Random reboots

W

Wolf

For about 2 months I've had random reboots. It's started shortly after I
upgraded to SP3 as well as to Norton Anti-virus 2008. I never get to see the
blue screen before it reboots, And had to download the debugger just to read
the dump files. I've upgraded the drivers, checked that everything was
seated. It doesn't matter what program it happens on, a game, just working
with files, etc. The one constant here, and I'm having trouble finding the
function in support is: FAILURE_BUCKET_ID:
0xA_W_nt!MiRestoreTransitionPte+6b. What does this call refer to? Physical
memory, hard drive, that sort of thing...

Microsoft (R) Windows Debugger Version 6.9.0003.113 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\WINDOWS\Minidump\Mini061808-02.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*C:\Program Files\Debugging Tools for Windows
(x86)\Symbols*http://msdl.microsoft,com/download/symbols
Executable search path is: C:\WINDOWS\system32; C:\WINDOWS\system\system32
Windows XP Kernel Version 2600 (Service Pack 3) UP Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 2600.xpsp.080413-2111
Kernel base = 0x804d7000 PsLoadedModuleList = 0x80553fc0
Debug session time: Wed Jun 18 20:26:07.750 2008 (GMT-7)
System Uptime: 0 days 0:37:18.315
Loading Kernel Symbol
......................................................................................................................................................................................
Loading User Symbols
Loading unloaded module list
..................................
*******************************************************************************
*
*
* Bugcheck Analysis
*
*

*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1000000A, {4f000010, 2, 1, 80514135}

Probably caused by : memory_corruption ( nt!MiRestoreTransitionPte+6b )

Followup: MachineOwner
---------

kd> !analyze -
*******************************************************************************
*
*
* Bugcheck Analysis
*
*

*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 4f000010, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000001, bitfield :
bit 0 : value 0 = read operation, 1 = write operation
bit 3 : value 0 = not an execute operation, 1 = execute operation (only on
chips which support this level of status)
Arg4: 80514135, address which referenced memory

Debugging Details:
------------------


WRITE_ADDRESS: 4f000010

CURRENT_IRQL: 2

FAULTING_IP:
nt!MiRestoreTransitionPte+6b
80514135 ff4910 dec dword ptr [ecx+10h]

CUSTOMER_CRASH_COUNT: 2

DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: 0xA

PROCESS_NAME: System

LAST_CONTROL_TRANSFER: from 8051ec6d to 80514135

STACK_TEXT:
bace3aac 8051ec6d e7aea080 ffffffff 8a612408 nt!MiRestoreTransitionPte+0x6b
bace3ac4 8051f21e 87c265c0 805126d5 8a612438 nt!MiRemovePageFromList+0xd1
bace3acc 805126d5 8a612438 000004c0 00000400 nt!MiRemoveAnyPage+0x56
bace3af8 80513210 00010000 87c26634 87c26650 nt!MiResolveMappedFileFault+0x3dd
bace3b3c 805133ca 00000000 ced10000 c0676880 nt!MiResolveProtoPteFault+0x18c
bace3bc0 8051cb1c e7aea080 ced10000 c0676880 nt!MiDispatchFault+0xe8
bace3c24 80517c78 00000000 ced10000 00000000 nt!MmAccessFault+0x7b4
bace3c80 804e0fe7 ced10000 00000000 80550118 nt!MmCheckCachedPageState+0x56c
bace3d2c 804e620f 8a7b9298 8055b0c0 8a7bb830 nt!CcPerformReadAhead+0x1f1
bace3d74 80534c02 8a7b9298 00000000 8a7bb830 nt!CcWorkerThread+0x147
bace3dac 805c6160 8a7b9298 00000000 00000000 nt!ExpWorkerThread+0x100
bace3ddc 80541dd2 80534b02 00000000 00000000 nt!PspSystemThreadStartup+0x34
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16


STACK_COMMAND: kb

FOLLOWUP_IP:
nt!MiRestoreTransitionPte+6b
80514135 ff4910 dec dword ptr [ecx+10h]

SYMBOL_STACK_INDEX: 0

SYMBOL_NAME: nt!MiRestoreTransitionPte+6b

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nt

DEBUG_FLR_IMAGE_TIMESTAMP: 4802516a

IMAGE_NAME: memory_corruption

FAILURE_BUCKET_ID: 0xA_W_nt!MiRestoreTransitionPte+6b

BUCKET_ID: 0xA_W_nt!MiRestoreTransitionPte+6b

Followup: MachineOwner
---------

kd> lmvm nt
start end module name
804d7000 806cf580 nt (pdb symbols) C:\Program
Files\Debugging Tools for Windows
(x86)\Symbols\ntkrnlpa.pdb\30B5FB31AE7E4ACAABA750AA241FF3311\ntkrnlpa.pdb
Loaded symbol image file: ntkrnlpa.exe
Mapped memory image file: C:\WINDOWS\system32\ntkrnlpa.exe
Image path: ntkrnlpa.exe
Image name: ntkrnlpa.exe
Timestamp: Sun Apr 13 11:31:06 2008 (4802516A)
CheckSum: 00204E7E
ImageSize: 001F8580
File version: 5.1.2600.5512
Product version: 5.1.2600.5512
File flags: 0 (Mask 3F)
File OS: 40004 NT Win32
File type: 1.0 App
File date: 00000000.00000000
Translations: 0409.04b0
CompanyName: Microsoft Corporation
ProductName: Microsoft® Windows® Operating System
InternalName: ntkrnlpa.exe
OriginalFilename: ntkrnlpa.exe
ProductVersion: 5.1.2600.5512
FileVersion: 5.1.2600.5512 (xpsp.080413-2111)
FileDescription: NT Kernel & System
LegalCopyright: © Microsoft Corporation. All rights reserved.

Please note that I picked an older dump file, The parameters are almost the
same in each dump file. The executables in each dump are different, however.
The most current one:


Microsoft (R) Windows Debugger Version 6.9.0003.113 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\WINDOWS\Minidump\Mini081608-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*C:\Program Files\Debugging Tools for Windows
(x86)\Symbols*http://msdl.microsoft,com/download/symbols
Executable search path is: C:\WINDOWS\system32; C:\WINDOWS\system\system32
Windows XP Kernel Version 2600 (Service Pack 3) UP Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 2600.xpsp.080413-2111
Kernel base = 0x804d7000 PsLoadedModuleList = 0x80553fc0
Debug session time: Sat Aug 16 23:39:31.765 2008 (GMT-7)
System Uptime: 0 days 2:23:35.349
Loading Kernel Symbols
......................................................................................................................................................................................
Loading User Symbols
Loading unloaded module list
.................................
*******************************************************************************
*
*
* Bugcheck Analysis
*
*
*
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1000000A, {a080014, 2, 1, 80514135}

Probably caused by : memory_corruption ( nt!MiRestoreTransitionPte+6b )

Followup: MachineOwner
---------

kd> !analyze -v
*******************************************************************************
*
*
* Bugcheck Analysis
*
*
*
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 0a080014, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000001, bitfield :
bit 0 : value 0 = read operation, 1 = write operation
bit 3 : value 0 = not an execute operation, 1 = execute operation (only on
chips which support this level of status)
Arg4: 80514135, address which referenced memory

Debugging Details:
------------------


WRITE_ADDRESS: 0a080014

CURRENT_IRQL: 2

FAULTING_IP:
nt!MiRestoreTransitionPte+6b
80514135 ff4910 dec dword ptr [ecx+10h]

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: 0xA

PROCESS_NAME: WinRAR.exe

LAST_CONTROL_TRANSFER: from 8051ec6d to 80514135

STACK_TEXT:
a9405810 8051ec6d 00000000 ffffffff 9da00000 nt!MiRestoreTransitionPte+0x6b
a9405828 8051f21e e7dc0c30 80518793 00000000 nt!MiRemovePageFromList+0xd1
a9405830 80518793 00000000 c2146000 00001000 nt!MiRemoveAnyPage+0x56
a9405924 804e2d61 c2146000 01d29450 00000000 nt!MmCopyToCachedPage+0x1f3
a94059b4 804e0d21 87c25c60 01d29450 a94059e8 nt!CcMapAndCopy+0x1a9
a9405a34 ba646846 87d2bdb8 2ec80ebc 00007ff0 nt!CcFastCopyWrite+0x211
a9405a9c ba6d5018 87d2bdb8 a9405b0c 00007ff0 Ntfs!NtfsCopyWriteA+0x23d
a9405ad0 ba6e0b99 00000004 00000000 a9405b04
fltmgr!FltpPerformFastIoCall+0x230
a9405b24 ba6c7a27 87d2bdb8 8783b9e0 00007ff0 fltmgr!FltpFastIoWrite+0xa9
a9405b58 ba6d5018 87d2bdb8 8783b9e0 00007ff0 sr!SrFastIoWrite+0x77
a9405b8c ba6d51e4 00000004 00000000 8783b9d8
fltmgr!FltpPerformFastIoCall+0x230
a9405bb8 ba6e0c38 00405bd8 01d2430c 8a5eccc0 fltmgr!FltpPassThroughFastIo+0x78
a9405bf8 ba6d5018 87d2bdb8 a9405c68 00007ff0 fltmgr!FltpFastIoWrite+0x148
a9405c2c ba6e0b99 00000004 00000000 a9405c60
fltmgr!FltpPerformFastIoCall+0x230
a9405c80 8057256c 87d2bdb8 a9405cc4 00007ff0 fltmgr!FltpFastIoWrite+0xa9
a9405d38 8053d638 000001f4 00000000 00000000 nt!NtWriteFile+0x324
a9405d38 7c90e4f4 000001f4 00000000 00000000 nt!KiFastCallEntry+0xf8
WARNING: Frame IP not in any known module. Following frames may be wrong.
000eff78 00000000 00000000 00000000 00000000 0x7c90e4f4


