The computer has rebooted from a bugcheck.

cjjimbos
cjjimbos used Ask the Experts™
on
My Server reboots around 12:05am every night, starting about a week ago.  In the event Viewer/System, I get this error showing:
"The computer has rebooted from a bugcheck.  The bugcheck was: 0x1000008e (0xc0000005, 0xf728a284, 0xf240c85c, 0x00000000). A dump was saved in: C:\WINDOWS\Minidump\Mini101405-01.dmp."

OK..........I read up on this.  Apparently it COULD be an issue with RAM, or a hardware device, or driver.  I tried to open up the .dmp file to TRY and read it, but dont know how.  I tried to figure out the above #'s (ie: 0xf728a284) but dont understand it.

So if this is a possible hardware issue, why is it rebooting around the same time (12:05am--give or take 5 to 10 minutes)?  How can I  further troubleshoot this?  I was going to unclick the "Automatic restart" on the Startup and Recovery in Systems, but I wasnt sure if it would still shut down and not restart, or if it wont restart at all and hang on the blue screen of death.


Help me please.
Comment
Watch Question

Do more with

Expert Office
EXPERT OFFICE® is a registered trademark of EXPERTS EXCHANGE®
Commented:
The crash may be caused by faulty ram or device driver error. When Windows crashes with blue screen, it writes a system event 1001 or 1003 and a minidump to the folder \winnt\minidump. Check system event 1001 and 1003 and it has the content of the blue screen.

Event ID: 1001
Source: Save Dump
Description:
The computer has rebooted from a bugcheck.The bugcheck was : 0xc000000a (0xe1270188, 0x00000002, 0x00000000, 0x804032100).
Microsoft Windows..... A dump was saved in: .......

Event Source: System Error
Event Category: (102)
Event ID: 1003
Description:
Error code 1000007f, parameter1 0000000d, parameter2 00000000, parameter3 00000000, parameter4 00000000

Control Panel -> Adminstrative Tools -> Event Viewer -> System -> Event 1001/1003. Copy the content and paste it back here

Zip 5 to 6 minidumps to a zip file and attach it at any webspace. I will study the dump and find out the culprit.
This doesn't sound like a hardware issue, the exception code was c0000005 or access violation.  It means an instruction referenced a memory location (virtual memory, not physical memory) that was uninitialized.  Virtual memory that had not yet been initialized by the process.  So this invalid virtual address hasn't even been mapped to physical memory yet so its not likely to be faulty RAM.  This most likely there is a bug in some driver.  Since it happens at around the same time every night, my first guess would be backup software.  Unfortunately we need to see the dump files to tell any more than that.

Commented:
Hi Marc,

You have the same thinking as me when I start windows debugging. Conceptually you are right. Why the memory location is bad. At the beggining I think it must be related to software. Finally I find out it can be software and hardware.

Refer the following cases they are related to faulty ram.
http://www.experts-exchange.com/Operating_Systems/WinXP/Q_21363977.html#13712378
http://www.experts-exchange.com/Operating_Systems/WinXP/Q_21505124.html

I have much more confirmed cases at the other forum
Become a Microsoft Certified Solutions Expert

This course teaches how to install and configure Windows Server 2012 R2.  It is the first step on your path to becoming a Microsoft Certified Solutions Expert (MCSE).

I'm not trying to say hardware can't cause these types of crashes, but I myself have done more of these than I can count and maybe once it has turned out to be a hardware problem.  Its like you said, if you get multiple mini dumps that all have different bugcheck codes and faulting stacks then its most likely hardware.  But this one, an access violation every night at roughly the same time seems a bit too consistent.  Regardless, its all speculation until we see the minidumps.  As general good practice I try not to rule anything out until I have some proof.  Happy debugging :-)

Author

Commented:
I think you are right.  But how do I get the dump files to open in a format that is readable.  I am on a Windows 2003 server and the dump files are .dmp files.  I couldnt figure out how to read the files.  How can i convert them so I can paste them onto this site?

Commented:
Debugging Tools from Microsoft
1) Create folder c:\symbols
2) Download and install the http://www.microsoft.com/whdc/devtools/debugging/installx86.mspx
3) Locate your latest memory.dmp file- C:\WINNT\Minidump\Mini011005-01.dmp or whatever
4) open a CMD prompt and cd\program files\debugging tools for windows\
5) type the following stuff:

Code:
c:\program files\debugging tools>kd -z C:\WINNT\Minidump\Mini011005-01.dmp
kd> .logopen c:\debuglog.txt
kd> .sympath srv*c:\symbols*http://msdl.microsoft.com/download/symbols
kd> .reload;!analyze -v;r;kv;lmnt;.logclose;q

You now have a debuglog.txt in c:\, open it in notepad and post to this thread.

Author

Commented:
Ill try to open the dmp file

Author

Commented:
This is what the debugger came up with:

Opened log file 'c:\debuglog.txt'
1: kd> .sympath srv*c:\symbols*http://msdl.microsoft.com/download/symbols
Symbol search path is: srv*c:\symbols*http://msdl.microsoft.com/download/symbols
1: kd> .reload;anlayze -v;r;kv;lmnt;.logclose;q
Loading Kernel Symbols
........................................................................................................................
Loading unloaded module list
........
Loading User Symbols
*** WARNING: Unable to verify timestamp for ati2drad.dll
*** ERROR: Module load completed but symbols could not be loaded for ati2drad.dll
*** WARNING: Unable to verify timestamp for naveng.sys
*** ERROR: Module load completed but symbols could not be loaded for naveng.sys
*** WARNING: Unable to verify timestamp for navex15.sys
*** ERROR: Module load completed but symbols could not be loaded for navex15.sys
*** WARNING: Unable to verify timestamp for UdfReadr_xp.SYS
*** ERROR: Module load completed but symbols could not be loaded for UdfReadr_xp.SYS
*** WARNING: Unable to verify timestamp for cdudf_xp.SYS
*** ERROR: Module load completed but symbols could not be loaded for cdudf_xp.SYS
*** WARNING: Unable to verify timestamp for Savrtpel.sys
*** ERROR: Module load completed but symbols could not be loaded for Savrtpel.sys
*** WARNING: Unable to verify timestamp for SYMEVENT.SYS
*** ERROR: Module load completed but symbols could not be loaded for SYMEVENT.SYS
*** WARNING: Unable to verify timestamp for savrt.sys
*** ERROR: Module load completed but symbols could not be loaded for savrt.sys
*** WARNING: Unable to verify timestamp for pwd_2k.SYS
*** ERROR: Module load completed but symbols could not be loaded for pwd_2k.SYS
*** WARNING: Unable to verify timestamp for ks.sys
*** ERROR: Module load completed but symbols could not be loaded for ks.sys
*** WARNING: Unable to verify timestamp for ati2mpad.sys
*** ERROR: Module load completed but symbols could not be loaded for ati2mpad.sys
*** WARNING: Unable to verify timestamp for e1000325.sys
*** ERROR: Module load completed but symbols could not be loaded for e1000325.sys
*** WARNING: Unable to verify timestamp for Cdralw2k.SYS
*** ERROR: Module load completed but symbols could not be loaded for Cdralw2k.SYS
*** WARNING: Unable to verify timestamp for mmc_2K.SYS
*** ERROR: Module load completed but symbols could not be loaded for mmc_2K.SYS
*** WARNING: Unable to verify timestamp for ASPI32.SYS
*** ERROR: Module load completed but symbols could not be loaded for ASPI32.SYS
*** WARNING: Unable to verify timestamp for afamgt.sys
*** ERROR: Module load completed but symbols could not be loaded for afamgt.sys
*** WARNING: Unable to verify timestamp for aic78xx.sys
*** ERROR: Module load completed but symbols could not be loaded for aic78xx.sys
*** WARNING: Unable to verify timestamp for Cdr4_xp.SYS
*** ERROR: Module load completed but symbols could not be loaded for Cdr4_xp.SYS
*** WARNING: Unable to verify timestamp for ptilink.sys
*** ERROR: Module load completed but symbols could not be loaded for ptilink.sys
*** WARNING: Unable to verify timestamp for mraid35x.sys
*** ERROR: Module load completed but symbols could not be loaded for mraid35x.sys
*** WARNING: Unable to verify timestamp for symmpi.sys
*** ERROR: Module load completed but symbols could not be loaded for symmpi.sys
*** WARNING: Unable to verify timestamp for PxHelp20.sys
*** ERROR: Module load completed but symbols could not be loaded for PxHelp20.sys
*** WARNING: Unable to verify timestamp for stdatw2k.sys
*** ERROR: Module load completed but symbols could not be loaded for stdatw2k.sys
*** WARNING: Unable to verify timestamp for dump_mraid35x.sys
*** ERROR: Module load completed but symbols could not be loaded for dump_mraid35x.sys
*** WARNING: Unable to verify timestamp for swenum.sys
*** ERROR: Module load completed but symbols could not be loaded for swenum.sys
Couldn't resolve error at 'nlayze -v;r;kv;lmnt;.logclose;q'

