Windows 2k "Dumping Physical Memory"??? (W2K)

[phil_l875]

I am currently experiencing problems with my laptop dumping its physical memory. The laptop is fairly new and the menufacturers have told me to sod off even tough the computer is still under warranty. If anyone has come accross this problem could they please let me have any info about is as I ave taken the computer to a local computer company where no problems could be found - which is very confusing. Thanks, Phil

[Paul S]

What does it say on the screen when the dump of physcial memory starts?

<font color=green>Paul</font color=green>

[phil_l875]

I get a completely blue screen and then white text appears in the top left of the screen and then the text "Beginning dunp of physical memory" is displayed. Then the computer restarts and usually crashes on startup after restarting

[gavsta]

If you have the Win2k Professional CD you may be able to repair your installation. This can be a very risky process and may result in loss of data or software configuration.

In order to use the repair option you will need to Boot from the Win2k CD. You then choose to repair your installation. From here I would simply choose for an automated repair. This will then check the registry, start environment and system files.

You will then need to reboot. Hopefully this will return your machine to a state where it is usuable.

If this fails your only other avenue is to try the recovery console. Which can be a very daunting process.

Lets hope the repair option works.

Gav.

[Pdawg_Dba]

What are the letters and numbers on this screen? Does it say Nonpaged Error, something like that? Did you recently install any new drivers for hardware or any new software?

Patrick Middleton, MCSE/MCDBA

[phil_l875]

I haven't tried the repair option in the Windows 2k setup, although I have run setup from startup and have completely reformatted the hard drive, so that should put it back to how it was. I can't see how it can suddenly be the software though as Windows 2k has been running fine for the last 8 months and a local computer company have had the computer in and can't find a problem with the software so they, and I think there must be a hardware problem somewhere, the problem is, where?

[jpjohnelway]

it is not always a software problem, defective memory, a bad nic card, or a bad hard drive could do it also. so if the software checks out go there next.

[Andy-S]

Phil,

To help pinpoint the problem, go to control panel &gt; system &gt; properties &gt; advanced &gt; startup and recovery &gt; settings and uncheck the automatically restart on error. This will freeze the system whyen the bugcheck occurs and you will be able to determine the stop error.

Cheers
Andy

[phil_l875]

Thanks for that bit of advice. Here is what the system is saying (I hope this makes more sense to you lot than it does to me!).

*** STOP: 0x000000D1 (0x00000000,0x00000002,0x00000000,0x00000000)
DRIVER_IRQL_NOT_LESS_OR_EQUAL

Beginning dump of physical memory...

[Andy-S]

Phil,

The error message means that a driver has to tried to access memory at a privilege level higher than it is allowed to.

In most cases the problem is due to a buggy driver. Have you added any hardware or changed drivers recently?


Cheers
Andy

[phil_l875]

No. I havent done anything. When I first got the problem I assumed that I had a software problem somewhere along the line so i formatted the hard drive and reinstalled everything. When I still had the same problem i formatted and installed a different version of windows, where i still got the same problem. So i put Windows 2k back on.

The problem is now though, how do I fix it?

[Andy-S]

If it fails in multiple versions of Windows then it is most likely a hardware problem. What are you doing at the time of failure?



Cheers
Andy

[phil_l875]

I can't specify what I'm doing when it does it but I think I'm just generally using the computer to browse the net, talk to people on Messenger and listen to music. Thats all I ever do really!

[Andy-S]

Phil,

The way I would tackle it is to disable one piece of hardware at a time to see if the problem goes away. To do this it is best to have a simple method of duplicating the problem.

Even though it doesn't look a driver issue as it fails in multiple versions of Windows it is the driver that is performing the access when the problem occurs.

Try using driver verifier to isolate the root cause. Driver verifier is installed in Windows 2000 as verifier.exe and it is in %systemroot%\system32 directory. The article at this URL provides details of how to run driver verifier and do IRQL checking.

<a target="_blank" href=http://msdn.microsoft.com/library/default.asp?url=/library/en-us/ddtools/hh/ddtools/dv_7egj.asp>http://msdn.microsoft.com/library/default.asp?url=/library/en-us/ddtools/hh/ddtools/dv_7egj.asp</a>

Cheers
Andy

[phil_l875]

I have done that although im not entirely sure what the results mean. I have a list of drivers and most say loaded but there is the odd one that says unloaded. Can anyone clarify for me what this means?

[Andy-S]

Phil,

If you go to the settings tab you can select the drivers to verify. I would select the drivers 2 at a time as verifying really slows down the system boot time.

To verify a list of drivers, select the Settings tab. Select Verify selected drivers. You will see a list of all drivers that were loaded in the system during the most recent boot.

The Verification Status column gives the current status for each driver. Possible Verification Status values are:

Enabled
The driver is currently being verified and will continue to be verified after reboot.
Disabled
The driver is not currently being verified, and will not be verified after reboot.
Enabled (Reboot Needed)
The driver is not currently being verified, but the user has requested verification of this driver. This driver will be verified after reboot.
Disabled (Reboot Needed)
The driver is currently being verified, but the user has requested an end to this verification. After reboot, this driver will no longer be verified.

