|
ez2cy
Member
2013-Jan-31 7:30 am
[WIN7] Memory dumpI'm running win7 and lately I get my puter shuts down. Screen flashes, then I get a blue screen with a long long message but it's not up long enough to read the whole thing. It says it's shutting down and doing a memory dump to protect the computer....etc.....etc.... If this is the first time seeing this message.....etc etc.
Then the screen will come up with the "Start normal" Start in safe mode etc screen.
I have Windows Security Esstianals, scan wit Maylwarebytes, Spybot S&D.
Is this something to worry about? Annoying as hell as it sometimes happens 3 or 4 times in a row. |
|
dave Premium Member join:2000-05-04 not in ohio |
dave
Premium Member
2013-Jan-31 7:52 am
said by ez2cy:Is this something to worry about? Yes. Your system is broken. Either the hardware is failing or some piece of software is buggy. Either way, you can't trust that system an inch. It's certainly not safe to rely on it storing anything you can't afford to lose. The memory dump is not to 'protect the computer'. The system crashes ('blue screens') to protect against further possibility of data corruption. The memory dump part of the deal is for post-mortem analysis of what went wrong. If you zip up the dump and post it here, someone may volunteer to take a look at it. You should be aware that the dump may contain traces of whatever you were doing at the time, so you'll have to figure out whether you trust people here |
|
|
ez2cy
Member
2013-Jan-31 8:18 am
Thank you for your reply.
How do I get the "dump" to post it.
Please talk to me like a 4 year old if you can tell me how..ie, step by step. Not the greatest on computer |
|
ez2cy |
ez2cy
Member
2013-Jan-31 9:17 am
I think I may have found a fix? From Microsoft a 'debug" . I found it doing a search for my problem about the blue screen and dumping. » msdn.microsoft.com/en-us ··· 009.aspxWould this be what I need to do? Thanks in advance. |
|
ez2cy |
ez2cy
Member
2013-Jan-31 9:28 am
I think I may have found a fix? From Microsoft a 'debug" . I found it doing a search for my problem about the blue screen and dumping. » msdn.microsoft.com/en-us ··· 009.aspxWould this be what I need to do? Thanks in advance. |
|
Zupe MVM join:2001-11-29 New York, NY |
to ez2cy
That would be a set of tools to view the memory dumps, but won't be of that much use to you if you don't know what you're looking at.
To upload the minidump files, go to the C:\Windows\minidump folder, zip up the files there (if there are a lot, the most recent three or so would be a good start) and then attach them to a reply post in this thread.
Someone will hopefully then be able to look them over and possibly give you some input on what may be causing the problem. |
|
|
ez2cy
Member
2013-Jan-31 9:34 am
Ok found, zipped (I think, never zipped before) and attached. Only saw 2 files. ???? Hope this is right Thank you for your help, appreciate it. |
|
aguen Premium Member join:2003-07-16 Grants Pass, OR |
aguen to ez2cy
Premium Member
2013-Jan-31 12:05 pm
to ez2cy
Either the date/time is set incorrectly on your machine or you didn't get the latest dump file(s). The 2 files you zipped up are from Sept. 2010 and both deal with a video driver issue. |
|
|
ez2cy
Member
2013-Jan-31 12:53 pm
Ok...date is right on puter. When I was looking at the above (where I found the Microsoft site) I followed what it was saying and I saw a "kernel memory dump' was checked off. Is that anything or what we are looking for? I am attaching a screenshot of what I'm talking about. I'm looking for the file in Windows. |
|
aguen Premium Member join:2003-07-16 Grants Pass, OR |
to ez2cy
Look to see if you have the folder C:\Windows\minidump\
If so are there any files in there with today's or yesterdays date/time stamp?
If so, please zip up the most recent 2 files and then upload them. |
|
|
ez2cy
Member
2013-Jan-31 1:42 pm
Just the two files I uploaded that are from 2010. Only 2 there.
