Blue Screen - Physical Dump

[Guest]

Much like some other messages posted, I am experiencing similar problems in
Win 2000 Pro where a blue screen will appear with message regarding the
commencemet of a physical dump of memory. The message vanishes quickly so
there is no time to record the details - the blue screen appears with out
warning.

Characteristics of problem:

1. Problem started about the same time I updated the service pack for 2000
and updated Internet Explorer.
2. From the Control Panel/Systems, I'm able to see an event logged as a
"Save Dump". The event reads as follows:

"The computer has rebooted from a bugcheck. The bugcheck was: 0x0000001e
(0xc0000005, 0xbfe10014, 0x00000000, 0x00000011). Microsoft Windows 2000
[v15.2195]. A dump was savied in C:\WINNT\minidump\mini101804.02.dmp."

3. From the minidump file, I can see the dates it occurred but am unable to
open the dmp file - it has happened 36 times since Feb 18th/04.
4. Blue screen usually appears while on the web - has happened recently
without being on the web.
5. When surfing on the web, on certain addresses I am getting a "debug"
message asking if I want to debug - I know nothing about this so I usually
say no.

Could anyone assist me with this? I have low technical knowledge when it
comes to these types of problems and finding solutions.

Thankyou and would much appreciate the assistance

 

[Oli Restorick [MVP]]

Hi

When the system blue-screens, it will also tell you a module name. This is
useful information in finding out what the problem is.

I take it you're using a firewall. If not, try the free version of
ZoneAlarm at www.zonelabs.com and see if that makes any difference.

Regards

Oli

 

[Guest]

Oli -

Thanks for the response.

I have not noted a module name - as I said earlier, the message appears and
disappears quickly and you basaically just get a glimpse of it. Would the
module be recorded anywhere else - in the event log or dmp file?

Thanks for the firewall suggestion - I'll be doing that.

Hi

When the system blue-screens, it will also tell you a module name. This is
useful information in finding out what the problem is.

I take it you're using a firewall. If not, try the free version of
ZoneAlarm at www.zonelabs.com and see if that makes any difference.

Regards

Oli

Much like some other messages posted, I am experiencing similar problems
in
Win 2000 Pro where a blue screen will appear with message regarding the
commencemet of a physical dump of memory. The message vanishes quickly so
there is no time to record the details - the blue screen appears with out
warning.

Characteristics of problem:

1. Problem started about the same time I updated the service pack for
2000
and updated Internet Explorer.
2. From the Control Panel/Systems, I'm able to see an event logged as a
"Save Dump". The event reads as follows:

"The computer has rebooted from a bugcheck. The bugcheck was: 0x0000001e
(0xc0000005, 0xbfe10014, 0x00000000, 0x00000011). Microsoft Windows 2000
[v15.2195]. A dump was savied in C:\WINNT\minidump\mini101804.02.dmp."

3. From the minidump file, I can see the dates it occurred but am unable
to
open the dmp file - it has happened 36 times since Feb 18th/04.
4. Blue screen usually appears while on the web - has happened recently
without being on the web.
5. When surfing on the web, on certain addresses I am getting a "debug"
message asking if I want to debug - I know nothing about this so I usually
say no.

Could anyone assist me with this? I have low technical knowledge when it
comes to these types of problems and finding solutions.

Thankyou and would much appreciate the assistance

 

[Oli Restorick [MVP]]

The module name is included in the dump file, but it requires some technical
knowledge to analyse the dumps.

If you like, drop me an e-mail with a minidump and I'll see what info I can
retrieve from it.

Regards

Oli

Oli -

Thanks for the response.

I have not noted a module name - as I said earlier, the message appears
and
disappears quickly and you basaically just get a glimpse of it. Would the
module be recorded anywhere else - in the event log or dmp file?

Thanks for the firewall suggestion - I'll be doing that.

Hi

When the system blue-screens, it will also tell you a module name. This
is
useful information in finding out what the problem is.

I take it you're using a firewall. If not, try the free version of
ZoneAlarm at www.zonelabs.com and see if that makes any difference.

Regards

Oli

Much like some other messages posted, I am experiencing similar
problems
in
Win 2000 Pro where a blue screen will appear with message regarding the
commencemet of a physical dump of memory. The message vanishes quickly
so
there is no time to record the details - the blue screen appears with
out
warning.

