Some help with a mini dump analysis

T

thesmackdown

New member
Local time
8:19 PM
Messages
16
I have had a few BSODs over the last few days and am totally lost as to what the cause is. Here is an example of one of the mini dump files.
Code: 
Microsoft (R) Windows Debugger Version 6.11.0001.404 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Windows\Minidump\122709-18283-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*C:\SymCache*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7600 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16385.amd64fre.win7_rtm.090713-1255
Machine Name:
Kernel base = 0xfffff800`02a12000 PsLoadedModuleList = 0xfffff800`02c4fe50
Debug session time: Sun Dec 27 08:12:32.670 2009 (GMT-6)
System Uptime: 0 days 12:24:22.880
Loading Kernel Symbols
...............................................................
................................................................
........................................
Loading User Symbols
Loading unloaded module list
......
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1A, {5003, fffff70001080000, 13d60, 137e700026fca}

Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+21bc6 )

Followup: MachineOwner
---------

3: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

MEMORY_MANAGEMENT (1a)
    # Any other values for parameter 1 must be individually examined.
Arguments:
Arg1: 0000000000005003, The subtype of the bugcheck.
Arg2: fffff70001080000
Arg3: 0000000000013d60
Arg4: 000137e700026fca

Debugging Details:
------------------


BUGCHECK_STR:  0x1a_5003

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

PROCESS_NAME:  firefox.exe

CURRENT_IRQL:  0

LAST_CONTROL_TRANSFER:  from fffff80002aec536 to fffff80002a83f00

STACK_TEXT:  
fffff880`0baa0128 fffff800`02aec536 : 00000000`0000001a 00000000`00005003 fffff700`01080000 00000000`00013d60 : nt!KeBugCheckEx
fffff880`0baa0130 fffff800`02a9e82c : fffff680`0004d540 fffff880`0baa0200 00000000`00000000 ffffffff`ffffffff : nt! ?? ::FNODOBFM::`string'+0x21bc6
fffff880`0baa0180 fffff800`02a81fee : 00000000`00000001 00000000`ffffff07 00000000`0042ec01 00000000`00712d90 : nt!MmAccessFault+0xc4c
fffff880`0baa02e0 00000000`65ff25e1 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiPageFault+0x16e
00000000`0042ebc4 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x65ff25e1


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt! ?? ::FNODOBFM::`string'+21bc6
fffff800`02aec536 cc              int     3

SYMBOL_STACK_INDEX:  1

SYMBOL_NAME:  nt! ?? ::FNODOBFM::`string'+21bc6

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  4a5bc600

FAILURE_BUCKET_ID:  X64_0x1a_5003_nt!_??_::FNODOBFM::_string_+21bc6

BUCKET_ID:  X64_0x1a_5003_nt!_??_::FNODOBFM::_string_+21bc6

Followup: MachineOwner
---------
And one from yesterday:
Code: 
Microsoft (R) Windows Debugger Version 6.11.0001.404 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Windows\Minidump\122609-37331-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*C:\SymCache*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7600 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16385.amd64fre.win7_rtm.090713-1255
Machine Name:
Kernel base = 0xfffff800`02a5b000 PsLoadedModuleList = 0xfffff800`02c98e50
Debug session time: Sat Dec 26 19:15:43.134 2009 (GMT-6)
System Uptime: 0 days 0:59:19.694
Loading Kernel Symbols
...............................................................
................................................................
........................................
Loading User Symbols
Loading unloaded module list
.....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck C1, {fffff98018fd2fe0, fffff98018fd288c, 4b001c, 32}

Probably caused by : memory_corruption ( nt!MiCheckSpecialPoolSlop+83 )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

SPECIAL_POOL_DETECTED_MEMORY_CORRUPTION (c1)
Special pool has detected memory corruption.  Typically the current thread's
stack backtrace will reveal the guilty party.
Arguments:
Arg1: fffff98018fd2fe0, address trying to free
Arg2: fffff98018fd288c, address where one bit is corrupted
Arg3: 00000000004b001c, (reserved)
Arg4: 0000000000000032, caller is freeing an address where nearby bytes within the same page have a single bit error

