BleepingComputer.com: Computer restarts daily

I am running XP Professional SP3. Lately I have noticed my computer crashing and reboot very often. At least once a day. Sometimes several more. It is not over heating. Here is what I have gathered from the event view:


The computer has rebooted from a bugcheck. The bugcheck was: 0x1000008e (0xc000001d, 0xb781f1b9, 0xa2d50af0, 0x00000000). A dump was saved in: C:\WINDOWS\Minidump\Mini012812-01.dmp.


Don't know if there is anyone here that can analyze the dump and see what is going on.

Let's try this.

Download/install BlueScreenView, http://www.nirsoft.net/utils/blue_screen_view.html .

Double-click BlueScreenView.exe file.

When autoscan is done (screen comes up), click Edit/Select All...then File/Save Selected Items.

Save the report as BSOD.txt.

Open BSOD.txt, copy all content and paste it into your next reply.

Louis

==================================================
Dump File : Mini012812-01.dmp
Crash Time : 1/28/2012 9:35:32 PM
Bug Check String : KERNEL_MODE_EXCEPTION_NOT_HANDLED
Bug Check Code : 0x1000008e
Parameter 1 : 0xc000001d
Parameter 2 : 0xb781f1b9
Parameter 3 : 0xa2d50af0
Parameter 4 : 0x00000000
Caused By Driver : win32k.sys
Caused By Address : win32k.sys+13608
File Description : Multi-User Win32 Driver
Product Name : Microsoft® Windows® Operating System
Company : Microsoft Corporation
File Version : 5.1.2600.6119 (xpsp_sp3_gdr.110602-1657)
Processor : 32-bit
Crash Address :
Stack Address 1 : win32k.sys+13608
Stack Address 2 : win32k.sys+1eaad
Stack Address 3 : win32k.sys+156a0
Computer Name :
Full Path : C:\WINDOWS\Minidump\Mini012812-01.dmp
Processors Count : 4
Major Version : 15
Minor Version : 2600
Dump File Size : 102,400
==================================================

==================================================
Dump File : Mini012712-02.dmp
Crash Time : 1/27/2012 8:41:04 PM
Bug Check String : PAGE_FAULT_IN_NONPAGED_AREA
Bug Check Code : 0x10000050
Parameter 1 : 0xffffffe8
Parameter 2 : 0x00000001
Parameter 3 : 0x805266ca
Parameter 4 : 0x00000000
Caused By Driver : ntoskrnl.exe
Caused By Address : ntoskrnl.exe+4f6ca
File Description : NT Kernel & System
Product Name : Microsoft® Windows® Operating System
Company : Microsoft Corporation
File Version : 5.1.2600.6055 (xpsp_sp3_gdr.101209-1647)
Processor : 32-bit
Crash Address : ntoskrnl.exe+4f6ca
Stack Address 1 : ntoskrnl.exe+6a67c
Stack Address 2 :
Stack Address 3 :
Computer Name :
Full Path : C:\WINDOWS\Minidump\Mini012712-02.dmp
Processors Count : 4
Major Version : 15
Minor Version : 2600
Dump File Size : 102,400
==================================================

==================================================
Dump File : Mini012712-01.dmp
Crash Time : 1/27/2012 10:49:40 AM
Bug Check String : KERNEL_MODE_EXCEPTION_NOT_HANDLED
Bug Check Code : 0x1000008e
Parameter 1 : 0xc000001d
Parameter 2 : 0xb780ec36
Parameter 3 : 0xa4224f64
Parameter 4 : 0x00000000
Caused By Driver : win32k.sys
Caused By Address : win32k.sys+1eb40
File Description : Multi-User Win32 Driver
Product Name : Microsoft® Windows® Operating System
Company : Microsoft Corporation
File Version : 5.1.2600.6119 (xpsp_sp3_gdr.110602-1657)
Processor : 32-bit
Crash Address :
Stack Address 1 : win32k.sys+152ec
Stack Address 2 : win32k.sys+15638
Stack Address 3 : win32k.sys+150f7
Computer Name :
Full Path : C:\WINDOWS\Minidump\Mini012712-01.dmp
Processors Count : 4
Major Version : 15
Minor Version : 2600
Dump File Size : 102,400
==================================================

