Solved

Windows XP Crash Dump Analysis

Posted on 2003-10-23
7
22,432 Views
Last Modified: 2007-12-19
Hello

I've just had about 10 Windows XP Pro systems crash at the same time. Does anyone know why this might have happened. I have included a copy of the crash dump below.

----- 32 bit Kernel Mini Dump Analysis

DUMP_HEADER32:
MajorVersion        0000000f
MinorVersion        00000a28
DirectoryTableBase  00039000
PfnDataBase         80c4a000
PsLoadedModuleList  8054be30
PsActiveProcessHead 8054de78
MachineImageType    0000014c
NumberProcessors    00000001
BugCheckCode        1000007f
BugCheckParameter1  00000008
BugCheckParameter2  80042000
BugCheckParameter3  00000000
BugCheckParameter4  00000000
PaeEnabled          00000000
KdDebuggerDataBlock 8053dde0
MiniDumpFields      00000dff

TRIAGE_DUMP32:
ServicePackBuild      00000100
SizeOfDump            00010000
ValidOffset           0000fffc
ContextOffset         00000320
ExceptionOffset       000007d0
MmOffset              00001068
UnloadedDriversOffset 000010a0
PrcbOffset            00001878
ProcessOffset         000024c8
ThreadOffset          00002720
CallStackOffset       00002978
SizeOfCallStack       00003fff
DriverListOffset      00006c08
DriverCount           00000075
StringPoolOffset      00008ec8
StringPoolSize        00001008
BrokenDriverOffset    00000000
TriageOptions         00000041
TopOfStack            f0c2b000
DebuggerDataOffset    00006978
DebuggerDataSize      00000290
DataBlocksOffset      00009ed0
DataBlocksCount       00000003


Windows XP Kernel Version 2600 (Service Pack 1) UP Free x86 compatible
Kernel base = 0x804d4000 PsLoadedModuleList = 0x8054be30
Debug session time: Fri Oct 24 12:08:24 2003
System Uptime: 0 days 3:28:26
start    end        module name
804d4000 806c6980   nt             Checksum: 0020230B  Timestamp: Thu Aug 29 19:
03:24 2002 (3D6DE35C)

Unloaded modules:
f035f000 f0386000   kmixer.sys    Timestamp: unavailable (00000000)
f035f000 f0386000   kmixer.sys    Timestamp: unavailable (00000000)
f035f000 f0386000   kmixer.sys    Timestamp: unavailable (00000000)
f035f000 f0386000   kmixer.sys    Timestamp: unavailable (00000000)
f0426000 f044d000   kmixer.sys    Timestamp: unavailable (00000000)
f0865000 f088c000   kmixer.sys    Timestamp: unavailable (00000000)
fa050000 fa051000   drmkaud.sys    Timestamp: unavailable (00000000)
f11d0000 f11dd000   DMusic.sys    Timestamp: unavailable (00000000)
f088c000 f08af000   aec.sys     Timestamp: unavailable (00000000)
f08c2000 f08d0000   swmidi.sys    Timestamp: unavailable (00000000)
f9f6c000 f9f6e000   splitter.sys    Timestamp: unavailable (00000000)
f10b3000 f10e8000   ghpcw2k.sys    Timestamp: unavailable (00000000)
f9c92000 f9c9c000   imapi.sys    Timestamp: unavailable (00000000)
f9d62000 f9d67000   Cdaudio.SYS    Timestamp: unavailable (00000000)
f9ed2000 f9ed5000   Sfloppy.SYS    Timestamp: unavailable (00000000)
f9859000 f988e000   ghpcw2k.sys    Timestamp: unavailable (00000000)

Finished dump check
0
Comment
Question by:StefanSlatter
  • 5
7 Comments
 
LVL 49

Expert Comment

by:sunray_2003
ID: 9611944
Check dump files in windows xp

http://support.microsoft.com/?kbid=254649

Sunray
0
 
LVL 44

Expert Comment

by:CrazyOne
ID: 9611949
I would double check for viruses.

Online Scanners

 Norton Web Services  
Go to this page and click on Scan for Viruses
http://security.symantec.com/ssc/vc_about.asp?j=1&langid=us&venid=sym&plfid=22&pkj=REODSKVYRMHCGVRVRMN

It needs to download a few file so as to activate the scan so you may see a message like this.

"The Scan for Viruses uses an ActiveX program to scan your computer. The download is approximately 1.5MB and can take about 10 minutes over a 28.8 modem.

The scan can take more than 20 minutes depending on the speed of your computer and the number of files that you have. Please do not browse away from this page unless you intend to abort the scan.
 
Downloading Scan for Viruses controls. Please wait...
 
During the download, you might see one or more messages asking if it is OK to download and run these programs. Click Yes when these messages appear.
 
Note: Scan for Viruses does not scan compressed files"
======================
 Trend Micro HouseCall        
www.housecall.antivirus.com
"Trend Micro's free online virus scanner
In order to better serve our customers, we ask HouseCall users to register before scanning their computer.  By registering, you will receive virus alerts from our team of Virus Doctors. You will be able to unsubscribe when you receive your first email. You can also scan without registering"
http://housecall.antivirus.com/housecall/start_corp.asp
======================

PC Pitstop Virus Scan
Our free Web-based virus scan uses Panda Software's award-winning technology and virus list. We're checking against the "wildlist," the roughly 200 viruses that are most prevalent in the world in a given month
http://www.pcpitstop.com/antivirus/default.asp
0
 
LVL 44

Expert Comment

by:CrazyOne
ID: 9611967
Stefan have you installed any software or hardware or updates on all these mahcines recently. If so look at that as the cause of this.
0
The Eight Noble Truths of Backup and Recovery

How can IT departments tackle the challenges of a Big Data world? This white paper provides a roadmap to success and helps companies ensure that all their data is safe and secure, no matter if it resides on-premise with physical or virtual machines or in the cloud.

