BSOD Posting instructions question & my problem(s)

[schatham]

Before proceeding, make a full, updated antivirus scan
Download and make a full scan with malwarebytes. Make sure that they are upadated and make sure you do the full scan.

I kicked off the Malwarebytes FULL scan this morning. Will run Virus scan later on (Avast).

I did one other thing this morning as well. I ran the verifier, and went through and disabled the Disk Integrity check. Maybe that will keep it from BSOD-ing while this stuff runs. I think that that check was only for Server 03, XP and Vista & was removed for Windows 7.

There was also something else I noticed about the 2-3 most recent BSOD's I got. When I ran a dumpcheck tool (WhoCrashed), when I ran it this morning after the most recent BSOD, I noticed that when it analyzed the dump files, that it saw it's most recent Dump & Minidump files were from 3-4 days ago. I know it's BSOD'd every day this week, but it recorded only ones from 3 days ago as the most recent (they were on crcdisk.sys). I will be willing to bet that the info I posted did not reflect ALL the BSOD's it is throwing. The BSOD's are always the same. Any idea about this?

Thanks again for all your help.

 

[richc46]

Dont know why you would not have reports. You can locate the files, yourself, however, if any
The C:\Windows\Minidump folder Or, the dumps may be stored in the file C:\Window\memory.dmp.

There are many reasons that a memory dump may not be captured. To start with, go to Start and type in SYSDM.CPL and press Enter.
Then click on the Advanced tab, then on the Startup and Recovery Settings button.
In the next window there'll be a "Write debugging information" section - what does it say there?

 

[schatham]

Dont know why you would not have reports. You can locate the files, yourself, however, if any
The C:\Windows\Minidump folder Or, the dumps may be stored in the file C:\Window\memory.dmp.

There are many reasons that a memory dump may not be captured. To start with, go to Start and type in SYSDM.CPL and press Enter.
Then click on the Advanced tab, then on the Startup and Recovery Settings button.
In the next window there'll be a "Write debugging information" section - what does it say there?

It was BSOD'd when I got back later today & I checked the C:\Windows\Minidump folder and the latest file was on 1/8/12, not the one from today (which BTW was a DRIVER_IRQL_NOT_LESS_OR_EQUAL with NetIO.sys) that was waiting for me.

To answer your question from above, Kernel Memory Dump is the value in the Write Debugging information section.

 

[richc46]

It seems, then that you are getting BSODs caused by several drivers. Netio, usually means the network driver. When you get many different reports the problem may be hardware; test your memory.
http://www.geekstogo.com/forum/topic/246994-guide-to-using-memtest86/
If you are using Zone alarm, uninstall and use the Windows firewall

 

[schatham]

I did notice a couple things in the dump - 2 drivers have in the past caused problems.

One was igkmd32.sys (the MB has an on-board graphics card that would flicker on my monitor, and it would keep overlaying the standard vga driver with this one).
Also it found avgidsshim.sys - I had previously used AVG, which I know doesn't clean up after itself very well. I did run the tool off their site to remove it.

Do not have Zonealarm on the system.

I had run memtest previously, and will reboot & run it again for a couple hours or so. Earlier it reported no errors.

 

[richc46]

Mem test must be run for 8 passes and and then with a good ram, test each slot for 4 passes

 

[schatham]

Mem test must be run for 8 passes and and then with a good ram, test each slot for 4 passes

I ran the memory tests yesterday - all memory tests passed without an error.

I've not rebooted since I ran the AVG removal tool, so I don't know if that had any impact on BSOD's.

Any idea why a minidump isn't getting written when I get a BSOD?

In looking at the data I sent on 1/9, when I had a BSOD on a reboot before I ran the tools, I looked at the kernel dump file, and it has the same date time stamp as the minidump file. That BSOD didn't write to either apparently. And, since then, even though it's BSOD'd every day, the last minidump file there is still the one created on 1/8 - not one has been created since then, although the MEMORY.DMP file date time stamp has changed since then.

 

[richc46]

See last post by USAMSA
http://www.vistax64.com/general-discussion/231972-no-minidump-file-located.html

 

[schatham]

There are many different reasons for not having memory dumps:
- Crash reporting not setup correctly.
- Disabled services
- Pagefile too small
- crash happens before the crash reporting mechanism has loaded.
- crash occurs below the level that Windows is able to recognize.
- other stuff (read the Windows Internals books for more info)


My Write Debugging Information section has Kernel Memory Dump as the value.

What crash reporting settings should I have?
Are there any services that I should look for to enable?

...in other words - how should I have Vista set up to accurately report crashes?

 

[richc46]

Change it to minidump

 

[schatham]

Made the change to minidump in the crash settings, and the system ran fine for 3-4 days.

When I got home earlier today though, it was sitting on a blue screen. Best I can figure, from the event log was that it occurred at 3:21 p.m. and was unexpected. However, nothing in the minidump folder (last one created on 1/8/2012), or in MEMORY.DMP (last updated on 1/9/2012).