Why I was asking about the uploaded printscreen, if that is where it's going instead to the Kernel memory dump, and if I should change that. ???? |
|
dave Premium Member join:2000-05-04 not in ohio |
dave
Premium Member
2013-Jan-31 2:23 pm
There are two types of dump that you can configure: 1) "All of kernel memory" - ends up in C:\Windows\memory.dmp 2) "Small memory dump" - ends up in C:\Windows\minidump You're configured for #1, aguen gave instructions for #2. Take a look and see if you have a recently-written C:\Windows\memory.dmp. Though it might be too large to upload. It might be worth switching your config to "small memory dump" so you can collect more than one, since we may need to look for commonalities. |
|
1 edit |
ez2cy
Member
2013-Jan-31 2:46 pm
Ok...I have...C:\Windows\LiveKernelReports
Within that is a file "WATCHDOG" but nothing with today's date.
the list of files that have today's date on them are; (in Windows)
assembly inf Installer system32 bootstat.exe setupact.log WindowsUpdate.log
Should I be looking in one of those for something?
I will change the config to small memory dump as suggested. |
|
ez2cy |
ez2cy
Member
2013-Feb-1 3:26 pm
No one? |
|
|
dave Premium Member join:2000-05-04 not in ohio |
dave
Premium Member
2013-Feb-1 3:40 pm
No, that's not it.
It's either C:\Windows\memory.dmp (one file from kernel memory dump) or C:\Windows\minidump (folder containing multiple files) |
|
|
ez2cy
Member
2013-Feb-1 6:30 pm
WEll then something is really screwed up.
There is not Memory.dmp.....there is minidump...but the two files in it are the ones I posted and they are from 2010.
It's just done the blue screen dump thing to me 3 times in the past hour.
Also, computer is really slow booting up, to password sign in,...and then after I enter it. NOt sure if that helps or not.
When it does boot up, get a message from the bottom right screen that says, a windows service did not start....but it says something about other users not being able to use it or something. ????
Also, where someone told me to change the "kernel dump" to "small memory dump" in Systems, start up and recovery, it has "Small dump directory" as %SystemRoot%\Minidump ????? no idea what that means |
|
dave Premium Member join:2000-05-04 not in ohio |
dave
Premium Member
2013-Feb-1 6:38 pm
%systemroot% is a symbol that means "where the OS is installed", and it is usually C:\Windows, though need not be. Using the symbol makes the setting independent of the name chosen by whoever installed the OS.
So, leave it as it is, and your minidump files will be in C:\Windows\Minidump |
|
|
ez2cy
Member
2013-Feb-1 7:30 pm
Ok...but that's the point....no files are going to Minidump period. I found how to stop the auto reboot so I can read the whole blue screen.
But...as I said, it's happened this evening a few times and no files after in minidump.
I'll wait for it to happen again I guess |
|
takeahikeYou sure ask a lot of dumb questions Premium Member join:2005-01-07 Catacombs |
to ez2cy
You should and can check your memory by typing 'memory' in the search box which will give you the option to run Windows Memory Diagnostic on the next re-boot. If you get an error you'll have to check each stick by trial and error with this tool. Bad memory is a very common cause of your problem and it sounds like you have a hardware problem from the random nature of your errors. |
|
dave Premium Member join:2000-05-04 not in ohio |
dave to ez2cy
Premium Member
2013-Feb-1 8:30 pm
to ez2cy
said by ez2cy:But...as I said, it's happened this evening a few times and no files after in minidump. AH, I missed that it had crashed after you'd switched to the minidump setting. Weird. The only reasons I can think that might happen involve disk problems: failure to read the crash handler code, or failure to write the dump to disk. Ah, do you have a page file on C: ? Certainly with full dumps, the dump is written to the page file, and then copied out to the final file after reboot (all this because you don't want a messed-up system doing complicated stunts like creating files). Minidumps are likely handled the same way though I am uncertain of that. |
|
|
to takeahike
I apoligize if I post things that are irrelvant. Not that good on puter.
