Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Computer restarts on it's own, now stopping on Blue Screen


  • Please log in to reply
10 replies to this topic

#1 sherriec09

sherriec09

  • Members
  • 51 posts
  • OFFLINE
  •  
  • Local time:10:02 AM

Posted 06 September 2009 - 06:26 PM

Hi,
I have been having this problem for over 3 months now. I have been posting on another site and after 3 months I give up. I really need help. My computer is my lifeline and I cannot lose it now. I have posted everything on the other forum but don't know if I need to post it here again or if I can just post the link to my topic. It is two pages long with suggestions that I have followed and some I did on my own to no avail.
My computer was restarting on it's own. I finally found the problem (forgot to uncheck an error box) but now it stops and goes to the Blue Screen where it tells you it saved the computer from damage and gives you some suggestions.

This is what I have:

• CPU: Intel CeleronD 2.66GHz CPU
• Motherboard: ECS 661FX-M
• Chipset: SiS 661FX
• Devices
o 80 GB HDD
o Combo DVD-ROM/CDRW Drive
o Floppy drive (now removed and disabled)
• Memory: 2gb DDR333
• Operation System: Windows XP Home Edition SP3
• Accessories Box
o Keyboard
o Mouse w/scroll wheel (Logitech wireless mouse)
o Stereo Speakers
• Features
o Integrated SiS Real256E Graphics. SMA up to 64M.
o Open AGP 8x slot, 3 x PCI slots (1 used)
o 6 x USB ports (4 back, 2 front) (4 in back do not work)
o Build in AC97 audio codec.
o 10/100 build in onboard LAN port and 56K Modem.

Added new graphics card a few years ago:

RADEON 9250/9200 SERIES AGP (0x5964)
Internal DAC(400MHZ
128 MB
RADEON 9200 SERIES
BK-AMI VER008.009.000.000
Now I have the ATI Catalyst Center installed once again and seem to have no problems with my video card.

I run NOD32 AV and Tune-Up Utilities, and Spybot, search & destroy. I don't really run any other utilities.

I now have BlueScreenView but can't figure out how to copy the log files. Tried pasting to the other forum but wouldn't take. Maybe it was just too big (?).
I have Hijack this logs. But I don't believe I have a virus or spyware problem.
Microsoft error page keeps telling me it is a driver or device problem.
Memory error came up a couple of times, but have done MS Memory tests and another Memory Test program with no problems coming up. Had restarting problem BEFORE I upgraded my memory from 768mg to 2 gb.
Most errors come up with Microsoft problem. Almost ALL of them come up with DMP errors. Cannot open the DMP files to post them. Tried the recommended fixes, registry repair, driver updates and chkdsk. Still can't open them.

Here is what I have done per suggestions:

Suggestions:

Here's the most common problems for a system randomly rebooting:

1. Overheating
2. Weak Memory Module
3. Bad Motherboard
4. Bad Power Supply
5. Incompatible Software or Drivers

... but the event viewer might provide some insight.

Event Viewer:
SYSTEM:
ERROR PROPERTIES
Event Type: Error
Event Source: System Error
Event Category: (102)
Event ID: 1003
Date: 6/9/2009
Time: 9:09:59 AM
User: N/A
Computer: SME-01
Description:
Error code 1000000a, parameter1 20202000, parameter2 00000002, parameter3 00000001, parameter4 80701a2a.

For more information, see Help and Support Center at

http://go.microsoft.com/fwlink/events.asp.

Data:
0000: 53 79 73 74 65 6d 20 45 System E
0008: 72 72 6f 72 20 20 45 72 rror Er
0010: 72 6f 72 20 63 6f 64 65 ror code
0018: 20 31 30 30 30 30 30 30 1000000
0020: 61 20 20 50 61 72 61 6d a Param
0028: 65 74 65 72 73 20 32 30 eters 20
0030: 32 30 32 30 30 30 2c 20 202000,
0038: 30 30 30 30 30 30 30 32 00000002
0040: 2c 20 30 30 30 30 30 30 , 000000
0048: 30 31 2c 20 38 30 37 30 01, 8070
0050: 31 61 32 61 1a2a


Suggestion:

Here's the most common problems for a system randomly rebooting:

1. Overheating
2. Weak Memory Module
3. Bad Motherboard
4. Bad Power Supply
5. Incompatible Software or Drivers

... but the event viewer might provide some insight.


Number 4 is your likely suspect. Intermittent and irregular shutdowns are mostly caused by faulty PSU's. Ask your son to open yours up and check that there are no blown caps (capacitors) in your PSU. A blown cap is either bulging or actually shows residue. Just be careful, the capacitors store quiet a bit of punch =)



What I did:
PSU is new and running perfectly.
Cleaned and checked capacitors. Nothing bulging or 'shocking'. Nothing loose.
CPU WAS getting very hot to the touch. Replace Fan and installed a 2nd fan. Sent readings of thermal degrees. One said not running hot, another said running hot, so I did some checking on my own, and it is withing the recommended degrees. Also, the computer would whether I was on it for 5 minutes or for hours. Sometimes hot, sometimes not. Not the problem.


