Would like some to analyze a mini dmp

Posted on 2006-05-23
Medium Priority
Last Modified: 2012-06-27
I need someone who's willing to have a mini dmp file emailed to them for analysis....

Much appreciated!!!
Question by:entronet
LVL 74

Expert Comment

by:Jeffrey Kane - TechSoEasy
ID: 16756326
How about having Microsoft do it... at http://oca.microsoft.com.  They see a bunch more of those than I do.

LVL 20

Expert Comment

ID: 16761827
The crash may be caused by faulty ram or device driver error (ie video, sound card, modem and etc). The system event log and the minidump has the most useful diagnostic information. When Windows crashes with blue screen, it writes a system event 1001 or 1003 and a minidump to the folder \windows\minidump. Check system event 1001 and 1003 and it has the detail of the blue screen.

Event ID: 1001
Source: Save Dump
The computer has rebooted from a bugcheck.The bugcheck was : 0xc000000a (0xe1270188, 0x00000002, 0x00000000, 0x804032100).
Microsoft Windows..... A dump was saved in: .......

Event Source: System Error
Event Category: (102)
Event ID: 1003
Error code 1000007f, parameter1 0000000d, parameter2 00000000, parameter3 00000000, parameter4 00000000

Control Panel -> Adminstrative Tools -> Event Viewer -> System -> Event 1001/1003. Copy the content and paste it back here

Zip 5 to 6 minidumps to a zip file and attach it at any webspace. I will study the dump and find out the culprit. If you can't provide the minidumps, run memtest to stress test the ram. Make sure that your windows is not infected with spyware, adware adn chkdsk /r.

Get public webspace
Use a free service like rapidshare to attach the minidumps and post the url of the mimidumps at this thread.

Author Comment

ID: 16764164
here's the link to one file. I'll will be getting more today


Technology Partners: We Want Your Opinion!

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

LVL 20

Expert Comment

ID: 16770467
One minidump is insufficient to confirm the culprit. Attach 5 to 6 minidumps at webspace. From the stack trace, the crash may be related the Norton AV or corrupted filesystem. Run chkdsk /r and un-unstall Norton AV. It is also worthwhile to run memtest to stress test the ram.

f04f1240 f71b2930 849d9730 f04f1270 00001000 nt!CcMapData+0xed
f04f1260 f71b2c36 84542e50 e24e3ba8 07730000 Ntfs!NtfsMapStream+0x44
f04f1290 f71b2d4f 84542e50 0000000c 00007730 Ntfs!ReadIndexBuffer+0x88
f04f12c0 f71b7bc2 84542e50 f04f1338 e29ec748 Ntfs!FindFirstIndexEntry+0x18f
f04f13c8 f71c7c3a 84542e50 e24e3ba8 e29ec748 Ntfs!NtfsFindIndexEntry+0x48
f04f1484 f71c7d0b 84542e50 e24e3ba8 e2b7f008 Ntfs!NtfsAddDosOnlyName+0x122
f04f14c0 f71c3649 84542e50 00000001 e24e3ba8 Ntfs!NtfsAddLink+0xa7
f04f1698 f71bc5cf 84542e50 84576a58 84576ba0 Ntfs!NtfsCreateNewFile+0x755
f04f18bc f71b251f 84542e50 84576a58 f04f18fc Ntfs!NtfsCommonCreate+0x1200
f04f19c0 804f0473 85f40020 84576a58 84576be8 Ntfs!NtfsFsdCreate+0x17d
f04f19d0 f0eea741 84576bc4 84576be8 f04f1a30 nt!IofCallDriver+0x3f
WARNING: Stack unwind information not available. Following frames may be wrong.
f04f19f8 f0ef1890 85f40020 85f11980 f04f1a30 SYMEVENT+0x7741
f04f1a14 f0eea7b9 f04f1a30 804f1d00 f0eea87a SYMEVENT+0xe890
f04f1a50 804f0473 85cc6740 84576a58 84576a58 SYMEVENT+0x77b9
f04f1a60 8058f828 86556c10 85d9d0ac f04f1c14 nt!IofCallDriver+0x3f
f04f1b58 8058e412 86556c28 00000000 85d9d008 nt!IopParseDevice+0xab5
f04f1bd4 8058db49 00000000 f04f1c14 00000040 nt!ObpLookupObjectName+0x545
f04f1c28 8058fa39 00000000 00000000 00040001 nt!ObOpenObjectByName+0xe8
f04f1ca4 8058fb0d 09b0f87c c0100080 09b0f818 nt!IopCreateFile+0x413
f04f1cf0 8058e21e 09b0f87c c0100080 09b0f818 nt!IoCreateFile+0x3d
f04f1d30 804dfd24 09b0f87c c0100080 09b0f818 nt!NtCreateFile+0x2e
f04f1d30 7ffe0304 09b0f87c c0100080 09b0f818 nt!KiSystemService+0xd0
09b0f874 00000000 00000000 00000000 00000000 SharedUserData!SystemCallStub+0x4
LVL 20

