Advice Appreciated On... Rebooted from a bugcheck

[Twdix]

I have the message shown below in the System section of my Event Viewer.
I'm looking for some troubleshooting suggestions. What is this message and
why does it appear on EVERY system start?

My system is an HP Pavillion Pentium 4 with 1GB RAM and WinXP Home. I
noticed recently that on a normal system start that I was sitting at the
black WinXP logo screen (with the blue moving progress bar) for a longer
time than I was use to. The system does boot in to WinXP.

With a little digging I found the system log and noticed this Bugcheck
message. It is always the third entry in the log on a startup. The first
entry is "Microsoft (R) Windows (R) 5.01. 2600 Service Pack 2 Uniprocessor
Free", the second entry is "The Event log service was started".

Here's the complete third entry.

Event Type: Information
Event Source: Save Dump
Event Category: None
Event ID: 1000
Date: 11/25/2005
Time: 3:24:35 PM
User: N/A
Computer: TWDIX
Description:
The computer has rebooted from a bugcheck. The bugcheck was: 0x0000008e
(0xc0000005, 0xbfa9883c, 0xb261e7d4, 0x00000000). A full dump was not saved.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.

Any tips will be GREATLY appreciated.

Tom

 

[Rick \Nutcase\ Rogers]

Hi,

Main cause is usually faulty or mismatched ram. If you want to check the
memory, there are free programs here:

http://www.simmtester.com/page/products/doc/download.asp
http://oca.microsoft.com/en/windiag.asp

--
Best of Luck,

Rick Rogers, aka "Nutcase" - Microsoft MVP

Associate Expert - WindowsXP Expert Zone

Windows help - www.rickrogers.org

 

[Twdix]

Thanks for the ideas. I have downloaded and run the Microsoft Windows
Memory Diagnostic. First two passes were OK. I'll run the overnight
thorough test in an upcoming evening.

I was interested in your idea. I did have a major retailer spec and install
1GB of RAM in August. I do have the 1/2 GB that they removed. Do you think
swapping the original memory back into the machine would be a worthwhile
test?

Thanks again for your reply.

Tom

 

[David Candy]

Type verifier in Start Run, follow the wizard but choose All Drivers. This will slow down your computer and cause more blue screen crashes but will pinpoint what is causing the crash (if the original error message didn't). Once you fix it you rerun verifier and turn it off.

If you can't start after enabling verifier
choose Last Known Good Configuration at the Failed Boot menu (which will
start without verifier).


You will be creating a crash dump file in c:\windows\minidump every blue screen. Make sure you are set to record minidumps (Small Memory Dumps) - type it in Help to see how.

Then

If you have the XP SP2 Security Update CD (else see
http://www.microsoft.com/whdc/­devtools/debugging/symbolpkg.m­spx
)


Install symbols from <CD Drive Letter>:\SUPPORT\SYMBOLS

Download
http://www.microsoft.com/whdc/devtools/debugging/installx86.mspx

Load the crash dump file into windbg
and read what it says. You may need to tell it where the symbols are. Read it.
Type
!Analyze -v
into Windbg's command line.
(this will hopefully tell you the faulty component)

If the above is too technical then email the crash dump files to david @ mvps.org. Don't send me lots of them. Just the one from your last crash after you turn verifier on. And only one per mail.

You can look up specific details here
http://msdn.microsoft.com/library/d..._ea8b9fd0-2d81-4a04-a7ed-c1c6a80bd501.xml.asp

If it indicates faulty memory might be the cause you can get a memory tester
here
http://oca.microsoft.com/en/wi­ndiag.asp


If it mentions a core windows system file, meaning it a MS fix is required,
upload a minidump to

http://oca.microsoft.com

Also try typing the main error code in Help while online (ie,
Stop 0x50
and also try in the 8 digit form
stop 0x00000050)
and if there are too many hits use a filename if available. Generally memory
addresses are different for each computer (as each computer has a different
mix of drivers) so parameters that are memory addresses aren't that useful for searching, but NTStatus codes are (plus you can look them up here http://cvs.sourceforge.net/viewcvs.py/mingw/w32api/include/ddk/ntstatus.h?rev=1.2).

If this doesn't work try

Get your XP CD and install Windows Support Tools.


Type in start run after installing and rebooting


pstat > "%userprofile%\desktop\driverl­ist.txt"


The last table in this file is a list of loaded drivers. Other things apart
from hardware uses drivers. Post the list of drivers (the last table only -
REPEAT THE LAST TABLE O N L Y ) or match the fault address to the driver.

This will allow you to match memory addresses to a driver.

 

[Rick \Nutcase\ Rogers]

Yes, that would be a good idea. If it proves not to be the memory, then
follow David's steps regarding the driver verifier.

--
Best of Luck,

Rick Rogers, aka "Nutcase" - Microsoft MVP

Associate Expert - WindowsXP Expert Zone

Windows help - www.rickrogers.org