STACK_COMMAND: kb

FOLLOWUP_IP:
nt!MiRestoreTransitionPte+6b
80514135 ff4910 dec dword ptr [ecx+10h]

SYMBOL_STACK_INDEX: 0

SYMBOL_NAME: nt!MiRestoreTransitionPte+6b

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nt

DEBUG_FLR_IMAGE_TIMESTAMP: 4802516a

IMAGE_NAME: memory_corruption

FAILURE_BUCKET_ID: 0xA_W_nt!MiRestoreTransitionPte+6b

BUCKET_ID: 0xA_W_nt!MiRestoreTransitionPte+6b

Followup: MachineOwner
---------

kd> lmvm nt
start end module name
804d7000 806cf580 nt (pdb symbols) C:\Program
Files\Debugging Tools for Windows
(x86)\Symbols\ntkrnlpa.pdb\30B5FB31AE7E4ACAABA750AA241FF3311\ntkrnlpa.pdb
Loaded symbol image file: ntkrnlpa.exe
Mapped memory image file: C:\WINDOWS\system32\ntkrnlpa.exe
Image path: ntkrnlpa.exe
Image name: ntkrnlpa.exe
Timestamp: Sun Apr 13 11:31:06 2008 (4802516A)
CheckSum: 00204E7E
ImageSize: 001F8580
File version: 5.1.2600.5512
Product version: 5.1.2600.5512
File flags: 0 (Mask 3F)
File OS: 40004 NT Win32
File type: 1.0 App
File date: 00000000.00000000
Translations: 0409.04b0
CompanyName: Microsoft Corporation
ProductName: Microsoft® Windows® Operating System
InternalName: ntkrnlpa.exe
OriginalFilename: ntkrnlpa.exe
ProductVersion: 5.1.2600.5512
FileVersion: 5.1.2600.5512 (xpsp.080413-2111)
FileDescription: NT Kernel & System
LegalCopyright: © Microsoft Corporation. All rights reserved.
 
W

Wolf

Wolf said:
For about 2 months I've had random reboots. It's started shortly after I
upgraded to SP3 as well as to Norton Anti-virus 2008. I never get to see the
blue screen before it reboots, And had to download the debugger just to read
the dump files. I've upgraded the drivers, checked that everything was
seated. It doesn't matter what program it happens on, a game, just working
with files, etc. The one constant here, and I'm having trouble finding the
function in support is: FAILURE_BUCKET_ID:
0xA_W_nt!MiRestoreTransitionPte+6b. What does this call refer to? Physical
memory, hard drive, that sort of thing...

Microsoft (R) Windows Debugger Version 6.9.0003.113 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\WINDOWS\Minidump\Mini061808-02.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*C:\Program Files\Debugging Tools for Windows
(x86)\Symbols*http://msdl.microsoft,com/download/symbols
Executable search path is: C:\WINDOWS\system32; C:\WINDOWS\system\system32
Windows XP Kernel Version 2600 (Service Pack 3) UP Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 2600.xpsp.080413-2111
Kernel base = 0x804d7000 PsLoadedModuleList = 0x80553fc0
Debug session time: Wed Jun 18 20:26:07.750 2008 (GMT-7)
System Uptime: 0 days 0:37:18.315
Loading Kernel Symbols
.....................................................................................................................................................................................
Loading User Symbols
Loading unloaded module list
..................................
*******************************************************************************
*
*
* Bugcheck Analysis
*
*
*
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1000000A, {4f000010, 2, 1, 80514135}

Probably caused by : memory_corruption ( nt!MiRestoreTransitionPte+6b )

Followup: MachineOwner
---------

kd> !analyze -v
*******************************************************************************
*
*
* Bugcheck Analysis
*
*
*
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 4f000010, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000001, bitfield :
bit 0 : value 0 = read operation, 1 = write operation
bit 3 : value 0 = not an execute operation, 1 = execute operation (only on
chips which support this level of status)
Arg4: 80514135, address which referenced memory

Debugging Details:
------------------


WRITE_ADDRESS: 4f000010

CURRENT_IRQL: 2

FAULTING_IP:
nt!MiRestoreTransitionPte+6b
80514135 ff4910 dec dword ptr [ecx+10h]

CUSTOMER_CRASH_COUNT: 2

DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: 0xA

PROCESS_NAME: System

LAST_CONTROL_TRANSFER: from 8051ec6d to 80514135

STACK_TEXT:
bace3aac 8051ec6d e7aea080 ffffffff 8a612408 nt!MiRestoreTransitionPte+0x6b
bace3ac4 8051f21e 87c265c0 805126d5 8a612438 nt!MiRemovePageFromList+0xd1
bace3acc 805126d5 8a612438 000004c0 00000400 nt!MiRemoveAnyPage+0x56
bace3af8 80513210 00010000 87c26634 87c26650 nt!MiResolveMappedFileFault+0x3dd
bace3b3c 805133ca 00000000 ced10000 c0676880 nt!MiResolveProtoPteFault+0x18c
bace3bc0 8051cb1c e7aea080 ced10000 c0676880 nt!MiDispatchFault+0xe8
bace3c24 80517c78 00000000 ced10000 00000000 nt!MmAccessFault+0x7b4
bace3c80 804e0fe7 ced10000 00000000 80550118 nt!MmCheckCachedPageState+0x56c
bace3d2c 804e620f 8a7b9298 8055b0c0 8a7bb830 nt!CcPerformReadAhead+0x1f1
bace3d74 80534c02 8a7b9298 00000000 8a7bb830 nt!CcWorkerThread+0x147
bace3dac 805c6160 8a7b9298 00000000 00000000 nt!ExpWorkerThread+0x100
bace3ddc 80541dd2 80534b02 00000000 00000000 nt!PspSystemThreadStartup+0x34
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16


STACK_COMMAND: kb

FOLLOWUP_IP:
nt!MiRestoreTransitionPte+6b
80514135 ff4910 dec dword ptr [ecx+10h]

SYMBOL_STACK_INDEX: 0

SYMBOL_NAME: nt!MiRestoreTransitionPte+6b

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nt

DEBUG_FLR_IMAGE_TIMESTAMP: 4802516a

IMAGE_NAME: memory_corruption

FAILURE_BUCKET_ID: 0xA_W_nt!MiRestoreTransitionPte+6b

BUCKET_ID: 0xA_W_nt!MiRestoreTransitionPte+6b

Followup: MachineOwner
---------

kd> lmvm nt
start end module name
804d7000 806cf580 nt (pdb symbols) C:\Program
Files\Debugging Tools for Windows
(x86)\Symbols\ntkrnlpa.pdb\30B5FB31AE7E4ACAABA750AA241FF3311\ntkrnlpa.pdb
Loaded symbol image file: ntkrnlpa.exe
Mapped memory image file: C:\WINDOWS\system32\ntkrnlpa.exe
Image path: ntkrnlpa.exe
Image name: ntkrnlpa.exe
Timestamp: Sun Apr 13 11:31:06 2008 (4802516A)
CheckSum: 00204E7E
ImageSize: 001F8580
File version: 5.1.2600.5512
Product version: 5.1.2600.5512
File flags: 0 (Mask 3F)
File OS: 40004 NT Win32
File type: 1.0 App
File date: 00000000.00000000
Translations: 0409.04b0
CompanyName: Microsoft Corporation
ProductName: Microsoft® Windows® Operating System
InternalName: ntkrnlpa.exe
OriginalFilename: ntkrnlpa.exe
ProductVersion: 5.1.2600.5512
FileVersion: 5.1.2600.5512 (xpsp.080413-2111)
FileDescription: NT Kernel & System
LegalCopyright: © Microsoft Corporation. All rights reserved.

