maybe this helps...
Event ID: 1000
Source Save Dump
Type Error
Description The computer has rebooted from a bugcheck. The bugcheck
was: <bugcheck code> (<bugcheck details>). Microsoft Windows NT
[v15.1381]. A full dump was not saved.
Comments Adrian Grigorof (Last update 6/3/2003):
0x0000000a = IRQL NOT LESS OR EQUAL - This Stop message, also known as
Stop 0xA, indicates that a kernel-mode process attempted to access a
portion of memory at an Interrupt Request Level (IRQL) that was too
high. A kernel-mode process can only access other processes that have an
IRQL lesser than or equal to its own. See the link below for more details.
0x000000d1 = IRQL_NOT_LESS_OR_EQUAL. Again, typically cause by bugs in
device drivers or incompatibility with the operating system (ie NT
drivers used on Windows 2000). Few articles Q810980, Q817790, Q812484,
Q817789, Q817864, Q816990, Q331053. Many more can be found by using the
Microsof search engine via the link for error code 0x000000d1.
0x0000001e = KMODE_EXCEPTION_NOT_HANDLED - This Stop message, also known
as Stop 0x1E, indicates that a kernel-mode process tried to execute an
illegal or unknown processor instruction. This error handler is a
default error handler that catches errors not associated with other
specific error handlers. See the link below for more details.
0x00000022 = FILE_SYSTEM - Explanation: This is a Windows 2000 Executive
character-mode STOP message. This indicates a generic file system
problem. User Action: If this is the first time you have booted after
installing new hardware, remove the hardware and boot again. Check the
Microsoft Hardware compatibility List to verify that the hardware and
its drivers are compatible with Windows 2000. For information about the
hardware, contact the supplier. If you are installing Windows 2000 for
the first time, check the Windows 2000 system requirements, including
the amount of RAM and disk space required to load the operating system.
Also, check the Hardware Compatibility List to verify that the system
can run Windows 2000. If Windows 2000 is loaded and no new hardware has
been installed, reboot with recovery options set to create a dump file.
If the message continues to appear, select the Last Known Good option
when you reboot. If there is no Last Known Good configuration, try using
the Emergency Repair Disk. If you do not have an Emergency Repair Disk,
contact your technical support group.
0x00000024 = NTFS_FILE_SYSTEM - This Stop message, also known as Stop
0x24, indicates that a problem occurred within Ntfs.sys (the driver file
that allows the system to read and write to NTFS drives).
0x00000044 = MULTIPLE_IRP_COMPLETE_REQUESTS - This is a Windows 2000
Executive character-mode STOP message. It indicates an attempt was made
to complete an IRP (I/O request packet) more than once, possibly by more
than one driver. If this is the first time you have booted after
installing new hardware, remove the hardware and boot again. Check the
Microsoft Hardware Compatibility List to verify that the hardware and
its drivers are compatible with Windows 2000. For information about the
hardware, contact the supplier. If you are installing Windows 2000 for
the first time, check the Windows 2000 system requirements, including
the amount of RAM and disk space required to load the operating system.
Also, check the Hardware Compatibility List to verify that the system
can run Windows 2000. If Windows 2000 is loaded and no new hardware has
been installed, reboot with recovery options set to create a dump file.
If the message continues to appear, select the Last Known Good option
when you reboot. If there is no Last Known Good configuration, try using
the Emergency Repair Disk. If you do not have an Emergency Repair Disk,
contact your technical support group. See also
Q186345,Q296734,Q294876,Q187518,Q196022,Q258813,Q260830
0x0000004D = NO_PAGES_AVAILABLE - Indicates there are no physical pages
available. Restart and set the Recovery options in the System Control
Panel or the /CRASHDEBUG system start option.
0x00000050 = PAGE_FAULT_IN_NONPAGED_AREA - Occurs on many circumstances
and it usually indicates faulty drivers. There are quite a few number of
Q articles on Microsoft's site. Do a search on "0x00000050".
0x000000de = POOL_CORRUPTION_IN_FILE_AREA - This signifies that a driver
corrupted pool memory used for holding pages destined for disk. When the
Memory Manager dereferenced the file, it discovered the corruption in
pool memory.