Characteristics of problem:

1. Problem started about the same time I updated the service pack for
2000
and updated Internet Explorer.
2. From the Control Panel/Systems, I'm able to see an event logged as
a
"Save Dump". The event reads as follows:

"The computer has rebooted from a bugcheck. The bugcheck was:
0x0000001e
(0xc0000005, 0xbfe10014, 0x00000000, 0x00000011). Microsoft Windows
2000
[v15.2195]. A dump was savied in C:\WINNT\minidump\mini101804.02.dmp."

3. From the minidump file, I can see the dates it occurred but am
unable
to
open the dmp file - it has happened 36 times since Feb 18th/04.
4. Blue screen usually appears while on the web - has happened
recently
without being on the web.
5. When surfing on the web, on certain addresses I am getting a
"debug"
message asking if I want to debug - I know nothing about this so I
usually
say no.

Could anyone assist me with this? I have low technical knowledge when
it
comes to these types of problems and finding solutions.

Thankyou and would much appreciate the assistance

 

[Guest]

Oli,

I went into the minidump folder to copy and paste one of the minidumps on a
reply message - it won't allow me to paste. This morning I tried opening one
of the dmp files using a text application (notepad & wordpad) but to no avail.

At this point not sure how to get one of the dmp files to you.

If you have any suggestions, it would be much appreciated.

The module name is included in the dump file, but it requires some technical
knowledge to analyse the dumps.

If you like, drop me an e-mail with a minidump and I'll see what info I can
retrieve from it.

Regards

Oli

Oli -

Thanks for the response.

I have not noted a module name - as I said earlier, the message appears
and
disappears quickly and you basaically just get a glimpse of it. Would the
module be recorded anywhere else - in the event log or dmp file?

Thanks for the firewall suggestion - I'll be doing that.

Hi

When the system blue-screens, it will also tell you a module name. This
is
useful information in finding out what the problem is.

I take it you're using a firewall. If not, try the free version of
ZoneAlarm at www.zonelabs.com and see if that makes any difference.

Regards

Oli


Much like some other messages posted, I am experiencing similar
problems
in
Win 2000 Pro where a blue screen will appear with message regarding the
commencemet of a physical dump of memory. The message vanishes quickly
so
there is no time to record the details - the blue screen appears with
out
warning.

Characteristics of problem:

1. Problem started about the same time I updated the service pack for
2000
and updated Internet Explorer.
2. From the Control Panel/Systems, I'm able to see an event logged as
a
"Save Dump". The event reads as follows:

"The computer has rebooted from a bugcheck. The bugcheck was:
0x0000001e
(0xc0000005, 0xbfe10014, 0x00000000, 0x00000011). Microsoft Windows
2000
[v15.2195]. A dump was savied in C:\WINNT\minidump\mini101804.02.dmp."

3. From the minidump file, I can see the dates it occurred but am
unable
to
open the dmp file - it has happened 36 times since Feb 18th/04.
4. Blue screen usually appears while on the web - has happened
recently
without being on the web.
5. When surfing on the web, on certain addresses I am getting a
"debug"
message asking if I want to debug - I know nothing about this so I
usually
say no.

Could anyone assist me with this? I have low technical knowledge when
it
comes to these types of problems and finding solutions.

Thankyou and would much appreciate the assistance

 

[Oli Restorick [MVP]]

E-mail me. oli (at) mvps (dot) org

Oli

Oli,

I went into the minidump folder to copy and paste one of the minidumps on
a
reply message - it won't allow me to paste. This morning I tried opening
one
of the dmp files using a text application (notepad & wordpad) but to no
avail.

At this point not sure how to get one of the dmp files to you.

If you have any suggestions, it would be much appreciated.

The module name is included in the dump file, but it requires some
technical
knowledge to analyse the dumps.

If you like, drop me an e-mail with a minidump and I'll see what info I
can
retrieve from it.

Regards

Oli

Oli -

Thanks for the response.

I have not noted a module name - as I said earlier, the message appears
and
disappears quickly and you basaically just get a glimpse of it. Would
the
module be recorded anywhere else - in the event log or dmp file?