Debugging Details:
------------------


BUGCHECK_STR:  0xC1_32

SPECIAL_POOL_CORRUPTION_TYPE:  32

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VERIFIER_ENABLED_VISTA_MINIDUMP

PROCESS_NAME:  digsby-app.exe

CURRENT_IRQL:  1

IRP_ADDRESS:  ffffffffffffff88

LAST_CONTROL_TRANSFER:  from fffff80002b5b593 to fffff80002accf00

STACK_TEXT:  
fffff880`06e3a6c8 fffff800`02b5b593 : 00000000`000000c1 fffff980`18fd2fe0 fffff980`18fd288c 00000000`004b001c : nt!KeBugCheckEx
fffff880`06e3a6d0 fffff800`02bd2613 : fffff880`00000003 fffffa80`0ae23b60 00000000`00000297 fffff800`02f5fdfe : nt!MiCheckSpecialPoolSlop+0x83
fffff880`06e3a710 fffff800`02bfe356 : fffff800`02a5b000 00000000`20206f49 00000000`001451bc fffffa80`0addbdb0 : nt!MmFreeSpecialPool+0x1d3
fffff880`06e3a840 fffff800`02aec56e : fffffa80`0ae23b60 fffff800`02ad2dda 00000000`00000001 00000000`00000000 : nt!ExFreePool+0x9f3
fffff880`06e3a8f0 fffff800`02aa992f : 00000000`00000000 00000000`00000000 fffffa80`0addbd00 fffff880`06e3ac60 : nt!IopCompleteRequest+0x5ce
fffff880`06e3a9c0 fffff800`02ad425d : fffff800`02c48fe0 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiDeliverApc+0x1d7
fffff880`06e3aa40 fffff800`02ad61af : 00000000`00000294 00000000`7efd8000 fffff880`0000006b 00000000`0424f118 : nt!KiCommitThreadWait+0x3dd
fffff880`06e3aad0 fffff800`02dc4ab2 : fffff880`06e3ac00 fffffa80`00000006 00000000`00000001 fffff800`02de4001 : nt!KeWaitForSingleObject+0x19f
fffff880`06e3ab70 fffff800`02acc153 : fffffa80`0ae23b60 00000000`00000000 fffff880`06e3abb8 fffffa80`0a2afbf0 : nt!NtWaitForSingleObject+0xb2
fffff880`06e3abe0 00000000`737f2dd9 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`0424f0f8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x737f2dd9


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt!MiCheckSpecialPoolSlop+83
fffff800`02b5b593 cc              int     3

SYMBOL_STACK_INDEX:  1

SYMBOL_NAME:  nt!MiCheckSpecialPoolSlop+83

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

DEBUG_FLR_IMAGE_TIMESTAMP:  4a5bc600

IMAGE_NAME:  memory_corruption

FAILURE_BUCKET_ID:  X64_0xC1_32_VRF_nt!MiCheckSpecialPoolSlop+83

BUCKET_ID:  X64_0xC1_32_VRF_nt!MiCheckSpecialPoolSlop+83

Followup: MachineOwner
---------
Any suggestions on where to go next?
 

My Computer

OS
Windows 7 Pro x64
CPU
Intel Core2 Quad Q9550 @2.83GHz
Motherboard
Gigabyte EP45-UD3P with F9 Bios
Memory
8 gigs OCZ DDR2 400MHz (OCZ2G8002G)
Graphics Card(s)
EVGA NVIDIA GeForce GTX260
Sound Card
On Board
Monitor(s) Displays
Samsung T260HD
Cooling
Liquid
thesmackdown said:
I have had a few BSODs over the last few days and am totally lost as to what the cause is. Here is an example of one of the mini dump files.
Code: 
Microsoft (R) Windows Debugger Version 6.11.0001.404 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Windows\Minidump\122709-18283-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*C:\SymCache*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7600 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16385.amd64fre.win7_rtm.090713-1255
Machine Name:
Kernel base = 0xfffff800`02a12000 PsLoadedModuleList = 0xfffff800`02c4fe50
Debug session time: Sun Dec 27 08:12:32.670 2009 (GMT-6)
System Uptime: 0 days 12:24:22.880
Loading Kernel Symbols
...............................................................
................................................................
........................................
Loading User Symbols
Loading unloaded module list
......
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1A, {5003, fffff70001080000, 13d60, 137e700026fca}

Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+21bc6 )

Followup: MachineOwner
---------

3: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

MEMORY_MANAGEMENT (1a)
    # Any other values for parameter 1 must be individually examined.
Arguments:
Arg1: 0000000000005003, The subtype of the bugcheck.
Arg2: fffff70001080000
Arg3: 0000000000013d60
Arg4: 000137e700026fca

Debugging Details:
------------------


BUGCHECK_STR:  0x1a_5003

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

PROCESS_NAME:  firefox.exe

CURRENT_IRQL:  0

LAST_CONTROL_TRANSFER:  from fffff80002aec536 to fffff80002a83f00

STACK_TEXT:  
fffff880`0baa0128 fffff800`02aec536 : 00000000`0000001a 00000000`00005003 fffff700`01080000 00000000`00013d60 : nt!KeBugCheckEx
fffff880`0baa0130 fffff800`02a9e82c : fffff680`0004d540 fffff880`0baa0200 00000000`00000000 ffffffff`ffffffff : nt! ?? ::FNODOBFM::`string'+0x21bc6
fffff880`0baa0180 fffff800`02a81fee : 00000000`00000001 00000000`ffffff07 00000000`0042ec01 00000000`00712d90 : nt!MmAccessFault+0xc4c
fffff880`0baa02e0 00000000`65ff25e1 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiPageFault+0x16e
00000000`0042ebc4 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x65ff25e1


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt! ?? ::FNODOBFM::`string'+21bc6
fffff800`02aec536 cc              int     3

SYMBOL_STACK_INDEX:  1

SYMBOL_NAME:  nt! ?? ::FNODOBFM::`string'+21bc6

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  4a5bc600

FAILURE_BUCKET_ID:  X64_0x1a_5003_nt!_??_::FNODOBFM::_string_+21bc6

BUCKET_ID:  X64_0x1a_5003_nt!_??_::FNODOBFM::_string_+21bc6

Followup: MachineOwner
---------
And one from yesterday:
Code: 
Microsoft (R) Windows Debugger Version 6.11.0001.404 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Windows\Minidump\122609-37331-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*C:\SymCache*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7600 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16385.amd64fre.win7_rtm.090713-1255
Machine Name:
Kernel base = 0xfffff800`02a5b000 PsLoadedModuleList = 0xfffff800`02c98e50
Debug session time: Sat Dec 26 19:15:43.134 2009 (GMT-6)
System Uptime: 0 days 0:59:19.694
Loading Kernel Symbols
...............................................................
................................................................
........................................
Loading User Symbols
Loading unloaded module list
.....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck C1, {fffff98018fd2fe0, fffff98018fd288c, 4b001c, 32}

Probably caused by : memory_corruption ( nt!MiCheckSpecialPoolSlop+83 )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

SPECIAL_POOL_DETECTED_MEMORY_CORRUPTION (c1)
Special pool has detected memory corruption.  Typically the current thread's
stack backtrace will reveal the guilty party.
Arguments:
Arg1: fffff98018fd2fe0, address trying to free
Arg2: fffff98018fd288c, address where one bit is corrupted
Arg3: 00000000004b001c, (reserved)
Arg4: 0000000000000032, caller is freeing an address where nearby bytes within the same page have a single bit error

Debugging Details:
------------------


BUGCHECK_STR:  0xC1_32

SPECIAL_POOL_CORRUPTION_TYPE:  32

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VERIFIER_ENABLED_VISTA_MINIDUMP

