Microsoft Event ID 1001

0
A Client machine restarts twice each day. After each restart the following Event is logged. Can any one assist with the cause.
Log Name:      System
Source:        Microsoft-Windows-WER-SystemErrorReporting
Date:          02/20/2014 1:16:05 PM
Event ID:      1001
Task Category: None
Level:         Error
Keywords:      Classic
User:          N/A
Computer:      SFS106
Description:
The computer has rebooted from a bugcheck. The bugcheck was: 0x000000f7 (0x808087ff74821eaf, 0x0000f8800d71840d, 0xffff077ff28e7bf2, 0x0000000000000000). A dump was saved in: C:\Windows\MEMORY.DMP. Report Id: 022014-18595-01.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
    <Provider Name="Microsoft-Windows-WER-SystemErrorReporting" Guid="{ABCE23E7-DE45-4366-8631-84FA6C525952}" EventSourceName="BugCheck" />
    <EventID Qualifiers="16384">1001</EventID>
    <Version>0</Version>
    <Level>2</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2014-02-20T18:16:05.000000000Z" />
    <EventRecordID>359136</EventRecordID>
    <Correlation />
    <Execution ProcessID="0" ThreadID="0" />
    <Channel>System</Channel>
    <Computer>SFS106</Computer>
    <Security />
</System>
<EventData>
    <Data Name="param1">0x000000f7 (0x808087ff74821eaf, 0x0000f8800d71840d, 0xffff077ff28e7bf2, 0x0000000000000000)</Data>
    <Data Name="param2">C:\Windows\MEMORY.DMP</Data>
    <Data Name="param3">022014-18595-01</Data>
</EventData>
</Event>
The dump file is located here
https://www.dropbox.com/sh/elxsx4re82vljwl/GNt5CrVVOA

DEFAULT_BUCKET_ID: GS_FALSE_POSITIVE_MISSING_GSFRAME
SECURITY_COOKIE: Expected 0000f8800d71840d found 808087ff74821eaf
BUGCHECK_STR: 0xF7
PROCESS_NAME: System
CURRENT_IRQL: 0
LAST_CONTROL_TRANSFER: from fffff8800d7057ce to fffff80003283bc0
STACK_TEXT:
fffff880`0bfd6188 fffff880`0d7057ce : 00000000`000000f7 808087ff`74821eaf 0000f880`0d71840d ffff077f`f28e7bf2 : nt!KeBugCheckEx
fffff880`0bfd6190 fffff880`0d69c269 : 00000000`0000039c fffffa80`04463010 00000000`00000000 00000000`00000000 : AE1200w764+0xa77ce
fffff880`0bfd61d0 7f7f7f7f`7f7f7f7f : 7f7f7f7f`7f7f7f7f 7f7f7f7f`7f7f7f7f 00000000`007f7f7f 00000000`00000000 : AE1200w764+0x3e269
fffff880`0bfd62a0 7f7f7f7f`7f7f7f7f : 7f7f7f7f`7f7f7f7f 00000000`007f7f7f 00000000`00000000 0169807d`00000010 : 0x7f7f7f7f`7f7f7f7f
fffff880`0bfd62a8 7f7f7f7f`7f7f7f7f : 00000000`007f7f7f 00000000`00000000 0169807d`00000010 00000002`00000066 : 0x7f7f7f7f`7f7f7f7f
fffff880`0bfd62b0 00000000`007f7f7f : 00000000`00000000 0169807d`00000010 00000002`00000066 00000000`ffffffa8 : 0x7f7f7f7f`7f7f7f7f
fffff880`0bfd62b8 00000000`00000000 : 0169807d`00000010 00000002`00000066 00000000`ffffffa8 00000000`00000000 : 0x7f7f7f
STACK_COMMAND: kb
FOLLOWUP_IP:
AE1200w764+a77ce
fffff880`0d7057ce cc int 3
SYMBOL_STACK_INDEX: 1
SYMBOL_NAME: AE1200w764+a77ce
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: AE1200w764
IMAGE_NAME: AE1200w764.sysDEBUG_FLR_IMAGE_TIMESTAMP: 4d912630
FAILURE_BUCKET_ID: X64_0xF7_MISSING_GSFRAME_AE1200w764+a77ce
BUCKET_ID: X64_0xF7_MISSING_GSFRAME_AE1200w764+a77ce
Followup: MachineOwner
AE1200w764.sys is from the NIC in the PC. It can be from various vendors (Broadcom, Linksys). Update the drivers if possible.

Similar Messages

How to Resolve Event ID 1001- Machine Blue Screen and Restart

A Client machine restarts twice each day. After each restart the following Event is logged. Can any one assist with the cause.
Log Name:      System
Source:        Microsoft-Windows-WER-SystemErrorReporting
Date:          02/20/2014 1:16:05 PM
Event ID:      1001
Task Category: None
Level:         Error
Keywords:      Classic
User:          N/A
Computer:      SFS106
Description:
The computer has rebooted from a bugcheck. The bugcheck was: 0x000000f7 (0x808087ff74821eaf, 0x0000f8800d71840d, 0xffff077ff28e7bf2, 0x0000000000000000). A dump was saved in: C:\Windows\MEMORY.DMP. Report Id: 022014-18595-01.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
    <Provider Name="Microsoft-Windows-WER-SystemErrorReporting" Guid="{ABCE23E7-DE45-4366-8631-84FA6C525952}" EventSourceName="BugCheck" />
    <EventID Qualifiers="16384">1001</EventID>
    <Version>0</Version>
    <Level>2</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2014-02-20T18:16:05.000000000Z" />
    <EventRecordID>359136</EventRecordID>
    <Correlation />
    <Execution ProcessID="0" ThreadID="0" />
    <Channel>System</Channel>
    <Computer>SFS106</Computer>
    <Security />
</System>
<EventData>
    <Data Name="param1">0x000000f7 (0x808087ff74821eaf, 0x0000f8800d71840d, 0xffff077ff28e7bf2, 0x0000000000000000)</Data>
    <Data Name="param2">C:\Windows\MEMORY.DMP</Data>
    <Data Name="param3">022014-18595-01</Data>
</EventData>
</Event>