Suggestion:

I will see if I could help.

Go to this directory.

C:\Windows\minidump

you will find "minidump.dmp" files. usually the files will be around 100 KB.

If there are many files look for the names. it will contain date in format MMDDYY.

upload the latest file to any site and post the uploaded link here.



My answer:
I had to do the hardware check myself since I am 40 miles from my son and now have no transportation. The Power Supply seems to be working fine. the heatsink seems fine (cleaned and re lubed) and all fans are working and clean. I finally did a complete re format and reinstalled Windows Home and now have XP sp3. Had a major problem before with Adobe Flash and the new install is working fine. System started shutting down again with same results from MS. I opened the case and now run it opened in front and side with an outside fan blowing on it too. Ran good for two days then rebooted again today. There seems to be a lot of heat coming from the inside even though I have a 500w Power supply with a fan that is blowing great, a new fan over heatsink (after heatsink was re done) and a new fan against the front (inside) of the computer that seems to be working fine too. I can feel the air cooling when I put my hand near them. The Power Supply seems to get hot intermittently but cools itself down. I noticed my CD ROM gets very hot when I am using it, then cools down when I stop. I never noticed that because I had the front attached. With it off, everything is open and I can feel the difference. It also gets very hot in my place, only about 4 degrees cooler than it is outside. I dont' know what else to do so

Okay, file uploaded.

(Did this and he never got back to me, even after 3 months....)


My new post:
Computer rebooted itself again. New file on its way. I was in Firefox when it quit. When it restarted this popped up and I hadn't typed anything yet:

Http://oca.microsoft.com/resredir.aspx?sid...300.3.0’.Make sure you typed the name correctly, and then try again. To search for a file, click the Start button, and then click Search.


New Suggestion:

Have you checked the CPU temperature from within the bios after a shutdown? Also your bios should give the temps of other parts as well, such as the southbridge.



My answer:
I think you are close to the problem. I have a nasty feeling that my motherboard is going out and that is what is causing the problem. I am no expert, but before I re formatted, I would intermittently get a " WARNING Boot device has changed, hit F1 to continue and DEL to enter Setup" At one time I had a second hard drive that I was working on for my sister. I took it out but the system never noticed it was gone. I thought this was the problem. Now it is gone after format and I still get the message like every 4th startup. That is why I think it is the motherboard.

Okay, checked the temps.

CPU Voltage = 134V
DDR Voltage = 260V
CPU Temp = 55 deg Celsius (checked right after the comp restarted on its own)
Fan Speed 3924 then jumped to 4017
Shutdown Temp is Disabled.

Shutdown Temps:
140 deg F
149 Deg F
158 Deg F

Hope this helps. I don't know which Fan it gives, but I have 2 fans plus the PSU fan.


Suggestion:

RAM failure sounds more likely, if your computer can stay on more than 10minutes, yo should try a "stress test" on your RAM and/or other Hardware.



Done as posted above...

Suggestion:

From what i've read; (most likely to least likely)
Your at your Ram's Limit.
Your running too Hot (get better cooling, try with the side panel off)
Your at your motherboard's limit
Your at your CPU's limit
Your PSU is screwy (get a better PSU)
Your motherboard is screwy.

Hope that shed a little more light on the situtation.



My answer:
1: No overclocking. No "tweaks" of any kind.
2: Ram is at the limit at 2gigs. New in May 09. Will put old memory back in to see, but was doing the same thing before I upgraded.
3: No updates have been done to Bios since I got the computer. Don't know where to find them.
4: PSU is new and could be problem. Would have to buy new one to find out.
5: don't know how to tell if MB is at it's limit. Only thing different from purchase is memory, graphics card and psu.
6: Graphics card is ATI Radeon 9200. Used to have Catalyst Center but can't seem to install it since format. Have upgraded drivers though but not working as good as Catalyst did.
7: Before format, my system read WinXP 64bits. Now I have 32bits.
I have 2 4" Fans installed plus the PSU Fan. Side panel AND front panel are both off and outside fan blowing towards it.

Don't know anything about timing factors, CPU limits, etc.

Note: Catalyst Center now re installed. Memory at 2gb is at computer limit. PSU seems to be working fine. Still cannot find updates for Bios. Tried a driver program for Bios updates, but didn't work.


Suggestion:

I think it's a loose connection too.



My answer:
I will check all my connections, thanks!
I updated all the drivers on my computer with a driver program and it hasn't shut down or restarted in 2 days now. However, now it freezes and programs like Win Explorer hang on me. Sigh... I can't win....


Suggestion:
Run spybot


I did, with no problem.

