Solved

WinXP restarts - is it a possible hardware problem

Posted on 2004-03-25
16
19,994 Views
Last Modified: 2012-08-13
I double boot with Win98 SE and WinXP home. Win Xp restarts unexpected with various error messages on the Blue screen but the most common are Stop 0x8E and 0x50 - possible problem with win32k.sys file.
Win 98 doesn't seem to have pany problems. All the hardware came with my computer(the WindowsXP is 2002 year version without service pack and with a few updates)I  haven't had problems so far- they started a few weeks ago
Any ideas of how can I trouble shoot this?!
0
Comment
Question by:dimcho
  • 4
  • 4
  • 2
  • +6
16 Comments
 
LVL 32

Expert Comment

by:Luc Franken
ID: 10676743
Hi dimcho,

Take a look at http://www.aumha.org/win5/kbestop.htm
And you'll see these error messages point to bad drivers or hardware.
Change out your internal memmory to test.

Greetings,

LucF
0
 
LVL 21

Expert Comment

by:jvuz
ID: 10676881
0
 
LVL 21

Expert Comment

by:jvuz
ID: 10676902
There could be problem with your ram:

Check with this

http://www.snapfiles.com/get/memtest.html
0
 
LVL 24

Expert Comment

by:SunBow
ID: 10677992
For XP check the device manager and event log. Blue screens are hardware related, and for XP it is more often a need to get new updated drivers than for configuring HW (ex: IRQs).  As fyi, I just bought an XP that said it was 2002 version, when I got around to installing it, I found out that it was already loaded with SP-1. So you probably have some vulnerability patches you were not aware of, but do get some more from windowsupdate, or your problems will increase if you plug into the internet.
0
 

Author Comment

by:dimcho
ID: 10694530
I've tracked the problem using the dumpcheck tool and the failing address points to win32k.sys driver and fastfat.sys-which are not drivers for any of the hardware installed what should I do?
0
 

Author Comment

by:dimcho
ID: 10694548
I've tracked the problem using the dumpcheck tool and the failing address points to win32k.sys driver and fastfat.sys-which are not drivers for any of the hardware installed what should I do?
0
 
LVL 32

Expert Comment

by:Luc Franken
ID: 10694584
What is the error message. Both drivers you mentioned are needed to run windows.
0
 

Author Comment

by:dimcho
ID: 10695950
Well it doesn't says much. Appart from the words that appear on every blue screen I have just the stop error which is 0x0000008e(most of the times) and 0x00000050 (not so common). Some times it directly says that the problem is related to the win32k.sys some times not.
The last one was: Stop error 0x0000008e (0xc00000005,0xbf8702a0,0xbadb73d4,0x00000000)
win32.sys - Address  BF8702a0 base at BF800000 Datestamp 3b7de698

I read somewhewre in the MS documentation  related to the ox8e stop errors that:
- "If the problem is associated with Win32k.sys, the source of the error might be a third-party remote control program. If such software is installed, the service can be removed by starting the system using the Recovery Console and deleting the offending system service file."
, but apparently this is a system file and I can't just delete it can I? :)

I'm pasting the result of the last dumpcheck here:

D:\Documents and Settings\dim>dumpchk.exe %SystemRoot%\MEMORY.DMP
Loading dump file D:\WINDOWS\MEMORY.DMP
----- 32 bit Kernel Full Dump Analysis

DUMP_HEADER32:
MajorVersion        0000000f
MinorVersion        00000a28
DirectoryTableBase  08f7d000
PfnDataBase         80c2f000
PsLoadedModuleList  80545b28
PsActiveProcessHead 80547b58
MachineImageType    0000014c
NumberProcessors    00000001
BugCheckCode        0000008e
BugCheckParameter1  c0000005
BugCheckParameter2  bf8702a0
BugCheckParameter3  badb73d4
BugCheckParameter4  00000000
PaeEnabled          00000000
KdDebuggerDataBlock 80537d60