Moving the thread to the 'Where is the forum for...?' forum
Noel Paton | Nil Carborundum Illegitemi
CrashFixPC |
The Three-toed Sloth
No - I do not work for Microsoft, or any of its contractors.

Event ID 1001 Bug check Occurred, After updation of Kaspersky Windows 7

Hi,
Recently I have updated my Anti Virus Kaspersky 10 on my Windows 7 Ultimate System 32 bit. After that it restart automatically again and again. Then i restore it on Last known good configuration. It resolve the issue. In event viewr i found out the
Error 1001 Bug check ..
I exactly want to know that what happened to my system . For this How can i send my dmp files to support team .
I have face the problem non my multiple systems but not all .. .
Please guide me asap .

The following log occurred
The computer has rebooted from a bugcheck. The bugcheck was: 0x000000c9 (0x0000024d, 0x9047b25a, 0x8d5ed0b8, 0x00000000). A dump was saved in: C:\Windows\MEMORY.DMP. Report Id: 041714-22230-01.
when i run verifier.exe
and select " Create standard Setting" then select "Automatically select drivers build for older version of windows" and press Next
it display the Kl1.sys driver
what does it means .. is there any problem with this file?

Event ID 1001 Server 2008 R2 Windows Update not working

Windows update fails with error code 80072EFE. I have ran rootkiller and malicious software removal tool from microsoft. Still no luck.

Hi,
I suggest trying the following steps to troubleshoot this issue:
Step 1 Reset proxy (for LAN connection)
=========================
Remove invalid characters from the proxy exception list and then clear the proxy cache.
1. Open Internet Explorer.
2. In the Tools menu, select Internet Options.
3. Click on the Connections tab.
4. Click on the LAN Settings.
5. Clear the entries in "Use automatic configuration script" and uncheck "Automatically detect settings."
6. Click on the Advanced button.
7. Please delete any entry in the Exceptions section,
8. Click OK, and return to the previous window. Uncheck "Use Proxy Server for your LAN", and click OK to accept the changes.
9. Quit Internet Explorer.
Next, clear your proxy cache.
Step 2 Reset Proxy Cache
================
1. Click the Start Button, click "All programs", and click "Accessories".
2. Right-click "Command Prompt", and click "Run as administrator". If you are prompted for an administrator password or confirmation, type the password or provide confirmation.
3. Type "netsh winhttp reset proxy" (without quotes) at the command prompt, and press Enter.
Step 3 Clean Boot
===========
1. Click the Start Button, type "msconfig" in the search bar and press Enter.
Note: Please click the Continue if the "User Account Control" window pops up.
2. Click the "Services" tab, check the "Hide All Microsoft Services" box and click "Disable All" (if it is not gray).
3. Click the "Startup" tab, click "Disable All" and click "OK".
Then, restart the computer. When the "System Configuration Utility" window appears, please check the "Don't show this message or launch the System"
4. Test if we can update the system in Clean Boot.
Note 1: Temporarily disabling the Startup Group only prevents the startup programs from loading at startup. This shouldn't affect the system or other programs. We may still manually
run these programs later.
Note 2: We can check on Normal Startup in the General tab to roll back to Normal Mode after we get this issue resolved.
If the issue persists, please help collect the following files:
WindowsUpdate.log
============
1. Click Start, type: %windir% and press OK.
2. Locate a file named "WindowsUpdate.log".
System Information
============
1. Click Start, type in "MSINFO32" and press Enter to start System Information.
2. On the popup window, on the menu bar, click File, and click Save to save it as an NFO file, such as system.nfo.
Please upload the above files to
https://sftus.one.microsoft.com/choosetransfer.aspx?key=1681d4f9-7a0d-4b8e-bd8e-6d56f211397b
Password: a{BWaSOC!1CyX3Q
Tim Quan

Event 1001 Bug Check Windows 7 Ultimate 64-bit

Log Name: System
Source: Microsoft-Windows-WER-SystemErrorReporting
Date: 1/17/2014 6:56:51 PM
Event ID: 1001
Task Category: None
Level: Error
Keywords: Classic
User: N/A
Computer: KT-PC
Description:
The computer has rebooted from a bugcheck. The bugcheck was: 0x00000019 (0x0000000000000003, 0xfffff8a0245c2580, 0xfffff8a0245c2580, 0x73634946030c030c). A dump was saved in: C:\Windows\MEMORY.DMP. Report Id: 011714-30997-01.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-WER-SystemErrorReporting" Guid="{ABCE23E7-DE45-4366-8631-84FA6C525952}" EventSourceName="BugCheck" />
<EventID Qualifiers="16384">1001</EventID>
<Version>0</Version>
<Level>2</Level>
<Task>0</Task>
<Opcode>0</Opcode>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime="2014-01-17T23:56:51.000000000Z" />
<EventRecordID>389585</EventRecordID>
<Correlation />
<Execution ProcessID="0" ThreadID="0" />
<Channel>System</Channel>
<Computer>KT-PC</Computer>
<Security />
</System>
<EventData>
<Data Name="param1">0x00000019 (0x0000000000000003, 0xfffff8a0245c2580, 0xfffff8a0245c2580, 0x73634946030c030c)</Data>
<Data Name="param2">C:\Windows\MEMORY.DMP</Data>
<Data Name="param3">011714-30997-01</Data>
</EventData>
</Event>

