Solved

Xp blue screen - Cant access machine - seems a driver problem - memory dump included

Posted on 2011-03-03
12
719 Views
Last Modified: 2013-12-01

C:\Program Files\Support Tools>dumpchk.exe -v c:\Mini030311-01.dmp
Loading dump file c:\Mini030311-01.dmp
----- 32 bit Kernel Mini Dump Analysis

DUMP_HEADER32:
MajorVersion        0000000f
MinorVersion        00000a28
DirectoryTableBase  0b100060
PfnDataBase         81086000
PsLoadedModuleList  8055d720
PsActiveProcessHead 805638b8
MachineImageType    0000014c
NumberProcessors    00000002
BugCheckCode        10000050
BugCheckParameter1  bc5dfff0
BugCheckParameter2  00000000
BugCheckParameter3  bf89c16b
BugCheckParameter4  00000000
PaeEnabled          00000001
KdDebuggerDataBlock 8054d2e0
MiniDumpFields      00000dff

TRIAGE_DUMP32:
ServicePackBuild      00000300
SizeOfDump            00010000
ValidOffset           0000fffc
ContextOffset         00000320
ExceptionOffset       000007d0
MmOffset              00001068
UnloadedDriversOffset 000010a0
PrcbOffset            00001878
ProcessOffset         000024c8
ThreadOffset          00002728
CallStackOffset       00002980
SizeOfCallStack       00000568
DriverListOffset      00003178
DriverCount           0000006b
StringPoolOffset      00005140
StringPoolSize        00000e90
BrokenDriverOffset    00000000
TriageOptions         00000041
TopOfStack            aa5fda98
DebuggerDataOffset    00002ee8
DebuggerDataSize      00000290
DataBlocksOffset      00005fd0
DataBlocksCount       00000002


Windows XP Kernel Version 2600 (Service Pack 3) MP (2 procs) Free x86 compatible

Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055d720
Debug session time: Thu Mar 03 08:28:24 2011
System Uptime: 1 days 6:32:07
start    end        module name
804d7000 806e5000   nt             Checksum: 001FA054  Timestamp: Thu Dec 09 08:
06:55 2010 (4D00D46F)

Unloaded modules:
aaa07000 aaa28000   tmcomm.sys    Timestamp: unavailable (00000000)
ba6c6000 ba6c7000   drmkaud.sys    Timestamp: unavailable (00000000)
a96d0000 a96fb000   kmixer.sys    Timestamp: unavailable (00000000)
aa4ce000 aa4db000   DMusic.sys    Timestamp: unavailable (00000000)
a96fb000 a971e000   aec.sys     Timestamp: unavailable (00000000)
aa4ae000 aa4bc000   swmidi.sys    Timestamp: unavailable (00000000)
ba652000 ba654000   splitter.sys    Timestamp: unavailable (00000000)
ad0be000 ad0c2000   kbdhid.sys    Timestamp: unavailable (00000000)
aca6a000 aca77000   i8042prt.SYS    Timestamp: unavailable (00000000)
aca32000 aca37000   Cdaudio.SYS    Timestamp: unavailable (00000000)
ad0c2000 ad0c5000   Sfloppy.SYS    Timestamp: unavailable (00000000)
aca3a000 aca3f000   Flpydisk.SYS    Timestamp: unavailable (00000000)
aca42000 aca49000   Fdc.SYS     Timestamp: unavailable (00000000)

Finished dump check

C:\Program Files\Support Tools>
0
Comment
Question by:techguy111
  • 8
  • 4
12 Comments
 

Author Comment

by:techguy111
Comment Utility
From the memory dump can someone tell me where the problem is ? I am guess its a driver which is causing it to crash.

THe machine was up for 1day.
0
 

Author Comment

by:techguy111
Comment Utility
Event Type:      Error
Event Source:      System Error
Event Category:      (102)
Event ID:      1003
Date:            3/3/2011
Time:            9:45:46 AM
User:            N/A
Computer:      PC02051
Description:
Error code 10000050, parameter1 bc5dfff0, parameter2 00000000, parameter3 bf89c16b, parameter4 00000000.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 53 79 73 74 65 6d 20 45   System E
0008: 72 72 6f 72 20 20 45 72   rror  Er
0010: 72 6f 72 20 63 6f 64 65   ror code
0018: 20 31 30 30 30 30 30 35    1000005
0020: 30 20 20 50 61 72 61 6d   0  Param
0028: 65 74 65 72 73 20 62 63   eters bc
0030: 35 64 66 66 66 30 2c 20   5dfff0,
0038: 30 30 30 30 30 30 30 30   00000000
0040: 2c 20 62 66 38 39 63 31   , bf89c1
0048: 36 62 2c 20 30 30 30 30   6b, 0000
0050: 30 30 30 30               0000  
0
 
LVL 87

Expert Comment

by:rindi
Comment Utility
It's more likely to a an issue with the RAM, Antivirus Software, Remote tools (like teamviewer etc), or hardware.

