Did you notice that Windows will automatically generate crash dumps whenever you get blue screen of death (BSOD)? I’ve gotten lots of them when using Windows 98 but when come to XP, it is nearly flawless and I can’t remember when was the last time I ever got a blue screen. However on my new laptop that comes with Vista, it’s a whole different story because it happened so often and I can’t really remember how many times I got the blue screen. If you’ve never seen a Windows blue screen before, it looks something like what it says below.
A problem has been detected and Windows has been shut down to prevent damage to your computer.
If this is the first time you’ve seen this stop error screen, restart your computer. If this screen appears again, follow these steps:
Check to be sure you have adequate disk space. If a driver is identified in the Stop message, disable the driver or check with the manufacturer for driver updates. Try changing video adapters.
Check with your hardware vendor for any BIOS updates. Disable BIOS memory options such as caching or shadowing. If you need to use Safe Mode to remove or disable components, restart your computer, press F8 to select Advanced Startup Options, and then select Safe Mode.
Technical information:
*** STOP: 0x0000007E (0C0000005, 0x81C908A2)
Collecting data for crash dump …
Initializing disk for crash dump …
Beginning dump of physical memory.
Dumping physical memory to disk: 50
The memory crash dump are usually saved in C:\WINDOWS\Minidump and C:\WINDOWS\MEMORY.DMP. I remembered many years ago when I took computing course, one of my lecturer told us Windows crash dump are very hard to analyze and we actually have to pay Microsoft to do that. I don’t know how true is that but researching on how to analyze crash dumps with Microsoft Debugging tools did show that it is not easy. Fortunately here is a tool called WhoCrashed that is able to read Windows crash dumps and roughly tells us what is causing the blue screen crash.
WhoCrashed shows the drivers which have been crashing your computer with a single click. In most cases it can pinpoint the offending drivers which have been causing misery on your computer system in the past. It does post-mortem crashdump analysis and presents all gathered information in a comprehensible way. Normally, debugging skills and a set of debugging tools are required to do post-mortem crash dump analysis. By using this utility you do not need any debugging skills to be able to find out what drivers are causing trouble to your computer.
Before start using WhoCrashed, you’ll have to make sure that Microsoft Debugging Tools for Windows has been installed. The first time you click the Analyze button, it’ll ask you to select the path to the Microsoft Debugging Tools for Windows (usually in C:\Program Files\Debugging Tools for Windows) or you can download the installer by clicking “Download the required file from Microsoft site now”.
On my Acer laptop that has Vista installed, WhoCrashed is able to determine that the crash was likely caused by usbvideo.sys. It also did advice that the crash took place in a standard Microsoft module. Likely the culprit is another driver on your system which cannot be identified. Looks like I am back to square one. So is analyzing Windows crash dump useless? Not really, on some cases it might be able to help you pinpoint the cause of the problem but definitely not all the time. One example is many years ago I was testing an exploit called IGMP nuke which is able to crash Windows XP machines by causing blue screens, lockups and automatic reboots on XP computers that don’t have SP2 installed. When that happens, Windows will create a crash dump file and I am very sure you’re not going to find any clues on what caused the crash after analyzing it.
WhoCrashed Home Edition is free and works on Windows 2000/2003/XP/Vista/2008. Resplendence Software also have a PROFESSIONAL version that cost $34.95 which can analyze crash dump on remote computers on the network and on a local dump directory of your choice. It also gives more detailed analysis of crash dumps and license not limited to use at home only.