bugcheck was: 0x00000050 from BSOD on Win 7 32-bit
I have a Dell Inspiron 1420 laptop here (customers laptop) that keeps blue screening - probably every other day, at least once or twice.
Checking event view, I see this:
Log Name: System
Source: Microsoft-Windows-WER-SystemErrorReporting
Date: 12/31/2010 10:45:16 AM
Event ID: 1001
Task Category: None
Level: Error
Keywords: Classic
User: N/A
Computer: LAWYERBIRD-PC
Description:
The computer has rebooted from a bugcheck. The bugcheck was: 0x00000050 (0xfe7c0f60, 0x00000001, 0x82b7237d, 0x00000000). A dump was saved in: C:\Windows\MEMORY.DMP. Report Id: 123110-23836-01.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event ">
<System>
<Provider Name="Microsoft-Windows-WER-SystemErrorReporting" Guid="{ABCE23E7-DE45-4366-8631-84FA6C525952}" EventSourceName="BugCheck" />
<EventID Qualifiers="16384">1001</EventID>
<Version>0</Version>
<Level>2</Level>
<Task>0</Task>
<Opcode>0</Opcode>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime="2010-12-31T18:45:16.000000000Z" />
<EventRecordID>34986</EventRecordID>
<Correlation />
<Execution ProcessID="0" ThreadID="0" />
<Channel>System</Channel>
<Computer>Mine</Computer>
<Security />
</System>
<EventData>
<Data Name="param1">0x00000050 (0xfe7c0f60, 0x00000001, 0x82b7237d, 0x00000000)</Data>
<Data Name="param2">C:\Windows\MEMORY.DMP</Data>
<Data Name="param3">123110-23836-01</Data>
</EventData>
</Event>
After loading up the dmp file in my WinDbg (provided I setup the symbols correctly), here is the dump analysis:
! analyze -v
*******************************************************************************
*
*
* Bugcheck Analysis
*
*
*
*******************************************************************************
PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced. This cannot be protected by try-except,
it must be protected by a Probe. Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: fe7c0f60, memory referenced.
Arg2: 00000001, value 0 = read operation, 1 = write operation.
Arg3: 82b7237d, If non-zero, the instruction address which referenced the bad memory
address.
Arg4: 00000000, (reserved)
Debugging Details:
------------------
WRITE_ADDRESS: fe7c0f60 Paged session pool
FAULTING_IP:
nt!ExAllocatePoolWithTag+7cc
82b7237d 891a mov dword ptr [edx],ebx
MM_INTERNAL_CODE: 0
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
BUGCHECK_STR: 0x50
PROCESS_NAME: iexplore.exe
CURRENT_IRQL: 0
TRAP_FRAME: 94894b94 -- (.trap 0xffffffff94894b94)
ErrCode = 00000002
eax=8ce43fe0 ebx=ff476f60 ecx=8ce43e00 edx=fe7c0f60 esi=ff476000 edi=000001ff
eip=82b7237d esp=94894c08 ebp=94894c54 iopl=0 nv up ei ng nz ac pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010296
nt!ExAllocatePoolWithTag+0x7cc:
82b7237d 891a mov dword ptr [edx],ebx ds:0023:fe7c0f60=????????
Resetting default scope
LAST_CONTROL_TRANSFER: from 82a98638 to 82ad7903
STACK_TEXT:
94894b7c 82a98638 00000001 fe7c0f60 00000000 nt!MmAccessFault+0x106
94894b7c 82b7237d 00000001 fe7c0f60 00000000 nt!KiTrap0E+0xdc
94894c54 974d8f4a 00000021 00000f50 6c777355 nt!ExAllocatePoolWithTag+0x7cc
94894ca0 974ccba6 ffb33008 00000000 00000000 win32k!InternalRebuildHwndListForIMEClass+0x25
94894cb4 974cef8c 00000000 0000000b 00000000 win32k!BuildHwndList+0x82
94894d10 82a9544a 00000000 00010a4e 00000001 win32k!NtUserBuildHwndList+0x118
94894d10 778364f4 00000000 00010a4e 00000001 nt!KiFastCallEntry+0x12a
WARNING: Frame IP not in any known module. Following frames may be wrong.
0245d5a0 00000000 00000000 00000000 00000000 0x778364f4
STACK_COMMAND: kb
FOLLOWUP_IP:
win32k!InternalRebuildHwndListForIMEClass+25
974d8f4a 8bc8 mov ecx,eax
SYMBOL_STACK_INDEX: 3
SYMBOL_NAME: win32k!InternalRebuildHwndListForIMEClass+25
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: win32k
IMAGE_NAME: win32k.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 4cbe5b31
FAILURE_BUCKET_ID: 0x50_win32k!InternalRebuildHwndListForIMEClass+25
BUCKET_ID: 0x50_win32k!InternalRebuildHwndListForIMEClass+25
Followup: MachineOwner
---------
Can anyone decipher what the dump log says? I can't seem to figure out that mumbo-jumbo. I see DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT which might lead me to understand a driver is causing all this - but what drive, I'd have no idea.
I see PROCESS_NAME: iexplore.exe, but I don't see how IE could be causing such a huge blue screen crash. If anyone wants the entire 350mb dmp file, i can upload it somewhere.
Thanks in advance.
January 1st, 2011 10:01pm
update the graphic card driver and check the RAM with memtest86+. If the RAm is fine and you still get crashes, zip the dump in 50MB parts and upload the parts to your public SkyDrive folder [1] and post a link here.
http://social.technet.microsoft.com/Forums/en-US/w7itproui/thread/4fc10639-02db-4665-993a-08d865088d65
"A programmer is just a tool which converts caffeine into code" CLIP- Stellvertreter http://www.winvistaside.de/
Free Windows Admin Tool Kit Click here and download it now
January 2nd, 2011 9:01am
Additionally, it should be noted that the 1420 is one of the models Dell does not recommend installation of Windows 7 on nor supports it with Windows 7 compatible hardware drivers and utilities:
http://support.dell.com/support/topics/global.aspx/support/kcs/document?c=us&l=en&s=gen&docid=DSN_364750&isLegacy=true Part of the reason Dell does not recommend Win 7 on the 1420 is some of the DVD drives used then have proven to be
non-compatible with Windows 7.Please remember to click Mark as Answer on the post that helps you, and to click Unmark as Answer if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.
January 2nd, 2011 9:38am