Solved

Help track source of "bugcheck" reboot.

Posted on 2004-08-03
25
1,911 Views
Last Modified: 2012-06-27
I'm having a problem with some of our machines, I'm not sure if it's related to our custom software or not, but unfortunately we are unable to determine a repeatable set of steps to reproduce this, but for the machines on which it is happening (they're all configured the same, Windows 2000) it happens frequently, other machines never see this.  

What happens is the computer just reboots. (a "courtesy reboot" as we've been tounge-in-cheek calling it)

All we can see are event logs left behind. The event shows in the Event Viewer like this:

Source: Save Dump
 Category: None
 Event ID: 1001

 Description:
 The computer has rebooted from a bugcheck. The bugcheck was: 0x0000000a (0x00000000, 0x00000002, 0x00000001, 0x80448ee5). Microsoft Windows 2000 [v15.2195]. Adump was saved in: C:\WINNT\Minidump\Min060404-01.dmp.

The output of DUMPCHK looks like:
Filename . . . . . . .Mini060404-01.dmp
Signature. . . . . . .PAGE
ValidDump. . . . . . .DUMP
MajorVersion . . . . .free system
MinorVersion . . . . .2195
DirectoryTableBase . .0x13f55000
PfnDataBase. . . . . .0x85410000
PsLoadedModuleList . .0x80484520
PsActiveProcessHead. .0x80485c68
MachineImageType . . .i386
NumberProcessors . . .2
BugCheckCode . . . . .0x0000000a
BugCheckParameter1 . .0x00000000
BugCheckParameter2 . .0x00000002
BugCheckParameter3 . .0x00000001
BugCheckParameter4 . .0x80448ee5

ExceptionCode. . . . .0x80000003
ExceptionFlags . . . .0x00000001
ExceptionAddress . . .0x8046987c

plus (in -v verbose mode) it then lists all the modules loaded:
Module ntoskrnl.exe loaded at 0x80400000
Module hal.dll loaded at 0x80062000
Module BOOTVID.dll loaded at 0xeb810000
.. and on and on and on.

I assume the "ExceptionAddress" would point to the address of whatever failed. but that address appears nowhere within the long list of Module lines.

Thoughts?

thanks!
-Paul



0
Comment
Question by:PMH4514
  • 10
  • 8
  • 7
25 Comments
 
LVL 9

Expert Comment

by:BigC666
ID: 11705314
howdy,

right click my computer->properties->advanced->startup and recovery uncheck auto reboot, this will hold the error on the screen until you do a manual reboot. see what it says and repost.

hope we can  help
0
 
LVL 32

Expert Comment

by:Luc Franken
ID: 11705349
Hi PMH4514,

Please use pstat.exe as explained here:
http://support.microsoft.com/default.aspx?kbid=192463

This will point out what driver/program would have caused the problem.

But as you say it happens frequently, I suggest you to start with suspecting the RAM. Check it with a tool like http://www.memtest86.com (if this tool doesn't find errors, doesn't mean it's good, the only way to be 100% sure is to replace it. But if it finds any errors, you can be sure it's bad)

Greetings,

LucF
0
 
LVL 32

Expert Comment

by:Luc Franken
ID: 11705379
BigC666,
It'll say the following:

STOP: IRQL_NOT_LESS_OR_EQUAL
0x0000000a (0x00000000,0x00000002,0x00000001,0x80448ee5)
0
 
LVL 9

Expert Comment

by:BigC666
ID: 11705474
ok, as long as it is holding and not doing an auto reboot, what LucF says abouve is correct. the pstat program will let you check for a possible driver problem. however i've found that doing the memtest is quite misleading.1) make sure that the cpu fan is running 2)pull all but one stick of ram and reboot if runs ok, then sub. other ram sticks until you find the one that's giving you problems and replace. fought one of these for a week before just doing ram sub. found the bad stick in 2 reboots.

hope that this helps
0
 

Author Comment

by:PMH4514
ID: 11705498
Yeah, I had turned the auto-reboot option off, we keep that on becuase the blue screen of death scares customers should it happen.  I'll see if I can duplicate it again when a box arrives from a customer later today. LucF -how do you know it'll show STOP: IRQL_NOT_LESS_OR_EQUAL ?

