steinmto
asked on
Need Help Diagnosing Memory Dump
Below is a read out from an Windows 2000 computer that keeps blue screening. So far I have removed AV, reinstalled all the drivers to the latest versions, ran all the windows updates and am still having the problem. It seems to occur when I am copying large files which makes me think it is related to network drivers or the IP stack.
Loading Dump File [C:\Documents and Settings\helpdesk\Desktop\ MEMORY.DMP ]
Kernel Complete Dump File: Full address space is available
Symbol search path is: SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols
Executable search path is: C:\I386
Windows 2000 Kernel Version 2195 (Service Pack 4) UP Free x86 compatible
Product: WinNt
Kernel base = 0x80400000 PsLoadedModuleList = 0x8046e1b8
Debug session time: Tue Apr 4 11:22:54.210 2006 (GMT-5)
System Uptime: 0 days 0:03:31.046
WARNING: Process directory table base 00B6F000 doesn't match CR3 00030000
WARNING: Process directory table base 00B6F000 doesn't match CR3 00030000
Loading Kernel Symbols
.......................... .......... .......... .......... .......... .......... .......... .......... ..........
Loading unloaded module list
........
Loading User Symbols
.................
************************** ********** ********** ********** ********** ********** ***
* *
* Bugcheck Analysis *
* *
************************** ********** ********** ********** ********** ********** ***
Use !analyze -v to get detailed debugging information.
BugCheck 9C, {0, 0, a2000000, 84010400}
*** ERROR: Module load completed but symbols could not be loaded for mdm.exe
Probably caused by : ntoskrnl.exe ( nt!ExpCopyThreadInfo+59 )
Followup: MachineOwner
---------
kd> !analyze -v
************************** ********** ********** ********** ********** ********** ***
* *
* Bugcheck Analysis *
* *
************************** ********** ********** ********** ********** ********** ***
MACHINE_CHECK_EXCEPTION (9c)
A fatal Machine Check Exception has occurred.
KeBugCheckEx parameters;
x86 Processors
If the processor has ONLY MCE feature available (For example Intel
Pentium), the parameters are:
1 - Low 32 bits of P5_MC_TYPE MSR
2 - Address of MCA_EXCEPTION structure
3 - High 32 bits of P5_MC_ADDR MSR
4 - Low 32 bits of P5_MC_ADDR MSR
If the processor also has MCA feature available (For example Intel
Pentium Pro), the parameters are:
1 - Bank number
2 - Address of MCA_EXCEPTION structure
3 - High 32 bits of MCi_STATUS MSR for the MCA bank that had the error
4 - Low 32 bits of MCi_STATUS MSR for the MCA bank that had the error
IA64 Processors
1 - Bugcheck Type
1 - MCA_ASSERT
2 - MCA_GET_STATEINFO
SAL returned an error for SAL_GET_STATEINFO while processing MCA.
3 - MCA_CLEAR_STATEINFO
SAL returned an error for SAL_CLEAR_STATEINFO while processing MCA.
4 - MCA_FATAL
FW reported a fatal MCA.
5 - MCA_NONFATAL
SAL reported a recoverable MCA and we don't support currently
support recovery or SAL generated an MCA and then couldn't
produce an error record.
0xB - INIT_ASSERT
0xC - INIT_GET_STATEINFO
SAL returned an error for SAL_GET_STATEINFO while processing INIT event.
0xD - INIT_CLEAR_STATEINFO
SAL returned an error for SAL_CLEAR_STATEINFO while processing INIT event.
0xE - INIT_FATAL
Not used.
2 - Address of log
3 - Size of log
4 - Error code in the case of x_GET_STATEINFO or x_CLEAR_STATEINFO
AMD64 Processors
1 - Bank number
2 - Address of MCA_EXCEPTION structure
3 - High 32 bits of MCi_STATUS MSR for the MCA bank that had the error
4 - Low 32 bits of MCi_STATUS MSR for the MCA bank that had the error
Arguments:
Arg1: 00000000
Arg2: 00000000
Arg3: a2000000
Arg4: 84010400
Debugging Details:
------------------
BUGCHECK_STR: 0x9C_IA32_GenuineIntel
DEFAULT_BUCKET_ID: INTEL_CPU_MICROCODE_ZERO
LAST_CONTROL_TRANSFER: from 80062b7e to 80062be6
STACK_TEXT:
8186005c 80062b7e 8025a000 00000000 00000000 hal!HalpMcaSwitchMcaExcept ionStackAn dBugCheck+ 0x46
8186005c 80486000 8025a000 00000000 00000000 hal!HalpMcaExceptionHandle rWrapper+0 x46
ed67fa84 80485e43 b760b670 81866b20 00008000 nt!ExpCopyThreadInfo+0x59
ed67fb04 8049424f 00143400 00008000 ed67fb78 nt!ExpGetProcessInformatio n+0x1f7
ed67fd4c 80465691 00000005 00143400 00008000 nt!NtQuerySystemInformatio n+0x7b1
ed67fd4c 77f87d1c 00000005 00143400 00008000 nt!KiSystemService+0xc4
00e0fe28 690a3158 00000005 00143400 00008000 ntdll!ZwQuerySystemInforma tion+0xb
00e0fe8c 00429eb9 00c0c218 00000190 00e0fec8 psapi!EnumProcesses+0x56
WARNING: Stack unwind information not available. Following frames may be wrong.