 
LVL 44

Expert Comment

by:CrazyOne
ID: 9611974
How to Gather Information After a Memory Dump in Windows XP
http://support.microsoft.com/default.aspx?scid=kb;en-us;314084

Download Pstat here
Pstat.exe: Process and Thread Status
http://www.microsoft.com/windows2000/techinfo/reskit/tools/existing/pstat-o.asp 
0
 
LVL 44

Expert Comment

by:CrazyOne
ID: 9611989
http://www.eventid.net/display.asp?eventid=1003&eventno=1274

Error code 1000007f = "UNEXPECTED_KERNEL_MODE_TRAP_M" - The first parameter displayed on the blue screen specifies the trap number. Trap number 0x00000000, or Divide by Zero Error, may indicate memory corruption. Other hardware problems, or software failures can cause this error. See the the link to Bug Check codes for more explanations about various trap numbers.
0
 
LVL 44

Accepted Solution

by:
CrazyOne earned 125 total points
ID: 9611993
http://msdn.microsoft.com/library/default.asp?url=/library/en-us/ddtools/hh/ddtools/bccodes_0ug7.asp

Cause
Bug check 0x7F usually occurs after the installation of faulty or mismatched hardware (especially memory) or in the event that installed hardware fails.

A double fault can occur when the kernel stack overflows. This can happen if multiple drivers are attached to the same stack. For example, two file system filter drivers can be attached to the same stack and then the file system can recurse back in, overflowing the stack.

Resolving the Problem
Debugging: Always begin with the !analyze debugger extension.

If this is not sufficient, use the KV (Display Stack Backtrace) debugger command.

If KV shows a taskGate, then use the .tss (Display Task State Segment) command on the part before the colon.
If KV shows a trap frame, then use the .trap (Display Trap Frame) command to format the frame.
Otherwise, use the .trap (Display Trap Frame) command on the appropriate frame. (On x86 platforms, this frame is associated with the procedure NT!KiTrap.)
After this, use KV again to display the new stack.

Troubleshooting: If hardware was recently added to the system, remove it to see if the error recurs. If existing hardware has failed, remove or replace the faulty component. Run hardware diagnostics supplied by the system manufacturer, to determine which hardware component has failed. The memory scanner is especially important; faulty or mismatched memory can cause this bug check. For details on these procedures, see the owner's manual for your computer. Check that all adapter cards in the computer are properly seated. Use an ink eraser or an electrical contact treatment, available at electronics supply stores, to ensure adapter card contacts are clean.

If the error appears on a newly installed system, check the availability of updates for the BIOS, the SCSI controller or network cards. Updates of this kind are typically available on the Web site or BBS of the hardware manufacturer.

Confirm that all hard disks, hard disk controllers, and SCSI adapters are listed on the Microsoft Windows Hardware Compatibility List (HCL).

If the error occurred after the installation of a new or updated device driver, the driver should be removed or replaced. If, under this circumstance, the error occurs during the startup sequence and the system partition is formatted with NTFS, you might be able to use Safe Mode to rename or delete the faulty driver. If the driver is used as part of the system startup process in Safe Mode, you need to start the computer using the Recovery Console in order to access the file. Also try restarting your computer, and press F8 at the character-based menu that displays the operating system choices. At the resulting Windows Advanced Options menu, choose the Last Known Good Configuration option. This option is most effective when only one driver or service is added at a time.

Overclocking (setting the CPU to run at speeds above the rated specification) can cause this error. If this has been done to the computer experiencing the error, return the CPU to the default clock speed setting.

Check the System Log in Event Viewer for additional error messages that might help pinpoint the device or driver that is causing the error. Disabling memory caching of the BIOS might also resolve it.

If you encountered this error while upgrading to a new version of Windows, it might be caused by a device driver, a system service, a virus scanner, or a backup tool that is incompatible with the new version. If possible, remove all third-party device drivers and system services and disable any virus scanners prior to upgrading. Contact the software manufacturer to obtain updates of these tools. Also make sure that you have installed the latest Windows Service Pack.

Finally, if all the above steps fail to resolve the error, take the system motherboard to a repair facility for diagnostic testing. A crack, a scratched trace, or a defective component on the motherboard can also cause this error.
0
 

Expert Comment

by:deuzige_wn4e
ID: 11271544
this is sooo lame! Damned can there be just one single site out there which does not want only money?
0

Featured Post

Three Reasons Why Backup is Strategic

Backup is strategic to your business because your data is strategic to your business. Without backup, your business will fail. This white paper explains why it is vital for you to design and immediately execute a backup strategy to protect 100 percent of your data.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Can I legally transfer my OEM version of Windows to another PC?  (AKA - Can I put a new systemboard in my OEM PC?) Few of us are both IT and legal experts but we all have our own views of Microsoft's licensing rules and how they apply.  There are…
Sometimes people don't understand why download speed shows differently for Windows than Linux.Specially, this article covers and shows the solution for throughput difference for Windows than a Linux machine. For this, I arranged a test scenario.I…
Two types of users will appreciate AOMEI Backupper Pro: 1 - Those with PCIe drives (and haven't found cloning software that works on them). 2 - Those who want a fast clone of their boot drive (no re-boots needed) and it can clone your drive wh…

773 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question