I'll have to find a copy of pstat, I don't know if we own the resource kit.
0
 

Author Comment

by:PMH4514
ID: 11705520
in what way is memtest misleading? if we have defective ram chips, we'll need a way to prove it to our vendor.
0
 
LVL 32

Expert Comment

by:Luc Franken
ID: 11705567
>>LucF -how do you know it'll show STOP: IRQL_NOT_LESS_OR_EQUAL <<
Pretty easy, 0x0000000A is IRQL_NOT_LESS_OR_EQUAL

You can find a whole list of bugcheckcodes and their names and possible solutions at:
http://www.aumha.org/win5/kbestop.htm

Btw, I just noticed, you won't need pstat.exe
The exception address is 0x8046987c
ntoskrnl.exe starts at 0x80400000 (and goes on to 0x80062000)

So this is where your problem exists.
If memmory checking doesn't help, try the windows system file checker:

Description of the Windows 2000 System File Checker (Sfc.exe)
http://support.microsoft.com/?kbid=222471

LucF
0
 
LVL 9

Expert Comment

by:BigC666
ID: 11705568
most of the time that i run the memtest programs that i have the don't uncover leaks and this is the major problem in these cases. they will find a dead chip but not the leaks. so that's why the ram sub suggestion, for me it was faster. also to answer for LucF that the usual text with the stop error that you provided.

hope that this helps
0
 

Author Comment

by:PMH4514
ID: 11705572
also,
>>2)pull all but one stick of ram and reboot if runs ok, then sub. other ram sticks until you find the one that's giving you problems and replace. fought one of these for a week before just doing ram sub. found the bad stick in 2 reboots.

this may be problematic, as the crash doesn't happen all of the time, and when it does, it's at seemingly random points in time. ie. I could pull all but one memory stick and reboot, and not see the problem, even if perhaps that stick was corrupted in some way.. know what i mean?

0
 
LVL 9

Expert Comment

by:BigC666
ID: 11705594
if you have a problem stick it will show rather quickly.
0
 

Author Comment

by:PMH4514
ID: 11705640
>>Btw, I just noticed, you won't need pstat.exe
>>The exception address is 0x8046987c
>>ntoskrnl.exe starts at 0x80400000 (and goes on to 0x80062000)
ahh, I was just about to ask that. I wasn't able to find 0x8046987c in the list from dumpchk, but I thought maybe "find the closest" would be it. You've verified that for me.

so ntoskrnl.exe is definitely the problem? We have several Minidump files from a few months time, they all show the same thing as far as pointing to ntoskrnl.exe

googling that finds:
http://support.microsoft.com/default.aspx?scid=kb;en-us;294690
0
 
LVL 32

Expert Comment

by:Luc Franken
ID: 11705699
That's a completely different dumpcheckcode ( 0x0000001E: KMODE_EXCEPTION_NOT_HANDLED)
Although it's related to 0xA, it isn't the same error.

But anyway, upgrading to the latest Service Pack is never a dumb idea in case you haven't done that yet.
0
Find Ransomware Secrets With All-Source Analysis

Ransomware has become a major concern for organizations; its prevalence has grown due to past successes achieved by threat actors. While each ransomware variant is different, we’ve seen some common tactics and trends used among the authors of the malware.