Run memtest86+ on the PC (you'll find it on the UBCD:

http://ultimatebootcd.com

You could also zip the last 3 dumps and upload them.
0
 

Author Comment

by:techguy111
Comment Utility
There is only one memory dump which was generated.

THis is a brand new precision 3500 machine which came from DEll. It was supposed to run Win 7 prof. But I downgraded it to run WIn XP prof sp3

Is it something you can narrow down a bit more based on the log.

The user is remoting in from a MAC laptop to this windows machine using VPN. Mini030311-01.dmp
0
 
LVL 87

Accepted Solution

by:
rindi earned 500 total points
Comment Utility
The RDPDD.dll file seems to have caused that dump, I believe that has something to do with Remote Desktop / Terminal Services. Try disabling that. Also, since you only have one dump, it is also possible that this was just a freak crash. Maybe after disabling the service you could first run SFC /Scannow on the PC to make sure all the system files are the correct version, then run Windowsupdates until there are none left, and after that enable remote desktop again to check whether the issue has ceased.
0
 

Author Comment

by:techguy111
Comment Utility
Will run SFC/scannow and windows updates.

Could this also take care of the issue.
http://forums.nvidia.com/index.php?showtopic=67147&hl=remote%20desktop&st=60

"You can fix this bug by increasing the size of the session image space via a registry key.¿  Add the following key:
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\ Session Manager\Memory Management]

"SessionImageSize"=dword:00000020"
0
Find Ransomware Secrets With All-Source Analysis

Ransomware has become a major concern for organizations; its prevalence has grown due to past successes achieved by threat actors. While each ransomware variant is different, we’ve seen some common tactics and trends used among the authors of the malware.

 
LVL 87

Expert Comment

by:rindi
Comment Utility
It's unlikely, as from the link you posted i didn't see anything mentioned about the system BSODing, but rather remote desktop didn't work (but I didn't go through the complete thread...).
0
 

Author Comment

by:techguy111
Comment Utility
Thanks for your response. The user is currently using the machine remotely and I cant run rightaway the memtest86+ and SFC/scannow and windows updates as you had suggested.

I will do try to do these things while the user is in a meeting or so.

Am remotely watching the event logs and nothing seems unusual as of now.






0
 

Author Comment

by:techguy111
Comment Utility
Did the following :
1. Ran memtest86+ (once) as was short of time. It ran without errors.
2. Ran all windows updates.
3. Made the registry edit :
 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\ Session Manager\Memory Management]
"SessionImageSize"=dword:00000020"

Couldnt run sfc /scannow as didnt have time.

Anything else you would like to suggest ?
0
 
LVL 87

Expert Comment

by:rindi
Comment Utility
No. But as I mentioned earlier, as there is only one minidump, it could just have been a freak crash. A single crash is usually something you can put aside for the moment, but just keep watching. If it happens more often then it needs extra attention. Also often the crashes aren't always the same, so the crash-dumps created can be different and analyzing 3 or so can give a better idea of what is happening.

Anyway, when you do get around doing SFC /scannow, you may need the install CD of XP, as the tool, if it finds invalid system-files, will first check in it's cache for the correct versions, if it can't find them there it'll need them from the CD and replace them with those.
0
 

Assisted Solution

by:techguy111
techguy111 earned 0 total points
Comment Utility
Hi. The machine hasnt crashed as of now. It ran well over the weekend.
0
 

Author Closing Comment

by:techguy111
Comment Utility
Thanks
0

Featured Post

How your wiki can always stay up-to-date

Quip doubles as a “living” wiki and a project management tool that evolves with your organization. As you finish projects in Quip, the work remains, easily accessible to all team members, new and old.
- Increase transparency
- Onboard new hires faster
- Access from mobile/offline

Join & Write a Comment

One good source is the manufacturer's web site. Even though the device operating system is changing, the hardware isn't. Going to the support site and looking at the Vista drivers provides a starting point for identifying system hardware for which d…
Good afternoon all, We are running a VM infrastructure on a clustered ESX environment with two DELL R710's.  One of our IT Application Support Engineers contacted me and asked if it was possible to extend the partition of a certain Windows 2003 S…
Sending a Secure fax is easy with eFax Corporate (http://www.enterprise.efax.com). First, Just open a new email message.  In the To field, type your recipient's fax number @efaxsend.com. You can even send a secure international fax — just include t…
This demo shows you how to set up the containerized NetScaler CPX with NetScaler Management and Analytics System in a non-routable Mesos/Marathon environment for use with Micro-Services applications.

728 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

10 Experts available now in Live!

Get 1:1 Help Now