We do need the actual DMP file as it contains the only record of the sequence of events leading up to the crash, what drivers were loaded, and what was responsible.
We prefer at least 2 DMP files to spot trends and confirm the cause.
Please follow our instructions for finding and uploading the files we need to help you fix your computer. They can be found here
If you have any questions about the procedure please ask
Please provide us with your Event Viewer administrative logs by following these steps:
Click Start Menu
Type eventvwr into Search programs and files (do not hit enter)
Right click eventvwr.exe and click Run as administrator
Expand Custom Views
Click Administrative Events
Right click Administrative Events
Save all Events in Custom View As...
Save them in a folder where you will remember which folder and save as Errors.evtx
Go to where you saved Errors.evtx
Right click Errors.evtx -> send to -> compressed (zipped) folder
Upload the .zip file to skydrive or a file sharing service and put a link to it in your next post
If you have updated to win 8.1 and you get the error message "the system cannot find the file specified" it is a known problem. The
work around is to edit the registry. If you are not comfortable doing this DONT. If you are, backup the key before you do
Press Win+"R" and input regedit
Navigate to:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels. Delete "Microsoft-Windows-DxpTaskRingtone/Analytic"
Wanikiya and Dyami--Team Zigzag

Dell e6420 win 7 ent 64 bit - error source corrected machine check event id 19

I have a user that is getting this error before it BSOD
any help would be great
Log Name:      System
Source:        Microsoft-Windows-WHEA-Logger
Date:          1/23/2014 10:33:22 AM
Event ID:      19
Task Category: None
Level:         Warning
Keywords:
User:          LOCAL SERVICE
Computer:      EEXO1209.ga.local
Description:
A corrected hardware error has occurred.
Reported by component: Processor Core
Error Source: Corrected Machine Check
Error Type: Internal parity error
Processor ID: 0
The details view of this entry contains further information.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
    <Provider Name="Microsoft-Windows-WHEA-Logger" Guid="{C26C4F3C-3F66-4E99-8F8A-39405CFED220}" />
    <EventID>19</EventID>
    <Version>0</Version>
    <Level>3</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8000000000000000</Keywords>
    <TimeCreated SystemTime="2014-01-23T15:33:22.370702000Z" />
    <EventRecordID>48325</EventRecordID>
    <Correlation ActivityID="{E060A63B-4EF5-45A1-9890-F70EF86F85EF}" />
    <Execution ProcessID="1544" ThreadID="5756" />
    <Channel>System</Channel>
    <Computer>EEXO1209.ga.local</Computer>
    <Security UserID="S-1-5-19" />
</System>
<EventData>
    <Data Name="ErrorSource">1</Data>
    <Data Name="ApicId">0</Data>
    <Data Name="MCABank">0</Data>
    <Data Name="MciStat">0xd000070000010005</Data>
    <Data Name="MciAddr">0x0</Data>
    <Data Name="MciMisc">0x0</Data>
    <Data Name="ErrorType">12</Data>
    <Data Name="TransactionType">256</Data>
    <Data Name="Participation">256</Data>
    <Data Name="RequestType">256</Data>
    <Data Name="MemorIO">256</Data>
    <Data Name="MemHierarchyLvl">256</Data>
    <Data Name="Timeout">256</Data>
    <Data Name="OperationType">256</Data>
    <Data Name="Channel">256</Data>
    <Data Name="Length">864</Data>
    <Data Name="RawData">435045521002FFFFFFFF030002000000020000006003000014210F0017010E140000000000000000000000000000000000000000000000000000000000000000BDC407CF89B7184EB3C41F732CB57131B18BCE2DD7BD0E45B9AD9CF4EBD4F8904FA21AD63618CF0100000000000000000000000000000000000000000000000058010000C00000000102000001000000ADCC7698B447DB4BB65E16F193C4F3DB0000000000000000000000000000000002000000000000000000000000000000000000000000000018020000400000000102000000000000B0A03EDC44A19747B95B53FA242B6E1D0000000000000000000000000000000002000000000000000000000000000000000000000000000058020000080100000102000000000000011D1E8AF94257459C33565E5CC3F7E80000000000000000000000000000000002000000000000000000000000000000000000000000000057010000000000000002080000000000A70602000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000003000000000000000000000000000000A706020000081000FFE3BA1FFFFBEBBF00000000000000000000000000000000000000000000000000000000000000000100000001000000268D21725018CF0100000000000000000000000000000000000000000000000005000100000700D0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000</Data>
</EventData>
</Event>
Log Name:      System
Source:        Microsoft-Windows-WER-SystemErrorReporting
Date:          1/23/2014 10:36:44 AM
Event ID:      1001
Task Category: None
Level:         Error
Keywords:      Classic
User:          N/A
Computer:      EEXO1209
Description:
The computer has rebooted from a bugcheck. The bugcheck was: 0x0000003b (0x00000000c0000005, 0x0000000000000000, 0xfffff88009795e40, 0x0000000000000000). A dump was saved in: C:\windows\MEMORY.DMP. Report Id: 012314-28516-01.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
    <Provider Name="Microsoft-Windows-WER-SystemErrorReporting" Guid="{ABCE23E7-DE45-4366-8631-84FA6C525952}" EventSourceName="BugCheck" />
    <EventID Qualifiers="16384">1001</EventID>
    <Version>0</Version>
    <Level>2</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2014-01-23T15:36:44.000000000Z" />
    <EventRecordID>48342</EventRecordID>
    <Correlation />
    <Execution ProcessID="0" ThreadID="0" />
    <Channel>System</Channel>
    <Computer>EEXO1209</Computer>
    <Security />
</System>
<EventData>
    <Data Name="param1">0x0000003b (0x00000000c0000005, 0x0000000000000000, 0xfffff88009795e40, 0x0000000000000000)</Data>
    <Data Name="param2">C:\windows\MEMORY.DMP</Data>
    <Data Name="param3">012314-28516-01</Data>
</EventData>
</Event>

