TechSpot

Help! Computer is rebooting and getting minidump errors

By Tim_FJ1200SC
Jan 12, 2007
  1. Thanks in advance for all your assistance!

    I have had two crashes today.

    Computer is configured to auto restart on crash so I never see the Blue screen of Death. It

    just reboots like your unplugged it and plugged it right back in. When it comes up I get the

    report error popup.

    When this happens I'm not doing anything that would tax the processor. I typically have

    Outlook, Excel & Word 2003 open. I had IE 6 open and Windows media player open playing a web

    based audio file.

    Here is a rundown of the system;

    XP Home
    Version 2002
    Service Pack 2
    AMD Sempron(tm) 3000+
    1.99 GHz, 480 MB of RAM
    Seagate Barracuda ST380011A 76.5 GB with only 11.5 GB used.
    Running Norton Internet Security Suite 2006, fully updated and just completely scanned.
    Scan comes back clean.


    Here are both minidump log, one right atfer the other;


    C:\Program Files\Support Tools>dumpchk.exe c:\windows\minidump\mini011207-01.dmp

    Loading dump file c:\windows\minidump\mini011207-01.dmp
    ----- 32 bit Kernel Mini Dump Analysis

    DUMP_HEADER32:
    MajorVersion 0000000f
    MinorVersion 00000a28
    DirectoryTableBase 0ea97000
    PfnDataBase 81000000
    PsLoadedModuleList 8055a420
    PsActiveProcessHead 805604d8
    MachineImageType 0000014c
    NumberProcessors 00000001
    BugCheckCode 000000c4
    BugCheckParameter1 00000090
    BugCheckParameter2 ffdff120
    BugCheckParameter3 00000000
    BugCheckParameter4 00000000
    PaeEnabled 00000000
    KdDebuggerDataBlock 8054c060
    MiniDumpFields 00000dff

    TRIAGE_DUMP32:
    ServicePackBuild 00000200
    SizeOfDump 00010000
    ValidOffset 0000fffc
    ContextOffset 00000320
    ExceptionOffset 000007d0
    MmOffset 00001068
    UnloadedDriversOffset 000010a0
    PrcbOffset 00001878
    ProcessOffset 000024c8
    ThreadOffset 00002728
    CallStackOffset 00002980
    SizeOfCallStack 00003fff
    DriverListOffset 00006c10
    DriverCount 00000088
    StringPoolOffset 00009470
    StringPoolSize 000012b8
    BrokenDriverOffset 00000000
    TriageOptions 00000041
    TopOfStack f233b000
    DebuggerDataOffset 00006980
    DebuggerDataSize 00000290
    DataBlocksOffset 0000a728
    DataBlocksCount 00000003


    Windows XP Kernel Version 2600 (Service Pack 2) UP Free x86 compatible
    Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055a420
    Debug session time: Fri Jan 12 09:18:22 2007
    System Uptime: 0 days 16:51:32
    start end module name
    804d7000 806eb100 nt Checksum: 002198AF Timestamp: Tue Mar 01 17:
    59:37 2005 (42250FF9)

    Unloaded modules:
    f1e06000 f1e31000 kmixer.sys Timestamp: unavailable (00000000)
    f2782000 f27ad000 kmixer.sys Timestamp: unavailable (00000000)
    f7b0c000 f7b0d000 drmkaud.sys Timestamp: unavailable (00000000)
    f27ad000 f27d0000 aec.sys Timestamp: unavailable (00000000)
    f2b8b000 f2b98000 DMusic.sys Timestamp: unavailable (00000000)
    f2b1b000 f2b29000 swmidi.sys Timestamp: unavailable (00000000)
    f79f3000 f79f5000 splitter.sys Timestamp: unavailable (00000000)
    f5f37000 f5f68000 symidsco.sys Timestamp: unavailable (00000000)
    f787f000 f7884000 Cdaudio.SYS Timestamp: unavailable (00000000)
    bae0c000 bae0f000 Sfloppy.SYS Timestamp: unavailable (00000000)