Please note that I picked an older dump file, The parameters are almost the
same in each dump file. The executables in each dump are different, however.
The most current one:


Microsoft (R) Windows Debugger Version 6.9.0003.113 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\WINDOWS\Minidump\Mini081608-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*C:\Program Files\Debugging Tools for Windows
(x86)\Symbols*http://msdl.microsoft,com/download/symbols
Executable search path is: C:\WINDOWS\system32; C:\WINDOWS\system\system32
Windows XP Kernel Version 2600 (Service Pack 3) UP Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 2600.xpsp.080413-2111
Kernel base = 0x804d7000 PsLoadedModuleList = 0x80553fc0
Debug session time: Sat Aug 16 23:39:31.765 2008 (GMT-7)
System Uptime: 0 days 2:23:35.349
Loading Kernel Symbols
.....................................................................................................................................................................................
Loading User Symbols
Loading unloaded module list
................................
*******************************************************************************
*
*
* Bugcheck Analysis
*
*
*
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1000000A, {a080014, 2, 1, 80514135}

Probably caused by : memory_corruption ( nt!MiRestoreTransitionPte+6b )

Followup: MachineOwner
---------

kd> !analyze -v
*******************************************************************************
*
*
* Bugcheck Analysis
*
*
*
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 0a080014, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000001, bitfield :
bit 0 : value 0 = read operation, 1 = write operation
bit 3 : value 0 = not an execute operation, 1 = execute operation (only on
chips which support this level of status)
Arg4: 80514135, address which referenced memory

Debugging Details:
------------------


WRITE_ADDRESS: 0a080014

CURRENT_IRQL: 2

FAULTING_IP:
nt!MiRestoreTransitionPte+6b
80514135 ff4910 dec dword ptr [ecx+10h]

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: 0xA

PROCESS_NAME: WinRAR.exe

LAST_CONTROL_TRANSFER: from 8051ec6d to 80514135

STACK_TEXT:
a9405810 8051ec6d 00000000 ffffffff 9da00000 nt!MiRestoreTransitionPte+0x6b
a9405828 8051f21e e7dc0c30 80518793 00000000 nt!MiRemovePageFromList+0xd1
a9405830 80518793 00000000 c2146000 00001000 nt!MiRemoveAnyPage+0x56
a9405924 804e2d61 c2146000 01d29450 00000000 nt!MmCopyToCachedPage+0x1f3
a94059b4 804e0d21 87c25c60 01d29450 a94059e8 nt!CcMapAndCopy+0x1a9
a9405a34 ba646846 87d2bdb8 2ec80ebc 00007ff0 nt!CcFastCopyWrite+0x211
a9405a9c ba6d5018 87d2bdb8 a9405b0c 00007ff0 Ntfs!NtfsCopyWriteA+0x23d
a9405ad0 ba6e0b99 00000004 00000000 a9405b04
fltmgr!FltpPerformFastIoCall+0x230
a9405b24 ba6c7a27 87d2bdb8 8783b9e0 00007ff0 fltmgr!FltpFastIoWrite+0xa9
a9405b58 ba6d5018 87d2bdb8 8783b9e0 00007ff0 sr!SrFastIoWrite+0x77
a9405b8c ba6d51e4 00000004 00000000 8783b9d8
fltmgr!FltpPerformFastIoCall+0x230
a9405bb8 ba6e0c38 00405bd8 01d2430c 8a5eccc0 fltmgr!FltpPassThroughFastIo+0x78
a9405bf8 ba6d5018 87d2bdb8 a9405c68 00007ff0 fltmgr!FltpFastIoWrite+0x148
a9405c2c ba6e0b99 00000004 00000000 a9405c60
fltmgr!FltpPerformFastIoCall+0x230
a9405c80 8057256c 87d2bdb8 a9405cc4 00007ff0 fltmgr!FltpFastIoWrite+0xa9
a9405d38 8053d638 000001f4 00000000 00000000 nt!NtWriteFile+0x324
a9405d38 7c90e4f4 000001f4 00000000 00000000 nt!KiFastCallEntry+0xf8
WARNING: Frame IP not in any known module. Following frames may be wrong.
000eff78 00000000 00000000 00000000 00000000 0x7c90e4f4


STACK_COMMAND: kb

FOLLOWUP_IP:
nt!MiRestoreTransitionPte+6b
80514135 ff4910 dec dword ptr [ecx+10h]

SYMBOL_STACK_INDEX: 0

SYMBOL_NAME: nt!MiRestoreTransitionPte+6b

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nt

DEBUG_FLR_IMAGE_TIMESTAMP: 4802516a

IMAGE_NAME: memory_corruption

FAILURE_BUCKET_ID: 0xA_W_nt!MiRestoreTransitionPte+6b

BUCKET_ID: 0xA_W_nt!MiRestoreTransitionPte+6b

Followup: MachineOwner
---------

kd> lmvm nt
start end module name
804d7000 806cf580 nt (pdb symbols) C:\Program
Files\Debugging Tools for Windows
(x86)\Symbols\ntkrnlpa.pdb\30B5FB31AE7E4ACAABA750AA241FF3311\ntkrnlpa.pdb
Loaded symbol image file: ntkrnlpa.exe

Almost forgot, from Event Viewer:
Error code 1000000a, parameter1 0a080014, parameter2 00000002, parameter3
00000001, parameter4 80514135. from the latest one.

From the 15th of August:
Error code 1000000a, parameter1 00000010, parameter2 00000002, parameter3
00000001, parameter4 80514135.

From the 14th...:
Error code 1000000a, parameter1 0fdd6010, parameter2 00000002, parameter3
00000001, parameter4 80514135.

Anyways. that's the way it's been going. Thanks in advance.
 
G

Gerry

Wolf

Disable automatic restart on system failure. This should help by
allowing time to write down the STOP code properly. Right click on
the My Computer icon on the Desktop and select Properties, Advanced,
Start-Up and Recovery, System Failure and uncheck box before
Automatically Restart.

Do not re-enable automatic restart on system failure. Check for variants
of the Stop Error message.

An alternative is to keep pressing the F8 key during Start-Up and select
option - Disable automatic restart on system failure.

I would uninstall WinRAR and observe for affect. What version do you
have installed?

When you post Event Viewer please post complete reports not parts of the
Report.

A tip for posting copies of Error Reports! Run Event Viewer and double
click on the error you want to copy. In the window, which appears is a
button resembling two pages. Click the button and close Event
Viewer.Now start your message (email) and do a paste into the body of
the message. Make sure this is the first paste after exiting from
Event Viewer.

--



Hope this helps.

Gerry
~~~~
FCA
Stourport, England
Enquire, plan and execute
~~~~~~~~~~~~~~~~~~~
Wolf said:
For about 2 months I've had random reboots. It's started shortly
after I upgraded to SP3 as well as to Norton Anti-virus 2008. I
never get to see the blue screen before it reboots, And had to
download the debugger just to read the dump files. I've upgraded the
drivers, checked that everything was seated. It doesn't matter what
program it happens on, a game, just working with files, etc. The one
constant here, and I'm having trouble finding the function in
support is: FAILURE_BUCKET_ID: 0xA_W_nt!MiRestoreTransitionPte+6b.
What does this call refer to? Physical memory, hard drive, that sort
of thing...

Microsoft (R) Windows Debugger Version 6.9.0003.113 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\WINDOWS\Minidump\Mini061808-02.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*C:\Program Files\Debugging Tools for
Windows (x86)\Symbols*http://msdl.microsoft,com/download/symbols
Executable search path is: C:\WINDOWS\system32;
C:\WINDOWS\system\system32 Windows XP Kernel Version 2600 (Service
Pack 3) UP Free x86 compatible Product: WinNt, suite: TerminalServer
SingleUserTS
Built by: 2600.xpsp.080413-2111
Kernel base = 0x804d7000 PsLoadedModuleList = 0x80553fc0
Debug session time: Wed Jun 18 20:26:07.750 2008 (GMT-7)
System Uptime: 0 days 0:37:18.315
Loading Kernel Symbols
.....................................................................................................................................................................................
Loading User Symbols
Loading unloaded module list
..................................
*******************************************************************************
*
*
* Bugcheck Analysis
*
*
*
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1000000A, {4f000010, 2, 1, 80514135}

Probably caused by : memory_corruption (
nt!MiRestoreTransitionPte+6b )

Followup: MachineOwner
---------

kd> !analyze -v
*******************************************************************************
*
*
* Bugcheck Analysis
*
*
*
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid)
address at an interrupt request level (IRQL) that is too high. This
is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 4f000010, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000001, bitfield :
bit 0 : value 0 = read operation, 1 = write operation
bit 3 : value 0 = not an execute operation, 1 = execute operation
(only on chips which support this level of status)
Arg4: 80514135, address which referenced memory

Debugging Details:
------------------


WRITE_ADDRESS: 4f000010

CURRENT_IRQL: 2

FAULTING_IP:
nt!MiRestoreTransitionPte+6b
80514135 ff4910 dec dword ptr [ecx+10h]