Thanks for the firewall suggestion - I'll be doing that.


:

Hi

When the system blue-screens, it will also tell you a module name.
This
is
useful information in finding out what the problem is.

I take it you're using a firewall. If not, try the free version of
ZoneAlarm at www.zonelabs.com and see if that makes any difference.

Regards

Oli


Much like some other messages posted, I am experiencing similar
problems
in
Win 2000 Pro where a blue screen will appear with message regarding
the
commencemet of a physical dump of memory. The message vanishes
quickly
so
there is no time to record the details - the blue screen appears
with
out
warning.

Characteristics of problem:

1. Problem started about the same time I updated the service pack
for
2000
and updated Internet Explorer.
2. From the Control Panel/Systems, I'm able to see an event logged
as
a
"Save Dump". The event reads as follows:

"The computer has rebooted from a bugcheck. The bugcheck was:
0x0000001e
(0xc0000005, 0xbfe10014, 0x00000000, 0x00000011). Microsoft Windows
2000
[v15.2195]. A dump was savied in
C:\WINNT\minidump\mini101804.02.dmp."

3. From the minidump file, I can see the dates it occurred but am
unable
to
open the dmp file - it has happened 36 times since Feb 18th/04.
4. Blue screen usually appears while on the web - has happened
recently
without being on the web.
5. When surfing on the web, on certain addresses I am getting a
"debug"
message asking if I want to debug - I know nothing about this so I
usually
say no.

Could anyone assist me with this? I have low technical knowledge
when
it
comes to these types of problems and finding solutions.

Thankyou and would much appreciate the assistance

 

[Oli Restorick [MVP]]

Hi there

Thanks for sending me the dump file. I've taken a quick look at it. Below
is the !analyze -v information, for the benefit of anybody else who may be
getting the same issue.

The problem appears to be a crash in a module called cwcspud.sys which is a
driver installed on your system. From a quick web search, this file appears
to belong to your sound card. The first step in diagnosing the problem
would be to head off to device manager (Right-click My Computer and choose
"Manage") and disable the sound card temporarily. For good measure, try a
reboot now and see if that clears your issue. If it does, try looking for
another sound card driver. It is possible that an unsuitable driver is
loaded.

Hope this helps

Oli



KMODE_EXCEPTION_NOT_HANDLED (1e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Arguments:
Arg1: c0000005, The exception code that was not handled
Arg2: bfe19014, The address that the exception occurred at
Arg3: 00000000, Parameter 0 of the exception
Arg4: 00000011, Parameter 1 of the exception

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx"
referenced memory at "0x%08lx". The memory could not be "%s".

FAULTING_IP:
cwcspud+f014
bfe19014 ?? ???

EXCEPTION_PARAMETER1: 00000000

EXCEPTION_PARAMETER2: 00000011

READ_ADDRESS: unable to read from 80482fac
unable to read from 80482a08
unable to read from 804828e0
unable to read from 80474e00
unable to read from 804828f8
unable to read from 80482a04
unable to read from 80474e04
unable to read from 80482ac4
unable to read from 80482f80
00000011

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: 0x1E

LAST_CONTROL_TRANSFER: from 80469bb2 to 804559bc

STACK_TEXT:
ed43bddc 80469bb2 804190f0 00000000 00000000
nt!PspUnhandledExceptionInSystemThread+0x18
ed43bddc 80469bb2 804190f0 00000000 00000000 nt!KiThreadStartup+0x16
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16


STACK_COMMAND: .bugcheck ; kb

FOLLOWUP_IP:
cwcspud+f014
bfe19014 ?? ???

FOLLOWUP_NAME: MachineOwner

SYMBOL_NAME: cwcspud+f014

MODULE_NAME: cwcspud

IMAGE_NAME: cwcspud.sys

DEBUG_FLR_IMAGE_TIMESTAMP: 3a00b164

BUCKET_ID: 0x1E_cwcspud+f014

Followup: MachineOwner

 

[Guest]

Oli,

I disabled the sound card driver as you mentioned - then did a reboot - then
reinstalled the driver in the hopes that the reinstall will fix the problem.
Now I'll wait to see if I get a blue screen again - if I do, then I'll
disable again and get a new sound card.

Thanks for all the help

GTT