My PC crashed today. In looking at the event log, all it said was, "The previous system shutdown at 12:35:13 PM on 7/18/2012 was unexpected." So then it crashed again during the bugcheck, which gave a little more information:
Log Name: System
Source: Microsoft-Windows-WER-SystemErrorReporting
Date: 7/18/2012 12:40:04 PM
Event ID: 1001
Task Category: None
Level: Error
Keywords: Classic
User: N/A
Computer: MYCOMPUTER
Description:
The computer has rebooted from a bugcheck. The bugcheck was: 0x0000007e (0xffffffffc0000005, 0xfffff880071a6f8a, 0xfffff88006104898, 0xfffff880061040f0). A dump was saved in: C:\Windows\MEMORY.DMP. Report Id: 071812-95628-01.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-WER-SystemErrorReporting" Guid="{ABCE23E7-DE45-4366-8631-84FA6C525952}" EventSourceName="BugCheck" />
<EventID Qualifiers="16384">1001</EventID>
<Version>0</Version>
<Level>2</Level>
<Task>0</Task>
<Opcode>0</Opcode>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime="2012-07-18T18:40:04.000000000Z" />
<EventRecordID>476208</EventRecordID>
<Correlation />
<Execution ProcessID="0" ThreadID="0" />
<Channel>System</Channel>
<Computer>MYCOMPUTER</Computer>
<Security />
</System>
<EventData>
<Data Name="param1">0x0000007e (0xffffffffc0000005, 0xfffff880071a6f8a, 0xfffff88006104898, 0xfffff880061040f0)</Data>
<Data Name="param2">C:\Windows\MEMORY.DMP</Data>
<Data Name="param3">071812-95628-01</Data>
</EventData>
</Event>
It created a dump file, how do I read dump files?
The log file will be %systemroot%\Minidump which is normally C:\windows\Minidump
If the files don't exist then setup your system to record them ;-
Go to Start and type in sysdm.cpl and press Enter Click on the Advanced tab Click on the Startup and Recovery Settings button Ensure that Automatically restart is unchecked Under the Write Debugging Information header select Small memory dump (256 kB) in the dropdown box Ensure that the Small Dump Directory is listed as %systemroot%\Minidump << where your .dmp files can be found later
Click OK twice to exit the dialogs, then reboot for the changes to take effect.
(Answer stolen from http://windows7forums.com/windows-7-support/39784-where-dump-files-dmp-saved-after-crash.html)
This is a SYSTEM_THREAD_EXCEPTION_NOT_HANDLED bugcheck, caused by a system thread throwing an exception that was not caught.
The kernel dump is unlikely to be of use to you, unless you're secretly a kernel-ninja, but hopefully you have Windows Error Reporting on, so that the bugcheck can be triaged by someone who knows what they're doing back in Microsoft HQ.
User contributions licensed under CC BY-SA 3.0