• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 275
  • Last Modified:

Windows XP restarting - help me to understand what the problem is

I have a XP media cetre windows that is restarting periodically about once a day.  I cannot pinpoint why.  I have tried to use this dumpchk.exe and think I have the information below.

Could someone please tell me what is wrong or give me further instructions on what to do.
Microsoft (R) Windows Debugger Version 6.12.0002.633 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\WINDOWS\Minidump\Mini032810-03.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

WARNING: Inaccessible path: 'c:\windows\i386'
Symbol search path is: srv*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: c:\windows\i386
Windows XP Kernel Version 2600 (Service Pack 3) MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 2600.xpsp.080413-2111
Machine Name:
Kernel base = 0x804d7000 PsLoadedModuleList = 0x805634c0
Debug session time: Sun Mar 28 10:21:23.640 2010 (UTC + 1:00)
System Uptime: 0 days 0:22:11.344
Loading Kernel Symbols
...............................................................
......................................................
Loading User Symbols
Loading unloaded module list
.............
ERROR: FindPlugIns 8007007b
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1000008E, {c0000005, b94ac2c8, b5a8a05c, 0}

Unable to load image nv4_disp.dll, Win32 error 0n2
*** WARNING: Unable to verify timestamp for nv4_disp.dll
*** ERROR: Module load completed but symbols could not be loaded for nv4_disp.dll
Probably caused by : memory_corruption

Followup: memory_corruption
---------

0: kd> !analyze -v
ERROR: FindPlugIns 8007007b
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

KERNEL_MODE_EXCEPTION_NOT_HANDLED_M (1000008e)
This is a very common bugcheck.  Usually the exception address pinpoints
the driver/function that caused the problem.  Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003.  This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG.  This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG.  This will let us see why this breakpoint is
happening.
Arguments:
Arg1: c0000005, The exception code that was not handled
Arg2: b94ac2c8, The address that the exception occurred at
Arg3: b5a8a05c, Trap Frame
Arg4: 00000000

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx". The memory could not be "%s".

FAULTING_IP: 
nv4_mini!dacSetDigitalDisplayDynamicScriptOffsets_InvalidStrap_LVDSInfo+238
b94ac2c8 188b91006500    sbb     byte ptr [ebx+650091h],cl

TRAP_FRAME:  b5a8a05c -- (.trap 0xffffffffb5a8a05c)
ErrCode = 00000002
eax=b94ac2c0 ebx=00000000 ecx=897dd000 edx=b5a8a0f8 esi=897dcfff edi=897dd004
eip=b94ac2c8 esp=b5a8a0d0 ebp=89802008 iopl=0         nv up ei ng nz ac pe nc
cs=0008  ss=0010  ds=0023  es=0023  fs=0030  gs=0000             efl=00010296
nv4_mini!dacSetDigitalDisplayDynamicScriptOffsets_InvalidStrap_LVDSInfo+0x238:
b94ac2c8 188b91006500    sbb     byte ptr [ebx+650091h],cl  ds:0023:00650091=??
Resetting default scope

CUSTOMER_CRASH_COUNT:  3

DEFAULT_BUCKET_ID:  CODE_CORRUPTION

BUGCHECK_STR:  0x8E

PROCESS_NAME:  explorer.exe

LAST_CONTROL_TRANSFER:  from b943cde4 to b94ac2c8

STACK_TEXT:  
b5a8a0d4 b943cde4 897dd000 8980f798 00000001 nv4_mini!dacSetDigitalDisplayDynamicScriptOffsets_InvalidStrap_LVDSInfo+0x238
b5a8a0e8 b941d811 897dd000 8980f798 00000000 nv4_mini!dacProgramCRTCImageEnable+0x24
b5a8a104 b942806d 897dd000 00000000 00000000 nv4_mini!dacDisableImage+0x31
b5a8a150 b940ba26 898044b0 8980f798 0000007a nv4_mini!dacDisableDac+0x37d
b5a8a174 b9599ca9 897dfe48 00000000 002320a4 nv4_mini!RmPostModeSet+0xb6
b5a8a230 b93d7729 89a68350 b5a8a24c 00000010 nv4_mini!NVStartIO+0xb69
b5a8a2f4 804e13c9 89a68038 884ee6b8 00000000 VIDEOPRT!pVideoPortDispatch+0xabf
b5a8a304 bf85a1ae e16dc010 00000180 00000001 nt!IopfCallDriver+0x31
b5a8a334 bf85a228 89a68038 002320a4 b5a8a398 win32k!GreDeviceIoControl+0x93
b5a8a358 bf03a405 89a68038 002320a4 b5a8a398 win32k!EngDeviceIoControl+0x1f
WARNING: Stack unwind information not available. Following frames may be wrong.
b5a8a378 e16dcb00 e16dc010 e16dc010 00000000 nv4_disp+0x28405
b5a8a3e0 00000000 b5a8a418 00000000 00000001 0xe16dcb00


