Help looking at windows 7 crash Dump

Posted on 2010-08-20
Medium Priority
Last Modified: 2012-05-10
I have used WinDbg many times to troubleshoot bad drivers, etc.  However this is the first time I think I have come across waht I think is a hardware problem.

I have had my Wifes Windows 7 pro Computer Blue Screen over and over and over....

I grabed the minidumps and loaded them in to WinDbg with the following results.  Can someone please:

a. interpert this for me.  Is it a hardware failure, if so what component?  

b. How can I learn to interpert this my self?  What resources are available to learn how to break this down...

I have also attached the dump file if it helps
Microsoft (R) Windows Debugger Version 6.12.0002.633 X86
Copyright (c) Microsoft Corporation. All rights reserved.

Loading Dump File [\\vmware-host\Shared Folders\Cats Dumps\082010-95750-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*C:\MSSymbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7600 MP (4 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16617.x86fre.win7_gdr.100618-1621
Machine Name:
Kernel base = 0x82a11000 PsLoadedModuleList = 0x82b59810
Debug session time: Fri Aug 20 10:19:07.148 2010 (UTC - 4:00)
System Uptime: 0 days 1:38:36.601
Loading Kernel Symbols
Loading User Symbols
Loading unloaded module list
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *

Use !analyze -v to get detailed debugging information.

BugCheck A, {0, 2, 1, 82a782af}

Probably caused by : memory_corruption

Followup: memory_corruption

1: kd> !analyze -v
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *

An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arg1: 00000000, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000001, bitfield :
	bit 0 : value 0 = read operation, 1 = write operation
	bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: 82a782af, address which referenced memory

Debugging Details:

WRITE_ADDRESS: GetPointerFromAddress: unable to read from 82b79718
Unable to read MiSystemVaType memory at 82b59160


82a782af 8939            mov     dword ptr [ecx],edi




PROCESS_NAME:  csrss.exe

TRAP_FRAME:  8c8f8b2c -- (.trap 0xffffffff8c8f8b2c)
ErrCode = 00000002
eax=8805b508 ebx=8805b500 ecx=00000000 edx=0000000d esi=8806485c edi=880648d0
eip=82a78200 esp=8c8f8ba0 ebp=8c8f8c00 iopl=0         nv up ei pl nz ac po nc
cs=0008  ss=0010  ds=0023  es=0023  fs=0030  gs=0000             efl=00010238
82a78200 143b            adc     al,3Bh
Resetting default scope

82a78200 143b            adc     al,3Bh

LAST_CONTROL_TRANSFER:  from 82a78200 to 82a5782b

8c8f8b2c 82a78200 badb0d70 0000000d 8c8f8c00 nt!KiTrap0E+0x2cf
8c8f8c00 8c8f8c00 82ab01a3 8805b503 0000001b nt!KeWaitForSingleObject+0x2c4
WARNING: Frame IP not in any known module. Following frames may be wrong.
8c8f8c04 82ab01a3 8805b503 0000001b 00000020 0x8c8f8c00
8c8f8c3c 82a7c7a5 807c9120 00010224 8c8f8c5c nt!ExpWaitForResource+0x16f
8c8f8c5c 82a7b6ce 8805b500 82a52210 88064810 nt!KiSetTimerEx+0x7a
8c8f8cac 82a99d7d 88014770 00000001 00000001 nt!ExAcquireResourceExclusiveLite+0x1cf
8c8f8cc0 92a28d0a 88014728 92978423 00000004 nt!ExEnterPriorityRegionAndAcquireResourceExclusive+0x24
8c8f8cc8 92978423 00000004 0027fe08 92a3c325 win32k!UserEnterUserCritSec+0xc
8c8f8d04 92978586 00000001 00000002 8ac754c8 win32k!RawInputThread+0x606
8c8f8d6a 00000000 00000000 31760000 000175bd win32k!xxxCreateSystemThreads+0x4a


CHKIMG_EXTENSION: !chkimg -lo 50 -d !nt
    82a57884 - nt!Dr_kitf_a+1c
	[ 89:00 ]
    82a5788c - nt!Dr_kitf_a+24 (+0x08)
	[ 20:60 ]
    82a57894 - nt!Dr_kitf_a+2c (+0x08)
	[ 21:00 ]
    82a5789c - nt!Dr_kitf_a+34 (+0x08)
	[ 33:80 ]
    82a578a4 - nt!Dr_kitf_a+3c (+0x08)
	[ 64:00 ]
    82a578ac - nt!Dr_kitf_a+44 (+0x08)
	[ 9f:00 ]
    82a578b4 - nt!Dr_kitf_a+4c (+0x08)
	[ 02:00 ]
    82a578bc - nt!Dr_kitf_a+54 (+0x08)
	[ c9:6a ]
    82a78b5f - nt!SwapContext_PatchXSave+2 (+0x212a3)
	[ 01:21 ]
    82a78dad - nt!EnlightenedSwapContext_PatchFxb+2 (+0x24e)
	[ 01:21 ]
10 errors : !nt (82a57884-82a78dad)

