Where are BSOD crash files stored?

[tony22]

I got an IRQL not less or equal BSOD last night. I was shocked to say te least. I've been using this syetm for at least a year in this exact physical configuration with not a lick of trouble. I was so taken aback that I did not notice from the information provided where the crash files were dropped. All I can remember is that there are two: one somewhere in the bowels of my Documents and Settings\User\Local\.... and the other somewhere in one of the Windows subdirectories. I looked in Windows\MiniDump but there was nothing with the correct date. I even did a seach of my entire C: directory looking for files Modified yesterday but nothing obvious showed up.

Where would these files be located?

 

[ttran]

They should be located in the C:\window\minidump. Make sure that you have set your system to create minidump correctly. Does the BSODs occur frequently? Please check the "Set minidump" below to make sure that you have set system to create minidump in appropriate way.

Windows 7:
Go to Start and type in "sysdm.cpl" (without the quotes) and press Enter
Click on the Advanced tab
Click on the Startup and Recovery Settings button
Ensure that "Automatically restart" is unchecked
Under the Write Debugging Information header select "Small memory dump (64 kB)" in the dropdown box
Ensure that the Small Dump Directory is listed as "%systemroot%\Minidump" (without the quotes)
Click OK twice to exit the dialogs, then reboot for the changes to take effect.

Also, make sure you don't use program such as CCcleaner, because they might clean out your minidmp folder anytime

 

[Jonathan_King]

Please follow these directions: http://www.sevenforums.com/crashes-debugging/96879-blue-screen-death-bsod-posting-instructions.html

Hopefully that will tell us what we need to know to solve it.

Just want to let you know, though, that a BSOD can be caused even by a power glitch. Since this is your first one, I wouldn't worry about it.

 

[tony22]

They should be located in the C:\window\minidump. Make sure that you have set your system to create minidump correctly. Does the BSODs occur frequently?

I'll have to check when I start Win7 back up. I'm running memtest86+ right now. I've only ever had this one BSOD. In fact, the last time I had a crash in Windows at all was (I think) back in the earliest days of Windows XP.

What has me scratching my head is the screen that indicated where the two files were located (which is what I can't remember). Neither one of them had a "minidump" in the path name.

Jonathan, thanks. I saw that thread after I posted this one. Once I get Win7 cranked up again I'll follow the instructions and hopefully will get something to post.

 

[tony22]

Dump files for review

Please follow these directions: http://www.sevenforums.com/crashes-debugging/96879-blue-screen-death-bsod-posting-instructions.html

Hopefully that will tell us what we need to know to solve it.

Just want to let you know, though, that a BSOD can be caused even by a power glitch. Since this is your first one, I wouldn't worry about it.

Here it is. You can see there are two older dmp files that were in the minidump directory, but neither one of these was a BSOD (I don't even recall the circumstances for these). And there is none from yesterday. Hopefully one of the other files will contain something.

Thanks for the help!

Oh, you can see my system specs, but as far as the other info:

Installed on a new bare drive
Full retail version
Installed 7/13/2009
Never reinstalled
Motherboard is a little over two years old
Other bits vary in age

 

[Jonathan_King]

Looks like VMware is causing the problem. Try removing it and see what happens.

Also, install these nVidia drivers: NVIDIA DRIVERS 258.96 WHQL

Finally, remove Acronis True Image, at least for the time being.

It may also pay to test RAM: http://www.sevenforums.com/tutorials/105647-ram-test-memtest86.html

...Summary of the Dumps:

[font=lucida console]
Built by: 7600.16385.amd64fre.win7_rtm.090713-1255
Debug session time: Sun Aug 22 23:21:02.266 2010 (GMT-4)
System Uptime: 7 days 13:16:33.465
BugCheck 124, {0, fffffa8006338038, b2000040, 800}
Probably caused by : hardware
BUGCHECK_STR:  0x124_GenuineIntel
PROCESS_NAME:  vmware-authd.e
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨
Built by: 7600.16385.amd64fre.win7_rtm.090713-1255
Debug session time: Sat Dec 19 09:58:02.782 2009 (GMT-4)
System Uptime: 0 days 0:04:50.016
BugCheck A, {8, 2, 0, fffff80002b7a50b}
Probably caused by : memory_corruption ( nt!MiStoreSetEvictPageFile+b )
BUGCHECK_STR:  0xA
PROCESS_NAME:  SearchProtocol
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨[/font]

 

[tony22]

Okay Jonathan. But did you find anything at all from yesterday?

BTW, ran memtest86+ for 5 passes. No problems. Just finished running linpack at max memory, 64 bit, 2 threads, 10 passes. Both came up spotless.

Ran Prime 95 Blend last night, overnight. It was still running when I got up this morning with no errors.

I know these utilities should run longer for better certainty, but if I can't get one peep out of the three of them put together that's gotta mean something.

I'm still scared because real BSODs (at least in the old days) were usually signs of hardware trouble.

 

[tony22]

So I risked it and did a video rendering last night. Came through fine.

I wonder if the BSOD I had on the 13th was caused in part by the significant increase in video rendering that I've been doing. I rarely reboot my system; it runs 24/7 and sometimes doesn't get restarted for weeks at a time. Over the last few weeks I've often been doing one video job a night. I use Vegas Pro. Maybe there was just a lot of debris left over that caused this BSOD?

I looked through a few of those files in the Zip package and could not find anything dated 9-13 at around 1900 hours, which was when it happened. So I wonder where those two files (or at least the two paths that I saw that suggested there were two files)?

 

[Jonathan_King]

Well I'll be honest, I wasn't paying attention to the dates.

One is dated December 2009, the other August 2010. Forget my last post.