==================================================
Dump File : Mini012612-02.dmp
Crash Time : 1/26/2012 2:44:49 PM
Bug Check String : IRQL_NOT_LESS_OR_EQUAL
Bug Check Code : 0x1000000a
Parameter 1 : 0x0000ffdf
Parameter 2 : 0x00000002
Parameter 3 : 0x00000001
Parameter 4 : 0x806e7a8e
Caused By Driver : hal.dll
Caused By Address : hal.dll+2a8e
File Description : Hardware Abstraction Layer DLL
Product Name : Microsoft® Windows® Operating System
Company : Microsoft Corporation
File Version : 5.1.2600.5512 (xpsp.080413-2111)
Processor : 32-bit
Crash Address : hal.dll+2a8e
Stack Address 1 : ntoskrnl.exe+61643
Stack Address 2 : NDIS.sys+6ec
Stack Address 3 : AE1200xp.sys+160e5
Computer Name :
Full Path : C:\WINDOWS\Minidump\Mini012612-02.dmp
Processors Count : 4
Major Version : 15
Minor Version : 2600
Dump File Size : 102,400
==================================================

==================================================
Dump File : Mini012612-01.dmp
Crash Time : 1/26/2012 2:29:43 AM
Bug Check String : IRQL_NOT_LESS_OR_EQUAL
Bug Check Code : 0x1000000a
Parameter 1 : 0x00000004
Parameter 2 : 0x0000001c
Parameter 3 : 0x00000001
Parameter 4 : 0x804f8a75
Caused By Driver : ntoskrnl.exe
Caused By Address : ntoskrnl.exe+21a75
File Description : NT Kernel & System
Product Name : Microsoft® Windows® Operating System
Company : Microsoft Corporation
File Version : 5.1.2600.6055 (xpsp_sp3_gdr.101209-1647)
Processor : 32-bit
Crash Address : ntoskrnl.exe+21a75
Stack Address 1 : ntoskrnl.exe+21caf
Stack Address 2 : ntoskrnl.exe+dd0c3
Stack Address 3 : ntoskrnl.exe+dd2aa
Computer Name :
Full Path : C:\WINDOWS\Minidump\Mini012612-01.dmp
Processors Count : 4
Major Version : 15
Minor Version : 2600
Dump File Size : 102,400
==================================================

==================================================
Dump File : Mini012112-02.dmp
Crash Time : 1/21/2012 10:30:48 AM
Bug Check String : KERNEL_MODE_EXCEPTION_NOT_HANDLED
Bug Check Code : 0x1000008e
Parameter 1 : 0xc0000005
Parameter 2 : 0xbf9552ca
Parameter 3 : 0xa2fd3c00
Parameter 4 : 0x00000000
Caused By Driver : win32k.sys
Caused By Address : win32k.sys+1552ca
File Description : Multi-User Win32 Driver
Product Name : Microsoft® Windows® Operating System
Company : Microsoft Corporation
File Version : 5.1.2600.6119 (xpsp_sp3_gdr.110602-1657)
Processor : 32-bit
Crash Address : win32k.sys+1552ca
Stack Address 1 : win32k.sys+14c957
Stack Address 2 : win32k.sys+14c9d3
Stack Address 3 : ntoskrnl.exe+6a67c
Computer Name :
Full Path : C:\WINDOWS\Minidump\Mini012112-02.dmp
Processors Count : 4
Major Version : 15
Minor Version : 2600
Dump File Size : 102,400
==================================================

==================================================
Dump File : Mini012112-01.dmp
Crash Time : 1/21/2012 10:22:25 AM
Bug Check String : PAGE_FAULT_IN_NONPAGED_AREA
Bug Check Code : 0x10000050
Parameter 1 : 0xffffffe8
Parameter 2 : 0x00000001
Parameter 3 : 0x805266ca
Parameter 4 : 0x00000000
Caused By Driver : ntoskrnl.exe
Caused By Address : ntoskrnl.exe+4f6ca
File Description : NT Kernel & System
Product Name : Microsoft® Windows® Operating System
Company : Microsoft Corporation
File Version : 5.1.2600.6055 (xpsp_sp3_gdr.101209-1647)
Processor : 32-bit
Crash Address : ntoskrnl.exe+4f6ca
Stack Address 1 : ntoskrnl.exe+6a67c
Stack Address 2 :
Stack Address 3 :
Computer Name :
Full Path : C:\WINDOWS\Minidump\Mini012112-01.dmp
Processors Count : 4
Major Version : 15
Minor Version : 2600
Dump File Size : 102,400
==================================================

==================================================
Dump File : Mini122511-01.dmp
Crash Time : 12/25/2011 11:04:44 PM
Bug Check String : KERNEL_MODE_EXCEPTION_NOT_HANDLED
Bug Check Code : 0x1000008e
Parameter 1 : 0xc0000005
Parameter 2 : 0x805b1007
Parameter 3 : 0xa3115bdc
Parameter 4 : 0x00000000
Caused By Driver : win32k.sys
Caused By Address : win32k.sys+5485
File Description : Multi-User Win32 Driver
Product Name : Microsoft® Windows® Operating System
Company : Microsoft Corporation
File Version : 5.1.2600.6119 (xpsp_sp3_gdr.110602-1657)
Processor : 32-bit
Crash Address : ntoskrnl.exe+da007
Stack Address 1 : ntoskrnl.exe+daf32
Stack Address 2 : win32k.sys+2ab1c
Stack Address 3 : ntoskrnl.exe+6a67c
Computer Name :
Full Path : C:\WINDOWS\Minidump\Mini122511-01.dmp
Processors Count : 4
Major Version : 15
Minor Version : 2600
Dump File Size : 102,400
==================================================

