Help reading Mini-Dump

[odies]

My Computer reboots sometimes after the welcome screen.

Then I found an error with the WLAN driver and removed it.

Although I removed the driver, Windows reboots sometimes.

Is my HDD going to break ?

Here is the Dump-Analysis:

*******************************************************************************

* *

* Bugcheck Analysis *

* *

*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 7A, {c0712b38, c000009c, e2567028, 2a7f08c0}

Unable to load image win32k.sys, Win32 error 2

*** WARNING: Unable to verify timestamp for win32k.sys

*** ERROR: Module load completed but symbols could not be loaded for win32k.sys

Probably caused by : win32k.sys ( win32k+374a1 )

Followup: MachineOwner

---------

kd> !analyze -v

*******************************************************************************

* *

* Bugcheck Analysis *

* *

*******************************************************************************

KERNEL_DATA_INPAGE_ERROR (7a)

The requested page of kernel data could not be read in. Typically caused by

a bad block in the paging file or disk controller error. Also see

KERNEL_STACK_INPAGE_ERROR.

If the error status is 0xC000000E, 0xC000009C, 0xC000009D or 0xC0000185,

it means the disk subsystem has experienced a failure.

If the error status is 0xC000009A, then it means the request failed because

a filesystem failed to make forward progress.

Arguments:

Arg1: c0712b38, lock type that was held (value 1,2,3, or PTE address)

Arg2: c000009c, error status (normally i/o status code)

Arg3: e2567028, current process (virtual address for lock type 3, or PTE)

Arg4: 2a7f08c0, virtual address that could not be in-paged (or PTE contents if arg1 is a PTE address)

Debugging Details:

------------------

ERROR_CODE: (NTSTATUS) 0xc000009c - STATUS_DEVICE_DATA_ERROR

DISK_HARDWARE_ERROR: There was error with disk hardware

BUGCHECK_STR: 0x7a_c000009c

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: DRIVER_FAULT

PROCESS_NAME: firefox.exe

TRAP_FRAME: aa529ac0 -- (.trap ffffffffaa529ac0)

ErrCode = 00000000

eax=00000800 ebx=00001295 ecx=00000000 edx=e1d40020 esi=00001000 edi=e2563018

eip=bf8374a1 esp=aa529b34 ebp=aa529b58 iopl=0 nv up ei ng nz ac po cy

cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010293

win32k+0x374a1:

bf8374a1 ?? ???

Resetting default scope

LAST_CONTROL_TRANSFER: from 80512091 to 804f8c3f

STACK_TEXT:

aa529994 80512091 0000007a c0712b38 c000009c nt!KeBugCheckEx+0x1b

aa5299c4 80512bb7 814a5e40 c0712b38 e2567028 nt!MiWaitForInPageComplete+0x1c7

aa529a44 8051c0f8 c0712b38 e2567028 c0712b38 nt!MiDispatchFault+0x2b5

aa529aa8 8053faac 00000000 e2567028 00000000 nt!MmAccessFault+0x7b4

aa529aa8 bf8374a1 00000000 e2567028 00000000 nt!KiTrap0E+0xcc

WARNING: Stack unwind information not available. Following frames may be wrong.

aa529b30 aa529cec 00000020 00000000 00000060 win32k+0x374a1

aa529b58 bf85b99b aa529b80 00000001 aa529b74 0xaa529cec

aa529b78 bf86c156 00000020 00000000 aa529d0c win32k+0x5b99b

aa529c20 bf80829f aa529d0c aa529ca8 e34a5b58 win32k+0x6c156

aa529cb0 bf808307 e34a5a38 00000000 00000002 win32k+0x829f

aa529cc8 bf8eccb8 aa529d0c 00000000 00000002 win32k+0x8307

aa529ce4 bf8ecc67 e132b598 70616d63 00000000 win32k+0xeccb8

aa529d04 bf8ecc2a e39bc008 70616d63 00000000 win32k+0xecc67

aa529d48 8053cbc8 180109fe 70616d63 00000000 win32k+0xecc2a

aa529d48 7c91eb94 180109fe 70616d63 00000000 nt!KiFastCallEntry+0xf8

180109fe 00000000 00000000 00000000 00000000 0x7c91eb94

STACK_COMMAND: kb

FOLLOWUP_IP:

win32k+374a1

bf8374a1 ?? ???

SYMBOL_STACK_INDEX: 5

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: win32k

IMAGE_NAME: win32k.sys

DEBUG_FLR_IMAGE_TIMESTAMP: 47e0df7d

SYMBOL_NAME: win32k+374a1

FAILURE_BUCKET_ID: 0x7a_c000009c_win32k+374a1

BUCKET_ID: 0x7a_c000009c_win32k+374a1

Followup: MachineOwner

---------

[cluberti]

Hard to say because you didn't configure your symbols before running !analyze -v, but the error code that was reported means this:

# for hex 0xc000009c / decimal -1073741668
  STATUS_DEVICE_DATA_ERROR									   ntstatus.h
# as an HRESULT: Severity: FAILURE (1), FACILITY_NULL (0x0), Code 0x9c

The "device" could be the disk, the controller, anything along the hardware chain. However, I would start checking your hard drive(s) for errors, just to be safe.