Suggestion:

try the little button battery in the mother board for your bios. take it out and put another one in it or just test it with a voltage meter and get back to me



Answer:
Button battery was almost dead. I replaced it with new one but still no change.

Suggestion:

BlueScreenView program



Answer:
Ran this program but couldn't figure out how to post the log files.

My last posts today:
Okay, I have changed the CMOS battery. The good thing is the old one was almost dead. The bad thing is, it didn't make any difference.
I have cleaned and checked every connection. Nothing loose.
Took out the Floppy drive, it didn't seem to be working anyway. Went into Bios and disabled the Shadowing per blue screen advice. Have updated every driver. My video card seems to be working fine. I have the ATI Catalyst back in and no problems.
I remembered that I hadn't unchecked the Restart at Error in the System Error area. I unchecked it. Now it shuts down to the Blue Screen instead of restarting.... :thumbsup: It suggested a chkdisk so I did that, no problems.
Memory pops up every once in awhile and I checked it again with Microsoft Memory program checker. No problems, and I let it run for a long time just to make sure.
Just had another error:
C:\DOCUME~1\Sherrie\LOCALS~1\Temp\WER9b0b.dir00\Mini090609-01.dmp
C:\DOCUME~1\Sherrie\LOCALS~1\Temp\WER9b0b.dir00\sysdata.xml

Seems a lot of the logs state dumps as a problem and most of the bluescreenview program comes up as Microsoft problems, but all are different.
I uninstalled all programs that I could find that I installed after the reformat. Still crashes.
I have more problems now: USB keeps popping up telling me that the hardware I am using can perform faster in another USB port. Problem is, I have 4 USB ports and only 2 of them work. (the ones in the front). I have a USB Wireless Mouse plugged into one, and the 2nd one is used for my camera or a USB flash drive. This pops up intermittantly, even when I am not in the usb flash/camera program.
Another problem is Firefox. It crashes on me constantly, it won't let me stay logged in to any program even when Remember Me is checked. I have all cookies checked to third party, and no history dump for two weeks. I have updated finally to 3.5 and it is still crashing on me. One of the crashes said it was Adobe Flash so I uninstalled Adobe Flash X. Another time it says it is Internet download manager, so I disabled it and it still crashes.
My computer has become slow, sometimes it takes up to 5 min for a program to open and then it will freeze. this includes all programs from Tune up utilities to Windows explorer.
I am at a loss. I need my computer for business. This is my only income. I need to get it fixed, please.
The Microsoft Error site just tells me it is a device or driver.
I am going to try to post the logs again, maybe someone will see something that will help....

Tried to open the DMP files to post but I can't open them with any program I have. Windows File Help opened up and said:
Problem: Can't Open .DMP Files
Causes:

* Corrupt Windows Registry Structure
* Outdated System and Device Drivers
* Adware or Spyware Infection

Ran Registy repair with Tune-Up Utilities
Updated Drivers with Driver Genius. Only drivers were for the Logitech Mouse. Now installed.
Just ran Spybot search and destroy and Eset yesterday. No virus's or spyware found. Cleaned cookies.

Still can't open the DMP file to post here. have tried Notepad, Wordpad, Firefox, and WinUha, still no luck.

Any suggestions?

Also updated to Windows XP Sp3 after the reformat.

My last post was a new Hijack This log.

Note: Now my downloads are becoming corrupted, my games will not open (no error, just won't open). things are getting worse everyday...

This is 3 months of trial and error and nothing worked. now I am here and hopefully someone can help me.... :flowers:

Thank you
Sherrie

Edited by sherriec09, 06 September 2009 - 06:28 PM.


BC AdBot (Login to Remove)

 


#2 hamluis

hamluis

    Moderator


  • Moderator
  • 55,247 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:Killeen, TX
  • Local time:12:02 PM

Posted 06 September 2009 - 07:58 PM

Hi :thumbsup:.

3 months is a long time put up with system problems...you never considered a clean install?

Lots of guesses in that laundry list, strange no one seems to have mentioned "clean install" as a baseline for determining whether you have a hardware problem or not.

In any case...if you want to try to provide some info by posting the interpreted results of your .dmp files, follow this set of procedures and post the results. Take your last 3 .dmp files, let the others go for now.

Help Diagnosing BSODs And Crashes (BC) - http://www.bleepingcomputer.com/forums/t/176011/how-to-receive-help-diagnosing-blue-screens-and-windows-crashes/

Louis

#3 sherriec09

sherriec09
  • Topic Starter

  • Members
  • 51 posts
  • OFFLINE
  •  
  • Local time:10:02 AM

Posted 06 September 2009 - 08:33 PM

I will try it. thanks!

I did a clean install. Re formatted the hard drive, put in the restore disc and re did everything. Still had the same problem.

Here is the first one:


Microsoft Windows Debugger Version 6.11.0001.404 X86
Copyright Microsoft Corporation. All rights reserved.


