Solved

Analyze minidump file

Posted on 2010-09-21
8
783 Views
Last Modified: 2012-05-10
Hello,

I would like ask you for help with analyzing minidump file.

Here is report from WinDbg:

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck DE, {1, fa95b120, f0752c80, 8089}



Probably caused by : memory_corruption ( nt!MiCleanSection+995 )

Followup: MachineOwner
---------

4: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

POOL_CORRUPTION_IN_FILE_AREA (de)
A driver corrupted pool memory used for holding pages destined for disk.
This was discovered by the memory manager when dereferencing the file.
Arguments:
Arg1: 00000001
Arg2: fa95b120
Arg3: f0752c80
Arg4: 00008089

Debugging Details:
------------------




CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  DRIVER_FAULT_SERVER_MINIDUMP

BUGCHECK_STR:  0xDE

PROCESS_NAME:  System

CURRENT_IRQL:  0

LAST_CONTROL_TRANSFER:  from e0842b2d to e0827c83

STACK_TEXT:  
f0752c58 e0842b2d 000000de 00000001 fa95b120 nt!KeBugCheckEx+0x1b
f0752d40 e084393e fa95b120 00000000 e0a5e540 nt!MiCleanSection+0x995
f0752d90 e0843a6d 00000000 ff922670 00000000 nt!MiRemoveUnusedSegments+0x96c
f0752dac e0949b80 00000000 00000000 00000000 nt!MiDereferenceSegmentThread+0x5f
f0752ddc e088e092 e0843a0e 00000000 00000000 nt!PspSystemThreadStartup+0x2e
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16


STACK_COMMAND:  kb

FOLLOWUP_IP:
nt!MiCleanSection+995
e0842b2d 8b7508          mov     esi,dword ptr [ebp+8]

SYMBOL_STACK_INDEX:  1

SYMBOL_NAME:  nt!MiCleanSection+995

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

DEBUG_FLR_IMAGE_TIMESTAMP:  4a799091

IMAGE_NAME:  memory_corruption

FAILURE_BUCKET_ID:  0xDE_nt!MiCleanSection+995

BUCKET_ID:  0xDE_nt!MiCleanSection+995

Followup: MachineOwner
---------
0
Comment
Question by:T-cko
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 4
  • 3
8 Comments
 
LVL 2

Expert Comment

by:mgrabarz
ID: 33724684
POOL_CORRUPTION_IN_FILE_AREA occurs when a system component corrupts pool memory of the other component.
To get detailed information about this error and detect driver causing problems you need to enable pool overrun detection feature:
http://support.microsoft.com/kb/188831
0
 
LVL 18

Expert Comment

by:awawada
ID: 33724731
Please post a minidump for me.
0
 

Author Comment

by:T-cko
ID: 33725170
Here is minidump file
Mini092110-01.dmp
0
Technology Partners: We Want Your Opinion!

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

 
LVL 18

Expert Comment

by:awawada
ID: 33726644
Is your Windows Server up to date?
0
 

Author Comment

by:T-cko
ID: 33732680
No there are some updates waiting for instalation. There was also ntfs  error on system volume in event logs. I suppose that this may cause crash of server, but i'm not sure in it.
0
 
LVL 18

Expert Comment

by:awawada
ID: 33732706
Can you run a Harddisc / ' s check?
0
 

Accepted Solution

by:
T-cko earned 0 total points
ID: 33768667
in event log was also error with source ntfs. After restart I scheduled to run chkdsk in repair mode. Error in system volume was fixed. Since that no errors appeared.
0
 
LVL 18

Expert Comment

by:awawada
ID: 33768679
nice :)
0

Featured Post

Complete VMware vSphere® ESX(i) & Hyper-V Backup

Capture your entire system, including the host, with patented disk imaging integrated with VMware VADP / Microsoft VSS and RCT. RTOs is as low as 15 seconds with Acronis Active Restore™. You can enjoy unlimited P2V/V2V migrations from any source (even from a different hypervisor)

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

by Batuhan Cetin Within the dynamic life of an IT administrator, we hold many information in our minds like user names, passwords, IDs, phone numbers, incomes, service tags, bills and the order from our wives to buy milk when coming back to home.…
Learn about cloud computing and its benefits for small business owners.
Monitoring a network: why having a policy is the best policy? Michael Kulchisky, MCSE, MCSA, MCP, VTSP, VSP, CCSP outlines the enormous benefits of having a policy-based approach when monitoring medium and large networks. Software utilized in this v…
This is my first video review of Microsoft Bookings, I will be doing a part two with a bit more information, but wanted to get this out to you folks.

630 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question