Blue Screen History - Analyzing Screen Dumps

[TerminallyOdd]

I've been given the pleasure of having a laptop handed to me with nothing to go on but being informed that the user has been getting blue screens.

It'd be nice to be able to check those blue screens after they've happened, but as far as I know, all I can do is look at the dump files in the minidump folder, and pipe them to a text file using dumpchk.exe.

I've done that with one of them here, but I'm not sure where to go from here in determining what has been causing the problem:

----- 32 bit Kernel Mini Dump Analysis

DUMP_HEADER32:
MajorVersion 0000000f
MinorVersion 00000a28
DirectoryTableBase 00039000
PfnDataBase 81053000
PsLoadedModuleList 80543530
PsActiveProcessHead 80545578
MachineImageType 0000014c
NumberProcessors 00000001
BugCheckCode 0000007f
BugCheckParameter1 0000000d
BugCheckParameter2 00000000
BugCheckParameter3 00000000
BugCheckParameter4 00000000
PaeEnabled 00000000
KdDebuggerDataBlock 805353e0
MiniDumpFields 00000dff

TRIAGE_DUMP32:
ServicePackBuild 00000100
SizeOfDump 00010000
ValidOffset 0000fffc
ContextOffset 00000320
ExceptionOffset 000007d0
MmOffset 00001068
UnloadedDriversOffset 000010a0
PrcbOffset 00001878
ProcessOffset 000024c8
ThreadOffset 00002720
CallStackOffset 00002978
SizeOfCallStack 000005e8
DriverListOffset 000031f0
DriverCount 000000a0
StringPoolOffset 00006170
StringPoolSize 00001628
BrokenDriverOffset 00000000
TriageOptions 00000041
TopOfStack 80539218
DebuggerDataOffset 00002f60
DebuggerDataSize 00000290
DataBlocksOffset 00007798
DataBlocksCount 00000004


Windows XP Kernel Version 2600 (Service Pack 1) UP Free x86 compatible
Kernel base = 0x804d4000 PsLoadedModuleList = 0x80543530
Debug session time: Sun Jul 04 07:30:58 2004
System Uptime: 0 days 0:27:37
start end module name
804d4000 806aa280 nt Checksum: 001E311B Timestamp: Thu Apr 24 08:57:43 2003 (3EA80977)

Unloaded modules:
f7252000 f7290000 ar5211.sys Timestamp: unavailable (00000000)
ec0ef000 ec116000 kmixer.sys Timestamp: unavailable (00000000)
f7c84000 f7c85000 drmkaud.sys Timestamp: unavailable (00000000)
ec3c1000 ec3ce000 DMusic.sys Timestamp: unavailable (00000000)
ec691000 ec69f000 swmidi.sys Timestamp: unavailable (00000000)
ec116000 ec139000 aec.sys Timestamp: unavailable (00000000)
f7a74000 f7a76000 splitter.sys Timestamp: unavailable (00000000)
f7780000 f778a000 p3.sys Timestamp: unavailable (00000000)
f7938000 f793d000 Cdaudio.SYS Timestamp: unavailable (00000000)

Anything there that could help diagnose the problem? It's an IBM Thinkpad T40 (Pent. M 1.6 GHz, 768 MB RAM) with Windows XP. Thanks.

 

[Ryoga]

BugCheckCode 0000007f
BugCheckParameter1 0000000d
BugCheckParameter2 00000000
BugCheckParameter3 00000000
BugCheckParameter4 00000000

I'm assuming that means a Stop Code of 0x7F

Bug Check 0x7F: UNEXPECTED_KERNEL_MODE_TRAP
[...]
Parameter: 0x0000000D ? An exception not covered by some other exception; a protection fault that pertains to access violations for applications.
[...]
Cause: Bug check 0x7F usually occurs after the installation of faulty or mismatched hardware (especially memory) or in the event that installed hardware fails.

If you have recently upgraded the system memory, check the manufacturer of the new SO-DIMM. It may not be compatible with the existing module. Only reason I mention RAM is because that's the most common upgrade, and 768 MiB of RAM is a bit unusual. Typically you'll see 256, 512, and 1 GiB.

Also note that the crash seems to be related to application access violations. That's very odd, since hardly any applications have kernel mode execution. My spidey sense suggests the antivirus scanner may be to blame.

You also might do ye olde update ye drivers/BIOS.