How do I generate a memory dump manually?

KB Solution ID: KB380|Last Revised: August 14, 2015

Issue

  • ESET Customer Care has asked you to generate a memory dump file for analysis to help them resolve an issue with your computer.

Solution

Before you begin

I use Microsoft Windows 7

I use Microsoft Windows 8

I. Configure memory dump settings

  1. Press the Windows key  + R, type Control system into the Open field and click OK.

Figure 1-2

  1. Click Advanced system settings.



Figure 1-3
Click the image to view larger in new window

  1. Select the Advanced tab and click Settings in the Startup and Recovery section.



Figure 1-4

  1. The Dump file: section of the Startup and Recovery window allows you to set the location where new memory dump files are saved. The %SystemRoot% string is a Microsoft Windows variable that stands for the root directory of your Microsoft Windows installation (typically the default value is C:\Windows).

    In the Write debugging information section, you can select the type of memory dump (we recommend that you use the Complete setting, see Figure 1-4).
     
  2. Click to bookmark this article before you continue and then click OK to restart your computer. After your computer restarts, continue to part II to generate a memory dump manually.



Figure 1-5

 

II. Generate a memory dump manually

Use caution when editing the registry

Make only the edits specified below to the system registry. Unnecessary changes to the registry can negatively affect system performance.

  1. Press the Windows key + R to open a Run dialog, type regedit and click OK. If you are prompted by Windows, click Yes.
     
  2. In the Registry Editor window, expand  HKEY_LOCAL_MACHINESYSTEM CurrentControlSetServices kbdhid Parameters.

    PS/2 keyboards

    If you are using a PS/2 keyboard, expand HKEY_LOCAL_MACHINESystemCurrentControlSetServices i8042prtParameters (we are using a USB keyboard in this example, kbhid is expanded).

  1. Right-click in the right pane and select New DWORD or DWORD (32-bit value) depending on your operating system.

Figure 2-1
Click the image to view larger in new window

  1. Name the key CrashOnCtrlScroll. Type 1 into the Value data field and click OK

Figure 2-2
Click the image to view larger in new window

  1. Close Registry Editor and restart your computer.
     
  2. Once your computer has started, press and hold the right CTRL key on your keyboard (you must use the right and not the left) and then press the Scroll Lock key (located in the upper right on most keyboards) twice. The Windows forced crash dialog will run and a memory dump will be generated. Your computer may restart as a result.
     
  3. Once your computer has started, navigate to your system's root directory (C:\Windows by default) and locate the file named MEMORY.DMP. Respond to the last email from your case with ESET Customer Care and notify them that you are ready to submit your memory dump file. An ESET Customer Care agent will contact you with instructions to submit the file for analysis.

Figure 2-3
Click the image to view larger in new window

 



I. Configure memory dump settings (Windows 8)

  1. Type System on your keyboard. This will bring up the search bar. Click the System icon.

    Figure 3-1
    Click the image to view larger in new window

  2. Click Advanced system settings.

    Figure 3-2
    Click the image tov iew larger in new window

  3. Under Startup and Recovery, click Settings.

    Figure 3-3

  4. In the Write debugging information section, you can select the type of memory dump file you want to generate from the drop-down menu. We recommend that you select Complete. The Dump file field of the Startup and Recovery window allows you to set the location where new memory dump files are saved. The %SystemRoot% string is a Microsoft Windows variable that stands for the root directory of your Microsoft Windows installation (typically the default value is C:\Windows). We recommend that you leave this field as is and then bookmark this article before proceeding to the next step.
     
  5. Click OK. If prompted to restart your computer, click OK again. After your computer restarts, continue to part II to generate a memory dump manually using your keyboard.

    Figure 3-4

II. Generate a memory dump manually (Windows 8)

Use caution when editing the registry

Make only the edits specified below to the system registry. Unnecessary changes to the registry can negatively affect system performance.

  1. Type Run on your keyboard. This will open a search. Click the Run icon.

    Figure 4-1
    Click the image to view larger in new window

  2. In the Run dialog, type regedit into the blank field and click OK.

    Figure 4-2

  3. In the Registry Editor window, expand HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServiceskbdhid and double-click Parameters.

    PS/2 keyboards

    If you are using a PS/2 keyboard, expand HKEY_LOCAL_MACHINESystemCurrentControlSetServices i8042prtParameters (in this example, we are using a PS/2 keyboard).

  4. Right-click in the right pane and select NewDWORD (32-bit).

    Figure 4-3
    Click the image to view larger in new window

  5. Name the key CrashOnCtrlScroll.
     
  6. Double-click the CrashOnCtrlScroll key, type 1 into the Value data field and then click OK.

    Figure 4-4
    Click the image to view larger in new window

  7. Restart your computer.
     
  8. Once your computer has started, press and hold the right CTRL key on your keyboard (you must use the right, not the left) and then press the Scroll Lock key (located in the upper right on most keyboards) twice. The Windows forced crash dialog will run and a memory dump will be generated. Your computer may restart as a result.

    Figure 4-5
    Click the image to view larger in new window

  9. Once your computer has started, navigate to your system's root directory (C:\Windows by default) and locate the file named MEMORY.DMP. Respond to the last email from your case with ESET Customer Care and notify them that you are ready to submit your memory dump file. An ESET Customer Care agent will contact you with instructions to submit the file for analysis.

    Figure 4-6
    Click the image to view larger in new window

Rate this article:
We cannot respond to feedback from this form. Requests for assistance should be submitted through your normal support channel.