Solved

Physical memory dump after clean load of XP pro

Posted on 2004-10-30
1,516 Views
Last Modified: 2010-05-19
I have a brand new Toshiba Laptop workstation on our network that is acting quite strange. After loading SP2 it started that 'reboot by itself' deal. I uninstalled SP2 and it gave me a 'Checksum' Error. After several trys of installing the corrupt file, then re-installing the OS, I got it to boot and work fine....for a few days. Today it's performing physical memory dumps on it's own. I'm checking over here in hardware because it's starting to sound like bad ram... The ram is on the mother board. Is there a software way to check to see if the ram is bad?
0
Question by:jhevesy
    13 Comments
     
    LVL 2

    Expert Comment

    by:joey_the_ass
    There sure is.

    www.memtest86.com

    Unfortunately, this test can't prove 100% that your RAM is good.  If it passes the test it's possible that your RAM could still be bad.  But if it does find errors, than that means your RAM is definitely bad.
    0
     
    LVL 3

    Expert Comment

    by:rjhawkin
    There are some programs that dod aoffer the ability to check memory in system they usually come with a bootable floppy or CD.

    The best one that I have come across is PC-Check from a compnay called EuroSoft. It is quite pricey at $250 but works really well, especially if you have to test a large number of systems  http://www.eurosoft-uk.com/pc_check.htm

    There was one for a long time from a company called Check-it/Check-it Pro but I havent seen any advertising from them in a while.

    A free test that I havnt ever used is the Windows Memory checker loacted at http://oca.microsoft.com/en/windiag.asp

    Goold luck
    0
     
    LVL 20

    Expert Comment

    by:cpc2004
    Check system event log and look for recrod id 1001 (ie sysdump). The bugcheck code and the paramter list is the most useful information to diagnostic your problem.

    http://www.microsoft.com/resources/documentation/Windows/XP/all/reskit/en-us/Default.asp?url=/resources/documentation/Windows/XP/all/reskit/en-us/prmd_stp_fwal.asp

    All the bugcheck code is document at microsoft web page. Repost if you need help.
    0
     

    Author Comment

    by:jhevesy
    I checked the memory and it appears to be ok. I have checked the event logs and Have a million errors or so. How do I find the right one?
    0
     

    Author Comment

    by:jhevesy
    Sorry I found the event... Now I can't find the file. It says it's at C:windows/memory.dmp????
    0
     
    LVL 20

    Expert Comment

    by:cpc2004
    I was advised not to process your minidump because it is more fair to the other people. It is not easy to interpret the record id 1001. Can you extract the content of record 1001 and repost. The event viewer has the copy button to copy the content to clipboard and you can paste the content from the clipboard. I will analysis the output of the sysdump record. If the problem is related to bugcheck 0A, it is much harder to find out the root cause as the failing module is always ntoskrnl.exe  

    The record id 1001 does not have the failing module name. The failing module can be found by processing the minidump using windbg.

    The easy way to get the failing module is disable automatic recovery. When the system crash, you will see a blue screen and the system freeze. In the blue screen, you can find the failing modules provide that the failing module is not ntoskrnl.exe (ie windows kernel). After you drop down the bugcheck code and bug check parameter. Reset the PC.

    Hope it will help you
    Albert
    0
     
    LVL 20

    Expert Comment

    by:cpc2004
    You can find the minidump at the folder \windows\minidump. Download windbg from microsoft
    http://www.microsoft.com/whdc/devtools/debugging/default.mspx

    Install windbg and invoke windbg to process the minidump.

    File --> Symbol File Path --> srv*\websymbols*http://msdl/microsoft.com/download/symbols

    File --> open the crash file (ie the minidump)

    enter the following commands at command prompt
    !analyze -v
    r
    lm t n

    write the output to a text file and repost. I will help you to analyse the output.

