Want to win a PS4? Go Premium and enter to win our High-Tech Treats giveaway. Enter to Win

x
?
Solved

Xp blue screen - Cant access machine - seems a driver problem - memory dump included

Posted on 2011-03-03
12
Medium Priority
?
750 Views
Last Modified: 2013-12-01

C:\Program Files\Support Tools>dumpchk.exe -v c:\Mini030311-01.dmp
Loading dump file c:\Mini030311-01.dmp
----- 32 bit Kernel Mini Dump Analysis

DUMP_HEADER32:
MajorVersion        0000000f
MinorVersion        00000a28
DirectoryTableBase  0b100060
PfnDataBase         81086000
PsLoadedModuleList  8055d720
PsActiveProcessHead 805638b8
MachineImageType    0000014c
NumberProcessors    00000002
BugCheckCode        10000050
BugCheckParameter1  bc5dfff0
BugCheckParameter2  00000000
BugCheckParameter3  bf89c16b
BugCheckParameter4  00000000
PaeEnabled          00000001
KdDebuggerDataBlock 8054d2e0
MiniDumpFields      00000dff

TRIAGE_DUMP32:
ServicePackBuild      00000300
SizeOfDump            00010000
ValidOffset           0000fffc
ContextOffset         00000320
ExceptionOffset       000007d0
MmOffset              00001068
UnloadedDriversOffset 000010a0
PrcbOffset            00001878
ProcessOffset         000024c8
ThreadOffset          00002728
CallStackOffset       00002980
SizeOfCallStack       00000568
DriverListOffset      00003178
DriverCount           0000006b
StringPoolOffset      00005140
StringPoolSize        00000e90
BrokenDriverOffset    00000000
TriageOptions         00000041
TopOfStack            aa5fda98
DebuggerDataOffset    00002ee8
DebuggerDataSize      00000290
DataBlocksOffset      00005fd0
DataBlocksCount       00000002


Windows XP Kernel Version 2600 (Service Pack 3) MP (2 procs) Free x86 compatible

Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055d720
Debug session time: Thu Mar 03 08:28:24 2011
System Uptime: 1 days 6:32:07
start    end        module name
804d7000 806e5000   nt             Checksum: 001FA054  Timestamp: Thu Dec 09 08:
06:55 2010 (4D00D46F)

Unloaded modules:
aaa07000 aaa28000   tmcomm.sys    Timestamp: unavailable (00000000)
ba6c6000 ba6c7000   drmkaud.sys    Timestamp: unavailable (00000000)
a96d0000 a96fb000   kmixer.sys    Timestamp: unavailable (00000000)
aa4ce000 aa4db000   DMusic.sys    Timestamp: unavailable (00000000)
a96fb000 a971e000   aec.sys     Timestamp: unavailable (00000000)
aa4ae000 aa4bc000   swmidi.sys    Timestamp: unavailable (00000000)
ba652000 ba654000   splitter.sys    Timestamp: unavailable (00000000)
ad0be000 ad0c2000   kbdhid.sys    Timestamp: unavailable (00000000)
aca6a000 aca77000   i8042prt.SYS    Timestamp: unavailable (00000000)
aca32000 aca37000   Cdaudio.SYS    Timestamp: unavailable (00000000)
ad0c2000 ad0c5000   Sfloppy.SYS    Timestamp: unavailable (00000000)
aca3a000 aca3f000   Flpydisk.SYS    Timestamp: unavailable (00000000)
aca42000 aca49000   Fdc.SYS     Timestamp: unavailable (00000000)

Finished dump check

C:\Program Files\Support Tools>
0
Comment
Question by:techguy111
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 8
  • 4
12 Comments
 

Author Comment

by:techguy111
ID: 35027796
From the memory dump can someone tell me where the problem is ? I am guess its a driver which is causing it to crash.

THe machine was up for 1day.
0
 

Author Comment

by:techguy111
ID: 35027906
Event Type:      Error
Event Source:      System Error
Event Category:      (102)
Event ID:      1003
Date:            3/3/2011
Time:            9:45:46 AM
User:            N/A
Computer:      PC02051
Description:
Error code 10000050, parameter1 bc5dfff0, parameter2 00000000, parameter3 bf89c16b, parameter4 00000000.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 53 79 73 74 65 6d 20 45   System E
0008: 72 72 6f 72 20 20 45 72   rror  Er
0010: 72 6f 72 20 63 6f 64 65   ror code
0018: 20 31 30 30 30 30 30 35    1000005
0020: 30 20 20 50 61 72 61 6d   0  Param
0028: 65 74 65 72 73 20 62 63   eters bc
0030: 35 64 66 66 66 30 2c 20   5dfff0,
0038: 30 30 30 30 30 30 30 30   00000000
0040: 2c 20 62 66 38 39 63 31   , bf89c1
0048: 36 62 2c 20 30 30 30 30   6b, 0000
0050: 30 30 30 30               0000  
0
 
LVL 88

Expert Comment

by:rindi
ID: 35028083
It's more likely to a an issue with the RAM, Antivirus Software, Remote tools (like teamviewer etc), or hardware.