PROCESS_NAME:  digsby-app.exe

CURRENT_IRQL:  1

IRP_ADDRESS:  ffffffffffffff88

LAST_CONTROL_TRANSFER:  from fffff80002b5b593 to fffff80002accf00

STACK_TEXT:  
fffff880`06e3a6c8 fffff800`02b5b593 : 00000000`000000c1 fffff980`18fd2fe0 fffff980`18fd288c 00000000`004b001c : nt!KeBugCheckEx
fffff880`06e3a6d0 fffff800`02bd2613 : fffff880`00000003 fffffa80`0ae23b60 00000000`00000297 fffff800`02f5fdfe : nt!MiCheckSpecialPoolSlop+0x83
fffff880`06e3a710 fffff800`02bfe356 : fffff800`02a5b000 00000000`20206f49 00000000`001451bc fffffa80`0addbdb0 : nt!MmFreeSpecialPool+0x1d3
fffff880`06e3a840 fffff800`02aec56e : fffffa80`0ae23b60 fffff800`02ad2dda 00000000`00000001 00000000`00000000 : nt!ExFreePool+0x9f3
fffff880`06e3a8f0 fffff800`02aa992f : 00000000`00000000 00000000`00000000 fffffa80`0addbd00 fffff880`06e3ac60 : nt!IopCompleteRequest+0x5ce
fffff880`06e3a9c0 fffff800`02ad425d : fffff800`02c48fe0 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiDeliverApc+0x1d7
fffff880`06e3aa40 fffff800`02ad61af : 00000000`00000294 00000000`7efd8000 fffff880`0000006b 00000000`0424f118 : nt!KiCommitThreadWait+0x3dd
fffff880`06e3aad0 fffff800`02dc4ab2 : fffff880`06e3ac00 fffffa80`00000006 00000000`00000001 fffff800`02de4001 : nt!KeWaitForSingleObject+0x19f
fffff880`06e3ab70 fffff800`02acc153 : fffffa80`0ae23b60 00000000`00000000 fffff880`06e3abb8 fffffa80`0a2afbf0 : nt!NtWaitForSingleObject+0xb2
fffff880`06e3abe0 00000000`737f2dd9 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`0424f0f8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x737f2dd9


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt!MiCheckSpecialPoolSlop+83
fffff800`02b5b593 cc              int     3

SYMBOL_STACK_INDEX:  1

SYMBOL_NAME:  nt!MiCheckSpecialPoolSlop+83

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

DEBUG_FLR_IMAGE_TIMESTAMP:  4a5bc600

IMAGE_NAME:  memory_corruption

FAILURE_BUCKET_ID:  X64_0xC1_32_VRF_nt!MiCheckSpecialPoolSlop+83

BUCKET_ID:  X64_0xC1_32_VRF_nt!MiCheckSpecialPoolSlop+83

Followup: MachineOwner
---------
Any suggestions on where to go next?
Click to expand...


Hi thesmackdown, Welcome to SF,

According to the analysis i guess problem is with Memory Corruption since Firefox and Disbsy is involved is best to Run memtest. Also Go To Start > Cmd > Right Click on cmd and Run as Administrator then type sfc /scannow

Hope this helps
 

My Computer

Computer Manufacturer/Model Number
Samsung NP550P5C-S02IN
OS
Windows 7 Ultimate - 64-bit | Windows 8 Pro - 64-bit
CPU
Intel® Core™ i7 Processor 3,610QM (2.30Hz, 6MB L3 Cach
Memory
8 GB
Graphics Card(s)
NVIDIA® GeForce® GT 650M 2GB Graphics, Optimus™ techno
Sound Card
SoundAlive™ JBL 3 Speakers (With sub-Woofer)
Monitor(s) Displays
39.62cm (15.6) SuperBright 300nit HD+ LED Display
Screen Resolution
1,600 x 900, Anti-Reflective
Hard Drives
1TB S-ATA II Hard Drive (5,400RPM)
Capt Jack is of course correct.