STACK_COMMAND:  kb

CHKIMG_EXTENSION: !chkimg -lo 50 -d !nv4_mini
    b94ac2c6 - nv4_mini!dacSetDigitalDisplayDynamicScriptOffsets_InvalidStrap_LVDSInfo+236
	[ 8b:ab ]
1 error : !nv4_mini (b94ac2c6)

MODULE_NAME: memory_corruption

IMAGE_NAME:  memory_corruption

FOLLOWUP_NAME:  memory_corruption

DEBUG_FLR_IMAGE_TIMESTAMP:  0

MEMORY_CORRUPTOR:  ONE_BIT

FAILURE_BUCKET_ID:  MEMORY_CORRUPTION_ONE_BIT

BUCKET_ID:  MEMORY_CORRUPTION_ONE_BIT

Followup: memory_corruption
---------

Open in new window

0
darbid73
Asked:
darbid73
  • 7
  • 7
2 Solutions
 
datumasterCommented:
Seems you have a corrupted memory as log shows, try memtest86 to check memory of your computer. you can download cd image from memtest.org and create a bootable cd burnong this image.
0
 
optomaCommented:
Hi,
Can you upload three recent minidump files
0
 
darbid73Author Commented:
sure here they are.

Microsoft (R) Windows Debugger Version 6.12.0002.633 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\WINDOWS\Minidump\Mini032810-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

WARNING: Inaccessible path: 'c:\windows\i386'
Symbol search path is: srv*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: c:\windows\i386
Windows XP Kernel Version 2600 (Service Pack 3) MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 2600.xpsp.080413-2111
Machine Name:
Kernel base = 0x804d7000 PsLoadedModuleList = 0x805634c0
Debug session time: Sun Mar 28 00:06:27.125 2010 (UTC + 1:00)
System Uptime: 0 days 7:08:30.833
Loading Kernel Symbols
...............................................................
......................................................
Loading User Symbols
Loading unloaded module list
............
Unable to load image KLIF.SYS, Win32 error 0n2
*** WARNING: Unable to verify timestamp for KLIF.SYS
*** ERROR: Module load completed but symbols could not be loaded for KLIF.SYS
ERROR: FindPlugIns 8007007b
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 10000050, {cef9f49c, 0, b5d07811, 0}


Could not read faulting driver name
Probably caused by : hardware ( KLIF+15811 )

Followup: MachineOwner
---------

0: kd> !analyze -v
ERROR: FindPlugIns 8007007b
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced.  This cannot be protected by try-except,
it must be protected by a Probe.  Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: cef9f49c, memory referenced.
Arg2: 00000000, value 0 = read operation, 1 = write operation.
Arg3: b5d07811, If non-zero, the instruction address which referenced the bad memory
	address.
Arg4: 00000000, (reserved)

Debugging Details:
------------------


Could not read faulting driver name

READ_ADDRESS:  cef9f49c 

FAULTING_IP: 
KLIF+15811
b5d07811 c40cc7          les     ecx,fword ptr [edi+eax*8]

MM_INTERNAL_CODE:  0

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  DRIVER_FAULT

BUGCHECK_STR:  0x50

PROCESS_NAME:  firefox.exe

MISALIGNED_IP: 
KLIF+15811
b5d07811 c40cc7          les     ecx,fword ptr [edi+eax*8]

LAST_CONTROL_TRANSFER:  from b5cfb284 to b5d07811

STACK_TEXT:  
WARNING: Stack unwind information not available. Following frames may be wrong.
b45a0c88 b5cfb284 8961f3a8 00000000 00000000 KLIF+0x15811
b45a0d4c 804dd98f 0012f970 001f0fff 0012f940 KLIF+0x9284
b45a0d4c 00000000 0012f970 001f0fff 0012f940 nt!KiFastCallEntry+0xfc


STACK_COMMAND:  kb

FOLLOWUP_IP: 
KLIF+15811
b5d07811 c40cc7          les     ecx,fword ptr [edi+eax*8]

