Solved

Help looking at windows 7 crash Dump

Posted on 2010-08-20
6
584 Views
Last Modified: 2012-05-10
I have used WinDbg many times to troubleshoot bad drivers, etc.  However this is the first time I think I have come across waht I think is a hardware problem.

I have had my Wifes Windows 7 pro Computer Blue Screen over and over and over....

I grabed the minidumps and loaded them in to WinDbg with the following results.  Can someone please:

a. interpert this for me.  Is it a hardware failure, if so what component?  

b. How can I learn to interpert this my self?  What resources are available to learn how to break this down...

I have also attached the dump file if it helps
Microsoft (R) Windows Debugger Version 6.12.0002.633 X86

Copyright (c) Microsoft Corporation. All rights reserved.





Loading Dump File [\\vmware-host\Shared Folders\Cats Dumps\082010-95750-01.dmp]

Mini Kernel Dump File: Only registers and stack trace are available



Symbol search path is: SRV*C:\MSSymbols*http://msdl.microsoft.com/download/symbols

Executable search path is: 

Windows 7 Kernel Version 7600 MP (4 procs) Free x86 compatible

Product: WinNt, suite: TerminalServer SingleUserTS

Built by: 7600.16617.x86fre.win7_gdr.100618-1621

Machine Name:

Kernel base = 0x82a11000 PsLoadedModuleList = 0x82b59810

Debug session time: Fri Aug 20 10:19:07.148 2010 (UTC - 4:00)

System Uptime: 0 days 1:38:36.601

Loading Kernel Symbols

...............................................................

................................................................

.....................

Loading User Symbols

Loading unloaded module list

.....

*******************************************************************************

*                                                                             *

*                        Bugcheck Analysis                                    *

*                                                                             *

*******************************************************************************



Use !analyze -v to get detailed debugging information.



BugCheck A, {0, 2, 1, 82a782af}



Probably caused by : memory_corruption



Followup: memory_corruption

---------



1: kd> !analyze -v

*******************************************************************************

*                                                                             *

*                        Bugcheck Analysis                                    *

*                                                                             *

*******************************************************************************



IRQL_NOT_LESS_OR_EQUAL (a)

An attempt was made to access a pageable (or completely invalid) address at an

interrupt request level (IRQL) that is too high.  This is usually

caused by drivers using improper addresses.

If a kernel debugger is available get the stack backtrace.

Arguments:

Arg1: 00000000, memory referenced

Arg2: 00000002, IRQL

Arg3: 00000001, bitfield :

	bit 0 : value 0 = read operation, 1 = write operation

	bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)

Arg4: 82a782af, address which referenced memory



Debugging Details:

------------------





WRITE_ADDRESS: GetPointerFromAddress: unable to read from 82b79718

Unable to read MiSystemVaType memory at 82b59160

 00000000 



CURRENT_IRQL:  2



FAULTING_IP: 

nt!KeWaitForSingleObject+373

82a782af 8939            mov     dword ptr [ecx],edi



CUSTOMER_CRASH_COUNT:  1



DEFAULT_BUCKET_ID:  CODE_CORRUPTION



BUGCHECK_STR:  0xA



PROCESS_NAME:  csrss.exe



TRAP_FRAME:  8c8f8b2c -- (.trap 0xffffffff8c8f8b2c)

ErrCode = 00000002

eax=8805b508 ebx=8805b500 ecx=00000000 edx=0000000d esi=8806485c edi=880648d0

eip=82a78200 esp=8c8f8ba0 ebp=8c8f8c00 iopl=0         nv up ei pl nz ac po nc

cs=0008  ss=0010  ds=0023  es=0023  fs=0030  gs=0000             efl=00010238

nt!KeWaitForSingleObject+0x2c4:

82a78200 143b            adc     al,3Bh

Resetting default scope



MISALIGNED_IP: 

nt!KeWaitForSingleObject+2c4

82a78200 143b            adc     al,3Bh



LAST_CONTROL_TRANSFER:  from 82a78200 to 82a5782b



STACK_TEXT:  

8c8f8b2c 82a78200 badb0d70 0000000d 8c8f8c00 nt!KiTrap0E+0x2cf

8c8f8c00 8c8f8c00 82ab01a3 8805b503 0000001b nt!KeWaitForSingleObject+0x2c4

WARNING: Frame IP not in any known module. Following frames may be wrong.

