Issue

• ESET technical support has asked you to generate a memory dump file for analysis to help them resolve an issue with your computer.

Solution

1. Configure memory dump settings
2. Generate a memory dump manually

I. Configure memory dump settings

1. Press the Windows key  + R, type sysdm.cpl into the Open field and click OK.
   

   Figure 1-2

2. Select the Advanced tab and click Settings in the Startup and Recovery section.

Figure 1-3

3. The Dump file section allows you to set the location where new memory dump files are saved. The %SystemRoot% string is a Microsoft Windows variable that stands for the root directory of your Microsoft Windows installation (typically the default value is C:\Windows).

   In the Write debugging information section, you can select the type of memory dump (we recommend that you use the Complete setting, see Figure 1-4).

   Do not see the Complete memory dump option?

   If the Complete memory dump option is missing, click here for instructions.

4. Click to bookmark this article before you continue and then click OK to restart your computer. After your computer restarts, continue to part II to generate a memory dump manually.

Figure 1-4

II. Generate a memory dump manually

1. Press the Windows  key + R on your keyboard to open a Run dialog, type regedit and click OK. If you are prompted by Windows, click Yes.
2. In the Registry Editor window, expand HKEY_LOCAL_MACHINE → SYSTEM → CurrentControlSet → Services → kbdhid → Parameters.

   PS/2 keyboards

   If you are using a PS/2 keyboard, expand HKEY_LOCAL_MACHINE → System → CurrentControlSet → Services → i8042prt → Parameters (we are using a USB keyboard in this example—kbhid is expanded in Figure 2-1).

3. Right-click in the right pane and select New → DWORD or DWORD (32-bit value) depending on your operating system.

Figure 2-1
Click the image to view larger in new window

4. Name the key CrashOnCtrlScroll. Type 1 into the Value data field and click OK.

Figure 2-2
Click the image to view larger in new window

5. Close Registry Editor and restart your computer.
6. When your computer has started, wait until your issue is active or visible on the screen and then generate the dump: press and hold the right CTRL key on your keyboard (you must use the right and not the left) and then press the Scroll Lock key (located in the upper right on most keyboards) twice. The Windows forced crash dialog will run and a memory dump will be generated. Your computer may restart as a result.

7. When your computer has started, navigate to your system’s root directory (C:\Windows by default) and locate the file named MEMORY.DMP. Respond to the last email from your case with ESET technical support and notify them that you are ready to submit your memory dump file. An ESET technical support agent will contact you with instructions to submit the file for analysis.

Figure 2-3
Click the image to view larger in new window

Troubleshooting: No Complete memory dump option

1. Click Start → Run, type regedit.exe into the blank field and then click OK.
2. Use the tree to navigate to and select the following key: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\CrashControl
3. Double-click the CrashDumpEnabled data value to edit it.
4. Change the value to 1.
5. Click OK.
6. Restart the computer.

The Complete memory dump option is now enabled and can be selected from Write debugging information drop-down menu. Click here to continue from step 4 above.