CUSTOMER_CRASH_COUNT: 2

DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: 0xA

PROCESS_NAME: System

LAST_CONTROL_TRANSFER: from 8051ec6d to 80514135

STACK_TEXT:
bace3aac 8051ec6d e7aea080 ffffffff 8a612408
nt!MiRestoreTransitionPte+0x6b bace3ac4 8051f21e 87c265c0 805126d5
8a612438 nt!MiRemovePageFromList+0xd1 bace3acc 805126d5 8a612438
000004c0 00000400 nt!MiRemoveAnyPage+0x56
bace3af8 80513210 00010000 87c26634 87c26650
nt!MiResolveMappedFileFault+0x3dd bace3b3c 805133ca 00000000
ced10000 c0676880 nt!MiResolveProtoPteFault+0x18c bace3bc0 8051cb1c
e7aea080 ced10000 c0676880 nt!MiDispatchFault+0xe8
bace3c24 80517c78 00000000 ced10000 00000000 nt!MmAccessFault+0x7b4
bace3c80 804e0fe7 ced10000 00000000 80550118
nt!MmCheckCachedPageState+0x56c bace3d2c 804e620f 8a7b9298 8055b0c0
8a7bb830 nt!CcPerformReadAhead+0x1f1 bace3d74 80534c02 8a7b9298
00000000 8a7bb830 nt!CcWorkerThread+0x147
bace3dac 805c6160 8a7b9298 00000000 00000000 nt!ExpWorkerThread+0x100
bace3ddc 80541dd2 80534b02 00000000 00000000
nt!PspSystemThreadStartup+0x34 00000000 00000000 00000000 00000000
00000000 nt!KiThreadStartup+0x16


STACK_COMMAND: kb

FOLLOWUP_IP:
nt!MiRestoreTransitionPte+6b
80514135 ff4910 dec dword ptr [ecx+10h]

SYMBOL_STACK_INDEX: 0

SYMBOL_NAME: nt!MiRestoreTransitionPte+6b

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nt

DEBUG_FLR_IMAGE_TIMESTAMP: 4802516a

IMAGE_NAME: memory_corruption

FAILURE_BUCKET_ID: 0xA_W_nt!MiRestoreTransitionPte+6b

BUCKET_ID: 0xA_W_nt!MiRestoreTransitionPte+6b

Followup: MachineOwner
---------

kd> lmvm nt
start end module name
804d7000 806cf580 nt (pdb symbols) C:\Program
Files\Debugging Tools for Windows
(x86)\Symbols\ntkrnlpa.pdb\30B5FB31AE7E4ACAABA750AA241FF3311\ntkrnlpa.pdb
Loaded symbol image file: ntkrnlpa.exe
Mapped memory image file: C:\WINDOWS\system32\ntkrnlpa.exe
Image path: ntkrnlpa.exe
Image name: ntkrnlpa.exe
Timestamp: Sun Apr 13 11:31:06 2008 (4802516A)
CheckSum: 00204E7E
ImageSize: 001F8580
File version: 5.1.2600.5512
Product version: 5.1.2600.5512
File flags: 0 (Mask 3F)
File OS: 40004 NT Win32
File type: 1.0 App
File date: 00000000.00000000
Translations: 0409.04b0
CompanyName: Microsoft Corporation
ProductName: Microsoft® Windows® Operating System
InternalName: ntkrnlpa.exe
OriginalFilename: ntkrnlpa.exe
ProductVersion: 5.1.2600.5512
FileVersion: 5.1.2600.5512 (xpsp.080413-2111)
FileDescription: NT Kernel & System
LegalCopyright: © Microsoft Corporation. All rights reserved.

Please note that I picked an older dump file, The parameters are
almost the same in each dump file. The executables in each dump are
different, however. The most current one:


Microsoft (R) Windows Debugger Version 6.9.0003.113 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\WINDOWS\Minidump\Mini081608-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*C:\Program Files\Debugging Tools for
Windows (x86)\Symbols*http://msdl.microsoft,com/download/symbols
Executable search path is: C:\WINDOWS\system32;
C:\WINDOWS\system\system32 Windows XP Kernel Version 2600 (Service
Pack 3) UP Free x86 compatible Product: WinNt, suite: TerminalServer
SingleUserTS
Built by: 2600.xpsp.080413-2111
Kernel base = 0x804d7000 PsLoadedModuleList = 0x80553fc0
Debug session time: Sat Aug 16 23:39:31.765 2008 (GMT-7)
System Uptime: 0 days 2:23:35.349
Loading Kernel Symbols
.....................................................................................................................................................................................
Loading User Symbols
Loading unloaded module list
................................
*******************************************************************************
*
*
* Bugcheck Analysis
*
*
*
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1000000A, {a080014, 2, 1, 80514135}

Probably caused by : memory_corruption (
nt!MiRestoreTransitionPte+6b )

Followup: MachineOwner
---------

kd> !analyze -v
*******************************************************************************
*
*
* Bugcheck Analysis
*
*
*
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid)
address at an interrupt request level (IRQL) that is too high. This
is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 0a080014, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000001, bitfield :
bit 0 : value 0 = read operation, 1 = write operation
bit 3 : value 0 = not an execute operation, 1 = execute operation
(only on chips which support this level of status)
Arg4: 80514135, address which referenced memory

Debugging Details:
------------------


WRITE_ADDRESS: 0a080014

CURRENT_IRQL: 2

FAULTING_IP:
nt!MiRestoreTransitionPte+6b
80514135 ff4910 dec dword ptr [ecx+10h]

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: 0xA

PROCESS_NAME: WinRAR.exe

LAST_CONTROL_TRANSFER: from 8051ec6d to 80514135

STACK_TEXT:
a9405810 8051ec6d 00000000 ffffffff 9da00000
nt!MiRestoreTransitionPte+0x6b a9405828 8051f21e e7dc0c30 80518793
00000000 nt!MiRemovePageFromList+0xd1 a9405830 80518793 00000000
c2146000 00001000 nt!MiRemoveAnyPage+0x56
a9405924 804e2d61 c2146000 01d29450 00000000
nt!MmCopyToCachedPage+0x1f3 a94059b4 804e0d21 87c25c60 01d29450
a94059e8 nt!CcMapAndCopy+0x1a9
a9405a34 ba646846 87d2bdb8 2ec80ebc 00007ff0 nt!CcFastCopyWrite+0x211
a9405a9c ba6d5018 87d2bdb8 a9405b0c 00007ff0
Ntfs!NtfsCopyWriteA+0x23d a9405ad0 ba6e0b99 00000004 00000000
a9405b04 fltmgr!FltpPerformFastIoCall+0x230
a9405b24 ba6c7a27 87d2bdb8 8783b9e0 00007ff0
fltmgr!FltpFastIoWrite+0xa9 a9405b58 ba6d5018 87d2bdb8 8783b9e0
00007ff0 sr!SrFastIoWrite+0x77
a9405b8c ba6d51e4 00000004 00000000 8783b9d8
fltmgr!FltpPerformFastIoCall+0x230
a9405bb8 ba6e0c38 00405bd8 01d2430c 8a5eccc0
fltmgr!FltpPassThroughFastIo+0x78 a9405bf8 ba6d5018 87d2bdb8
a9405c68 00007ff0 fltmgr!FltpFastIoWrite+0x148 a9405c2c ba6e0b99
00000004 00000000 a9405c60 fltmgr!FltpPerformFastIoCall+0x230
a9405c80 8057256c 87d2bdb8 a9405cc4 00007ff0
fltmgr!FltpFastIoWrite+0xa9 a9405d38 8053d638 000001f4 00000000
00000000 nt!NtWriteFile+0x324
a9405d38 7c90e4f4 000001f4 00000000 00000000 nt!KiFastCallEntry+0xf8
WARNING: Frame IP not in any known module. Following frames may be
wrong. 000eff78 00000000 00000000 00000000 00000000 0x7c90e4f4


STACK_COMMAND: kb

FOLLOWUP_IP:
nt!MiRestoreTransitionPte+6b
80514135 ff4910 dec dword ptr [ecx+10h]

SYMBOL_STACK_INDEX: 0

SYMBOL_NAME: nt!MiRestoreTransitionPte+6b

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nt

DEBUG_FLR_IMAGE_TIMESTAMP: 4802516a

IMAGE_NAME: memory_corruption

FAILURE_BUCKET_ID: 0xA_W_nt!MiRestoreTransitionPte+6b

BUCKET_ID: 0xA_W_nt!MiRestoreTransitionPte+6b

Followup: MachineOwner
---------

kd> lmvm nt
start end module name
804d7000 806cf580 nt (pdb symbols) C:\Program
Files\Debugging Tools for Windows
(x86)\Symbols\ntkrnlpa.pdb\30B5FB31AE7E4ACAABA750AA241FF3311\ntkrnlpa.pdb
Loaded symbol image file: ntkrnlpa.exe

Almost forgot, from Event Viewer:
Error code 1000000a, parameter1 0a080014, parameter2 00000002,
parameter3 00000001, parameter4 80514135. from the latest one.

