XP PC keeps shutting down?

By commission
Nov 27, 2007
  1. Hello

    I have a Windows XP machine that has restarted twice in the last week for no particular reason. Can someone please make sense of this minidump please? What does all of this mean?

    Microsoft (R) Windows Debugger Version 6.8.0004.0 X86
    Copyright (c) Microsoft Corporation. All rights reserved.

    Loading Dump File [C:\Documents and Settings\Minidump\Mini112607-01.dmp]
    Mini Kernel Dump File: Only registers and stack trace are available

    Symbol search path is: C:\WINDOWS\symbols
    Executable search path is:
    Windows XP Kernel Version 2600 (Service Pack 2) UP Free x86 compatible
    Product: WinNt, suite: TerminalServer SingleUserTS
    Built by: 2600.xpsp_sp2_gdr.070227-2254
    Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055a620
    Debug session time: Mon Nov 26 14:22:48.259 2007 (GMT+11)
    System Uptime: 0 days 5:13:32.701
    Loading Kernel Symbols
    Loading User Symbols
    Loading unloaded module list
    *** ERROR: Module load completed but symbols could not be loaded for Ntfs.sys
    * *
    * Bugcheck Analysis *
    * *

    Use !analyze -v to get detailed debugging information.

    BugCheck 24, {1902fe, add480f8, add47df4, f7b7a44a}

    *** ERROR: Module load completed but symbols could not be loaded for sr.sys
    *** WARNING: Unable to verify timestamp for VET-FILT.SYS
    *** ERROR: Module load completed but symbols could not be loaded for VET-FILT.SYS
    *** WARNING: Unable to verify timestamp for VETMONNT.SYS
    *** ERROR: Module load completed but symbols could not be loaded for VETMONNT.SYS

    Probably caused by : Ntfs.sys ( Ntfs+2844a )

    Followup: MachineOwner

    kd> !analyze -v
    * *
    * Bugcheck Analysis *
    * *

    If you see NtfsExceptionFilter on the stack then the 2nd and 3rd
    parameters are the exception record and context record. Do a .cxr
    on the 3rd parameter and then kb to obtain a more informative stack
    Arg1: 001902fe
    Arg2: add480f8
    Arg3: add47df4
    Arg4: f7b7a44a

    Debugging Details:

    EXCEPTION_RECORD: add480f8 -- (.exr 0xffffffffadd480f8)
    ExceptionAddress: f7b7a44a (Ntfs+0x0002844a)
    ExceptionCode: c0000005 (Access violation)
    ExceptionFlags: 00000000
    NumberParameters: 2
    Parameter[0]: 00000000
    Parameter[1]: 000002da
    Attempt to read from address 000002da

    CONTEXT: add47df4 -- (.cxr 0xffffffffadd47df4)
    eax=000002da ebx=add40053 ecx=e31eead4 edx=e31e0057 esi=e2087288 edi=e2087290
    eip=f7b7a44a esp=add481c0 ebp=add481cc iopl=0 nv up ei ng nz na pe nc
    cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010286
    f7b7a44a 668b10 mov dx,word ptr [eax] ds:0023:000002da=????
    Resetting default scope


    PROCESS_NAME: wmiprvse.exe

    ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx". The memory could not be "%s".