Loading Dump File [C:\WINDOWS\Minidump\Mini090609-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

WARNING: Whitespace at end of path element
Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols

Executable search path is:
Windows XP Kernel Version 2600 (Service Pack 3) UP Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 2600.xpsp_sp3_gdr.090206-1234
Machine Name:
Kernel base = 0x804d7000 PsLoadedModuleList = 0x805634c0
Debug session time: Sun Sep 6 00:45:57.250 2009 (GMT-7)
System Uptime: 0 days 2:24:51.836
Loading Kernel Symbols
...............................................................
................................................................
...
Loading User Symbols
Loading unloaded module list
.........
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1000008E, {c0000005, 202, aeaa0d90, 0}

Probably caused by : Unknown_Image ( ANALYSIS_INCONCLUSIVE )

Followup: MachineOwner
---------

kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

KERNEL_MODE_EXCEPTION_NOT_HANDLED_M (1000008e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003. This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG. This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG. This will let us see why this breakpoint is
happening.
Arguments:
Arg1: c0000005, The exception code that was not handled
Arg2: 00000202, The address that the exception occurred at
Arg3: aeaa0d90, Trap Frame
Arg4: 00000000

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx". The memory could not be "%s".

FAULTING_IP:
+0
00000202 ?? ???

TRAP_FRAME: aeaa0d90 -- (.trap 0xffffffffaeaa0d90)
ErrCode = 00000000
eax=badb0d00 ebx=80588948 ecx=805803d5 edx=00000000 esi=0304ff00 edi=aeaa0d34
eip=00000202 esp=aeaa0e04 ebp=0000001b iopl=0 nv up ei pl nz na po cy
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010203
00000202 ?? ???
Resetting default scope

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: 0x8E

PROCESS_NAME: ekrn.exe

LAST_CONTROL_TRANSFER: from 00000000 to 00000202

STACK_TEXT:
aeaa0e00 00000000 00001f80 7c9101db 00a8e018 0x202


STACK_COMMAND: .trap 0xffffffffaeaa0d90 ; kb

SYMBOL_NAME: ANALYSIS_INCONCLUSIVE

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: Unknown_Module

IMAGE_NAME: Unknown_Image

DEBUG_FLR_IMAGE_TIMESTAMP: 0

BUCKET_ID: BAD_STACK

Followup: MachineOwner
---------

2nd (Actually #3)


Microsoft ® Windows Debugger Version 6.11.0001.404 X86
Copyright © Microsoft Corporation. All rights reserved.


Loading Dump File [C:\WINDOWS\Minidump\Mini090509-03.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

WARNING: Whitespace at end of path element
Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols

Executable search path is:
Windows XP Kernel Version 2600 (Service Pack 3) UP Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 2600.xpsp_sp3_gdr.090206-1234
Machine Name:
Kernel base = 0x804d7000 PsLoadedModuleList = 0x805634c0
Debug session time: Sat Sep 5 21:58:47.468 2009 (GMT-7)
System Uptime: 0 days 3:39:05.031
Loading Kernel Symbols
...............................................................
................................................................
...
Loading User Symbols
Loading unloaded module list
...............
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1000000A, {14, 2, 1, 80518499}

Probably caused by : ntkrnlmp.exe ( nt!IoCancelIrp+2f )

Followup: MachineOwner
---------

kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 00000014, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000001, bitfield :
bit 0 : value 0 = read operation, 1 = write operation
bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: 80518499, address which referenced memory

Debugging Details:
------------------


WRITE_ADDRESS: 00000014

CURRENT_IRQL: 2

FAULTING_IP:
nt!IoCancelIrp+2f
80518499 c6462401 mov byte ptr [esi+24h],1

CUSTOMER_CRASH_COUNT: 3

DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: 0xA

PROCESS_NAME: ekrn.exe

LAST_CONTROL_TRANSFER: from 805da1d3 to 80518499

STACK_TEXT:
ae4f7c04 805da1d3 fffffff0 88fe4da0 88ac3020 nt!IoCancelIrp+0x2f
ae4f7c2c 80574e4e 88ac3020 88ac3020 88ac3268 nt!IoCancelThreadIo+0x33
ae4f7ccc 80574faf 00000000 00000000 88ac3020 nt!PspExitThread+0x428
ae4f7cec 80583a71 88ac3020 00000000 00000680 nt!PspTerminateThreadByPointer+0x52
ae4f7d0c 88c4a256 00000000 00000000 ae4f7d64 nt!NtTerminateThread+0x70
WARNING: Frame IP not in any known module. Following frames may be wrong.
00000000 00000000 00000000 00000000 00000000 0x88c4a256


STACK_COMMAND: kb

FOLLOWUP_IP:
nt!IoCancelIrp+2f
80518499 c6462401 mov byte ptr [esi+24h],1

SYMBOL_STACK_INDEX: 0

SYMBOL_NAME: nt!IoCancelIrp+2f

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nt

IMAGE_NAME: ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP: 498c19b5

FAILURE_BUCKET_ID: 0xA_nt!IoCancelIrp+2f

BUCKET_ID: 0xA_nt!IoCancelIrp+2f

Followup: MachineOwner
---------

and 3rd (#2)


Microsoft ® Windows Debugger Version 6.11.0001.404 X86
Copyright © Microsoft Corporation. All rights reserved.