0x0000007b = INACCESSIBLE_BOOT_DEVICE - Indicates a problem with the
boot disk.
0x0000007f = UNEXPECTED_KERNEL_MODE - Appears when a driver tries to
execute an illegal processor instruction.
0xc0000005 = STATUS_ACCESS_VIOLATION - A memory access violation
occurred. (Parameter 4 of the bug check is the address, which the driver
attempted to access.) Typically generated by faulty drivers.
0xc000021a = STATUS_SYSTEM_PROCESS_TERMINATED - This error occurs when a
user-mode subsystem, such as WinLogon or the Client Server Runtime
Subsystem (CSRSS), has been fatally compromised and security can no
longer be guaranteed. In response, the operating system switches to
kernel mode. Microsoft Windows cannot run without WinLogon or CSRSS.
Therefore, this is one of the few cases where the failure of a user-mode
service can shut down the system. Mismatched system files can also cause
this error. This can occur if you have restored your hard disk from a
backup. Some backup programs might skip restoring system files that they
determine are in use. Search Microsoft's site for 0xc000021a as there
are a large number of Q article related to this stop code.
0xdeaddead = When there is not enough free disk space to write a dump
file, Savedump.exe does not write the following entry to the event log.
See Q235999 for more details. Fixed with SP6.
For a complete list of exception codes, see the ntstatus.h file located
in the inc directory of the Windows DDK.
PaulD (Last update 6/6/2003):
For Stop 0xA or IRQL_NOT_LESS_OR_EQUAL see also Q316676, Q310918,
Q311564, Q307129, Q319810, Q311806, Q311466.
HairyMonster
0x0000007b = INACCESSIBLE_BOOT_DEVICE - can occur with Windows 2000/XP
when moving a hard-disk to a different chipset motherboard (or indeed
upgrading the motherboard). Also occurs when using sysprep. MS article
Q271965/Q314082 detail work-arounds. Can also be done by transferring to
a working machine, loading the system hive in regedt32 and editing as
per instructions in Q271965.
Links Q235999 , Q192463 , Q314084 , Inside the Blue Screen, Crash Dump
Analysis, Stop 0x0000000A or IRQL_NOT_LESS_OR_EQUAL, Stop 0x0000001E or
KMODE_EXCEPTION_NOT_HANDLED, Stop 0x00000024 or NTFS_FILE_SYSTEM,
Q186345 , Q296734 , Q294876 , Q187518 , Q196022 , Q258813 , Q260830 ,
Bug Check 0xC000021A: STATUS_SYSTEM_PROCESS_TERMINATED, Q271965 ,
Q314082 , Error code 0x0000000a , Error code 0x0000001e , Error code
0x00000050 , Q810980 , Q817790 , Q812484 , Q817789 , Q817864 , Q816990 ,
Q331053 , Error code 0x000000d1 , Q316676 , Q310918 , Q311564 , Q307129
, Q319810 , Q311806 , Q311466
Send comments - Notify me when updated!
Automatic search for "Event 1000 Save Dump" at:
Support @ Microsoft - Search @ Microsoft - Google Newsgroups -
Google Microsoft
Automatic search for "Event ID 1000" through:
Support @ Microsoft - Search @ Microsoft - Google Newsgroups -
Google Microsoft - EventID.Net Processing Queue
Legal - EventID.Net @ 2001-2003 Altair Technologies Ltd., All rights
reserved
Hi
I have this event id on my Windows 2000 Server SP4
event id:1001- source:Save dump
The computer has rebooted from a bugcheck. The bugcheck was: 0x00000044
(0x84440bc8, 0x00000cca, 0x00000000, 0x00000000). Microsoft Windows 2000
[v15.2195]. A dump was saved in: C:\WINNT\MEMORY.DMP
This event is coming after a hardware problem with my server, and we
changed our MB, i read Microsoft article and install SP4, this event
don't apperar for 4 days but now is newly present and reboot my server.
Help me please
TIA Pupo