Author

Commented:
OK, Cancel the above Code.  I forgot to put an "!' in front of analyze.  Now this is the updated debuglog.txt

1: kd> .reload;!anlayze -v;r;kv;lmnt;.logclose;q
Loading Kernel Symbols
........................................................................................................................
Loading unloaded module list
........
Loading User Symbols
No export anlayze found
eax=00000000 ebx=8866e8b0 ecx=f72acf62 edx=885bdb30 esi=8866ea1c edi=00000000
eip=f728a284 esp=f2b6c8d0 ebp=f2b6c9d0 iopl=0         nv up ei ng nz ac po nc
cs=0008  ss=0010  ds=0023  es=0023  fs=0030  gs=0000             efl=00010296
Ntfs!NtfsAcquireResourceExclusive+0x4:
f728a284 6681380207       cmp     word ptr [eax],0x702  ds:0023:00000000=????
ChildEBP RetAddr  Args to Child              
f2b6c8cc f72d3e9f 885bdab0 00000000 00000001 Ntfs!NtfsAcquireResourceExclusive+0x4 (FPO: [3,0,0])
f2b6c9d0 804f0be3 8a44d718 8866e8b0 f2b6ca34 Ntfs!NtfsFsdCreate+0x362 (FPO: [Non-Fpo])
*** WARNING: Unable to verify timestamp for SYMEVENT.SYS
*** ERROR: Module load completed but symbols could not be loaded for SYMEVENT.SYS
f2b6c9e0 f6cf322b f2b6ca34 00040000 00000000 nt!IofCallDriver+0x3f (FPO: [0,0,0])
WARNING: Stack unwind information not available. Following frames may be wrong.
f2b6cb58 8058f412 8a494418 00000000 884198d8 SYMEVENT+0xb22b
f2b6cbd4 8058eb49 00000000 f2b6cc14 00000040 nt!ObpLookupObjectName+0x545 (FPO: [Non-Fpo])
f2b6cc28 80590a39 00000000 00000000 b6cd6401 nt!ObOpenObjectByName+0xe8 (FPO: [Non-Fpo])
f2b6cca4 80590b0d 008ad70c 02100080 008ad6a8 nt!IopCreateFile+0x413 (FPO: [Non-Fpo])
f2b6ccf0 8058f21e 008ad70c 02100080 008ad6a8 nt!IoCreateFile+0x3d (FPO: [Non-Fpo])
f2b6cd30 804dfd24 008ad70c 02100080 008ad6a8 nt!NtCreateFile+0x2e (FPO: [Non-Fpo])
f2b6cd30 7ffe0304 008ad70c 02100080 008ad6a8 nt!KiSystemService+0xd0 (FPO: [0,0] TrapFrame @ f2b6cd64)
008ad704 00000000 00000000 00000000 00000000 SharedUserData!SystemCallStub+0x4 (FPO: [0,0,0])
start    end        module name
804de000 80747000   nt       ntkrnlmp.exe Wed May 04 19:54:40 2005 (42798AF0)
80747000 8076f000   hal      halmacpi.dll Mon Mar 24 23:07:28 2003 (3E800030)
bf800000 bf9c7000   win32k   win32k.sys   Tue Mar 08 00:31:56 2005 (422D62FC)
bf9c7000 bfa1d680   ati2drad ati2drad.dll Tue Mar 25 01:43:37 2003 (3E8024C9)
bff80000 bff96000   dxg      dxg.sys      Tue Mar 25 01:46:23 2003 (3E80256F)
f5491000 f54a2980   naveng   naveng.sys   Mon Oct 10 12:18:51 2005 (434ABE9B)
f54a3000 f5544860   navex15  navex15.sys  Mon Oct 10 12:18:03 2005 (434ABE6B)
f5d33000 f5d4b000   ipnat    ipnat.sys    Mon Mar 24 23:11:05 2003 (3E800109)
f5d73000 f5d95000   RDPWD    RDPWD.SYS    Mon Mar 24 23:03:00 2003 (3E7FFF24)
f5e25000 f5e2f000   TDTCP    TDTCP.SYS    Mon Mar 24 23:02:52 2003 (3E7FFF1C)
f6295000 f62f3000   srv      srv.sys      Tue May 03 17:47:41 2005 (42781BAD)
f668b000 f66ba000   afd      afd.sys      Mon Mar 24 23:40:50 2003 (3E800802)
f67da000 f67e3000   ndisuio  ndisuio.sys  Mon Mar 24 23:09:47 2003 (3E8000BB)
f687c000 f68a9000   Fastfat  Fastfat.SYS  Tue Mar 25 00:00:16 2003 (3E800C90)
f68a9000 f68bc000   Fips     Fips.SYS     Tue Mar 25 00:54:59 2003 (3E801963)
f68bc000 f6928000   mrxsmb   mrxsmb.sys   Tue Jan 18 17:35:18 2005 (41EDB956)
f6928000 f6953000   rdbss    rdbss.sys    Mon Oct 11 17:38:09 2004 (416B2771)
f6a1b000 f6a50000   netbt    netbt.sys    Fri Jul 18 10:16:03 2003 (3F182B53)
f6a50000 f6ab2000   tcpip    tcpip.sys    Wed May 25 12:08:14 2005 (4294CD1E)
f6ab2000 f6ace000   ipsec    ipsec.sys    Mon Mar 24 23:55:45 2003 (3E800B81)
f6b08000 f6b3a680   UdfReadr_xp UdfReadr_xp.SYS Thu Aug 01 00:16:28 2002 (3D48E04C)
f6b75000 f6baf980   cdudf_xp cdudf_xp.SYS Thu Aug 01 00:15:06 2002 (3D48DFFA)
f6c84000 f6c8c000   Fs_Rec   Fs_Rec.SYS   Mon Mar 24 23:08:36 2003 (3E800074)
