Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

XP restarts, freezes and occasional BSOD


  • Please log in to reply
13 replies to this topic

#1 jay211083

jay211083

  • Members
  • 55 posts
  • OFFLINE
  •  
  • Local time:10:45 AM

Posted 14 January 2010 - 09:33 AM

Hi,

A few weeks ago my computer randomly started rebooting itself, sometimes with error messages and sometimes without. I originally thought it might be malware related but after a long thread in the malware section of these forums that has been ruled out.

The first thing I tried was swapping the RAM, this seemed to solve the problem for about a week and then the same problems starting happening. Also, Crucial have replaced my old RAM with new parts which would suggest they also thing the RAM was faulty as well.

It got to the stage that sometimes my computer would not even load into XP and it would just hang on a black screen with a mouse cursor, a system restore seemed to solve this a couple of times but the last time it happened a restore had no effect. This is when I decided it was probably time to repair Windows, which also didn't work as the install hung at 35 minutes to go, so I have done a fresh install. All was going well, XP installed with no problems and I was able to complete all updates from the Microsoft site, however, the same problems are still there, sometimes the computer will freeze completely and sometimes it reboots, on one occasion I had a BSOD about driver_irql_not_less_or_equal. I have rolled back my graphics card drivers and have also unistalled my Avira anti-virus as it seemed to happen a lot when trying to update Avira, but this does not seem to have solved the problem.

There doesn't seem to be any particular reason for the computer to crash, sometimes it will crash when just sitting there idle, and sometimes when I'm using it. Also, I am able to play Company of Heroes for hours on end without any crashes which makes me think it isn't heat or power related, but then I am no expert!

Here is the thread from the malware section for reference:

http://www.bleepingcomputer.com/forums/t/281832/computer-restarting-cwindowssystem32servicesexe-terminated-unexpectedly-with-status-code-1073741819/

Any help will be greatly appreciated.

Thank you.

Edited by jay211083, 14 January 2010 - 09:35 AM.


BC AdBot (Login to Remove)

 


#2 hamluis

hamluis

    Moderator


  • Moderator
  • 55,726 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Killeen, TX
  • Local time:05:45 AM

Posted 14 January 2010 - 10:40 AM

Hi :thumbsup:.

Well...if you've eliminated the O/S and malware...that leaves hardware as suspects, IMO.

The content of the specific error messages...might be useful...but we will ignore that, for the moment.

FWIW: Driver and other errors...can be reflected as the result of hardware problems. The hard drive, power supply, and RAM are favorite candidates for such, each of these can be tested somewhat for functionality.

System manufacturer and model?

I also suggest that you take a look in Event Viewer...for errors. If you can post the Module, EventID, and summary description for the last three errors...it might help.

How To Use Event Viewer - http://www.bleepingcomputer.com/forums/t/40108/how-to-use-event-viewer/

Louis

#3 jay211083

jay211083
  • Topic Starter

  • Members
  • 55 posts
  • OFFLINE
  •  
  • Local time:10:45 AM

Posted 14 January 2010 - 11:09 AM

Hi,

The system is a Dell Dimension 4500.

The last errors:

Application:

Source - Application Error, Category - (100), Event - 1000, Description - Faulting application update.exe, version 9.0.0.52, faulting module unknown, version 0.0.0.0, fault address 0x00174f57.

System:

Source - Service Control Manager, Category - None, Event - 7026, Description - The following boot-start or system-start driver(s) failed to load:
AFD
Fips
intelppm
IPSec
MRxSmb
NetBIOS
NetBT
OMCI
RasAcd
Rdbss
Tcpip

Source - Service Control Manager, Category - None, Event - 7001, Description - The IPSEC Services service depends on the IPSEC driver service which failed to start because of the following error:
A device attached to the system is not functioning.

Source - System Error, Category - (102), Event - 1003, Description - Error code 100000d1, parameter1 c01a6c7c, parameter2 000000ff, parameter3 00000000, parameter4 e162a5b0.

I think a couple of those are from where I booted into Safe Mode. But the application error and the last system error above are from the time I received the BSOD.

