Solved

Blue Screen flashes too quickly to read. Can't find reason for shut-down in the Event Viewer

Posted on 2006-11-16
17
1,135 Views
Last Modified: 2012-05-05
I am running Windows XP SP 2. I randomly (2-4 times per week) get total shut down following the blue screen that flashes by so fast I can't read it. I have checked the Event View (Application, Security and System) and see where several services started on the reboot but can't find any problem at or near the time of shutdown. Where else can I check to find the specific error listed on the blue screen?

thanks,
grant
0
Comment
Question by:granttmiller
  • 6
  • 6
  • 4
  • +1
17 Comments
 
LVL 8

Expert Comment

by:caddlady
ID: 17957122
Go to   Control Panel      then       System,  Click on the Advanced Tab,  Startup and Recovery area - click on Settings button.   Uncheck  - Automatically Restart.

It will not restart and the next time it happens the blue screen will stay up until you press and hold in the power button for about 4 or more seconds on the computer.
0
 
LVL 20

Expert Comment

by:cpc2004
ID: 17957210
The crash may be caused by faulty ram or device driver error (ie video, sound card, modem and etc). The system event log and the minidump has the most useful diagnostic information. When Windows crashes with blue screen, it writes a system event 1001 or 1003 and a minidump to the folder \windows\minidump. Check system event 1001 and 1003 and it has the detail of the blue screen.

Event ID: 1001
Source: Save Dump
Description:
The computer has rebooted from a bugcheck.The bugcheck was : 0xc000000a (0xe1270188, 0x00000002, 0x00000000, 0x804032100).
Microsoft Windows..... A dump was saved in: .......

Event Source: System Error
Event Category: (102)
Event ID: 1003
Description:
Error code 1000007f, parameter1 0000000d, parameter2 00000000, parameter3 00000000, parameter4 00000000

Control Panel -> Adminstrative Tools -> Event Viewer -> System -> Event 1001/1003. Copy the content and paste it back here

Zip 5 to 6 minidumps to a zip file and attach it at any webspace. I will study the dump and find out the culprit. If you can't provide the minidumps, run memtest to stress test the ram. Make sure that your windows is not infected with spyware, adware adn chkdsk /r.
http://www.memtest86.com/.

Get public webspace
Use a free service like rapidshare to attach the minidumps and post the url of the mimidumps at this thread.
http://www.rapidshare.de/
0
 

Author Comment

by:granttmiller
ID: 17957569
cpc2004   I looked in the minidump folder. There are 9 files dating back to 2-2006. The most recent one is 9/30/2006. Do you want to see these?

In the Event Viewer -> System there are no 1001/1003 Events. There are 1001/1003 events in Event Viewer -> Applications. The most recent "Warning" was 10/25/2006:

Event Type:      Warning
Event Source:      MsiInstaller
Event Category:      None
Event ID:      1001
Date:            10/25/2006
Time:            7:02:31 AM
User:            GTM-XP2\Grant
Computer:      GTM-XP2
Description:
Detection of product '{00000409-78E1-11D2-B60F-006097C998E7}', feature 'TCWP5Files' failed during request for component '{CC29EC7F-7BC2-11D1-A921-00A0C91E2AA2}'

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
______________________________________________________

The most recent "Error" was 9/22/2006:

Event Type:      Error
Event Source:      Application Error
Event Category:      None
Event ID:      1001
Date:            9/22/2006
Time:            5:41:37 AM
User:            N/A
Computer:      GTM-XP2
Description:
Fault bucket 329158863.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 42 75 63 6b 65 74 3a 20   Bucket:
0008: 33 32 39 31 35 38 38 36   32915886
0010: 33 0d 0a                  3..    

Thanks for your help,
grant

0
 
LVL 66

Expert Comment

by:johnb6767
ID: 17958565
Any other errrors in System with the times of the crashing?
0
 
LVL 20

Expert Comment

by:cpc2004
ID: 17961495
Hi,

I want the system event 1001 & 1003. You provide the application event 1001 & 1003.

cpc2004
0
 
LVL 20

Expert Comment

by:cpc2004
ID: 17961863
Hi Granttmiller,

You provide the application event
>>>>
Event Source:     Application Error
Event Category:     None
Event ID:     1001
Date:          9/22/2006
>>>

I want system event
>>>
Event Source: System Error
Event Category: (102)
Event ID: 1003
>>>>

I wonder why the latest system event is on 30th Sep. Unless it is a hardware error, windows always records the system event for blue screen for problem determination. Can you attach the minidumps at the webspace?

cpc2004
0
 
LVL 8

Expert Comment

by:caddlady
ID: 17964792
cpc2004 - in his post above - he stated that there were no 1001 or 1003 events in the System, only in the Application log.

The first error listed is dealing with the "TCWP5Files" -  I would run a repair on Office.

go to:

Control Panel / Add Remove Programs / Find Microsoft Office in the list / click on Change / then Repair your Office Installation.


or

You can open up Word, go to the Help pull-down and select   Detect and Repair.

0
 

Author Comment

by:granttmiller
ID: 17964946

1. I unchecked automatic restart in the Startup and Recovery settings so I should be able to have the blue screen stay visible if I have another crash.

