Reading Minidumps

poohgc · 08-25-2008, 08:11 PM

Hello all,

I have a windows 2000 pro machine with all the patches. Lately I have been getting a random BSOD. This machine is used as a file server only. It has 512 K ram on it with HP 4200 printer software installed along with some antivirus, pcanywhere and a program called Taxwise (along with all the default software) on it. There is a maximum of 2 users that connect to this machine so it is used very lightly. I tried to read the minidumps, but my knowledge of them is next to nothing.

Is there anyone out there willing to take a stab at them to see what the problem may be? Is there any other information that is needed to help me figure this out? The dumps are attached.

Thank you!
gmc

**jcgriff2** · 08-26-2008, 01:32 AM

Hi. . .

I would be glad to run them and see what comes out.

Picked up 15 mini kernel dumps, 14 of which are dated 06-05-2008 to 08-14-2008 and 1 dated 12-19-2007.

Regards. . .

jcgriff2

.

**jcgriff2** · 08-26-2008, 09:33 PM

Hi. . .

I ran the 15 dump files, but unfortunately cannot obtain the proper symbol files from Microsoft for Windows 2000 SP4. There are 3 downloads of symbols necessary well in excess of 100mb. I need Win2000, Win2000SP4 and then Win2000 SP4 inclusive. The extraction job for the second one continuously fails and I cannot figure out why. I have tried this on various systems here including a Vista x64, Vista x86 and 2 XP systems - 1 XP Home and 1 XP Pro - all to no avail. I have contacted Microsoft about this. The download and installation of the 1st and 3rd symbol package went just fine,

There s/b no problem with processing dump files from a Windows 2000 system on a system with an OS newer than Windows 2000.

I was able to look throughout the outputs of each and the only item to stand out is that they newest drivers in your system belong to Norton and have a timestamp of May 6, 2008. Interesting to note that you BSODs started on June 5, 2008. A Norton module with the aforementioned date would have gone into your system in early June, coinciding with the BSODs. I would definitely un-install Norton and test your system to see if it is in fact Norton causing your problems. Also a boot-up into SAFEMODE and testing may tell you as well.

The other module that I found recently updated was eeCtrl.sys, timestamp Thu Jan 17 21:44:27 2008, which also belongs to Symantec (Norton) and ironically your first BSOD was dated January 21, 2008. I strongly suspect Norton is the root cause of your BSODs.

A summary of the mini kernel dbug output is below and I have attached a full dbug output log as well.

Regards. . .

jcgriff2

.

Code:

BugCheck A, {2018006, 2, 1, 8042a771}
Probably caused by : ntoskrnl.exe ( nt+2a771 )
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
BugCheck A, {55444648, 2, 1, 804321a1}
Probably caused by : ntoskrnl.exe ( nt+321a1 )
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
BugCheck A, {0, 2, 1, 8044846f}
Probably caused by : ntoskrnl.exe ( nt+4846f )
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
BugCheck BE, {b7c4f06c, 3917121, 804716c8, a}
Probably caused by : ntoskrnl.exe ( nt+49d19 )
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
BugCheck 1E, {c0000005, 8048f867, 0, 0}
Probably caused by : ntoskrnl.exe ( nt+8f867 )
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
BugCheck 1E, {c0000005, 8046acc8, 0, 0}
Probably caused by : ntoskrnl.exe ( nt+6acc8 )
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
BugCheck A, {e2c3f8, 2, 0, 8042b784}
Probably caused by : ntoskrnl.exe ( nt+2b784 )
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
BugCheck 1E, {c0000005, 8046acc8, 0, 0}
Probably caused by : ntoskrnl.exe ( nt+6acc8 )
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
BugCheck 1E, {c0000005, 8048f867, 0, 0}
Probably caused by : ntoskrnl.exe ( nt+8f867 )
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
BugCheck A, {14, 2, 0, 80432328}
Probably caused by : ntoskrnl.exe ( nt+32328 )
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
BugCheck 1E, {c0000005, 8046acc8, 0, 0}
Probably caused by : ntoskrnl.exe ( nt+6acc8 )
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
BugCheck C0000218, {e1305b08, 0, 0, 0}
Probably caused by : ntoskrnl.exe ( nt+84df6 )
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
BugCheck 50, {ffffffdc, 0, 804157c1, 0}
Probably caused by : ntoskrnl.exe ( nt+157c1 )
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
BugCheck 50, {e5691000, 0, 8045abb3, 1}
Probably caused by : ntoskrnl.exe ( nt+5abb3 )