f6cc4000 f6ccc000   rasacd   rasacd.sys   Mon Mar 24 23:11:50 2003 (3E800136)
f6cd4000 f6ce8000   Savrtpel Savrtpel.sys Fri Feb 04 20:03:26 2005 (4204458E)
f6ce8000 f6d04be0   SYMEVENT SYMEVENT.SYS Fri Apr 29 12:00:28 2005 (4272844C)
f6d05000 f6d5a000   savrt    savrt.sys    Fri Feb 04 20:03:24 2005 (4204458C)
f6d5a000 f6d66000   vga      vga.sys      Mon Mar 24 23:08:03 2003 (3E800053)
f6dca000 f6dd4000   Dxapi    Dxapi.sys    Mon Mar 24 23:06:01 2003 (3E7FFFD9)
f6dda000 f6de4000   HidBatt  HidBatt.sys  Mon Mar 24 23:16:30 2003 (3E80024E)
f6e62000 f6e75000   usbhub   usbhub.sys   Mon Mar 24 23:10:46 2003 (3E8000F6)
f6e75000 f6ea8000   update   update.sys   Tue Mar 25 00:59:59 2003 (3E801A8F)
f6ea8000 f6edc000   rdpdr    rdpdr.sys    Mon Mar 24 23:09:30 2003 (3E8000AA)
f6edc000 f6ef1000   raspptp  raspptp.sys  Tue Mar 25 00:19:09 2003 (3E8010FD)
f6ef1000 f6f0c000   ndiswan  ndiswan.sys  Tue Mar 25 00:48:19 2003 (3E8017D3)
f6f0c000 f6f23000   rasl2tp  rasl2tp.sys  Mon Mar 24 23:54:46 2003 (3E800B46)
f6f23000 f6f44e80   USBPORT  USBPORT.SYS  Mon Mar 24 23:10:43 2003 (3E8000F3)
f6f45000 f6f611e0   pwd_2k   pwd_2k.SYS   Thu Aug 01 00:19:57 2002 (3D48E11D)
f6f8a000 f6fa9d00   ks       ks.sys       Wed Dec 04 09:09:38 2002 (3DEE36D2)
f6faa000 f6fbe000   redbook  redbook.sys  Mon Mar 24 23:04:38 2003 (3E7FFF86)
f6fbe000 f6fd2000   cdrom    cdrom.sys    Mon Mar 24 23:05:18 2003 (3E7FFFAE)
f6fd2000 f6fe9000   parport  parport.sys  Mon Mar 24 23:03:56 2003 (3E7FFF5C)
f6fe9000 f6ff6000   netbios  netbios.sys  Mon Mar 24 23:09:53 2003 (3E8000C1)
f6ff9000 f7006000   wanarp   wanarp.sys   Mon Mar 24 23:11:22 2003 (3E80011A)
f7039000 f7042000   dump_scsiport dump_scsiport.sys Mon Mar 24 23:05:15 2003 (3E7FFFAB)
f7059000 f7068000   msgpc    msgpc.sys    Mon Mar 24 23:10:12 2003 (3E8000D4)
f7089000 f70a1000   serial   serial.sys   Mon Mar 24 23:40:08 2003 (3E8007D8)
f70a1000 f70b7000   i8042prt i8042prt.sys Tue Mar 25 01:01:43 2003 (3E801AF7)
f70b7000 f70d0000   VIDEOPRT VIDEOPRT.SYS Mon Mar 24 23:08:02 2003 (3E800052)
f70d0000 f7123d80   ati2mpad ati2mpad.sys Thu Jul 18 18:13:20 2002 (3D3767B0)
f7124000 f713cc00   e1000325 e1000325.sys Mon Jan 13 11:12:12 2003 (3E230F8C)
f713d000 f7145000   RDPCDD   RDPCDD.sys   Mon Mar 24 23:03:05 2003 (3E7FFF29)
f7145000 f7149200   usbohci  usbohci.sys  Mon Mar 24 23:10:41 2003 (3E8000F1)
f714d000 f7155000   mnmdd    mnmdd.SYS    Mon Mar 24 23:07:53 2003 (3E800049)
f7155000 f715a560   Cdralw2k Cdralw2k.SYS Thu Aug 01 00:24:20 2002 (3D48E224)
f7165000 f716c000   Beep     Beep.SYS     Mon Mar 24 23:03:04 2003 (3E7FFF28)
f716d000 f7174000   Null     Null.SYS     Mon Mar 24 23:03:05 2003 (3E7FFF29)
f7175000 f717af00   HIDPARSE HIDPARSE.SYS Mon Mar 24 23:10:13 2003 (3E8000D5)
f717d000 f7182720   mmc_2K   mmc_2K.SYS   Thu Aug 01 00:20:04 2002 (3D48E124)
f71d9000 f71dce40   ASPI32   ASPI32.SYS   Fri Sep 10 16:46:10 1999 (37D99842)
f7225000 f7247000   Mup      Mup.sys      Tue Mar 25 00:55:58 2003 (3E80199E)
f7247000 f7288000   NDIS     NDIS.sys     Tue Mar 25 00:45:35 2003 (3E80172F)
f7288000 f7325000   Ntfs     Ntfs.sys     Mon Mar 24 23:40:05 2003 (3E8007D5)
f7325000 f7346000   KSecDD   KSecDD.sys   Mon Mar 24 23:05:39 2003 (3E7FFFC3)
f7346000 f735c000   CLASSPNP CLASSPNP.SYS Mon Mar 24 23:38:14 2003 (3E800766)
f735c000 f736d5c0   afamgt   afamgt.sys   Tue Oct 29 19:00:12 2002 (3DBF4B3C)
f736e000 f7394000   SCSIPORT SCSIPORT.SYS Tue Mar 25 00:01:25 2003 (3E800CD5)
f7394000 f73b0000   atapi    atapi.sys    Mon Mar 24 23:04:48 2003 (3E7FFF90)
f73b0000 f73d1000   volsnap  volsnap.sys  Mon Mar 24 23:05:47 2003 (3E7FFFCB)
f73d1000 f73fb000   dmio     dmio.sys     Mon Mar 24 23:08:14 2003 (3E80005E)
f73fb000 f7420000   ftdisk   ftdisk.sys   Mon Mar 24 23:05:26 2003 (3E7FFFB6)
f7420000 f7435000   pci      pci.sys      Mon Mar 24 23:16:40 2003 (3E800258)
