jlransom
asked on
XP SP2 system reboots itself about twice per day. I've included link to minidumps.
One of my XP SP2 based PC's reboots itself a couple times a day. It doesn't seem to corelate to any particular application. Several of the crashes refer to tcp/ip stack drivers and several refer to win32k.dll.
Disabled a few services, uninstalled a few programs. Run both Ad-Aware and Seach & Destroy and Norton Antivirus to clean the machine.
I've also run Prime95 for 6 hours without finding any errors. I've tried reading the minidumps but don't know how to use the info provided. Any help would be appreciated.
Here is a link to a zipfile with several minidumps:
http://rapidshare.de/files/16273619/minidumps.zip.html
Disabled a few services, uninstalled a few programs. Run both Ad-Aware and Seach & Destroy and Norton Antivirus to clean the machine.
I've also run Prime95 for 6 hours without finding any errors. I've tried reading the minidumps but don't know how to use the info provided. Any help would be appreciated.
Here is a link to a zipfile with several minidumps:
http://rapidshare.de/files/16273619/minidumps.zip.html
It very well may be a hardware problem instead of a hardware problem. Random reboots often can be attributed to a power supply not functioning correctly. If you have a spare psu try that one to see if the problem still exists.
..."instead of a software problem" that is.. :)
ASKER
I don't have a spare power supply. I was thinking it may be a bad nic since several of the minidumps site pieces of the tcp/ip stack. Before I start changing out parts, I thought someone could look at the minidumps and point me in a more focused direction.
thanks
thanks
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
ASKER
I will try swapping out the ram. I did run 6 hours of Prime95 stress test. Is this not an adequate ram test? From previouse google searches, I thought ram but eliminated it when the recomended prime95 test came up clean.
Some faulty ram can pass ram and this is not reason I don't suggest to run memtest.
Refer the following case, faulty ram pass memtest.
https://www.experts-exchange.com/questions/21505124/Seemingly-random-BSOD-on-MPC-Transport-x1000-laptop-XP-Pro-SP2.html
Refer the following case, faulty ram pass memtest.
https://www.experts-exchange.com/questions/21505124/Seemingly-random-BSOD-on-MPC-Transport-x1000-laptop-XP-Pro-SP2.html
ASKER
I've pulled out one of the sticks of ram. If it fails, I'll replace that one and pull the other. I won't get good info today because the user of the machine is not working today. She should be back tomorrow.
Let me know your test result.
ASKER
Earlier today the user reported an failure of Word to start. She got an error report pointing to winword, but not a reboot. I asked her to check the event viewer, it showed "faulting \application winword.exe..... and a few minutes later, The IP address leas 192.168.1.101 for the Network Car with network address 000EA61987AD has been denied by the DHCP server 192.168.1.1. (The DHCP Server sent a DHCPNACK message). (this system is connected to a linksys wired router.)
Later in the day I got a report that the system "froze" and had an event "Faulting application drwtsn32.exe, version 5.1.2600.0, faulting module dbghelp.dll version 5.1.2600.2180, fault address 0x0001295d.
This is a little bit different symptoms but I'll go ahead and swap memory sticks tonight.
Later in the day I got a report that the system "froze" and had an event "Faulting application drwtsn32.exe, version 5.1.2600.0, faulting module dbghelp.dll version 5.1.2600.2180, fault address 0x0001295d.
This is a little bit different symptoms but I'll go ahead and swap memory sticks tonight.
ASKER
I swapped out the memory and the box immediately blue screend so it appears that the errors from today are indeed a different issue. This new issue looks like one for the networking area. Since the prime95 didn't flag the memory as bad and I have seen many other threads where people have gotten clean memtest results but have bad memory, is there any reliable software memory test?
Thanks for the correct answer...memroy. Thanks for sticking with me, I didn't just accept memory at first because of the stress test passing.
thanks again cpc2004, you get the points.
Thanks for the correct answer...memroy. Thanks for sticking with me, I didn't just accept memory at first because of the stress test passing.
thanks again cpc2004, you get the points.