SYMBOL_STACK_INDEX:  0

SYMBOL_NAME:  KLIF+15811

FOLLOWUP_NAME:  MachineOwner

IMAGE_NAME:  hardware

DEBUG_FLR_IMAGE_TIMESTAMP:  0

MODULE_NAME: hardware

FAILURE_BUCKET_ID:  IP_MISALIGNED_KLIF.SYS

BUCKET_ID:  IP_MISALIGNED_KLIF.SYS

Followup: MachineOwner
---------

*****************************************************************

Microsoft (R) Windows Debugger Version 6.12.0002.633 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\WINDOWS\Minidump\Mini032810-02.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

WARNING: Inaccessible path: 'c:\windows\i386'
Symbol search path is: srv*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: c:\windows\i386
Windows XP Kernel Version 2600 (Service Pack 3) MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 2600.xpsp.080413-2111
Machine Name:
Kernel base = 0x804d7000 PsLoadedModuleList = 0x805634c0
Debug session time: Sun Mar 28 09:58:47.000 2010 (UTC + 1:00)
System Uptime: 0 days 6:23:03.693
Loading Kernel Symbols
...............................................................
......................................................
Loading User Symbols
Loading unloaded module list
.............
ERROR: FindPlugIns 8007007b
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 10000050, {c9851449, 1, bf852e18, 0}


Could not read faulting driver name
Probably caused by : memory_corruption

Followup: memory_corruption
---------

1: kd> !analyze -v
ERROR: FindPlugIns 8007007b
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced.  This cannot be protected by try-except,
it must be protected by a Probe.  Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: c9851449, memory referenced.
Arg2: 00000001, value 0 = read operation, 1 = write operation.
Arg3: bf852e18, If non-zero, the instruction address which referenced the bad memory
	address.
Arg4: 00000000, (reserved)

Debugging Details:
------------------


Could not read faulting driver name

WRITE_ADDRESS:  c9851449 

FAULTING_IP: 
win32k!PhkNextValid+7
bf852e18 088b481485c9    or      byte ptr [ebx-367AEBB8h],cl

MM_INTERNAL_CODE:  0

CUSTOMER_CRASH_COUNT:  2

DEFAULT_BUCKET_ID:  CODE_CORRUPTION

BUGCHECK_STR:  0x50

PROCESS_NAME:  csrss.exe

LAST_CONTROL_TRANSFER:  from 70bf83c8 to bf852e18

STACK_TEXT:  
b7c23985 70bf83c8 30bbe546 a4e198a4 00b7c23a win32k!PhkNextValid+0x7
WARNING: Frame IP not in any known module. Following frames may be wrong.
b7c2398d a4e198a4 00b7c23a 3d000000 e0804dc8 0x70bf83c8
b7c23991 00b7c23a 3d000000 e0804dc8 40b7c239 0xa4e198a4
b7c23995 3d000000 e0804dc8 40b7c239 2089a926 0xb7c23a
b7c23999 e0804dc8 40b7c239 2089a926 70f771f1 0x3d000000
b7c2399d 40b7c239 2089a926 70f771f1 d889bf33 0xe0804dc8
b7c239a1 2089a926 70f771f1 d889bf33 e0804e1b 0x40b7c239
b7c239a5 70f771f1 d889bf33 e0804e1b 00b7c239 0x2089a926
b7c239a9 d889bf33 e0804e1b 00b7c239 70000000 0x70f771f1
b7c239ad e0804e1b 00b7c239 70000000 e0bbe546 0xd889bf33
b7c239b1 00b7c239 70000000 e0bbe546 94b7c239 0xe0804e1b
b7c239b5 70000000 e0bbe546 94b7c239 c8bf8027 0xb7c239
b7c239b9 e0bbe546 94b7c239 c8bf8027 d8e17d32 0x70000000
b7c239bd 94b7c239 c8bf8027 d8e17d32 30b7c239 0xe0bbe546
b7c239c1 c8bf8027 d8e17d32 30b7c239 c6e198a4 0x94b7c239
b7c239c5 d8e17d32 30b7c239 c6e198a4 e8bf800b 0xc8bf8027
b7c239c9 30b7c239 c6e198a4 e8bf800b b4b7c239 0xd8e17d32
b7c239cd c6e198a4 e8bf800b b4b7c239 48bf8023 0x30b7c239
b7c239d1 e8bf800b b4b7c239 48bf8023 b889b445 0xc6e198a4
b7c239d5 b4b7c239 48bf8023 b889b445 03e12e23 0xe8bf800b
b7c239d9 48bf8023 b889b445 03e12e23 0c000000 0xb4b7c239
b7c239dd b889b445 03e12e23 0c000000 0cb7c23a 0x48bf8023
b7c239e1 03e12e23 0c000000 0cb7c23a d5b7c23a 0xb889b445
b7c239e5 0c000000 0cb7c23a d5b7c23a 70bf83c8 0x3e12e23
b7c239e9 0cb7c23a d5b7c23a 70bf83c8 0003e546 0xc000000
b7c239ed d5b7c23a 70bf83c8 0003e546 01000000 0xcb7c23a
b7c239f1 70bf83c8 0003e546 01000000 a4000000 0xd5b7c23a
b7c239f5 0003e546 01000000 a4000000 1cb7c23a 0x70bf83c8
b7c239f9 01000000 a4000000 1cb7c23a 54b7c23a 0x3e546
b7c239fd a4000000 1cb7c23a 54b7c23a d6b7c23a 0x1000000
b7c23a01 1cb7c23a 54b7c23a d6b7c23a 00bf801a 0xa4000000
b7c23a05 54b7c23a d6b7c23a 00bf801a 01000000 0x1cb7c23a
b7c23a09 d6b7c23a 00bf801a 01000000 00000000 0x54b7c23a
b7c23a0d 00bf801a 01000000 00000000 03000000 0xd6b7c23a
b7c23a11 01000000 00000000 03000000 80000000 0xbf801a
b7c23a15 00000000 03000000 80000000 30bf9aae 0x1000000