=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
.
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
*** ERROR: Module load completed but symbols could not be loaded for ntoskrnl.exe
Debug session time: Wed Aug 13 18:10:50.281 2008 (GMT-4)
System Uptime: not available
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
*** ERROR: Module load completed but symbols could not be loaded for ntoskrnl.exe
BugCheck A, {2018006, 2, 1, 8042a771}
Probably caused by : ntoskrnl.exe ( nt+2a771 )
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
*** ERROR: Module load completed but symbols could not be loaded for ntoskrnl.exe
Debug session time: Wed Aug 13 16:56:37.824 2008 (GMT-4)
System Uptime: not available
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
*** ERROR: Module load completed but symbols could not be loaded for ntoskrnl.exe
BugCheck A, {55444648, 2, 1, 804321a1}
Probably caused by : ntoskrnl.exe ( nt+321a1 )
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
*** ERROR: Module load completed but symbols could not be loaded for ntoskrnl.exe
Debug session time: Thu Jul 31 03:30:58.787 2008 (GMT-4)
System Uptime: not available
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
*** ERROR: Module load completed but symbols could not be loaded for ntoskrnl.exe
BugCheck A, {0, 2, 1, 8044846f}
Probably caused by : ntoskrnl.exe ( nt+4846f )
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
*** ERROR: Module load completed but symbols could not be loaded for ntoskrnl.exe
Debug session time: Mon Jul 28 06:41:08.687 2008 (GMT-4)
System Uptime: not available
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
*** ERROR: Module load completed but symbols could not be loaded for ntoskrnl.exe
BugCheck BE, {b7c4f06c, 3917121, 804716c8, a}
Probably caused by : ntoskrnl.exe ( nt+49d19 )
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
*** ERROR: Module load completed but symbols could not be loaded for ntoskrnl.exe
Debug session time: Sun Jul 20 03:28:04.253 2008 (GMT-4)
System Uptime: not available
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
*** ERROR: Module load completed but symbols could not be loaded for ntoskrnl.exe
BugCheck 1E, {c0000005, 8048f867, 0, 0}
Probably caused by : ntoskrnl.exe ( nt+8f867 )
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
*** ERROR: Module load completed but symbols could not be loaded for ntoskrnl.exe
Debug session time: Fri Jun 27 18:53:53.753 2008 (GMT-4)
System Uptime: not available
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
*** ERROR: Module load completed but symbols could not be loaded for ntoskrnl.exe
BugCheck 1E, {c0000005, 8046acc8, 0, 0}
Probably caused by : ntoskrnl.exe ( nt+6acc8 )
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
*** ERROR: Module load completed but symbols could not be loaded for ntoskrnl.exe
Debug session time: Fri Jun 27 03:11:50.240 2008 (GMT-4)
System Uptime: not available
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
*** ERROR: Module load completed but symbols could not be loaded for ntoskrnl.exe
BugCheck A, {e2c3f8, 2, 0, 8042b784}
Probably caused by : ntoskrnl.exe ( nt+2b784 )
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
*** ERROR: Module load completed but symbols could not be loaded for ntoskrnl.exe
Debug session time: Thu Jun 26 16:41:31.787 2008 (GMT-4)
System Uptime: not available
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
*** ERROR: Module load completed but symbols could not be loaded for ntoskrnl.exe
BugCheck 1E, {c0000005, 8046acc8, 0, 0}
Probably caused by : ntoskrnl.exe ( nt+6acc8 )
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
*** ERROR: Module load completed but symbols could not be loaded for ntoskrnl.exe
Debug session time: Fri Jun 20 11:57:41.290 2008 (GMT-4)
System Uptime: not available
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
*** ERROR: Module load completed but symbols could not be loaded for ntoskrnl.exe
BugCheck 1E, {c0000005, 8048f867, 0, 0}
Probably caused by : ntoskrnl.exe ( nt+8f867 )
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
*** ERROR: Module load completed but symbols could not be loaded for ntoskrnl.exe
Debug session time: Sat Jun 14 05:49:24.694 2008 (GMT-4)
System Uptime: not available
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
*** ERROR: Module load completed but symbols could not be loaded for ntoskrnl.exe
BugCheck A, {14, 2, 0, 80432328}
Probably caused by : ntoskrnl.exe ( nt+32328 )
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
*** ERROR: Module load completed but symbols could not be loaded for ntoskrnl.exe
Debug session time: Mon Jun  9 10:44:08.062 2008 (GMT-4)
System Uptime: not available
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
*** ERROR: Module load completed but symbols could not be loaded for ntoskrnl.exe
BugCheck 1E, {c0000005, 8046acc8, 0, 0}
Probably caused by : ntoskrnl.exe ( nt+6acc8 )
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
*** ERROR: Module load completed but symbols could not be loaded for ntoskrnl.exe
Debug session time: Mon Jun  9 10:43:00.546 2008 (GMT-4)
System Uptime: not available
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
*** ERROR: Module load completed but symbols could not be loaded for ntoskrnl.exe
BugCheck C0000218, {e1305b08, 0, 0, 0}
Probably caused by : ntoskrnl.exe ( nt+84df6 )
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
*** ERROR: Module load completed but symbols could not be loaded for ntoskrnl.exe
Debug session time: Thu Jun  5 03:19:46.549 2008 (GMT-4)
System Uptime: not available
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
*** ERROR: Module load completed but symbols could not be loaded for ntoskrnl.exe
BugCheck 50, {ffffffdc, 0, 804157c1, 0}
Probably caused by : ntoskrnl.exe ( nt+157c1 )
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
*** ERROR: Module load completed but symbols could not be loaded for ntoskrnl.exe
Debug session time: Wed Dec 19 11:08:09.045 2007 (GMT-4)
System Uptime: not available
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
*** ERROR: Module load completed but symbols could not be loaded for ntoskrnl.exe
BugCheck 50, {e5691000, 0, 8045abb3, 1}
Probably caused by : ntoskrnl.exe ( nt+5abb3 )
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