 

Author Comment

by:PMH4514
ID: 11705726
re: service pack upgrades, I don't configure the machines as they go out, I understand they are configured with the latest service packs. I'll check though.

this is the right tech note? http://support.microsoft.com/default.aspx?scid=kb;EN-US;165456
0
 

Author Comment

by:PMH4514
ID: 11705761
that tech note I posted in the last comment says "Microsoft has confirmed this to be a problem in Windows NT version 4.0" - am I looking at the right thing? we're on Windows 2000.
0
 
LVL 9

Expert Comment

by:BigC666
ID: 11705766
haven't encountered this perticular problem with win2k, on nt yes
0
 
LVL 32

Expert Comment

by:Luc Franken
ID: 11705833
ditto :)
0
 

Author Comment

by:PMH4514
ID: 11706073
ok thanks.. I've documented everything I've learned from reading your comments and the various posted links. I have to get the folks here who are supposed to be doing this as their job (rather than standing around all day chit-chatting about golf) to go ahead and do the related grunt work.. I have code to write on a deadline. I will report back, hopefully this afternoon if they get their acts together and let ya know what we find.  thanks!
0
 
LVL 32

Expert Comment

by:Luc Franken
ID: 11706087
Ok, good luck :)

LucF
0
 
LVL 9

Expert Comment

by:BigC666
ID: 11706830
yep, good luck
0
 

Author Comment

by:PMH4514
ID: 11715760
hmm.. so far, they've run the memtest for a few hours with no problems showing. they've installed the latest service pack as the MS tech note mentioned. The app did eventually crash with the same exact stop message. I believe they have been able to make "our app" crash, as well as MS Paint..  if the memory is testing OK and the hard-drives are OK, and windows is up to date, what else could it be??
0
 
LVL 9

Expert Comment

by:BigC666
ID: 11715842
as i said in an earlier post, the memtest is not definitave, the only sure way to test memory is to pull and run one stick at a time.
sorry
0
 

Author Comment

by:PMH4514
ID: 11735264
just an update. the guys have been trying to methodically replace things piece by piece. They have also encountered the bluescreen for these stop codes:

0x0000004E PFN_LIST_CORRUPT
portcls.sys 0x000000D1

I had thought they were already trying swapping ram chips, I'm told today they begin that..  what a pain :)

I'm thinking it could also be the onboard video driver.

0
 
LVL 32

Accepted Solution

by:
Luc Franken earned 125 total points
ID: 11735767
Some general information about those:

0x0000004E PFN_LIST_CORRUPT
http://www.aumha.org/win5/kbestop.php#0x4e
This indicates that the memory management Page File Number list is corrupted. Can be caused by corrupt physical RAM, or by drivers passing bad memory descriptor lists.

0x000000D1: DRIVER_IRQL_NOT_LESS_OR_EQUAL
http://www.aumha.org/win5/kbestop.php#0xd1
The system attempted to access pageable memory using a kernel process IRQL that was too high. The most typical cause is a bad device driver (one that uses improper addresses). It can also be caused by caused by faulty or mismatched RAM, or a damaged pagefile.

Both of them also indicate RAM problems, so I surely hope swapping the RAM will completely solve the problems.

I'll be away for the weekend, I'm sure someone will be able to follow up if you have any questions.

Good luck,

LucF
0
 

Author Comment

by:PMH4514
ID: 11844856
new RAM chips. haven't seen the problem yet!
0
 
LVL 32

Expert Comment

by:Luc Franken
ID: 11845259
Great to hear!

Glad to help,

LucF
0

Featured Post

Better Security Awareness With Threat Intelligence

See how one of the leading financial services organizations uses Recorded Future as part of a holistic threat intelligence program to promote security awareness and proactively and efficiently identify threats.

Join & Write a Comment

NTFS file system has been developed by Microsoft that is widely used by Windows NT operating system and its advanced versions. It is the mostly used over FAT file system as it provides superior features like reliability, security, storage, efficienc…
In this article, I will show you HOW TO: Create your first Windows Virtual Machine on a VMware vSphere Hypervisor 6.5 (ESXi 6.5) Host Server, the Windows OS we will install is Windows Server 2016.
This video discusses moving either the default database or any database to a new volume.
Polish reports in Access so they look terrific. Take yourself to another level. Equations, Back Color, Alternate Back Color. Write easy VBA Code. Tighten space to use less pages. Launch report from a menu, considering criteria only when it is filled…

707 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

17 Experts available now in Live!

Get 1:1 Help Now