[odies]

can you tell me how to configure my symbols right ?

Here is the Crash Dump:

Mini100908_01.zip

Edited October 10, 2008 by odies

[cluberti]

This one is fairly easy, now that I see it, and needs no more than a !analyze -v:

kd> !analyze -v
*******************************************************************************
*																			 *
*						Bugcheck Analysis									*
*																			 *
*******************************************************************************

KERNEL_DATA_INPAGE_ERROR (7a)
The requested page of kernel data could not be read in.  Typically caused by
a bad block in the paging file or disk controller error. Also see
KERNEL_STACK_INPAGE_ERROR.
If the error status is 0xC000000E, 0xC000009C, 0xC000009D or 0xC0000185,
it means the disk subsystem has experienced a failure.
If the error status is 0xC000009A, then it means the request failed because
a filesystem failed to make forward progress.
Arguments:
Arg1: c0712b38, lock type that was held (value 1,2,3, or PTE address)
Arg2: c000009c, error status (normally i/o status code)
Arg3: e2567028, current process (virtual address for lock type 3, or PTE)
Arg4: 2a7f08c0, virtual address that could not be in-paged (or PTE contents if arg1 is a PTE address)

Debugging Details:
------------------


ERROR_CODE: (NTSTATUS) 0xc000009c - STATUS_DEVICE_DATA_ERROR

DISK_HARDWARE_ERROR: There was error with disk hardware

BUGCHECK_STR:  0x7a_c000009c

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  DRIVER_FAULT

PROCESS_NAME:  firefox.exe

TRAP_FRAME:  aa529ac0 -- (.trap 0xffffffffaa529ac0)
ErrCode = 00000000
eax=00000800 ebx=00001295 ecx=00000000 edx=e1d40020 esi=00001000 edi=e2563018
eip=bf8374a1 esp=aa529b34 ebp=aa529b58 iopl=0		 nv up ei ng nz ac po cy
cs=0008  ss=0010  ds=0023  es=0023  fs=0030  gs=0000			 efl=00010293
win32k!RFONTOBJ::vXlatGlyphArray+0x1d3:
bf8374a1 663b54c710	  cmp	 dx,word ptr [edi+eax*8+10h] ds:0023:e2567028=????
Resetting default scope

LAST_CONTROL_TRANSFER:  from 80512091 to 804f8c3f

STACK_TEXT:  
aa529994 80512091 0000007a c0712b38 c000009c nt!KeBugCheckEx+0x1b
aa5299c4 80512bb7 814a5e40 c0712b38 e2567028 nt!MiWaitForInPageComplete+0x1c7
aa529a44 8051c0f8 c0712b38 e2567028 c0712b38 nt!MiDispatchFault+0x2b5
aa529aa8 8053faac 00000000 e2567028 00000000 nt!MmAccessFault+0x7b4
aa529aa8 bf8374a1 00000000 e2567028 00000000 nt!KiTrap0E+0xcc
aa529b58 bf85b99b aa529b80 00000001 aa529b74 win32k!RFONTOBJ::vXlatGlyphArray+0x1d3
aa529b78 bf86c156 00000020 00000000 aa529d0c win32k!RFONTOBJ::hgXlat+0x19
aa529c20 bf80829f aa529d0c aa529ca8 e34a5b58 win32k!RFONTOBJ::bRealizeFont+0x1b7
aa529cb0 bf808307 e34a5a38 00000000 00000002 win32k!RFONTOBJ::bInit+0x29a
aa529cc8 bf8eccb8 aa529d0c 00000000 00000002 win32k!RFONTOBJ::vInit+0x16
aa529ce4 bf8ecc67 e132b598 70616d63 00000000 win32k!ulGetFontData2+0x17
aa529d04 bf8ecc2a e39bc008 70616d63 00000000 win32k!ulGetFontData+0x48
aa529d48 8053cbc8 180109fe 70616d63 00000000 win32k!NtGdiGetFontData+0x26
aa529d48 7c91eb94 180109fe 70616d63 00000000 nt!KiFastCallEntry+0xf8
WARNING: Frame IP not in any known module. Following frames may be wrong.
180109fe 00000000 00000000 00000000 00000000 0x7c91eb94


STACK_COMMAND:  kb

FOLLOWUP_IP: 
win32k!RFONTOBJ::vXlatGlyphArray+1d3
bf8374a1 663b54c710	  cmp	 dx,word ptr [edi+eax*8+10h]

SYMBOL_STACK_INDEX:  5

SYMBOL_NAME:  win32k!RFONTOBJ::vXlatGlyphArray+1d3

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: win32k

IMAGE_NAME:  win32k.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  47e0df7d

FAILURE_BUCKET_ID:  0x7a_c000009c_win32k!RFONTOBJ::vXlatGlyphArray+1d3

BUCKET_ID:  0x7a_c000009c_win32k!RFONTOBJ::vXlatGlyphArray+1d3

Followup: MachineOwner

It seems that, yes, your disk subsystem reported an error so the bugcheck occurred. I'd say it could be a bad hard disk, so checking is the first thing to do. Making sure the other hardware is working fine is also something I'd suggest as well, just in case.

