[happyrock]

try running the hard drive manufactures own drive testing tool...you can get it in the support section of the drive manufactures website...
run the extended tests...it will find errors that the quick tests miss...

[Advertisements]

One day last week I ran the hard drive mfr's testing tool and the windows based version (Seagate drive) showed errors, but recommended that I run the DOS based version from an ISO file on a CD. I did that and it showed no errors on the drive. I've started to get more BSOD's and the system seems to be getting more unstable, but the problems are intermittent and difficult to troubleshoot. Sometimes it may work fine all day long and other days, I get several BSOD's. Since I last posted, I have received the following BSOD's: 0xBE error regarding SPBBCDrv.sys; 0xD1 regarding TCPIP.sys; 0x0A no file mentioned; 0x50, no file mentioned; 0x8E, no file mentioned. Some of these error codes seem to point to RAM, but I replaced the RAM two weeks ago, so I'm lost as to what could be the problem. Any ideas?

[mccarter]

One day last week I ran the hard drive mfr's testing tool and the windows based version (Seagate drive) showed errors, but recommended that I run the DOS based version from an ISO file on a CD. I did that and it showed no errors on the drive. I've started to get more BSOD's and the system seems to be getting more unstable, but the problems are intermittent and difficult to troubleshoot. Sometimes it may work fine all day long and other days, I get several BSOD's. Since I last posted, I have received the following BSOD's: 0xBE error regarding SPBBCDrv.sys; 0xD1 regarding TCPIP.sys; 0x0A no file mentioned; 0x50, no file mentioned; 0x8E, no file mentioned. Some of these error codes seem to point to RAM, but I replaced the RAM two weeks ago, so I'm lost as to what could be the problem. Any ideas?

[happyrock]

download and install WhoCrashed from [url="http://<a%20href="http://www.resplendence.com/download/whocrashedSetup.exe"%20target="_blank">http://www.resplende...edSetup.exe</a>"]here[/url]..
This program checks for any drivers which may have been causing your computer to crash....

click on it...then run...then next...put a tick in accept...then next..put a tick in the don't create a start menu folder..then next...put a tick in create a desktop icon..then install.. then make sure there is a tick in launch whocrashed...then finish...then click Analyze ...
it will want to install the debugger...let it
WhoCrashed will create report...you have to scroll down to see it
Copy and paste it into your next reply...

[mccarter]

The link to download it wouldn't work, but I went to the Resplendence website and downloaded it. It didn't appear to install the debugger. When I clicked "analyze", the popup for WhoCrashed flashes one time and gives me the following:


Analysis
--------------------------------------------------------------------------------

Crash dump directory: C:\WINDOWS\Minidump

Crash dumps are enabled on your computer.


No crash dumps have been found on your computer


--------------------------------------------------------------------------------
Conclusion
--------------------------------------------------------------------------------

Crash dumps are enabled and no crash dumps have been found on your computer. In case your computer does experience sudden reboots it is likely these are caused by malfunctioning hardware or power failure. Then it's suggested you contact the support department of the manufacturer of your system or test your system with a memory test utility for further investigation.

[usasma]

First, I'd like to state up front that I haven't followed the entire topic here.

I'm unsure of how WhoCrashed works - but there's several locations for the memory dump files on your system.
C:\Windows\Minidump is where, by default, the smaller memory dumps are located.
Larger dumps are usually found in the C:\Windows directory and will be labelled as MEMORY.DMP
Finally, when the Windows Error Reporting dialog pops up, it'll give you the location of those memory dumps in a temporary file. If you don't save the dump file elsewhere, there's a chance that it'll be erased when the report is sent/finished.

Additionally, if your pagefile is too small (less than the size of your RAM) then a memory dump may not be saved to disk. Another thing that will prevent this is having Error Reporting disabled.

Finally, FWIW, numerous seemingly unrelated memory dumps can have several causes. A lower level driver (such as those used with an antivirus program - or those started by malware) can cause these things. It can also be a Windows corruption, or a hardware issue.

Locating/enabling the saving of memory dumps is likely to be the first order of business here. Once there's a couple of memory dumps to analyze this should provide some clues as to what's causing this. If that doesn't work, then there's additional tests to run to force the identification of the culprit.

More info on locating BSOD information: http://www.bleepingc...tml#entry409491
How to use the Windows Debugging Tools to analyze memory dump files:
http://usasma.vox.co...ed-02oct08.html
http://support.micro....aspx/kb/315263

[mccarter]

Windows Error Reporting is enabled and I searched the hard drive for dmp and mdmp files and didn't find any from recent issues. There were some old ones from AutoCAD, but thats it. Most of the time when it crashes, it goes directly to the BSOD and doesn't give me the opportunity to save the error report. It has a time or two, but not usually. I meant to put in my earlier post that I've also been getting data execution prevention errors regarding svchost.exe and ccsvchost.exe (not positive about the filenames, I'm going from memory, but they are close to the actual names). When I get these errors, I sometimes cannot do a normal shutdown, the hourglass just stays up acting like it's trying to shutdown, but won't. I eventually have to shut the power off to reboot. How do I get the memory dumps to save?

[usasma]

IME some lower level errors seem to bypass the creation of a memory dump file (but I haven't seen this in a while in XP, and not at all in Vista or Win7).
Most often I've seen this to be either a malware infection or a hardware problem. You may want to get checked out in the Malware forums located here: http://www.geekstogo...emoval-f37.html

Did you search the Event Viewer for error messages around the time that the last crash occurred? Even if a dump isn't captured, there will be an error message logged for an unexpected shutdown. Can you find any of this?

svchost.exe is a process that "hosts" other processes - so there's normally a bunch of processes that run within it. Try right clicking on one of the svchost.exe processes in Task Manager...Processes tab and selecting "Go to service..." to see what they're associated with.

ccsvchost.exe is most likely a process that belongs to your Norton/Symantec protection. At work we find quite a few problems with these programs. We routinely use the Norton Removal Tool (free here: http://service1.syma...005033108162039 ) to remove it. Then we download a fresh copy from the Norton site and install that.

Edited by usasma, 07 April 2009 - 05:42 AM.