Hardware? Software? Both? Strange spontaneous reboots; repeatable

P

Pop

Crossposted to ...xp.hardware:

Hello folk.

Hope you'll forgive the crosspost, but I'm not exactly sure where
to post. Therefore, please, feel free to redirect me if you know
of a more likely center of experience. Last time I came on with
a question I ended up feeling pretty dumb for not knowing the
answer: I'm hoping you folk can do that to me again, but ...
<g>.
I also hope someone will have the patience to wade thru this
missive. I tried to keep it short, but, well, it just doesn't
seem to be in me to do that.

SYSTEM:
GW 700XL, P4, 2.6 GHz, 512 RAM, 2 80Gig 7200 rpm internal (not
RAID), 1 160Gig ext USB, XP Pro/SP2/Hotfix, Off XP, AV, Spyware,
etc., all updated & were current yesterday, 27 Jan 05, event logs
running, fair amount of peripheral equip: AV stuff, scanner, 2
printers, etc. etc.. Nvidia Gforce 5200/TV out, max video RAM,
all equip in use, 56k dialup 'net connection. Not simultaneously
of course. LAN is turned off/disabled, not being loaded.

SYSTEM STATUS:
Everything is functioning with a small but important
exception. No obvious problems with any specific application.
Everything functions re apps, so - that leaves OS, HW, or ME! I
think.

PROBLEM:
For some time, a very occasional spontaneous reboot would
occur. Messy, like the power cord was pulled - black screen,
keyboard off, no lights, etc.. But, after a few seconds it would
restart as though it had done a cold boot. Error message
indicating a Serious Error Occurred would appear, click OK and
boot continued normally and loaded windows. Not using multiboots
either; only the one OS.
Forgot about bootlog.txt until just now: Will turn it on next.
Event Logs all running.
For a long time it seemed to have no pattern but then
apparently I woke up enough to notice the pattern; it was simple,
and is repeatable every time.

HOW TO REPLICATE PROBLEM:
Clicking for the Summary tab on any Properties view which
includes a Summary, sets up the necessary condition. Upon
LEAVING the Properties window, whether by Cancel or OK, causes
the spontaneous reboot. Click, nothing happens, then about three
seconds later, it acts just like the power cord had been pulled
from the wall, and about another three seconds later initiates
what seems to be a full bootup from scratch.

RESULTS:
-- The Serious Error message already men tioned above, and
-- Sometimes partial rearrangement of desktop icons and/or Quik
Start icons in the Taskbar (lower left side) and
-- Other unpredictable but so far always minor setting changes
with one or two exceptions. Never any actual damage or
corruption I'm aware of. For instance, once it completely
rearranged desktop, single-click setting back to double click,
and once the entire thing re-defaulted. Every customization (for
the OS, not apps) that I had set went back to default. Weird; to
me at least. Apps like Office, etc., did not reset.

EFFORTS TO DATE (2 days):
-- Two to three weeks ago, I did a Repair install of XP, just
for grins, but they kept happening now and then. I make a fair
amount of use of the Summary tab in Properties for various files.
-- Backed up System State and all data.
-- I'm pretty confident there is no virus/Trojan/spyware etc..
Norton System Works, Adaware, Spybot, two others I can't recall
at the moment, oh, spyguard, and another. All known good, clean
applications used by many fellow spamfighters on Spamcop.net.
-- ALL cookies, temps & TMPS removed, completely cleaned every
account & manually verified. ONE file, perflib_perfdata_xyz
cannot be removed and so is ignored. I cannot seem to figure out
what it is, but the "xyz" is always different, and it's owned by
the OS. It's been there ever since I can remember. There are no
apps which, to the best of my ability, are not known-good,
known-safe apps installed. Most recent install was a reinstall
of Partition Magic 8 several months ago in the spring. Norton
Systemworks 2005 about the same time.
-- Systemworks says Registry is OK, and has been all along.
There WAS a Program Integrity problem Norton found, but it fixed
it and it didn't seem related to anything and changed nothing.
-- I've run every diagnostic I have and a couple I downloaded
yesterday, to no avail. All the hardware, including temperatures
looks fine. Nothing's sputtering, UPS shows no power line
disturbances, no brownouts, no blackouts in over 30 days. Last
time UPS came on was mid-Fall - power dropped for about three
minutes.

