[Dominique]

Hello,

As i saw you read dump as a guru I have mine in a thread under Windows OS:

C:\Program Files\Support Tools>dumpchk L:\WINNT\Minidump\Mini112707-10.dmp
****************************************************************
**
** Windows 2000 Crash Dump Analysis
**
****************************************************************
*
Filename . . . . . . .L:\WINNT\Minidump\Mini112707-10.dmp
Signature. . . . . . .PAGE
ValidDump. . . . . . .DUMP
MajorVersion . . . . .free system
MinorVersion . . . . .2195
DirectoryTableBase . .0x04d18000
PfnDataBase. . . . . .0x81896000
PsLoadedModuleList . .0x80481580
PsActiveProcessHead. .0x80483008
MachineImageType . . .i386
NumberProcessors . . .1
BugCheckCode . . . . .0x00000050
BugCheckParameter1 . .0xf0ea5fc7
BugCheckParameter2 . .0x00000000
BugCheckParameter3 . .0xa003f6f8
BugCheckParameter4 . .0x00000000

ExceptionCode. . . . .0x80000003
ExceptionFlags . . . .0x00000001
ExceptionAddress . . .0x80449d19

What is issue? It is happening on all Windows 2000 workstations when I try to connect remotely and if the user trying to login does not have already a profile created locally....

Thank you,
Dominique

 

[fresh]

Pls help with my minidump

pls can any1 help with read my minidump n tell me y my computer keeps showing dat blue screen

 

[kimsland]

Inside the 1 MiniDump:

BugCheck F4, {3, 899481a0, 89948314, 805d2970}
Unable to load image mfehidk.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for mfehidk.sys
*** ERROR: Module load completed but symbols could not be loaded for mfehidk.sys
Probably caused by : hardware_disk

Probably caused by "Daemon Tools"
Try uninstalling it in Add/Remove programs

Also in future you should create your own thread

 

[stevengfowler]

Here is my minidump. Please tell me why my computer keeps restarting!!

And what do I need to do? PLEASE HELP!

It's too long to post here. Can someone provide me with an email so I can send it so that you may look it over and help?

Sincerely,

Steven
stevengfowler (at) yahoo.com

 

[Route44]

And what do I need to do? PLEASE HELP!

It's too long to post here. Can someone provide me with an email so I can send it so that you may look it over and help?

Sincerely,

Steven
stevengfowler (at) yahoo.com

1. First, start your own post. You will find that you will get quicker responses than attaching to an old thread.

2. Put your system specs in your profile including power supply and operating system.

3. Read the sticky in this forum ebtitled "Before posting your minidumps..." by Julio. Do the advice given there and see if those steps help you rectify your issues. And let us know.

4. Do make a public post. Just give the highlights. We don't need all the details. Someone will definitely come along and help.

Lastly, welcome to the forums. :wave:

 

[momok]

I've gone through the steps as listed, but I'm getting the following:

***    Your debugger is not using the correct symbols                 ***
***                                                                   ***
***    In order for this command to work properly, your symbol path   ***
***    must point to .pdb files that have full type information.      ***
***                                                                   ***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                          ***

Anyone knows how to rectify this?

 

[kimsland]

Perhaps another link

Here you can learn how to read your own Minidump
http://forums.majorgeeks.com/showthread.php?t=35246

Here's some info, before attaching MiniDumps (for new members)
https://www.techspot.com/vb/topic51365.html

 

[Geekazoid93]

I've gone through the steps as listed, but I'm getting the following:

***    Your debugger is not using the correct symbols                 ***
***                                                                   ***
***    In order for this command to work properly, your symbol path   ***
***    must point to .pdb files that have full type information.      ***
***                                                                   ***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                          ***

Anyone knows how to rectify this?

ok try this go to windbg(within debugging tools for windows) then go file>symbol fiel path and then input the location of the symbols folder you created (if you havent done this, just go to c: and create a folder with the name 'symbols', then input it in windbg)

Hope this helps

 

[apandya]

Debugcheck SP3 Outlook Failure

Can anyone tell what could be provoking this?

*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 0000002c, memory referenced
Arg2: 000000ff, IRQL
Arg3: 00000001, bitfield :
bit 0 : value 0 = read operation, 1 = write operation
bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: 805418fb, address which referenced memory

Debugging Details:
------------------


WRITE_ADDRESS: 0000002c

CURRENT_IRQL: ff

FAULTING_IP:
nt!KiServiceExit2+117
805418fb 897308 mov dword ptr [ebx+8],esi

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: CODE_CORRUPTION

BUGCHECK_STR: 0xA

PROCESS_NAME: OUTLOOK.EXE

LAST_CONTROL_TRANSFER: from 988dbde0 to 805418fb

STACK_TEXT:
988dbd64 988dbde0 badb0d00 7c8024b7 033c2310 nt!KiServiceExit2+0x117
WARNING: Frame IP not in any known module. Following frames may be wrong.
988dbddc 805460ee b9ca8b85 87520700 00000000 0x988dbde0
988dbde0 b9ca8b84 87520700 00000000 4020027f nt!KiThreadStartup+0x16
988dbde4 87520700 00000000 4020027f 015f0000 NDIS!___PchSym_+0xc
988dbde8 00000000 4020027f 015f0000 02436b42 0x87520700


STACK_COMMAND: kb

CHKIMG_EXTENSION: !chkimg -lo 50 -d !nt
!chkimg -lo 50 -d !nt
80541461-80541465 5 bytes - nt!KiSystemService

[ 6a 00 55 53 56:e9 aa 6c 73 39 ]
80541547-8054154b 5 bytes - nt!KiFastCallEntry+17 (+0xe6)

[ 6a 23 52 9c 6a:e9 84 6c 73 39 ]
10 errors : !nt (80541461-8054154b)

MODULE_NAME: SysPlant

IMAGE_NAME: SysPlant.sys

DEBUG_FLR_IMAGE_TIMESTAMP: 45a4b4e9

FOLLOWUP_NAME: MachineOwner

MEMORY_CORRUPTOR: PATCH_SysPlant

FAILURE_BUCKET_ID: MEMORY_CORRUPTION_PATCH_SysPlant

BUCKET_ID: MEMORY_CORRUPTION_PATCH_SysPlant

Followup: MachineOwner
---------

 

[Route44]

This is an old thread. In the future you really need to start your own posting so that you can receive help all the quicker.

0xA errors are due to hardware or faulty drivers. In your case it is the Symantec CMC Firewall driver SysPlant.sys. You could update the software but we are recommending people to uninstall Symantec/Norton and go with better offerings. If you do decide to uninstall then make sure you go to their website, find the removal tool for your particular version and use it. This software is notorious for leaving remanants of itself behind.