dslreports logo
site
 
    All Forums Hot Topics Gallery
spc

spacer




how-to block ads


Search Topic:
uniqs
1366
share rss forum feed

ez2cy

join:2008-03-05

[WIN7] Memory dump

I'm running win7 and lately I get my puter shuts down. Screen flashes, then I get a blue screen with a long long message but it's not up long enough to read the whole thing. It says it's shutting down and doing a memory dump to protect the computer....etc.....etc.... If this is the first time seeing this message.....etc etc.

Then the screen will come up with the "Start normal" Start in safe mode etc screen.

I have Windows Security Esstianals, scan wit Maylwarebytes, Spybot S&D.

Is this something to worry about? Annoying as hell as it sometimes happens 3 or 4 times in a row.


dave
Premium,MVM
join:2000-05-04
not in ohio
kudos:8
Reviews:
·Verizon FiOS

said by ez2cy:

Is this something to worry about?

Yes. Your system is broken. Either the hardware is failing or some piece of software is buggy. Either way, you can't trust that system an inch. It's certainly not safe to rely on it storing anything you can't afford to lose.

The memory dump is not to 'protect the computer'. The system crashes ('blue screens') to protect against further possibility of data corruption. The memory dump part of the deal is for post-mortem analysis of what went wrong.

If you zip up the dump and post it here, someone may volunteer to take a look at it. You should be aware that the dump may contain traces of whatever you were doing at the time, so you'll have to figure out whether you trust people here

ez2cy

join:2008-03-05

Thank you for your reply.

How do I get the "dump" to post it.

Please talk to me like a 4 year old if you can tell me how..ie, step by step. Not the greatest on computer


ez2cy

join:2008-03-05

I think I may have found a fix?

From Microsoft a 'debug"
. I found it doing a search for my problem about the blue screen and dumping.

»msdn.microsoft.com/en-us/windows···009.aspx

Would this be what I need to do?

Thanks in advance.


ez2cy

join:2008-03-05
reply to ez2cy

I think I may have found a fix?

From Microsoft a 'debug"
. I found it doing a search for my problem about the blue screen and dumping.

»msdn.microsoft.com/en-us/windows···009.aspx

Would this be what I need to do?

Thanks in advance.



Zupe
Premium,MVM
join:2001-11-29
New York, NY
reply to ez2cy

That would be a set of tools to view the memory dumps, but won't be of that much use to you if you don't know what you're looking at.

To upload the minidump files, go to the C:\Windows\minidump folder, zip up the files there (if there are a lot, the most recent three or so would be a good start) and then attach them to a reply post in this thread.

Someone will hopefully then be able to look them over and possibly give you some input on what may be causing the problem.
--
Brain: Pinky, are you pondering what I'm pondering?
Pinky: I think so, Brain, but "Snowball for Windows"?


ez2cy

join:2008-03-05

downloadcrash.zipx.zip 40,660 bytes
Ok found, zipped (I think, never zipped before) and attached. Only saw 2 files. ????

Hope this is right

Thank you for your help, appreciate it.

aguen
Premium
join:2003-07-16
Grants Pass, OR
kudos:2
reply to ez2cy

Either the date/time is set incorrectly on your machine or you didn't get the latest dump file(s). The 2 files you zipped up are from Sept. 2010 and both deal with a video driver issue.


ez2cy

join:2008-03-05

Click for full size
Ok...date is right on puter.

When I was looking at the above (where I found the Microsoft site) I followed what it was saying and I saw a "kernel memory dump' was checked off. Is that anything or what we are looking for?

I am attaching a screenshot of what I'm talking about. I'm looking for the file in Windows.

aguen
Premium
join:2003-07-16
Grants Pass, OR
kudos:2
reply to ez2cy

Look to see if you have the folder C:\Windows\minidump\

If so are there any files in there with today's or yesterdays date/time stamp?

If so, please zip up the most recent 2 files and then upload them.


ez2cy

join:2008-03-05

Just the two files I uploaded that are from 2010. Only 2 there.

Why I was asking about the uploaded printscreen, if that is where it's going instead to the Kernel memory dump, and if I should change that. ????


dave
Premium,MVM
join:2000-05-04
not in ohio
kudos:8
Reviews:
·Verizon FiOS

There are two types of dump that you can configure:

1) "All of kernel memory" - ends up in C:\Windows\memory.dmp

2) "Small memory dump" - ends up in C:\Windows\minidump

You're configured for #1, aguen See Profile gave instructions for #2.

Take a look and see if you have a recently-written C:\Windows\memory.dmp. Though it might be too large to upload.

It might be worth switching your config to "small memory dump" so you can collect more than one, since we may need to look for commonalities.


ez2cy

join:2008-03-05

1 edit

Ok...I have...C:\Windows\LiveKernelReports

Within that is a file "WATCHDOG" but nothing with today's date.

the list of files that have today's date on them are; (in Windows)

assembly
inf
Installer
system32
bootstat.exe
setupact.log
WindowsUpdate.log

Should I be looking in one of those for something?

I will change the config to small memory dump as suggested.


ez2cy

join:2008-03-05

No one?


dave
Premium,MVM
join:2000-05-04
not in ohio
kudos:8

No, that's not it.

It's either C:\Windows\memory.dmp (one file from kernel memory dump) or C:\Windows\minidump (folder containing multiple files)


ez2cy

join:2008-03-05

WEll then something is really screwed up.

There is not Memory.dmp.....there is minidump...but the two files in it are the ones I posted and they are from 2010.

It's just done the blue screen dump thing to me 3 times in the past hour.

Also, computer is really slow booting up, to password sign in,...and then after I enter it. NOt sure if that helps or not.