The Event Logs don't show anything especially helpful. There are
a couple of Medium errors, but they always seem to straighten
themselves out either in successive attempts or next Restart.

I purposely caused the spontaneous restart to happen four times,
today. Each gave me the serious error message during the boot,
but;
-- First time, all OK.
-- Second time, some icons on left side of screen spread out,
Quicklaunches were rearranged, not by Name or anything obvious;
just rearranged.
-- Other two, nothing special that was eye-able, at least.

While I had the error message on the screen, I opened Notepad and
grabbed the error report data and saved it to a file. As you
likely know, as soon as you close that error dialog, the files go
away; now I see why: The last line of the script is to erase all
the data. Dumb move in my opinion!! It took me a LONG time to
figure out why I couldn't find that error data when it even gave
me the path to the actual filenames! Someone at MS should be
forced to drink a (your favorite here)!

So, if anyone thinks it would be useful, I will share those, or
even create more for testing, but I think they're all about the
same thing. I caught everything from the manifest.txt to the
..DMPs and the XML source. The XML source, though long, looks
pretty useless - it's just a bunch of machine ID's and ends with
an error message at the end where the machine quits, apparently.
I think one was about 49k, the other 140k, both text HTML files.

If I were to write a synopsis of this right now, about all I
could say is that it's a software problem causing something to
act like the power supply goes bonkers. But nothing points
towards that when I dig into it. I think I"m too close to the
problem by now.

Soo, if anyone likes a challenge out there, I'd be more than
willing to accept/debate/try/take under advisement/use/brainstorm
or otherwise make use of any input. I'm at a standstill for
ideas; all I can do for the moment is poke around and hope
something jumps up at me.
BTW, I'm no guru by any means, but I do know more than the
average joe on the streets. I have no fear of tweaking things as
long as I can satisfy myself that I think I might know what I
think I might be doing <g>. So, if you start talking about
DCOM(bobulators) et al, you're likely to lose me, so treat me as
an intermediate, not a power user.

Soooo, if you're looking for a challenge, have I got a deal for
you!! <G>

Thanks in advance, especially if you've manage to even read this
far!

Pop
 
J

James E Middleton

Have you checked the event viewer?
No BSOD messages?
Is the RAM one stick or two?
You could try pulling out one stick at a time and trying to recreate the
problem to rule out bad memory.
Hows the power supply; how old, how many watts?
 
P

Pop

James said:
Have you checked the event viewer?
===> Yes. No help. A couple of trying to write to the registry
before it was released from another app, but nothing corresponds
to anything anywhere near the reboot. Only Error I see is a
failed dl of SP3 because I killed it when I saw the size of it.
No BSOD messages?
===> None, nada.
Is the RAM one stick or two?
===> One. Have two slots; swapped slots, no joy. I have a
pretty reliable mem checking app and it exercises it every way
from Sunday, including timings, and all is reported as OK. Used
a couple other freebies too, but I din't think they'd find a
problem unless the stick was completely removed! They said OK of
course.
You could try pulling out one stick at a time and trying
to recreate the problem to rule out bad memory.
===> I'm beginning to think RAM too, since quite awhile ago I
had a "can't write" error during shutdown. That was a long time
ago but it's possible it coincided with the first time this
problem happened. I only have a couple months of data in the
logs so it's gone now; I checked.
But then, if it were RAM, I'd think it wouldn't be so
reliablly duplicated with one particualr action and no others I
have been able to discover.

Is there any way to capture the events around the cpu itself to
see what it was doing at the time of the problem? I've looked at
Sourceforge and AnalogX so far; it there's anything there i can't
locate it.

It's only 250W, maybe 300, not positive, but doesn't seem to be
getitng excessively hot in any way.
I do have a decent scope: what would you suggest monitoring:
3V? I'm not even sure what the voltage is right now; 3 is just
an assumption but I think it makes the question clear. Don't
remember what a P4 runs on; there are lower voltages but they
might be created from 3V.
All Fans are clear and operational. CPU not excessively hot;
fan fine, starts fast, coasts on shutoff.
I'm not really too keen on monitoring a voltage rail though;
impacts internal chimneys & everything's nice and "cool" (not
excessively hot) at the moment.
Hows the power supply; how old, how many watts?
===> A little over a 18 mo plus mfg storage. Machine received
just about a year and a half ago last month. Gateway 700 XL.