Hi,
To find the culprit, we need to analysis the dumpfile (C:\Windows\Minidump folder ).
Please use Windows Live SkyDrive (http://www.skydrive.live.com/) to upload the dump files to a public folder and share the URLs with us.
If you want to debug dump files by yourself, refer to that:
http://support.microsoft.com/kb/315263
For WHEA error 19 and 1001, please refer the links below:
Event ID: 19 occurs on Windows Server 2008 or Windows Vista Service Pack 1-based computers that use Intel Nehalem processors
http://support.microsoft.com/kb/961080
That should apply to Windows 7 too.
"0x0000003B" Stop error occurs in Windows Server 2008 R2 and in Windows 7 when an application or a service performs a GUI-related operation
http://support.microsoft.com/kb/2359223/en-us
Also the links below about error 19 and 1001 may be helpful to you:
http://www.eventid.net/display.asp?eventid=19&eventno=9845&source=Microsoft-Windows-WHEA-Logger&phase=1
http://www.eventid.net/display-eventid-1001-source-Microsoft-Windows-WER-SystemErrorReporting-eventno-10481-phase-1.htm
Please Note: Since the website is not hosted by Microsoft, the link may change without notice. Microsoft does not guarantee the accuracy of this information.
Please also update the BIOS and the display card driver to check the issue first.
Then check the memory.
Diagnosing memory problems on your computer
http://windows.microsoft.com/en-us/windows7/Diagnosing-memory-problems-on-your-computer
Hope it helps.
Regards,
Blair Deng
Blair Deng
TechNet Community Support

Oracle Database Inserts Via Microsoft Data Transformation Services (DTS)

This question involves a SQL Server database and an Oracle database. The databases reside on different servers. One of our developers periodically uses Microsoft DTS (Data Transformation Services) to read data from a SQL Server database and insert it into an Oracle database. Normally the job runs once a day and reportedly inserts about 20,000 rows. The job usually runs fine. About a month ago execution of the daily job was suspended. Two days ago the developer ran a job to select and insert nine days of information. He estimated that 80,000 rows would be inserted. The job cancelled after twenty-three minutes when it filled up the 512 MB UNDO tablespace. (FYI, we use automatic UNDO management.) At the point of failure the number of active sessions spiked sharply in the Oracle database because of system I/O waits (log file parallel write, db file parallel write, and control file parallel write). The number of active sessions also spiked sharply in three other Oracle databases whose files reside on the same array of disk drives. Most of those sessions were waiting on commits (log file sync). The spikes lasted for one minute or less. Grid Control’s performance monitor shows that sqlservr.exe is the module being executed when the UNDO tablespace fills up. We ran the job a second time and closely monitored it, watching the amount of UNDO space grow until it used all 512 MB available. The symptoms described above for the first cancellation were repeated in the second cancellation.
We reran the job by processing a single day’s worth of information and that ran fine. Then we ran it for two days of information, then for six days of information. Everything ran fine. During those tests no more than 70 MB of space of UNDO were used.
Our developer reported that last week he ran the job for nine days of information, the same amount as the job that cancelled twice today. He estimates that it ran for about 80 minutes and went to a normal end-of-job.
Can anyone here offer an explanation of why we seem to be getting these varied demands for space in the UNDO tablespace? Do you know if Microsoft DTS issues a commit after each insert or only a single commit at the end-of-job?
Thank you,
Bill