#4 jay211083

jay211083
  • Topic Starter

  • Members
  • 55 posts
  • OFFLINE
  •  
  • Local time:10:45 AM

Posted 14 January 2010 - 11:50 AM

OK just went back to the system and was confronted with a BSOD, the system was just idle when it happened.

A problem has been detected and windows has been shut down to prevent damage to your computer.

The problem seems to be caused by the following file: win32k.sys

PAGE_FAULT_IN_NONPAGED_AREA

Technical information:

***STOP: 0x00000050 (0xC08504C4, 0x00000001, 0xBF80544F, 0x00000002)

***win32k.sys - Address BF80544F base at BF800000, DateStamp 4a8564c7

Edited by jay211083, 14 January 2010 - 12:28 PM.


#5 hamluis

hamluis

    Moderator


  • Moderator
  • 55,726 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Killeen, TX
  • Local time:05:45 AM

Posted 14 January 2010 - 01:19 PM

<>

I believe this reflects the inability of Avira Free to update definitions correctly. Such can happen when the program or some aspect of it...is damaged. The counter is to uninstall/reinstall.

The D1 error...could be several things, may be because of safe mode.

I would like you to search your system for any .dmp files. If you have several, concern yourself with the last two.

Then try to follow the procedures at Help Diagnosing BSODs And Crashes (BC) - http://www.bleepingcomputer.com/forums/t/176011/how-to-receive-help-diagnosing-blue-screens-and-windows-crashes/

Louis

#6 jay211083

jay211083
  • Topic Starter

  • Members
  • 55 posts
  • OFFLINE
  •  
  • Local time:10:45 AM

Posted 14 January 2010 - 02:04 PM

Found 2 .dmp files in the c:\windows\minidump folder. Here they are:


Mini011310-01.dmp

Microsoft ® Windows Debugger Version 6.11.0001.404 X86
Copyright © Microsoft Corporation. All rights reserved.


Loading Dump File [C:\WINDOWS\Minidump\Mini011310-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows XP Kernel Version 2600 (Service Pack 3) UP Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 2600.xpsp_sp3_gdr.090804-1435
Machine Name:
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055b1c0
Debug session time: Wed Jan 13 16:57:19.046 2010 (GMT+0)
System Uptime: 0 days 0:03:25.705
Loading Kernel Symbols
...............................................................
.................................................
Loading User Symbols
Loading unloaded module list
.........
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 100000D1, {c01a6c7c, ff, 0, e162a5b0}

Unable to load image nv4_disp.dll, Win32 error 0n2
*** WARNING: Unable to verify timestamp for nv4_disp.dll
*** ERROR: Module load completed but symbols could not be loaded for nv4_disp.dll
Probably caused by : nv4_disp.dll ( nv4_disp+2683c )

Followup: MachineOwner
---------

kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: c01a6c7c, memory referenced
Arg2: 000000ff, IRQL
Arg3: 00000000, value 0 = read operation, 1 = write operation
Arg4: e162a5b0, address which referenced memory

Debugging Details:
------------------


READ_ADDRESS: c01a6c7c

CURRENT_IRQL: ff

FAULTING_IP:
+2683c
e162a5b0 0b00 or eax,dword ptr [eax]

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: 0xD1

PROCESS_NAME: avcenter.exe

LAST_CONTROL_TRANSFER: from 00000000 to e162a5b0

SYMBOL_ON_RAW_STACK: 1

STACK_ADDR_RAW_STACK_SYMBOL: ffffffffb7f60dd8

STACK_COMMAND: dds B7F60DD8-0x20 ; kb

STACK_TEXT:
b7f60db8 8800d000
b7f60dbc 00001c00
b7f60dc0 0000041a
b7f60dc4 f4c36040
b7f60dc8 e1532010
b7f60dcc 0004d9c0
b7f60dd0 821c2d00
b7f60dd4 bd03883c nv4_disp+0x2683c
b7f60dd8 e1532010
b7f60ddc 00000010
b7f60de0 f4e358e4
b7f60de4 f4c36000
b7f60de8 00000314
b7f60dec 00000001
b7f60df0 00000000
b7f60df4 0004d9c0
b7f60df8 821c2d00
b7f60dfc 00000010
b7f60e00 000006f8
b7f60e04 00000327
b7f60e08 0000001c
b7f60e0c 000003c4
b7f60e10 bd0558b6 nv4_disp+0x438b6
b7f60e14 f4c36000
b7f60e18 e1532010
b7f60e1c b7f60e98
b7f60e20 e1532010
b7f60e24 00000000
b7f60e28 000000df
b7f60e2c b7f60e98
b7f60e30 00000004
b7f60e34 00000000