Regards,

Pop
 
P

Pop

EasyFeelings said:
when this started, had you installed new hardware /
software ?
i wouldn't completely rule out viruses, if something got
past norton to begin with, scanning with norton won't
help. to be sure, try a second opinion at
http://housecall.trendmicro.com/housecall/start_corp.asp

it's free and usually very good.

No, I had not installed any hardware/software that coincided with
this. It's as I described in my original post. I really don't
think it's virus related anymore either, though I did try
Trendmicro for grins; all clean. Figured it couldn't hurt; they
do have a decent rep. FWIW, it's my experience that Trendmicro
seems to lag Symantec and McAfee by a day or so most of the time.
 
P

Pop

Hi again,

I -think- I've tracked down some useful info on this issue, but
it's not meaning to ME, so ... here's hoping it is to someone
here! In order to shorten this post, I'm going to snip a lot of
my previous post in order to contain the size just a bit.
I -think- it's coming down to bad_header_data, but whatever that
specifically is, you tell me and we'll both know!
Crossposted to ...xp.hardware:

Reverse chronology:
The following may all occur together:
Error code 00000019, parameter1 00000020, parameter2 f8cb81a8,
parameter3 f8cb8228, parameter4 0a100007.

The computer has rebooted from a bugcheck. The bugcheck was:
0x00000019 (0x00000020, 0xf8cb81a8, 0xf8cb8228, 0x0a100007). A
dump was saved in: C:\WINDOWS\MEMORY.DMP.

The System Restore filter encountered the unexpected error
'0xC0000243' while processing the file 'Savrt' on the volume
'HarddiskVolume1'. It has stopped monitoring the volume.

DCOM got error "The service database is locked. " attempting to
start the service winmgmt with arguments "" in order to run the
server:

{8BC3F05E-D86B-11D0-A075-00C04FB68820}

FOLLOWED BY SINGLE ERROR EVENTS SUCH AS:

The System Restore filter encountered the unexpected error
'0xC0000243' while processing the file 'Savrt' on the volume
'HarddiskVolume1'. It has stopped monitoring the volume.

Error messages are starting to show up more often in the log
viewers now; not sure that's good or bad. Maybe Safe Mode
triggered them on because until the Safe Mode log entries there
were no red error icons, only a warning here and there.

But, anyone with any advice, I'd be happy to hear it. I'm not
about doing another repair install, want to avoid a complete
format/install if at all possible. My main problem is that this
is a totally new area for me an d I don't understand half of what
I'm reading, other than maybe it's hardware, but be sure it's not
software <g>?!

Stanging by and hoping,

Pop

....
SYSTEM:
GW 700XL, P4, 2.6 GHz, 512 RAM, 2 80Gig 7200 rpm internal (not
RAID), 1 160Gig ext USB, XP Pro/SP2/Hotfix, Off XP, AV,
Spyware,
etc., all updated & were current yesterday, 27 Jan 05, event
logs
running, fair amount of peripheral equip: AV stuff, scanner, 2
printers, etc. etc.. Nvidia Gforce 5200/TV out, max video RAM,
all equip in use, 56k dialup 'net connection. Not
simultaneously
of course. LAN is turned off/disabled, not being loaded.

SYSTEM STATUS:
Upon selecting ANY file's Properties and the just placing the
cursor in the Summary window, winSP Pro SP2 will crash,
restarting itself with a "recovery from a serious error" message.
All else on the machine seems fine - no other noticeable
problems.
It took some time to realize, but the problem is 100%
repeatable.
I pasted the mini-dump to wordpad and save it; I think I got
it all.
There is now a "full" dump, but haven't looked at it yet; it's
so voluminous I imagine it's useless.
 

Ask a Question

Want to reply to this thread or ask your own question?

You'll need to choose a username for the site, which only take a couple of moments. After that, you can post your question and our members will help you out.

Ask a Question

Top