    Quit windbg
    You can find the explanation of bugcheck code at this url
    http://www.microsoft.com/resources/documentation/Windows/XP/all/reskit/en-us/Default.asp?url=/resources/documentation/Windows/XP/all/reskit/en-us/prmd_stp_fwal.asp

    Hope it can help you
    Albert

    0
     

    Author Comment

    by:jhevesy
    Albert,
    I'm trying my best ...please bare with me... I downloaded the debugger. I can't get it to do anything with the dump file. Which file do you open the minidump with?
    I don't know what you mean by the last part of your explaination. To clarify... I'm a hardware guy. I'm not sure what all of that other stuff you wrote like this:
    File --> Symbol File Path --> srv*\websymbols*http://msdl/microsoft.com/download/symbols

    File --> open the crash file (ie the minidump)

    enter the following commands at command prompt
    !analyze -v
    r
    lm t n
    Thanks!
    Jim
    I jumped up the points because I know this is more involved than I thought
    0
     
    LVL 20

    Expert Comment

    by:cpc2004
    After you start windbg, you will see the first of the panel looks like as

    File Edit View Debug Windows Help

    File --> Symbol File Path --> srv*\websymbols*http://msdl/microsoft.com/download/symbols

    I means Click File --> Click Symbol File Path -> Enter srv*\websymbols*http://msdl/microsoft.com/download/symbols and Press okay.

    This command instructs debugger to load the XP symbols from microsoft website.

    File --> open the crash file (ie the minidump)

    Click File and select the option to open the crash file and you can find crash dump at fiolder
    windows   \windows\minidump \*.dmp.   The dataset is something mini073004-01.dmp which means this is the first dump taken on 30th July 2004. The system event log record id 1001 has the minidump name and the path name. I don't understand why you cannot find the dump unless you specify no dump. The default option is taken minidump when windows crashes. Enable the dump option to take minidump if you specify no dump.

    Hope it can help you
    Albert




    0
     

    Author Comment

    by:jhevesy
    uhhh..How do you start windbg. There is not a "start" button, Just a file folder. What file do I click on to start it?
    0
     
    LVL 20

    Accepted Solution

    by:
    It is same as use as using microsoft winword. If you want to open a document, select file and open a document.  WinWord has no "start" button. I am afraid that you disable the dump option and no dump is written.

    Open the minidump file is same as start. the debug session.

    enter the following commands at command prompt
    .logopen c:\windows\temp\dump.txt
    !analyze -v
    r
    lm t n
    .logclose

    The output of the windbg session is written to text file at c:\windows\temp.txt

    Select -> File -> Exit  (this terminates the windbg)

    I will anticpiate you will have a lot of question to answer because interpret the output of windbg is very technical. Minidump only saves stack and register at time of crash. It can only diagnostic simple problem. For complicate problem a full dump is required, This is the reason 90% of the minidump analysis has no finding.

    Regards,
    Albert


     
    0
     

    Author Comment

    by:jhevesy
    Albert,
    It looks like this took care of it. I got some info from the debugger and I searched it and it came up that Toshiba knows about a problem they have when You upgrade XP home to Pro. They have a fix on thier website. What happened is that the USB controler was causing the problem the whole time. I just have to find the updated drivers for the USB controler. THANKS FOR ALL OF YOUR HELP! You are a kind person!
    Jim
    0
     
    LVL 20

    Expert Comment

    by:cpc2004
    You are welcome. Repost if you need further help

    Regards,
    Albert
    0

    Write Comment

    Please enter a first name

    Please enter a last name

    We will never share this with anyone.

    Featured Post

    IT, Stop Being Called Into Every Meeting

    Highfive is so simple that setting up every meeting room takes just minutes and every employee will be able to start or join a call from any room with ease. Never be called into a meeting just to get it started again. This is how video conferencing should work!

    In this article you will get to know about pros and cons of storage drives HDD, SSD and SSHD.
    Does your iMac really need a hardware upgrade? Will upgrading RAM speed-up your computer? If yes, then how can you proceed? Upgrading RAM in your iMac is not as simple as it may seem. This article will help you in getting and installing right RA…
    This video Micro Tutorial is the first in a two-part series that shows how to create and use custom scanning profiles in Nuance's PaperPort 14.5 (http://www.experts-exchange.com/articles/17490/). But the ability to create custom scanning profiles al…
    Sending a Secure fax is easy with eFax Corporate (http://www.enterprise.efax.com). First, Just open a new email message.  In the To field, type your recipient's fax number @efaxsend.com. You can even send a secure international fax — just include t…

    933 members asked questions and received personalized solutions in the past 7 days.

    Join the community of 500,000 technology professionals and ask your questions.

    Join & Ask a Question

    Need Help in Real-Time?

    Connect with top rated Experts

    23 Experts available now in Live!

    Get 1:1 Help Now