Help analyzing Windows minidump files to troubleshoot Blue Screens

One of the Dell computers at our company has been experiencing the BSOD for quite some time, however, they are few and far between (about once per month).

The most recent message states:

The problem seems to be caused by the following file: Ntfs.sys
Stop: 0x00000050
NTFS.sys -Address F730663F base at F7304000, DATESTAMP 45XX56A7

I am not able to find out what the previous ones said, but by analyzing the minidumps in WinDbg, i can see that the errors are not the same.

Attached are the 9 most recent minidump files. I have tried opening some of these in WinDbg, a few of them say Memory Corruption, others reference problems with other files, such as NTFS.sys, ntoskrnl. My initial impression is that the ones referencing specific files are probably caused by the underlying memory problem.

I ran the dell diagnostic utility included in the boot menu for this computer, and found no errors. I know that bad memory can still pass this test, but I wanted to make sure that there aren't other problems and that memory is the only problem.

Can we tell if those other errors are caused by bad memory as well? I am new to using windbg. EE will not let me attach a zip file containing the dmp files, i will try hosting it and updating this question.
Who is Participating?
JonveeConnect With a Mentor Commented:
From your most recent Stop error, please view the "aumha" link below:

Here, suspect memory (including main memory, L2 RAM cache, video RAM) is named as the possible cause, but also incompatible software including remote control, and antivirus s/w.  It can also be other hardware problems.

Notes:  With only about one Stop occurance a month i have to admit that it does seem a little unusual if RAM is the cause.  Thought Stop error would have appeared more frequently.

From WinDbg you may notice that half of the time the failing module is shown as win32k.sys and ntoskrnl.exe, but it's unlikely these are the culprit(s).

Analysed 4 more of your Minidumps but with similar results, as expected.

Finally, you may wish to look at your antivirus software on that one machine, & perhaps consider an AV uninstall/reinstall.
bradl3yAuthor Commented:
bradl3yAuthor Commented:
We ran 20 loops of the Dell memory test, and all passed. Any idea what else could be wrong?
Free Tool: Path Explorer

An intuitive utility to help find the CSS path to UI elements on a webpage. These paths are used frequently in a variety of front-end development and QA automation tasks.

One of a set of tools we're offering as a way of saying thank you for being a part of the community.

Have used WinDbg to open four of the minidumps & i'm getting random errors also.
IMAGE_NAME:  win32k.sys

FAILURE_BUCKET_ID:  0xD1_CODE_AV_BAD_IP_win32k!GreAcquireSemaphore+18

FAILURE_BUCKET_ID:  0x8E_win32k!EXLATEOBJ::bInitXlateObj+66


This is indicative of memory problems as you suspected.  Suspect RAM even though you had no failures.

Recommend you try the excellent memtest86+  v1.7
Cannot  be absolutely sure that faulty RAM is your *only* problem, but changing it seems the next logical step.
If you change it we could take a look at more Minidumps, and look for some consistancy in the errors.

Also suggest you check RAM socket(s) condition, and if you have more than one RAM stick, you could try removing all but one, then retest.

Presume cabinet and CPU cooling are ok  .. higher than normal temperature, dust?
Also assuming that you're using the correct RAM type.
bradl3yAuthor Commented:
Thanks, I will give memtest86+ a try. I am afraid dell is still going to be very stubborn with providing a replacement as it will not be their utility that is reporting an error. I am considering just telling them that their test failed. The Dell representative did not agree that if the memory passed 10 loops of their memory test, that it can still be defective. I know that it can, and I know that no memory test will be able to detect an error 100% of the time.

That is the whole reason you get to choose the number of loops, to increase the chance that the error will occur and be detected, keyword there being chance. Dell does not seem to want to accept that and was basically ignoring my results of WinDbg and simply stating "blue screens and minidumps can be cause by a long list of problems, such as OS corruption, hard drive errors, driver errors, or memory errors, if it passes 10 loops of memory testing, you will need to reinstall the OS". That is what windbg is for, to narrow down that long list!

Sorry, end of rant.

I will give Memtest86+ a try tonight to see if it reproduces errors. I just wanted to make sure that I was correct, as I am not very experienced using WinDbg.
> I know that no memory test will be able to detect an error 100% of the time <
i absolutely agree with you, although if a RAM *is* faulty memtest will almost certainly indicate that this is so.   And i understand your rant!

If you'd like some assistance in analysing your own dump file, this should help>
"How to read the small memory dump files that Windows creates for debugging":

The !analyze -v command will probably be your most used command.

You can download windbg from this microsoft website.

Perhaps the best article of all>
"Windows system crashes":

Note that even with WinDbg, there's only about a 50% chance of a good result .. but we've made a start!
rindiConnect With a Mentor Commented:
Also test your HD with the HD manufacturer's diagnostic tool. You'll find it on the UBCD.
bradl3yAuthor Commented:
Thanks for your help so far. I let Memtest86+ run all weekend, it passed 195 loops, no errors. So it seems the RAM isn't the cause. Video RAM is shared i beleive, and would a CPU stress test find problems with the L2 Cache, or is there another way to test it?

I am running the dell harddrive diagnostics from their utility partition right now. Is there any point in running this in more than one loop, or should one be good? I've got the UBCD, so i will try the manufacturers test next.

If everything passes with the harddrive, i will check on the issue of AV software.
i was just about to post this>>

Reviewing our past comments ...
Refering to an earlier statement of mine that Memtest will almost certainly indicate that a RAM is suspect if indeed it is, should have said that Memtest will *not necessarily* indicate that a RAM is faulty, when it is.

Assuming by now that Memtest also gave the green light to your RAM, and you've considered our other proposals, perhaps a faulty driver is running over the memory.
You could therefore try checking for driver updates.
I wouldn't run the Dell HD test at all, they don't build disks.
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.