Re: Random reboots

Wolf

Disable automatic restart on system failure. This should help by
allowing time to write down the STOP code properly. Right click on
the My Computer icon on the Desktop and select Properties, Advanced,
Start-Up and Recovery, System Failure and uncheck box before
Automatically Restart.

Do not re-enable automatic restart on system failure. Check for variants
of the Stop Error message.

An alternative is to keep pressing the F8 key during Start-Up and select
option - Disable automatic restart on system failure.

I would uninstall WinRAR and observe for affect. What version do you
have installed?

When you post Event Viewer please post complete reports not parts of the
Report.

A tip for posting copies of Error Reports! Run Event Viewer and double
click on the error you want to copy. In the window, which appears is a
button resembling two pages. Click the button and close Event
Viewer.Now start your message (email) and do a paste into the body of
the message. Make sure this is the first paste after exiting from
Event Viewer.

--



Hope this helps.

Gerry
~~~~
FCA
Stourport, England
Enquire, plan and execute
~~~~~~~~~~~~~~~~~~~

Wolf wrote:
"Wolf" wrote:

For about 2 months I've had random reboots. It's started shortly
after I upgraded to SP3 as well as to Norton Anti-virus 2008. I
never get to see the blue screen before it reboots, And had to
download the debugger just to read the dump files. I've upgraded the
drivers, checked that everything was seated. It doesn't matter what
program it happens on, a game, just working with files, etc. The one
constant here, and I'm having trouble finding the function in
support is: FAILURE_BUCKET_ID: 0xA_W_nt!MiRestoreTransitionPte+6b.
What does this call refer to? Physical memory, hard drive, that sort
of thing...

Microsoft (R) Windows Debugger Version 6.9.0003.113 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\WINDOWS\Minidump\Mini061808-02.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*C:\Program Files\Debugging Tools for
Windows (x86)\Symbols*http://msdl.microsoft,com/download/symbols
Executable search path is: C:\WINDOWS\system32;
C:\WINDOWS\system\system32 Windows XP Kernel Version 2600 (Service
Pack 3) UP Free x86 compatible Product: WinNt, suite: TerminalServer
SingleUserTS
Built by: 2600.xpsp.080413-2111
Kernel base = 0x804d7000 PsLoadedModuleList = 0x80553fc0
Debug session time: Wed Jun 18 20:26:07.750 2008 (GMT-7)
System Uptime: 0 days 0:37:18.315
Loading Kernel Symbols
.....................................................................................................................................................................................
Loading User Symbols
Loading unloaded module list
..................................
*******************************************************************************
*
*
* Bugcheck Analysis
*
*
*
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1000000A, {4f000010, 2, 1, 80514135}

Probably caused by : memory_corruption (
nt!MiRestoreTransitionPte+6b )

Followup: MachineOwner
---------

kd> !analyze -v
*******************************************************************************
*
*
* Bugcheck Analysis
*
*
*
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid)
address at an interrupt request level (IRQL) that is too high. This
is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 4f000010, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000001, bitfield :
bit 0 : value 0 = read operation, 1 = write operation
bit 3 : value 0 = not an execute operation, 1 = execute operation
(only on chips which support this level of status)
Arg4: 80514135, address which referenced memory

Debugging Details:
------------------


WRITE_ADDRESS: 4f000010

CURRENT_IRQL: 2

FAULTING_IP:
nt!MiRestoreTransitionPte+6b
80514135 ff4910 dec dword ptr [ecx+10h]