Memory corruption is the probable cause.


just suggest you

1-run memtest for at least 5 passes

2- in sfc /scannow you give us results for you will have to run it more than once

misc
if you are overclocking STOP
if you are raid'ing update driver


Jump

Ken J+
 

My Computer

Computer Manufacturer/Model Number
HP Pavillion dv-7 1005 Tx
OS
Win 8 Release candidate 8400
CPU
[email protected]
Memory
4 gigs
Graphics Card(s)
Nvidia 9600M
Sound Card
HD built-in
Monitor(s) Displays
17" Wxga
Screen Resolution
1440x900
Cooling
none
Internet Speed
45Mb down 5Mb up
Turn off Driver Verifier. It's purpose is to generate BSOD's:
Go to Start and type in "verifier" (without the quotes) and press Enter
In the next screen, select "Delete existing settings"
Then press the Finish button in the lower right
Click to expand...
 

My Computer

Computer Manufacturer/Model Number
Home built (x64), Lenovo x61s Tablet, Samsung Netbook
OS
Win7 x64 + x86
CPU
Intel i7 920, other Intel chips, and the Atom in the netbook
Motherboard
Asus P6T Deluxe
Memory
12 gB; 4 gB Lenovo; 1 gB Samsung netbook
Graphics Card(s)
ATI 4870
Sound Card
Yes, I have one of these
Monitor(s) Displays
32" Sharp Aquos TV
Screen Resolution
800x600 - I have vision issues
Hard Drives
4 - 150 gB Velociraptors in RAID 5
Promise controller
PSU
1000 watt (can't recall the brand)
Case
Antec 300
Cooling
Big honking cooler that was rated highly at Toms Hardware
Keyboard
Microsoft Natural
Mouse
Logitech Trackman
Internet Speed
Cable
Other Info
GeekSquad UPS
CyberPower UPS
DLink DNS-323 NAS (2 tB)
Netgear wireless router as an access point
Netgear wired router FSV-318
Home network consists of
4 desktop computers (2 Vista, 2 Win7)
1 netbook (Win7)
4 laptop computers (XP, 2-Vista, Win7)
Wii and XBox 360
here is the CBS log
 

My Computer

OS
Windows 7 Pro x64
CPU
Intel Core2 Quad Q9550 @2.83GHz
Motherboard
Gigabyte EP45-UD3P with F9 Bios
Memory
8 gigs OCZ DDR2 400MHz (OCZ2G8002G)
Graphics Card(s)
EVGA NVIDIA GeForce GTX260
Sound Card
On Board
Monitor(s) Displays
Samsung T260HD
Cooling
Liquid
usasma said:
Turn off Driver Verifier. It's purpose is to generate BSOD's:
Go to Start and type in "verifier" (without the quotes) and press Enter
In the next screen, select "Delete existing settings"
Then press the Finish button in the lower right
Click to expand...
Click to expand...


Thanks - thought I did that last night - but I'll do it again.
 

My Computer

OS
Windows 7 Pro x64
CPU
Intel Core2 Quad Q9550 @2.83GHz
Motherboard
Gigabyte EP45-UD3P with F9 Bios
Memory
8 gigs OCZ DDR2 400MHz (OCZ2G8002G)
Graphics Card(s)
EVGA NVIDIA GeForce GTX260
Sound Card
On Board
Monitor(s) Displays
Samsung T260HD
Cooling
Liquid
You must log in or register to reply here.

Similar threads

BSOD playing Genshin Impact, Bugcheck 1e
Replies
3
Views
3K
axe0
A
BSOD while browsing in Chrome - BAD POOL HEADER
2
Replies
20
Views
6K
axe0
A
BSOD - DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
Replies
1
Views
1K
zbook
Z
BSOD while idle only happening after fresh install.
Replies
4
Views
1K
axe0
A
Random BSODs when waking from sleep and other
Replies
1
Views
1K
axe0
A
Back
Top