1. TechSpot is dedicated to computer enthusiasts and power users. Ask a question and give support. Join the community here.
    TechSpot is dedicated to computer enthusiasts and power users.
    Ask a question and give support.
    Join the community here, it only takes a minute.
    Dismiss Notice

Reading those minidumps

By Hatrick ยท 17 replies
Nov 26, 2006
  1. Hi, I'm new, so if I ask stupid questions or offend protocols, please speak up.

    Having far too many 'system error, category 102, event 1003) happenings in WniXP(Home), I decided to try to have a first ever look at the minidump files.

    Following the instructions in the Microsoft support document, I downloaded the Windows debugging tools, copied i386 from the CD to Windows, moved the minidump files to the suggested location, cut and pasted the batch file into the correct folder and connected to the net before running the batch file.

    This is what I got:-

    Microsoft (R) Windows Debugger Version 6.6.0007.5
    Copyright (c) Microsoft Corporation. All rights reserved.

    Loading Dump File [C:\WINDOWS\minidump\mini112506-01.dmp]
    Mini Kernel Dump File: Only registers and stack trace are available

    Symbol search path is: srv*c:\symbols*http://msdl.microsoft.com/download/symbols
    Executable search path is: c:\windows\i386
    *** ERROR: Symbol file could not be found. Defaulted to export symbols for ntoskrnl.exe -
    Windows XP Kernel Version 2600 (Service Pack 2) UP Free x86 compatible
    Product: WinNt, suite: TerminalServer SingleUserTS Personal
    Built by: 2600.xpsp_sp2_gdr.050301-1519
    Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055a420
    Debug session time: Sat Nov 25 12:33:22.656 2006 (GMT+0)
    System Uptime: 0 days 1:36:12.218
    *** ERROR: Symbol file could not be found. Defaulted to export symbols for ntoskrnl.exe -
    Loading Kernel Symbols
    Loading User Symbols
    Loading unloaded module list
    * *
    * Bugcheck Analysis *
    * *

    Use !analyze -v to get detailed debugging information.

    BugCheck 1000008E, {c0000005, e30e0000, f016b72c, 0}

    ANALYSIS: Kernel with unknown size. Will force reload symbols with known size.
    ANALYSIS: Force reload command: .reload /f ntoskrnl.exe=FFFFFFFF804D7000,213F80,42250FF9
    ***** Kernel symbols are WRONG. Please fix symbols to do analysis.

    ***** Kernel symbols are WRONG. Please fix symbols to do analysis.

    Probably caused by : win32k.sys ( win32k!HmgRemoveObject+a0 )

    Followup: MachineOwner

    It appears that, despite the net connection, the debugger was unable to connect with the symbols files. Is it possible that this is because Firefox is my default browser? Surely Microsoft is not that small minded.
    Can anyone explain the significance of the 'Probably caused by : win32k.sys' comment in the penultimate line? Should I just run sfc /scannow, or is it something deeper than that?

    Think carefully before offering help because, if I get to see the contents of the files, I will almost certainly be back to ask what it all means. <BG>
  2. Ididmyc600

    Ididmyc600 TechSpot Chancellor Posts: 1,415

    Hi Hatrick and welcome to the TS forum

    You cant offend us were to old for that so dont worry as for reading minidumps, congrats on taking the initiative and actually doing something about your problem, most just come in and take and never give back.

    I started reading minidumps a while back, I had trouble using the online symbols so I downloaded them to my hard drive, its a very big file so you need lots of room. Once downloaded just tell MSdebugger the path to the symbols in the setup options.

    Once you have that sorted, here's a hint, open up the help file and use the search option on the error code, most are in the format 0X0xxx where x is a number or letter, the help file will list the faults associated with the code and will point you in the right direction, Google is also a good place to look up the error codes, you will find that the errors are listed frequently on Google and may have more than one reason for them, search through until you find a webpage that refers specifically to the problem you are having.

    SO do a google on win32k.sys and read the threads as a starter and go from there, i'm in here most nights or feel free to PM me and help where I can...

  3. tjyaz27

    tjyaz27 TS Rookie

    I cannot read minidumps as well. But i would like to know how to save and link my minidumps to my post so others can read them. Can someone plz tell me how to do this?
  4. cpc2004

    cpc2004 TS Evangelist Posts: 1,994


    This site supports attachment. You zip the minidumps and attach the zip file here.
  5. tjyaz27

    tjyaz27 TS Rookie

    Where can i find my minidumps?
  6. N3051M

    N3051M TS Evangelist Posts: 2,115

    Open up My computer and then navigate to:

    If this folder doesn't exist, or there's nothing in there, it would mean on of three things:
    1: You don't have any errors or recent BSODs/restarts lately
    2: Your Windows folder is somewhere else, which case look for it, or type in %systemroot%\minidump in the Start>Run box.
    3: Its not enabled on your PC. To fix:
    >>Right click My computer icon on the desktop then Properties>Advanced Tab>[Startup and Recovery] Settings
    -Uncheck Auto restart
    -[Writing Debugging information] Select Complete memory dump from the drop down box
  7. Hatrick