Hi Arthur,
Yes both instances are same.
Microsoft SQL Server 2008 R2 (SP2) - 10.50.4263.0 (X64) Aug 23 2012 15:56:56 Copyright (c) Microsoft Corporation Enterprise Edition (64-bit) on Windows NT 6.1 <X64> (Build 7601: Service Pack 1) (Hypervisor)
I have run the Main package using the using SQL Agent, main package calls the child packages.
The error message shown on SQL agent job is:
R6025 - pure virtual function call. The return value was unknown. The process exit code was 255.
or sometimes
The step did not generate any output. The return value was unknown. The process exit code was -532459699.
in the even log it says:
Error Level:
Event ID 1000
Faulting application name: DTExec.exe, version: 2009.100.4263.0, time stamp: 0x5036ba73
Faulting module name: DTSPipeline.dll, version: 2009.100.4263.0, time stamp: 0x5036ba53
Exception code: 0x40000015
Fault offset: 0x00000000000a33c5
Faulting process id: 0x98c
Faulting application start time: 0x01cf64ba9b72b27c
Faulting application path: C:\Program Files\Microsoft SQL Server\100\DTS\Binn\DTExec.exe
Faulting module path: C:\Program Files\Microsoft SQL Server\100\DTS\Binn\DTSPipeline.dll
Report Id: e8eb9b4f-d0ad-11e3-babd-005056997b14
Information Level:
Windows error reporting Event ID 1001
Fault bucket , type 0
Event Name: APPCRASH
Response: Not available
Cab Id: 0
Problem signature:
P1: DTExec.exe
P2: 2009.100.4263.0
P3: 5036ba73
P4: DTSPipeline.dll
P5: 2009.100.4263.0
P6: 5036ba53
P7: 40000015
P8: 00000000000a33c5
P9:
P10:
Attached files:
These files may be available here:
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_DTExec.exe_ccc7a4e176faafbea69955957371ea96e175b_44c41e3e
Analysis symbol:
Rechecking for solution: 0
Report Id: e8eb9b4f-d0ad-11e3-babd-005056997b14
Report Status: 4

Event Type: CLR20r3 Signature Problem: P4:mscorlib.dll P9:System.FormatException

Hello, I'm working on a C#.net app.This is a machine interfacing software , where we use it to control the machine by interacting with it through hardware.The software works fine on all the machines that we have in our company, but fails to open on client's machine.We have Windows XP, Windows 7 (32-bit as well as 64-bit) and the s/w just works smoothly with all of them.Tried checking event log and found this:Log Name: Application
Source : Windows Error Reporting
Date: 30/10/2014 3:07:59 p.m.
Event ID : 1001
Task Category : None
Level : Information
Keywords: Classic
User: N / A
Computer: Pro01PC14101401
Description:
Container 123123135 error type 22
Event Name : Event clr20r3 by Name: clr20r3
Answer: Not available Answer : Not available
CAB ID : 0
Signature of the problem:
P1: vms.exe
P2: 1.2.0.2
P3: 5413cdea
P4: mscorlib
P5: 2.0.0.0
P6: 53a12268
P7: c44
P8: 59
P9 : System.FormatException
P10 :
Attachments:
C: \ Users \ PRO01 \ AppData \ Local \ Temp \ WERB9F0.tmp.WERInternalMetadata.xml
These files may be available here:
C:\Users\Pro01\AppData\Local\Microsoft\Windows\WER\ReportArchive\AppCrash_vms.exe_94a436e347f991c21f9b4ed832169b677b88870_0e18144f
Analysis symbol :
New search solution : 0
Report ID : 18edc5d1-603e - 11e4-90e2-74d435f64282
Report Status : 0PLEASE NOTE: THE OS is WINDOWS 7 and IS IN FRENCH LANGUAGE AT CLIENT'S MACHINE WHEREAS WE ARE USING ENGLISH VERSION IN OUR COMPANY. Will it create any problems OR can it be something else?Please Help.

@Niranjan_v ，
I forget to ask whether your client machine means only one machine have this error?
If you have the problem on a specific machine, then please use this tool
.NET
Framework Setup Verification Tool User's Guide - Aaron Stebner's WebLog - Site
Home - MSDN Blogs
Please run this tool and choose .NET Framework 3.5 from program list of the tool and give us the output of this tool. The last few lines will tell you whether the machine has installed .NET 3.5 successfully or not. If verification failed, try use sfc /scannow
to repair this system component.
If you have this problem on more than one client machine. Then you may need to check whether you missed some package on your client machine. Or there are some software prevent your application to install.
Regards,
Barry
We are trying to better understand customer views on social support experience, so your participation in this interview project would be greatly appreciated if you have time. Thanks for helping make community forums a great place.
Click
HERE to participate the survey.

BSOD BugCheck 1001 Three Times In Three Days

I apologize for making yet another topic on this same issue but I'm not that big on reading .dmp files, and you folks know what's what better than I do.
I did a fresh installation of Windows 7 about a week ago but now - for the first time since forever - I've been getting bluescreens.
Here's the dump file:
https://onedrive.live.com/redir?resid=9FCFB68E12F1D23F!172&authkey=!AFIgTUizGz9k_iY&ithint=file%2c.dmp
And here's the mess from event viewer:
Log Name:      System
Source:        Microsoft-Windows-WER-SystemErrorReporting
Date:          2.6.2014 11:11:46
Event ID:      1001
Task Category: None
Level:         Error
Keywords:      Classic
User:          N/A
Computer:      Monocube
Description:
The computer has rebooted from a bugcheck. The bugcheck was: 0x000000f4 (0x0000000000000003, 0xfffffa8007e1ab30, 0xfffffa8007e1ae10, 0xfffff80002d81270). A dump was saved in: C:\Windows\MEMORY.DMP. Report Id: 060214-4508-01.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
    <Provider Name="Microsoft-Windows-WER-SystemErrorReporting" Guid="{ABCE23E7-DE45-4366-8631-84FA6C525952}" EventSourceName="BugCheck" />
    <EventID Qualifiers="16384">1001</EventID>
    <Version>0</Version>
    <Level>2</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2014-06-02T08:11:46.000000000Z" />
    <EventRecordID>4150</EventRecordID>
    <Correlation />
    <Execution ProcessID="0" ThreadID="0" />
    <Channel>System</Channel>
    <Computer>Monocube</Computer>
    <Security />
</System>
<EventData>
    <Data Name="param1">0x000000f4 (0x0000000000000003, 0xfffffa8007e1ab30, 0xfffffa8007e1ae10, 0xfffff80002d81270)</Data>
    <Data Name="param2">C:\Windows\MEMORY.DMP</Data>
    <Data Name="param3">060214-4508-01</Data>
</EventData>
</Event>