poohgc · 08-27-2008, 06:48 AM

Thank you. I too received errors when trying to load the symbols. I couldn't figure out what I was doing wrong, so I come here. I will uninstall Norton. This is the server that supplies the other machines with their definitions for Norton so I will have go around and re-install the other machines as unmanaged. Isn't it odd that Norton has been on that machine for a couple years and it is just now starting to give problems?

**jcgriff2** · 08-27-2008, 04:56 PM

Hi. . .

You are welcome.

Did you have the same difficulty with the symbols, i.e., the 2nd of the 3 required failing? On all the systems that I tried the symbol installation on, the 2nd failed during the cab extract. I am unsure as to the cause of this.

Since you have had Norton running for a few years without incident, it may simply be attributable to the recent updates of their modules. Could it be that the updated modules were intended for Vista SP1 and XP SP3 and did not take into account those like yourself using Windows 2000? Are all of your Windows Updates in for Win2000 SP4?

It may be an option to roll Norton back to the previous version but incorporating the new virus definitions. It may be worth a try. Have you contacted Symantec (Norton) for information... or is that the reason for the visit here with us at TSF?

I went back and looked at the first dump again and found the Norton modules to be dated October 2007. So those apparently ran OK within your system. It appears that the update on January 17, 2008, probably caused the problems initially.

I found a Norton/ Windows compatibility list HERE. I don't know the version of Norton that you are running, but this listing may be of some help.

Here are the various bugchecks, which could be attributable to Norton:

0xc0000218 = the registry hive could not be loaded, which can be attributable to RAM, HDD or a driver that has corrupted the registry.

0x000000be = 0xbe = an attempt by a driver to write to read-only memory

0x0000001e = 0x1e = a kernel mode program generated an exception that the error handler did not catch. In this case, the exception was 0xc..5, which is a memory access violation by a driver

0x0000000a = 0xa = the infamous IRQL_NOT_LESS_OR_EQUAL and indicates that Microsoft Windows or a kernel-mode driver accessed paged memory at DISPATCH_LEVEL or above - an improper or illegal IRQL level.

