Need help with analysis of memory.dmp from BSOD

Roondog · Nov 9, 2009

Hi, I've got an XP SP3 system that experiences a BSOD about once per day. I used windows debugger to analyse the crash dump and got the following anlysis:

PROCESS_OBJECT: 8933cae0

IMAGE_NAME: winsrv.dll

DEBUG_FLR_IMAGE_TIMESTAMP: 4802a128

FAULTING_MODULE: 4a680000 csrss

PROCESS_NAME: csrss.exe

EXCEPTION_RECORD: a278f9d8 -- (.exr 0xffffffffa278f9d8)
ExceptionAddress: 75b900d1 (winsrv!strstr)
ExceptionCode: c0000006 (In-page I/O error)
ExceptionFlags: 00000000
NumberParameters: 3
Parameter[0]: 00000008
Parameter[1]: 75b900d1
Parameter[2]: c0000056
Inpage operation failed at 75b900d1, due to I/O error c0000056

EXCEPTION_CODE: (NTSTATUS) 0xc0000006 - The instruction at "0x%08lx" referenced memory at "0x%08lx". The required data was not placed into memory because of an I/O error status of "0x%08lx".

DEFAULT_BUCKET_ID: DRIVER_FAULT

ERROR_CODE: (NTSTATUS) 0xc0000006 - The instruction at "0x%08lx" referenced memory at "0x%08lx". The required data was not placed into memory because of an I/O error status of "0x%08lx".

EXCEPTION_PARAMETER1: 00000008

EXCEPTION_PARAMETER2: 75b900d1

EXCEPTION_PARAMETER3: c0000056

IO_ERROR: (NTSTATUS) 0xc0000056 - A non close operation has been requested of a file object with a delete pending.

EXCEPTION_STR: 0xc0000006_c0000056

FAULTING_IP:
winsrv!strstr+0
75b900d1 ?? ???

BUGCHECK_STR: 0xF4_IOERR_C0000056

FOLLOWUP_IP:
winsrv!strstr+0
75b900d1 ?? ???

SYMBOL_NAME: winsrv!strstr+0

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: winsrv

STACK_COMMAND: kb

FAILURE_BUCKET_ID: 0xF4_IOERR_C0000056_winsrv!strstr+0

BUCKET_ID: 0xF4_IOERR_C0000056_winsrv!strstr+0

Followup: MachineOwner

I'm guessing that this is indicative of a hardware problem, but I'm not terribly familiar with these debug files so it could be anything. I'd appreciate any help pointing me in a direction to try and narrow down the problem. Thanks.

DavidGP · Nov 9, 2009

Hi

Could be a number of things from faulting Windows file, Malware or Memory errors and to help narrow it down a little for you and us, could you do the below steps, these are no means exhaustive but ones that spring to mind at present.

1. Please post the actual BSOD code and text in full as it can help narrow down the cause, a bugreport in the main only gives the faulting file, but not the why?

2. Boot into Safe Mode (F8 at boot) and does your PC work ok?

3. Run a Ram Memory test to see if you have failing ram, test only one ram stick at a time, Memtest86+ is good but you will need to burn the ISO to CD and use this free application to do this.

4. Run some malware tests and here is great guide, if any malware is found then do start a new thread in the malware area of the forum and attach the logs requested the steps are in the guide.

Roondog · Nov 10, 2009

Thanks for the help. I recently discovered that one of the hard drives in my RAID 1 array was bad. I replaced it yesterday and I haven't had a BSOD since. I'll post back here with more information if the problem continues.

Log in or Sign up

Need help with analysis of memory.dmp from BSOD

Roondog Private E-2

DavidGP MajorGeeks Forum Administrator - Grand Pooh-Bah Staff Member

Roondog Private E-2