Solved

XP BSOD bugcheck with no minidump

Posted on 2008-10-25
35
1,530 Views
Last Modified: 2011-04-14
BACKGROUND

I started having BSODs a couple of months ago. It was always a bugcheck c2. According to the MS knowledge base the cause of this could be "hardware or software" (big whoop). The minidump would always implicate a driver from Webroot Spysweeper. I first started the tech support process with them, and after a long round of back and forth, eventually uninstalled Spysweeper.

The BSODs continued, although now referring to a different program each time. I had already done a through memtest86, and no new hardware had been installed recently. Since I had been needed to reinstall Windows for quite some time anyways, I decided to do it to see if that would cure the problem.

AFTER REINSTALLING WINDOWS

After the clean install, BSODs have continued, usually while the machine is running overnight. However, there is no minidump, and nothing in the Event Log. The proper settings to create the minidump are set, and there is a pagefile > 200MB on the C partition, with the main 5GB pagefile on the F partition.

Any ideas on how to get the minidump?

0
Comment
Question by:jasimon9
  • 19
  • 12
  • 4
35 Comments
 
LVL 24

Expert Comment

by:DMTechGrooup
ID: 22804265
Its sounds like a total crash before it has a chance to do the dump.  Scan the HDD for errors.. try a chkdsk /r first and then use something like spinrite or the disk from the manufacture..  Also check your motherboard for bludging or blown caps.
0
 
LVL 27

Expert Comment

by:Jonvee
ID: 22805598
Have you disabled auto restart in order to see a Minidump?
Right click My Computer > Properties > Advanced > Startup and Recovery Settings and uncheck Automatically Restart.
The dumps are normally located in c:\windows\minidump\    
or  %systemroot%\minidump\

If you do locate a crash dump can you paste it in the "Attach Code Snippet" box and i'll see if the analysis shoes anything.

Another possible reason if you find no dump, is a flakey PSU.  Maybe you have a spare you can try.

You could also test your hard disk with the appropriate Tester>
http://www.tacktech.com/display.cfm?ttid=287
0
 

Author Comment

by:jasimon9
ID: 22806091
DMTechGrooup: normally chkdsk in the past has shown no errors. However, I ran chkdsk /r on all of my partitions, and this time did find some errors.

btw, I did notice on one BDOD, there was some info about writing a dump, where it displayed a series of numbers. Something like ....   1 .. 2 .. 3 .. 4 .. 5 .. 6 .. 7 .. 8 .. 9 (or something similar). I was thinking this might be a "full" dump as opposed to a minidump. And I understand that the file would be named memory.dmp. However, no such file was present on the disk either.

Well in any case, there were errors found on each partition. Mostly of the "cleaning up unused ___ " type messages. However, there was one message that I think could be problematical: HKDSK discovered free space marked as allocated in the
master file table (MFT) bitmap.

So in fact this running of chkdsk /r was definitely needed, and may even be a cure. But only time will tell.

Also, one other oddity: on one of the partitions, it took about 10 times as long as I would have expected to finish phase 4 and 5, the checking of the data and free areas.

Have not used spinrite for years, but I agree that is also a good next step. Will check Gibson's site ..... just checked and it is a commercial product now. I believe it was freeware back when I used it last.
0
 

Author Comment

by:jasimon9
ID: 22806110
Jonvee: yes, auto-restart has been disabled. Minidump should be there whether auto-restart is enabled or disabled however.

By PSU I presume you mean Power Supply Unit. No spare on hand.

I tried some disk tools from the page for Samsung drives. However, the programs immediate abort with error messages.
0
 

Author Comment

by:jasimon9
ID: 22806126
More -- I went to Samsung's web site and found the exact same utility. However, complete documentation is provided on how to use it (http://www.samsung.com/global/business/hdd/support/utilities/Support_HUTIL.html).

As I was kind of suspecting, it is a DOS-based tool. So a DOS boot disk is needed.

They also provide an ISO for a CD, which is what I would need because I don't have a diskette drive in this machine. (I do have plenty of old versions of DOS around on diskettes, but no ease way to use them on this machine).

In any case, I will try the ISO, with the hope that there is a DOS-compatible OS built-in.
0
 

Author Comment

by:jasimon9
ID: 22857900
I created a CD from the ISO and sure enough it is a bootable DOS disk.

I ran the diagnostic suite including the full surface scan. No errors found.

So still looking for another cause of the BSODs.

0
 
LVL 24

Expert Comment

by:DMTechGrooup
ID: 22857909
Did you look for bluging or blown caps?

http://en.wikipedia.org/wiki/Capacitor_plague

0
 
LVL 27

Expert Comment

by:Jonvee
ID: 22857987
As you can't find a Minidump maybe the problem is not 'visible' to Windows , in which case it is worth checking your CPU and associated heatsink & thermal paste.  
It's also worth checking the cabinet temperatures & fan(s), and for that you could try Everest free, Ed 2.20 from 'majorgeeks'.  
This would also be symptomatic of a power supply unit (PSU) problem.
0
 
LVL 27

Expert Comment

by:Jonvee
ID: 22858042
Has additional 'moderate current consumption' hardware recently been added to the machine without up-rating the PSU, and it's now taking a hammering?

