[CelestialTeardrop]

I have been experiencing problems with Panda's ActiveScan causing blue screen crashes (I posted in the malware removal forum about this issue) and now have 3 files in my minidump folder.

I was told I would be able to open them with notepad, but when I do all I see is a lot of characters like these:

ÏU€€>ü‚€ÏU€€?ü‚ ÐU€ l d=}­ :œN€ €ùßÿ€ùßÿ °‘ø•
’

   ³ GenuineIntel  ° ÿ?€  ÙxN€—  À÷ú‚À÷ú‚
^2¬1· 9¦E:· q–Q:· °\¯öÿÿ/‡iTdd Ð2 Ôz\‹ _| dd  j
ýßÿ ýßÿ 
|T€ ñßÿ   (àO‚(àO‚0àO‚0àO‚ ý  ¬  €
™ `àO‚`àO‚ �6�‚€i ‚   
2 Às¹ñ…IÈ
L
XæO‚ÀÇZÿ`™ Ì ÑR PŸ pM Xo ÑR ÀÊ 0C„æO‚ìÇZÿ `»
á˜éšáLÍ.ã À¸Ä­£

 áO‚ áO‚= Ó6
,,H®
 $áO‚$áO‚ E‚'Ž‚ <D @Ù»á ˜ˆ¹á @ xå*ÿ ( ° óâ€áO‚€áO‚ ±iexplore.exe 7�‚üi ‚  ÿ ðý ~ † F

Does this mean that my dump files are all corrupted or that they cannot be opened (successfully) in Notepad?

Thanks!

[Advertisements]

You have to use dumpchk.exe to read dump files. It is on the XP cd in the support/tools folder.

http://support.micro....com/kb/315271/

SRX660

[SRX660]

You have to use dumpchk.exe to read dump files. It is on the XP cd in the support/tools folder.

http://support.micro....com/kb/315271/

SRX660

[CelestialTeardrop]

Thanks SRX660, it's good to know they are not corrupted. Now to dig out my XP cd...

While on this topic of memory dumps, I have one more question.

When the blue screen error appeared, I shut the computer down by holding the power button then turned it on after a minute or so. There were no messages or anything out of the ordinary. I then ran checkdisk during the next restart, and when I came back to my desktop I got the message "The system has recovered from a serious error" (looking at the error details revealed the same address as the one given in the stop error earlier).

When the crash happened again (I couldn't resist checking if it was indeed Panda that caused it), I did everything as above but when the system powered back on I did a restart (no checkdisk scheduled) and did not get a "system recovered..." message. After that I ran checkdisk again, and behold the message appeared.

So to get to the point: Why does the "system recovered from a serious error" message appear only after running checkdisk but not after a regular restart after the crash?

Thanks for reading my long post.

[Major Payne]

You can also read small memory dump files by using the WinDbg tool or the KD.exe tool. WinDbg and KD.exe are included with the latest version of the Debugging Tools for Windows package.

To download and install the Windows debugging tools, visit the following Microsoft Web site:
http://www.microsoft.com/whdc/devtools/debugging/default.mspx

Select the Typical installation. By default, the installer installs the debugging tools in the following folder:
C:\Program Files\Debugging Tools for Windows.

To open the dump file after the installation is complete, follow these steps:
1. Click Start, click Run, type cmd, and then click OK.
2. Change to the Debugging Tools for Windows folder. To do this, type the following at the command prompt, and then press ENTER:
cd c:\program files\debugging tools for windows
3. To load the dump file into a debugger, type one of the following commands, and then press ENTER:
windbg -y SymbolPath -i ImagePath -z DumpFilePath
kd -y SymbolPath -i ImagePath -z DumpFilePath

Lots of work but gave this only if you don't find CD to use dumpchk.exe which is much better to use.

Ron

Edited by Major Payne, 12 January 2008 - 04:34 PM.

[CelestialTeardrop]

Thanks Major, I did manage to find my cd (sitting innocently in my desk cabinet) but I'm glad to know that there is an alternate method just in case.

I did some more searching about the "system recovered from serious error" message, and found this: smartcomputing.com/techsupport. According to the site, that message should have been fixed in SP1; doesn't that also imply that it should not be appearing on computers running SP2?