Physical Memory Description:
Number of runs: 3
          FileOffset  Start Address  Length
           00001000     00001000     0009e000
           0009f000     00100000     00eff000
           00f9e000     01000000     0eff0000
Last Page: 0ff8d000     0ffef000

KiProcessorBlock at 80544ac0
  1 KiProcessorBlock entries:
  ffdff120


Windows XP Kernel Version 2600 UP Free x86 compatible
Built by: 2600.xpclient.010817-1148
Kernel base = 0x804d0000 PsLoadedModuleList = 0x80545b28
Debug session time: Sat Mar 27 20:21:48 2004
System Uptime: 0 days 0:18:09
start    end        module name
804d0000 806b3f00   nt             Checksum: 001EC8BB  Timestamp: Sat Aug 18 06:
39:59 2001 (3B7DE38F)

Unloaded modules:
ba4d4000 ba4fb000   kmixer.sys    Timestamp: Sat Mar 27 20:06:16 2004 (4065C298)

ba9bd000 ba9d9000   aec.sys     Timestamp: Sat Mar 27 20:04:27 2004 (4065C22B)
fa11e000 fa11f000   drmkaud.sys    Timestamp: Sat Mar 27 20:04:27 2004 (4065C22B
)
babbe000 babcb000   DMusic.sys    Timestamp: Sat Mar 27 20:04:27 2004 (4065C22B)

bae18000 bae26000   swmidi.sys    Timestamp: Sat Mar 27 20:04:27 2004 (4065C22B)

ba996000 ba9bd000   kmixer.sys    Timestamp: Sat Mar 27 20:04:26 2004 (4065C22A)

f9f80000 f9f82000   splitter.sys    Timestamp: Sat Mar 27 20:04:26 2004 (4065C22
A)
fa0db000 fa0dc000   winio.sys    Timestamp: Sat Mar 27 20:04:19 2004 (4065C223)
f9d54000 f9d59000   Cdaudio.SYS    Timestamp: Sat Mar 27 20:03:53 2004 (4065C209
)
f9f44000 f9f47000   Sfloppy.SYS    Timestamp: Sat Mar 27 20:03:53 2004 (4065C209
)

Finished dump check

As you can see I don't get the exception code and the exception address(can you tell why not)
but as far as I know parameter 2 is the address of the exception. Following the instructions I've run pstst.exe and this is what I've got:

 ModuleName Load Addr   Code    Data   Paged           LinkDate
------------------------------------------------------------------------------
ntoskrnl.exe 804D0000  423168   75264 1152512 Sat Aug 18 06:39:59 2001
     hal.dll 806B4000   33408   42624   28928 Fri Aug 17 23:48:15 2001
   KDCOM.DLL F9F4C000    2560     256    1280 Fri Aug 17 23:49:10 2001
 BOOTVID.dll F9E5C000    5632    3584       0 Fri Aug 17 23:49:09 2001
    ACPI.sys F99FF000  103808   11008   40192 Fri Aug 17 23:57:52 2001
  WMILIB.SYS F9F4E000     512       0    1280 Sat Aug 18 00:07:23 2001
     pci.sys F9A4C000   14080    1664   30976 Fri Aug 17 23:58:04 2001
  isapnp.sys F9A5C000    8704     768   18688 Fri Aug 17 23:58:01 2001
  pciide.sys FA014000     896     128       0 Fri Aug 17 23:51:49 2001
 PCIIDEX.SYS F9CCC000    5120     512   12288 Fri Aug 17 23:51:46 2001
MountMgr.sys F9A6C000    1280     128   29696 Fri Aug 17 23:47:36 2001
  ftdisk.sys F99E0000    5888     128  102400 Fri Aug 17 23:52:41 2001
  siside.sys F9F50000    3200     128       0 Wed Jul 10 06:29:33 2002
 PartMgr.sys F9CD4000    1920     128   11136 Sat Aug 18 04:32:23 2001
 VolSnap.sys F9A7C000    2304     128   32512 Fri Aug 17 23:53:19 2001
   atapi.sys F99CA000   41216    3584   25984 Fri Aug 17 23:51:49 2001
    disk.sys F9A8C000    7680     256   16256 Fri Aug 17 23:52:31 2001
CLASSPNP.SYS F9A9C000   22784     128   13440 Sat Aug 18 04:32:31 2001
      sr.sys F99B8000    1792    1152   51968 Sat Aug 18 00:00:38 2001
 Fastfat.sys F9994000    8576     768  116480 Sat Aug 18 06:39:54 2001
  KSecDD.sys F9980000    9216    6784   53504 Fri Aug 17 23:50:01 2001
    NDIS.sys F9958000   16896    1024  118528 Sat Aug 18 04:31:13 2001
 sisperf.sys F9E60000    1920    2176    1536 Fri Jul 12 06:07:19 2002
 sisidex.sys F9AAC000    9088   11136    6016 Tue May 28 11:21:08 2002
 SISAGPX.sys F9CDC000   10624     128   14080 Thu Oct 31 05:58:41 2002
     Mup.sys F993E000   13568    6144   70528 Sat Aug 18 06:21:29 2001
processr.sys F9CF4000    7552    1408    9216 Fri Aug 17 23:48:32 2001
  sisgrp.sys F98B9000   83712   34560  102784 Tue Nov 26 14:08:57 2002
VIDEOPRT.SYS F9ADC000    8832     256   39424 Fri Aug 17 23:57:42 2001
i8042prt.sys F9AEC000   11520     256   22016 Sat Aug 18 06:44:51 2001
mouclass.sys F9CFC000    5888     896    5504 Fri Aug 17 23:47:50 2001
kbdclass.sys F9D04000    6528     896    6144 Fri Aug 17 23:47:47 2001
     fdc.sys F9D0C000   18176     256     384 Fri Aug 17 23:51:22 2001
  serial.sys F9AFC000   11392     256   29312 Sat Aug 18 06:27:19 2001
 serenum.sys F9EE4000    2688     128    7552 Fri Aug 17 23:50:13 2001
 parport.sys F98A6000   63360    1280     256 Fri Aug 17 23:50:05 2001
msmpu401.sys FA12B000     128       0     384 Fri Aug 17 23:59:59 2001
 portcls.sys F9885000   39168   10496   60800 Sat Aug 18 06:31:59 2001
    drmk.sys F9B0C000    5248    1280   45184 Sat Aug 18 00:01:08 2001
      ks.sys F9864000   29952     128   83328 Sat Aug 18 06:24:52 2001
     pfc.sys F9EE8000    6176      32       0 Mon Feb 25 09:35:19 2002
   cdrom.sys F9B1C000   31872     128    5632 Fri Aug 17 23:52:25 2001
 redbook.sys F9B2C000    6272    1152   35456 Fri Aug 17 23:51:37 2001
   Imapi.SYS F9B3C000   10112     256   19072 Fri Aug 17 23:53:17 2001
   cmuda.sys F97F5000  311488   38016   79040 Fri Nov 01 11:11:18 2002
 usbohci.sys F9EF4000   12288     384       0 Sat Aug 18 00:03:04 2001
 USBPORT.SYS F97D6000  102016    1024   10240 Sat Aug 18 00:03:07 2001
 usbehci.sys F9D14000   15360     768       0 Tue Apr 02 01:42:09 2002
  sisnic.sys F9D1C000   19968    1024    4608 Wed May 23 03:16:43 2001
Intels51.sys F9743000  232928  118272    3424 Fri May 10 22:58:59 2002
   Modem.SYS F9D24000    1280     128   19968 Fri Aug 17 23:57:35 2001
 audstub.sys FA12C000     128       0     512 Fri Aug 17 23:59:40 2001
 rasl2tp.sys F9B4C000   42240     512       0 Sat Aug 18 04:30:47 2001
ndistapi.sys F9EF8000    5248     128       0 Fri Aug 17 23:55:29 2001
 ndiswan.sys F972D000   69376    2432       0 Sat Aug 18 04:30:58 2001
raspppoe.sys F9B5C000   29056    4608       0 Fri Aug 17 23:55:33 2001
 raspptp.sys F9B6C000   38528     896       0 Sat Aug 18 04:30:51 2001