Thanks for the quick reply! And thanks for the advice.
I uninstalled Crosair Link as you suggested. Really wasn't using it for anything else than keeping the fans quiet. I think BIOS lets me do it also anyway.
I also ran Chkdsk and it gave a generally positive results as far as I can tell. Thanks for telling me how to create a log file of it. I was wondering how it's done.
TimeCreated : 2.6.2014 14:16:13
Message     :
              Checking file system on C:
              The type of the file system is NTFS.
              A disk check has been scheduled.
              Windows will now check the disk.
              CHKDSK is verifying files (stage 1 of 5)...
                280320 file records processed.
              File verification completed.
                1161 large file records processed.
                0 bad file records processed.
                20098 EA records processed.
                76 reparse records processed.
              CHKDSK is verifying indexes (stage 2 of 5)...
                389772 index entries processed.
              Index verification completed.
                0 unindexed files scanned.
                0 unindexed files recovered.
              CHKDSK is verifying security descriptors (stage 3 of 5)...
                280320 file SDs/SIDs processed.
              Cleaning up 1921 unused index entries from index $SII of file 0x9
              Cleaning up 1921 unused index entries from index $SDH of file 0x9
              Cleaning up 1921 unused security descriptors.
              Security descriptor verification completed.
                54727 data files processed.
              CHKDSK is verifying Usn Journal...
                35608072 USN bytes processed.
              Usn Journal verification completed.
              CHKDSK is verifying file data (stage 4 of 5)...
                280304 files processed.
              File data verification completed.
              CHKDSK is verifying free space (stage 5 of 5)...
                41242452 free clusters processed.
              Free space verification is complete.
              CHKDSK discovered free space marked as allocated in the
              master file table (MFT) bitmap.
              CHKDSK discovered free space marked as allocated in the volume bi
              tmap.
              Windows has made corrections to the file system.
               244196351 KB total disk space.
                78678284 KB in 223557 files.
                  158216 KB in 54728 indexes.
                       0 KB in bad sectors.
                  390039 KB in use by the system.
                   65536 KB occupied by the log file.
               164969812 KB available on disk.
                    4096 bytes in each allocation unit.
                61049087 total allocation units on disk.
                41242453 allocation units available on disk.
              Internal Info:
              00 47 04 00 17 3f 04 00 59 4f 08 00 00 00 00 00 .G...?..YO......
              c3 01 00 00 4c 00 00 00 00 00 00 00 00 00 00 00 ....L...........
              00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
              Windows has finished checking your disk.
              Please wait while your computer restarts.
Seatools also returned PASS on every test except the ones you said not to do. I also ran system file checker and there were no errors.
For now it seems like everything is a-ok. But don't lock this thread or however it works just yet, in case things go south again.
Thank you again for your help.

Bug Check Error on Exchange 2013: Microsoft-Windows-WER-SystemErrorReporting

This is the error which prompted the server to reboot:
Log Name:      System
Source:        Microsoft-Windows-WER-SystemErrorReporting
Date:          3/1/2015 9:27:00 PM
Event ID:      1001
Task Category: None
Level:         Error
Keywords:      Classic
User:          N/A
Computer:      exch13-02.domain.com
Description:
The computer has rebooted from a bugcheck. The bugcheck was: 0x000000ef (0xffffe000f9bfc080, 0x0000000000000000, 0x0000000000000000, 0x0000000000000000). A dump was saved in: C:\Windows\MEMORY.DMP. Report Id: 030115-27921-01.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
    <Provider Name="Microsoft-Windows-WER-SystemErrorReporting" Guid="{ABCE23E7-DE45-4366-8631-84FA6C525952}" EventSourceName="BugCheck" />
    <EventID Qualifiers="16384">1001</EventID>
    <Version>0</Version>
    <Level>2</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2015-03-02T05:27:00.000000000Z" />
    <EventRecordID>36389</EventRecordID>
    <Correlation />
    <Execution ProcessID="0" ThreadID="0" />
    <Channel>System</Channel>
    <Computer>exch13-02.SC.ESILICON.com</Computer>
    <Security />
</System>
<EventData>
    <Data Name="param1">0x000000ef (0xffffe000f9bfc080, 0x0000000000000000, 0x0000000000000000, 0x0000000000000000)</Data>
    <Data Name="param2">C:\Windows\MEMORY.DMP</Data>
    <Data Name="param3">030115-27921-01</Data>
</EventData>
</Event>

Hi,
It seems like a Windows Server problem, not an Exchange Server problem.
What’s the version of your Windows Server and Exchange Server?
Similar thread:
https://social.technet.microsoft.com/Forums/en-US/f132d246-7114-4223-9ff7-e72f3ade0708/exchange-server-2013-restarts-frequently-after-cumulative-update-3-is-installed?forum=exchangesvradmin
Best Regards.
Please remember to mark the replies as answers if they help, and unmark the answers if they provide no help. If you have feedback for TechNet Support, contact [email protected]
Lynn-Li
TechNet Community Support

How does one clear Custom Views (Administrative Events) in the Event Viewer?

