?
Solved

Need Help Diagnosing Memory Dump

Posted on 2006-04-04
6
Medium Priority
?
680 Views
Last Modified: 2008-01-09
Below is a read out from an Windows 2000 computer that keeps blue screening.  So far I have removed AV, reinstalled all the drivers to the latest versions, ran all the windows updates and am still having the problem.  It seems to occur when I am copying large files which makes me think it is related to network drivers or the IP stack.  



Loading Dump File [C:\Documents and Settings\helpdesk\Desktop\MEMORY.DMP]
Kernel Complete Dump File: Full address space is available

Symbol search path is: SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols
Executable search path is: C:\I386
Windows 2000 Kernel Version 2195 (Service Pack 4) UP Free x86 compatible
Product: WinNt
Kernel base = 0x80400000 PsLoadedModuleList = 0x8046e1b8
Debug session time: Tue Apr  4 11:22:54.210 2006 (GMT-5)
System Uptime: 0 days 0:03:31.046
WARNING: Process directory table base 00B6F000 doesn't match CR3 00030000
WARNING: Process directory table base 00B6F000 doesn't match CR3 00030000
Loading Kernel Symbols
..........................................................................................................
Loading unloaded module list
........
Loading User Symbols
.................
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 9C, {0, 0, a2000000, 84010400}

*** ERROR: Module load completed but symbols could not be loaded for mdm.exe
Probably caused by : ntoskrnl.exe ( nt!ExpCopyThreadInfo+59 )

Followup: MachineOwner
---------

kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

MACHINE_CHECK_EXCEPTION (9c)
A fatal Machine Check Exception has occurred.
KeBugCheckEx parameters;
    x86 Processors
        If the processor has ONLY MCE feature available (For example Intel
        Pentium), the parameters are:
        1 - Low  32 bits of P5_MC_TYPE MSR
        2 - Address of MCA_EXCEPTION structure
        3 - High 32 bits of P5_MC_ADDR MSR
        4 - Low  32 bits of P5_MC_ADDR MSR
        If the processor also has MCA feature available (For example Intel
        Pentium Pro), the parameters are:
        1 - Bank number
        2 - Address of MCA_EXCEPTION structure
        3 - High 32 bits of MCi_STATUS MSR for the MCA bank that had the error
        4 - Low  32 bits of MCi_STATUS MSR for the MCA bank that had the error
    IA64 Processors
        1 - Bugcheck Type
            1 - MCA_ASSERT
            2 - MCA_GET_STATEINFO
                SAL returned an error for SAL_GET_STATEINFO while processing MCA.
            3 - MCA_CLEAR_STATEINFO
                SAL returned an error for SAL_CLEAR_STATEINFO while processing MCA.
            4 - MCA_FATAL
                FW reported a fatal MCA.
            5 - MCA_NONFATAL
                SAL reported a recoverable MCA and we don't support currently
                support recovery or SAL generated an MCA and then couldn't
                produce an error record.
            0xB - INIT_ASSERT
            0xC - INIT_GET_STATEINFO
                  SAL returned an error for SAL_GET_STATEINFO while processing INIT event.
            0xD - INIT_CLEAR_STATEINFO
                  SAL returned an error for SAL_CLEAR_STATEINFO while processing INIT event.
            0xE - INIT_FATAL
                  Not used.
        2 - Address of log
        3 - Size of log
        4 - Error code in the case of x_GET_STATEINFO or x_CLEAR_STATEINFO
    AMD64 Processors
        1 - Bank number
        2 - Address of MCA_EXCEPTION structure
        3 - High 32 bits of MCi_STATUS MSR for the MCA bank that had the error
        4 - Low  32 bits of MCi_STATUS MSR for the MCA bank that had the error
Arguments:
Arg1: 00000000
Arg2: 00000000
Arg3: a2000000
Arg4: 84010400

