I will be surfing the internet and my computer reboots. When it comes back up, there is an error message in a "Microsoft Windows" box. It has some BCCode errors at the top (BCCode: 100000d1 etc ending in Product: 256_1).
The reporting details say: This error report includes: information regarding the condition of Microsoft Windows when teh problem occured, the operating system version and computer hardware in use, and the Internet Protocol (IP) address of your computer.
It is doing a dump to a WERab64.dir00 subdirectory in the temp subdirectory under the locall settings of my documents and settings.
Does anyone know what is causing this or how I can fix?
Thanks!
This Question has been solved and asker verified All Experts Exchange premium technology solutions are available to subscription members.
Experts Exchange has been collecting answers to technology questions since 1996…3 million and counting! If you have a question, chances are we already have your answer.
If you can't find the exact answer you're looking for, ask our exclusive community of 50,000 experts. You’ll get a personalized answer from a trusted professional.
Thousands of free tech tips, tricks, how-to’s and tutorials are available in our peer reviewed articles section. See for yourself how smart our experts are, no login required.
Save solutions to your questions, answers you’ve discovered through searching plus helpful articles in your personal knowledgebase for easy future access.
Access the answers to your technology questions today.
30-day free trial. Register in 60 seconds.
Members of the expert community talk about why the experience at Experts Exchange is different than what you will find anywhere else.
Try it out and discover for yourself.
30-day free trial. Register in 60 seconds.
Join the community of experts here and help other tech pros by answering question in your area of expertise. You can earn FREE access to all Experts Exchange's premium features and resources.
Also might be a drivers issue. Right click on your My Computer, click on Properties, and then go to the advanced tab. Click on settings under startup and recovery and disable automatically restart.
should cause the "blue screen of death" Write down the error that comes up, should help us troubleshoot some more.
Also, not sure if this works, but found this on another site:
http://www.techspot.com/vb
Look for minidumps and post them here. Rebooting means that your system got BSOD. In right click on My Computer - Properties - Advanced - Startup and Recovery uncheck the restart automatically. And since then you will be able to get BSOD and message on it.
Minidump will give us chance to track the problem causing dll or driver.
settings
Good. Now look for minidump and post it here. Here is the steps of minidump finding: http://www.pchell.com/supp
You will need to change the extension of the file to picture one to attach it here.
I downloaded and also downloaded the symbol set when the minidump gave errors on the symbol set. However, downloading the symbol set did not help.
Here is what seems to be the meat of what I can see from the most recent one:
Unable to load image ntoskrnl.exe, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
*** ERROR: Module load completed but symbols could not be loaded for ntoskrnl.exe
Windows XP Kernel Version 2600 (Service Pack 3) MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Machine Name:
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055d720
Debug session time: Wed Aug 5 14:27:11.112 2009 (GMT-4)
System Uptime: 0 days 3:10:30.178
Here's another one:
Loading Dump File [C:\WINDOWS\Minidump\Mini0
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: *** Invalid ***
**************************
* Symbol loading may be unreliable without a symbol search path. *
* Use .symfix to have the debugger choose a symbol path. *
* After setting your symbol path, use .reload to refresh symbol locations. *
**************************
Executable search path is:
**************************
* Symbols can not be loaded because symbol path is not initialized. *
* *
* The Symbol Path can be set by: *
* using the _NT_SYMBOL_PATH environment variable. *
* using the -y <symbol_path> argument when starting the debugger. *
* using .sympath and .sympath+ *
**************************
Unable to load image ntoskrnl.exe, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
*** ERROR: Module load completed but symbols could not be loaded for ntoskrnl.exe
Windows XP Kernel Version 2600 (Service Pack 2) MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Machine Name:
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055c700
Debug session time: Tue Jan 8 11:32:36.848 2008 (GMT-4)
System Uptime: 10 days 18:08:39.300
**************************
* Symbols can not be loaded because symbol path is not initialized. *
* *
* The Symbol Path can be set by: *
* using the _NT_SYMBOL_PATH environment variable. *
* using the -y <symbol_path> argument when starting the debugger. *
* using .sympath and .sympath+ *
**************************
Unable to load image ntoskrnl.exe, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
*** ERROR: Module load completed but symbols could not be loaded for ntoskrnl.exe
Loading Kernel Symbols
..........................