0x00000050 - 0x50 = invalid system memory has been referenced.

To be on the safe side, perform a memory test using memtest86+. Simply click on the link in the second row in my sig banner and create as ISO file.

This all that I have right now, but if you are able to obtain the correct symbols, I will gladly re-run the dumps. Please know that you can send me a PM at anytime... OK??

Regards. . .

jcgriff2

.

poohgc · 08-28-2008, 09:08 AM

Hello,

I was able to now download all the symbols and no longer get an error when running the dumps. I just don't know how to read them now. Shall I post the bug analysis that I get??

**jcgriff2** · 08-28-2008, 10:29 AM

Yes... please do post them - or attach them.

Did you use the same procedure to download the symbols... the 3 packages?

Also, if not already doing do, please use the kd> command:

!analyze -v;r;kv;lmtn

Thanks. . .

JC

.

poohgc · 08-29-2008, 01:13 PM

OK, thank you for looking at those. please find attached some of the dumps. I didn't have time to run and post them all, maybe the attached will give some idea of what the problem is. Yes, I was able to install all three packages, no errors this time.

Thank you for looking.

**jcgriff2** · 08-30-2008, 10:26 PM

Hi. . .

Thanks for the dbug output files.

I still see an invalid timestamp error message for the NT kernel module ntoskrnl.exe - not sure what to make of this.

0x1e bugcheck did not show an offending driver, but did tell us that the process running at the time was Rtvscan.exe.

0xbe did not provide any additional information

0xa lists memory corruption as the probable cause with the instruction from the stack nt!MiFreeNonPagedPool+18, in this case a driver attempted to write to a pageable or an invalid memory address. Two of the 0xa dumps listed the system process at idle, while on showed iao.exe was running at the time of the BSOD.

Was it the server itself that crashed? I would run hardware diagnostics if the roll-back/removal of Norton did not help. Start w/ memtest86+ - click on the link in my sig area and create bootable ISO.

Regards. . .

jcgriff2

.

08-26-2008, 01:32 AM	#2 (permalink)
jcgriff2 Moderator, Microsoft Supp Join Date: Sep 2007 Location: The Great State of New Jersey - away from the gross corruption of the Riverside County, CA, SO office. SHAMEFUL ! Posts: 10,158 OS: Windows 7, Vista Ultimate My System	Re: Reading Minidumps Hi. . . I would be glad to run them and see what comes out. Picked up 15 mini kernel dumps, 14 of which are dated 06-05-2008 to 08-14-2008 and 1 dated 12-19-2007. Regards. . . jcgriff2 . __________________ . . . . . . . . BSOD Posting Instructions B Expecting a reply and waiting > 36 hours ? Send a PM to me containing a link to your thread Glad to be home in the Great State of New Jersey ! ! Last edited by jcgriff2; 08-26-2008 at 01:39 AM.

08-27-2008, 06:48 AM	#4 (permalink)
poohgc Registered User Join Date: Aug 2008 Posts: 4 OS: windows 2000 pro	Re: Reading Minidumps Thank you. I too received errors when trying to load the symbols. I couldn't figure out what I was doing wrong, so I come here. I will uninstall Norton. This is the server that supplies the other machines with their definitions for Norton so I will have go around and re-install the other machines as unmanaged. Isn't it odd that Norton has been on that machine for a couple years and it is just now starting to give problems?