Digging through event logs, I found these corresponding items:

Event[181]:
  Log Name: Application
  Source: Windows Error Reporting
  Date: 2010-09-13T19:06:35.000
  Event ID: 1001
  Task: N/A
  Level: Information
  Opcode: Info
  Keyword: Classic
  User: N/A
  User Name: N/A
  Computer: WINTONY
  Description: 
Fault bucket X64_0xA_nt!MiResolveProtoPteFault+6a, type 0
Event Name: BlueScreen
Response: Not available
Cab Id: 0

Problem signature:
P1: 
P2: 
P3: 
P4: 
P5: 
P6: 
P7: 
P8: 
P9: 
P10: 

Attached files:
C:\Windows\Minidump\091310-25343-01.dmp
C:\Users\tony\AppData\Local\Temp\WER-32562-0.sysdata.xml
C:\Users\tony\AppData\Local\Temp\WER79BF.tmp.WERInternalMetadata.xml

These files may be available here:
C:\ProgramData\Microsoft\Windows\WER\ReportArchive\Kernel_0_0_cab_09ed8a0b

Analysis symbol: X64_0xA_nt!MiResolveProtoPteFault+6a
Rechecking for solution: 0
Report Id: 091310-25343-01
Report Status: 0

That doesn't tell us much, unfortunately.

I would hope that this was a one-time event, not a real problem, but if you would like to look for driver issues, go ahead and enable driver verifier: http://www.sevenforums.com/tutorials/101379-driver-verifier-enable-disable.html

This will make your computer crash much more, until you disable it. Hopefully the dumps will be of use though.

 

[tony22]

7:06 PM - that's the one. Now I wonder why this 091310-25343-01.dmp wasn't in the minidump directory? If I can find any of this stuff you want me to post it?

 

[Jonathan_King]

My best guess is that a cleaning program got the file, after it was created. Are you using any optimization or cleaning programs, such as CCleaner, the Windows Disk Cleanup Tool, etc?

 

[tony22]

Normally yes, but after the reboot the only thing I did was a System Restore.

 

[tony22]

Attached files:
C:\Windows\Minidump\091310-25343-01.dmp
C:\Users\tony\AppData\Local\Temp\WER-32562-0.sysdata.xml
C:\Users\tony\AppData\Local\Temp\WER79BF.tmp.WERInternalMetadata.xml

These files may be available here:
C:\ProgramData\Microsoft\Windows\WER\ReportArchive\Kernel_0_0_cab_09ed8a0b

Well, none of the three indicated files were there! But there is a Report.wer in the ReportArchive. Here's what it says:

Version=1
EventType=BlueScreen
EventTime=129288927299658203
ReportType=4
Consent=1
UploadTime=129288927911699218
ReportIdentifier=64fb8c8f-bf8b-11df-9a13-005056c00008
IntegratorReportIdentifier=091310-25343-01
Response.type=4
Response.AnalysisBucket=X64_0xA_nt!MiResolveProtoPteFault+6a
DynamicSig[1].Name=OS Version
DynamicSig[1].Value=6.1.7600.2.0.0.256.1
DynamicSig[2].Name=Locale ID
DynamicSig[2].Value=1033
UI[2]=C:\Windows\system32\wer.dll
UI[3]=Windows has recovered from an unexpected shutdown
UI[4]=Windows can check online for a solution to the problem.
UI[5]=&Check for solution
UI[6]=&Check later
UI[7]=Cancel
UI[8]=Windows has recovered from an unexpected shutdown
UI[9]=A problem caused Windows to stop working correctly. Windows will notify you if a solution is available.
UI[10]=Close
Sec[0].Key=BCCode
Sec[0].Value=a
Sec[1].Key=BCP1
Sec[1].Value=0000007C5004A408
Sec[2].Key=BCP2
Sec[2].Value=0000000000000002
Sec[3].Key=BCP3
Sec[3].Value=0000000000000000
Sec[4].Key=BCP4
Sec[4].Value=FFFFF80002AB31EA
Sec[5].Key=OS Version
Sec[5].Value=6_1_7600
Sec[6].Key=Service Pack
Sec[6].Value=0_0
Sec[7].Key=Product
Sec[7].Value=256_1
State[0].Key=Transport.DoneStage1
State[0].Value=1
State[1].Key=CA
State[1].Value=1
State[2].Key=BLOB
State[2].Value=CHKSUM=317A479F7FF867ED888B997E122EB4FA;BID=OCATAG;ID=7a1480bd-36f4-44f0-ac0c-cbbcc4f39dd8;SUB=9//13//2010 4:06:35 PM
File[0].CabName=091310-25343-01.dmp
File[0].Path=091310-25343-01.dmp
File[0].Flags=851970
File[0].Type=2
File[0].Original.Path=C:\Windows\Minidump\091310-25343-01.dmp
File[1].CabName=sysdata.xml
File[1].Path=WER-32562-0.sysdata.xml
File[1].Flags=851970
File[1].Type=5
File[1].Original.Path=C:\Users\tony\AppData\Local\Temp\WER-32562-0.sysdata.xml
File[2].CabName=WERInternalMetadata.xml
File[2].Path=WER79BF.tmp.WERInternalMetadata.xml
File[2].Flags=589827
File[2].Type=5
File[2].Original.Path=C:\Users\tony\AppData\Local\Temp\WER79BF.tmp.WERInternalMetadata.xml
File[3].CabName=Report.cab
File[3].Path=Report.cab
File[3].Flags=196608
File[3].Type=7
File[3].Original.Path=Report.cab
FriendlyEventName=Shut down unexpectedly
ConsentKey=BlueScreen
AppName=Windows
AppPath=C:\Windows\System32\WerFault.exe

 

[Jonathan_King]

Try disabling any such programs for now.

If the BSODs persist, you may check for new dumps, or enable driver verifier, and hope the bucket IDs help.