Solved

Windows XP Crash Dump Analysis

Posted on 2003-10-23
7
22,423 Views
Last Modified: 2007-12-19
Hello

I've just had about 10 Windows XP Pro systems crash at the same time. Does anyone know why this might have happened. I have included a copy of the crash dump below.

----- 32 bit Kernel Mini Dump Analysis

DUMP_HEADER32:
MajorVersion        0000000f
MinorVersion        00000a28
DirectoryTableBase  00039000
PfnDataBase         80c4a000
PsLoadedModuleList  8054be30
PsActiveProcessHead 8054de78
MachineImageType    0000014c
NumberProcessors    00000001
BugCheckCode        1000007f
BugCheckParameter1  00000008
BugCheckParameter2  80042000
BugCheckParameter3  00000000
BugCheckParameter4  00000000
PaeEnabled          00000000
KdDebuggerDataBlock 8053dde0
MiniDumpFields      00000dff

TRIAGE_DUMP32:
ServicePackBuild      00000100
SizeOfDump            00010000
ValidOffset           0000fffc
ContextOffset         00000320
ExceptionOffset       000007d0
MmOffset              00001068
UnloadedDriversOffset 000010a0
PrcbOffset            00001878
ProcessOffset         000024c8
ThreadOffset          00002720
CallStackOffset       00002978
SizeOfCallStack       00003fff
DriverListOffset      00006c08
DriverCount           00000075
StringPoolOffset      00008ec8
StringPoolSize        00001008
BrokenDriverOffset    00000000
TriageOptions         00000041
TopOfStack            f0c2b000
DebuggerDataOffset    00006978
DebuggerDataSize      00000290
DataBlocksOffset      00009ed0
DataBlocksCount       00000003


Windows XP Kernel Version 2600 (Service Pack 1) UP Free x86 compatible
Kernel base = 0x804d4000 PsLoadedModuleList = 0x8054be30
Debug session time: Fri Oct 24 12:08:24 2003
System Uptime: 0 days 3:28:26
start    end        module name
804d4000 806c6980   nt             Checksum: 0020230B  Timestamp: Thu Aug 29 19:
03:24 2002 (3D6DE35C)

Unloaded modules:
f035f000 f0386000   kmixer.sys    Timestamp: unavailable (00000000)
f035f000 f0386000   kmixer.sys    Timestamp: unavailable (00000000)
f035f000 f0386000   kmixer.sys    Timestamp: unavailable (00000000)
f035f000 f0386000   kmixer.sys    Timestamp: unavailable (00000000)
f0426000 f044d000   kmixer.sys    Timestamp: unavailable (00000000)
f0865000 f088c000   kmixer.sys    Timestamp: unavailable (00000000)
fa050000 fa051000   drmkaud.sys    Timestamp: unavailable (00000000)
f11d0000 f11dd000   DMusic.sys    Timestamp: unavailable (00000000)
f088c000 f08af000   aec.sys     Timestamp: unavailable (00000000)
f08c2000 f08d0000   swmidi.sys    Timestamp: unavailable (00000000)
f9f6c000 f9f6e000   splitter.sys    Timestamp: unavailable (00000000)
f10b3000 f10e8000   ghpcw2k.sys    Timestamp: unavailable (00000000)
f9c92000 f9c9c000   imapi.sys    Timestamp: unavailable (00000000)
f9d62000 f9d67000   Cdaudio.SYS    Timestamp: unavailable (00000000)
f9ed2000 f9ed5000   Sfloppy.SYS    Timestamp: unavailable (00000000)
f9859000 f988e000   ghpcw2k.sys    Timestamp: unavailable (00000000)

Finished dump check
0
Comment
Question by:StefanSlatter
  • 5
7 Comments
 
LVL 49

Expert Comment

by:sunray_2003
ID: 9611944
Check dump files in windows xp

http://support.microsoft.com/?kbid=254649

Sunray
0
 
LVL 44

Expert Comment

by:CrazyOne
ID: 9611949
I would double check for viruses.

Online Scanners

 Norton Web Services  
Go to this page and click on Scan for Viruses
http://security.symantec.com/ssc/vc_about.asp?j=1&langid=us&venid=sym&plfid=22&pkj=REODSKVYRMHCGVRVRMN

It needs to download a few file so as to activate the scan so you may see a message like this.

"The Scan for Viruses uses an ActiveX program to scan your computer. The download is approximately 1.5MB and can take about 10 minutes over a 28.8 modem.

The scan can take more than 20 minutes depending on the speed of your computer and the number of files that you have. Please do not browse away from this page unless you intend to abort the scan.
 
Downloading Scan for Viruses controls. Please wait...
 
During the download, you might see one or more messages asking if it is OK to download and run these programs. Click Yes when these messages appear.
 
Note: Scan for Viruses does not scan compressed files"
======================
 Trend Micro HouseCall        
www.housecall.antivirus.com
"Trend Micro's free online virus scanner
In order to better serve our customers, we ask HouseCall users to register before scanning their computer.  By registering, you will receive virus alerts from our team of Virus Doctors. You will be able to unsubscribe when you receive your first email. You can also scan without registering"
http://housecall.antivirus.com/housecall/start_corp.asp
======================

PC Pitstop Virus Scan
Our free Web-based virus scan uses Panda Software's award-winning technology and virus list. We're checking against the "wildlist," the roughly 200 viruses that are most prevalent in the world in a given month
http://www.pcpitstop.com/antivirus/default.asp
0
 
LVL 44

Expert Comment

by:CrazyOne
ID: 9611967
Stefan have you installed any software or hardware or updates on all these mahcines recently. If so look at that as the cause of this.
0
IT, Stop Being Called Into Every Meeting

Highfive is so simple that setting up every meeting room takes just minutes and every employee will be able to start or join a call from any room with ease. Never be called into a meeting just to get it started again. This is how video conferencing should work!