f7435000 f7466000   ACPI     ACPI.sys     Mon Mar 24 23:16:21 2003 (3E800245)
f7487000 f7490000   WMILIB   WMILIB.SYS   Mon Mar 24 23:13:00 2003 (3E80017C)
f7497000 f74a6000   isapnp   isapnp.sys   Mon Mar 24 23:16:35 2003 (3E800253)
f74a7000 f74b4000   PCIIDEX  PCIIDEX.SYS  Mon Mar 24 23:04:44 2003 (3E7FFF8C)
f74b7000 f74c6000   MountMgr MountMgr.sys Mon Mar 24 23:03:05 2003 (3E7FFF29)
f74c7000 f74d5000   PartMgr  PartMgr.sys  Tue Mar 25 00:04:02 2003 (3E800D72)
f74d7000 f74e4f00   aic78xx  aic78xx.sys  Mon May 20 09:16:12 2002 (3CE9214C)
f74e7000 f74f6000   disk     disk.sys     Mon Mar 24 23:05:20 2003 (3E7FFFB0)
f74f7000 f7503000   Dfs      Dfs.sys      Mon Mar 24 23:09:52 2003 (3E8000C0)
f7507000 f7510000   crcdisk  crcdisk.sys  Mon Mar 24 23:07:23 2003 (3E80002B)
f7527000 f7531000   flpydisk flpydisk.sys Mon Mar 24 23:04:32 2003 (3E7FFF80)
f7537000 f7540000   hidusb   hidusb.sys   Mon Mar 24 23:10:17 2003 (3E8000D9)
f7547000 f7555000   HIDCLASS HIDCLASS.SYS Mon Mar 24 23:10:17 2003 (3E8000D9)
f7577000 f7581000   Msfs     Msfs.SYS     Mon Mar 24 23:08:56 2003 (3E800088)
f7587000 f7593000   Npfs     Npfs.SYS     Mon Mar 24 23:08:59 2003 (3E80008B)
f75b7000 f75c3000   processr processr.sys Mon Mar 24 23:07:36 2003 (3E800038)
f75c7000 f75d1000   TAPE     TAPE.SYS     Mon Mar 24 23:05:25 2003 (3E7FFFB5)
f75d7000 f75e0000   watchdog watchdog.sys Mon Mar 24 23:09:01 2003 (3E80008D)
f75e7000 f75f2000   fdc      fdc.sys      Mon Mar 24 23:04:31 2003 (3E7FFF7F)
f75f7000 f7601000   kbdclass kbdclass.sys Mon Mar 24 23:03:10 2003 (3E7FFF2E)
f7607000 f7611000   mouclass mouclass.sys Mon Mar 24 23:03:09 2003 (3E7FFF2D)
f7617000 f7621000   serenum  serenum.sys  Mon Mar 24 23:04:01 2003 (3E7FFF61)
f7627000 f7635000   imapi    imapi.sys    Mon Mar 24 23:05:45 2003 (3E7FFFC9)
f7637000 f7645ee0   Cdr4_xp  Cdr4_xp.SYS  Thu Aug 01 00:25:16 2002 (3D48E25C)
f7647000 f7650000   ndistapi ndistapi.sys Mon Mar 24 23:11:28 2003 (3E800120)
f7657000 f7665000   raspppoe raspppoe.sys Mon Mar 24 23:11:37 2003 (3E800129)
f7667000 f7672000   TDI      TDI.SYS      Mon Mar 24 23:14:28 2003 (3E8001D4)
f7677000 f7682000   ptilink  ptilink.sys  Mon Mar 24 23:03:51 2003 (3E7FFF57)
f7687000 f7690000   raspti   raspti.sys   Mon Mar 24 23:11:36 2003 (3E800128)
f7697000 f76a6000   termdd   termdd.sys   Mon Mar 24 23:02:52 2003 (3E7FFF1C)
f76a7000 f76b5000   NDProxy  NDProxy.SYS  Mon Mar 24 23:11:30 2003 (3E800122)
f7707000 f770f000   kdcom    kdcom.dll    Mon Mar 24 23:08:00 2003 (3E800050)
f770f000 f7717000   BOOTVID  BOOTVID.dll  Mon Mar 24 23:07:58 2003 (3E80004E)
f7717000 f771e000   pciide   pciide.sys   Mon Mar 24 23:04:46 2003 (3E7FFF8E)
f771f000 f7726000   dmload   dmload.sys   Mon Mar 24 23:08:08 2003 (3E800058)
f7727000 f772cf00   mraid35x mraid35x.sys Fri May 30 10:24:54 2003 (3ED793E6)
f772f000 f7735780   symmpi   symmpi.sys   Fri Oct 04 18:46:19 2002 (3D9E446B)
f7737000 f773bbc0   PxHelp20 PxHelp20.sys Tue Oct 28 10:25:49 2003 (3F9EB4AD)
f77af000 f77b6000   dxgthk   dxgthk.sys   Mon Mar 24 23:05:52 2003 (3E7FFFD0)
f77b7000 f77bf000   stdatw2k stdatw2k.sys Fri Aug 27 07:21:10 2004 (412F4356)
f77c7000 f77cf000   audstub  audstub.sys  Mon Mar 24 23:09:12 2003 (3E800098)
f77cf000 f77d6000   parvdm   parvdm.sys   Mon Mar 24 23:03:49 2003 (3E7FFF55)
f77d7000 f77dcf00   dump_mraid35x dump_mraid35x.sys Fri May 30 10:24:54 2003 (3ED793E6)
f77ef000 f77f6000   i2omgmt  i2omgmt.SYS  Mon Mar 24 23:07:18 2003 (3E800026)
f7897000 f7899800   compbatt compbatt.sys Mon Mar 24 23:16:28 2003 (3E80024C)
f789b000 f789e880   BATTC    BATTC.SYS    Mon Mar 24 23:16:20 2003 (3E800244)
f79e9000 f79ea580   USBD     USBD.SYS     Mon Mar 24 23:10:39 2003 (3E8000EF)
f79f5000 f79f6a60   uphcleanhlp uphcleanhlp.sys Thu Mar 04 21:43:35 2004 (40481387)
f7aa7000 f7aa8000   swenum   swenum.sys   Wed Dec 04 09:10:07 2002 (3DEE36EF)