Windows Logs and Applications and Services Logs have a "clear log" option; however, I am puzzled how to edit/delete Administrative Events?Eighter from Decatur, county seat of Wise (of course it's in Texas)

Ronnie Vernon said: Hi p010ne
The Custom View / Administrative Events is a compilation of all the other event logs in the Event Viewer.
Entries in this log will be removed when the log where the event originated from is cleared.
Hope this helps.
Ronnie Vernon MVP
I thought that was the case; however, I cleared all the other logs! This is an example of an entry in this log: Log Name: Microsoft-Windows-Dhcpv6-Client/AdminSource: Microsoft-Windows-DHCPv6-Client
Date: 1/17/2009 7:52:33 AM
Event ID: 1001
Task Category: Address Configuration State Event
Level: Error
Keywords:
User: LOCAL SERVICE
Computer: Windows7
Description:
Your computer was not assigned an address from the network (by the DHCP Server) for the Network Card with network address 0x000129F558C5. The following error occurred: 0x79. Your computer will continue to try and obtain an address on its own from the network address (DHCP) server.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
   <Provider Name="Microsoft-Windows-DHCPv6-Client" Guid="{6A1F2B00-6A90-4C38-95A5-5CAB3B056778}" />
   <EventID>1001</EventID>
   <Version>0</Version>
   <Level>2</Level>
   <Task>3</Task>
   <Opcode>74</Opcode>
   <Keywords>0x8000000000000000</Keywords>
   <TimeCreated SystemTime="2009-01-17T13:52:33.858398400Z" />
   <EventRecordID>202</EventRecordID>
   <Correlation />
   <Execution ProcessID="1088" ThreadID="864" />
   <Channel>Microsoft-Windows-Dhcpv6-Client/Admin</Channel>
   <Computer>Windows7</Computer>
   <Security UserID="S-1-5-19" />
  </System>
  <EventData>
   <Data Name="HWLength">6</Data>
   <Data Name="HWAddress">000129F558C5</Data>
   <Data Name="StatusCode">121</Data>
  </EventData>
</Event>
When I search for "Microsoft-Windows-DHCPv6-Client" I do not find that file?
OK, I found the entrys in the Microsoft section (DHCPv6-Client) and am able to clear them there!
Eighter from Decatur, county seat of Wise (of course it's in Texas)

Error while running Profile synchronization (Event ID: 6398)

Hi,
We had our User Profile Synchronization service in stopped state for quite some time due to our SQL server having "Named Instance". Since RTM version had this compatibility issue, I patched my farm with SP2 + FEB 2014 CU.
Now the "User Profile Synchronization Service" is running (I started it and now it was a success). However when I start the Profile sync job (either INC or FULL), it fails. This is the error I get:
The Execute method of job definition Microsoft.Office.Server.UserProfiles.UserProfileImportJob (ID c10650ed-0935-47a5-b3ce-a307c576ad9a) threw an exception. More information is included below.
Operation is not valid due to the current state of the object.
Log Name: Application
Source: Microsoft-SharePoint Products-SharePoint Foundation
Date: 6/25/2014 3:47:16 AM
Event ID: 6398
Task Category: Timer
Level: Critical
Keywords:
User: ST\sps02-svc
Computer: EMEA-MOSS1.st.stroot.local
Description:
The Execute method of job definition Microsoft.Office.Server.UserProfiles.UserProfileImportJob (ID c10650ed-0935-47a5-b3ce-a307c576ad9a) threw an exception. More information is included below.
Operation is not valid due to the current state of the object.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-SharePoint Products-SharePoint Foundation" Guid="{6FB7E0CD-52E7-47DD-997A-241563931FC2}" />
<EventID>6398</EventID>
<Version>14</Version>
<Level>1</Level>
<Task>12</Task>
<Opcode>0</Opcode>
<Keywords>0x4000000000000000</Keywords>
<TimeCreated SystemTime="2014-06-25T03:47:16.577398600Z" />
<EventRecordID>484089</EventRecordID>
<Correlation ActivityID="{A6F9E131-4925-4889-A759-5F873C4B2E74}" />
<Execution ProcessID="9140" ThreadID="7372" />
<Channel>Application</Channel>
<Computer>EMEA-MOSS1.st.stroot.local</Computer>
<Security UserID="S-1-5-21-1058282146-1732951074-3797079023-18290" />
</System>
<EventData>
<Data Name="string0">Microsoft.Office.Server.UserProfiles.UserProfileImportJob</Data>
<Data Name="string1">c10650ed-0935-47a5-b3ce-a307c576ad9a</Data>
<Data Name="string2">Operation is not valid due to the current state of the object.</Data>
</EventData>
</Event>
Here are the observations:
- User Profile Synchronization Service - Running
- User Profile Service - Running
- Both FIMS - Running
- On User Profile Service Application page, I see "User Profile Sync is not currently provisioned."
- If I go in for "Configure Sync Connections" I see --- The query returns nothing.
- On clicking "Create new connection" I get this error:
What could be wrong now?