     TDI.SYS F9EFC000    9472     512     256 Fri Aug 17 23:57:25 2001
  psched.sys F971C000   49664    2048    3968 Fri Aug 17 23:54:25 2001
   msgpc.sys F9B7C000   27264    1408     512 Fri Aug 17 23:54:19 2001
 ptilink.sys F9D2C000   12928     256       0 Fri Aug 17 23:49:53 2001
  raspti.sys F9D34000   11008     640       0 Fri Aug 17 23:55:32 2001
  termdd.sys F9B8C000   25088     768    2304 Fri Aug 17 23:46:42 2001
  swenum.sys FA130000     384       0     640 Fri Aug 17 23:48:47 2001
  update.sys F965A000    2048     768  129792 Sat Aug 18 06:53:56 2001
MODEMCSA.sys F9F14000    5760    1152    3968 Fri Aug 17 23:57:37 2001
 NDProxy.SYS F9B9C000   29184    2176       0 Fri Aug 17 23:55:30 2001
flpydisk.sys F9D3C000    1792    1280   11520 Fri Aug 17 23:51:21 2001
  usbhub.sys F9BFC000   22528     384   20608 Sat Aug 18 00:03:11 2001
    USBD.SYS F9F52000     256       0     896 Sat Aug 18 00:02:58 2001
  Fs_Rec.SYS F9F54000     128     128    3584 Fri Aug 17 23:49:37 2001
    Null.SYS FA138000       0     128     384 Fri Aug 17 23:47:39 2001
    Beep.SYS F9F56000    1152       0       0 Fri Aug 17 23:47:33 2001
     vga.sys F9D5C000     896     128   14592 Fri Aug 17 23:57:51 2001
   mnmdd.SYS F9F58000       0       0    1792 Fri Aug 17 23:57:28 2001
  RDPCDD.sys F9F5A000       0       0    1792 Fri Aug 17 23:46:56 2001
    Msfs.SYS F9D64000     896     128   11264 Fri Aug 17 23:50:02 2001
    Npfs.SYS F9D6C000    1664     256   20352 Fri Aug 17 23:50:03 2001
  rasacd.sys F9F48000    3840     128     512 Fri Aug 17 23:55:39 2001
   ipsec.sys F9C0C000   45056    1792    2304 Sat Aug 18 04:30:42 2001
   tcpip.sys F446D000  230016   39040   20736 Sat Aug 18 04:31:44 2001
   netbt.sys F4448000  101120    1664   30592 Sat Aug 18 04:32:18 2001
 netbios.sys F9C1C000   14336     768   11648 Fri Aug 17 23:54:00 2001
  sisesc.sys F9D74000   11392    1408     128 Thu Dec 05 11:51:08 2002
   srvkp.sys F9916000    5248     512       0 Wed Nov 20 20:08:57 2002
   rdbss.sys F03E0000   33024    2816  104448 Sat Aug 18 06:44:30 2001
  mrxsmb.sys F0354000  104064   17920  248704 Sat Aug 18 06:31:45 2001
    Fips.SYS F9C2C000   22016     768    3584 Sat Aug 18 04:31:49 2001
  wanarp.sys F9C3C000   21632     896    3328 Fri Aug 17 23:55:23 2001
  ASPI32.SYS F98F6000   10656     544       0 Wed Jul 17 18:53:00 2002
    Cdfs.SYS F9C4C000    6400     640   45568 Sat Aug 18 06:33:34 2001
dump_atapi.sys F029E000       0       0       0
dump_WMILIB.SYS F9F5C000       0       0       0
  win32k.sys BF800000 1562496   78208       0 Sat Aug 18 06:52:56 2001
watchdog.sys F924E000    2304     128    7424 Fri Aug 17 23:59:35 2001
     dxg.sys BFF80000   58880     896       0 Sat Aug 18 00:55:56 2001
  dxgthk.sys FA18C000     128       0       0 Fri Aug 17 23:53:12 2001
  SiSGRV.dll BF9B8000  631424   75776       0 Tue Nov 26 14:17:26 2002
pavdrv51.sys F969C000   40448    6528     384 Thu Apr 03 13:04:27 2003
     afd.sys BAE38000    3840    2048  104832 Sat Aug 18 04:30:36 2001
 ndisuio.sys BAED4000    6784     128     640 Fri Aug 17 23:53:53 2001
vsdatant.sys BAD39000  182848   25504       0 Tue Dec 16 00:04:27 2003
  mrxdav.sys BAC1E000   25088    5504  122240 Fri Aug 17 23:50:20 2001
sysaudio.sys BAF88000    2432     128   44672 Sat Aug 18 06:47:26 2001
  wdmaud.sys BABC6000    8576    2176   61312 Sat Aug 18 06:42:48 2001
 GenPort.SYS FA055000     992       0       0 Thu Jan 16 23:50:04 1997
  MapMem.SYS F9F74000    1984     160       0 Wed Mar 12 04:17:39 1997
 NTRemap.SYS FA058000    1472     320       0 Wed Mar 12 04:16:00 1997
  ParVdm.SYS F9F76000    1408     128       0 Fri Aug 17 23:49:49 2001
     srv.sys BA96E000   53504    8320  235904 Sat Aug 18 04:32:06 2001
   ipnat.sys BA753000   60928    4096     512 Fri Aug 17 23:55:11 2001
  kmixer.sys BA4AC000   12032   35840   94080 Sat Aug 18 00:00:45 2001
   ntdll.dll 77F50000  475136   20480       0 Sat Aug 18 06:25:18 2001
------------------------------------------------------------------------------
       Total          5927936  739008 3912224
As you can see the failling address points to win32k.sys(this time it was written on the error message directly, but most of the times the second parameter points to win32k.sys)

