Needle in a haystack!

[Tony]

If anyone is an expert at understanding a memory dump file, could they
please assist? This occurs at least once a day but every time it occurs is
when I hit the save menu oiption in Visual Studio .NET. I've
reformatted/reinstalled windows plus all software and I've run hardware
vendor diagnostics. Unfortunately nothing helps. Many thanks to anyone who
can find the needle in the haystack.

----- 32 bit Kernel Summary Dump Analysis

DUMP_HEADER32:
MajorVersion 0000000f
MinorVersion 00000a28
DirectoryTableBase 343b1000
PfnDataBase 81053000
PsLoadedModuleList 805644a0
PsActiveProcessHead 8056a558
MachineImageType 0000014c
NumberProcessors 00000002
BugCheckCode 0000008e
BugCheckParameter1 c0000005
BugCheckParameter2 804e1c34
BugCheckParameter3 b7cb3c80
BugCheckParameter4 00000000
PaeEnabled 00000000
KdDebuggerDataBlock 805542e0

SUMMARY_DUMP32:
DumpOptions 504d4453
HeaderSize 0000a000
BitmapSize 0003ffaa
Pages 000060a6
Bitmap.SizeOfBitMap 0003ffaa

KiProcessorBlock at 805633a0
2 KiProcessorBlock entries:
ffdff120 f7abf120


Windows XP Kernel Version 2600 (Service Pack 2) MP (2 procs) Free x86
compatible
Built by: 2600.xpsp_sp2_rtm.040803-2158
Kernel base = 0x804d7000 PsLoadedModuleList = 0x805644a0
Debug session time: Fri Sep 23 10:27:40 2005
System Uptime: 0 days 0:05:36
start end module name
804d7000 80701000 nt Checksum: 0021C534 Timestamp: Wed Aug 04
16:18:18 2004 (41107FAA)

Unloaded modules:
b7969000 b7993000 kmixer.sys Timestamp: Fri Sep 23 10:26:40 2005
(43334BC0)
f7aff000 f7b06000 USBSTOR.SYS Timestamp: Fri Sep 23 10:25:17 2005
(43334B6D)
b872c000 b8756000 kmixer.sys Timestamp: Fri Sep 23 10:23:05 2005
(43334AE9)
f7e45000 f7e46000 drmkaud.sys Timestamp: Fri Sep 23 10:23:00 2005
(43334AE4)
b8a16000 b8a23000 DMusic.sys Timestamp: Fri Sep 23 10:23:00 2005
(43334AE4)
b8756000 b8779000 aec.sys Timestamp: Fri Sep 23 10:23:00 2005
(43334AE4)
b8a26000 b8a34000 swmidi.sys Timestamp: Fri Sep 23 10:23:00 2005
(43334AE4)
f7d6f000 f7d71000 splitter.sys Timestamp: Fri Sep 23 10:23:00 2005
(43334AE4)
b8b26000 b8b36000 Serial.SYS Timestamp: Fri Sep 23 10:22:46 2005
(43334AD6)
b82d3000 b82e7000 Parport.SYS Timestamp: Fri Sep 23 10:22:46 2005
(43334AD6)
f7b87000 f7b8c000 Cdaudio.SYS Timestamp: Fri Sep 23 10:22:19 2005
(43334ABB)
f709c000 f709f000 Sfloppy.SYS Timestamp: Fri Sep 23 10:22:19 2005
(43334ABB)
f7b7f000 f7b84000 Flpydisk.SYS Timestamp: Fri Sep 23 10:22:19 2005
(43334ABB)
f7b77000 f7b7e000 Fdc.SYS Timestamp: Fri Sep 23 10:22:19 2005
(43334ABB)

Finished dump check

 

[Mark Dormer]

0x0000008e is KERNEL_MODE_EXCEPTION_NOT_HANDLED
0xC0000005: STATUS_ACCESS_VIOLATION
A memory access violation occurred.

Update all drivers and BIOS.
http://msdn.microsoft.com/library/d..._12795dee-19a9-4461-a135-bbb882b81455.xml.asp

 

[Tony]

Hi Mark,

Thanks for the info and link. At least now I know it's driver/BIOS related
but unfortunately upgrading drivers and BIOS was one of the first things I
tried. I was wondering if you or anyone else can determine which driver is
at fault from the dump listing?

Regards,
Tony

 

[David Candy]

Type verifier in Start Run, follow the wizard but choose All Drivers. This will slow down your computer and cause more blue screen crashes but will pinpoint what is causing the crash (if the original error message didn't). Once you fix it you rerun verifier and turn it off.

If you can't start after enabling verifier
choose Last Known Good Configuration at the Failed Boot menu (which will
start without verifier).


You will be creating a crash dump file in c:\windows\minidump every blue screen. Make sure you are set to record minidumps (Small Memory Dumps) - type it in Help to see how.

Then

If you have the XP SP2 Security Update CD (else see
http://www.microsoft.com/whdc/­devtools/debugging/symbolpkg.m­spx
)


Install symbols from <CD Drive Letter>:\SUPPORT\SYMBOLS

Download
http://www.microsoft.com/whdc/devtools/debugging/installx86.mspx

Load the crash dump file into windbg
and read what it says. You may need to tell it where the symbols are. Read it.
Type
!Analyze -v
into Windbg's command line.
(this will hopefully tell you the faulty component)

If the above is too technical then email the crash dump files to davidc @ mvps.org. Don't send me lots of them. Just the one from your last crash after you turn verifier on. And only one per mail.

You can look up specific details here
http://msdn.microsoft.com/library/d..._ea8b9fd0-2d81-4a04-a7ed-c1c6a80bd501.xml.asp

If it indicates faulty memory might be the cause you can get a memory tester
here
http://oca.microsoft.com/en/wi­ndiag.asp


If it mentions a core windows system file, meaning it a MS fix is required,
upload a minidump to

http://oca.microsoft.com

Also try typing the main error code in Help while online (ie,
Stop 0x50
and also try in the 8 digit form
stop 0x00000050)
and if there are too many hits use a filename if available. Generally memory
addresses are different for each computer (as each computer has a different
mix of drivers) so parameters that are memory addresses aren't that useful for searching, but NTStatus codes are (plus you can look them up here http://cvs.sourceforge.net/viewcvs.py/mingw/w32api/include/ddk/ntstatus.h?rev=1.2).