Clear the file system cache on all servers in the server farm on which the Windows SharePoint Services Timer service is running. Please refer to the following link:
http://ahmedmadany.wordpress.com/2011/05/08/user-profile-service-an-update-conflict-has-occurred-and-you-must-re-try-this-action/
Make sure that the SharePoint Farm account, which is created during the SharePoint Farm setup, is a member of the local Administrators group where the User Profile Synchronization service is deployed.
Make sure that the SharePoint Farm account is able to log on locally on the server where User Profile Synchronization is deployed.
More information are provided in the link below:
http://www.sysadminsblog.com/microsoft/user-profile-service-an-update-conflict-has-occurred-and-you-must-re-try-this-action/
http://www.sysadminsblog.com/microsoft/event-6398-microsoft-sharepoint-administration-spsqmtimerjobdefinition-exception/
If this helped you resolve your issue, please mark it Answered

Bug: Microsoft.Diagnostics.Tracing.EventSource fails to generate manifest when using a byte enum.

Not sure where to post issues with this library, so I'm trying here.
This problem occurs with both
Microsoft Event Source Library 1.0.26 and the latest pre-release
Microsoft EventSource Library 1.1.13-beta
When building the following program an error occurs during manifest generation.
public enum MyEnum : byte
One,
Two,
Three
[EventSource(Name = "My-EventSource")]
public sealed class MyEventSource : EventSource
[Event(1, Channel = EventChannel.Admin, Message = "My value: {0}")]
public void MyEvent(MyEnum myEnum)
WriteEvent(1, myEnum);
error : MSXML Schema Validation Error 0xc00ce16a. At Line=13, Column=56, Union doesn't support this value.
If I change the enum type to have "Int32" as its underlying type however, everything works as expected.

Hello Peter,
>>error : MSXML Schema Validation Error 0xc00ce16a. At Line=13, Column=56, Union doesn't support this value.
For this issues, it seems to be caused by the eventRegister.exe which is installed with the Microsoft.Diagnostics.Tracing.EventSource 1.0.26, because if I use the System.Diagnostics.Tracing namespace instead, it works fine even with the byte. I think
the team might have changed its insider implementation(I am not sure since the package on nuget is not open).
My suggestion for this issue is that you could post this feedback to the site below:
https://connect.microsoft.com/VisualStudio/Feedback
Regards.
We are trying to better understand customer views on social support experience, so your participation in this interview project would be greatly appreciated if you have time. Thanks for helping make community forums a great place.
Click
HERE to participate the survey.

DEP and Event error

I have recently (within the last 24) gotten a problem with skype where upon logging in and attempting to call someone it crashes and Data Execution Prevention says it closed it, up until now i have not had this problem, ive attempted reinstall twice deleted appdata three times and disabled updates all to no avail.
Upon inspection of microsoft event viewer i notice the error:
Faulting application Skype.exe, version 6.21.0.104, time stamp 0x542bca1d, faulting module unknown, version 0.0.0.0, time stamp 0x00000000, exception code 0xc0000005, fault offset 0x0f0dbc18, process id 0x15ac, application start time 0x01cff244703aa8bd.
Im confused as to what it should be ive done all the scans i can using Avira my antivirus on hi heuristics and i can say with utmost certinty that its not a virus i am very thorugh and sceptical when it comes to things i download, i will also note that the event viewer has multiple errors linked to updating and it says that updating times out eventually.

Please, run the DirectX diagnostics tool (32-bit version).
Go to Windows Start and in the Run box type dxdiag.exe and press the OK button. This will start the DirectX diagnostics program. Run this diagnostics and save the results to a file. Please, attach this file to your post.
Be aware that you will have to zip this file before attaching it here.

Is there a list of 'Event Log' enteries that I sho...

Hi,
I was looking through a few of the posts on here and noticed posts about event logs on the BT HomeHub.
I was wondering if there is a list of specific 'Event Log' enteries that I should be aware of that could be malicious activity?
If there is specific enteries that could be malicious activity is there a way of using Microsoft 'Event Viewer' of 'System Monitor' to send me a message when this malicious activity is taking place?
Also I noticed on my laptop that when I was looking in WiFi Status that there was a massive difference in the bytes sent and recieved. I think it was something like 600,000 sent and 6000,000 recieved. I looked in the BT HomeHub Event Log and there was a load of enteries for the following:
11:41:42,12 Feb. PortMapping Delete By UPNP/TR064 Success.
11:41:02,12 Feb. PortMapping Add By UPNP/TR064 Success.
The only thing I've done recently is install WAMP for a local test server to view website being designed in PHP. I wanted to view the websites on my other devices so I allowed WAMP through my microsoft firewall. I have dissalowed WAMP through the firewall now and the PortMapping messsages in BT HomeHub Event Log have seemed to have stopped.

Disable uPnP, restart the hub, and the entries should stop. Then see if any programs you have installed, stop working properly.
If everything works as normal, then leave uPnP disabled.
Quote
"Is there anyway of setting up Microsoft ‘Event Viewer’ or ‘System Monitor’ to flag up this malicious activity and send me a message to make me aware of these?"
No, but I would not worry about them, as the home hub firewall is there to preven intrusions.
There are some useful help pages here, for BT Broadband customers only, on my personal website.
BT Broadband customers - help with broadband, WiFi, networking, e-mail and phones.

Microsoft Event ID 1001

Similar Messages

Maybe you are looking for