Solved

Analyze minidump file

Posted on 2010-09-21
8
772 Views
Last Modified: 2012-05-10
Hello,

I would like ask you for help with analyzing minidump file.

Here is report from WinDbg:

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck DE, {1, fa95b120, f0752c80, 8089}



Probably caused by : memory_corruption ( nt!MiCleanSection+995 )

Followup: MachineOwner
---------

4: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

POOL_CORRUPTION_IN_FILE_AREA (de)
A driver corrupted pool memory used for holding pages destined for disk.
This was discovered by the memory manager when dereferencing the file.
Arguments:
Arg1: 00000001
Arg2: fa95b120
Arg3: f0752c80
Arg4: 00008089

Debugging Details:
------------------




CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  DRIVER_FAULT_SERVER_MINIDUMP

BUGCHECK_STR:  0xDE

PROCESS_NAME:  System

CURRENT_IRQL:  0

LAST_CONTROL_TRANSFER:  from e0842b2d to e0827c83

STACK_TEXT:  
f0752c58 e0842b2d 000000de 00000001 fa95b120 nt!KeBugCheckEx+0x1b
f0752d40 e084393e fa95b120 00000000 e0a5e540 nt!MiCleanSection+0x995
f0752d90 e0843a6d 00000000 ff922670 00000000 nt!MiRemoveUnusedSegments+0x96c
f0752dac e0949b80 00000000 00000000 00000000 nt!MiDereferenceSegmentThread+0x5f
f0752ddc e088e092 e0843a0e 00000000 00000000 nt!PspSystemThreadStartup+0x2e
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16


STACK_COMMAND:  kb

FOLLOWUP_IP:
nt!MiCleanSection+995
e0842b2d 8b7508          mov     esi,dword ptr [ebp+8]

SYMBOL_STACK_INDEX:  1

SYMBOL_NAME:  nt!MiCleanSection+995

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

DEBUG_FLR_IMAGE_TIMESTAMP:  4a799091

IMAGE_NAME:  memory_corruption

FAILURE_BUCKET_ID:  0xDE_nt!MiCleanSection+995

BUCKET_ID:  0xDE_nt!MiCleanSection+995

Followup: MachineOwner
---------
0
Comment
Question by:T-cko
  • 4
  • 3
8 Comments
 
LVL 2

Expert Comment

by:mgrabarz
ID: 33724684
POOL_CORRUPTION_IN_FILE_AREA occurs when a system component corrupts pool memory of the other component.
To get detailed information about this error and detect driver causing problems you need to enable pool overrun detection feature:
http://support.microsoft.com/kb/188831
0
 
LVL 18

Expert Comment

by:awawada
ID: 33724731
Please post a minidump for me.
0
 

Author Comment

by:T-cko
ID: 33725170
Here is minidump file
Mini092110-01.dmp
0
 
LVL 18

Expert Comment

by:awawada
ID: 33726644
Is your Windows Server up to date?
0
What Security Threats Are You Missing?

Enhance your security with threat intelligence from the web. Get trending threat insights on hackers, exploits, and suspicious IP addresses delivered to your inbox with our free Cyber Daily.

 

Author Comment

by:T-cko
ID: 33732680
No there are some updates waiting for instalation. There was also ntfs  error on system volume in event logs. I suppose that this may cause crash of server, but i'm not sure in it.
0
 
LVL 18

Expert Comment

by:awawada
ID: 33732706
Can you run a Harddisc / ' s check?
0
 

Accepted Solution

by:
T-cko earned 0 total points
ID: 33768667
in event log was also error with source ntfs. After restart I scheduled to run chkdsk in repair mode. Error in system volume was fixed. Since that no errors appeared.
0
 
LVL 18

Expert Comment

by:awawada
ID: 33768679
nice :)
0

Featured Post

How to improve team productivity

Quip adds documents, spreadsheets, and tasklists to your Slack experience
- Elevate ideas to Quip docs
- Share Quip docs in Slack
- Get notified of changes to your docs
- Available on iOS/Android/Desktop/Web
- Online/Offline

Join & Write a Comment

Recently, I had the need to build a standalone system to run a point-of-sale system. I’m running this on a low-voltage Atom processor, so I wanted a light-weight operating system, but still needed Windows. I chose to use Microsoft Windows Server 200…
On July 14th 2015, Windows Server 2003 will become End of Support, leaving hundreds of thousands of servers around the world that still run this 12 year old operating system vulnerable and potentially out of compliance in many organisations around t…
Get a first impression of how PRTG looks and learn how it works.   This video is a short introduction to PRTG, as an initial overview or as a quick start for new PRTG users.
This video gives you a great overview about bandwidth monitoring with SNMP and WMI with our network monitoring solution PRTG Network Monitor (https://www.paessler.com/prtg). If you're looking for how to monitor bandwidth using netflow or packet s…

746 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

13 Experts available now in Live!

Get 1:1 Help Now