Help reading minidump

I've got a new Intel build that is giving me multiple errors, including
the occasional BSOD. I want to read the dump file, but can't seem
to get it right (and I'm sure it's operator error). I downloaded and
installed
Windows Debugger program (Vista) and installed it. I downloaded the
Symbols files
(X64) and installed them in sequence through SP1. I pointed the Symbol
path to
C:\Windows\Symbols and then loaded the dump file. The text says I do not
have
the right Symbols loaded. I've reviewed different "how to" articles, and
can't
figure what I'm doing wrong. Help would be appreciated.

The event viewer shows multiple errors with the Yukon64 miniport driver.
I've gotten
some "video driver has failed and successfully recovered" messages.
Side by Side
application errors concerning the LCD software. Blue tooth errors (can't
read, says
file is bigger than supported).

The system is an Intel Q9550 on a ASUS Maximus II Formula motherboard w/
8 GB OCZ Reaper PC8500 RAM. GeForce GTX 280 video card. Four harddrives
(C:\System is 2 drives in RAID 0). Two optical drives, front panel LCD,
floppy.
Power supply and cooling are sufficient and good quality.

I have run Memtest86 for 6 hours with no errors. Re-installed OS.
Removed LCD
software. Installed Marvell Yukon Ethernet drivers from Marvell website
vs ASUS.
Updated BIOS. All MS updates installed. Disabled antivirus. Nothing has
worked.
I'm waiting on the arrival of an Intel 10/100/1000 ethernet PCI-e card,
at which time
I will disable the on board Marvell and see if that helps (numerous
forums say it will
fix at least some of the errors).

Thanks for your time.

Fitz
--
Your body is a temple boy,
You ought to treat it well
But you trash the place and rent it out
Like it's some cheap motel - The Badlees

Hi Fitz,

Change the symbols path to:

SRV*c:\symbols*http://msdl.microsoft.com/download/symbols

--
Best of Luck,

Rick Rogers, aka "Nutcase" - Microsoft MVP
http://mvp.support.microsoft.com/
Windows help - www.rickrogers.org
My thoughts http://rick-mvp.blogspot.com

"Fitz" <akfitz@gci.net> wrote in message
news:uYKdnf1G_OhERKjUnZ2dnUVZ_qfinZ2d@posted.gcico mmunications...
> I've got a new Intel build that is giving me multiple errors, including
> the occasional BSOD. I want to read the dump file, but can't seem
> to get it right (and I'm sure it's operator error). I downloaded and
> installed
> Windows Debugger program (Vista) and installed it. I downloaded the
> Symbols files
> (X64) and installed them in sequence through SP1. I pointed the Symbol
> path to
> C:\Windows\Symbols and then loaded the dump file. The text says I do not
> have
> the right Symbols loaded. I've reviewed different "how to" articles, and
> can't
> figure what I'm doing wrong. Help would be appreciated.
>
> The event viewer shows multiple errors with the Yukon64 miniport driver.
> I've gotten
> some "video driver has failed and successfully recovered" messages. Side
> by Side
> application errors concerning the LCD software. Blue tooth errors (can't
> read, says
> file is bigger than supported).
>
> The system is an Intel Q9550 on a ASUS Maximus II Formula motherboard w/
> 8 GB OCZ Reaper PC8500 RAM. GeForce GTX 280 video card. Four harddrives
> (C:\System is 2 drives in RAID 0). Two optical drives, front panel LCD,
> floppy.
> Power supply and cooling are sufficient and good quality.
>
> I have run Memtest86 for 6 hours with no errors. Re-installed OS. Removed
> LCD
> software. Installed Marvell Yukon Ethernet drivers from Marvell website vs
> ASUS.
> Updated BIOS. All MS updates installed. Disabled antivirus. Nothing has
> worked.
> I'm waiting on the arrival of an Intel 10/100/1000 ethernet PCI-e card, at
> which time
> I will disable the on board Marvell and see if that helps (numerous forums
> say it will
> fix at least some of the errors).
>
> Thanks for your time.
>
> Fitz
> --
> Your body is a temple boy,
> You ought to treat it well
> But you trash the place and rent it out
> Like it's some cheap motel - The Badlees

Rick Rogers wrote:
> Hi Fitz,
>
> Change the symbols path to:
>
> SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
>
Thanks- got the minidump to work. Unfortunately, I can't interpret
to file well enough to identify the problem. Is there a website that will
interpret the log file if I send it in?