==================================================
Dump File : Mini120411-01.dmp
Crash Time : 12/4/2011 10:06:18 PM
Bug Check String : PAGE_FAULT_IN_NONPAGED_AREA
Bug Check Code : 0x10000050
Parameter 1 : 0xffffffe8
Parameter 2 : 0x00000001
Parameter 3 : 0x805266ca
Parameter 4 : 0x00000000
Caused By Driver : ntoskrnl.exe
Caused By Address : ntoskrnl.exe+4f6ca
File Description : NT Kernel & System
Product Name : Microsoft® Windows® Operating System
Company : Microsoft Corporation
File Version : 5.1.2600.6055 (xpsp_sp3_gdr.101209-1647)
Processor : 32-bit
Crash Address : ntoskrnl.exe+4f6ca
Stack Address 1 : ntoskrnl.exe+6a67c
Stack Address 2 :
Stack Address 3 :
Computer Name :
Full Path : C:\WINDOWS\Minidump\Mini120411-01.dmp
Processors Count : 4
Major Version : 15
Minor Version : 2600
Dump File Size : 102,400
==================================================

==================================================
Dump File : Mini120211-01.dmp
Crash Time : 12/2/2011 7:30:51 PM
Bug Check String : KERNEL_MODE_EXCEPTION_NOT_HANDLED
Bug Check Code : 0x1000008e
Parameter 1 : 0xc0000005
Parameter 2 : 0x805b1007
Parameter 3 : 0xa2c1bbdc
Parameter 4 : 0x00000000
Caused By Driver : win32k.sys
Caused By Address : win32k.sys+5485
File Description : Multi-User Win32 Driver
Product Name : Microsoft® Windows® Operating System
Company : Microsoft Corporation
File Version : 5.1.2600.6119 (xpsp_sp3_gdr.110602-1657)
Processor : 32-bit
Crash Address : ntoskrnl.exe+da007
Stack Address 1 : ntoskrnl.exe+daf32
Stack Address 2 : win32k.sys+2ab1c
Stack Address 3 : ntoskrnl.exe+6a67c
Computer Name :
Full Path : C:\WINDOWS\Minidump\Mini120211-01.dmp
Processors Count : 4
Major Version : 15
Minor Version : 2600
Dump File Size : 102,400
==================================================

==================================================
Dump File : Mini111911-01.dmp
Crash Time : 11/19/2011 8:59:30 AM
Bug Check String : PAGE_FAULT_IN_NONPAGED_AREA
Bug Check Code : 0x10000050
Parameter 1 : 0xffffffe8
Parameter 2 : 0x00000001
Parameter 3 : 0x805266ca
Parameter 4 : 0x00000000
Caused By Driver : ntoskrnl.exe
Caused By Address : ntoskrnl.exe+4f6ca
File Description : NT Kernel & System
Product Name : Microsoft® Windows® Operating System
Company : Microsoft Corporation
File Version : 5.1.2600.6055 (xpsp_sp3_gdr.101209-1647)
Processor : 32-bit
Crash Address : ntoskrnl.exe+4f6ca
Stack Address 1 : ntoskrnl.exe+6a67c
Stack Address 2 :
Stack Address 3 :
Computer Name :
Full Path : C:\WINDOWS\Minidump\Mini111911-01.dmp
Processors Count : 4
Major Version : 15
Minor Version : 2600
Dump File Size : 102,400
==================================================

Well...those files don't reveal anything to me.

If I had to guess...it would be nothing but that. Memory corruption and malware would be my suspects, based on the finger pointing at key Windows processes (win32k.sys, hal.dll, ntoskrnl.exe).

I'd take a fundamental approach...first, eliminate the possibility of malware by posting a topic at Am I infected What do I do - http://www.bleepingcomputer.com/forums/forum103.html . Assuming that is negative, then I would proceed with testing the RAM, then the hard drive.

There is no particular reason to my approach, other than I try to eliminate the greatest threat first from my list of suspects.

I suggest that you wait for a few other opinions by fellow members...before doing anything.

Louis

Quote

I agree with Louis's approach. If I had the computer in front of me, I'd rule out malware before scanning the memory or other hardware.

I guess it all comes down to how confident the owner is that the system is malware free.