From the 15th of August:
Error code 1000000a, parameter1 00000010, parameter2 00000002,
parameter3 00000001, parameter4 80514135.

From the 14th...:
Error code 1000000a, parameter1 0fdd6010, parameter2 00000002,
parameter3 00000001, parameter4 80514135.

Anyways. that's the way it's been going. Thanks in advance.
 
D

db.·.. >

you might try to
further analyze
your issue by
uninstalling norton.

--

db·´¯`·...¸><)))º>


Wolf said:
Wolf said:
For about 2 months I've had random reboots. It's started shortly after I
upgraded to SP3 as well as to Norton Anti-virus 2008. I never get to see the
blue screen before it reboots, And had to download the debugger just to read
the dump files. I've upgraded the drivers, checked that everything was
seated. It doesn't matter what program it happens on, a game, just working
with files, etc. The one constant here, and I'm having trouble finding the
function in support is: FAILURE_BUCKET_ID:
0xA_W_nt!MiRestoreTransitionPte+6b. What does this call refer to? Physical
memory, hard drive, that sort of thing...

Microsoft (R) Windows Debugger Version 6.9.0003.113 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\WINDOWS\Minidump\Mini061808-02.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*C:\Program Files\Debugging Tools for Windows
(x86)\Symbols*http://msdl.microsoft,com/download/symbols
Executable search path is: C:\WINDOWS\system32; C:\WINDOWS\system\system32
Windows XP Kernel Version 2600 (Service Pack 3) UP Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 2600.xpsp.080413-2111
Kernel base = 0x804d7000 PsLoadedModuleList = 0x80553fc0
Debug session time: Wed Jun 18 20:26:07.750 2008 (GMT-7)
System Uptime: 0 days 0:37:18.315
Loading Kernel Symbols
.....................................................................................................................................................................................
Loading User Symbols
Loading unloaded module list
..................................
*******************************************************************************
*
*
* Bugcheck Analysis
*
*
*
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1000000A, {4f000010, 2, 1, 80514135}

Probably caused by : memory_corruption ( nt!MiRestoreTransitionPte+6b )

Followup: MachineOwner
---------

kd> !analyze -v
*******************************************************************************
*
*
* Bugcheck Analysis
*
*
*
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 4f000010, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000001, bitfield :
bit 0 : value 0 = read operation, 1 = write operation
bit 3 : value 0 = not an execute operation, 1 = execute operation (only on
chips which support this level of status)
Arg4: 80514135, address which referenced memory

Debugging Details:
------------------


WRITE_ADDRESS: 4f000010

CURRENT_IRQL: 2

FAULTING_IP:
nt!MiRestoreTransitionPte+6b
80514135 ff4910 dec dword ptr [ecx+10h]

CUSTOMER_CRASH_COUNT: 2

DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: 0xA

PROCESS_NAME: System

LAST_CONTROL_TRANSFER: from 8051ec6d to 80514135

STACK_TEXT:
bace3aac 8051ec6d e7aea080 ffffffff 8a612408 nt!MiRestoreTransitionPte+0x6b
bace3ac4 8051f21e 87c265c0 805126d5 8a612438 nt!MiRemovePageFromList+0xd1
bace3acc 805126d5 8a612438 000004c0 00000400 nt!MiRemoveAnyPage+0x56
bace3af8 80513210 00010000 87c26634 87c26650 nt!MiResolveMappedFileFault+0x3dd
bace3b3c 805133ca 00000000 ced10000 c0676880 nt!MiResolveProtoPteFault+0x18c
bace3bc0 8051cb1c e7aea080 ced10000 c0676880 nt!MiDispatchFault+0xe8
bace3c24 80517c78 00000000 ced10000 00000000 nt!MmAccessFault+0x7b4
bace3c80 804e0fe7 ced10000 00000000 80550118 nt!MmCheckCachedPageState+0x56c
bace3d2c 804e620f 8a7b9298 8055b0c0 8a7bb830 nt!CcPerformReadAhead+0x1f1
bace3d74 80534c02 8a7b9298 00000000 8a7bb830 nt!CcWorkerThread+0x147
bace3dac 805c6160 8a7b9298 00000000 00000000 nt!ExpWorkerThread+0x100
bace3ddc 80541dd2 80534b02 00000000 00000000 nt!PspSystemThreadStartup+0x34
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16


STACK_COMMAND: kb

FOLLOWUP_IP:
nt!MiRestoreTransitionPte+6b
80514135 ff4910 dec dword ptr [ecx+10h]

SYMBOL_STACK_INDEX: 0

SYMBOL_NAME: nt!MiRestoreTransitionPte+6b

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nt

DEBUG_FLR_IMAGE_TIMESTAMP: 4802516a

IMAGE_NAME: memory_corruption

FAILURE_BUCKET_ID: 0xA_W_nt!MiRestoreTransitionPte+6b

BUCKET_ID: 0xA_W_nt!MiRestoreTransitionPte+6b

Followup: MachineOwner
---------

kd> lmvm nt
start end module name
804d7000 806cf580 nt (pdb symbols) C:\Program
Files\Debugging Tools for Windows
(x86)\Symbols\ntkrnlpa.pdb\30B5FB31AE7E4ACAABA750AA241FF3311\ntkrnlpa.pdb
Loaded symbol image file: ntkrnlpa.exe
Mapped memory image file: C:\WINDOWS\system32\ntkrnlpa.exe
Image path: ntkrnlpa.exe
Image name: ntkrnlpa.exe
Timestamp: Sun Apr 13 11:31:06 2008 (4802516A)
CheckSum: 00204E7E
ImageSize: 001F8580
File version: 5.1.2600.5512
Product version: 5.1.2600.5512
File flags: 0 (Mask 3F)
File OS: 40004 NT Win32
File type: 1.0 App
File date: 00000000.00000000
Translations: 0409.04b0
CompanyName: Microsoft Corporation
ProductName: Microsoft® Windows® Operating System
InternalName: ntkrnlpa.exe
OriginalFilename: ntkrnlpa.exe
ProductVersion: 5.1.2600.5512
FileVersion: 5.1.2600.5512 (xpsp.080413-2111)
FileDescription: NT Kernel & System
LegalCopyright: © Microsoft Corporation. All rights reserved.

Please note that I picked an older dump file, The parameters are almost the
same in each dump file. The executables in each dump are different, however.
The most current one:


Microsoft (R) Windows Debugger Version 6.9.0003.113 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\WINDOWS\Minidump\Mini081608-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*C:\Program Files\Debugging Tools for Windows
(x86)\Symbols*http://msdl.microsoft,com/download/symbols
Executable search path is: C:\WINDOWS\system32; C:\WINDOWS\system\system32
Windows XP Kernel Version 2600 (Service Pack 3) UP Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 2600.xpsp.080413-2111
Kernel base = 0x804d7000 PsLoadedModuleList = 0x80553fc0
Debug session time: Sat Aug 16 23:39:31.765 2008 (GMT-7)
System Uptime: 0 days 2:23:35.349
Loading Kernel Symbols
.....................................................................................................................................................................................
Loading User Symbols
Loading unloaded module list
................................
*******************************************************************************
*
*
* Bugcheck Analysis
*
*
*
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1000000A, {a080014, 2, 1, 80514135}

Probably caused by : memory_corruption ( nt!MiRestoreTransitionPte+6b )

Followup: MachineOwner
---------

kd> !analyze -v
*******************************************************************************
*
*
* Bugcheck Analysis
*
*
*
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 0a080014, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000001, bitfield :
bit 0 : value 0 = read operation, 1 = write operation
bit 3 : value 0 = not an execute operation, 1 = execute operation (only on
chips which support this level of status)
Arg4: 80514135, address which referenced memory

Debugging Details:
------------------


WRITE_ADDRESS: 0a080014

CURRENT_IRQL: 2

FAULTING_IP:
nt!MiRestoreTransitionPte+6b
80514135 ff4910 dec dword ptr [ecx+10h]