8c8f8c04 82ab01a3 8805b503 0000001b 00000020 0x8c8f8c00

8c8f8c3c 82a7c7a5 807c9120 00010224 8c8f8c5c nt!ExpWaitForResource+0x16f

8c8f8c5c 82a7b6ce 8805b500 82a52210 88064810 nt!KiSetTimerEx+0x7a

8c8f8cac 82a99d7d 88014770 00000001 00000001 nt!ExAcquireResourceExclusiveLite+0x1cf

8c8f8cc0 92a28d0a 88014728 92978423 00000004 nt!ExEnterPriorityRegionAndAcquireResourceExclusive+0x24

8c8f8cc8 92978423 00000004 0027fe08 92a3c325 win32k!UserEnterUserCritSec+0xc

8c8f8d04 92978586 00000001 00000002 8ac754c8 win32k!RawInputThread+0x606

8c8f8d6a 00000000 00000000 31760000 000175bd win32k!xxxCreateSystemThreads+0x4a





STACK_COMMAND:  kb



CHKIMG_EXTENSION: !chkimg -lo 50 -d !nt

    82a57884 - nt!Dr_kitf_a+1c

	[ 89:00 ]

    82a5788c - nt!Dr_kitf_a+24 (+0x08)

	[ 20:60 ]

    82a57894 - nt!Dr_kitf_a+2c (+0x08)

	[ 21:00 ]

    82a5789c - nt!Dr_kitf_a+34 (+0x08)

	[ 33:80 ]

    82a578a4 - nt!Dr_kitf_a+3c (+0x08)

	[ 64:00 ]

    82a578ac - nt!Dr_kitf_a+44 (+0x08)

	[ 9f:00 ]

    82a578b4 - nt!Dr_kitf_a+4c (+0x08)

	[ 02:00 ]

    82a578bc - nt!Dr_kitf_a+54 (+0x08)

	[ c9:6a ]

    82a78b5f - nt!SwapContext_PatchXSave+2 (+0x212a3)

	[ 01:21 ]

    82a78dad - nt!EnlightenedSwapContext_PatchFxb+2 (+0x24e)

	[ 01:21 ]

10 errors : !nt (82a57884-82a78dad)



MODULE_NAME: memory_corruption



IMAGE_NAME:  memory_corruption



FOLLOWUP_NAME:  memory_corruption



DEBUG_FLR_IMAGE_TIMESTAMP:  0



MEMORY_CORRUPTOR:  LARGE



FAILURE_BUCKET_ID:  MEMORY_CORRUPTION_LARGE



BUCKET_ID:  MEMORY_CORRUPTION_LARGE



Followup: memory_corruption

---------

Open in new window

082010-95750-01.dmp
081910-14484-01.dmp
0
Comment
Question by:brittonv
  • 3
  • 2
6 Comments
 
LVL 16

Accepted Solution

by:
uescomp earned 500 total points
Comment Utility
I use a free program called Who Crashed for memory dump interpretation.  You can dowload it from the following link:

http://www.resplendence.com/downloads

I ran your dump files through it and this is what it said:

On Thu 8/19/2010 2:58:36 PM your computer crashed
This was likely caused by the following module: dxgmms1.sys
Bugcheck code: 0x1000000A (0x35, 0x2, 0x1, 0x82AAC028)
Error: Unknown
Dump file: C:\Windows\Minidump\081910-14484-01.dmp
file path: C:\Windows\system32\drivers\dxgmms1.sys
product: Microsoft® Windows® Operating System
company: Microsoft Corporation
description: DirectX Graphics MMS
The crash took place in a standard Microsoft module. Your system configuration may be incorrect, possibly the culprit is in another driver on your system which cannot be identified at this time.