    Finished dump check

    C:\Program Files\Support Tools>dumpchk.exe c:\windows\minidump\mini011207-02.dmp

    Loading dump file c:\windows\minidump\mini011207-02.dmp
    ----- 32 bit Kernel Mini Dump Analysis

    DUMP_HEADER32:
    MajorVersion 0000000f
    MinorVersion 00000a28
    DirectoryTableBase 10008000
    PfnDataBase 81000000
    PsLoadedModuleList 8055a420
    PsActiveProcessHead 805604d8
    MachineImageType 0000014c
    NumberProcessors 00000001
    BugCheckCode 000000c4
    BugCheckParameter1 00000090
    BugCheckParameter2 ffdff120
    BugCheckParameter3 00000000
    BugCheckParameter4 00000000
    PaeEnabled 00000000
    KdDebuggerDataBlock 8054c060
    MiniDumpFields 00000dff

    TRIAGE_DUMP32:
    ServicePackBuild 00000200
    SizeOfDump 00010000
    ValidOffset 0000fffc
    ContextOffset 00000320
    ExceptionOffset 000007d0
    MmOffset 00001068
    UnloadedDriversOffset 000010a0
    PrcbOffset 00001878
    ProcessOffset 000024c8
    ThreadOffset 00002728
    CallStackOffset 00002980
    SizeOfCallStack 00003000
    DriverListOffset 00005c10
    DriverCount 00000087
    StringPoolOffset 00008428
    StringPoolSize 00001298
    BrokenDriverOffset 00000000
    TriageOptions 00000041
    TopOfStack f377b000
    DebuggerDataOffset 00005980
    DebuggerDataSize 00000290
    DataBlocksOffset 000096c0
    DataBlocksCount 00000003


    Windows XP Kernel Version 2600 (Service Pack 2) UP Free x86 compatible
    Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055a420
    Debug session time: Fri Jan 12 11:31:54 2007
    System Uptime: 0 days 2:13:18
    start end module name
    804d7000 806eb100 nt Checksum: 002198AF Timestamp: Tue Mar 01 17:
    59:37 2005 (42250FF9)

    Unloaded modules:
    f20eb000 f2116000 kmixer.sys Timestamp: unavailable (00000000)
    f77c7000 f77ce000 usbprint.sys Timestamp: unavailable (00000000)
    f31db000 f3206000 kmixer.sys Timestamp: unavailable (00000000)
    f7a55000 f7a56000 drmkaud.sys Timestamp: unavailable (00000000)
    f33be000 f33cb000 DMusic.sys Timestamp: unavailable (00000000)
    f3206000 f3229000 aec.sys Timestamp: unavailable (00000000)
    f35ce000 f35dc000 swmidi.sys Timestamp: unavailable (00000000)
    f79ed000 f79ef000 splitter.sys Timestamp: unavailable (00000000)
    f7887000 f788c000 Cdaudio.SYS Timestamp: unavailable (00000000)
    badfc000 badff000 Sfloppy.SYS Timestamp: unavailable (00000000)

    Finished dump check

    C:\Program Files\Support Tools>
     
  2. Tim_FJ1200SC

    Tim_FJ1200SC TS Rookie Topic Starter

    I forgot to add the following.

    It is a work computer that is always on, is never put into standby or hibernate and is rebooted on average, two to three times a week.

    Thanks, Tim
     
  3. Tim_FJ1200SC

    Tim_FJ1200SC TS Rookie Topic Starter

    It just happened agin.
    Here is the log.