Fitz

--
Your body is a temple boy,
You ought to treat it well
But you trash the place and rent it out
Like it's some cheap motel - The Badlees

Did you try the "!analyze -v" command?

Another thing you can do is enable driver verifier for the offending
driver - which may help the debugger better determine what is going on.

http://www.microsoft.com/whdc/DevToo...vVerifier.mspx

start --> run -->verifier.exe

+create custom settings (for code developers)
+select individual settings from a full list
+Select everything from the list, except low resource simulation
+Select driver names from a list
+Select Yukon64 driver - complete the wizard, and reboot the machine

When you submit an error report to Microsoft, this crash file is analyzed on
the back end and matched against any known issues. If the issue is known,
their will often be a response sent back to you with instructions on how to
solve your situation.

From what you have already written, it appears that you have already
narrowed it down to the Marvell driver - what is the specific hardwareIDs of
the device?

Start --> Run --> Devmgmt.msc --> device properties --> details tab -->
HardwareIDs


"Fitz" <akfitz@gci.net> wrote in message
news:2PadnRcFDaJcd6vUnZ2dnUVZ_gudnZ2d@posted.gcico mmunications...
> Rick Rogers wrote:
>> Hi Fitz,
>>
>> Change the symbols path to:
>>
>> SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
>>
> Thanks- got the minidump to work. Unfortunately, I can't interpret
> to file well enough to identify the problem. Is there a website that will
> interpret the log file if I send it in?
>
> Fitz
>
> --
> Your body is a temple boy,
> You ought to treat it well
> But you trash the place and rent it out
> Like it's some cheap motel - The Badlees

Timothy Davis [MSFT] wrote:
> Did you try the "!analyze -v" command?

Yes. I saved it to notepad. This isn't the entire text:

Use !analyze -v to get detailed debugging information.

BugCheck 24, {1904aa, fffffa6001b98768, fffffa6001b98140, fffff8000210a36b}

Probably caused by : Ntfs.sys ( Ntfs!NtfsDeleteScb+e6

DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT

PROCESS_NAME: System

CURRENT_IRQL: 0

ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx
referenced memory at 0x%08lx. The memory could not be %s.

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx
referenced memory at 0x%08lx. The memory could not be %s.

EXCEPTION_PARAMETER1: 0000000000000001

EXCEPTION_PARAMETER2: 0000001000023107

WRITE_ADDRESS: GetPointerFromAddress: unable to read from fffff80002075080
0000001000023107

FOLLOWUP_IP:
Ntfs!NtfsDeleteScb+e6
fffffa60`012bb936 488b03 mov rax,qword ptr [rbx]


> Another thing you can do is enable driver verifier for the offending
> driver - which may help the debugger better determine what is going on.

Did that- it loaded for about 2 sec and then BSOD. Said it was creating
dump file,
but it didn't go to the hard drive. Had to do a system restore from safe
mode to
get Windows to start again.
>

>
> From what you have already written, it appears that you have already
> narrowed it down to the Marvell driver - what is the specific
> hardwareIDs of the device?

PCI\VEN_11AB&DEV_4364&SUBSYS_81F81043&REV_12
PCI\VEN_11AB&DEV_4364&SUBSYS_81F81043
PCI\VEN_11AB&DEV_4364&CC_020000
PCI\VEN_11AB&DEV_4364&CC_0200

Thanks for the help,
Fitz

--
Your body is a temple boy,
You ought to treat it well
But you trash the place and rent it out
Like it's some cheap motel - The Badlees

Are you overclocking the machine? Have you tried underclocking it?

