System calls to ATI device when none present

[Don Phillipson]

Trying to troubleshoot spontaneous reboots via
/ Comp Mgt / System / Event Viewer / System I find
two errors marked for the time the system rebooted:
1. Service Control Manager call to MBAMService service
2. SCM failed to open ATI TV Wonder video capture service.

There is no ATI card in this system. Registry has 6 or 8 keys that
call ATI DLLs (and there are six ATI DLLs in \Windows\System32
and dozens in \Windows\ServicePackFiles\i36); but my monitor is
a ViewSonic LED (not Radeon) and I have no ATI equipment.

Besides neither " MBAMService service" nor "ATI TV Wonder
video capture service" appear in /Comp Mgt / Services / Services.

System is an IBM M52 desktop running WinXP (SP3). I have
two identical M52s but only one incurs spontaneous reboots
(five times since Sept. 2013.) Does all this mean anything to anyone ?

With thanks

 

[Paul]

Trying to troubleshoot spontaneous reboots via
/ Comp Mgt / System / Event Viewer / System I find
two errors marked for the time the system rebooted:
1. Service Control Manager call to MBAMService service
2. SCM failed to open ATI TV Wonder video capture service.

There is no ATI card in this system. Registry has 6 or 8 keys that
call ATI DLLs (and there are six ATI DLLs in \Windows\System32
and dozens in \Windows\ServicePackFiles\i36); but my monitor is
a ViewSonic LED (not Radeon) and I have no ATI equipment.

Besides neither " MBAMService service" nor "ATI TV Wonder
video capture service" appear in /Comp Mgt / Services / Services.

System is an IBM M52 desktop running WinXP (SP3). I have
two identical M52s but only one incurs spontaneous reboots
(five times since Sept. 2013.) Does all this mean anything to anyone ?

With thanks

Are you sure those events aren't showing up after
the reboot begins ? Maybe those services cannot be
started, because the files are missing. And the services
weren't properly removed.

ATI TV wonder at one time, was a video card (GPU) with an
added tin-can tuner and small capture chip.

Later, ATI got tired of doing business that way. They
created the ATI Theatre line, which is a capture chip.
The capture chip sits on a separate tuner card (no GPU
onboard). There may have been some cards made with
tin-can tuners, but later they used third-party silicon
tuners. The first silicon tuners were "hot and nasty", but later
they got a bit better. The silicon tuner doesn't need the
tin can, so the card can be smaller. And later still, the
switch from NTSC, to ATSC digital or DVB-T, means yet
more third party front ends can be added to the Theatre chip.

*******

To know something of the hardware history of the machine,
have a look at setupapi.log. The file rolls over when it
gets big enough, so there can be several similarly named files.
They will go back to the day the OS was installed. So if you
clean reinstalled recently, that would blow away the evidence.

If the system is rebooting spontaneously, I'd be doing a
"capacitor check" and looking for leaking capacitors around
the CPU socket. Or the capacitors inside the power supply
could be bad. I've had a couple power supplies fail here, and
on the first one, one of the symptoms was a system crash (t=30 seconds).
It turned out the low voltage 5V bypass caps on the output side of
the supply were leaking. And they would actually "sizzle" at
startup, because the juice escaped, and the DC plus semi-dry
capacitor plates would make a noise. Once the cap got hot, the sizzling would
stop. But since the power wasn't steady, the machine could
crash in the blink of an eye.

You could try running memtest86+ to see if any memory
locations are bad. As well as trying Prime95 or some other
100% loading "CPU-burner" program, to heat up the CPU and
test for power-related instability.

When a system crashes like that, it can fail a couple
different ways. If it takes a double-bus fault, there may
be no opportunity to generate any log event, so nothing
for the Event Viewer. Making it relatively hard to figure
out what happened. If the event was a bit "tamer", there would
be some evidence for later (log event, then reboot maybe).

Paul