Run memtest86+ on the PC (you'll find it on the UBCD:

http://ultimatebootcd.com

You could also zip the last 3 dumps and upload them.
0
Tech or Treat! - Giveaway

Submit an article about your scariest tech experience—and the solution—and you’ll be automatically entered to win one of 4 fantastic tech gadgets.

 

Author Comment

by:techguy111
ID: 35028165
There is only one memory dump which was generated.

THis is a brand new precision 3500 machine which came from DEll. It was supposed to run Win 7 prof. But I downgraded it to run WIn XP prof sp3

Is it something you can narrow down a bit more based on the log.

The user is remoting in from a MAC laptop to this windows machine using VPN. Mini030311-01.dmp
0
 
LVL 88

Accepted Solution

by:
rindi earned 2000 total points
ID: 35028499
The RDPDD.dll file seems to have caused that dump, I believe that has something to do with Remote Desktop / Terminal Services. Try disabling that. Also, since you only have one dump, it is also possible that this was just a freak crash. Maybe after disabling the service you could first run SFC /Scannow on the PC to make sure all the system files are the correct version, then run Windowsupdates until there are none left, and after that enable remote desktop again to check whether the issue has ceased.
0
 

Author Comment

by:techguy111
ID: 35028871
Will run SFC/scannow and windows updates.

Could this also take care of the issue.
http://forums.nvidia.com/index.php?showtopic=67147&hl=remote%20desktop&st=60

"You can fix this bug by increasing the size of the session image space via a registry key.¿  Add the following key:
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\ Session Manager\Memory Management]

"SessionImageSize"=dword:00000020"
0
 
LVL 88

Expert Comment

by:rindi
ID: 35029441
It's unlikely, as from the link you posted i didn't see anything mentioned about the system BSODing, but rather remote desktop didn't work (but I didn't go through the complete thread...).
0
 

Author Comment

by:techguy111
ID: 35029890
Thanks for your response. The user is currently using the machine remotely and I cant run rightaway the memtest86+ and SFC/scannow and windows updates as you had suggested.

I will do try to do these things while the user is in a meeting or so.

Am remotely watching the event logs and nothing seems unusual as of now.






0
 

Author Comment

by:techguy111
ID: 35032052
Did the following :
1. Ran memtest86+ (once) as was short of time. It ran without errors.
2. Ran all windows updates.
3. Made the registry edit :
 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\ Session Manager\Memory Management]
"SessionImageSize"=dword:00000020"

Couldnt run sfc /scannow as didnt have time.

Anything else you would like to suggest ?
0
 
LVL 88

Expert Comment

by:rindi
ID: 35034168
No. But as I mentioned earlier, as there is only one minidump, it could just have been a freak crash. A single crash is usually something you can put aside for the moment, but just keep watching. If it happens more often then it needs extra attention. Also often the crashes aren't always the same, so the crash-dumps created can be different and analyzing 3 or so can give a better idea of what is happening.

Anyway, when you do get around doing SFC /scannow, you may need the install CD of XP, as the tool, if it finds invalid system-files, will first check in it's cache for the correct versions, if it can't find them there it'll need them from the CD and replace them with those.
0
 

Assisted Solution

by:techguy111
techguy111 earned 0 total points
ID: 35063152
Hi. The machine hasnt crashed as of now. It ran well over the weekend.
0
 

Author Closing Comment

by:techguy111
ID: 35120685
Thanks
0

Featured Post

Free Tool: Site Down Detector

Helpful to verify reports of your own downtime, or to double check a downed website you are trying to access.

One of a set of tools we are providing to everyone as a way of saying thank you for being a part of the community.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

One good source is the manufacturer's web site. Even though the device operating system is changing, the hardware isn't. Going to the support site and looking at the Vista drivers provides a starting point for identifying system hardware for which d…
I. Introduction There's an interesting discussion going on now in an Experts Exchange Group — Attachments with no extension (http://www.experts-exchange.com/discussions/210281/Attachments-with-no-extension.html). This reminded me of questions tha…
Finding and deleting duplicate (picture) files can be a time consuming task. My wife and I, our three kids and their families all share one dilemma: Managing our pictures. Between desktops, laptops, phones, tablets, and cameras; over the last decade…
Visualize your data even better in Access queries. Given a date and a value, this lesson shows how to compare that value with the previous value, calculate the difference, and display a circle if the value is the same, an up triangle if it increased…
Suggested Courses

618 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question