Memory tests don't always catch issues caused by heat buildup (since the
CPU/GPU/Drives aren't being used heavily)

Here is what I would try:

1: Backup anything of value from the machine - you are currently at high
risk of losing everything by running RAID 0
2: Check for firmware/driver update for your storage controller
3: If firmware doesn't help, stop using RAID 0. I have had very bad
experiences with RAID 0, even with high end hardware/software. When one of
your drives begins to fail (maybe a year or two from now), you will be a
very bad position to recover any data (assuming you are not constantly
backing up). If you are looking for outstanding performance, I would
suggest using something like a Western digital Velociraptor drive
(http://www.wdvelociraptor.com/), or if budget is no issue, then go get an
Intel solid state drive
(http://www.intel.com/design/flash/na...ream/index.htm).

Try rebuilding the machine without RAID - and see if that doesn't resolve
your issues.

From the debugging tools documentation for bugcheck 24:

************************************************** ******************************
The NTFS_FILE_SYSTEM bug check has a value of 0x00000024. This indicates a
problem occurred in ntfs.sys, the driver file that allows the system to read
and write to NTFS drives.

Parameters
The following parameters are displayed on the blue screen.

Parameter Description
1 Specifies source file and line number information. The high 16 bits (the
first four hexadecimal digits after the "0x") identify the source file by
its identifier number. The low 16 bits identify the source line in the file
where the bug check occurred.
2 If NtfsExceptionFilter is on the stack, this parameter specifies the
address of the exception record.
3 If NtfsExceptionFilter is on the stack, this parameter specifies the
address of the context record.
4 Reserved


Cause
One possible cause of this bug check is disk corruption. Corruption in the
NTFS file system or bad blocks (sectors) on the hard disk can induce this
error. Corrupted SCSI and IDE drivers can also adversely affect the system's
ability to read and write to disk, thus causing the error.

Another possible cause is depletion of nonpaged pool memory. If the nonpaged
pool memory is completely depleted, this error can stop the system. However,
during the indexing process, if the amount of available nonpaged pool memory
is very low, another kernel-mode driver requiring nonpaged pool memory can
also trigger this error.

Resolving the Problem
To debug this problem: Use the .cxr (Display Context Record) command with
Parameter 3, and then use kb (Display Stack Backtrace).

To resolve a disk corruption problem: Check Event Viewer for error messages
from SCSI and FASTFAT (System Log) or Autochk (Application Log) that might
help pinpoint the device or driver that is causing the error. Try disabling
any virus scanners, backup programs, or disk defragmenter tools that
continually monitor the system. You should also run hardware diagnostics
supplied by the system manufacturer. For details on these procedures, see
the owner's manual for your computer. Run Chkdsk /f /r to detect and resolve
any file system structural corruption. You must restart the system before
the disk scan begins on a system partition.

To resolve a nonpaged pool memory depletion problem: Either add new physical
memory to the computer (thus increasing the quantity of nonpaged pool memory
available to the kernel), or reduce the number of files on the Services for
Macintosh (SFM) volume.
************************************************** ******************************



"Fitz" <akfitz@gci.net> wrote in message
news:-Lidnd2QUMqTgarUnZ2dnUVZ_gCdnZ2d@posted.gcicommunic ations...
> Timothy Davis [MSFT] wrote:
>> Did you try the "!analyze -v" command?
>
> Yes. I saved it to notepad. This isn't the entire text:
>
> Use !analyze -v to get detailed debugging information.
>
> BugCheck 24, {1904aa, fffffa6001b98768, fffffa6001b98140,
> fffff8000210a36b}
>
> Probably caused by : Ntfs.sys ( Ntfs!NtfsDeleteScb+e6
>
> DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
>
> PROCESS_NAME: System
>
> CURRENT_IRQL: 0
>
> ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced
> memory at 0x%08lx. The memory could not be %s.
>
> EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx
> referenced memory at 0x%08lx. The memory could not be %s.
>
> EXCEPTION_PARAMETER1: 0000000000000001
>
> EXCEPTION_PARAMETER2: 0000001000023107
>
> WRITE_ADDRESS: GetPointerFromAddress: unable to read from fffff80002075080
> 0000001000023107
>
> FOLLOWUP_IP:
> Ntfs!NtfsDeleteScb+e6
> fffffa60`012bb936 488b03 mov rax,qword ptr [rbx]
>
>
>> Another thing you can do is enable driver verifier for the offending
>> driver - which may help the debugger better determine what is going on.
>
> Did that- it loaded for about 2 sec and then BSOD. Said it was creating
> dump file,
> but it didn't go to the hard drive. Had to do a system restore from safe
> mode to
> get Windows to start again.
>>
>
>>
>> From what you have already written, it appears that you have already
>> narrowed it down to the Marvell driver - what is the specific hardwareIDs
>> of the device?
>
> PCI\VEN_11AB&DEV_4364&SUBSYS_81F81043&REV_12
> PCI\VEN_11AB&DEV_4364&SUBSYS_81F81043
> PCI\VEN_11AB&DEV_4364&CC_020000
> PCI\VEN_11AB&DEV_4364&CC_0200
>
> Thanks for the help,
> Fitz
>
> --
> Your body is a temple boy,
> You ought to treat it well
> But you trash the place and rent it out
> Like it's some cheap motel - The Badlees