It just happened again, but I did not see you reply until after.
I did change the "auto reboot" so I got all the info....not sure if it relevant or not.
Blue screen'
A problem has been detected........
Technacial Information Stop 0s00000026(0x00000000001904FB,0xFFFFF8800324A9F80xFFFFF8800324A250,0xFFFFF880016A9244)
Ntfs.sys0AddressFFFFF880016A9244 base at FFFFF8800161D000. Batectamp 5040d4c6
Not sure if that's anything or not
Thanks again..and again...and again for trying to help me |
|
takeahikeYou sure ask a lot of dumb questions Premium Member join:2005-01-07 Catacombs |
to ez2cy
Do you run the Windows Memory Diagnostic as I suggested? If it gives any errors you've spotted the problem--all you'd have to do then is find out which of your memory sticks is defective, and replace it. |
|
|
ez2cy
Member
2013-Feb-2 8:31 am
Yes I did, last nite. NOw I'm just trying to figure out where it has a log or something.
I did get a message that I have memory problems I know. Other than that, I did not see anything. |
|
ez2cy |
ez2cy
Member
2013-Feb-2 8:53 am
LOL....
I just did another Windows Memory Diagnostic and it came back with no memory problems this time. ??????????
Is there a log that I can find the other one I did? |
|
dave Premium Member join:2000-05-04 not in ohio |
dave to ez2cy
Premium Member
2013-Feb-2 9:12 am
to ez2cy
If the stopcode waa 0x00000026 then that points to a problem with the CD file system. Which seems unlikely - you weren't using the CD drive at the time? » msdn.microsoft.com/en-us ··· 85).aspx |
|
|
ez2cy
Member
2013-Feb-2 11:52 am
Sorry again for my ignorance.
I have a (not sure the right word for it) start up 'recovery" disc in my drive.
Had a problem with a rouge virus that shut down computer and could not start. Answer was to make this Kapersky rescue start up disc. It comes up on the screen everytime I boot but does nothing unless I click on it.
Not sure if that's what you mean or not. |
|
ez2cy |
ez2cy
Member
2013-Feb-2 12:09 pm
I'll do another diagnostic with it removed if that's what you're meaning and post |
|
dave Premium Member join:2000-05-04 not in ohio |
dave to ez2cy
Premium Member
2013-Feb-2 12:30 pm
to ez2cy
The running program responsible for the crash, assuming you transcribed the stop code correctly (*), is the Compact Disc File System driver, "CDFS". I figured that out by looking up the stop code on Microsoft's web site, at the link I posted in my previous reply.
The only reason that I know that CDFS would be doing anything is that you were using the CD for some reason.
I'm not sure that having a disc just sitting there would cause any CD activity.
Still, if you don't need it there, it's worth removing it.
Or are you saying you need that CD in the reader in order for your PC to boot correctly? If so, that's another problem.
---
(*) The important part is the hexadecimal number after the word STOP, which you wrote as 0s00000026 and which I am assuming was actually 0x00000026. The '0x' part was certainly what was on the screen; I'm just hoping the 00000026 part was unmodified in the copying. |
|
|
ez2cy
Member
2013-Feb-2 2:10 pm
No, I don't need the disc in to boot.
I took it out and did a diagnostic again, this time though, I pressed F1 when it started to set what kind I need to do??? (was in help). I did the basic.
I did that, sorry did not write down the 00000 stuff this time.
There was a message that came up with the blue screen when it rebooted this time "Driver_IRQL_NOT_LESS_OR_EQUAL
again, did write down the 00000's
Going to run thru all the diagnostics from pressing F1, think there is a standard and then an indepth or something. |
|
ez2cy |
ez2cy
Member
2013-Feb-2 9:46 pm
well....not getting anywhere except it telling me I have a memory problem.
Guess I need to take it into the shop.
Thanks for trying to help folks, I do appreciate the effort. |
|