EVEREST Free Edition 2.20
http://www.majorgeeks.com/EVEREST_Free_Edition_d4181.html
0
 

Author Comment

by:jasimon9
ID: 22871341
Answering the "easy one" first -- no additional hardware added of any kind.

The other questions need to wait until I can shut down.
0
 

Author Comment

by:jasimon9
ID: 22905153
I opened up the case and saw that the fan mounted on the CPU was quite obstructed by "impacted" dust. I cleaned that out. I hope that has a good effect on resolving the BSODs.

I inspected all the visible capacitors but saw no bulging. I did not open up the power supply to check capacitors there.

After that, I went into the BIOS and watched the temperatures and fan speeds. The fan speeds were normal. However, the temp varied between 67 and 69 degrees C. I checked the spec for the processor (Pentium D 820) which gives a maximum operating temp of 64.1 degrees.

So I am wondering if this apparent out-of-spec operating condition is a problem. I have had this system for over two and a half years, but the BSODs have only occurred within the last 6 months or so. I suspect that the fan dust build up could have pushed it over the edge.
0
 
LVL 27

Expert Comment

by:Jonvee
ID: 22905459
The CPU fan/dust may well have been the problem, time will tell.
The 69C max temperature reached should not be a problem, but i still suggest you run EVEREST Free Edition 2.20 for confirmation.

If you quickly get another BSOD, another option would be to remove a panel from your machine and air blast the CPU/heatsink assembly with an external (office) fan.
If resolved, that at least would point to a heat issue.

You do not really need to open up the PSU to check any capacitors, it's the capacitors on the mobo which for some folk are a problem ... but a PSU exchange is still worth bearing in mind should the BSODs return.
0
 
LVL 27

Expert Comment

by:Jonvee
ID: 22905651
There doesn't appear to be any mention of memory testing in this thread, so another option if the BSODs return (& no crash dumps available) would be a RAM test >
 memtest86+  v1.70 :
http://www.memtest.org/

Recommend you run at least three passes.
If the RAM tests ok, check to see if you have more than one RAM chip.  If you do, remove all but one RAM chip, then retest your machine.  Even insert the one confirmed good RAM, in a different socket.  Sounds strange perhaps, but this has resolved the problem more than once.
0
 

Author Comment

by:jasimon9
ID: 22906290
In the original question you will see the following sentence:

"I had already done a through memtest86, and no new hardware had been installed recently. "
0
 

Author Comment

by:jasimon9
ID: 22906295
"through" should have been "thorough"
0
 
LVL 27

Expert Comment

by:Jonvee
ID: 22906857
Thanks, don't know how i missed that, but all other RAM comments still apply.
0
 

Author Comment

by:jasimon9
ID: 22907293
Interesting suggestion -- at this point I am suspecting that the blockage in the CPU fan may have allowed overheating, and will wait a while to see if that fixes.

Any ideas on the temperature range issue? (69C observed vs 64C limit)
0
Free Trending Threat Insights Every Day

Enhance your security with threat intelligence from the web. Get trending threat insights on hackers, exploits, and suspicious IP addresses delivered to your inbox with our free Cyber Daily.

 
LVL 27

Expert Comment

by:Jonvee
ID: 22907972
General reading >
"THE HEATSINK GUIDE: Maximum CPU temperature and maximum CPU power usage":
http://www.heatsink-guide.com/content.php?content=maxtemp.shtml

You checked the fan speeds although it's possible the airflow is lower than normal due to partially gunged fan blades .. if not already done you may want to check/clean these.

Presume you are not overclocking CPU?

If you're comfortable about removing the CPU from it's heatsink, another option is to remove/refit it with new thermal compound.  Better CPU/paste/heatsink path, lower temperature >  
THE HEATSINK GUIDE: Info about thermal compound
http://www.heatsink-guide.com/content.php?content=maxtemp.shtml
0
 
LVL 27

Expert Comment

by:Jonvee
ID: 22908005
Select "Thermal compound" on left, in link above.
0
 

Author Comment

by:jasimon9
ID: 22917245
btw, no overclocking
0
 

Author Comment

by:jasimon9
ID: 22922589
Actually, I had better clarify, as the information I have provided could be completely wrong.

There are in fact three temperatures reported on the BIOS screen, with the "typical range", as follows:

Processor:    69-71
Internal:     37-41
Remote:       39-41

I had been fixing on the "Processor" temp as exceeding the 64.1 max. But then it occurred to me that maybe that was the wrong temp to be comparing, and perhaps the "Internal" is the more relevant. In which case, it is well within limits.

Please comment.
0
 
LVL 24

Expert Comment

by:DMTechGrooup
ID: 22923208
Has it BS again?
0
 

Author Comment

by:jasimon9
ID: 22923469
I have not had an actual BSOD lately.

However, the machine does reboot itself without displaying a BSOD or providing a minidump, or even having a helpful entry in the Event Log, or in fact any evidence at all of the restart, other than when I come in in the morning, I see that it has restarted.