Unloaded modules:
f5491000 f54a3000   naveng.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
f54a3000 f5545000   navex15.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
f6bd0000 f6be2000   naveng.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
f6be2000 f6c84000   navex15.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
f660c000 f6663000   wlbs.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
f6b47000 f6b4a000   scsichng.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
f77e7000 f77ec000   04mmdat.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
f77d7000 f77df000   Sfloppy.SYS
    Timestamp: unavailable (00000000)
    Checksum:  00000000
Closing open log file c:\debuglog.txt

Author

Commented:
You know, ever since I installed it, that issue started around that time.

Author

Commented:
So I finally ran the executable and rebooted my PC.  I will test it out this weekend.  Also as an FYI, sometimes this reboot happens, then while starting up some services errors pop up.  The one I am curious about is the "The following boot-start or system-start driver(s) failed to load: 4mmdat--VRTS.

Do you think this might be causing the issue with the reboot?  CHeck this out.  The tape backup was supposed to start at 11pm.  THe PC got the Error:6008 unexpect shutdown at 11:04pm.  Also, reading up, there is no specific driver for this product with Windows, it uses windows tape drivers(from what I read).  Could it possibly be the tape drive going bad?  Or the driver?

The only thing that makes me believe that it isnt truly this, is the other times it shutdown.  Sometimes it would shutdown prior the the Tape Backup f rom starting (even an hour prior).  

Commented:
Can you provide more output of the minidumps? Maybe your system crash have multiple culprits.

You miss the exclamation mark for analyze and it shoud be !analyze
.reload;anlayze -v;r;kv;lmnt;.logclose;q <-- incorrect
.reload;!anlayze -v;r;kv;lmnt;.logclose;q <-- correct

Author

Commented:
OK.................Here is the latest minidump.  Installed the executable for Symantec then rebooted a couple of days ago.  Still getting issue with the PC shutting down.  Can you look at this code, then help me decide where to look?  Should I uninstall Norton, or should I replace the RAM?

Opened log file 'c:\debuglog.txt'
2: kd> .sympath srv*c:\symbols*http://msdl.microsoft.com/download/symbols
Symbol search path is: srv*c:\symbols*http://msdl.microsoft.com/download/symbols
2: kd> .reload;!analyze -v;r;kv;lmnt;.logclose;q
Loading Kernel Symbols
........................................................................................................................
Loading unloaded module list
.........
Loading User Symbols
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

KERNEL_MODE_EXCEPTION_NOT_HANDLED_M (1000008e)
This is a very common bugcheck.  Usually the exception address pinpoints
the driver/function that caused the problem.  Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003.  This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG.  This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG.  This will let us see why this breakpoint is
happening.
Arguments:
Arg1: c0000005, The exception code that was not handled
Arg2: f728a284, The address that the exception occurred at
Arg3: f2291860, Trap Frame
Arg4: 00000000

Debugging Details:
------------------

*** WARNING: Unable to verify timestamp for SYMEVENT.SYS
*** ERROR: Module load completed but symbols could not be loaded for SYMEVENT.SYS

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx". The memory could not be "%s".

FAULTING_IP:
Ntfs!NtfsAcquireResourceExclusive+4
f728a284 6681380207       cmp     word ptr [eax],0x702

TRAP_FRAME:  f2291860 -- (.trap fffffffff2291860)
.trap fffffffff2291860
ErrCode = 00000000
eax=00000000 ebx=88646578 ecx=f72acf7e edx=89e9a590 esi=886466e4 edi=00000000
eip=f728a284 esp=f22918d4 ebp=f22919d4 iopl=0         nv up ei ng nz ac po nc
cs=0008  ss=0010  ds=0023  es=0023  fs=0030  gs=0000             efl=00010296
Ntfs!NtfsAcquireResourceExclusive+0x4:
f728a284 6681380207       cmp     word ptr [eax],0x702  ds:0023:00000000=????
.trap
Resetting default scope

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  DRIVER_FAULT_SERVER_MINIDUMP

BUGCHECK_STR:  0x8E

CURRENT_IRQL:  0

LAST_CONTROL_TRANSFER:  from f72d3e9f to f728a284

STACK_TEXT:  
f22918d0 f72d3e9f 89e9a510 00000000 00000001 Ntfs!NtfsAcquireResourceExclusive+0x4
f22919d4 804f0be3 8a569020 88646578 f2291a34 Ntfs!NtfsFsdCreate+0x362
f22919e4 f6cf3173 f2291a34 f2041a00 00000000 nt!IofCallDriver+0x3f
WARNING: Stack unwind information not available. Following frames may be wrong.
f2291b58 8058f412 8a5a5778 00000000 87ec4e28 SYMEVENT+0xb173
f2291bd4 8058eb49 00000000 f2291c14 00000040 nt!ObpLookupObjectName+0x545
f2291c28 80590a39 00000000 00000000 291d6401 nt!ObOpenObjectByName+0xe8
f2291ca4 80590b0d 0096d70c 02100080 0096d6a8 nt!IopCreateFile+0x413
f2291cf0 8058f21e 0096d70c 02100080 0096d6a8 nt!IoCreateFile+0x3d
f2291d30 804dfd24 0096d70c 02100080 0096d6a8 nt!NtCreateFile+0x2e
f2291d30 7ffe0304 0096d70c 02100080 0096d6a8 nt!KiSystemService+0xd0
0096d704 00000000 00000000 00000000 00000000 SharedUserData!SystemCallStub+0x4


FOLLOWUP_IP:
SYMEVENT+b173
f6cf3173 ??               ???