Timothy Davis [MSFT] wrote:
> Are you overclocking the machine? Have you tried underclocking it?
Yes, (stock runs at 2.83 GHz, OC'd to 3.0 GHz, from a Q9550 to a Q9650)-
however, one of the first things I did after seeing the problem was reset
everything to default values- no improvement. I then called OCZ and got
recommendations for memory settings and applied them.


> Memory tests don't always catch issues caused by heat buildup (since the
> CPU/GPU/Drives aren't being used heavily)

Processor is 20C idle, never over 25C. Northbridge 48C to 53C. Motherboard
40-42C. Max temps under 3DMark Vantage video/cpu test.
>
> Here is what I would try:
>
> 1: Backup anything of value from the machine - you are currently at
> high risk of losing everything by running RAID 0
> 2: Check for firmware/driver update for your storage controller
> 3: If firmware doesn't help, stop using RAID 0. I have had very bad
> experiences with RAID 0, even with high end hardware/software. When one
> of your drives begins to fail (maybe a year or two from now), you will
> be a very bad position to recover any data (assuming you are not
> constantly backing up). If you are looking for outstanding performance,
> I would suggest using something like a Western digital Velociraptor
> drive (http://www.wdvelociraptor.com/), or if budget is no issue, then
> go get an Intel solid state drive
> (http://www.intel.com/design/flash/na...ream/index.htm).
>
> Try rebuilding the machine without RAID - and see if that doesn't
> resolve your issues.
Price checking 300 GB Velociraptor. That would eliminate the RAID config and
give me more C:\System space (the current RAID uses 2 X 74GB Raptors)
>
> From the debugging tools documentation for bugcheck 24:
>
> ************************************************** ******************************
>
> The NTFS_FILE_SYSTEM bug check has a value of 0x00000024. This indicates
> a problem occurred in ntfs.sys, the driver file that allows the system
> to read and write to NTFS drives.
>
> Parameters
> The following parameters are displayed on the blue screen.
>
> Parameter Description
> 1 Specifies source file and line number information. The high 16 bits
> (the first four hexadecimal digits after the "0x") identify the source
> file by its identifier number. The low 16 bits identify the source line
> in the file where the bug check occurred.
> 2 If NtfsExceptionFilter is on the stack, this parameter specifies the
> address of the exception record.
> 3 If NtfsExceptionFilter is on the stack, this parameter specifies the
> address of the context record.
> 4 Reserved
>
>
> Cause
> One possible cause of this bug check is disk corruption. Corruption in
> the NTFS file system or bad blocks (sectors) on the hard disk can induce
> this error. Corrupted SCSI and IDE drivers can also adversely affect the
> system's ability to read and write to disk, thus causing the error.

WD Diagnostic Tool for Windows doesn't have a Vista 64 compatible download.
The CD and floppy versions say "Vista" without specifying 32 or 64 bit.
I tried the
CD version, but couldn't get it to execute- said no drives found
(possibly due to
RAID?)
>
> Another possible cause is depletion of nonpaged pool memory. If the
> nonpaged pool memory is completely depleted, this error can stop the
> system. However, during the indexing process, if the amount of available
> nonpaged pool memory is very low, another kernel-mode driver requiring
> nonpaged pool memory can also trigger this error.

