Windows Debug crash dump analysis.

Good Afternoon,

I am a new member here and i hope i could help others as much as i can.
The following crash dump is from one of the local clients in my domain. I am new into analyzing crush dumps and i think i need help figuring out the following results, Thanks so much and have a good holiday!

I have tested the memory modules with a memory test tool and found errors in one of the modules and i just wanted to check the log above to determine whether my problem is memory related or something else that i might be missing.

Thanks so much in advance!

Sincerely

Hans





*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 00000004, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000000, bitfield :
bit 0 : value 0 = read operation, 1 = write operation
bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: 804e7ebd, address which referenced memory

Debugging Details:
------------------




READ_ADDRESS: 00000004

CURRENT_IRQL: 2

FAULTING_IP:
nt!MiRemovePageByColor+6a
804e7ebd 8b4804 mov ecx,dword ptr [eax+4]

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: INTEL_CPU_MICROCODE_ZERO

BUGCHECK_STR: 0xA

PROCESS_NAME: iexplore.exe

TRAP_FRAME: f6ed67b0 -- (.trap 0xfffffffff6ed67b0)
ErrCode = 00000002
eax=00000000 ebx=00013c6c ecx=0000331b edx=e2eb4000 esi=00013c6c edi=e2ebb000
eip=bf80fbdb esp=f6ed6824 ebp=f6ed682c iopl=0 nv up ei pl zr na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010246
win32k!PALLOCMEM+0x2c:
bf80fbdb f3ab rep stos dword ptr es:[edi] es:0023:e2ebb000=????????
Resetting default scope

LAST_CONTROL_TRANSFER: from 804ea839 to 804e7ebd

STACK_TEXT:
f6ed66bc 804ea839 c038baec 00000000 00000001 nt!MiRemovePageByColor+0x6a
f6ed66d4 804e8f8b e2ebb000 c038baec 00000000 nt!MiResolveDemandZeroFault+0xd9
f6ed6744 804e9dd9 00000001 e2ebb000 c038baec nt!MiDispatchFault+0x129
f6ed6798 804e0944 00000001 e2ebb000 00000000 nt!MmAccessFault+0x642
f6ed6798 bf80fbdb 00000001 e2ebb000 00000000 nt!KiTrap0E+0xd0
f6ed682c bf805b12 00013c6c 35306847 f6ed68c0 win32k!PALLOCMEM+0x2c
f6ed6848 bf80964f 00013c6c 00000005 00000001 win32k!AllocateObject+0x9a
f6ed6890 bf84bc23 00000a88 00000000 00000000 win32k!SURFMEM::bCreateDIB+0x1d4
f6ed68f8 bf84bafc e10e02a8 00000000 00000000 win32k!hbmCreateClone+0x79
f6ed6920 804dd99f 2e050634 00000000 00000000 win32k!GreCreatePatternBrushInternal+0x3a
f6ed6920 7c90eb94 2e050634 00000000 00000000 nt!KiFastCallEntry+0xfc
WARNING: Frame IP not in any known module. Following frames may be wrong.
0012dd54 00000000 00000000 00000000 00000000 0x7c90eb94


STACK_COMMAND: kb

FOLLOWUP_IP:
win32k!PALLOCMEM+2c
bf80fbdb f3ab rep stos dword ptr es:[edi]

SYMBOL_STACK_INDEX: 5

SYMBOL_NAME: win32k!PALLOCMEM+2c

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: win32k

IMAGE_NAME: win32k.sys

DEBUG_FLR_IMAGE_TIMESTAMP: 45f013f6

FAILURE_BUCKET_ID: 0xA_win32k!PALLOCMEM+2c

BUCKET_ID: 0xA_win32k!PALLOCMEM+2c

Followup: MachineOwner
---------

1: kd> .trap 0xfffffffff6ed67b0
ErrCode = 00000002
eax=00000000 ebx=00013c6c ecx=0000331b edx=e2eb4000 esi=00013c6c edi=e2ebb000
eip=bf80fbdb esp=f6ed6824 ebp=f6ed682c iopl=0 nv up ei pl zr na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010246
win32k!PALLOCMEM+0x2c:
bf80fbdb f3ab rep stos dword ptr es:[edi] es:0023:e2ebb000=????????

 

Memory testers are very good if they find errors. Your debug log also has a strong indicator of a RAM problem.

FAULTING_IP:
nt!MiRemovePageByColor+6a <-- Strong indicator of faulty RAM.

 

Hi, gohans. Welcome to Windows BBS!

NOTE:

If you replaced the faulty memory module(s) and the BSODs continue to occur, then please do the following.

Please carefully follow all the instructions in this link and then paste DebugWiz-generated BSOD dump log analysis reports for a few of your most recent crashes in this thread.

Sometimes seeing a few dump logs helps us determine whether there is any pattern to the crashes or not. The additional information the DebugWiz-generated reports provide might help us narrow down the culprit more quickly.

The DebugWiz application should be run while connected to the Internet so your Debugging Tools can retrieve the proper "symbols ".

==========

You might also benefit by reading this 4-page article, Network World: "How to solve Windows system crashes in minutes" (specifically the last paragraph of page 3 and all of page 4). DebugWiz takes care of most of the instructions on the first 3 pages of that article.

==========

EDIT: BTW, peterdiva is one of the experts references in PeteC's note I quoted above.

 

Hello, thanks so much for your time, after replacing the memory modules looks like the random reboots stopped. Mailman and Peterdiva thanks so much for your assistance. I saved all the information you provided me for future references.

Again thanks so much and take care!!!

 

You're welcome, gohans.

Thanks for your follow-up too! I'm glad your issue seems to be resolved.