Want to protect your cyber security and still get fast solutions? Ask a secure question today.Go Premium


Xp blue screen - Cant access machine - seems a driver problem - memory dump included

Posted on 2011-03-03
Medium Priority
Last Modified: 2013-12-01

C:\Program Files\Support Tools>dumpchk.exe -v c:\Mini030311-01.dmp
Loading dump file c:\Mini030311-01.dmp
----- 32 bit Kernel Mini Dump Analysis

MajorVersion        0000000f
MinorVersion        00000a28
DirectoryTableBase  0b100060
PfnDataBase         81086000
PsLoadedModuleList  8055d720
PsActiveProcessHead 805638b8
MachineImageType    0000014c
NumberProcessors    00000002
BugCheckCode        10000050
BugCheckParameter1  bc5dfff0
BugCheckParameter2  00000000
BugCheckParameter3  bf89c16b
BugCheckParameter4  00000000
PaeEnabled          00000001
KdDebuggerDataBlock 8054d2e0
MiniDumpFields      00000dff

ServicePackBuild      00000300
SizeOfDump            00010000
ValidOffset           0000fffc
ContextOffset         00000320
ExceptionOffset       000007d0
MmOffset              00001068
UnloadedDriversOffset 000010a0
PrcbOffset            00001878
ProcessOffset         000024c8
ThreadOffset          00002728
CallStackOffset       00002980
SizeOfCallStack       00000568
DriverListOffset      00003178
DriverCount           0000006b
StringPoolOffset      00005140
StringPoolSize        00000e90
BrokenDriverOffset    00000000
TriageOptions         00000041
TopOfStack            aa5fda98
DebuggerDataOffset    00002ee8
DebuggerDataSize      00000290
DataBlocksOffset      00005fd0
DataBlocksCount       00000002

Windows XP Kernel Version 2600 (Service Pack 3) MP (2 procs) Free x86 compatible

Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055d720
Debug session time: Thu Mar 03 08:28:24 2011
System Uptime: 1 days 6:32:07
start    end        module name
804d7000 806e5000   nt             Checksum: 001FA054  Timestamp: Thu Dec 09 08:
06:55 2010 (4D00D46F)

Unloaded modules:
aaa07000 aaa28000   tmcomm.sys    Timestamp: unavailable (00000000)
ba6c6000 ba6c7000   drmkaud.sys    Timestamp: unavailable (00000000)
a96d0000 a96fb000   kmixer.sys    Timestamp: unavailable (00000000)
aa4ce000 aa4db000   DMusic.sys    Timestamp: unavailable (00000000)
a96fb000 a971e000   aec.sys     Timestamp: unavailable (00000000)
aa4ae000 aa4bc000   swmidi.sys    Timestamp: unavailable (00000000)
ba652000 ba654000   splitter.sys    Timestamp: unavailable (00000000)
ad0be000 ad0c2000   kbdhid.sys    Timestamp: unavailable (00000000)
aca6a000 aca77000   i8042prt.SYS    Timestamp: unavailable (00000000)
aca32000 aca37000   Cdaudio.SYS    Timestamp: unavailable (00000000)
ad0c2000 ad0c5000   Sfloppy.SYS    Timestamp: unavailable (00000000)
aca3a000 aca3f000   Flpydisk.SYS    Timestamp: unavailable (00000000)
aca42000 aca49000   Fdc.SYS     Timestamp: unavailable (00000000)

Finished dump check

C:\Program Files\Support Tools>
Question by:techguy111
  • 8
  • 4

Author Comment

ID: 35027796
From the memory dump can someone tell me where the problem is ? I am guess its a driver which is causing it to crash.

THe machine was up for 1day.

Author Comment

ID: 35027906
Event Type:      Error
Event Source:      System Error
Event Category:      (102)
Event ID:      1003
Date:            3/3/2011
Time:            9:45:46 AM
User:            N/A
Computer:      PC02051
Error code 10000050, parameter1 bc5dfff0, parameter2 00000000, parameter3 bf89c16b, parameter4 00000000.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
0000: 53 79 73 74 65 6d 20 45   System E
0008: 72 72 6f 72 20 20 45 72   rror  Er
0010: 72 6f 72 20 63 6f 64 65   ror code
0018: 20 31 30 30 30 30 30 35    1000005
0020: 30 20 20 50 61 72 61 6d   0  Param
0028: 65 74 65 72 73 20 62 63   eters bc
0030: 35 64 66 66 66 30 2c 20   5dfff0,
0038: 30 30 30 30 30 30 30 30   00000000
0040: 2c 20 62 66 38 39 63 31   , bf89c1
0048: 36 62 2c 20 30 30 30 30   6b, 0000
0050: 30 30 30 30               0000  
LVL 88

Expert Comment

ID: 35028083
It's more likely to a an issue with the RAM, Antivirus Software, Remote tools (like teamviewer etc), or hardware.