SYMBOL_STACK_INDEX:  3

FOLLOWUP_NAME:  MachineOwner

SYMBOL_NAME:  SYMEVENT+b173

MODULE_NAME:  SYMEVENT

IMAGE_NAME:  SYMEVENT.SYS

DEBUG_FLR_IMAGE_TIMESTAMP:  42ddb287

STACK_COMMAND:  .trap fffffffff2291860 ; kb

FAILURE_BUCKET_ID:  0x8E_SYMEVENT+b173

BUCKET_ID:  0x8E_SYMEVENT+b173

Followup: MachineOwner
---------

eax=00000000 ebx=88646578 ecx=f72acf7e edx=89e9a590 esi=886466e4 edi=00000000
eip=f728a284 esp=f22918d4 ebp=f22919d4 iopl=0         nv up ei ng nz ac po nc
cs=0008  ss=0010  ds=0023  es=0023  fs=0030  gs=0000             efl=00010296
Ntfs!NtfsAcquireResourceExclusive+0x4:
f728a284 6681380207       cmp     word ptr [eax],0x702  ds:0023:00000000=????
ChildEBP RetAddr  Args to Child              
f22918d0 f72d3e9f 89e9a510 00000000 00000001 Ntfs!NtfsAcquireResourceExclusive+0x4 (FPO: [3,0,0])
f22919d4 804f0be3 8a569020 88646578 f2291a34 Ntfs!NtfsFsdCreate+0x362 (FPO: [Non-Fpo])
f22919e4 f6cf3173 f2291a34 f2041a00 00000000 nt!IofCallDriver+0x3f (FPO: [0,0,0])
WARNING: Stack unwind information not available. Following frames may be wrong.
f2291b58 8058f412 8a5a5778 00000000 87ec4e28 SYMEVENT+0xb173
f2291bd4 8058eb49 00000000 f2291c14 00000040 nt!ObpLookupObjectName+0x545 (FPO: [Non-Fpo])
f2291c28 80590a39 00000000 00000000 291d6401 nt!ObOpenObjectByName+0xe8 (FPO: [Non-Fpo])
f2291ca4 80590b0d 0096d70c 02100080 0096d6a8 nt!IopCreateFile+0x413 (FPO: [Non-Fpo])
f2291cf0 8058f21e 0096d70c 02100080 0096d6a8 nt!IoCreateFile+0x3d (FPO: [Non-Fpo])
f2291d30 804dfd24 0096d70c 02100080 0096d6a8 nt!NtCreateFile+0x2e (FPO: [Non-Fpo])
f2291d30 7ffe0304 0096d70c 02100080 0096d6a8 nt!KiSystemService+0xd0 (FPO: [0,0] TrapFrame @ f2291d64)
0096d704 00000000 00000000 00000000 00000000 SharedUserData!SystemCallStub+0x4 (FPO: [0,0,0])
start    end        module name
804de000 80747000   nt       ntkrnlmp.exe Wed May 04 19:54:40 2005 (42798AF0)
80747000 8076f000   hal      halmacpi.dll Mon Mar 24 23:07:28 2003 (3E800030)
bf800000 bf9c7000   win32k   win32k.sys   Tue Mar 08 00:31:56 2005 (422D62FC)
bf9c7000 bfa1d680   ati2drad ati2drad.dll Tue Mar 25 01:43:37 2003 (3E8024C9)
bff80000 bff96000   dxg      dxg.sys      Tue Mar 25 01:46:23 2003 (3E80256F)
bffa0000 bffe8000   ATMFD    ATMFD.DLL    Tue Mar 25 01:46:23 2003 (3E80256F)
f53a7000 f53c9000   RDPWD    RDPWD.SYS    Mon Mar 24 23:03:00 2003 (3E7FFF24)
f5491000 f54a2980   naveng   naveng.sys   Tue Oct 18 11:48:24 2005 (43554378)
f54a3000 f55448c0   navex15  navex15.sys  Tue Oct 18 12:11:58 2005 (435548FE)
f5cc5000 f5cdd000   ipnat    ipnat.sys    Mon Mar 24 23:11:05 2003 (3E800109)
f5d29000 f5d2aa60   uphcleanhlp uphcleanhlp.sys Thu Mar 04 21:43:35 2004 (40481387)
f626d000 f62cb000   srv      srv.sys      Tue May 03 17:47:41 2005 (42781BAD)
f668b000 f66ba000   afd      afd.sys      Mon Mar 24 23:40:50 2003 (3E800802)
f67aa000 f67b3000   ndisuio  ndisuio.sys  Mon Mar 24 23:09:47 2003 (3E8000BB)
f687c000 f68a9000   Fastfat  Fastfat.SYS  Tue Mar 25 00:00:16 2003 (3E800C90)
f68a9000 f68bc000   Fips     Fips.SYS     Tue Mar 25 00:54:59 2003 (3E801963)
f68bc000 f6928000   mrxsmb   mrxsmb.sys   Tue Jan 18 17:35:18 2005 (41EDB956)
f6928000 f6953000   rdbss    rdbss.sys    Mon Oct 11 17:38:09 2004 (416B2771)
f6963000 f696d000   Dxapi    Dxapi.sys    Mon Mar 24 23:06:01 2003 (3E7FFFD9)
f6973000 f697d000   TDTCP    TDTCP.SYS    Mon Mar 24 23:02:52 2003 (3E7FFF1C)
f6a1b000 f6a50000   netbt    netbt.sys    Fri Jul 18 10:16:03 2003 (3F182B53)
f6a50000 f6ab2000   tcpip    tcpip.sys    Wed May 25 12:08:14 2005 (4294CD1E)
f6ab2000 f6ace000   ipsec    ipsec.sys    Mon Mar 24 23:55:45 2003 (3E800B81)
f6aee000 f6af1e40   ASPI32   ASPI32.SYS   Fri Sep 10 16:46:10 1999 (37D99842)
f6b08000 f6b3a680   UdfReadr_xp UdfReadr_xp.SYS Thu Aug 01 00:16:28 2002 (3D48E04C)
f6b75000 f6baf980   cdudf_xp cdudf_xp.SYS Thu Aug 01 00:15:06 2002 (3D48DFFA)
f6cac000 f6cb3000   parvdm   parvdm.sys   Mon Mar 24 23:03:49 2003 (3E7FFF55)
f6cbc000 f6cc4000   rasacd   rasacd.sys   Mon Mar 24 23:11:50 2003 (3E800136)
f6cd4000 f6ce8000   Savrtpel Savrtpel.sys Fri Feb 04 20:03:26 2005 (4204458E)
f6ce8000 f6d04cc0   SYMEVENT SYMEVENT.SYS Tue Jul 19 19:10:15 2005 (42DDB287)
f6d05000 f6d5a000   savrt    savrt.sys    Fri Feb 04 20:03:24 2005 (4204458C)
f6d7a000 f6d86000   vga      vga.sys      Mon Mar 24 23:08:03 2003 (3E800053)
f6e62000 f6e75000   usbhub   usbhub.sys   Mon Mar 24 23:10:46 2003 (3E8000F6)
f6e75000 f6ea8000   update   update.sys   Tue Mar 25 00:59:59 2003 (3E801A8F)
f6ea8000 f6edc000   rdpdr    rdpdr.sys    Mon Mar 24 23:09:30 2003 (3E8000AA)
f6edc000 f6ef1000   raspptp  raspptp.sys  Tue Mar 25 00:19:09 2003 (3E8010FD)
f6ef1000 f6f0c000   ndiswan  ndiswan.sys  Tue Mar 25 00:48:19 2003 (3E8017D3)
f6f0c000 f6f23000   rasl2tp  rasl2tp.sys  Mon Mar 24 23:54:46 2003 (3E800B46)
f6f23000 f6f44e80   USBPORT  USBPORT.SYS  Mon Mar 24 23:10:43 2003 (3E8000F3)
f6f45000 f6f611e0   pwd_2k   pwd_2k.SYS   Thu Aug 01 00:19:57 2002 (3D48E11D)
f6f8a000 f6fa9d00   ks       ks.sys       Wed Dec 04 09:09:38 2002 (3DEE36D2)
f6faa000 f6fbe000   redbook  redbook.sys  Mon Mar 24 23:04:38 2003 (3E7FFF86)
f6fbe000 f6fd2000   cdrom    cdrom.sys    Mon Mar 24 23:05:18 2003 (3E7FFFAE)
f6ff2000 f6fff000   netbios  netbios.sys  Mon Mar 24 23:09:53 2003 (3E8000C1)
f7002000 f700f000   wanarp   wanarp.sys   Mon Mar 24 23:11:22 2003 (3E80011A)
f7012000 f701c000   HidBatt  HidBatt.sys  Mon Mar 24 23:16:30 2003 (3E80024E)
f7072000 f7089000   parport  parport.sys  Mon Mar 24 23:03:56 2003 (3E7FFF5C)
f7089000 f70a1000   serial   serial.sys   Mon Mar 24 23:40:08 2003 (3E8007D8)
f70a1000 f70b7000   i8042prt i8042prt.sys Tue Mar 25 01:01:43 2003 (3E801AF7)