On Fri 8/20/2010 2:58:30 PM your computer crashed
This was likely caused by the following module: ntkrnlpa.exe
Bugcheck code: 0xA (0x0, 0x2, 0x1, 0x82A782AF)
Error: IRQL_NOT_LESS_OR_EQUAL
Dump file: C:\Windows\Minidump\082010-95750-01.dmp
0
 
LVL 8

Author Comment

by:brittonv
Comment Utility
I downloaded that tool, thanks for pointing that out to me!  

So I have 1 Dump that can't be determined
1 says it's dxgmms1.sys
and 1 says it's mousclass.sys

These errors are all over the place.  Would that indicate a hardware problem?

My thinking is if it was a bad driver or something it would be the same error repeated.  

Please weigh in with your opinions....

I thought I would save myself headaches by buying a Intel Motherboard Model boxdq45cb
0
 
LVL 6

Expert Comment

by:che6ausc
Comment Utility
This shows stride memory corruption.  Do a memtest86+ for at least five passes: http://www.memtest.org/.
0
Get up to 2TB FREE CLOUD per backup license!

An exclusive Black Friday offer just for Expert Exchange audience! Buy any of our top-rated backup solutions & get up to 2TB free cloud per system! Perform local & cloud backup in the same step, and restore instantly—anytime, anywhere. Grab this deal now before it disappears!

 
LVL 16

Expert Comment

by:uescomp
Comment Utility
dxgmms1.sys is related to your video card.  I would download and install the latest video card drivers from your PC manufacturer's website (don't use Windows update for video card drivers).  If this does not resolve the issue, you may have hardware issues.
0
 
LVL 8

Author Comment

by:brittonv
Comment Utility
I got fed up tore out the Intel motherboard, and replaced it with an ASUS.  I used the same Ram, CPU, HD, GPU, etc.. reinstalled.  Problem fixed.  (Yes I had tried reinstalling on the Intel)

I then took the Intel Motherboard out back suspended it between 2 trees and hit it with 1 good shot from my 12 Guage, so I would never be tempted to use it again.

Why did I do this?...

I took out the nVidia Graphics card and then the POS would no longer boot with a monitor connected to it.  In order to get it to boot, I would have to disconnect the monitor, power it on then connect the monitor again (to the onboard DVI connection).  After an hour of messing around with that I put the nVidia back in but now it no longer worked either.

I tried to reset the bios, remove the bios battery, AMS settings, etc etc etc.

And yes I was using a grounding strap and mat when I did the work.

I will never for as long as I live buy another Intel Motherboard.  I always have some kind of stupid problem with them.  

Why does a company that makes the chipset and Processor fail so miserably when it comes to putting them all together.

Although I admit this is the first time I have shot one, and boy did it feel good....

0
 
LVL 8

Author Closing Comment

by:brittonv
Comment Utility
I resolved it myself but thanks for the great tools!
0

Featured Post

Threat Intelligence Starter Resources

Integrating threat intelligence can be challenging, and not all companies are ready. These resources can help you build awareness and prepare for defense.

Join & Write a Comment

First some basics on Windows 7 Backup.  It has 2 components one is a file based backup which is stored in .zip files each zip is split at around 200 Megabytes and there is the Image Backup which is as the name implies a total image of the partition …
The recent Microsoft changes on update philosophy for Windows pre-10 and their impact on existing WSUS implementations.
This Micro Tutorial will teach you how to change your appearance and customize your Windows 7 interface to your unique preference. This will be demonstrated using Windows 7 operating system.
The viewer will learn how to successfully download and install the SARDU utility on Windows 7, without downloading adware.

763 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

9 Experts available now in Live!

Get 1:1 Help Now