System reboots automatically

[Guest]

Hello,

I have a computer that is running Windows XP Professional SP2. The computer
started to reboot itself a month ago. I have a minidump file of the system. I
used Windbg to open the file and this is what it shows.

*******************************************************************************
*
*
* Bugcheck Analysis
*
*
*
*******************************************************************************

KERNEL_MODE_EXCEPTION_NOT_HANDLED_M (1000008e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003. This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG. This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG. This will let us see why this breakpoint is
happening.
Arguments:
Arg1: c000001d, The exception code that was not handled
Arg2: bfad6c9c, The address that the exception occurred at
Arg3: eb4e4a2c, Trap Frame
Arg4: 00000000

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc000001d - {EXCEPTION} Illegal Instruction An
attempt was made to execute an illegal instruction.

FAULTING_IP:
ati3duag+8cc9c
bfad6c9c c61048 mov byte ptr [eax],0x48

TRAP_FRAME: eb4e4a2c -- (.trap ffffffffeb4e4a2c)
ErrCode = 00000000
eax=003f0000 ebx=00000001 ecx=00000000 edx=00000001 esi=e4e66878 edi=e126dcc4
eip=bfad6c9c esp=eb4e4aa0 ebp=00000000 iopl=0 nv up ei ng nz na po nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010286
ati3duag+0x8cc9c:
bfad6c9c c61048 mov byte ptr [eax],0x48 ds:0023:003f0000=00
Resetting default scope

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: 0x8E

MISALIGNED_IP:
ati3duag+8cc9c
bfad6c9c c61048 mov byte ptr [eax],0x48

LAST_CONTROL_TRANSFER: from 00000000 to bfad6c9c

FAILED_INSTRUCTION_ADDRESS:
ati3duag+8cc9c
bfad6c9c c61048 mov byte ptr [eax],0x48

STACK_TEXT:
00000000 00000000 00000000 00000000 00000000 ati3duag+0x8cc9c


STACK_COMMAND: .bugcheck ; kb

FOLLOWUP_IP:
ati3duag+8cc9c
bfad6c9c c61048 mov byte ptr [eax],0x48

FAULTING_SOURCE_CODE:


SYMBOL_STACK_INDEX: 0

FOLLOWUP_NAME: MachineOwner

SYMBOL_NAME: ati3duag+8cc9c

MODULE_NAME: hardware

IMAGE_NAME: hardware

DEBUG_FLR_IMAGE_TIMESTAMP: 0

FAILURE_BUCKET_ID: IP_MISALIGNED_ati3duag.dll

BUCKET_ID: IP_MISALIGNED_ati3duag.dll

Followup: MachineOwner




Can you guys see what the problem is?

Thanks for your help.

 

[Carey Frisch [MVP]]

Your video adapter drivers probably need to be reinstalled.
Visit the support web site of the manufacturer of your video
card adapter and download the latest drivers.

Before installing them, uninstall the old drivers. In your
Control Panel, open the Add or Remove Programs applet
and look for your video drivers to uninstall.

If you happen to have a notebook computer, visit the notebook
manufacturer's support website to download the correct video
adapter drivers for your specific notebook model.

After installing a fresh set of drivers, right-click on your
desktop and select Properties > Settings, change the Color
Quality to "Highest (32 bit), then adjust your Screen Resolution
to your liking, then click on Apply.

Most Poplar Video Adapter Drivers:

http://www.ati.com/


--
Carey Frisch
Microsoft MVP
Windows - Shell/User
Microsoft Community Newsgroups
news://msnews.microsoft.com/

---------------------------------------------------------------------------­----------------

:

| Hello,
|
| I have a computer that is running Windows XP Professional SP2. The computer
| started to reboot itself a month ago. I have a minidump file of the system. I
| used Windbg to open the file and this is what it shows.
|
| *******************************************************************************
| *
| *
| * Bugcheck Analysis
| *
| *
| *
| *******************************************************************************
|
| KERNEL_MODE_EXCEPTION_NOT_HANDLED_M (1000008e)
| This is a very common bugcheck. Usually the exception address pinpoints
| the driver/function that caused the problem. Always note this address
| as well as the link date of the driver/image that contains this address.
| Some common problems are exception code 0x80000003. This means a hard
| coded breakpoint or assertion was hit, but this system was booted
| /NODEBUG. This is not supposed to happen as developers should never have
| hardcoded breakpoints in retail code, but ...
| If this happens, make sure a debugger gets connected, and the
| system is booted /DEBUG. This will let us see why this breakpoint is
| happening.
| Arguments:
| Arg1: c000001d, The exception code that was not handled
| Arg2: bfad6c9c, The address that the exception occurred at
| Arg3: eb4e4a2c, Trap Frame
| Arg4: 00000000
|
| Debugging Details:
| ------------------
|
|
| EXCEPTION_CODE: (NTSTATUS) 0xc000001d - {EXCEPTION} Illegal Instruction An
| attempt was made to execute an illegal instruction.
|
| FAULTING_IP:
| ati3duag+8cc9c
| bfad6c9c c61048 mov byte ptr [eax],0x48
|
| TRAP_FRAME: eb4e4a2c -- (.trap ffffffffeb4e4a2c)
| ErrCode = 00000000
| eax=003f0000 ebx=00000001 ecx=00000000 edx=00000001 esi=e4e66878 edi=e126dcc4
| eip=bfad6c9c esp=eb4e4aa0 ebp=00000000 iopl=0 nv up ei ng nz na po nc
| cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010286
| ati3duag+0x8cc9c:
| bfad6c9c c61048 mov byte ptr [eax],0x48 ds:0023:003f0000=00
| Resetting default scope
|
| CUSTOMER_CRASH_COUNT: 1
|
| DEFAULT_BUCKET_ID: DRIVER_FAULT
|
| BUGCHECK_STR: 0x8E
|
| MISALIGNED_IP:
| ati3duag+8cc9c
| bfad6c9c c61048 mov byte ptr [eax],0x48
|
| LAST_CONTROL_TRANSFER: from 00000000 to bfad6c9c
|
| FAILED_INSTRUCTION_ADDRESS:
| ati3duag+8cc9c
| bfad6c9c c61048 mov byte ptr [eax],0x48
|
| STACK_TEXT:
| 00000000 00000000 00000000 00000000 00000000 ati3duag+0x8cc9c
|
|
| STACK_COMMAND: .bugcheck ; kb
|
| FOLLOWUP_IP:
| ati3duag+8cc9c
| bfad6c9c c61048 mov byte ptr [eax],0x48
|
| FAULTING_SOURCE_CODE:
|
|
| SYMBOL_STACK_INDEX: 0
|
| FOLLOWUP_NAME: MachineOwner
|
| SYMBOL_NAME: ati3duag+8cc9c
|
| MODULE_NAME: hardware
|
| IMAGE_NAME: hardware
|
| DEBUG_FLR_IMAGE_TIMESTAMP: 0
|
| FAILURE_BUCKET_ID: IP_MISALIGNED_ati3duag.dll
|
| BUCKET_ID: IP_MISALIGNED_ati3duag.dll
|
| Followup: MachineOwner
|
|
|
|
| Can you guys see what the problem is?
|
| Thanks for your help.
|

 

[Plato]

I have a computer that is running Windows XP Professional SP2. The computer
started to reboot itself a month ago. I have a minidump file of the system. I

Try disabling some of your 49 background apps you've got running.

 

[cquirke (MVP Windows shell/user)]

On Sat, 6 May 2006 10:28:01 -0700, Urko

I have a computer that is running Windows XP Professional SP2.
The computer started to reboot itself a month ago.

Disable "Automatically restart on errors" so you can see what's going
on, without having to dredge through minidumps (how will you read
minidumps if the OS crashes before it finishes booting?)

KERNEL_MODE_EXCEPTION_NOT_HANDLED_M (1000008e)

If you always crash at the same place, with the same error type, then
look for a "static" failure cause such as:
- bad sectors on the hard drive
- bad software or drivers
- corrupted files
- malware

If you crash in different places and get different error types, then
look for a more random failure cause such as:
- bad RAM or other hardware
- overheating or overclocking
- software interaction scenarios

In practice I'd check for both, in this order:
- check cooling, caps, RAM
- re-connect and check physical HD and file system
- check logs for "fixed" file corruption (which files?)
- check av logs for cleaned malware
- formal virus scan
- additional Safe Cmd Only anti-malware scans
- manual checks of integration points (HJT, Nirsoft)

I'd also compare mileage between:
- normal Windows
- normal Windows using VGA mode
- normal Windows but different user account
- normal Windows will all peripherals disconnected
- normal Windows with MSConfig startup suppression
- normal Windows with networking unplugged/disabled
- Safe Mode
- Safe Mode Cmd Only
- booting an alternate OS installation (e.g. on another HD)
- booting a Bart CDR prepared on the stricken PC
- booting a Bart CDR prepared on a different PC

Each of the above excludes certain possible scopes of causes, and by
comparing the mileage, you can better track down the cause.

---------- ----- ---- --- -- - - - -

Don't pay malware vendors - boycott Sony