CUSTOMER_CRASH_COUNT: 2

DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: 0xA

PROCESS_NAME: System

LAST_CONTROL_TRANSFER: from 8051ec6d to 80514135

STACK_TEXT:
bace3aac 8051ec6d e7aea080 ffffffff 8a612408
nt!MiRestoreTransitionPte+0x6b bace3ac4 8051f21e 87c265c0 805126d5
8a612438 nt!MiRemovePageFromList+0xd1 bace3acc 805126d5 8a612438
000004c0 00000400 nt!MiRemoveAnyPage+0x56
bace3af8 80513210 00010000 87c26634 87c26650
nt!MiResolveMappedFileFault+0x3dd bace3b3c 805133ca 00000000
ced10000 c0676880 nt!MiResolveProtoPteFault+0x18c bace3bc0 8051cb1c
e7aea080 ced10000 c0676880 nt!MiDispatchFault+0xe8
bace3c24 80517c78 00000000 ced10000 00000000 nt!MmAccessFault+0x7b4
bace3c80 804e0fe7 ced10000 00000000 80550118
nt!MmCheckCachedPageState+0x56c bace3d2c 804e620f 8a7b9298 8055b0c0
8a7bb830 nt!CcPerformReadAhead+0x1f1 bace3d74 80534c02 8a7b9298
00000000 8a7bb830 nt!CcWorkerThread+0x147
bace3dac 805c6160 8a7b9298 00000000 00000000 nt!ExpWorkerThread+0x100
bace3ddc 80541dd2 80534b02 00000000 00000000
nt!PspSystemThreadStartup+0x34 00000000 00000000 00000000 00000000
00000000 nt!KiThreadStartup+0x16


STACK_COMMAND: kb

FOLLOWUP_IP:
nt!MiRestoreTransitionPte+6b
80514135 ff4910 dec dword ptr [ecx+10h]

SYMBOL_STACK_INDEX: 0

SYMBOL_NAME: nt!MiRestoreTransitionPte+6b

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nt

DEBUG_FLR_IMAGE_TIMESTAMP: 4802516a

IMAGE_NAME: memory_corruption

FAILURE_BUCKET_ID: 0xA_W_nt!MiRestoreTransitionPte+6b

BUCKET_ID: 0xA_W_nt!MiRestoreTransitionPte+6b

Followup: MachineOwner
---------

kd> lmvm nt
start end module name
804d7000 806cf580 nt (pdb symbols) C:\Program
Files\Debugging Tools for Windows
(x86)\Symbols\ntkrnlpa.pdb\30B5FB31AE7E4ACAABA750AA241FF3311\ntkrnlpa.pdb
Loaded symbol image file: ntkrnlpa.exe
Mapped memory image file: C:\WINDOWS\system32\ntkrnlpa.exe
Image path: ntkrnlpa.exe
Image name: ntkrnlpa.exe
Timestamp: Sun Apr 13 11:31:06 2008 (4802516A)
CheckSum: 00204E7E
ImageSize: 001F8580
File version: 5.1.2600.5512
Product version: 5.1.2600.5512
File flags: 0 (Mask 3F)
File OS: 40004 NT Win32
File type: 1.0 App
File date: 00000000.00000000
Translations: 0409.04b0
CompanyName: Microsoft Corporation
ProductName: Microsoft® Windows® Operating System
InternalName: ntkrnlpa.exe
OriginalFilename: ntkrnlpa.exe
ProductVersion: 5.1.2600.5512
FileVersion: 5.1.2600.5512 (xpsp.080413-2111)
FileDescription: NT Kernel & System
LegalCopyright: © Microsoft Corporation. All rights reserved.

Please note that I picked an older dump file, The parameters are
almost the same in each dump file. The executables in each dump are
different, however. The most current one:


Microsoft (R) Windows Debugger Version 6.9.0003.113 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\WINDOWS\Minidump\Mini081608-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*C:\Program Files\Debugging Tools for
Windows (x86)\Symbols*http://msdl.microsoft,com/download/symbols
Executable search path is: C:\WINDOWS\system32;
C:\WINDOWS\system\system32 Windows XP Kernel Version 2600 (Service
Pack 3) UP Free x86 compatible Product: WinNt, suite: TerminalServer
SingleUserTS
Built by: 2600.xpsp.080413-2111
Kernel base = 0x804d7000 PsLoadedModuleList = 0x80553fc0
Debug session time: Sat Aug 16 23:39:31.765 2008 (GMT-7)
System Uptime: 0 days 2:23:35.349
Loading Kernel Symbols
.....................................................................................................................................................................................
Loading User Symbols
Loading unloaded module list
................................
*******************************************************************************
*
*
* Bugcheck Analysis
*
*
*
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1000000A, {a080014, 2, 1, 80514135}

Probably caused by : memory_corruption (
nt!MiRestoreTransitionPte+6b )

Followup: MachineOwner
---------

kd> !analyze -v
*******************************************************************************
*
*
* Bugcheck Analysis
*
*
*
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid)
address at an interrupt request level (IRQL) that is too high. This
is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 0a080014, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000001, bitfield :
bit 0 : value 0 = read operation, 1 = write operation
bit 3 : value 0 = not an execute operation, 1 = execute operation
(only on chips which support this level of status)
Arg4: 80514135, address which referenced memory