    C:\Program Files\Support Tools>dumpchk.exe c:\windows\minidump\mini011207-03.DMP

    Loading dump file c:\windows\minidump\mini011207-03.DMP
    ----- 32 bit Kernel Mini Dump Analysis

    DUMP_HEADER32:
    MajorVersion 0000000f
    MinorVersion 00000a28
    DirectoryTableBase 1bfec000
    PfnDataBase 81000000
    PsLoadedModuleList 8055a420
    PsActiveProcessHead 805604d8
    MachineImageType 0000014c
    NumberProcessors 00000001
    BugCheckCode 000000c4
    BugCheckParameter1 00000090
    BugCheckParameter2 ffdff120
    BugCheckParameter3 00000000
    BugCheckParameter4 00000000
    PaeEnabled 00000000
    KdDebuggerDataBlock 8054c060
    MiniDumpFields 00000dff

    TRIAGE_DUMP32:
    ServicePackBuild 00000200
    SizeOfDump 00010000
    ValidOffset 0000fffc
    ContextOffset 00000320
    ExceptionOffset 000007d0
    MmOffset 00001068
    UnloadedDriversOffset 000010a0
    PrcbOffset 00001878
    ProcessOffset 000024c8
    ThreadOffset 00002728
    CallStackOffset 00002980
    SizeOfCallStack 00003fff
    DriverListOffset 00006c10
    DriverCount 00000088
    StringPoolOffset 00009470
    StringPoolSize 000012b8
    BrokenDriverOffset 00000000
    TriageOptions 00000041
    TopOfStack f1e68000
    DebuggerDataOffset 00006980
    DebuggerDataSize 00000290
    DataBlocksOffset 0000a728
    DataBlocksCount 00000003


    Windows XP Kernel Version 2600 (Service Pack 2) UP Free x86 compatible
    Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055a420
    Debug session time: Fri Jan 12 13:59:37 2007
    System Uptime: 0 days 2:27:28
    start end module name
    804d7000 806eb100 nt Checksum: 002198AF Timestamp: Tue Mar 01 17:
    59:37 2005 (42250FF9)

    Unloaded modules:
    f1d21000 f1d4c000 kmixer.sys Timestamp: unavailable (00000000)
    f1d21000 f1d4c000 kmixer.sys Timestamp: unavailable (00000000)
    f20bc000 f20e7000 kmixer.sys Timestamp: unavailable (00000000)
    f2e14000 f2e3f000 kmixer.sys Timestamp: unavailable (00000000)
    f7aaf000 f7ab0000 drmkaud.sys Timestamp: unavailable (00000000)
    f30ff000 f310c000 DMusic.sys Timestamp: unavailable (00000000)
    f301f000 f302d000 swmidi.sys Timestamp: unavailable (00000000)
    f2e67000 f2e8a000 aec.sys Timestamp: unavailable (00000000)
    f7a0d000 f7a0f000 splitter.sys Timestamp: unavailable (00000000)
    f788f000 f7894000 Cdaudio.SYS Timestamp: unavailable (00000000)
    bae00000 bae03000 Sfloppy.SYS Timestamp: unavailable (00000000)

    Finished dump check

    C:\Program Files\Support Tools>
     
  4. Tim_FJ1200SC

    Tim_FJ1200SC TS Rookie Topic Starter

    Found the debugging analyzer and ran it.
    These are the culprit files
    SAVRT.SYS
    navex15.sys
    SYMEVENT.SYS
    They all belong to Norton.
    Anyone know how I might stop the problem? Removing Norton is not an option, as my boss thinks it is a good program.

    Thanks, Tim
     
  5. Hello Tim

    I see that you have atleast have found what might be causing your problem?

    I have had a series of crashes increasing over the last couple of months. I have re formatted, tried new drivers & have reverted back to the old, so and so on.

    I configurerd the pc not to shut down so that It can atleast get a BSOD that may give me a little insight to my problem. I received an error this afternoon that is similar to yours. I do not know how to extract the minidum file information? Can you enlighten me to a possible fix or direction to follow?

    DRIVER_IRQL_NOT_LESS_OR_EQUAL
    **STOP 0x000000D1, (0x08A743B1A, 0x00000002, 0x00000000,0xA8233B6F)
    SYMIDSCO.SYS ADDRESS A8233B6F BASE AT A8214000, date stamp 45384916.

