Link to home
Start Free TrialLog in
Avatar of steinmto
steinmtoFlag for United States of America

asked on

Need Help Diagnosing Memory Dump

Below is a read out from an Windows 2000 computer that keeps blue screening.  So far I have removed AV, reinstalled all the drivers to the latest versions, ran all the windows updates and am still having the problem.  It seems to occur when I am copying large files which makes me think it is related to network drivers or the IP stack.  



Loading Dump File [C:\Documents and Settings\helpdesk\Desktop\MEMORY.DMP]
Kernel Complete Dump File: Full address space is available

Symbol search path is: SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols
Executable search path is: C:\I386
Windows 2000 Kernel Version 2195 (Service Pack 4) UP Free x86 compatible
Product: WinNt
Kernel base = 0x80400000 PsLoadedModuleList = 0x8046e1b8
Debug session time: Tue Apr  4 11:22:54.210 2006 (GMT-5)
System Uptime: 0 days 0:03:31.046
WARNING: Process directory table base 00B6F000 doesn't match CR3 00030000
WARNING: Process directory table base 00B6F000 doesn't match CR3 00030000
Loading Kernel Symbols
..........................................................................................................
Loading unloaded module list
........
Loading User Symbols
.................
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 9C, {0, 0, a2000000, 84010400}

*** ERROR: Module load completed but symbols could not be loaded for mdm.exe
Probably caused by : ntoskrnl.exe ( nt!ExpCopyThreadInfo+59 )

Followup: MachineOwner
---------

kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

MACHINE_CHECK_EXCEPTION (9c)
A fatal Machine Check Exception has occurred.
KeBugCheckEx parameters;
    x86 Processors
        If the processor has ONLY MCE feature available (For example Intel
        Pentium), the parameters are:
        1 - Low  32 bits of P5_MC_TYPE MSR
        2 - Address of MCA_EXCEPTION structure
        3 - High 32 bits of P5_MC_ADDR MSR
        4 - Low  32 bits of P5_MC_ADDR MSR
        If the processor also has MCA feature available (For example Intel
        Pentium Pro), the parameters are:
        1 - Bank number
        2 - Address of MCA_EXCEPTION structure
        3 - High 32 bits of MCi_STATUS MSR for the MCA bank that had the error
        4 - Low  32 bits of MCi_STATUS MSR for the MCA bank that had the error
    IA64 Processors
        1 - Bugcheck Type
            1 - MCA_ASSERT
            2 - MCA_GET_STATEINFO
                SAL returned an error for SAL_GET_STATEINFO while processing MCA.
            3 - MCA_CLEAR_STATEINFO
                SAL returned an error for SAL_CLEAR_STATEINFO while processing MCA.
            4 - MCA_FATAL
                FW reported a fatal MCA.
            5 - MCA_NONFATAL
                SAL reported a recoverable MCA and we don't support currently
                support recovery or SAL generated an MCA and then couldn't
                produce an error record.
            0xB - INIT_ASSERT
            0xC - INIT_GET_STATEINFO
                  SAL returned an error for SAL_GET_STATEINFO while processing INIT event.
            0xD - INIT_CLEAR_STATEINFO
                  SAL returned an error for SAL_CLEAR_STATEINFO while processing INIT event.
            0xE - INIT_FATAL
                  Not used.
        2 - Address of log
        3 - Size of log
        4 - Error code in the case of x_GET_STATEINFO or x_CLEAR_STATEINFO
    AMD64 Processors
        1 - Bank number
        2 - Address of MCA_EXCEPTION structure
        3 - High 32 bits of MCi_STATUS MSR for the MCA bank that had the error
        4 - Low  32 bits of MCi_STATUS MSR for the MCA bank that had the error
Arguments:
Arg1: 00000000
Arg2: 00000000
Arg3: a2000000
Arg4: 84010400

