Help track source of "bugcheck" reboot.
Posted on 2004-08-03
I'm having a problem with some of our machines, I'm not sure if it's related to our custom software or not, but unfortunately we are unable to determine a repeatable set of steps to reproduce this, but for the machines on which it is happening (they're all configured the same, Windows 2000) it happens frequently, other machines never see this.
What happens is the computer just reboots. (a "courtesy reboot" as we've been tounge-in-cheek calling it)
All we can see are event logs left behind. The event shows in the Event Viewer like this:
Source: Save Dump
Event ID: 1001
The computer has rebooted from a bugcheck. The bugcheck was: 0x0000000a (0x00000000, 0x00000002, 0x00000001, 0x80448ee5). Microsoft Windows 2000 [v15.2195]. Adump was saved in: C:\WINNT\Minidump\Min060404-01.dmp.
The output of DUMPCHK looks like:
Filename . . . . . . .Mini060404-01.dmp
Signature. . . . . . .PAGE
ValidDump. . . . . . .DUMP
MajorVersion . . . . .free system
MinorVersion . . . . .2195
DirectoryTableBase . .0x13f55000
PfnDataBase. . . . . .0x85410000
PsLoadedModuleList . .0x80484520
MachineImageType . . .i386
NumberProcessors . . .2
BugCheckCode . . . . .0x0000000a
BugCheckParameter1 . .0x00000000
BugCheckParameter2 . .0x00000002
BugCheckParameter3 . .0x00000001
BugCheckParameter4 . .0x80448ee5
ExceptionCode. . . . .0x80000003
ExceptionFlags . . . .0x00000001
ExceptionAddress . . .0x8046987c
plus (in -v verbose mode) it then lists all the modules loaded:
Module ntoskrnl.exe loaded at 0x80400000
Module hal.dll loaded at 0x80062000
Module BOOTVID.dll loaded at 0xeb810000
.. and on and on and on.
I assume the "ExceptionAddress" would point to the address of whatever failed. but that address appears nowhere within the long list of Module lines.