Loading Dump File [C:\WINDOWS\Minidump\Mini090509-02.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

WARNING: Whitespace at end of path element
Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols

Executable search path is:
Windows XP Kernel Version 2600 (Service Pack 3) UP Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 2600.xpsp_sp3_gdr.090206-1234
Machine Name:
Kernel base = 0x804d7000 PsLoadedModuleList = 0x805634c0
Debug session time: Sat Sep 5 18:19:21.203 2009 (GMT-7)
System Uptime: 0 days 2:08:46.775
Loading Kernel Symbols
...............................................................
................................................................
......
Loading User Symbols
Loading unloaded module list
.............
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 19, {20, 892d18f8, 892d18f8, a000001}

Probably caused by : win32k.sys ( win32k!SURFACE::bDeleteSurface+188 )

Followup: MachineOwner
---------

kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

BAD_POOL_HEADER (19)
The pool is already corrupt at the time of the current request.
This may or may not be due to the caller.
The internal pool links must be walked to figure out a possible cause of
the problem, and then special pool applied to the suspect tags or the driver
verifier to a suspect driver.
Arguments:
Arg1: 00000020, a pool block header size is corrupt.
Arg2: 892d18f8, The pool entry we were looking for within the page.
Arg3: 892d18f8, The next pool entry.
Arg4: 0a000001, (reserved)

Debugging Details:
------------------


BUGCHECK_STR: 0x19_20

POOL_ADDRESS: 892d18f8

CUSTOMER_CRASH_COUNT: 2

DEFAULT_BUCKET_ID: DRIVER_FAULT

PROCESS_NAME: firefox.exe

LAST_CONTROL_TRANSFER: from 80551fc5 to 8053767a

STACK_TEXT:
af0d6668 80551fc5 00000019 00000020 892d18f8 nt!KeBugCheckEx+0x1b
af0d66b8 805715f1 892d1900 00000000 af0d6774 nt!ExFreePoolWithTag+0x2c1
af0d675c 804dd99f ffffffff af0d683c af0d6848 nt!NtFreeVirtualMemory+0x49b
af0d675c 804e390f ffffffff af0d683c af0d6848 nt!KiFastCallEntry+0xfc
af0d67e4 bf8095c5 ffffffff af0d683c af0d6848 nt!ZwFreeVirtualMemory+0x11
af0d6840 bf809630 00000000 00000000 af0d6864 win32k!SURFACE::bDeleteSurface+0x188
af0d6850 bf8137fa 00000000 00000000 e363da90 win32k!SURFREF::bDeleteSurface+0x12
af0d6864 bf8138d3 f80509a3 0012e328 af0d6884 win32k!bDeleteSurface+0x20
af0d6878 804dd99f f80509a3 0012e33c 7c90e514 win32k!NtGdiDeleteObjectApp+0x74
af0d6878 7c90e514 f80509a3 0012e33c 7c90e514 nt!KiFastCallEntry+0xfc
WARNING: Frame IP not in any known module. Following frames may be wrong.
0012e33c 00000000 00000000 00000000 00000000 0x7c90e514


STACK_COMMAND: kb

FOLLOWUP_IP:
win32k!SURFACE::bDeleteSurface+188
bf8095c5 e964ffffff jmp win32k!SURFACE::bDeleteSurface+0x1a8 (bf80952e)

SYMBOL_STACK_INDEX: 5

SYMBOL_NAME: win32k!SURFACE::bDeleteSurface+188

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: win32k

IMAGE_NAME: win32k.sys

DEBUG_FLR_IMAGE_TIMESTAMP: 49e87572

FAILURE_BUCKET_ID: 0x19_20_win32k!SURFACE::bDeleteSurface+188

BUCKET_ID: 0x19_20_win32k!SURFACE::bDeleteSurface+188

Followup: MachineOwner
---------

Edited by sherriec09, 06 September 2009 - 10:33 PM.


#4 hamluis

hamluis

    Moderator


  • Moderator
  • 55,247 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:Killeen, TX
  • Local time:12:02 PM

Posted 07 September 2009 - 11:38 AM

Thanks :thumbsup:.

BugCheck 1000008E, c0000005: I don't see anything useful from the first one.

0x0000008E: KERNEL_MODE_EXCEPTION_NOT_HANDLED (#1)
A kernel mode program generated an exception which the error handler didnt catch. These are nearly always hardware compatibility issues (which sometimes means a driver issue or a need for a BIOS upgrade).