You can select one or more drivers from this list and click the Verify or Don't Verify button. You can also right-click on the driver's name and control verification from the popup menu.

Select the volatile settings tab and ensure that force IRQL checking is selected for each driver.


Cheers
Andy

[phil_l875]

I have verified them all at the same time and I just got a list of them after i rebooted. The funny think is, i noticed Force IRQL Checking in the settings after I ha rebooted. This looked familiar from the original message (see a couple of posts up for error message), so I checked it.

After checking it said that I needed to reboot and when I did I got the below message on boot.

***STOP: 0x0000000A (0xE1001008,0x00000002,0x00000000,0x8049F6FF)
***Address 8049F6FF base at 80400000, DateStamp 384d9b17 - ntoskrnl.exe

This appears each time i reboot until i start up in safe mode and enter verify and uncheck the option. Then the system loads normally. Each time i select the option, i get the message.

[phil_l875]

I know that im no Einstein but what with the original message of the IRQL and then the checking of when i get the message, is the computer hinting at the fact that there is a problem with the ntoskrnl.exe as in the error message at boot when IRQL checking is enabled?

[Andy-S]

Phil,

NTOSKERNEL is responsible for handling the bugcheck. The good news is that you have as simple method of duplicating the problem. Select one driver at a time to determine what one is causing the 0A bugcheck.

Cheers
Andy

[phil_l875]

I'm sorry. I'm not overly technically minded but what do you mean by duplicating the problem?

[Andy-S]

What I mean is that the IRQL checking is throwing up the same error that is generated when you are surfing the web etc. If you identify the driver that is causing the 0A exception then you will be one step closer to determining the driver/hardware that are causing your original problem.

Cheers
Andy

[phil_l875]

Hi Andy. Me again! You must be pretty fed up with me and my stupidness by now.

How do I know which driver is the dodgy one? Will it be the one that says 'Not Loaded' or is there some other message it will display?

[Andy-S]

I don't have a W2K system available right now but I believe in the global counters tab there is a drop down list of drivers and you can view the details for each driver. Look for the one that failed the IRQL checking.

If you can't find it then, rather than selecting all drivers, select them one at a time and just do IRQL checking (volatile settings) there is no need to reboot to do this.

Cheers
Andy

[phil_l875]

I NEED HELP!!!!!

I really haven't got a clue what I am looking for. I have tried the verifier.exe and have checked the drivers two at a time then restarted and all I get is 'Loaded' or 'Unloaded' it isn't telling me if there is an error or not with that driver.

Plus I don't understand what you mean with the Global Counters and the Volatile Settings. (If I were you I would be really really p***ed off with me by now)

[Andy-S]

Phil,

If you have checked the drivers 2 at a time and have managed to restart without the 0A exception being displayed then the drivers you have checked are not at fault (as long as you have IRQL checking enabled).

Unfortunately I am out on business until next Monday so don't have access to a W2K system. If your problem can wait until next week then I can provide you with screen captures of what to do.

In the meantime you could try a more brute force procedure by disabling your hardware one at a time to see if the problem goes away. The one's I would check are NIC, modem, audio.

I would also think back to any changes you made to the system prior to getting this problem. Or have you always had the problem?

Sorry this is not much help. Maybe someone else wil be able to help out in the meantime with the details of how to run driver verifier.

Cheers
Andy

[phil_l875]

Thanks a lot for all of your help Andy. I will keep trying and I'll look on the Net for a guide to verifier.exe.

Thanks again for all your help

[Andy-S]

Phil,

I managed to dig a summary document off our server. It was something I put together about 18 months ago but it is all still valid. Send me a private mail with your email address and I will send it to you.

Cheers
Andy

[sda]

I see this stop error quite often.

Phil, do you have service pack 2 for win2k installed ?

If a driver is problematic, even if you reload your box, and reinstall the same one, your still gonna have the same problem.

If your not sure if you have sp 2 installed, open your windows explorer (right click on start and explore) go on the help menu and select about win2k ... its gonna tell you if you have it or not.

A LOT of fixes for stop error related to that.

If your going to start removing hardware to troubleshoot that issue, definatly start with your ram. If you have several stick, take your most recent one or the best one (higher FSB higher speed) and put it in the slot the one near your processor. Give that a try.

From the exeption and the stop error you posted, i have reason to think the 2 suggestion i told you could help you.

[phil_l875]

Thanks. Ill look if I have any service paks and if not ill download one. I have checked in my event viewer and I got the following message from one of the reboots. If it means anything to anyone, could they please let me know.

The computer has rebooted from a bugcheck. The bugcheck was: 0x000000d1 (0xbfd6ee60, 0x00000002, 0x00000000, 0xbfd6ee60). Microsoft Windows 2000 [v15.2195]. A dump was saved in: C:\WINNT\Minidump\Mini072502-03.dmp

[Andy-S]

Phil,

The information in event viewer is just the same as what is displayed on the blue screen. The mini-dump that is created is a dump of the kernel processes in memory at the time of failure.

Cheers
Andy