    Any assistance or direction would be a great help.

    Thank you in advance.
    Craig
     
  6. Tim_FJ1200SC

    Tim_FJ1200SC TS Rookie Topic Starter

    Well I cannot take credit for anything here. I found a link that TS Special Forces member howard_hopkinso posted a while ago.

    Here is the link - http://forums.majorgeeks.com/showthread.php?t=35246

    Here is the link to Howard's post - http://www.techspot.com/vb/topic35422.html

    I hope this helps because I'm not really someone that should try to help you with this deep of a problem.

    I still do no know how to fix my computer's problems even though I think I know what drivers are causing the errors.

    Anyone want to bail me out here?

    Tim
     
  7. Tim_FJ1200SC

    Tim_FJ1200SC TS Rookie Topic Starter

    Please can one of you folks that know this stuff please take a look at this.
    This is the debug log I got on my last minidump and I have run the "!analyze -v" command on it.

    1) Can I run a "verifier.exe stop" from the cmd and shut off the verifier?
    2) Is that a bad thing to do?
    3) Is there a better way to fix this?

    Thanks, Tim

    Microsoft (R) Windows Debugger Version 6.6.0007.5
    Copyright (c) Microsoft Corporation. All rights reserved.


    Loading Dump File [C:\WINDOWS\Minidump\Mini011507-03.dmp]
    Mini Kernel Dump File: Only registers and stack trace are available

    Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
    Executable search path is:
    Windows XP Kernel Version 2600 (Service Pack 2) UP Free x86 compatible
    Product: WinNt, suite: TerminalServer SingleUserTS Personal
    Built by: 2600.xpsp_sp2_gdr.050301-1519
    Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055a420
    Debug session time: Mon Jan 15 15:48:44.468 2007 (GMT-7)
    System Uptime: 0 days 3:37:22.016
    Loading Kernel Symbols
    .......................................................................................................................................
    Loading User Symbols
    Loading unloaded module list
    .............
    *******************************************************************************
    * *
    * Bugcheck Analysis *
    * *
    *******************************************************************************

    Use !analyze -v to get detailed debugging information.

    BugCheck C4, {90, ffdff120, 0, 0}

    Unable to load image SAVRT.SYS, Win32 error 2
    *** WARNING: Unable to verify timestamp for SAVRT.SYS
    *** ERROR: Module load completed but symbols could not be loaded for SAVRT.SYS
    Probably caused by : SAVRT.SYS ( SAVRT+3c2e0 )

    Followup: MachineOwner
    ---------

    kd> !analyze -v
    *******************************************************************************
    * *
    * Bugcheck Analysis *
    * *
    *******************************************************************************

    DRIVER_VERIFIER_DETECTED_VIOLATION (c4)
    A device driver attempting to corrupt the system has been caught. This is
    because the driver was specified in the registry as being suspect (by the
    administrator) and the kernel has enabled substantial checking of this driver.
    If the driver attempts to corrupt the system, bugchecks 0xC4, 0xC1 and 0xA will
    be among the most commonly seen crashes.
    Parameter 1 = 0x1000 .. 0x1020 - deadlock verifier error codes.
    Typically the code is 0x1001 (deadlock detected) and you can
    issue a '!deadlock' KD command to get more information.
    Arguments:
    Arg1: 00000090, A driver switched stacks. The current stack is neither a thread
    stack nor a DPC stack. Typically the driver doing this should be
    on the stack obtained from `kb' command.
    Arg2: ffdff120
    Arg3: 00000000
    Arg4: 00000000

    Debugging Details:
    ------------------


    BUGCHECK_STR: 0xc4_90

    CUSTOMER_CRASH_COUNT: 3

    DEFAULT_BUCKET_ID: DRIVER_FAULT

    PROCESS_NAME: LuCallbackProxy

    TRAP_FRAME: 834d4e1c -- (.trap ffffffff834d4e1c)
    ErrCode = 00000000
    eax=000004d3 ebx=000000d3 ecx=00000052 edx=000004d3 esi=e2743008 edi=00000000
    eip=f27922e0 esp=834d4e90 ebp=e1247008 iopl=0 nv up ei ng nz ac pe cy
    cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010297
    SAVRT+0x3c2e0:
    f27922e0 ?? ???
    Resetting default scope