..........................
.......................
Loading User Symbols
Loading unloaded module list
..........................
**************************
* *
* Bugcheck Analysis *
* *
**************************
Use !analyze -v to get detailed debugging information.
BugCheck 44, {88f2d008, d63, 0, 0}
***** Kernel symbols are WRONG. Please fix symbols to do analysis.
*** WARNING: Unable to verify timestamp for tcpip.sys
*** ERROR: Module load completed but symbols could not be loaded for tcpip.sys
*** WARNING: Unable to verify timestamp for SYMTDI.SYS
*** ERROR: Module load completed but symbols could not be loaded for SYMTDI.SYS
*** WARNING: Unable to verify timestamp for netbt.sys
*** ERROR: Module load completed but symbols could not be loaded for netbt.sys
*** WARNING: Unable to verify timestamp for rdbss.sys
*** ERROR: Module load completed but symbols could not be loaded for rdbss.sys
*** WARNING: Unable to verify timestamp for mrxsmb.sys
*** ERROR: Module load completed but symbols could not be loaded for mrxsmb.sys
**************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
**************************
**************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!KPRCB ***
*** ***
**************************
**************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
**************************
**************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!KPRCB ***
*** ***
**************************
**************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
**************************
**************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_IRP ***
*** ***
**************************
**************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
**************************
**************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
**************************
**************************
* Symbols can not be loaded because symbol path is not initialized. *
* *
* The Symbol Path can be set by: *
* using the _NT_SYMBOL_PATH environment variable. *
* using the -y <symbol_path> argument when starting the debugger. *
* using .sympath and .sympath+ *
**************************
**************************
* Symbols can not be loaded because symbol path is not initialized. *
* *
* The Symbol Path can be set by: *
* using the _NT_SYMBOL_PATH environment variable. *
* using the -y <symbol_path> argument when starting the debugger. *
* using .sympath and .sympath+ *
**************************
Probably caused by : SYMTDI.SYS ( SYMTDI+4e10 )
Followup: MachineOwner
Good info. The cause of the problem is SYMTDI.SYS.
Do you have any Symantec product installed? If not then there is virus in your system.
Look this link: http://securityresponse.sy
and here: http://www.file.net/proces
Thanks! Great, I see that. What about the latest dump (referenced at the top) that says:
Unable to load image ntoskrnl.exe, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
*** ERROR: Module load completed but symbols could not be loaded for ntoskrnl.exe
Windows XP Kernel Version 2600 (Service Pack 3) MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Machine Name:
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055d720
Debug session time: Wed Aug 5 14:27:11.112 2009 (GMT-4)
System Uptime: 0 days 3:10:30.178
The first part of the dump is not important. It failed to gather info about all files.
According to first link I gave you I would update to latest version of Symantec and also scan the PC for rootkits, viruses etc. BTW, Symantec antivirus sometimes misses viruses so I used to test with two antiviruses the laptop of my user to detect more than 22 viruses there while Norton 2009 was on it.
Ok, did everything as above and still did not correct problem. Also found out that the original message "*** WARNING: Unable to verify timestamp for ntoskrnl.exe" has to do with the network adapter, so updated drivers on that also.
DId not help. I also found out that even though Ioaded the symbol set, I had to set the symbol set path inside the windbg program. So I did that too.
Here's the latest one:
Loading Dump File [C:\WINDOWS\Minidump\Mini0
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\symbols*http://msdl
Executable search path is:
Windows XP Kernel Version 2600 (Service Pack 3) MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 2600.xpsp_sp3_gdr.090206-1
Machine Name:
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055d720
Debug session time: Fri Aug 7 08:23:37.692 2009 (GMT-4)
System Uptime: 0 days 18:21:42.842
Loading Kernel Symbols
..........................
..........................
.................
Loading User Symbols
Loading unloaded module list
..........................
**************************
* *
* Bugcheck Analysis *
* *
**************************
Use !analyze -v to get detailed debugging information.