00e0fee8 0042a056 00c035e8 00e0ff44 00000001 mdm+0x29eb9
00e0ff04 00408158 00c035e8 00e0ff44 00000001 mdm+0x2a056
00e0ff48 004084e9 00c035c0 00138010 00137400 mdm+0x8158
00e0ffb0 00408528 7c4e987c 00c035c0 00138010 mdm+0x84e9
00e0ffec 00000000 0040851f 00c035c0 00000000 mdm+0x8528
FOLLOWUP_IP:
nt!ExpCopyThreadInfo+59
80486000 8b4764 mov eax,[edi+0x64]
SYMBOL_STACK_INDEX: 2
FOLLOWUP_NAME: MachineOwner
SYMBOL_NAME: nt!ExpCopyThreadInfo+59
MODULE_NAME: nt
IMAGE_NAME: ntoskrnl.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 3ee6c002
STACK_COMMAND: kb
FAILURE_BUCKET_ID: 0x9C_IA32_GenuineIntel_nt! ExpCopyThr eadInfo+59
BUCKET_ID: 0x9C_IA32_GenuineIntel_nt! ExpCopyThr eadInfo+59
Followup: MachineOwner
---------
Loading Dump File [C:\Documents and Settings\helpdesk\Desktop\
Kernel Complete Dump File: Full address space is available
Symbol search path is: SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols
Executable search path is: C:\I386
Windows 2000 Kernel Version 2195 (Service Pack 4) UP Free x86 compatible
Product: WinNt
Kernel base = 0x80400000 PsLoadedModuleList = 0x8046e1b8
Debug session time: Tue Apr 4 11:22:54.210 2006 (GMT-5)
System Uptime: 0 days 0:03:31.046
WARNING: Process directory table base 00B6F000 doesn't match CR3 00030000
WARNING: Process directory table base 00B6F000 doesn't match CR3 00030000
Loading Kernel Symbols
..........................
Loading unloaded module list
........
Loading User Symbols
.................
**************************
* *
* Bugcheck Analysis *
* *
**************************
Use !analyze -v to get detailed debugging information.
BugCheck 9C, {0, 0, a2000000, 84010400}
*** ERROR: Module load completed but symbols could not be loaded for mdm.exe
Probably caused by : ntoskrnl.exe ( nt!ExpCopyThreadInfo+59 )
Followup: MachineOwner
---------
kd> !analyze -v
**************************
* *
* Bugcheck Analysis *
* *
**************************
MACHINE_CHECK_EXCEPTION (9c)
A fatal Machine Check Exception has occurred.
KeBugCheckEx parameters;
x86 Processors
If the processor has ONLY MCE feature available (For example Intel
Pentium), the parameters are:
1 - Low 32 bits of P5_MC_TYPE MSR
2 - Address of MCA_EXCEPTION structure
3 - High 32 bits of P5_MC_ADDR MSR
4 - Low 32 bits of P5_MC_ADDR MSR
If the processor also has MCA feature available (For example Intel
Pentium Pro), the parameters are:
1 - Bank number
2 - Address of MCA_EXCEPTION structure
3 - High 32 bits of MCi_STATUS MSR for the MCA bank that had the error
4 - Low 32 bits of MCi_STATUS MSR for the MCA bank that had the error
IA64 Processors
1 - Bugcheck Type
1 - MCA_ASSERT
2 - MCA_GET_STATEINFO
SAL returned an error for SAL_GET_STATEINFO while processing MCA.
3 - MCA_CLEAR_STATEINFO
SAL returned an error for SAL_CLEAR_STATEINFO while processing MCA.
4 - MCA_FATAL
FW reported a fatal MCA.
5 - MCA_NONFATAL
SAL reported a recoverable MCA and we don't support currently
support recovery or SAL generated an MCA and then couldn't
produce an error record.
0xB - INIT_ASSERT
0xC - INIT_GET_STATEINFO
SAL returned an error for SAL_GET_STATEINFO while processing INIT event.
0xD - INIT_CLEAR_STATEINFO
SAL returned an error for SAL_CLEAR_STATEINFO while processing INIT event.
0xE - INIT_FATAL
Not used.