The problem with this assessment is that...there are all sorts of drivers which can cause problems and no particular driver is specified in the detail for this particular STOP error on your system.

0xc0000005 detail points to PROCESS_NAME: ekrn.exe (#2). Seems to be a problem with Nod32 AV program (AV programs also have drivers). I would suspect that the program is damaged and needs to be uninstalled, then reinstalled and updated.

0x0000000A: IRQL_NOT_LESS_OR_EQUAL
Typically due to a bad driver, or faulty or incompatible hardware or software. Again, no specific driver pointed out, but finger again points to ekrn.exe file.

0x00000019: BAD_POOL_HEADER
A pool header issue is a problem with Windows memory allocation. Device driver issues are probably the msot common, but this can have diverse causes including bad sectors or other disk write issues, and problems with some routers. (By theory, RAM problems would be suspect for memory pool issues, but I havent been able to confirm this as a cause.)

Well...that certainly doesn't narrow the field :flowers:. Drivers, RAM, and hard drive listed as possibilities.

I see that you already changed the CMOS battery, good move :trumpet:.

...and I suggest that you stop running the Tuneup program. At least temporarily...my opinion is that it is of dubious value, unnecessary and it makes changes to your system that you cannot accurately document.

Ditto for Driver Genius, you should get drivers directly from the ECS website, it's not very difficult and you will get the right ones.

http://www.ecs.com.tw/ECSWebSite/Downloads...D=6&LanID=0 OR http://www.ecs.com.tw/ECSWebSite/Products/...D=1&LanID=0

The correct drivers depend on which of the two boards you have installed.

I may have missed it, but I would do a long/extended hard drive diagnostic. If that receives a clean bill of health, I would then run Memtest86+ on the RAM, just to eliminate seemingly logical candidates. If these problems resurfaced after a clean install, that tends to point to hardware or malware, IMO.

The fact that you have an 80GB hard drive and those haven't been made recently...also points toward a hard drive diagnostic. Such is available from the respective manufacturer of your drive.

Hard Drive Installation and Diagnostic Tools - http://www.bleepingcomputer.com/forums/t/28744/hard-drive-installation-and-diagnostic-tools/

You have SP3 installed...what about all the critical updates which have been issued post-SP3?

You have a Celeron processor, those tend to run hot, I believe. 67 Celsius is the max operating temp, the shutdown temps you listed are too high. http://www.infoplease.com/ipa/A0001731.html

Did you install new heatsink/fan on the CPU?

To compound all this...temperatures that are excessive could have damaged the motherboard. I've only had one experience where my system overheated (fan died) but it did not hurt the board/system...I don't know if that can be expected in similar situations.

Louis

#5 sherriec09

sherriec09
  • Topic Starter

  • Members
  • 51 posts
  • OFFLINE
  •  
  • Local time:10:02 AM

Posted 07 September 2009 - 12:21 PM

I only have a minute so I will answer what I can:

I installed a new fan over the heatsink area. Cleaned and re lubed the heatsink (my son did actually since he knows what he is doing and I didn't)

I will uninstall Tune up utilities.

I will uninstall Eset and reinstall. Have been getting lots of errors on it this past week.

will uninstall Driver Genius.

All critical updates have been installed from MS. Automatic download and install. However, I have been getting wrong updates from them too. Update for Office 2007 was installed, which i don't have, Sound card drivers were wrong and corrupted my soundcard. Had to uninstall. Driver genius found the right ones and works fine now.

The fan on the PSU went out which is why it got so hot and had to replace the whole PSU unit. Went from default PSU to a 500watt PSU and added the new CPU fan over heatsink and a second fan under hard drive (front of computer.)

Will check out the other options you recommended when I get home tonight.

Thanks!
Sherrie

#6 hamluis

hamluis

    Moderator


  • Moderator
  • 55,247 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:Killeen, TX
  • Local time:12:02 PM

Posted 07 September 2009 - 12:42 PM

Another strike...for auto-updating :thumbsup:.

No one should use the Windows Update site for...updating drivers. It's fine for updating critical updates, but users should just go to the system manufacturer or motherboard manufacturer's respective websites...for drivers.

I noticed that the drivers were usually the latest ones...but the latest ones replaced older drivers which worked well, while the newer ones did not perform properly. That was when I realized that it's foolish (IMO) to treat driver updates as something that needs to be done when the system is working well. And when doing such...just go to the proper website and download the correct drivers.

Louis

#7 sherriec09

sherriec09
  • Topic Starter

  • Members
  • 51 posts
  • OFFLINE
  •  
  • Local time:10:02 AM

Posted 08 September 2009 - 01:38 PM

Another crash last night. Blue screen came up. I shut down, then restarted and all I got was the blue screen (different text). I shut down for about 5 min, then restarted. I came here, went to Belarc, downloaded the diagnostic tool, ran it. Went to Western Digital, found my hard drive, downloaded Life guard for my hard drive, ran it and Hard drive is heathly and passed, no errors.

