Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

My PC crashed today. In looking at the event log, all it said was, "The previous system shutdown at 12:35:13 PM on 7/18/2012 was unexpected." So then it crashed again during the bugcheck, which gave a little more information:

Log Name:      System
Source:        Microsoft-Windows-WER-SystemErrorReporting
Date:          7/18/2012 12:40:04 PM
Event ID:      1001
Task Category: None
Level:         Error
Keywords:      Classic
User:          N/A
Computer:      MYCOMPUTER
Description:
The computer has rebooted from a bugcheck.  The bugcheck was: 0x0000007e (0xffffffffc0000005, 0xfffff880071a6f8a, 0xfffff88006104898, 0xfffff880061040f0). A dump was saved in: C:\Windows\MEMORY.DMP. Report Id: 071812-95628-01.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WER-SystemErrorReporting" Guid="{ABCE23E7-DE45-4366-8631-84FA6C525952}" EventSourceName="BugCheck" />
    <EventID Qualifiers="16384">1001</EventID>
    <Version>0</Version>
    <Level>2</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2012-07-18T18:40:04.000000000Z" />
    <EventRecordID>476208</EventRecordID>
    <Correlation />
    <Execution ProcessID="0" ThreadID="0" />
    <Channel>System</Channel>
    <Computer>MYCOMPUTER</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="param1">0x0000007e (0xffffffffc0000005, 0xfffff880071a6f8a, 0xfffff88006104898, 0xfffff880061040f0)</Data>
    <Data Name="param2">C:\Windows\MEMORY.DMP</Data>
    <Data Name="param3">071812-95628-01</Data>
  </EventData>
</Event>

It created a dump file, how do I read dump files?

share|improve this question
    
Check your formatting please, you need to indent code with Ctrl-K in order to have XML display properly. –  slhck Jul 19 '12 at 3:32
    
How do I troubleshoot computer dumps should point you at a few good tools. –  Mokubai Jul 19 '12 at 8:30

2 Answers 2

up vote 1 down vote accepted

This is a SYSTEM_THREAD_EXCEPTION_NOT_HANDLED bugcheck, caused by a system thread throwing an exception that was not caught.

The kernel dump is unlikely to be of use to you, unless you're secretly a kernel-ninja, but hopefully you have Windows Error Reporting on, so that the bugcheck can be triaged by someone who knows what they're doing back in Microsoft HQ.

share|improve this answer

The log file will be %systemroot%\Minidump which is normally C:\windows\Minidump

If the files don't exist then setup your system to record them ;-

Go to Start and type in sysdm.cpl and press Enter Click on the Advanced tab Click on the Startup and Recovery Settings button Ensure that Automatically restart is unchecked Under the Write Debugging Information header select Small memory dump (256 kB) in the dropdown box Ensure that the Small Dump Directory is listed as %systemroot%\Minidump << where your .dmp files can be found later

Click OK twice to exit the dialogs, then reboot for the changes to take effect.

(Answer stolen from http://windows7forums.com/windows-7-support/39784-where-dump-files-dmp-saved-after-crash.html)

share|improve this answer
    
The log file does exist in C:\windows\Minidump as you predicted. Now how do I read it? –  Rod Jul 19 '12 at 12:33
    
All details should be here: support.microsoft.com/kb/315263 –  Dave Rook Jul 19 '12 at 12:35

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.