f70b7000 f70d0000   VIDEOPRT VIDEOPRT.SYS Mon Mar 24 23:08:02 2003 (3E800052)
f70d0000 f7123d80   ati2mpad ati2mpad.sys Thu Jul 18 18:13:20 2002 (3D3767B0)
f7124000 f713cc00   e1000325 e1000325.sys Mon Jan 13 11:12:12 2003 (3E230F8C)
f7145000 f7149200   usbohci  usbohci.sys  Mon Mar 24 23:10:41 2003 (3E8000F1)
f7155000 f715a560   Cdralw2k Cdralw2k.SYS Thu Aug 01 00:24:20 2002 (3D48E224)
f715d000 f7165000   RDPCDD   RDPCDD.sys   Mon Mar 24 23:03:05 2003 (3E7FFF29)
f7165000 f716d000   mnmdd    mnmdd.SYS    Mon Mar 24 23:07:53 2003 (3E800049)
f7175000 f717c000   Beep     Beep.SYS     Mon Mar 24 23:03:04 2003 (3E7FFF28)
f717d000 f7182720   mmc_2K   mmc_2K.SYS   Thu Aug 01 00:20:04 2002 (3D48E124)
f7185000 f718c000   Null     Null.SYS     Mon Mar 24 23:03:05 2003 (3E7FFF29)
f7225000 f7247000   Mup      Mup.sys      Tue Mar 25 00:55:58 2003 (3E80199E)
f7247000 f7288000   NDIS     NDIS.sys     Tue Mar 25 00:45:35 2003 (3E80172F)
f7288000 f7325000   Ntfs     Ntfs.sys     Mon Mar 24 23:40:05 2003 (3E8007D5)
f7325000 f7346000   KSecDD   KSecDD.sys   Mon Mar 24 23:05:39 2003 (3E7FFFC3)
f7346000 f735c000   CLASSPNP CLASSPNP.SYS Mon Mar 24 23:38:14 2003 (3E800766)
f735c000 f736d5c0   afamgt   afamgt.sys   Tue Oct 29 19:00:12 2002 (3DBF4B3C)
f736e000 f7394000   SCSIPORT SCSIPORT.SYS Tue Mar 25 00:01:25 2003 (3E800CD5)
f7394000 f73b0000   atapi    atapi.sys    Mon Mar 24 23:04:48 2003 (3E7FFF90)
f73b0000 f73d1000   volsnap  volsnap.sys  Mon Mar 24 23:05:47 2003 (3E7FFFCB)
f73d1000 f73fb000   dmio     dmio.sys     Mon Mar 24 23:08:14 2003 (3E80005E)
f73fb000 f7420000   ftdisk   ftdisk.sys   Mon Mar 24 23:05:26 2003 (3E7FFFB6)
f7420000 f7435000   pci      pci.sys      Mon Mar 24 23:16:40 2003 (3E800258)
f7435000 f7466000   ACPI     ACPI.sys     Mon Mar 24 23:16:21 2003 (3E800245)
f7487000 f7490000   WMILIB   WMILIB.SYS   Mon Mar 24 23:13:00 2003 (3E80017C)
f7497000 f74a6000   isapnp   isapnp.sys   Mon Mar 24 23:16:35 2003 (3E800253)
f74a7000 f74b4000   PCIIDEX  PCIIDEX.SYS  Mon Mar 24 23:04:44 2003 (3E7FFF8C)
f74b7000 f74c6000   MountMgr MountMgr.sys Mon Mar 24 23:03:05 2003 (3E7FFF29)
f74c7000 f74d5000   PartMgr  PartMgr.sys  Tue Mar 25 00:04:02 2003 (3E800D72)
f74d7000 f74e4f00   aic78xx  aic78xx.sys  Mon May 20 09:16:12 2002 (3CE9214C)
f74e7000 f74f6000   disk     disk.sys     Mon Mar 24 23:05:20 2003 (3E7FFFB0)
f74f7000 f7503000   Dfs      Dfs.sys      Mon Mar 24 23:09:52 2003 (3E8000C0)
f7507000 f7510000   crcdisk  crcdisk.sys  Mon Mar 24 23:07:23 2003 (3E80002B)
f7527000 f7531000   Msfs     Msfs.SYS     Mon Mar 24 23:08:56 2003 (3E800088)
f7537000 f7540000   hidusb   hidusb.sys   Mon Mar 24 23:10:17 2003 (3E8000D9)
f7547000 f7555000   HIDCLASS HIDCLASS.SYS Mon Mar 24 23:10:17 2003 (3E8000D9)
f7557000 f7563000   Npfs     Npfs.SYS     Mon Mar 24 23:08:59 2003 (3E80008B)
f7597000 f75a0000   dump_scsiport dump_scsiport.sys Mon Mar 24 23:05:15 2003 (3E7FFFAB)
f75a7000 f75b6000   msgpc    msgpc.sys    Mon Mar 24 23:10:12 2003 (3E8000D4)
f75b7000 f75c3000   processr processr.sys Mon Mar 24 23:07:36 2003 (3E800038)
f75c7000 f75d0000   watchdog watchdog.sys Mon Mar 24 23:09:01 2003 (3E80008D)
f75d7000 f75e2000   fdc      fdc.sys      Mon Mar 24 23:04:31 2003 (3E7FFF7F)
f75e7000 f75f1000   kbdclass kbdclass.sys Mon Mar 24 23:03:10 2003 (3E7FFF2E)
f75f7000 f7601000   mouclass mouclass.sys Mon Mar 24 23:03:09 2003 (3E7FFF2D)
f7607000 f7611000   serenum  serenum.sys  Mon Mar 24 23:04:01 2003 (3E7FFF61)
f7617000 f7625000   imapi    imapi.sys    Mon Mar 24 23:05:45 2003 (3E7FFFC9)
f7627000 f7635ee0   Cdr4_xp  Cdr4_xp.SYS  Thu Aug 01 00:25:16 2002 (3D48E25C)
f7637000 f7640000   ndistapi ndistapi.sys Mon Mar 24 23:11:28 2003 (3E800120)
f7647000 f7655000   raspppoe raspppoe.sys Mon Mar 24 23:11:37 2003 (3E800129)
f7657000 f7662000   TDI      TDI.SYS      Mon Mar 24 23:14:28 2003 (3E8001D4)
f7667000 f7672000   ptilink  ptilink.sys  Mon Mar 24 23:03:51 2003 (3E7FFF57)
f7677000 f7680000   raspti   raspti.sys   Mon Mar 24 23:11:36 2003 (3E800128)
f7687000 f7696000   termdd   termdd.sys   Mon Mar 24 23:02:52 2003 (3E7FFF1C)
f7697000 f76a5000   NDProxy  NDProxy.SYS  Mon Mar 24 23:11:30 2003 (3E800122)
f76b7000 f76c1000   flpydisk flpydisk.sys Mon Mar 24 23:04:32 2003 (3E7FFF80)
f7707000 f770f000   kdcom    kdcom.dll    Mon Mar 24 23:08:00 2003 (3E800050)
f770f000 f7717000   BOOTVID  BOOTVID.dll  Mon Mar 24 23:07:58 2003 (3E80004E)
f7717000 f771e000   pciide   pciide.sys   Mon Mar 24 23:04:46 2003 (3E7FFF8E)
f771f000 f7726000   dmload   dmload.sys   Mon Mar 24 23:08:08 2003 (3E800058)
f7727000 f772cf00   mraid35x mraid35x.sys Fri May 30 10:24:54 2003 (3ED793E6)
f772f000 f7735780   symmpi   symmpi.sys   Fri Oct 04 18:46:19 2002 (3D9E446B)
f7737000 f773bbc0   PxHelp20 PxHelp20.sys Tue Oct 28 10:25:49 2003 (3F9EB4AD)
f776f000 f7777000   Fs_Rec   Fs_Rec.SYS   Mon Mar 24 23:08:36 2003 (3E800074)
f7777000 f777cf00   HIDPARSE HIDPARSE.SYS Mon Mar 24 23:10:13 2003 (3E8000D5)
f77b7000 f77bbfe0   04mmdat  04mmdat.sys  Wed Jan 29 13:30:10 2003 (3E3847E2)
f77bf000 f77c6000   dxgthk   dxgthk.sys   Mon Mar 24 23:05:52 2003 (3E7FFFD0)
f77c7000 f77cf000   audstub  audstub.sys  Mon Mar 24 23:09:12 2003 (3E800098)
f77cf000 f77d4f00   dump_mraid35x dump_mraid35x.sys Fri May 30 10:24:54 2003 (3ED793E6)
f77d7000 f77de000   i2omgmt  i2omgmt.SYS  Mon Mar 24 23:07:18 2003 (3E800026)
f7897000 f7899800   compbatt compbatt.sys Mon Mar 24 23:16:28 2003 (3E80024C)
f789b000 f789e880   BATTC    BATTC.SYS    Mon Mar 24 23:16:20 2003 (3E800244)
f79db000 f79dc580   USBD     USBD.SYS     Mon Mar 24 23:10:39 2003 (3E8000EF)
f7ab3000 f7ab4000   swenum   swenum.sys   Wed Dec 04 09:10:07 2002 (3DEE36EF)