I don't know if this is related to the problem but the name of the volume that WinXP is installed and running was renamed from SS(D:) to pT(D:)

Any help will be appreciated











0
How to run any project with ease

Manage projects of all sizes how you want. Great for personal to-do lists, project milestones, team priorities and launch plans.
- Combine task lists, docs, spreadsheets, and chat in one
- View and edit from mobile/offline
- Cut down on emails

 
LVL 32

Expert Comment

by:Luc Franken
ID: 10699032
>> If such software is installed, the service can be removed by starting the system using the Recovery Console and deleting the offending system service file."
, but apparently this is a system file and I can't just delete it can I? :) <<

You should never delete that file!!!

It sais, any "third-party remote control program"
Do you know if you have any running? PC anywhere or something like that?

Could also be that you have a virus on your computer that gives a backdoor into your computer. Just to be sure, scan for it:
http://www3.ca.com/virusinfo/virusscan.aspx

LucF
0
 

Author Comment

by:dimcho
ID: 10703415
"It sais, any "third-party remote control program"
Do you know if you have any running? PC anywhere or something like that?" -
- No, nothing like that, besides I'm on a dial up connection and I'm not constantly in Internet and it happens also when I'm not connected.
It's funny  but when I posted my question I couldn't stay longer then 10-15 min. in the web before the blue screen appears and it seems that I don't  have problems now appart from the fact that the browsing it is too slow(much slower than Win98 SE on the same computer).

Could it be some of the CD-recording software?