    Hatrick TS Rookie Topic Starter Posts: 90

  8. Hatrick

    Hatrick TS Rookie Topic Starter Posts: 90

    Use 'search' or 'Agent Ransack' if you have it. Search C:\ *.dmp.
  9. tjyaz27

    tjyaz27 TS Rookie

    How do i attach my minidumps to my post? I found the minidumps but how do i put them on my post?
  10. Ididmyc600

    Ididmyc600 TechSpot Chancellor Posts: 1,415

    I am a Brit, born and bred, congrats is coz im to lazy to type congrat.... see even now I cant be bothered,
    As for the other part of your post sorry I forgot to mention those things, by default most times its set to dump a 64k file, not the full 700mb, if it does that it cant be read my windebug,

    If you get good at reading them then come here on the evenings when your free, there is always lots of bluescreen\minidump posts to be read and answered..



    As to how to attach a file to your post, when you post a message there is a little paperclip just above where you type, its next to the smiley face, click it and the rest is self explanatory.

  11. greenflash

    greenflash TS Rookie Posts: 100

    and if you are analyzing dumps on a local machine you shouldnt install Daemon Tools on that pc:)
  12. tjyaz27

    tjyaz27 TS Rookie

    K im going to send you the minidumps

    Ok thanks. Recently i have been getting a blue screen when trying to download the patch for the game World of Warcraft. it says DRIVER_IRQS_NOT_LESS_OR_EQUAL. I meet all the requirements for this game and i even bought a new graphics card. World of Warcraft is the only game i have this issue with. Here are my minidumps plz try and figure out what is wrong.

    This one didnt fit in.

    Thanks in advance

    Attached Files:

  13. cpc2004

    cpc2004 TS Evangelist Posts: 1,994


    The system is crashed without any pattern. I believe that the culprit is faulty ram as hardware error occurs randomly. Run memtest to stress test the ram.

    Mini102006-01.dmp BugCheck 100000D1, {bb33120, 2, 1, 85abb009}
    Probably caused by : ntkrpamp.exe ( nt!IoStartPacket+8d )

    Mini111506-01.dmp BugCheck 100000D1, {c, 2, 0, aa021ccf}
    Probably caused by : MpFirewall.sys ( MpFirewall+2ccf )

    Mini112606-01.dmp BugCheck 100000D0, {80000, 2, 1, 80547ed8}
    Probably caused by : wg111v2.sys ( wg111v2+5c60 )

    Mini112606-02.dmp BugCheck 100000D1, {7dcb8f00, 2, 1, 86248877}
    Probably caused by : ntkrpamp.exe ( nt!IoStartPacket+8d )

    Mini112606-03.dmp BugCheck 100000D1, {ac2028, 2, 0, f48fd76f}
    Probably caused by : afd.sys ( afd!AfdGetReceiveBuffer+4f )
  14. Ididmyc600

    Ididmyc600 TechSpot Chancellor Posts: 1,415

    I have that and Alcohol on mine and I have no problems as far as I can see...

  15. tjyaz27

    tjyaz27 TS Rookie


    How do i run a memtest and if the results are bad, do i have to get a new ram?
  16. howard_hopkinso

    howard_hopkinso TS Rookie Posts: 24,177   +19

    Hello and welcome to Techspot.

    Take a look at this Memtest tutorial.

    If Memtest gives you errors, then your ram is bad.

    Regards Howard :wave: :wave:
  17. tjyaz27

    tjyaz27 TS Rookie

    New Error

    Ok i got a few new errors (my ram is ok). I bought a new graphics card and now when i get in the game it has a blue screen and a new error:


    0x000000D1 (0x00001028, 0x00000002, 0x00000000, 0xF6F1S1E7)

    USBPORT.SYS- ADDRESS F6F1SIE7 base at F6F0D000, Datestamp 435ec23d

    I think this error might be caused by my netgear router. I have NETGEAR WG111v2. It has a 54mbps. Here are my minidumps.

    Attached Files:

  18. N3051M

    N3051M TS Evangelist Posts: 2,115

    all your minidumps were corrupted (driver list not recorded on there)

    It faulted on a driver issue. > DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)

    -update all your drivers, including motherboard chipset drivers.

    USBPORT.sys relates to your USB drivers. Maybe take out all extra USB devices (including hubs) and see if its stable. If it is, put one device at a time until you find your culprit.

    Attatched is the debug logs.
Topic Status:
Not open for further replies.

Similar Topics

Add New Comment

You need to be a member to leave a comment. Join thousands of tech enthusiasts and participate.
TechSpot Account You may also...