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: 0xA

PROCESS_NAME: WinRAR.exe

LAST_CONTROL_TRANSFER: from 8051ec6d to 80514135

STACK_TEXT:
a9405810 8051ec6d 00000000 ffffffff 9da00000 nt!MiRestoreTransitionPte+0x6b
a9405828 8051f21e e7dc0c30 80518793 00000000 nt!MiRemovePageFromList+0xd1
a9405830 80518793 00000000 c2146000 00001000 nt!MiRemoveAnyPage+0x56
a9405924 804e2d61 c2146000 01d29450 00000000 nt!MmCopyToCachedPage+0x1f3
a94059b4 804e0d21 87c25c60 01d29450 a94059e8 nt!CcMapAndCopy+0x1a9
a9405a34 ba646846 87d2bdb8 2ec80ebc 00007ff0 nt!CcFastCopyWrite+0x211
a9405a9c ba6d5018 87d2bdb8 a9405b0c 00007ff0 Ntfs!NtfsCopyWriteA+0x23d
a9405ad0 ba6e0b99 00000004 00000000 a9405b04
fltmgr!FltpPerformFastIoCall+0x230
a9405b24 ba6c7a27 87d2bdb8 8783b9e0 00007ff0 fltmgr!FltpFastIoWrite+0xa9
a9405b58 ba6d5018 87d2bdb8 8783b9e0 00007ff0 sr!SrFastIoWrite+0x77
a9405b8c ba6d51e4 00000004 00000000 8783b9d8
fltmgr!FltpPerformFastIoCall+0x230
a9405bb8 ba6e0c38 00405bd8 01d2430c 8a5eccc0 fltmgr!FltpPassThroughFastIo+0x78
a9405bf8 ba6d5018 87d2bdb8 a9405c68 00007ff0 fltmgr!FltpFastIoWrite+0x148
a9405c2c ba6e0b99 00000004 00000000 a9405c60
fltmgr!FltpPerformFastIoCall+0x230
a9405c80 8057256c 87d2bdb8 a9405cc4 00007ff0 fltmgr!FltpFastIoWrite+0xa9
a9405d38 8053d638 000001f4 00000000 00000000 nt!NtWriteFile+0x324
a9405d38 7c90e4f4 000001f4 00000000 00000000 nt!KiFastCallEntry+0xf8
WARNING: Frame IP not in any known module. Following frames may be wrong.
000eff78 00000000 00000000 00000000 00000000 0x7c90e4f4


STACK_COMMAND: kb

FOLLOWUP_IP:
nt!MiRestoreTransitionPte+6b
80514135 ff4910 dec dword ptr [ecx+10h]

SYMBOL_STACK_INDEX: 0

SYMBOL_NAME: nt!MiRestoreTransitionPte+6b

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nt

DEBUG_FLR_IMAGE_TIMESTAMP: 4802516a

IMAGE_NAME: memory_corruption

FAILURE_BUCKET_ID: 0xA_W_nt!MiRestoreTransitionPte+6b

BUCKET_ID: 0xA_W_nt!MiRestoreTransitionPte+6b

Followup: MachineOwner
---------

kd> lmvm nt
start end module name
804d7000 806cf580 nt (pdb symbols) C:\Program
Files\Debugging Tools for Windows
(x86)\Symbols\ntkrnlpa.pdb\30B5FB31AE7E4ACAABA750AA241FF3311\ntkrnlpa.pdb
Loaded symbol image file: ntkrnlpa.exe

Almost forgot, from Event Viewer:
Error code 1000000a, parameter1 0a080014, parameter2 00000002, parameter3
00000001, parameter4 80514135. from the latest one.

From the 15th of August:
Error code 1000000a, parameter1 00000010, parameter2 00000002, parameter3
00000001, parameter4 80514135.

From the 14th...:
Error code 1000000a, parameter1 0fdd6010, parameter2 00000002, parameter3
00000001, parameter4 80514135.

Anyways. that's the way it's been going. Thanks in advance.
 
W

Wolf

Thanks. I'll try both the suggestions. This was a very reliable system before
a few months ago. I have other PC's to work from, but this one has the
horsepower to do dang near anything. Hate to lose it for something like this,
even for a short time. One more thing, as in my first post, this is a
recurring theme: MiRestoreTransitionPte+6b... In english, what's it refer to?

db.·.. > said:
you might try to
further analyze
your issue by
uninstalling norton.

--

db·´¯`·...¸><)))º>


Wolf said:
Wolf said:
For about 2 months I've had random reboots. It's started shortly after I
upgraded to SP3 as well as to Norton Anti-virus 2008. I never get to see the
blue screen before it reboots, And had to download the debugger just to read
the dump files. I've upgraded the drivers, checked that everything was
seated. It doesn't matter what program it happens on, a game, just working
with files, etc. The one constant here, and I'm having trouble finding the
function in support is: FAILURE_BUCKET_ID:
0xA_W_nt!MiRestoreTransitionPte+6b. What does this call refer to? Physical
memory, hard drive, that sort of thing...

Microsoft (R) Windows Debugger Version 6.9.0003.113 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\WINDOWS\Minidump\Mini061808-02.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*C:\Program Files\Debugging Tools for Windows
(x86)\Symbols*http://msdl.microsoft,com/download/symbols
Executable search path is: C:\WINDOWS\system32; C:\WINDOWS\system\system32
Windows XP Kernel Version 2600 (Service Pack 3) UP Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 2600.xpsp.080413-2111
Kernel base = 0x804d7000 PsLoadedModuleList = 0x80553fc0
Debug session time: Wed Jun 18 20:26:07.750 2008 (GMT-7)
System Uptime: 0 days 0:37:18.315
Loading Kernel Symbols
.....................................................................................................................................................................................
Loading User Symbols
Loading unloaded module list
..................................
*******************************************************************************
*
*
* Bugcheck Analysis
*
*
*
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1000000A, {4f000010, 2, 1, 80514135}

Probably caused by : memory_corruption ( nt!MiRestoreTransitionPte+6b )

Followup: MachineOwner
---------

kd> !analyze -v
*******************************************************************************
*
*
* Bugcheck Analysis
*
*
*
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 4f000010, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000001, bitfield :
bit 0 : value 0 = read operation, 1 = write operation
bit 3 : value 0 = not an execute operation, 1 = execute operation (only on
chips which support this level of status)
Arg4: 80514135, address which referenced memory

Debugging Details:
------------------


WRITE_ADDRESS: 4f000010

CURRENT_IRQL: 2

FAULTING_IP:
nt!MiRestoreTransitionPte+6b
80514135 ff4910 dec dword ptr [ecx+10h]

CUSTOMER_CRASH_COUNT: 2

DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: 0xA

PROCESS_NAME: System

LAST_CONTROL_TRANSFER: from 8051ec6d to 80514135

STACK_TEXT:
bace3aac 8051ec6d e7aea080 ffffffff 8a612408 nt!MiRestoreTransitionPte+0x6b
bace3ac4 8051f21e 87c265c0 805126d5 8a612438 nt!MiRemovePageFromList+0xd1
bace3acc 805126d5 8a612438 000004c0 00000400 nt!MiRemoveAnyPage+0x56
bace3af8 80513210 00010000 87c26634 87c26650 nt!MiResolveMappedFileFault+0x3dd
bace3b3c 805133ca 00000000 ced10000 c0676880 nt!MiResolveProtoPteFault+0x18c
bace3bc0 8051cb1c e7aea080 ced10000 c0676880 nt!MiDispatchFault+0xe8
bace3c24 80517c78 00000000 ced10000 00000000 nt!MmAccessFault+0x7b4
bace3c80 804e0fe7 ced10000 00000000 80550118 nt!MmCheckCachedPageState+0x56c
bace3d2c 804e620f 8a7b9298 8055b0c0 8a7bb830 nt!CcPerformReadAhead+0x1f1
bace3d74 80534c02 8a7b9298 00000000 8a7bb830 nt!CcWorkerThread+0x147
bace3dac 805c6160 8a7b9298 00000000 00000000 nt!ExpWorkerThread+0x100
bace3ddc 80541dd2 80534b02 00000000 00000000 nt!PspSystemThreadStartup+0x34
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16


STACK_COMMAND: kb

FOLLOWUP_IP:
nt!MiRestoreTransitionPte+6b
80514135 ff4910 dec dword ptr [ecx+10h]

SYMBOL_STACK_INDEX: 0

SYMBOL_NAME: nt!MiRestoreTransitionPte+6b

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nt

DEBUG_FLR_IMAGE_TIMESTAMP: 4802516a

IMAGE_NAME: memory_corruption

FAILURE_BUCKET_ID: 0xA_W_nt!MiRestoreTransitionPte+6b

BUCKET_ID: 0xA_W_nt!MiRestoreTransitionPte+6b

Followup: MachineOwner
---------

kd> lmvm nt
start end module name
804d7000 806cf580 nt (pdb symbols) C:\Program
Files\Debugging Tools for Windows
(x86)\Symbols\ntkrnlpa.pdb\30B5FB31AE7E4ACAABA750AA241FF3311\ntkrnlpa.pdb
Loaded symbol image file: ntkrnlpa.exe
Mapped memory image file: C:\WINDOWS\system32\ntkrnlpa.exe
Image path: ntkrnlpa.exe
Image name: ntkrnlpa.exe
Timestamp: Sun Apr 13 11:31:06 2008 (4802516A)
CheckSum: 00204E7E
ImageSize: 001F8580
File version: 5.1.2600.5512
Product version: 5.1.2600.5512
File flags: 0 (Mask 3F)
File OS: 40004 NT Win32
File type: 1.0 App
File date: 00000000.00000000
Translations: 0409.04b0
CompanyName: Microsoft Corporation
ProductName: Microsoft® Windows® Operating System
InternalName: ntkrnlpa.exe
OriginalFilename: ntkrnlpa.exe
ProductVersion: 5.1.2600.5512
FileVersion: 5.1.2600.5512 (xpsp.080413-2111)
FileDescription: NT Kernel & System
LegalCopyright: © Microsoft Corporation. All rights reserved.