08-27-2008, 04:56 PM	#5 (permalink)
jcgriff2 Moderator, Microsoft Supp Join Date: Sep 2007 Location: The Great State of New Jersey - away from the gross corruption of the Riverside County, CA, SO office. SHAMEFUL ! Posts: 10,158 OS: Windows 7, Vista Ultimate My System	Re: Reading Minidumps Hi. . . You are welcome. Did you have the same difficulty with the symbols, i.e., the 2nd of the 3 required failing? On all the systems that I tried the symbol installation on, the 2nd failed during the cab extract. I am unsure as to the cause of this. Since you have had Norton running for a few years without incident, it may simply be attributable to the recent updates of their modules. Could it be that the updated modules were intended for Vista SP1 and XP SP3 and did not take into account those like yourself using Windows 2000? Are all of your Windows Updates in for Win2000 SP4? It may be an option to roll Norton back to the previous version but incorporating the new virus definitions. It may be worth a try. Have you contacted Symantec (Norton) for information... or is that the reason for the visit here with us at TSF? I went back and looked at the first dump again and found the Norton modules to be dated October 2007. So those apparently ran OK within your system. It appears that the update on January 17, 2008, probably caused the problems initially. I found a Norton/ Windows compatibility list HERE. I don't know the version of Norton that you are running, but this listing may be of some help. Here are the various bugchecks, which could be attributable to Norton: 0xc0000218 = the registry hive could not be loaded, which can be attributable to RAM, HDD or a driver that has corrupted the registry. 0x000000be = 0xbe = an attempt by a driver to write to read-only memory 0x0000001e = 0x1e = a kernel mode program generated an exception that the error handler did not catch. In this case, the exception was 0xc..5, which is a memory access violation by a driver 0x0000000a = 0xa = the infamous IRQL_NOT_LESS_OR_EQUAL and indicates that Microsoft Windows or a kernel-mode driver accessed paged memory at DISPATCH_LEVEL or above - an improper or illegal IRQL level. 0x00000050 - 0x50 = invalid system memory has been referenced. To be on the safe side, perform a memory test using memtest86+. Simply click on the link in the second row in my sig banner and create as ISO file. This all that I have right now, but if you are able to obtain the correct symbols, I will gladly re-run the dumps. Please know that you can send me a PM at anytime... OK?? Regards. . . jcgriff2 . __________________ . . . . . . . . BSOD Posting Instructions B Expecting a reply and waiting > 36 hours ? Send a PM to me containing a link to your thread Glad to be home in the Great State of New Jersey ! !

08-28-2008, 09:08 AM	#6 (permalink)
poohgc Registered User Join Date: Aug 2008 Posts: 4 OS: windows 2000 pro	Re: Reading Minidumps Hello, I was able to now download all the symbols and no longer get an error when running the dumps. I just don't know how to read them now. Shall I post the bug analysis that I get??

08-28-2008, 10:29 AM	#7 (permalink)
jcgriff2 Moderator, Microsoft Supp Join Date: Sep 2007 Location: The Great State of New Jersey - away from the gross corruption of the Riverside County, CA, SO office. SHAMEFUL ! Posts: 10,158 OS: Windows 7, Vista Ultimate My System	Re: Reading Minidumps Yes... please do post them - or attach them. Did you use the same procedure to download the symbols... the 3 packages? Also, if not already doing do, please use the kd> command: !analyze -v;r;kv;lmtn Thanks. . . JC . __________________ . . . . . . . . BSOD Posting Instructions B Expecting a reply and waiting > 36 hours ? Send a PM to me containing a link to your thread Glad to be home in the Great State of New Jersey ! !

08-30-2008, 10:26 PM	#9 (permalink)
jcgriff2 Moderator, Microsoft Supp Join Date: Sep 2007 Location: The Great State of New Jersey - away from the gross corruption of the Riverside County, CA, SO office. SHAMEFUL ! Posts: 10,158 OS: Windows 7, Vista Ultimate My System	Re: Reading Minidumps Hi. . . Thanks for the dbug output files. I still see an invalid timestamp error message for the NT kernel module ntoskrnl.exe - not sure what to make of this. 0x1e bugcheck did not show an offending driver, but did tell us that the process running at the time was Rtvscan.exe. 0xbe did not provide any additional information 0xa lists memory corruption as the probable cause with the instruction from the stack nt!MiFreeNonPagedPool+18, in this case a driver attempted to write to a pageable or an invalid memory address. Two of the 0xa dumps listed the system process at idle, while on showed iao.exe was running at the time of the BSOD. Was it the server itself that crashed? I would run hardware diagnostics if the roll-back/removal of Norton did not help. Start w/ memtest86+ - click on the link in my sig area and create bootable ISO. Regards. . . jcgriff2 . __________________ . . . . . . . . BSOD Posting Instructions B Expecting a reply and waiting > 36 hours ? Send a PM to me containing a link to your thread Glad to be home in the Great State of New Jersey ! !