    LAST_CONTROL_TRANSFER: from 80671fdb to 8053331e

    STACK_TEXT:
    834d4c30 80671fdb 000000c4 00000090 ffdff120 nt!KeBugCheckEx+0x1b
    834d4c50 806722d9 834d4c7c 806728cc 00000000 nt!ViDeadlockCheckStackLimits+0x6c
    834d4c58 806728cc 00000000 00000000 00000000 nt!ViDeadlockCanProceed+0x2a
    834d4c7c 8054b60d 8343efb0 00000050 84d69c98 nt!VfDeadlockDeleteMemoryRange+0x13
    834d4cc0 8054b0b9 8343efb0 00000000 834d4cdc nt!ExFreePoolWithTag+0xad
    834d4cd0 804f107e 8343efb0 834d4d0c 80670ff8 nt!ExFreePool+0xf
    834d4cdc 80670ff8 80553d00 8343efb0 80669cdd nt!ExFreeToPagedLookasideList+0x1e
    834d4ce8 80669cdd 84d3e9f8 014c5000 84850ef8 nt!VfIrpReleaseCallStackData+0x15
    834d4d0c 804f5508 00000000 84850ee8 84850ef8 nt!IovCallDriver+0xb8
    834d4d20 804f552f 84d69c98 84850f0a 84850f00 nt!IopPageReadInternal+0xf4
    834d4d40 804f5194 84d3e9f8 84850f20 84850f00 nt!IoPageRead+0x1b
    834d4db4 804ebace 153eb8c0 f27922e0 c03c9e48 nt!MiDispatchFault+0x274
    834d4e04 804e1718 00000000 f27922e0 00000000 nt!MmAccessFault+0x5bc
    834d4e04 f27922e0 00000000 f27922e0 00000000 nt!KiTrap0E+0xcc
    WARNING: Stack unwind information not available. Following frames may be wrong.
    834d4e8c f27964ec 000004d3 e2743008 f2797e5c SAVRT+0x3c2e0
    834d4e90 00000000 e2743008 f2797e5c 00000000 SAVRT+0x404ec


    STACK_COMMAND: kb

    FOLLOWUP_IP:
    SAVRT+3c2e0
    f27922e0 ?? ???

    SYMBOL_STACK_INDEX: e

    FOLLOWUP_NAME: MachineOwner

    MODULE_NAME: SAVRT

    IMAGE_NAME: SAVRT.SYS

    DEBUG_FLR_IMAGE_TIMESTAMP: 422cda85

    SYMBOL_NAME: SAVRT+3c2e0

    FAILURE_BUCKET_ID: 0xc4_90_SAVRT+3c2e0

    BUCKET_ID: 0xc4_90_SAVRT+3c2e0

    Followup: MachineOwner
    ---------
     
  8. cpc2004

    cpc2004 TS Evangelist Posts: 2,044

    Hi,

    From the stack trace, I find the footprint of SAVRT.sys which belongs to Norton AV. Upgrade or de-install Norton AV may resolve the blue screen problem.
     
  9. Kaorichan2002

    Kaorichan2002 TS Rookie Posts: 89

    he said its not an option... tell the boss you need a new computer or tell him you quit till he gets it fixed since he didnt notice the problem. and they said computers would decrease workload, they do but the stress!!!
     
Topic Status:
Not open for further replies.


Add New Comment

TechSpot Members
Login or sign up for free,
it takes about 30 seconds.
You may also...


Get complete access to the TechSpot community. Join thousands of technology enthusiasts that contribute and share knowledge in our forum. Get a private inbox, upload your own photo gallery and more.