ASKER
I thought all this was figured out but this morning we had another crash 1000008e error again, but I still have the "bad" memory stick out of the box.
Maybe your windows have multiple culprit. Attach the latest minidump at the webspace.
ASKER
Sorry I didn't get back sooner. I've added output from the minidump below.
I've also been getting warnings that the computer could not renew it's address from the DHCP server (I'm using DHCP from a linksys router), and an error saying I lost the lease on my ip.
I did try moving the remaining memory stick to a new slot. I did not have a crash today for the first time however I did get the warnings and error mentioned above, which I was getting before as well.
kd> !analyze -v
************************** ********** ********** ********** ********** ********** ***
* *
* Bugcheck Analysis *
* *
************************** ********** ********** ********** ********** ********** ***
KERNEL_MODE_EXCEPTION_NOT_ HANDLED_M (1000008e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003. This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG. This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG. This will let us see why this breakpoint is
happening.
Arguments:
Arg1: c000001d, The exception code that was not handled
Arg2: f6a45307, The address that the exception occurred at
Arg3: f34f178c, Trap Frame
Arg4: 00000000
Debugging Details:
------------------
EXCEPTION_CODE: (NTSTATUS) 0xc000001d - {EXCEPTION} Illegal Instruction An attempt was made to execute an illegal instruction.
FAULTING_IP:
tcpip!IPTransmit+1e77
f6a45307 e8b5e5ffff call tcpip!IPFreeBuff (f6a438c1)
TRAP_FRAME: f34f178c -- (.trap fffffffff34f178c)
ErrCode = 00000000
eax=00000000 ebx=00000000 ecx=00000000 edx=f34f17a4 esi=f6a833f0 edi=81ef5348
eip=f6a45307 esp=f34f1800 ebp=f34f1920 iopl=0 nv up ei ng nz na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010282
tcpip!IPTransmit+0x1e77:
f6a45307 e8b5e5ffff call tcpip!IPFreeBuff (f6a438c1)
Resetting default scope
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: DRIVER_FAULT
BUGCHECK_STR: 0x8E
LAST_CONTROL_TRANSFER: from f6a49b83 to f6a45307
FAILED_INSTRUCTION_ADDRESS :
tcpip!IPTransmit+1e77
f6a45307 e8b5e5ffff call tcpip!IPFreeBuff (f6a438c1)
STACK_TEXT:
f34f1920 f6a49b83 f6a836b4 81a1a520 81d8a07c tcpip!IPTransmit+0x1e77
f34f19c0 f6a4994a 81e12718 81a1a520 81e2c0c0 tcpip!FinishRemoveTCBFromC onn+0x42
f34f19e4 f6a499b0 004f1a08 81e2c008 81d8a0bc tcpip!TCPCloseObjectComple te+0x3c
f34f1a1c f6a48308 81e2c0c0 81e2c154 81e2c178 tcpip!FreeTCB+0x77
f34f1a38 804e37f7 8215e2a0 81e2c0c0 81e2c19c tcpip!DoNDISRequest+0x55
f34f1a38 f34f1b00 8215e2a0 81e2c0c0 81e2c19c nt!KeUpdateSystemTime+0xba
WARNING: Frame IP not in any known module. Following frames may be wrong.
81fc6b70 00000000 81a60080 81a60080 81fc6b80 0xf34f1b00
STACK_COMMAND: .bugcheck ; kb
FOLLOWUP_IP:
tcpip!IPTransmit+1e77
f6a45307 e8b5e5ffff call tcpip!IPFreeBuff (f6a438c1)
FAULTING_SOURCE_CODE:
SYMBOL_STACK_INDEX: 0
FOLLOWUP_NAME: MachineOwner
SYMBOL_NAME: tcpip!IPTransmit+1e77
MODULE_NAME: tcpip
IMAGE_NAME: tcpip.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 43c7103c
FAILURE_BUCKET_ID: 0x8E_BAD_IP_tcpip!IPTransm it+1e77
BUCKET_ID: 0x8E_BAD_IP_tcpip!IPTransm it+1e77
Followup: MachineOwner
I've also been getting warnings that the computer could not renew it's address from the DHCP server (I'm using DHCP from a linksys router), and an error saying I lost the lease on my ip.