BugCheck 100000D1, {bacc8018, 2, 0, 887400ad}
Unable to load image RtkHDAud.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for RtkHDAud.sys
*** ERROR: Module load completed but symbols could not be loaded for RtkHDAud.sys
Probably caused by : portcls.sys ( portcls!CPortWaveCyclic::N
Followup: MachineOwner
Got the same crash again, but hit the hyperlink for analyze and got this:
Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [C:\WINDOWS\Minidump\Mini0
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\symbols*http://msdl
Executable search path is:
Windows XP Kernel Version 2600 (Service Pack 3) MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 2600.xpsp_sp3_gdr.090206-1
Machine Name:
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055d720
Debug session time: Fri Aug 7 09:26:09.507 2009 (GMT-4)
System Uptime: 0 days 1:02:02.931
Loading Kernel Symbols
..........................
..........................
.................
Loading User Symbols
Loading unloaded module list
.........................
**************************
* *
* Bugcheck Analysis *
* *
**************************
Use !analyze -v to get detailed debugging information.
BugCheck 100000D1, {6c3a82ed, 2, 1, 89784dad}
Unable to load image RtkHDAud.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for RtkHDAud.sys
*** ERROR: Module load completed but symbols could not be loaded for RtkHDAud.sys
Probably caused by : portcls.sys ( portcls!CPortWaveCyclic::N
Followup: MachineOwner
---------
0: kd> !analyze -v
**************************
* *
* Bugcheck Analysis *
* *
**************************
DRIVER_IRQL_NOT_LESS_OR_EQ
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: 6c3a82ed, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000001, value 0 = read operation, 1 = write operation
Arg4: 89784dad, address which referenced memory
Debugging Details:
------------------
WRITE_ADDRESS: 6c3a82ed
CURRENT_IRQL: 2
FAULTING_IP:
+28
89784dad dfb4b801000000 fbstp tbyte ptr [eax+edi*4+1]
CUSTOMER_CRASH_COUNT: 2
DEFAULT_BUCKET_ID: DRIVER_FAULT
BUGCHECK_STR: 0xD1
PROCESS_NAME: Idle
LAST_CONTROL_TRANSFER: from b89cea3b to 89784dad
STACK_TEXT:
WARNING: Frame IP not in any known module. Following frames may be wrong.
805512b0 b89cea3b 8968e5a0 805513fc b8a30a64 0x89784dad
805512bc b8a30a64 89c677d8 8968e5a0 b8b43d6c portcls!CPortWaveCyclic::N
805513fc 8050232b 8055c0c0 ffdff9c0 ffdff000 RtkHDAud+0x3fa64
80551428 80545e7f 8055c4c0 00000000 0003a2bb nt!KiTimerExpiration+0xb1
80551440 8055be60 ffdffc50 00000000 8055be60 nt!KiRetireDpcList+0x61
80551450 80545d64 00000000 0000000e 00000000 nt!KiIdleThread0
80551454 00000000 0000000e 00000000 00000000 nt!KiIdleLoop+0x28
STACK_COMMAND: kb
FOLLOWUP_IP:
portcls!CPortWaveCyclic::N
b89cea3b 5d pop ebp
SYMBOL_STACK_INDEX: 1
SYMBOL_NAME: portcls!CPortWaveCyclic::N
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: portcls
IMAGE_NAME: portcls.sys
DEBUG_FLR_IMAGE_TIMESTAMP:
FAILURE_BUCKET_ID: 0xD1_portcls!CPortWaveCycl
BUCKET_ID: 0xD1_portcls!CPortWaveCycl
Followup: MachineOwner
---------
Business Accounts
Answer for Membership
by: astralcomputingPosted on 2009-07-28 at 06:02:30ID: 24960188
Check your event logs. This is usually due to third party software or driver problems. You IE may have been corrupted. Run sfc /scannow and have your windows disk handy. Run anti-malware software like malware bytes to check if malware or spyware is installed.
A good guide to stop errors is here: http://aumha.org/a/stop.ht
If it goes all the way to a reboot, you probably have a serious problem with drivers or software. If it is recreatable inside internet explorer, try a third party browse like firefox to diagnose if it is a kernel problem or an internet explorer problem.