Unloaded modules:
f600d000 f6017000   TDTCP.SYS
    Timestamp: unavailable (00000000)
    Checksum:  00000000
f5d41000 f5d63000   RDPWD.SYS
    Timestamp: unavailable (00000000)
    Checksum:  00000000
f5491000 f54a3000   naveng.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
f54a3000 f5545000   navex15.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
f6bd0000 f6be2000   naveng.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
f6be2000 f6c84000   navex15.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
f660c000 f6663000   wlbs.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
f6b3f000 f6b42000   scsichng.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
f77cf000 f77d7000   Sfloppy.SYS
    Timestamp: unavailable (00000000)
    Checksum:  00000000
Closing open log file c:\debuglog.txt

Commented:
Can you attach all the system event 1001/1003 within last two months?

Control Panel -> Adminstrative Tools -> Event Viewer -> System -> Event 1001/1003. Copy the content and paste it back here

Author

Commented:
I entered the last three 1001 and 1003 events in the system log.  I hope this will help.  Thanks cpc2004 for being such a great resource.

*******10/23/05   Source: Save Dump Category: None  Event ID: 1001   12:51:24am*********

The computer has rebooted from a bugcheck.  The bugcheck was: 0x1000008e (0xc0000005, 0xf728a284, 0xf2291860, 0x00000000). A dump was saved in: C:\WINDOWS\Minidump\Mini102305-01.dmp.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
---------------------------------------------------------------------------------------------------------------------
********10/22/05   Source: Save Dump  Event ID: 1001  Category: None 12:51:03am*********

The computer has rebooted from a bugcheck.  The bugcheck was: 0x1000008e (0xc0000005, 0xf728a284, 0xf4bfa860, 0x00000000). A dump was saved in: C:\WINDOWS\Minidump\Mini102205-01.dmp.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
--------------------------------------------------------------------------------------------------------------------
********10/22/05   Source: Save Dump  Event ID: 1001 Category: None 11:04:02pm*********

The computer has rebooted from a bugcheck.  The bugcheck was: 0x1000008e (0xc0000005, 0x8059f2dc, 0xf6f795b0, 0x00000000). A dump was saved in: C:\WINDOWS\Minidump\Mini102005-02.dmp.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
----------------------------------------------------------------------------------------------------------------------------------------
******10/24/05   Source: System Error  Event ID: 1003 Category: (102) 7:00:02AM********

Error code 1000008e, parameter1 c0000005, parameter2 f728a284, parameter3 f2291860, parameter4 00000000.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
--------------------------------------------------------------------------------------------------------------------
******10/22/05   Source: System Error  Event ID: 1003 Category: (102) 11:40:20AM*******

Error code 1000008e, parameter1 c0000005, parameter2 f728a284, parameter3 f4bfa860, parameter4 00000000.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
-------------------------------------------------------------------------------------------------------------------
******10/21/05   Source: System Error  Event ID: 1003 Category: (102) 6:05:46AM********

Error code 1000008e, parameter1 c0000005, parameter2 8059f2dc, parameter3 f6f795b0, parameter4 00000000.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Author

Commented:
Anybody there?????????????????????//

Commented:
Your windows crashes with 3 different address. Probably the culprit is faulty ram. Run memtest to stress test the ram. If you can attach the 5 to 6 minidumps at the webspace, I will provide more accurate answer.

Commented:
Yours stack trace has the footprint of Norton AV. There has an known issue of bugcheck 8E for Norton AV
http://service1.symantec.com/SUPPORT/ent-security.nsf/pfdocs/2005081909325748?Open&dtype=corp

STACK_TEXT:  
f22918d0 f72d3e9f 89e9a510 00000000 00000001 Ntfs!NtfsAcquireResourceExclusive+0x4
f22919d4 804f0be3 8a569020 88646578 f2291a34 Ntfs!NtfsFsdCreate+0x362
f22919e4 f6cf3173 f2291a34 f2041a00 00000000 nt!IofCallDriver+0x3f
WARNING: Stack unwind information not available. Following frames may be wrong.
f2291b58 8058f412 8a5a5778 00000000 87ec4e28 SYMEVENT+0xb173  <-- Norton AV
f2291bd4 8058eb49 00000000 f2291c14 00000040 nt!ObpLookupObjectName+0x545


Commented:
Do you resolve the problem after you de-install or upgrade Norton AV?

Commented:
Do you have any update?

Author

Commented:
Sorry guys, ive been out and about.  Let me test this today

Author

Commented:
Also I am running 10.0  Small Business Corporate Edition for Norton.  Does this still have the issue.

Commented:
Your version of Norton AV is unstable. Upgrade Norton AV to 10.0.2


No comment has been added to this question in more than 21 days, so it is now classified as abandoned.
I will leave the following recommendation for this question in the Cleanup topic area:

Accept cpc2004's comment as answer.

Any objections should be posted here in the next 4 days. After that time, the question will be closed.

Miguel
EE Cleanup Volunteer

Do more with

Expert Office
Submit tech questions to Ask the Experts™ at any time to receive solutions, advice, and new ideas from leading industry professionals.

Start 7-Day Free Trial