FOLLOWUP_IP:
nv4_disp+2683c
bd03883c ?? ???

SYMBOL_NAME: nv4_disp+2683c

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nv4_disp

IMAGE_NAME: nv4_disp.dll

DEBUG_FLR_IMAGE_TIMESTAMP: 4b0762f0

FAILURE_BUCKET_ID: 0xD1_nv4_disp+2683c

BUCKET_ID: 0xD1_nv4_disp+2683c

Followup: MachineOwner
---------


Mini011410-01.dmp

Microsoft ® Windows Debugger Version 6.11.0001.404 X86
Copyright © Microsoft Corporation. All rights reserved.


Loading Dump File [C:\WINDOWS\Minidump\Mini011410-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows XP Kernel Version 2600 (Service Pack 3) UP Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 2600.xpsp_sp3_gdr.090804-1435
Machine Name:
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055b1c0
Debug session time: Thu Jan 14 16:37:46.078 2010 (GMT+0)
System Uptime: 0 days 0:04:44.748
Loading Kernel Symbols
...............................................................
.............................................
Loading User Symbols
Loading unloaded module list
.........
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 10000050, {c08504c4, 1, bf80544f, 2}


Could not read faulting driver name
Probably caused by : win32k.sys ( win32k!HANDLELOCK::vLockHandle+8d )

Followup: MachineOwner
---------

kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced. This cannot be protected by try-except,
it must be protected by a Probe. Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: c08504c4, memory referenced.
Arg2: 00000001, value 0 = read operation, 1 = write operation.
Arg3: bf80544f, If non-zero, the instruction address which referenced the bad memory
address.
Arg4: 00000002, (reserved)

Debugging Details:
------------------


Could not read faulting driver name

WRITE_ADDRESS: c08504c4

FAULTING_IP:
win32k!HANDLELOCK::vLockHandle+8d
bf80544f 748d je win32k!HANDLELOCK::vLockHandle+0x8f (bf8053de)

MM_INTERNAL_CODE: 2

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: 0x50

PROCESS_NAME: explorer.exe

LAST_CONTROL_TRANSFER: from bf908d9a to bf80544f

STACK_TEXT:
b8787574 bf908d9a b9c041c0 00000001 b87875d8 win32k!HANDLELOCK::vLockHandle+0x8d
b87875a4 bf80491d 00fef6d4 b87875e0 bf808745 win32k!HmgShareCheckLock+0x37
b87875b0 bf808745 5a05041c b8787604 00fef6d4 win32k!SURFREF::vAltCheckLock+0x12
b87875e0 bf80852a bb0103f0 5a05041c 00000000 win32k!hbmSelectBitmap+0x2a
b87875f4 804de7ec bb0103f0 5a05041c 00fef6e4 win32k!GreSelectBitmap+0x12
b87875f4 7c90e514 bb0103f0 5a05041c 00fef6e4 nt!KiFastCallEntry+0xf8
WARNING: Frame IP not in any known module. Following frames may be wrong.
00fef6e4 00000000 00000000 00000000 00000000 0x7c90e514


STACK_COMMAND: kb

FOLLOWUP_IP:
win32k!HANDLELOCK::vLockHandle+8d
bf80544f 748d je win32k!HANDLELOCK::vLockHandle+0x8f (bf8053de)

SYMBOL_STACK_INDEX: 0

SYMBOL_NAME: win32k!HANDLELOCK::vLockHandle+8d

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: win32k

IMAGE_NAME: win32k.sys

DEBUG_FLR_IMAGE_TIMESTAMP: 4a8564c7

FAILURE_BUCKET_ID: 0x50_win32k!HANDLELOCK::vLockHandle+8d

BUCKET_ID: 0x50_win32k!HANDLELOCK::vLockHandle+8d

Followup: MachineOwner
---------

#7 hamluis

hamluis

    Moderator


  • Moderator
  • 55,726 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Killeen, TX
  • Local time:05:45 AM

Posted 14 January 2010 - 07:39 PM

Try uninstalling your current video drivers, via Device Manager...then reinstalling either the same version or updated ones for your board/system.