When it does boot up, get a message from the bottom right screen that says, a windows service did not start....but it says something about other users not being able to use it or something. ????

Also, where someone told me to change the "kernel dump" to "small memory dump" in Systems, start up and recovery, it has "Small dump directory" as %SystemRoot%\Minidump ????? no idea what that means


dave
Premium,MVM
join:2000-05-04
not in ohio
kudos:8
Reviews:
·Verizon FiOS

%systemroot% is a symbol that means "where the OS is installed", and it is usually C:\Windows, though need not be. Using the symbol makes the setting independent of the name chosen by whoever installed the OS.

So, leave it as it is, and your minidump files will be in C:\Windows\Minidump


ez2cy

join:2008-03-05

Ok...but that's the point....no files are going to Minidump period. I found how to stop the auto reboot so I can read the whole blue screen.

But...as I said, it's happened this evening a few times and no files after in minidump.

I'll wait for it to happen again I guess



takeahike
Premium
join:2005-01-07
Woodland Hills, CA
reply to ez2cy

You should and can check your memory by typing 'memory' in the search box which will give you the option to run Windows Memory Diagnostic on the next re-boot. If you get an error you'll have to check each stick by trial and error with this tool. Bad memory is a very common cause of your problem and it sounds like you have a hardware problem from the random nature of your errors.
--
"The best laid schemes of mice and men often go awry . . . " --Robert Burns


dave
Premium,MVM
join:2000-05-04
not in ohio
kudos:8
Reviews:
·Verizon FiOS
reply to ez2cy

said by ez2cy:

But...as I said, it's happened this evening a few times and no files after in minidump.

AH, I missed that it had crashed after you'd switched to the minidump setting.

Weird.

The only reasons I can think that might happen involve disk problems: failure to read the crash handler code, or failure to write the dump to disk.

Ah, do you have a page file on C: ? Certainly with full dumps, the dump is written to the page file, and then copied out to the final file after reboot (all this because you don't want a messed-up system doing complicated stunts like creating files). Minidumps are likely handled the same way though I am uncertain of that.

ez2cy

join:2008-03-05
reply to takeahike

I apoligize if I post things that are irrelvant. Not that good on puter.

It just happened again, but I did not see you reply until after.

I did change the "auto reboot" so I got all the info....not sure if it relevant or not.

Blue screen'

A problem has been detected........

Technacial Information
Stop 0s00000026(0x00000000001904FB,0xFFFFF8800324A9F80xFFFFF8800324A250,0xFFFFF880016A9244)

Ntfs.sys0AddressFFFFF880016A9244 base at FFFFF8800161D000.
Batectamp 5040d4c6

Not sure if that's anything or not

Thanks again..and again...and again for trying to help me


takeahike
Premium
join:2005-01-07
Woodland Hills, CA
reply to ez2cy

Do you run the Windows Memory Diagnostic as I suggested? If it gives any errors you've spotted the problem--all you'd have to do then is find out which of your memory sticks is defective, and replace it.
--
"The best laid schemes of mice and men often go awry . . . " --Robert Burns


ez2cy

join:2008-03-05

Yes I did, last nite. NOw I'm just trying to figure out where it has a log or something.

I did get a message that I have memory problems I know. Other than that, I did not see anything.


ez2cy

join:2008-03-05

LOL....

I just did another Windows Memory Diagnostic and it came back with no memory problems this time. ??????????

Is there a log that I can find the other one I did?


dave
Premium,MVM
join:2000-05-04
not in ohio
kudos:8
Reviews:
·Verizon FiOS
reply to ez2cy

If the stopcode waa 0x00000026 then that points to a problem with the CD file system. Which seems unlikely - you weren't using the CD drive at the time?

»msdn.microsoft.com/en-us/library···85).aspx


ez2cy

join:2008-03-05

Sorry again for my ignorance.

I have a (not sure the right word for it) start up 'recovery" disc in my drive.

Had a problem with a rouge virus that shut down computer and could not start. Answer was to make this Kapersky rescue start up disc. It comes up on the screen everytime I boot but does nothing unless I click on it.

Not sure if that's what you mean or not.


ez2cy

join:2008-03-05

I'll do another diagnostic with it removed if that's what you're meaning and post


dave
Premium,MVM
join:2000-05-04
not in ohio
kudos:8
Reviews:
·Verizon FiOS
reply to ez2cy

The running program responsible for the crash, assuming you transcribed the stop code correctly (*), is the Compact Disc File System driver, "CDFS". I figured that out by looking up the stop code on Microsoft's web site, at the link I posted in my previous reply.

The only reason that I know that CDFS would be doing anything is that you were using the CD for some reason.

I'm not sure that having a disc just sitting there would cause any CD activity.

Still, if you don't need it there, it's worth removing it.

Or are you saying you need that CD in the reader in order for your PC to boot correctly? If so, that's another problem.

---

(*) The important part is the hexadecimal number after the word STOP, which you wrote as 0s00000026 and which I am assuming was actually 0x00000026. The '0x' part was certainly what was on the screen; I'm just hoping the 00000026 part was unmodified in the copying.


ez2cy

join:2008-03-05

No, I don't need the disc in to boot.

I took it out and did a diagnostic again, this time though, I pressed F1 when it started to set what kind I need to do??? (was in help). I did the basic.

I did that, sorry did not write down the 00000 stuff this time.

There was a message that came up with the blue screen when it rebooted this time "Driver_IRQL_NOT_LESS_OR_EQUAL

again, did write down the 00000's

Going to run thru all the diagnostics from pressing F1, think there is a standard and then an indepth or something.


ez2cy

join:2008-03-05

well....not getting anywhere except it telling me I have a memory problem.

Guess I need to take it into the shop.

Thanks for trying to help folks, I do appreciate the effort.