STACK_COMMAND:  kb

CHKIMG_EXTENSION: !chkimg -lo 50 -d !win32k
    bf852e16 - win32k!PhkNextValid+5
	[ 8b:ab ]
1 error : !win32k (bf852e16)

MODULE_NAME: memory_corruption

IMAGE_NAME:  memory_corruption

FOLLOWUP_NAME:  memory_corruption

DEBUG_FLR_IMAGE_TIMESTAMP:  0

MEMORY_CORRUPTOR:  ONE_BIT

FAILURE_BUCKET_ID:  MEMORY_CORRUPTION_ONE_BIT

BUCKET_ID:  MEMORY_CORRUPTION_ONE_BIT

Followup: memory_corruption
---------

Open in new window

0
Upgrade your Question Security!

Your question, your audience. Choose who sees your identity—and your question—with question security.

 
optomaCommented:
Agree, memtest is good route to take.

Upload the actual .dmp files from c:\windows\minidump
0
 
darbid73Author Commented:
here they are - i will not be able to do the memtest right now.

Mini032810-01.dmp
Mini032810-02.dmp
Mini032810-03.dmp
0
 
optomaCommented:
When you get to run Memtest let it pass at least three times
0
 
darbid73Author Commented:
I have done 4 passes and there are no errors.
0
 
optomaCommented:
Ok.

When system restarts is there a common programs running at that time?

Run autoruns.
In Autoruns:
Hit options and check "verify code signatures" and rescan (F5 key)
Don't make any other changes...

Within Autoruns,select the file tab and select save(Ctrl+S) and save as AutoRuns Data (*.arn) -Output file is a few megs in size
Once saved then right click autoruns.arn and rename to autoruns.txt to upload

Autoruns http://technet.microsoft.com/en-us/sysinternals/bb963902.aspx
0
 
darbid73Author Commented:
here it is

file.txt
0
 
optomaCommented:
Run dxdiag from run box and see if tests pass.

When machine crashes>random times of day?

0
 
darbid73Author Commented:
and we have a winner.

Doing the draw tests and 3d test my sceen flashes and then stays off.  No reboot though.

Are there further tests like this which give a dump file or something of the problem.
0
 
optomaCommented:
Try updating graphics card drivers.

Appears to be Nvidia
http://www.nvidia.com/Download/index5.aspx?lang=en-us

If you cant get them there try the machine manufacturers driver website
0
 
darbid73Author Commented:
Optoma I got sick of XP.  I have installed Windows 7 on the box.  It has been running now for a about a week without any error messages or restarts.

Thanks for your help.  Whilst you have not provided a solution I think I will throw you the points for the help as we probably would not have found a solution anyway.
0
 
darbid73Author Commented:
Dear Moderator,

I wanted to close this question awarding the points to optoma.  I am not sure that this is what is happening?? Could you please make sure he gets the points.
0
 
optomaCommented:
Not to worry. Probably was a driver issue. Win7 probably had them builtin and is stable.
Question being closed as such is fine. Your comment as accepted and mine as assisted!
0

Featured Post

Free Tool: ZipGrep

ZipGrep is a utility that can list and search zip (.war, .ear, .jar, etc) archives for text patterns, without the need to extract the archive's contents.

One of a set of tools we're offering as a way to say thank you for being a part of the community.

  • 7
  • 7
Tackle projects and never again get stuck behind a technical roadblock.
Join Now