The stop code on today's BSOD was: 0x0000008E and it also had in parenthesis these as well:
0x000000D5
0xFCA6E8D8
0xDD1F2BCC

Without the crash giving some useful, updated info in the appropriate places, or being able to do something in particular that will make it crash, it's hard to figure out what is actually going on.

Any ideas?

 

[richc46]

To start try, to upload the reports to us.

 

[schatham]

The only thing I can find is in the Event Viewer, under Custom Views/Administrative Events. There's a single entry there when I restarted the computer, that gives any inkling as to when the system BSOD'd.

Log Name:      System
Source:        EventLog
Date:          1/17/2012 5:58:33 PM
Event ID:      6008
Task Category: None
Level:         Error
Keywords:      Classic
User:          N/A
Computer:      Chatham-PC
Description:
The previous system shutdown at 3:21:34 PM on 1/17/2012 was unexpected.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="EventLog" />
    <EventID Qualifiers="32768">6008</EventID>
    <Level>2</Level>
    <Task>0</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2012-01-17T22:58:33.000Z" />
    <EventRecordID>377140</EventRecordID>
    <Channel>System</Channel>
    <Computer>Chatham-PC</Computer>
    <Security />
  </System>
  <EventData>
    <Data>3:21:34 PM</Data>
    <Data>1/17/2012</Data>
    <Data>
    </Data>
    <Data>
    </Data>
    <Data>278764</Data>
    <Data>
    </Data>
    <Data>
    </Data>
    <Binary>DC070100020011000F0015002200CC03DC07010002001100140015002200CC03600900003C000000010000006009000000000000B0040000010000003D000000</Binary>
  </EventData>
</Event>

Outside of that, I don't see anything in the dump files (they're still 1/8 & 1/9 for the mini & memory dump files respectively). Or anywhere else in the event log.

 

[schatham]

Got another crash this morning, showing to be in win32k.sys at addr 9F70BC79.

Checked both minidump & memory.dmp files, last entries/updates for those are 1/8 & 1/9 respectively. I know it was bluescreening, but neither is getting recorded.

 

[schatham]

Still getting some BSOD's about every other day.

2 days ago, it was in Win32K.sys.

Earlier today, it BSOD'd with this info:

0x000000D1

TCPIP.SYS
Address: 86091F14
Base at: 8600F000
DateStamp: 4e789d64

Checked in Minidump folder and in C:\Windows folder for dump files. Minidump folder's last dmp file was written on 1/8 (12 days ago); MEMORY.DMP was written on 1/9 (11 days ago). I've done searches on the drive looking for *.DMP files, and the C:\Windows\Minidump folder & the C:\Windows folders are the only ones that have those files in them.

Not sure what I can capture/send to evaluate.

 

[richc46]

You are sending conflicting information, although not your fault. Those reports often give different reasons for the BSOD. An analysis of the acutal report is necessary to try and determine the true cause.

 

[schatham]

You are sending conflicting information, although not your fault. Those reports often give different reasons for the BSOD. An analysis of the acutal report is necessary to try and determine the true cause.

I understand that the info is conflicting, I am just reporting what's happening.

The files I uploaded to this thread a week ago would be the same ones I would be uploading today - any BSOD I've gotten has not written to either the minidump or the MEMORY.DMP file (I've made the changes suggested to create a minidump file, but it hasn't created one since 1/8).

Since it's apparently not creating a dump on a BSOD, what other report can I supply that would be pertinent?

 

[richc46]

Are you set up like post number 8 here:
http://www.vistax64.com/crashes-deb...it-freezing-multiple-symtoms.html#post1307181

 

[schatham]

Mine has one small difference - the Automatically Restart is NOT selected.

However, under System Failure Write an event to the system log is checked.
Write Debugging information: Small memory dump (64KB)
Small dump directory: %SystemRoot%\Minidump

The Overwrite any existing file is checked, but it is greyed out & not editable.

 

[schatham]

My system has continued to BSOD on me, a couple times over the last several days. The most recent handful of times has been on TCPIP.SYS.

Based on that, I went to the ASUS website & found they had updated LAN & USB drivers, in addition to revising the BIOS twice since last May (not a good sign). The MB is an ASUS P8H67M-LE, with an after market video card in it.

Not having much else to lose, I went ahead & flashed the BIOS on this system, as well as updated the two sets of drivers for it. The latest BIOS update the #1 reason for it was to "Improve system stability". (FYI, it's had 5 BIOS updates since 3/1/2011).

I'm waiting for it to BSOD on me again & will continue to collect info on it.

Still having the problem of getting a BSOD and NO dump files anywhere I can find. Best I can tell, I have my system set up to properly record the dump, it's just not doing it.

I have seen some info on the pagefile size that may have something to do with it. Right now, the C: drive is system managed, but the remaining hard drives in this system have NO pagefile on them. FWIW, the system has 4GB memory, and the pagefile size was 3396MB (I think). That number may not be exactly right, but I thought that the two numbers should be about the same. Running Windows Vista Ultimate 32 bit.