Or bad RAM - I've run Mem86 and it found errors during test 6 -
"Test 6 [Modulo 20, ones&zeros, cached]
  Using the Modulo-X algorithm should uncover errors that are not
  detected by moving inversions due to cache and buffering interference
  with the the algorithm.  As with test one only ones and zeros are
  used for data patterns."
 - To be honest that sounds Greek to me :). But the RAM came with the computer about 6 months ago and I haven't had problems so far.
Before I post this question I've run Symantec online scan and I have updated Panda AV and all kinds of spy and adware + firewall.
More ideas?! (Well-except format d: -for the time being:))
0
 
LVL 32

Accepted Solution

by:
Luc Franken earned 50 total points
ID: 10703534
>>I've run Mem86 and it found errors during test 6
Just get rid of this memmory. If it's still under warranty, bring it in so you get some new.

It doesn't really matter what error memtest gives with what test, if it gives errors, it's either incompatible or faulty memory, both reasons to get rid of it.

LucF
0
 

Expert Comment

by:ednor
ID: 10799517
if possible replace the file that causes an error... it may be corrupted. I hope you are not infected with MBLAST virus. if it still doesnt work, try to reinstall your OS.
0
 

Expert Comment

by:callumjones
ID: 10831216
Use your WinXP cd to repair the OS, put the cd and press any key to boot from the CD then press R and then go to Repair and then Automatic repair.
0
 

Expert Comment

by:SarwanGul
ID: 10854396
I faced a problem with windows XP on a Pentium 3 machine. when ever the computer went into stand by mode, it actually restarted, and when i tried to shut the computer down, it never did as it got stuck on the "shutting down" screen. the problem turned out to a folder in the hard drive by the name of "folder.htt" it had some sort of a worm virus in it which kept on infecting any primary or secondary hard disk that i attached and it did not allow me to format my hard drive aswell. the solution that i found for this problem was that i got a new hard disk and i cleared out the old one deleting all the partitions and then creating them all over again. maybe this is the problem with ur machine aswell.
0
 

Expert Comment

by:rizguy79
ID: 10875131
Remember:
if you got such type of problems with OS, then try the following methods; i usualy found them very helping:
*clean the contact points of the RAM,VGA,Sound card,Modem Card.
*try after changing the slot of RAM,if u have two modules then try with one n change its slots

whenever i observed such ype of resetting problem; above tricks had helped me a lot!!!
GOOD LUCK
0
 

Expert Comment

by:Dam01
ID: 10907854
There's several good solutions from others here, but to prevent the system from restarting (not crashing), right click on My Computer, or clicking it on your Start menu, then clicking on Startup & Recovery in the Advanced tab. Uncheck the "Automatically Restart" box. This won't stop the problem, but you'll see a blue screen with more detail about the crash. It's helped me on a few ocassions.
0

Featured Post

Highfive + Dolby Voice = No More Audio Complaints!

Poor audio quality is one of the top reasons people don’t use video conferencing. Get the crispest, clearest audio powered by Dolby Voice in every meeting. Highfive and Dolby Voice deliver the best video conferencing and audio experience for every meeting and every room.

Join & Write a Comment

Hello I read in a discussion about a person who configured a very simple mirror RAID with two hard drives; the system and data were on the same partition. He asked how to repair the system as it was not booting up anymore. In his case running …
Many people tend to confuse the function of a virus with the one of adware, this misunderstanding of the basic of what each software is and how it operates causes users and organizations to take the wrong security measures that would protect them ag…
It is a freely distributed piece of software for such tasks as photo retouching, image composition and image authoring. It works on many operating systems, in many languages.
Sending a Secure fax is easy with eFax Corporate (http://www.enterprise.efax.com). First, Just open a new email message.  In the To field, type your recipient's fax number @efaxsend.com. You can even send a secure international fax — just include t…

743 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

10 Experts available now in Live!

Get 1:1 Help Now