 
LVL 44

Expert Comment

by:CrazyOne
ID: 9611974
How to Gather Information After a Memory Dump in Windows XP
http://support.microsoft.com/default.aspx?scid=kb;en-us;314084

Download Pstat here
Pstat.exe: Process and Thread Status
http://www.microsoft.com/windows2000/techinfo/reskit/tools/existing/pstat-o.asp
0
 
LVL 44

Expert Comment

by:CrazyOne
ID: 9611989
http://www.eventid.net/display.asp?eventid=1003&eventno=1274

Error code 1000007f = "UNEXPECTED_KERNEL_MODE_TRAP_M" - The first parameter displayed on the blue screen specifies the trap number. Trap number 0x00000000, or Divide by Zero Error, may indicate memory corruption. Other hardware problems, or software failures can cause this error. See the the link to Bug Check codes for more explanations about various trap numbers.
0
 
LVL 44

Accepted Solution

by:
CrazyOne earned 125 total points
ID: 9611993
http://msdn.microsoft.com/library/default.asp?url=/library/en-us/ddtools/hh/ddtools/bccodes_0ug7.asp

Cause
Bug check 0x7F usually occurs after the installation of faulty or mismatched hardware (especially memory) or in the event that installed hardware fails.

A double fault can occur when the kernel stack overflows. This can happen if multiple drivers are attached to the same stack. For example, two file system filter drivers can be attached to the same stack and then the file system can recurse back in, overflowing the stack.

Resolving the Problem
Debugging: Always begin with the !analyze debugger extension.

If this is not sufficient, use the KV (Display Stack Backtrace) debugger command.

If KV shows a taskGate, then use the .tss (Display Task State Segment) command on the part before the colon.
If KV shows a trap frame, then use the .trap (Display Trap Frame) command to format the frame.
Otherwise, use the .trap (Display Trap Frame) command on the appropriate frame. (On x86 platforms, this frame is associated with the procedure NT!KiTrap.)
After this, use KV again to display the new stack.

Troubleshooting: If hardware was recently added to the system, remove it to see if the error recurs. If existing hardware has failed, remove or replace the faulty component. Run hardware diagnostics supplied by the system manufacturer, to determine which hardware component has failed. The memory scanner is especially important; faulty or mismatched memory can cause this bug check. For details on these procedures, see the owner's manual for your computer. Check that all adapter cards in the computer are properly seated. Use an ink eraser or an electrical contact treatment, available at electronics supply stores, to ensure adapter card contacts are clean.

If the error appears on a newly installed system, check the availability of updates for the BIOS, the SCSI controller or network cards. Updates of this kind are typically available on the Web site or BBS of the hardware manufacturer.

Confirm that all hard disks, hard disk controllers, and SCSI adapters are listed on the Microsoft Windows Hardware Compatibility List (HCL).

If the error occurred after the installation of a new or updated device driver, the driver should be removed or replaced. If, under this circumstance, the error occurs during the startup sequence and the system partition is formatted with NTFS, you might be able to use Safe Mode to rename or delete the faulty driver. If the driver is used as part of the system startup process in Safe Mode, you need to start the computer using the Recovery Console in order to access the file. Also try restarting your computer, and press F8 at the character-based menu that displays the operating system choices. At the resulting Windows Advanced Options menu, choose the Last Known Good Configuration option. This option is most effective when only one driver or service is added at a time.

Overclocking (setting the CPU to run at speeds above the rated specification) can cause this error. If this has been done to the computer experiencing the error, return the CPU to the default clock speed setting.

Check the System Log in Event Viewer for additional error messages that might help pinpoint the device or driver that is causing the error. Disabling memory caching of the BIOS might also resolve it.

If you encountered this error while upgrading to a new version of Windows, it might be caused by a device driver, a system service, a virus scanner, or a backup tool that is incompatible with the new version. If possible, remove all third-party device drivers and system services and disable any virus scanners prior to upgrading. Contact the software manufacturer to obtain updates of these tools. Also make sure that you have installed the latest Windows Service Pack.

Finally, if all the above steps fail to resolve the error, take the system motherboard to a repair facility for diagnostic testing. A crack, a scratched trace, or a defective component on the motherboard can also cause this error.
0
 

Expert Comment

by:deuzige_wn4e
ID: 11271544
this is sooo lame! Damned can there be just one single site out there which does not want only money?
0

Featured Post

Maximize Your Threat Intelligence Reporting

Reporting is one of the most important and least talked about aspects of a world-class threat intelligence program. Here’s how to do it right.

Join & Write a Comment

cPanel is a Unix based web hosting control panel that provides a graphical interface and automation tools designed to simplify the process of hosting a web site. cPanel utilizes a 3 tier structure that provides functionality for administrators, rese…
We have adopted the strategy to use Computers in Student Labs as the bulletin boards. The same target can be achieved by using a Login Notice feature in Group policy but it’s not as attractive as graphical wallpapers with message which grabs the att…
When you create an app prototype with Adobe XD, you can insert system screens -- sharing or Control Center, for example -- with just a few clicks. This video shows you how. You can take the full course on Experts Exchange at http://bit.ly/XDcourse.
This video demonstrates how to create an example email signature rule for a department in a company using CodeTwo Exchange Rules. The signature will be inserted beneath users' latest emails in conversations and will be displayed in users' Sent Items…

747 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

10 Experts available now in Live!

Get 1:1 Help Now