Debugging Details:
------------------


BUGCHECK_STR:  0x9C_IA32_GenuineIntel

DEFAULT_BUCKET_ID:  INTEL_CPU_MICROCODE_ZERO

LAST_CONTROL_TRANSFER:  from 80062b7e to 80062be6

STACK_TEXT:  
8186005c 80062b7e 8025a000 00000000 00000000 hal!HalpMcaSwitchMcaExceptionStackAndBugCheck+0x46
8186005c 80486000 8025a000 00000000 00000000 hal!HalpMcaExceptionHandlerWrapper+0x46
ed67fa84 80485e43 b760b670 81866b20 00008000 nt!ExpCopyThreadInfo+0x59
ed67fb04 8049424f 00143400 00008000 ed67fb78 nt!ExpGetProcessInformation+0x1f7
ed67fd4c 80465691 00000005 00143400 00008000 nt!NtQuerySystemInformation+0x7b1
ed67fd4c 77f87d1c 00000005 00143400 00008000 nt!KiSystemService+0xc4
00e0fe28 690a3158 00000005 00143400 00008000 ntdll!ZwQuerySystemInformation+0xb
00e0fe8c 00429eb9 00c0c218 00000190 00e0fec8 psapi!EnumProcesses+0x56
WARNING: Stack unwind information not available. Following frames may be wrong.
00e0fee8 0042a056 00c035e8 00e0ff44 00000001 mdm+0x29eb9
00e0ff04 00408158 00c035e8 00e0ff44 00000001 mdm+0x2a056
00e0ff48 004084e9 00c035c0 00138010 00137400 mdm+0x8158
00e0ffb0 00408528 7c4e987c 00c035c0 00138010 mdm+0x84e9
00e0ffec 00000000 0040851f 00c035c0 00000000 mdm+0x8528


FOLLOWUP_IP:
nt!ExpCopyThreadInfo+59
80486000 8b4764           mov     eax,[edi+0x64]

SYMBOL_STACK_INDEX:  2

FOLLOWUP_NAME:  MachineOwner

SYMBOL_NAME:  nt!ExpCopyThreadInfo+59

MODULE_NAME:  nt

IMAGE_NAME:  ntoskrnl.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  3ee6c002

STACK_COMMAND:  kb

FAILURE_BUCKET_ID:  0x9C_IA32_GenuineIntel_nt!ExpCopyThreadInfo+59

BUCKET_ID:  0x9C_IA32_GenuineIntel_nt!ExpCopyThreadInfo+59

Followup: MachineOwner
---------
ASKER CERTIFIED SOLUTION
Avatar of cpc2004
cpc2004
Flag of Hong Kong image

Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
Arguments:
Arg1: 00000000
Arg2: 00000000
Arg3: a2000000
Arg4: 84010400

Debugging Details:
------------------

***** Kernel symbols are WRONG. Please fix symbols to do analysis.

   NOTE:  This is a hardware error.  This error was reported by the CPU
   via Interrupt 18.  This analysis will provide more information about
   the specific error.  Please contact the manufacturer for additional
   information about this error and troubleshooting assistance.

   Bit Mask:

       MA                           Model Specific       MCA
    O  ID      Other Information      Error Code     Error Code
   VV  SDP ___________|____________ _______|_______ _______|______
   AEUECRC|                        |               |              |
   LRCNVVC|                        |               |              |
   ^^^^^^^|                        |               |              |
      6         5         4         3         2         1
   3210987654321098765432109876543210987654321098765432109876543210
   ----------------------------------------------------------------
   1010000111111111111111111111111110000100000000010000010000000000


VAL   - MCi_STATUS register is valid
        Indicates that the information contained within the IA32_MCi_STATUS
        register is valid.  When this flag is set, the processor follows the
        rules given for the OVER flag in the IA32_MCi_STATUS register when
        overwriting previously valid entries.  The processor sets the VAL
        flag and software is responsible for clearing it.

UC    - Error Uncorrected
        Indicates that the processor did not or was not able to correct the
        error condition.  When clear, this flag indicates that the processor
        was able to correct the error condition.

INTTIMERERR - INTERNAL TIMER ERROR
Avatar of steinmto

ASKER

Getting a replacement mb/processor i will let you know how it goes.