Please note that I picked an older dump file, The parameters are almost the
same in each dump file. The executables in each dump are different, however.
The most current one:


Microsoft (R) Windows Debugger Version 6.9.0003.113 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\WINDOWS\Minidump\Mini081608-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*C:\Program Files\Debugging Tools for Windows
(x86)\Symbols*http://msdl.microsoft,com/download/symbols
Executable search path is: C:\WINDOWS\system32; C:\WINDOWS\system\system32
Windows XP Kernel Version 2600 (Service Pack 3) UP Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 2600.xpsp.080413-2111
Kernel base = 0x804d7000 PsLoadedModuleList = 0x80553fc0
Debug session time: Sat Aug 16 23:39:31.765 2008 (GMT-7)
System Uptime: 0 days 2:23:35.349
Loading Kernel Symbols
.....................................................................................................................................................................................
Loading User Symbols
Loading unloaded module list
................................
*******************************************************************************
*
*
* Bugcheck Analysis
*
*
*
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1000000A, {a080014, 2, 1, 80514135}

Probably caused by : memory_corruption ( nt!MiRestoreTransitionPte+6b )

Followup: MachineOwner
---------

kd> !analyze -v
*******************************************************************************
*
*
* Bugcheck Analysis
*
*
*
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 0a080014, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000001, bitfield :
bit 0 : value 0 = read operation, 1 = write operation
bit 3 : value 0 = not an execute operation, 1 = execute operation (only on
chips which support this level of status)
Arg4: 80514135, address which referenced memory

Debugging Details:
------------------


WRITE_ADDRESS: 0a080014

CURRENT_IRQL: 2

FAULTING_IP:
nt!MiRestoreTransitionPte+6b
80514135 ff4910 dec dword ptr [ecx+10h]

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: 0xA

PROCESS_NAME: WinRAR.exe

LAST_CONTROL_TRANSFER: from 8051ec6d to 80514135

STACK_TEXT:
a9405810 8051ec6d 00000000 ffffffff 9da00000 nt!MiRestoreTransitionPte+0x6b
a9405828 8051f21e e7dc0c30 80518793 00000000 nt!MiRemovePageFromList+0xd1
a9405830 80518793 00000000 c2146000 00001000 nt!MiRemoveAnyPage+0x56
a9405924 804e2d61 c2146000 01d29450 00000000 nt!MmCopyToCachedPage+0x1f3
a94059b4 804e0d21 87c25c60 01d29450 a94059e8 nt!CcMapAndCopy+0x1a9
a9405a34 ba646846 87d2bdb8 2ec80ebc 00007ff0 nt!CcFastCopyWrite+0x211
a9405a9c ba6d5018 87d2bdb8 a9405b0c 00007ff0 Ntfs!NtfsCopyWriteA+0x23d
a9405ad0 ba6e0b99 00000004 00000000 a9405b04
fltmgr!FltpPerformFastIoCall+0x230
a9405b24 ba6c7a27 87d2bdb8 8783b9e0 00007ff0 fltmgr!FltpFastIoWrite+0xa9
a9405b58 ba6d5018 87d2bdb8 8783b9e0 00007ff0 sr!SrFastIoWrite+0x77
a9405b8c ba6d51e4 00000004 00000000 8783b9d8
fltmgr!FltpPerformFastIoCall+0x230
a9405bb8 ba6e0c38 00405bd8 01d2430c 8a5eccc0 fltmgr!FltpPassThroughFastIo+0x78
a9405bf8 ba6d5018 87d2bdb8 a9405c68 00007ff0 fltmgr!FltpFastIoWrite+0x148
a9405c2c ba6e0b99 00000004 00000000 a9405c60
fltmgr!FltpPerformFastIoCall+0x230
a9405c80 8057256c 87d2bdb8 a9405cc4 00007ff0 fltmgr!FltpFastIoWrite+0xa9
a9405d38 8053d638 000001f4 00000000 00000000 nt!NtWriteFile+0x324
a9405d38 7c90e4f4 000001f4 00000000 00000000 nt!KiFastCallEntry+0xf8
WARNING: Frame IP not in any known module. Following frames may be wrong.
000eff78 00000000 00000000 00000000 00000000 0x7c90e4f4


STACK_COMMAND: kb

FOLLOWUP_IP:
nt!MiRestoreTransitionPte+6b
80514135 ff4910 dec dword ptr [ecx+10h]
 
D

db.·.. >

yw.

in plain english,
mi dunno.

perhaps it is a
norton thing

perhaps it means
Management information Restore Transition

--

db·´¯`·...¸><)))º>


Wolf said:
Thanks. I'll try both the suggestions. This was a very reliable system before
a few months ago. I have other PC's to work from, but this one has the
horsepower to do dang near anything. Hate to lose it for something like this,
even for a short time. One more thing, as in my first post, this is a
recurring theme: MiRestoreTransitionPte+6b... In english, what's it refer to?

db.·.. > said:
you might try to
further analyze
your issue by
uninstalling norton.

--

db·´¯`·...¸><)))º>


Wolf said:
:

For about 2 months I've had random reboots. It's started shortly after I
upgraded to SP3 as well as to Norton Anti-virus 2008. I never get to see the
blue screen before it reboots, And had to download the debugger just to read
the dump files. I've upgraded the drivers, checked that everything was
seated. It doesn't matter what program it happens on, a game, just working
with files, etc. The one constant here, and I'm having trouble finding the
function in support is: FAILURE_BUCKET_ID:
0xA_W_nt!MiRestoreTransitionPte+6b. What does this call refer to? Physical
memory, hard drive, that sort of thing...

Microsoft (R) Windows Debugger Version 6.9.0003.113 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\WINDOWS\Minidump\Mini061808-02.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*C:\Program Files\Debugging Tools for Windows
(x86)\Symbols*http://msdl.microsoft,com/download/symbols
Executable search path is: C:\WINDOWS\system32; C:\WINDOWS\system\system32
Windows XP Kernel Version 2600 (Service Pack 3) UP Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 2600.xpsp.080413-2111
Kernel base = 0x804d7000 PsLoadedModuleList = 0x80553fc0
Debug session time: Wed Jun 18 20:26:07.750 2008 (GMT-7)
System Uptime: 0 days 0:37:18.315
Loading Kernel Symbols
.....................................................................................................................................................................................
Loading User Symbols
Loading unloaded module list
..................................
*******************************************************************************
*
*
* Bugcheck Analysis
*
*
*
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1000000A, {4f000010, 2, 1, 80514135}

Probably caused by : memory_corruption ( nt!MiRestoreTransitionPte+6b )

Followup: MachineOwner
---------

kd> !analyze -v
*******************************************************************************
*
*
* Bugcheck Analysis
*
*
*
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 4f000010, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000001, bitfield :
bit 0 : value 0 = read operation, 1 = write operation
bit 3 : value 0 = not an execute operation, 1 = execute operation (only on
chips which support this level of status)
Arg4: 80514135, address which referenced memory

Debugging Details:
------------------


WRITE_ADDRESS: 4f000010

CURRENT_IRQL: 2

FAULTING_IP:
nt!MiRestoreTransitionPte+6b
80514135 ff4910 dec dword ptr [ecx+10h]

CUSTOMER_CRASH_COUNT: 2

DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: 0xA

PROCESS_NAME: System

LAST_CONTROL_TRANSFER: from 8051ec6d to 80514135

STACK_TEXT:
bace3aac 8051ec6d e7aea080 ffffffff 8a612408 nt!MiRestoreTransitionPte+0x6b
bace3ac4 8051f21e 87c265c0 805126d5 8a612438 nt!MiRemovePageFromList+0xd1
bace3acc 805126d5 8a612438 000004c0 00000400 nt!MiRemoveAnyPage+0x56
bace3af8 80513210 00010000 87c26634 87c26650 nt!MiResolveMappedFileFault+0x3dd
bace3b3c 805133ca 00000000 ced10000 c0676880 nt!MiResolveProtoPteFault+0x18c
bace3bc0 8051cb1c e7aea080 ced10000 c0676880 nt!MiDispatchFault+0xe8
bace3c24 80517c78 00000000 ced10000 00000000 nt!MmAccessFault+0x7b4
bace3c80 804e0fe7 ced10000 00000000 80550118 nt!MmCheckCachedPageState+0x56c
bace3d2c 804e620f 8a7b9298 8055b0c0 8a7bb830 nt!CcPerformReadAhead+0x1f1
bace3d74 80534c02 8a7b9298 00000000 8a7bb830 nt!CcWorkerThread+0x147
bace3dac 805c6160 8a7b9298 00000000 00000000 nt!ExpWorkerThread+0x100
bace3ddc 80541dd2 80534b02 00000000 00000000 nt!PspSystemThreadStartup+0x34
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16