2. I have zipped and uploaded the minidump files to my file transfer site.

3. My file transfer site can be accessed at milleracq.leapfile.com , select "File Portal", login id is "expert", password "minidump".

4. I don't find any 1101 or 1103 System Errors, but I have copied the entire System Event log to an .evt file and posted it to my site also.

5. There have been several irpstacksize errors although not at the time of the crash. I increased the stacksize from 15 to 20.

6. In the Startup and Recovery settings "write an event to the system log" and "write debugging information" are not selected. It seems that these are set wrong. Should these settings be changed. (see pdf screenshot that I posted)
0
Backup Your Microsoft Windows Server®

Backup all your Microsoft Windows Server – on-premises, in remote locations, in private and hybrid clouds. Your entire Windows Server will be backed up in one easy step with patented, block-level disk imaging. We achieve RTOs (recovery time objectives) as low as 15 seconds.

 
LVL 20

Expert Comment

by:cpc2004
ID: 17965347
Hi,

>>>
6. In the Startup and Recovery settings "write an event to the system log" and "write debugging information" are not selected. It seems that these are set wrong. Should these settings be changed
>>>

You have to enable event log and debugging information.
0
 

Author Comment

by:granttmiller
ID: 17968956
The computer just crashed again. BSOD listed the following: CANCEL_STATE_IN_COMPLETED_IRP       and       0X00000048(0X848A30B0, 0X00000000,0X00000000)

I just uploaded the minidump file: Mini111706-01.dmp to the site listed above.

Any help would be appreciated,
thanks,
grant
0
 

Author Comment

by:granttmiller
ID: 17968974
Also, I did run the repair on Microsoft Office (2000). I received the following pop-up: "Unable to access configuration for Microsoft Personal WebServer".
I downloaded and installed all of the Office updates, ran repair again and still get the same notice.
0
 
LVL 20

Expert Comment

by:cpc2004
ID: 17969778
Hi,

You have to provide the url of the dump.

cpc2004
0
 

Author Comment

by:granttmiller
ID: 17971494
The dump file is located at:

milleracq.leapfile.com , select "File Portal", login id is "expert", password "minidump".

thanks,
gtm
0
 
LVL 20

Expert Comment

by:cpc2004
ID: 17973480
Hi gtm,

I cannot find the minidump after I login milleracq.leapfile.com

cpc2004
0
 
LVL 8

Accepted Solution

by:
caddlady earned 500 total points
ID: 17973756
mrtrate is not loading and is part of quickbooks.  Which version of quickbooks are you running?  Has this machine been upgraded from Win98 to XP?

http://support.microsoft.com/?kbid=305649
http://support.microsoft.com/kb/252414
http://web.intuit.com/support/quicken/2004/win/6173.html


There also seems to possibly be a problem with the Nvidia ATA driver, have you tried updated the drivers?

You have a Promise Raid controller in your computer also?  Raid Array?    


It looks like you installed SystemSuite 7 Professional on the 16th, did it assist in any manner or make anything slower?


The link below is a possibility for your irpstack error:

 http://support.microsoft.com/kb/177078


aspi32 error in the system log: - this would seem to follow along with the NVidia and Promise disk controller errors....

http://support.microsoft.com/kb/307128

You have also installed and or updated alot of Printer drivers since the 14th.  Have you checked for updates to that Scansoft software, etc.
0
 

Author Comment

by:granttmiller
ID: 17976046

caddlady.

Apparently you were able to download my files. Thanks.

Answers:

1. Quickbooks 2004 and Quicken 2007. I think I have eliminated the possibility of the Background Download manager trying to start and cause the mrtrate error. I've seen no more errors.

2. You were right the Nvidia ATA drivers, and Radeon Display drivers, and Intel Modem drivers, and ... ..... all needed to be updated.

3. I use a Promise Card for a Raid 1 Array. Drivers checked okay for that.

4. I uninstalled SystemSuite for now.

5. There have been no more irpstack errors since increasing the value to 20.

6. Scansoft software and Xerox scanner drivers both check out up to date.

Bottom line, I haven't seen any more BSODs.
Thanks for your help.

0
 
LVL 8

Expert Comment

by:caddlady
ID: 17978556
Your Welcome! :)

0

Featured Post

Highfive Gives IT Their Time Back

Highfive is so simple that setting up every meeting room takes just minutes and every employee will be able to start or join a call from any room with ease. Never be called into a meeting just to get it started again. This is how video conferencing should work!

Join & Write a Comment

Can you find a fax from a vendor you saved a decade ago in seconds? Have you ever cursed your PC under your breath during an audit because you couldn’t find the requested statement or driver history?  If you answered no to the first question or yes …
We have adopted the strategy to use Computers in Student Labs as the bulletin boards. The same target can be achieved by using a Login Notice feature in Group policy but it’s not as attractive as graphical wallpapers with message which grabs the att…
In this seventh video of the Xpdf series, we discuss and demonstrate the PDFfonts utility, which lists all the fonts used in a PDF file. It does this via a command line interface, making it suitable for use in programs, scripts, batch files — any pl…
Access reports are powerful and flexible. Learn how to create a query and then a grouped report using the wizard. Modify the report design after the wizard is done to make it look better. There will be another video to explain how to put the final p…

743 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

12 Experts available now in Live!

Get 1:1 Help Now