Uninstalled Tune up Utilities.
Uninstalled all Driver programs (2 of them) like Driver Genius.

Downloaded Memtest86+, Ran test all night. Ram passed tests and no errors found.

restarted my computer and Microsoft page pops us telling me the error was caused by RAM and to do a memory test. This was after I just rebooted from doing the memory test.

Here is the new minidump from last night/this morning:


Microsoft Windows Debugger Version 6.11.0001.404 X86
Copyright Microsoft Corporation. All rights reserved.


Loading Dump File [C:\WINDOWS\Minidump\Mini090809-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

WARNING: Whitespace at end of path element
Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols

Executable search path is:
Windows XP Kernel Version 2600 (Service Pack 3) UP Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 2600.xpsp_sp3_gdr.090206-1234
Machine Name:
Kernel base = 0x804d7000 PsLoadedModuleList = 0x805634c0
Debug session time: Tue Sep 8 02:20:47.390 2009 (GMT-7)
System Uptime: 0 days 6:25:21.957
Loading Kernel Symbols
...............................................................
................................................................
..
Loading User Symbols
Loading unloaded module list
..............
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1000008E, {c0000005, bf8c5f4d, f76e6734, 0}

Probably caused by : memory_corruption

Followup: memory_corruption
---------

kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

KERNEL_MODE_EXCEPTION_NOT_HANDLED_M (1000008e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003. This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG. This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG. This will let us see why this breakpoint is
happening.
Arguments:
Arg1: c0000005, The exception code that was not handled
Arg2: bf8c5f4d, The address that the exception occurred at
Arg3: f76e6734, Trap Frame
Arg4: 00000000

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx". The memory could not be "%s".

FAULTING_IP:
win32k!vSpSmallUnderlayCopy+a
bf8c5f4d 088b400c5689 or byte ptr [ebx-76A9F3C0h],cl

TRAP_FRAME: f76e6734 -- (.trap 0xfffffffff76e6734)
ErrCode = 00000002
eax=e23e6018 ebx=e1062680 ecx=fffffe9d edx=e10626e8 esi=00000000 edi=fffffffd
eip=bf8c5f4d esp=f76e67a8 ebp=eedccf52 iopl=0 nv up ei ng nz na po cy
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010283
win32k!vSpSmallUnderlayCopy+0xa:
bf8c5f4d 088b400c5689 or byte ptr [ebx-76A9F3C0h],cl ds:0023:6a5c32c0=??
Resetting default scope

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: CODE_CORRUPTION

BUGCHECK_STR: 0x8E

PROCESS_NAME: csrss.exe

MISALIGNED_IP:
win32k!vSpSmallUnderlayCopy+a
bf8c5f4d 088b400c5689 or byte ptr [ebx-76A9F3C0h],cl

LAST_CONTROL_TRANSFER: from bf827be4 to bf8c5f4d

STACK_TEXT:
f76e67a8 bf827be4 e1062680 e10626e8 e23e6018 win32k!vSpSmallUnderlayCopy+0xa
f76e6890 bf938f9f e15fa048 0000001f 0000001b win32k!bSpUpdatePosition+0x28d
f76e68c0 bf88576f e1b1de90 000001ea 00000166 win32k!EngMovePointer+0x140
f76e68e4 bf885b0b e15fa008 000001ea 00000166 win32k!vMovePointer+0x72
f76e6908 bf8862aa e15fa008 000001ea 00000166 win32k!GreMovePointer+0xd9
f76e6944 bf88666d 000001ea 00000166 00000000 win32k!xxxMoveEventAbsolute+0x13c
f76e697c bf8855d2 0160d021 890ed020 f76e69d4 win32k!ProcessMouseInput+0x16e
f76e698c 804f4194 e16a1438 e16a1460 00000000 win32k!InputApc+0x4e
f76e69d4 804f2c74 00000000 00000000 00000000 nt!KiDeliverApc+0x124
f76e69ec 804e1b83 804e1a13 e1b2c4c8 00000000 nt!KiSwapThread+0xa8
f76e6a24 bf80a493 00000003 8929b4b8 00000001 nt!KeWaitForMultipleObjects+0x284
f76e6a5c bf89b736 00000002 8929b4b8 bf89e684 win32k!xxxMsgWaitForMultipleObjects+0xb0
f76e6d30 bf8846e9 bf9ab400 00000001 f76e6d54 win32k!xxxDesktopThread+0x339
f76e6d40 bf8010ed bf9ab400 f76e6d64 0072fff4 win32k!xxxCreateSystemThreads+0x6a
f76e6d54 804dd99f 00000000 00000022 00000000 win32k!NtUserCallOneParam+0x23
f76e6d54 7c90e514 00000000 00000022 00000000 nt!KiFastCallEntry+0xfc
WARNING: Frame IP not in any known module. Following frames may be wrong.
00000000 00000000 00000000 00000000 00000000 0x7c90e514