Run memtest86+ on the PC (you'll find it on the UBCD:


You could also zip the last 3 dumps and upload them.
[Webinar On Demand] Database Backup and Recovery

Does your company store data on premises, off site, in the cloud, or a combination of these? If you answered “yes”, you need a data backup recovery plan that fits each and every platform. Watch now as as Percona teaches us how to build agile data backup recovery plan.


Author Comment

ID: 35028165
There is only one memory dump which was generated.

THis is a brand new precision 3500 machine which came from DEll. It was supposed to run Win 7 prof. But I downgraded it to run WIn XP prof sp3

Is it something you can narrow down a bit more based on the log.

The user is remoting in from a MAC laptop to this windows machine using VPN. Mini030311-01.dmp
LVL 88

Accepted Solution

rindi earned 2000 total points
ID: 35028499
The RDPDD.dll file seems to have caused that dump, I believe that has something to do with Remote Desktop / Terminal Services. Try disabling that. Also, since you only have one dump, it is also possible that this was just a freak crash. Maybe after disabling the service you could first run SFC /Scannow on the PC to make sure all the system files are the correct version, then run Windowsupdates until there are none left, and after that enable remote desktop again to check whether the issue has ceased.

Author Comment

ID: 35028871
Will run SFC/scannow and windows updates.

Could this also take care of the issue.

"You can fix this bug by increasing the size of the session image space via a registry key.¿  Add the following key:
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\ Session Manager\Memory Management]

LVL 88

Expert Comment

ID: 35029441
It's unlikely, as from the link you posted i didn't see anything mentioned about the system BSODing, but rather remote desktop didn't work (but I didn't go through the complete thread...).

Author Comment

ID: 35029890
Thanks for your response. The user is currently using the machine remotely and I cant run rightaway the memtest86+ and SFC/scannow and windows updates as you had suggested.

I will do try to do these things while the user is in a meeting or so.

Am remotely watching the event logs and nothing seems unusual as of now.


Author Comment

ID: 35032052
Did the following :
1. Ran memtest86+ (once) as was short of time. It ran without errors.
2. Ran all windows updates.
3. Made the registry edit :
 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\ Session Manager\Memory Management]

Couldnt run sfc /scannow as didnt have time.

Anything else you would like to suggest ?
LVL 88

Expert Comment

ID: 35034168
No. But as I mentioned earlier, as there is only one minidump, it could just have been a freak crash. A single crash is usually something you can put aside for the moment, but just keep watching. If it happens more often then it needs extra attention. Also often the crashes aren't always the same, so the crash-dumps created can be different and analyzing 3 or so can give a better idea of what is happening.

Anyway, when you do get around doing SFC /scannow, you may need the install CD of XP, as the tool, if it finds invalid system-files, will first check in it's cache for the correct versions, if it can't find them there it'll need them from the CD and replace them with those.

Assisted Solution

techguy111 earned 0 total points
ID: 35063152
Hi. The machine hasnt crashed as of now. It ran well over the weekend.

Author Closing Comment

ID: 35120685

Featured Post

[Webinar] Database Backup and Recovery

Does your company store data on premises, off site, in the cloud, or a combination of these? If you answered “yes”, you need a data backup recovery plan that fits each and every platform. Watch now as as Percona teaches us how to build agile data backup recovery plan.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

1. Start | Settings | Printers and Faxes. 2. Go to the File Menu. 3. Select Server Properties. 4. Select the Drivers tab. 5. Select the printer you need information about. 6. Once again select Properties. You should get a list of the files requ…
I. Introduction There's an interesting discussion going on now in an Experts Exchange Group — Attachments with no extension . This reminded me of questions that come up here at EE along the lines of, "How can I tell the type of file from its cont…
Finding and deleting duplicate (picture) files can be a time consuming task. My wife and I, our three kids and their families all share one dilemma: Managing our pictures. Between desktops, laptops, phones, tablets, and cameras; over the last decade…
Kernel Data Recovery is a renowned Data Recovery solution provider which offers wide range of softwares for both enterprise and home users with its cost-effective solutions. Let's have a quick overview of the journey and data recovery tools range he…

571 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question