I did try moving the remaining memory stick to a new slot. I did not have a crash today for the first time however I did get the warnings and error mentioned above, which I was getting before as well.
kd> !analyze -v
**************************
* *
* Bugcheck Analysis *
* *
**************************
KERNEL_MODE_EXCEPTION_NOT_
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003. This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG. This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG. This will let us see why this breakpoint is
happening.
Arguments:
Arg1: c000001d, The exception code that was not handled
Arg2: f6a45307, The address that the exception occurred at
Arg3: f34f178c, Trap Frame
Arg4: 00000000
Debugging Details:
------------------
EXCEPTION_CODE: (NTSTATUS) 0xc000001d - {EXCEPTION} Illegal Instruction An attempt was made to execute an illegal instruction.
FAULTING_IP:
tcpip!IPTransmit+1e77
f6a45307 e8b5e5ffff call tcpip!IPFreeBuff (f6a438c1)
TRAP_FRAME: f34f178c -- (.trap fffffffff34f178c)
ErrCode = 00000000
eax=00000000 ebx=00000000 ecx=00000000 edx=f34f17a4 esi=f6a833f0 edi=81ef5348
eip=f6a45307 esp=f34f1800 ebp=f34f1920 iopl=0 nv up ei ng nz na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010282
tcpip!IPTransmit+0x1e77:
f6a45307 e8b5e5ffff call tcpip!IPFreeBuff (f6a438c1)
Resetting default scope
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: DRIVER_FAULT
BUGCHECK_STR: 0x8E
LAST_CONTROL_TRANSFER: from f6a49b83 to f6a45307
FAILED_INSTRUCTION_ADDRESS
tcpip!IPTransmit+1e77
f6a45307 e8b5e5ffff call tcpip!IPFreeBuff (f6a438c1)
STACK_TEXT:
f34f1920 f6a49b83 f6a836b4 81a1a520 81d8a07c tcpip!IPTransmit+0x1e77
f34f19c0 f6a4994a 81e12718 81a1a520 81e2c0c0 tcpip!FinishRemoveTCBFromC
f34f19e4 f6a499b0 004f1a08 81e2c008 81d8a0bc tcpip!TCPCloseObjectComple
f34f1a1c f6a48308 81e2c0c0 81e2c154 81e2c178 tcpip!FreeTCB+0x77
f34f1a38 804e37f7 8215e2a0 81e2c0c0 81e2c19c tcpip!DoNDISRequest+0x55
f34f1a38 f34f1b00 8215e2a0 81e2c0c0 81e2c19c nt!KeUpdateSystemTime+0xba
WARNING: Frame IP not in any known module. Following frames may be wrong.
81fc6b70 00000000 81a60080 81a60080 81fc6b80 0xf34f1b00
STACK_COMMAND: .bugcheck ; kb
FOLLOWUP_IP:
tcpip!IPTransmit+1e77
f6a45307 e8b5e5ffff call tcpip!IPFreeBuff (f6a438c1)
FAULTING_SOURCE_CODE:
SYMBOL_STACK_INDEX: 0
FOLLOWUP_NAME: MachineOwner
SYMBOL_NAME: tcpip!IPTransmit+1e77
MODULE_NAME: tcpip
IMAGE_NAME: tcpip.sys
DEBUG_FLR_IMAGE_TIMESTAMP:
FAILURE_BUCKET_ID: 0x8E_BAD_IP_tcpip!IPTransm
BUCKET_ID: 0x8E_BAD_IP_tcpip!IPTransm
Followup: MachineOwner
Probably it is related to PSU.
https://www.experts-exchange.com/questions/21618873/please-help-computer-keeps-restarting.html
https://www.experts-exchange.com/questions/21618873/please-help-computer-keeps-restarting.html
ASKER
I moved the memory stick to the second slot and it's stayed up now for three days without failure. Does it make sense to have a slot go bad?