Debugging Details:
------------------


WRITE_ADDRESS: 0a080014

CURRENT_IRQL: 2

FAULTING_IP:
nt!MiRestoreTransitionPte+6b
80514135 ff4910 dec dword ptr [ecx+10h]

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: 0xA

PROCESS_NAME: WinRAR.exe

LAST_CONTROL_TRANSFER: from 8051ec6d to 80514135

STACK_TEXT:
a9405810 8051ec6d 00000000 ffffffff 9da00000
nt!MiRestoreTransitionPte+0x6b a9405828 8051f21e e7dc0c30 80518793
00000000 nt!MiRemovePageFromList+0xd1 a9405830 80518793 00000000
c2146000 00001000 nt!MiRemoveAnyPage+0x56
a9405924 804e2d61 c2146000 01d29450 00000000
nt!MmCopyToCachedPage+0x1f3 a94059b4 804e0d21 87c25c60 01d29450
a94059e8 nt!CcMapAndCopy+0x1a9
a9405a34 ba646846 87d2bdb8 2ec80ebc 00007ff0 nt!CcFastCopyWrite+0x211
a9405a9c ba6d5018 87d2bdb8 a9405b0c 00007ff0
Ntfs!NtfsCopyWriteA+0x23d a9405ad0 ba6e0b99 00000004 00000000
a9405b04 fltmgr!FltpPerformFastIoCall+0x230
a9405b24 ba6c7a27 87d2bdb8 8783b9e0 00007ff0
fltmgr!FltpFastIoWrite+0xa9 a9405b58 ba6d5018 87d2bdb8 8783b9e0
00007ff0 sr!SrFastIoWrite+0x77
a9405b8c ba6d51e4 00000004 00000000 8783b9d8
fltmgr!FltpPerformFastIoCall+0x230
a9405bb8 ba6e0c38 00405bd8 01d2430c 8a5eccc0
fltmgr!FltpPassThroughFastIo+0x78 a9405bf8 ba6d5018 87d2bdb8
a9405c68 00007ff0 fltmgr!FltpFastIoWrite+0x148 a9405c2c ba6e0b99
00000004 00000000 a9405c60 fltmgr!FltpPerformFastIoCall+0x230
a9405c80 8057256c 87d2bdb8 a9405cc4 00007ff0
fltmgr!FltpFastIoWrite+0xa9 a9405d38 8053d638 000001f4 00000000
00000000 nt!NtWriteFile+0x324
a9405d38 7c90e4f4 000001f4 00000000 00000000 nt!KiFastCallEntry+0xf8
WARNING: Frame IP not in any known module. Following frames may be
wrong. 000eff78 00000000 00000000 00000000 00000000 0x7c90e4f4


STACK_COMMAND: kb

FOLLOWUP_IP:
nt!MiRestoreTransitionPte+6b
80514135 ff4910 dec dword ptr [ecx+10h]

SYMBOL_STACK_INDEX: 0

SYMBOL_NAME: nt!MiRestoreTransitionPte+6b

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nt

DEBUG_FLR_IMAGE_TIMESTAMP: 4802516a

IMAGE_NAME: memory_corruption

FAILURE_BUCKET_ID: 0xA_W_nt!MiRestoreTransitionPte+6b

BUCKET_ID: 0xA_W_nt!MiRestoreTransitionPte+6b

Followup: MachineOwner
---------

kd> lmvm nt
start end module name
804d7000 806cf580 nt (pdb symbols) C:\Program
Files\Debugging Tools for Windows
(x86)\Symbols\ntkrnlpa.pdb\30B5FB31AE7E4ACAABA750AA241FF3311\ntkrnlpa.pdb
Loaded symbol image file: ntkrnlpa.exe

Almost forgot, from Event Viewer:
Error code 1000000a, parameter1 0a080014, parameter2 00000002,
parameter3 00000001, parameter4 80514135. from the latest one.

From the 15th of August:
Error code 1000000a, parameter1 00000010, parameter2 00000002,
parameter3 00000001, parameter4 80514135.

From the 14th...:
Error code 1000000a, parameter1 0fdd6010, parameter2 00000002,
parameter3 00000001, parameter4 80514135.

Anyways. that's the way it's been going. Thanks in advance.


.