2 - Address of log
3 - Size of log
4 - Error code in the case of x_GET_STATEINFO or x_CLEAR_STATEINFO
AMD64 Processors
1 - Bank number
2 - Address of MCA_EXCEPTION structure
3 - High 32 bits of MCi_STATUS MSR for the MCA bank that had the error
4 - Low 32 bits of MCi_STATUS MSR for the MCA bank that had the error
Arguments:
Arg1: 00000000
Arg2: 00000000
Arg3: a2000000
Arg4: 84010400
Debugging Details:
------------------
BUGCHECK_STR: 0x9C_IA32_GenuineIntel
DEFAULT_BUCKET_ID: INTEL_CPU_MICROCODE_ZERO
LAST_CONTROL_TRANSFER: from 80062b7e to 80062be6
STACK_TEXT:
8186005c 80062b7e 8025a000 00000000 00000000 hal!HalpMcaSwitchMcaExcept
8186005c 80486000 8025a000 00000000 00000000 hal!HalpMcaExceptionHandle
ed67fa84 80485e43 b760b670 81866b20 00008000 nt!ExpCopyThreadInfo+0x59
ed67fb04 8049424f 00143400 00008000 ed67fb78 nt!ExpGetProcessInformatio
ed67fd4c 80465691 00000005 00143400 00008000 nt!NtQuerySystemInformatio
ed67fd4c 77f87d1c 00000005 00143400 00008000 nt!KiSystemService+0xc4
00e0fe28 690a3158 00000005 00143400 00008000 ntdll!ZwQuerySystemInforma
00e0fe8c 00429eb9 00c0c218 00000190 00e0fec8 psapi!EnumProcesses+0x56
WARNING: Stack unwind information not available. Following frames may be wrong.
00e0fee8 0042a056 00c035e8 00e0ff44 00000001 mdm+0x29eb9
00e0ff04 00408158 00c035e8 00e0ff44 00000001 mdm+0x2a056
00e0ff48 004084e9 00c035c0 00138010 00137400 mdm+0x8158
00e0ffb0 00408528 7c4e987c 00c035c0 00138010 mdm+0x84e9
00e0ffec 00000000 0040851f 00c035c0 00000000 mdm+0x8528
FOLLOWUP_IP:
nt!ExpCopyThreadInfo+59
80486000 8b4764 mov eax,[edi+0x64]
SYMBOL_STACK_INDEX: 2
FOLLOWUP_NAME: MachineOwner
SYMBOL_NAME: nt!ExpCopyThreadInfo+59
MODULE_NAME: nt
IMAGE_NAME: ntoskrnl.exe
DEBUG_FLR_IMAGE_TIMESTAMP:
STACK_COMMAND: kb
FAILURE_BUCKET_ID: 0x9C_IA32_GenuineIntel_nt!
BUCKET_ID: 0x9C_IA32_GenuineIntel_nt!
Followup: MachineOwner
---------
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Arguments:
Arg1: 00000000
Arg2: 00000000
Arg3: a2000000
Arg4: 84010400
Debugging Details:
------------------
***** Kernel symbols are WRONG. Please fix symbols to do analysis.
NOTE: This is a hardware error. This error was reported by the CPU
via Interrupt 18. This analysis will provide more information about
the specific error. Please contact the manufacturer for additional
information about this error and troubleshooting assistance.
Bit Mask:
MA Model Specific MCA
O ID Other Information Error Code Error Code
VV SDP ___________|____________ _______|_______ _______|______
AEUECRC| | | |
LRCNVVC| | | |
^^^^^^^| | | |
6 5 4 3 2 1
32109876543210987654321098 7654321098 7654321098 7654321098 76543210
-------------------------- ---------- ---------- ---------- --------
10100001111111111111111111 1111111000 0100000000 0100000100 00000000
VAL - MCi_STATUS register is valid
Indicates that the information contained within the IA32_MCi_STATUS
register is valid. When this flag is set, the processor follows the
rules given for the OVER flag in the IA32_MCi_STATUS register when
overwriting previously valid entries. The processor sets the VAL
flag and software is responsible for clearing it.
UC - Error Uncorrected
Indicates that the processor did not or was not able to correct the
error condition. When clear, this flag indicates that the processor
was able to correct the error condition.
INTTIMERERR - INTERNAL TIMER ERROR
Arg1: 00000000
Arg2: 00000000
Arg3: a2000000
Arg4: 84010400
Debugging Details:
------------------
***** Kernel symbols are WRONG. Please fix symbols to do analysis.
NOTE: This is a hardware error. This error was reported by the CPU
via Interrupt 18. This analysis will provide more information about
the specific error. Please contact the manufacturer for additional
information about this error and troubleshooting assistance.
Bit Mask:
MA Model Specific MCA
O ID Other Information Error Code Error Code
VV SDP ___________|____________ _______|_______ _______|______
AEUECRC| | | |
LRCNVVC| | | |
^^^^^^^| | | |
6 5 4 3 2 1
32109876543210987654321098
--------------------------
10100001111111111111111111
VAL - MCi_STATUS register is valid
Indicates that the information contained within the IA32_MCi_STATUS
register is valid. When this flag is set, the processor follows the
rules given for the OVER flag in the IA32_MCi_STATUS register when
overwriting previously valid entries. The processor sets the VAL
flag and software is responsible for clearing it.
UC - Error Uncorrected
Indicates that the processor did not or was not able to correct the
error condition. When clear, this flag indicates that the processor
was able to correct the error condition.
INTTIMERERR - INTERNAL TIMER ERROR
ASKER
Getting a replacement mb/processor i will let you know how it goes.
https://www.experts-exchange.com/questions/21722742/Windows-2000-Server-Hard-Freezes-on-a-Daily-Basis.html