LCD software monitors physical memory usage- never seen it over 40% even
when playing games. Windows virtual memory settings are at default and
managed by Windows.
>
> Resolving the Problem
> To debug this problem: Use the .cxr (Display Context Record) command
> with Parameter 3, and then use kb (Display Stack Backtrace).
>
> To resolve a disk corruption problem: Check Event Viewer for error
> messages from SCSI and FASTFAT (System Log) or Autochk (Application Log)
> that might help pinpoint the device or driver that is causing the error.
> Try disabling any virus scanners, backup programs, or disk defragmenter
> tools that continually monitor the system. You should also run hardware
> diagnostics supplied by the system manufacturer. For details on these
> procedures, see the owner's manual for your computer. Run Chkdsk /f /r
> to detect and resolve any file system structural corruption. You must
> restart the system before the disk scan begins on a system partition.

I"ll do all of these. Before I spend the money replacing the hard
drives, I'd like
to be confident it will resolve the issue. Just to eliminate
possibilities, I RMA'd
the motherboard and should be getting a replacement in a couple days (cross
shipped so I still have the original). The new NIC doesn't seem to have
resolved
the issue.
>
> To resolve a nonpaged pool memory depletion problem: Either add new
> physical memory to the computer (thus increasing the quantity of
> nonpaged pool memory available to the kernel), or reduce the number of
> files on the Services for Macintosh (SFM) volume.

Thanks for your response- I appreciate the help

Fitz

> WD Diagnostic Tool for Windows doesn't have a Vista 64 compatible
> download.
> The CD and floppy versions say "Vista" without specifying 32 or 64 bit. I
> tried the
> CD version, but couldn't get it to execute- said no drives found (possibly
> due to
> RAID?)

This is most likely caused by RAID hiding the real disks behind the
operations. Unless Western digital needs direct disk access through a
kernel mode driver, there is no need for the tool to be x64 aware (x86
version of the software would use standard Windows APIs to do the disk
check, and so would not need to be compiled to 64 bit.)

> I"ll do all of these. Before I spend the money replacing the hard drives,
> I'd like
> to be confident it will resolve the issue. Just to eliminate
> possibilities, I RMA'd
> the motherboard and should be getting a replacement in a couple days
> (cross
> shipped so I still have the original). The new NIC doesn't seem to have
> resolved
> the issue.

I doubt the issue is with the NIC. It really sounds like the drives/storage
controllers having issues. Again, you can try updated firmware/drivers, but
at some point, it WILL come to bite you in the ass. Back up your data early
and often.

A coworker of mine (who is a driver developer, and far smarter than myself)
had his RAID 0 volume go TU on him. He was actually able to use disk
editing software to determine that all the data was intact, it was simply an
issue where one byte of data linking the two drives to the volume had been
corrupted. Editing this value back to what is should have been restored the
RAID 0 volume.

I want to emphasize two things here: First, is that he would have had to
spend hundreds or thousands of dollars to have a professional data recovery
company do the same recovery. Second: You can pretty much be sure that
your motherboard manufacturer didn't ship with the most expensive RAID
controller available. In fact, they probably went for one of the least
expensive.

Best of luck with your system!

Timothy Davis [MSFT] wrote:

>
> I want to emphasize two things here: First, is that he would have had
> to spend hundreds or thousands of dollars to have a professional data
> recovery company do the same recovery. Second: You can pretty much be
> sure that your motherboard manufacturer didn't ship with the most
> expensive RAID controller available. In fact, they probably went for
> one of the least expensive.
>
> Best of luck with your system!

Yeah, I think a single Velociraptor for the system drive is in order.
I've been
running this RAID config for 3 builds now (having replaced one of the hard
drives in the process). After reading reviews on the Velociraptor, it's
hard to
pass up- good performance while simplifying the system and increasing
reliability. If after replacing the motherboard, hard drive(s) and NIC,
if I'm
still having the same problem, the components can always be used as skeet
targets.

Thanks again,
Fitz


--
Your body is a temple boy,
You ought to treat it well
But you trash the place and rent it out
Like it's some cheap motel - The Badlees