MODULE_NAME: memory_corruption

IMAGE_NAME:  memory_corruption

FOLLOWUP_NAME:  memory_corruption





Followup: memory_corruption

Open in new window

Question by:brittonv
  • 3
  • 2
LVL 16

Accepted Solution

uescomp earned 2000 total points
ID: 33485942
I use a free program called Who Crashed for memory dump interpretation.  You can dowload it from the following link:


I ran your dump files through it and this is what it said:

On Thu 8/19/2010 2:58:36 PM your computer crashed
This was likely caused by the following module: dxgmms1.sys
Bugcheck code: 0x1000000A (0x35, 0x2, 0x1, 0x82AAC028)
Error: Unknown
Dump file: C:\Windows\Minidump\081910-14484-01.dmp
file path: C:\Windows\system32\drivers\dxgmms1.sys
product: Microsoft® Windows® Operating System
company: Microsoft Corporation
description: DirectX Graphics MMS
The crash took place in a standard Microsoft module. Your system configuration may be incorrect, possibly the culprit is in another driver on your system which cannot be identified at this time.

On Fri 8/20/2010 2:58:30 PM your computer crashed
This was likely caused by the following module: ntkrnlpa.exe
Bugcheck code: 0xA (0x0, 0x2, 0x1, 0x82A782AF)
Dump file: C:\Windows\Minidump\082010-95750-01.dmp

Author Comment

ID: 33486204
I downloaded that tool, thanks for pointing that out to me!  

So I have 1 Dump that can't be determined
1 says it's dxgmms1.sys
and 1 says it's mousclass.sys

These errors are all over the place.  Would that indicate a hardware problem?

My thinking is if it was a bad driver or something it would be the same error repeated.  

Please weigh in with your opinions....

I thought I would save myself headaches by buying a Intel Motherboard Model boxdq45cb

Expert Comment

ID: 33487103
This shows stride memory corruption.  Do a memtest86+ for at least five passes: http://www.memtest.org/.
Technology Partners: We Want Your Opinion!

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

LVL 16

Expert Comment

ID: 33489112
dxgmms1.sys is related to your video card.  I would download and install the latest video card drivers from your PC manufacturer's website (don't use Windows update for video card drivers).  If this does not resolve the issue, you may have hardware issues.

Author Comment

ID: 33503374
I got fed up tore out the Intel motherboard, and replaced it with an ASUS.  I used the same Ram, CPU, HD, GPU, etc.. reinstalled.  Problem fixed.  (Yes I had tried reinstalling on the Intel)

I then took the Intel Motherboard out back suspended it between 2 trees and hit it with 1 good shot from my 12 Guage, so I would never be tempted to use it again.

Why did I do this?...

I took out the nVidia Graphics card and then the POS would no longer boot with a monitor connected to it.  In order to get it to boot, I would have to disconnect the monitor, power it on then connect the monitor again (to the onboard DVI connection).  After an hour of messing around with that I put the nVidia back in but now it no longer worked either.

I tried to reset the bios, remove the bios battery, AMS settings, etc etc etc.

And yes I was using a grounding strap and mat when I did the work.

I will never for as long as I live buy another Intel Motherboard.  I always have some kind of stupid problem with them.  

Why does a company that makes the chipset and Processor fail so miserably when it comes to putting them all together.

Although I admit this is the first time I have shot one, and boy did it feel good....


Author Closing Comment

ID: 33682045
I resolved it myself but thanks for the great tools!

Featured Post

Concerto Cloud for Software Providers & ISVs

Can Concerto Cloud Services help you focus on evolving your application offerings, while delivering the best cloud experience to your customers? From DevOps to revenue models and customer support, the answer is yes!

Learn how Concerto can help you.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Article by: Lee
Windows 7 Ultimate and Enterprise (and 2008 R2) introduced a new feature you may not be aware of - Boot from VHD.   Boot from VHD (or what Microsoft refers to asNative Boot allows you to install Windows to a VHD (Virtual Hard Disk) file that is t…
Assume you have an outside contractor who comes in seasonally or once a week to do some work in your office, but you only want to give him access to the programs and files he needs and keep all other documents and programs private. Can you do this o…
This Micro Tutorial will go in depth within Systems and Security in Windows 7 and will go into detail regarding Action Center, Windows Firewall, System, etc. This will be demonstrated using Windows 7 operating system.
The viewer will learn how to successfully create a multiboot device using the SARDU utility on Windows 7. Start the SARDU utility: Change the image directory to wherever you store your ISOs, this will prevent you from having 2 copies of an ISO wit…
Suggested Courses
Course of the Month14 days, 11 hours left to enroll

839 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question