    READ_ADDRESS: 000002da

    BUGCHECK_STR: 0x24


    LAST_CONTROL_TRANSFER: from f7b7a4f4 to f7b7a44a

    WARNING: Stack unwind information not available. Following frames may be wrong.
    add481cc f7b7a4f4 e180523c add48210 e18050d0 Ntfs+0x2844a
    add481f8 f7b7a622 8a6a4db8 e18050d0 add48338 Ntfs+0x284f4
    add4835c f7b77d2d 8a6a4db8 89f65008 add483b4 Ntfs+0x28622
    add48440 804e37f7 8a6fe020 89f65008 8a6a9640 Ntfs+0x25d2d
    add48450 f746d876 89f651bc 8a6f5980 89f65008 nt!IopfCallDriver+0x31
    add4849c 804e37f7 8a6f0e88 00000001 89f651e0 sr+0x5876
    add48540 804e37f7 8a5ac958 89f65008 89f65008 nt!IopfCallDriver+0x31
    add48550 8056f54a 8a6fe8e8 8a368a54 add486f8 nt!IopfCallDriver+0x31
    add484dc f7809939 8a5aca10 89f65008 00000add nt!IopParseDevice+0xa12
    add48540 804e37f7 8a5ac958 89f65008 89f65008 VET_FILT+0x2939
    add48550 8056f54a 8a6fe8e8 8a368a54 add486f8 nt!IopfCallDriver+0x31
    add48630 8056336c 8a6fe900 00000000 8a3689b0 nt!IopParseDevice+0xa12
    add486b8 8056749a 00000000 add486f8 00000240 nt!ObpLookupObjectName+0x56a
    add4870c 8056fa23 00000000 00000000 00000000 nt!ObOpenObjectByName+0xeb
    add48788 8056faf2 add4894c 80000000 add48920 nt!IopCreateFile+0x407
    add487e4 8056fbba add4894c 80000000 add48920 nt!IoCreateFile+0x8e
    add48824 804de7ec add4894c 80000000 add48920 nt!NtOpenFile+0x27
    add48824 804dcfdd add4894c 80000000 add48920 nt!KiFastCallEntry+0xf8
    add488b4 f7817a2b add4894c 80000000 add48920 nt!ZwOpenFile+0x11
    add48950 f7818b43 89eed840 89eed888 00000000 VETMONNT+0xa2b
    add489a0 f7818c8b 8a027e0c 0000003f 00000000 VETMONNT+0x1b43
    add489b4 f7817904 8a6f0dd0 8a027c58 add489e8 VETMONNT+0x1c8b
    add48a04 f7809846 8a6f0dd0 8a027c58 8a027c68 VETMONNT+0x904
    add48a60 804e37f7 8a5ac958 8a027c58 8a027c58 VET_FILT+0x2846
    add48a70 8056f54a 8a6fe8e8 89f7d7a4 add48c18 nt!IopfCallDriver+0x31
    add48b50 8056336c 8a6fe900 00000000 89f7d700 nt!IopParseDevice+0xa12
    add48bd8 8056749a 00000000 add48c18 00000040 nt!ObpLookupObjectName+0x56a
    add48c2c 8056fa23 00000000 00000000 72000001 nt!ObOpenObjectByName+0xeb
    add48ca8 8056faf2 0007eee8 001200a9 0007ede4 nt!IopCreateFile+0x407
    add48d04 8056fbba 0007eee8 001200a9 0007ede4 nt!IoCreateFile+0x8e
    add48d44 804de7ec 0007eee8 001200a9 0007ede4 nt!NtOpenFile+0x27
    add48d44 7c90eb94 0007eee8 001200a9 0007ede4 nt!KiFastCallEntry+0xf8
    0007ee04 00000000 00000000 00000000 00000000 0x7c90eb94

    f7b7a44a 668b10 mov dx,word ptr [eax]


    SYMBOL_NAME: Ntfs+2844a

    FOLLOWUP_NAME: MachineOwner


    IMAGE_NAME: Ntfs.sys


    STACK_COMMAND: .cxr 0xffffffffadd47df4 ; kb

    FAILURE_BUCKET_ID: 0x24_Ntfs+2844a

    BUCKET_ID: 0x24_Ntfs+2844a

    Followup: MachineOwner
  2. fastco

    fastco TS Booster Posts: 1,123

  3. commission

    commission TS Rookie Topic Starter Posts: 26

    Ok thanks for your help
Topic Status:
Not open for further replies.

Similar Topics

Add your comment to this article

You need to be a member to leave a comment. Join thousands of tech enthusiasts and participate.
TechSpot Account You may also...