I further suggest reinstalling Avira on your system.

To be honest...I would guess that your PSU is the constant throughout all your troubles., but I can't validate that.

I am reduced to opinions which I cannot validate, based on data provided.

Louis

#8 jay211083

jay211083
  • Topic Starter

  • Members
  • 55 posts
  • OFFLINE
  •  
  • Local time:10:45 AM

Posted 16 January 2010 - 06:56 AM

Will try reinstalling Avira and video drivers and see what happens.

#9 OldGrumpyBastard

OldGrumpyBastard

  • Members
  • 781 posts
  • OFFLINE
  •  
  • Location:&quot;Way South of 'da Bridge&quot;
  • Local time:05:45 AM

Posted 16 January 2010 - 07:54 AM

In Addition:

BUGCHECK_STR: 0x50

PROCESS_NAME: explorer.exe

0x50 errors along with Event 1003 in your original post (not exact but very similar) could point to a possible malware infection...May not be infected but I wouldn't rule it out completely...

http://support.microsoft.com/?kbid=894278&sd=RMVP
Does this look like an OldGrumpyBastard or what?

#10 jay211083

jay211083
  • Topic Starter

  • Members
  • 55 posts
  • OFFLINE
  •  
  • Local time:10:45 AM

Posted 18 January 2010 - 05:02 PM

I've had a look in the folders in that article and not found any of the files it is talking about so I don't think that can be the problem.

#11 jay211083

jay211083
  • Topic Starter

  • Members
  • 55 posts
  • OFFLINE
  •  
  • Local time:10:45 AM

Posted 24 January 2010 - 05:09 PM

Is there any way to test the PSU? I've run memtest, which came back with no errors, and also hard disk diagnostics tools that all passed.

The computer runs fine for about a week, then for no apparent reason might freeze up 2 or 3 times in one day, then runs without any problems again for about a week.

#12 hamluis

hamluis

    Moderator


  • Moderator
  • 55,726 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Killeen, TX
  • Local time:05:45 AM

Posted 24 January 2010 - 05:34 PM

PSU Testing - http://www.bleepingcomputer.com/forums/t/149135/psu-testing/

How To Test Your Computers Power Supply (PSU) - Video - http://www.metacafe.com/watch/729606/how_t...wer_supply_psu/

Louis

Edited by hamluis, 24 January 2010 - 05:35 PM.


#13 jay211083

jay211083
  • Topic Starter

  • Members
  • 55 posts
  • OFFLINE
  •  
  • Local time:10:45 AM

Posted 24 January 2010 - 07:03 PM

The bleeping computer link is down and the other link is basically saying that if the fan comes on then the supply is working. My computer powers up fine, just sometimes it decides to crash or freeze up for no reason. I don't understand what is going wrong, viruses have been ruled out, memory is brand new and has passed memtest, both hard drives have passed their diagnostics tests and the PSU appears to be working!

It would make more sense if it failed to boot up every single time it was turned on or it crashed/froze when doing a specific thing, but it seems to be completely random and can go days on end without going even a little bit wrong.

#14 jay211083

jay211083
  • Topic Starter

  • Members
  • 55 posts
  • OFFLINE
  •  
  • Local time:10:45 AM

Posted 25 January 2010 - 06:56 AM

OK, have tested the PSU with multimeter and these are the readings I get:

3.3V rail - 3.31V
5V rail - 5.05V
12V rail - 11.73V

This was with the system at full load and the voltages were stable on the readout. Is the 12V reading too low or is that within tolerances?




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users