Link to home
Start Free TrialLog in
Avatar of jlransom
jlransom

asked on

XP SP2 system reboots itself about twice per day. I've included link to minidumps.

One of my XP SP2 based PC's reboots itself a couple times a day.  It doesn't seem to corelate to any particular application.  Several of the crashes refer to tcp/ip stack drivers and several refer to win32k.dll.  

Disabled a few services, uninstalled a few programs.  Run both Ad-Aware and Seach & Destroy and Norton Antivirus to clean the machine.

I've also run Prime95 for 6 hours without finding any errors.  I've tried reading the minidumps but don't know how to use the info provided.  Any help would be appreciated.

Here is a link to a zipfile with several minidumps:  
http://rapidshare.de/files/16273619/minidumps.zip.html
Avatar of Rineau
Rineau
Flag of Netherlands image

It very well may be a hardware problem instead of a hardware problem. Random reboots often can be attributed to a power supply not functioning correctly. If you have a spare psu try that one to see if the problem still exists.
..."instead of a software problem" that is.. :)
Avatar of jlransom
jlransom

ASKER

I don't have a spare power supply.  I was thinking it may be a bad nic since several of the minidumps site pieces of the tcp/ip stack.  Before I start changing out parts, I thought someone could look at the minidumps and point me in a more focused direction.

thanks
ASKER CERTIFIED SOLUTION
Avatar of cpc2004
cpc2004
Flag of Hong Kong image

Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
I will try swapping out the ram.  I did run 6 hours of Prime95 stress test.  Is this not an adequate ram test?  From previouse google searches, I thought ram but eliminated it when the recomended prime95 test came up clean.

Some faulty ram can pass ram and this is not reason I don't suggest to run memtest.
Refer the following case, faulty ram pass memtest.
https://www.experts-exchange.com/questions/21505124/Seemingly-random-BSOD-on-MPC-Transport-x1000-laptop-XP-Pro-SP2.html
I've pulled out one of the sticks of ram.  If it fails, I'll replace that one and pull the other.  I won't get good info today because the user of the machine is not working today.  She should be back tomorrow.
Let me know your test result.
Earlier today the user reported an failure of Word to start.  She got an error report pointing to winword, but not a reboot.   I asked her to check the event viewer, it showed "faulting \application winword.exe.....  and a few minutes later, The IP address leas 192.168.1.101 for the Network Car with network address 000EA61987AD has been denied by the DHCP server 192.168.1.1.  (The DHCP Server sent a DHCPNACK message).   (this system is connected to a linksys wired router.)

Later in the day I got a report that the system "froze" and had an event "Faulting application drwtsn32.exe, version 5.1.2600.0, faulting module dbghelp.dll version 5.1.2600.2180, fault address 0x0001295d.  

This is a little bit different symptoms but I'll go ahead and swap memory sticks tonight.
I swapped out the memory and the box immediately blue screend so it appears that the errors from today are indeed a different issue.  This new issue looks like one for the networking area.  Since the prime95 didn't flag the memory as bad and I have seen many other threads where people have gotten clean memtest results but have bad memory, is there any reliable software memory test?

Thanks for the correct answer...memroy.  Thanks for sticking with me, I didn't just accept memory at first because of the stress test passing.

thanks again cpc2004, you get the points.
I thought all this was figured out but this morning we had another crash 1000008e error again, but I still have the "bad" memory stick out of the box.
Maybe your windows have multiple culprit. Attach the latest minidump at the webspace.
Sorry I didn't get back sooner.  I've added output from the minidump below.  

I've also been getting warnings that the computer could not renew it's address from the DHCP server (I'm using DHCP from a linksys router), and an error saying I lost the lease on my ip.

I did try moving the remaining memory stick to a new slot.  I did not have a crash today for the first time however I did get the warnings and error mentioned above, which I was getting before as well.  

kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************
KERNEL_MODE_EXCEPTION_NOT_HANDLED_M (1000008e)
This is a very common bugcheck.  Usually the exception address pinpoints
the driver/function that caused the problem.  Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003.  This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG.  This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG.  This will let us see why this breakpoint is
happening.
Arguments:
Arg1: c000001d, The exception code that was not handled
Arg2: f6a45307, The address that the exception occurred at
Arg3: f34f178c, Trap Frame
Arg4: 00000000

Debugging Details:
------------------
EXCEPTION_CODE: (NTSTATUS) 0xc000001d - {EXCEPTION}  Illegal Instruction  An attempt was made to execute an illegal instruction.

FAULTING_IP:
tcpip!IPTransmit+1e77
f6a45307 e8b5e5ffff       call    tcpip!IPFreeBuff (f6a438c1)

TRAP_FRAME:  f34f178c -- (.trap fffffffff34f178c)
ErrCode = 00000000
eax=00000000 ebx=00000000 ecx=00000000 edx=f34f17a4 esi=f6a833f0 edi=81ef5348
eip=f6a45307 esp=f34f1800 ebp=f34f1920 iopl=0         nv up ei ng nz na pe nc
cs=0008  ss=0010  ds=0023  es=0023  fs=0030  gs=0000             efl=00010282
tcpip!IPTransmit+0x1e77:
f6a45307 e8b5e5ffff       call    tcpip!IPFreeBuff (f6a438c1)
Resetting default scope

CUSTOMER_CRASH_COUNT:  1
DEFAULT_BUCKET_ID:  DRIVER_FAULT
BUGCHECK_STR:  0x8E
LAST_CONTROL_TRANSFER:  from f6a49b83 to f6a45307
FAILED_INSTRUCTION_ADDRESS:
tcpip!IPTransmit+1e77
f6a45307 e8b5e5ffff       call    tcpip!IPFreeBuff (f6a438c1)

STACK_TEXT:  
f34f1920 f6a49b83 f6a836b4 81a1a520 81d8a07c tcpip!IPTransmit+0x1e77
f34f19c0 f6a4994a 81e12718 81a1a520 81e2c0c0 tcpip!FinishRemoveTCBFromConn+0x42
f34f19e4 f6a499b0 004f1a08 81e2c008 81d8a0bc tcpip!TCPCloseObjectComplete+0x3c
f34f1a1c f6a48308 81e2c0c0 81e2c154 81e2c178 tcpip!FreeTCB+0x77
f34f1a38 804e37f7 8215e2a0 81e2c0c0 81e2c19c tcpip!DoNDISRequest+0x55
f34f1a38 f34f1b00 8215e2a0 81e2c0c0 81e2c19c nt!KeUpdateSystemTime+0xba
WARNING: Frame IP not in any known module. Following frames may be wrong.
81fc6b70 00000000 81a60080 81a60080 81fc6b80 0xf34f1b00

STACK_COMMAND:  .bugcheck ; kb

FOLLOWUP_IP:
tcpip!IPTransmit+1e77
f6a45307 e8b5e5ffff       call    tcpip!IPFreeBuff (f6a438c1)

FAULTING_SOURCE_CODE:  
SYMBOL_STACK_INDEX:  0
FOLLOWUP_NAME:  MachineOwner
SYMBOL_NAME:  tcpip!IPTransmit+1e77
MODULE_NAME:  tcpip
IMAGE_NAME:  tcpip.sys
DEBUG_FLR_IMAGE_TIMESTAMP:  43c7103c
FAILURE_BUCKET_ID:  0x8E_BAD_IP_tcpip!IPTransmit+1e77
BUCKET_ID:  0x8E_BAD_IP_tcpip!IPTransmit+1e77
Followup: MachineOwner


 
I moved the memory stick to the second slot and it's stayed up now for three days without failure.  Does it make sense to have a slot go bad?