[odies]

Now I have a new Crash Dump.

Microsoft ® Windows Debugger Version 6.6.0007.5

Copyright © Microsoft Corporation. All rights reserved.

Loading Dump File [C:\WINDOWS\Minidump\Mini102308-01.dmp]

Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols

Executable search path is:

Windows XP Kernel Version 2600 (Service Pack 3) UP Free x86 compatible

Product: WinNt, suite: TerminalServer SingleUserTS

Built by: 2600.xpsp_sp3_gdr.080814-1236

Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055b1c0

Debug session time: Thu Oct 23 22:31:43.453 2008 (GMT+2)

System Uptime: 0 days 0:00:28.953

Loading Kernel Symbols

...............................................................................................

Loading User Symbols

*******************************************************************************

* *

* Bugcheck Analysis *

* *

*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck C0000218, {e17c8510, 0, 0, 0}

Probably caused by : ntoskrnl.exe ( nt!ExRaiseHardError+13e )

Followup: MachineOwner

---------

kd> !analyze -v

*******************************************************************************

* *

* Bugcheck Analysis *

* *

*******************************************************************************

Unknown bugcheck code (c0000218)

Unknown bugcheck description

Arguments:

Arg1: e17c8510

Arg2: 00000000

Arg3: 00000000

Arg4: 00000000

Debugging Details:

------------------

BUGCHECK_STR: 0xc0000218

ERROR_CODE: (NTSTATUS) 0xc0000218 - {Registrierungsdatei fehlgeschlagen} Die Registrierung konnte die Struktur(datei): %hs oder ihr Protokoll oder ihre Alternative nicht laden. Die Struktur ist besch digt, nicht vorhanden oder nicht beschreibbar.

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: DRIVER_FAULT

PROCESS_NAME: System

LAST_CONTROL_TRANSFER: from 8066bc36 to 80533806

STACK_TEXT:

f6ea0864 8066bc36 0000004c c0000218 f6ea08a0 nt!KeBugCheckEx+0x1b

f6ea0a18 80647e16 c0000218 00000001 00000001 nt!ExpSystemErrorHandler+0x526

f6ea0bc4 806480ad c0000218 00000001 00000001 nt!ExpRaiseHardError+0x9a

f6ea0c34 8060c0b4 c0000218 00000001 00000001 nt!ExRaiseHardError+0x13e

f6ea0dac 8057aeff 00000002 00000000 00000000 nt!CmpLoadHiveThread+0x1e8

f6ea0ddc 804f88ea 805bab17 00000002 00000000 nt!PspSystemThreadStartup+0x34

00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16

STACK_COMMAND: kb

FOLLOWUP_IP:

nt!ExRaiseHardError+13e

806480ad 837dfc00 cmp dword ptr [ebp-4],0

SYMBOL_STACK_INDEX: 3

SYMBOL_NAME: nt!ExRaiseHardError+13e

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nt

IMAGE_NAME: ntoskrnl.exe

DEBUG_FLR_IMAGE_TIMESTAMP: 48a404ab

FAILURE_BUCKET_ID: 0xc0000218_nt!ExRaiseHardError+13e

BUCKET_ID: 0xc0000218_nt!ExRaiseHardError+13e

Followup: MachineOwner

---------

I have attached the Minidump, when my symbols are not right.

Mini102308_01.zip

[cluberti]

kd> .bugcheck
Bugcheck code C0000218
Arguments e17c8510 00000000 00000000 00000000

kd> kb
ChildEBP RetAddr  Args to Child			  
f6ea0864 8066bc36 0000004c c0000218 f6ea08a0 nt!KeBugCheckEx+0x1b
f6ea0a18 80647e16 c0000218 00000001 00000001 nt!ExpSystemErrorHandler+0x526
f6ea0bc4 806480ad c0000218 00000001 00000001 nt!ExpRaiseHardError+0x9a
f6ea0c34 8060c0b4 c0000218 00000001 00000001 nt!ExRaiseHardError+0x13e
f6ea0dac 8057aeff 00000002 00000000 00000000 nt!CmpLoadHiveThread+0x1e8
f6ea0ddc 804f88ea 805bab17 00000002 00000000 nt!PspSystemThreadStartup+0x34
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16

kd> !error c0000218
Error code: (NTSTATUS) 0xc0000218 (3221226008) - {Registry File Failure}  The registry cannot load the hive (file):  %hs  or its log or alternate.  It is corrupt, absent, or not writable.

kd> da e17c8510
e17c8510  "\SystemRoot\System32\Config\SOFT"
e17c8530  "WARE"

It's telling you that it failed to load the HKLM\Software hive (found at %systemroot%\system32\config\SOFTWARE), and thus it crashed.

Knowing you have other hard disk related crashes, either the filesystem on that disk is bad, or the disk itself is. Also, update your debugger - you're running 6.6.7.5 (from July of 2006), and the latest version is 6.9.0003.113 (April 2008).