My sysadmin is proposing at this point to reapply the thermal compound. He also says that Pentium D chips are problematic as far as heat, and maybe it is time for an upgrade.
0
 
LVL 24

Expert Comment

by:DMTechGrooup
ID: 22923515
I would agree.. it sounds like a hardware issue for sure.  Time to tell that sysamin you need a nice quad core notebook.. ;)
0
 

Author Comment

by:jasimon9
ID: 23057522
Our latest thinking is that the motherboard thinks the processor is overheating.

In the BIOS the processor temp is reported as 67-70. The max temp for the chip (pentium D 820) is 65.

We removed the heat sink to re-apply the thermal compound, but that did not change anything. However during this process we felt the processor and it was running very cool. So we suspect the heat sensing could be off.

Another thing we noticed is that upon power on, the heat sink fan does not come up to full speed, but kind of "stutters". A few seconds later when the BIOS takes over, the full does come to normal speed. My sysadmin says he has never seen that before, and thus suspects the heat sink, the motherboard or both.

He is recommending at minimum a motherboard plus heat sink replacement. And while I am at is, I suppose I should update the chip too. The memory and disk drives are fine, so we could simply upgrade those components.

Thinking about it.
0
 

Author Comment

by:jasimon9
ID: 23108897
After additional input, I am not so sure it is the motherboard. Others recommended just replaceing the heat sink, so that will be next. My son had a similar issue, and he got a good result by merely replacing the thermal compound.
0
 
LVL 27

Expert Comment

by:Jonvee
ID: 23108976
> good result by merely replacing the thermal compound <
Yes, that was suggested as a possibility on 11.07.2008 and could certainly cause the processor overheating that you suspected .. but it seems that you have already tried the thermal compound.
0
 

Author Comment

by:jasimon9
ID: 23164599
I remembered that I had the SpeedFan utility (great tool btw!) which enables fan monitoring and a lot more without having to reboot to go into the BIOS. In SpeedFan, the CPU temp is given as 49 degrees, as compared to the 69 degrees shown in the BIOS.

This tends to confirm the bad motherboard or BIOS suspicions of my sysadmin, who by feeling around in the system said there was no way it was running at 69 because it "felt cool to the touch."

With these two pieces of evidence, it appears not to be an overheating problem after all, but could simply be a bad motherboard.
0
 
LVL 27

Expert Comment

by:Jonvee
ID: 23208437
Returning again to the subject of a dump, there is an option to force a crash dump.
It will at least show whether your machine can create a dump or not.

1. REGEDIT
2. Locate HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\i8042prt\Parameters
3. Create a new DWORD value and name it CrashOnCtrlScroll
4. Right-click on this newly created value and click on Modify
5. Enter 1 in the Value data field and click on OK.
6. Close regedit and reboot your system.
7. Now you will get a blue screen (crash) your system by holding the right CTRL key and pressing "Scroll Lock" twice.
8. The bugcheck code is E2
0
 

Author Comment

by:jasimon9
ID: 23208677
For some reason the dump had gotten disabled a ways back. When I went into the normal user interface controls for that, in fact they had been turned off by some unknown mechanism, as I did not do it.

Once I re-enabled, the dump files are now begin written. Minidumps, that is.

However, your technique is interesting, and I will try it as soon as I save this post.

0
 

Author Comment

by:jasimon9
ID: 23208873
Interestingly, the key was already there, with a zero value.

I changed it to one.

After rebooting, I tried the force crash. No response to the key sequence.
0
 
LVL 27

Accepted Solution

by:
Jonvee earned 500 total points
ID: 23209049
Ok.   Well, in a case where a minidump does not exist you can ensure the option has been enabled, and also write a System event log, as follows>

Control Panel > System > Advance > Startup and Recovery > Write debugging information > Minidump.

The size of the Minidump is probably less than 100K, and you can leave this option as it is.
0
 

Author Comment

by:jasimon9
ID: 23215039
As mentioned above, those settings are already activated. Minidumps seem to be written on a blue screen. However, the "force crash" does not work.
0
 

Author Comment

by:jasimon9
ID: 23402202
I feel that it is time to close this question. The best answer is the latest from Jonvee, so I am awarding points.
0
 
LVL 27

Expert Comment

by:Jonvee
ID: 23405671
Thank you; but i do hope that we've supplied sufficient information for you to eventually resolve this problem.
0

Featured Post

Do You Know the 4 Main Threat Actor Types?

Do you know the main threat actor types? Most attackers fall into one of four categories, each with their own favored tactics, techniques, and procedures.

Join & Write a Comment

It is only natural that we all want our PCs to be in good working order, improved system performance, so that is exactly how programs are advertised to entice. They say things like:            •      PC crashes? Get registry cleaner to repair it!    …
Sometimes people don't understand why download speed shows differently for Windows than Linux.Specially, this article covers and shows the solution for throughput difference for Windows than a Linux machine. For this, I arranged a test scenario.I…
This video discusses moving either the default database or any database to a new volume.
You have products, that come in variants and want to set different prices for them? Watch this micro tutorial that describes how to configure prices for Magento super attributes. Assigning simple products to configurable: We assigned simple products…

758 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

22 Experts available now in Live!

Get 1:1 Help Now