STACK_COMMAND: kb

FOLLOWUP_IP:
nt!MiRestoreTransitionPte+6b
80514135 ff4910 dec dword ptr [ecx+10h]

SYMBOL_STACK_INDEX: 0

SYMBOL_NAME: nt!MiRestoreTransitionPte+6b

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nt

DEBUG_FLR_IMAGE_TIMESTAMP: 4802516a

IMAGE_NAME: memory_corruption

FAILURE_BUCKET_ID: 0xA_W_nt!MiRestoreTransitionPte+6b

BUCKET_ID: 0xA_W_nt!MiRestoreTransitionPte+6b

Followup: MachineOwner
---------

kd> lmvm nt
start end module name
804d7000 806cf580 nt (pdb symbols) C:\Program
Files\Debugging Tools for Windows
(x86)\Symbols\ntkrnlpa.pdb\30B5FB31AE7E4ACAABA750AA241FF3311\ntkrnlpa.pdb
Loaded symbol image file: ntkrnlpa.exe
Mapped memory image file: C:\WINDOWS\system32\ntkrnlpa.exe
Image path: ntkrnlpa.exe
Image name: ntkrnlpa.exe
Timestamp: Sun Apr 13 11:31:06 2008 (4802516A)
CheckSum: 00204E7E
ImageSize: 001F8580
File version: 5.1.2600.5512
Product version: 5.1.2600.5512
File flags: 0 (Mask 3F)
File OS: 40004 NT Win32
File type: 1.0 App
File date: 00000000.00000000
Translations: 0409.04b0
CompanyName: Microsoft Corporation
ProductName: Microsoft® Windows® Operating System
InternalName: ntkrnlpa.exe
OriginalFilename: ntkrnlpa.exe
ProductVersion: 5.1.2600.5512
FileVersion: 5.1.2600.5512 (xpsp.080413-2111)
FileDescription: NT Kernel & System
LegalCopyright: © Microsoft Corporation. All rights reserved.

Please note that I picked an older dump file, The parameters are almost the
same in each dump file. The executables in each dump are different, however.
The most current one:


Microsoft (R) Windows Debugger Version 6.9.0003.113 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\WINDOWS\Minidump\Mini081608-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*C:\Program Files\Debugging Tools for Windows
(x86)\Symbols*http://msdl.microsoft,com/download/symbols
Executable search path is: C:\WINDOWS\system32; C:\WINDOWS\system\system32
Windows XP Kernel Version 2600 (Service Pack 3) UP Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 2600.xpsp.080413-2111
Kernel base = 0x804d7000 PsLoadedModuleList = 0x80553fc0
Debug session time: Sat Aug 16 23:39:31.765 2008 (GMT-7)
System Uptime: 0 days 2:23:35.349
Loading Kernel Symbols
.....................................................................................................................................................................................
Loading User Symbols
Loading unloaded module list
................................
*******************************************************************************
*
*
* Bugcheck Analysis
*
*
*
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1000000A, {a080014, 2, 1, 80514135}

Probably caused by : memory_corruption ( nt!MiRestoreTransitionPte+6b )

Followup: MachineOwner
---------

kd> !analyze -v
*******************************************************************************
*
*
* Bugcheck Analysis
*
*
*
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 0a080014, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000001, bitfield :
bit 0 : value 0 = read operation, 1 = write operation
bit 3 : value 0 = not an execute operation, 1 = execute operation (only on
chips which support this level of status)
Arg4: 80514135, address which referenced memory

Debugging Details:
------------------


WRITE_ADDRESS: 0a080014

CURRENT_IRQL: 2

FAULTING_IP:
nt!MiRestoreTransitionPte+6b
80514135 ff4910 dec dword ptr [ecx+10h]

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: 0xA

PROCESS_NAME: WinRAR.exe

LAST_CONTROL_TRANSFER: from 8051ec6d to 80514135

STACK_TEXT:
a9405810 8051ec6d 00000000 ffffffff 9da00000 nt!MiRestoreTransitionPte+0x6b
a9405828 8051f21e e7dc0c30 80518793 00000000 nt!MiRemovePageFromList+0xd1
a9405830 80518793 00000000 c2146000 00001000 nt!MiRemoveAnyPage+0x56
a9405924 804e2d61 c2146000 01d29450 00000000 nt!MmCopyToCachedPage+0x1f3
a94059b4 804e0d21 87c25c60 01d29450 a94059e8 nt!CcMapAndCopy+0x1a9
a9405a34 ba646846 87d2bdb8 2ec80ebc 00007ff0 nt!CcFastCopyWrite+0x211
a9405a9c ba6d5018 87d2bdb8 a9405b0c 00007ff0 Ntfs!NtfsCopyWriteA+0x23d
a9405ad0 ba6e0b99 00000004 00000000 a9405b04
fltmgr!FltpPerformFastIoCall+0x230
a9405b24 ba6c7a27 87d2bdb8 8783b9e0 00007ff0 fltmgr!FltpFastIoWrite+0xa9
a9405b58 ba6d5018 87d2bdb8 8783b9e0 00007ff0 sr!SrFastIoWrite+0x77
a9405b8c ba6d51e4 00000004 00000000 8783b9d8
fltmgr!FltpPerformFastIoCall+0x230
a9405bb8 ba6e0c38 00405bd8 01d2430c 8a5eccc0 fltmgr!FltpPassThroughFastIo+0x78
a9405bf8 ba6d5018 87d2bdb8 a9405c68 00007ff0 fltmgr!FltpFastIoWrite+0x148
a9405c2c ba6e0b99 00000004 00000000 a9405c60
fltmgr!FltpPerformFastIoCall+0x230
a9405c80 8057256c 87d2bdb8 a9405cc4 00007ff0 fltmgr!FltpFastIoWrite+0xa9
a9405d38 8053d638 000001f4 00000000 00000000 nt!NtWriteFile+0x324
a9405d38 7c90e4f4 000001f4 00000000 00000000 nt!KiFastCallEntry+0xf8
WARNING: Frame IP not in any known module. Following frames may be wrong.
000eff78 00000000 00000000 00000000 00000000 0x7c90e4f4


STACK_COMMAND: kb

FOLLOWUP_IP:
nt!MiRestoreTransitionPte+6b
80514135 ff4910 dec dword ptr [ecx+10h]
 
O

oztrailrider

Wolf;3170331 said:
For about 2 months I've had random reboots. It's started shortly after I

upgraded to SP3 as well as to Norton Anti-virus 2008. I never get to
see the
blue screen before it reboots, And had to download the debugger just to
read
the dump files. I've upgraded the drivers, checked that everything was

seated. It doesn't matter what program it happens on, a game, just
working
with files, etc.

It seems to me you are receiving an IRQL_NOT_LESS_OR_EQUAL error which
can usually be pointed at a bad driver that is installed or possibly
bad memory in the machine.

Here is the reference in your memory dump:

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid)
address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.

Probably the first thing I think you should try though is the
uninstallation of Norton because system services can create the problem
also. If still no joy I would then try making sure you have all the
latest drivers for your hardware since you may have an older driver
installed that is possibly disagreeing with SP3. Best of luck!.
 
W

Wolf

This problem I believe is solved using
http://support.microsoft.com/kb/330174/en-us particularly the part in the
article: 1. Click Start, click Run, type regedit, and then click OK.
2. Locate the following registry key:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Memory
Management
3. In the details pane, right-click the SystemPages value, and then click
Modify.
4. In the Value data box, type the following value, and then click OK:
FFFFFFFF.

After further research, and I don't know why WinXP had the setup like it
did, it seems the system had a set amount of disk space for page files. I
reset the page to system managed memory (using programs), and reset the reg
entry as above to the FFFFFFFF. #4 seemed to work. I haven't had anymore
reboots since. I've used gaming as a test as this is intensive to WinXP. It's
handled it and I don't know why it picked this last two months to have an
issue with how it ran, but it did. Hardware isn't the issue here. The
pagefile was the issue. Thanks for all the help people.
 

Ask a Question

Want to reply to this thread or ask your own question?

You'll need to choose a username for the site, which only take a couple of moments. After that, you can post your question and our members will help you out.

Ask a Question

Top