Accepted Solution

cpc2004 earned 1000 total points
ID: 16775965
Probably the culprit is Norton AV. Maybe Nortin AV conflicts with other device driver. Uninstall Norton AV may fix the problem.

Mini052206-02.dmp BugCheck A, {80000004, 2, 1, 807490dc}
Probably caused by : SYMEVENT.SYS ( SYMEVENT+10c7d )

Mini052306-01.dmp BugCheck A, {80000004, 2, 1, 807490dc}
Probably caused by : exifs.sys ( exifs+11805 )

Mini052306-02.dmp BugCheck A, {80000004, 2, 1, 807490dc}
Probably caused by : SYMEVENT.SYS ( SYMEVENT+3d3a )

Mini052306-03.dmp BugCheck 24, {190329, f04f112c, f04f0d7c, 805899eb}
Probably caused by : Ntfs.sys ( Ntfs!NtfsMapStream+44 )

Mini052306-04.dmp BugCheck 24, {190329, f09cf0e0, f09ced30, 805899eb}
Probably caused by : Ntfs.sys ( Ntfs!NtfsMapStream+44 )
LVL 32

Assisted Solution

by:Robberbaron (robr)
Robberbaron (robr) earned 1000 total points
ID: 16783668
there has been a bug in SYMEVENT.SYS   Symantec update service event manager.

I had 3 blue screens in 2 weeks.  Looked at the minidumps myself (thanks mainly to various explanatory posts by cpc2004 in various part of the web!) and the dumps all pointed the finger at SYSMEVENT.SYS

a google turned up several refernces on boith MS and Symantec sites noting poblems with new versions of SYMEVENT, mainly with latest PC Anywhere installation.  Recommendation was to remove PCAnywhere !

I suspect that they fixed it and perhaps autoupdated as i havent had problem for about a month.

Featured Post

Free Tool: Site Down Detector

Helpful to verify reports of your own downtime, or to double check a downed website you are trying to access.

One of a set of tools we are providing to everyone as a way of saying thank you for being a part of the community.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

This guide is intended for migrating Windows 2003 Standard with Exchange 2003 to Windows Small Business Server 2008. You will need the following: Exchange Best Practice Analyzer: http://www.microsoft.com/downloads/details.aspx?FamilyID=DBAB201F-…
I work for a company that primarily works with small businesses as their outsourced IT vendor. As such the majority of these customers utilize some version of Small Business Server. Due to the economics of running a small business, many of these cus…
Exchange organizations may use the Journaling Agent of the Transport Service to archive messages going through Exchange. However, if the Transport Service is integrated with some email content management application (such as an anti-spam), the admin…
Is your data getting by on basic protection measures? In today’s climate of debilitating malware and ransomware—like WannaCry—that may not be enough. You need to establish more than basics, like a recovery plan that protects both data and endpoints.…

809 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question