Debugging Details:
------------------


BUGCHECK_STR:  0x9C_IA32_GenuineIntel

DEFAULT_BUCKET_ID:  INTEL_CPU_MICROCODE_ZERO

LAST_CONTROL_TRANSFER:  from 80062b7e to 80062be6

STACK_TEXT:  
8186005c 80062b7e 8025a000 00000000 00000000 hal!HalpMcaSwitchMcaExceptionStackAndBugCheck+0x46
8186005c 80486000 8025a000 00000000 00000000 hal!HalpMcaExceptionHandlerWrapper+0x46
ed67fa84 80485e43 b760b670 81866b20 00008000 nt!ExpCopyThreadInfo+0x59
ed67fb04 8049424f 00143400 00008000 ed67fb78 nt!ExpGetProcessInformation+0x1f7
ed67fd4c 80465691 00000005 00143400 00008000 nt!NtQuerySystemInformation+0x7b1
ed67fd4c 77f87d1c 00000005 00143400 00008000 nt!KiSystemService+0xc4
00e0fe28 690a3158 00000005 00143400 00008000 ntdll!ZwQuerySystemInformation+0xb
00e0fe8c 00429eb9 00c0c218 00000190 00e0fec8 psapi!EnumProcesses+0x56
WARNING: Stack unwind information not available. Following frames may be wrong.
00e0fee8 0042a056 00c035e8 00e0ff44 00000001 mdm+0x29eb9
00e0ff04 00408158 00c035e8 00e0ff44 00000001 mdm+0x2a056
00e0ff48 004084e9 00c035c0 00138010 00137400 mdm+0x8158
00e0ffb0 00408528 7c4e987c 00c035c0 00138010 mdm+0x84e9
00e0ffec 00000000 0040851f 00c035c0 00000000 mdm+0x8528


FOLLOWUP_IP:
nt!ExpCopyThreadInfo+59
80486000 8b4764           mov     eax,[edi+0x64]

SYMBOL_STACK_INDEX:  2

FOLLOWUP_NAME:  MachineOwner

SYMBOL_NAME:  nt!ExpCopyThreadInfo+59

MODULE_NAME:  nt

IMAGE_NAME:  ntoskrnl.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  3ee6c002

STACK_COMMAND:  kb

FAILURE_BUCKET_ID:  0x9C_IA32_GenuineIntel_nt!ExpCopyThreadInfo+59

BUCKET_ID:  0x9C_IA32_GenuineIntel_nt!ExpCopyThreadInfo+59

Followup: MachineOwner
---------
0
Comment
Question by:steinmto
  • 3
4 Comments
 
LVL 20

Accepted Solution

by:
cpc2004 earned 2000 total points
ID: 16375587
Arg4: 84010400 is internal timer error.  Probably the culprit is faulty m/b. If you overclock the CPU, change it back to original setting.
0
 
LVL 20

Expert Comment

by:cpc2004
ID: 16375710
Refer the following cases and it is exactly the same as your problem.
http://www.experts-exchange.com/Operating_Systems/Win2000/Q_21722742.html
0
 
LVL 20

Expert Comment

by:cpc2004
ID: 16375765
Arguments:
Arg1: 00000000
Arg2: 00000000
Arg3: a2000000
Arg4: 84010400

Debugging Details:
------------------

***** Kernel symbols are WRONG. Please fix symbols to do analysis.

   NOTE:  This is a hardware error.  This error was reported by the CPU
   via Interrupt 18.  This analysis will provide more information about
   the specific error.  Please contact the manufacturer for additional
   information about this error and troubleshooting assistance.

   Bit Mask:

       MA                           Model Specific       MCA
    O  ID      Other Information      Error Code     Error Code
   VV  SDP ___________|____________ _______|_______ _______|______
   AEUECRC|                        |               |              |
   LRCNVVC|                        |               |              |
   ^^^^^^^|                        |               |              |
      6         5         4         3         2         1
   3210987654321098765432109876543210987654321098765432109876543210
   ----------------------------------------------------------------
   1010000111111111111111111111111110000100000000010000010000000000


VAL   - MCi_STATUS register is valid
        Indicates that the information contained within the IA32_MCi_STATUS
        register is valid.  When this flag is set, the processor follows the
        rules given for the OVER flag in the IA32_MCi_STATUS register when
        overwriting previously valid entries.  The processor sets the VAL
        flag and software is responsible for clearing it.

UC    - Error Uncorrected
        Indicates that the processor did not or was not able to correct the
        error condition.  When clear, this flag indicates that the processor
        was able to correct the error condition.

INTTIMERERR - INTERNAL TIMER ERROR
0
 
LVL 8

Author Comment

by:steinmto
ID: 16422951
Getting a replacement mb/processor i will let you know how it goes.
0

Featured Post

How to Use the Help Bell

Need to boost the visibility of your question for solutions? Use the Experts Exchange Help Bell to confirm priority levels and contact subject-matter experts for question attention.  Check out this how-to article for more information.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

NTFS file system has been developed by Microsoft that is widely used by Windows NT operating system and its advanced versions. It is the mostly used over FAT file system as it provides superior features like reliability, security, storage, efficienc…
Social messanging services like WhatsApp and Facebook can help businesses in ways that many owners don't even imagine, giving new opportunities to connect with customers. Discover some of the most innovative things they can do for your company.
Loops Section Overview
When cloud platforms entered the scene, users and companies jumped on board to take advantage of the many benefits, like the ability to work and connect with company information from various locations. What many didn't foresee was the increased risk…
Suggested Courses
Course of the Month16 days, 20 hours left to enroll

862 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question