STACK_COMMAND: kb

CHKIMG_EXTENSION: !chkimg -lo 50 -db !win32k
11 errors : !win32k (bf8c5f80-bf8c5ff8)
bf8c5f80 *5d 24 57 8d 45 8c 50 e8 *18 44 f8 ff 89 45 1c 33 ]$W.E.P..D...E.3
bf8c5f90 *5f 8d 75 8c 56 53 ff 75 0c ff 75 fc e8 c9 ab f8 _.u.VS.u..u.....
bf8c5fa0 *5f 47 83 c6 10 3b 7d 1c *05 ea 8b 45 fc 8b 48 08 _G...;}....E..H.
bf8c5fb0 *5b 55 24 e8 ea 44 ff ff 8b f0 85 f6 75 07 5f 5b [U$..D......u._[
bf8c5fc0 5e c9 c2 24 00 3b 75 08 *85 05 8b 4e 10 eb e1 83 ^..$.;u....N....
bf8c5fd0 65 10 00 8d 45 8c 89 45 *08 8b 4d 28 8d 45 cc 50 e...E..E..M(.E.P
bf8c5fe0 *6d 56 28 e8 bf 4a ff ff 85 c0 74 33 8b 7b 38 ba mV(..J....t3.{8.
bf8c5ff0 *60 04 00 00 23 fa 74 38 *05 ff 74 43 8b 43 0c 8b `...#.t8..tC.C..

MODULE_NAME: memory_corruption

IMAGE_NAME: memory_corruption

FOLLOWUP_NAME: memory_corruption

DEBUG_FLR_IMAGE_TIMESTAMP: 0

MEMORY_CORRUPTOR: STRIDE

FAILURE_BUCKET_ID: MEMORY_CORRUPTION_STRIDE

BUCKET_ID: MEMORY_CORRUPTION_STRIDE

Followup: memory_corruption
---------



How can I have memory corruption when the memory passed ALL tests?

I had problems with the computer which is why I upgraded the memory. I had 1-256 module and 1-512 module. I replaced them with 2-1gb modules in May.

Getting ready to uninstall ESET.

ESET NOD32 reinstalled
Exchanged one new memory module for one old memory module. Will post and let you know if it changes anything. If it doesn't, I will exchange the other new module with an old one and test.

Edited by sherriec09, 08 September 2009 - 02:40 PM.


#8 sherriec09

sherriec09
  • Topic Starter

  • Members
  • 51 posts
  • OFFLINE
  •  
  • Local time:10:02 AM

Posted 12 September 2009 - 02:34 AM

So far so good. No more shutdowns/restarts/blue screens! My son told me to now exchange the memory I took out (1gb) with the 1 gb that is in there and see if the problem starts all over again. He told me that if it doesn't start up again, then it doesn't have to do with the actual memory but with my computer not being able to handle all that memory, even though maximum is 2 gb.
Is this true?

#9 hamluis

hamluis

    Moderator


  • Moderator
  • 55,247 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:Killeen, TX
  • Local time:12:02 PM

Posted 12 September 2009 - 09:09 AM

Seeming memory errors/situations...can occur for a variety of reasons. The modules could be incompatible, there could be a problem with the system/RAM bus, there could be something interfering with the module connectivity, and so on.

If you want to test various scenarios/theories...I suggest that you download and run Memtest86+ - Advanced Memory Diagnostic Tool - http://www.memtest.org/#downiso

I further suggest that you read the following to get an idea of the testing/diagnostic methodology which a user should employ:

Icrontic Diagnose with Memtest86+ - http://icrontic.com/articles/diagnose_with_memtest86

MemTest Manual - http://hcidesign.com/memtest/manual.html

If the motherboard/system specs say that the max is 2GB...it's 2GB. There used to be some situations where "too much RAM" would cause problems with certain systems, but that was long ago..in the Win 9x days.

http://www.microsoft.com/whdc/system/platf...PAE/PAEmem.mspx

http://support.microsoft.com/kb/253912

Louis

#10 sherriec09

sherriec09
  • Topic Starter

  • Members
  • 51 posts
  • OFFLINE
  •  
  • Local time:10:02 AM

Posted 26 September 2009 - 08:31 PM

Thank you for all your help and input. It was a bad memory module that was causing all the problems. After 3 months my computer is running normal again. :thumbsup:

#11 hamluis

hamluis

    Moderator


  • Moderator
  • 55,247 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:Killeen, TX
  • Local time:12:02 PM

Posted 27 September 2009 - 08:32 AM

Glad you solved it, thanks for posting the resolution...happy computing :thumbsup:.

Louis




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users