[arisme]

Imagine that some malicious person hits the reset button on your machine whenever they think you need a nasty surprise.

That is the symptom I have - no BSOD, no hardware messages, no stop codes, and no warning - straight into loss of display, a report from my LCD monitor of 'no signal', then the BIOS boot sequence.

It seems to be associated with user-initiated program activity rather than programs at rest, but that is the only clue I have. It can be any program at any time, mostly early in.

It started about 2-3 months after I upgraded to XP Pro SP2 from Win98 (end of 2006). The early occurrences were spaced about 3 weeks apart, but the interval has gradually shrunk until today it is almost guaranteed daily.

I cannot associate the start of the problem with any specific hardware or software change on my system.

Windows Memory Diagnostic found no problems. But something, somewhere is issuing an NMI that bypasses the OS messaging mechanisms.

I am considering trying an XP in-place repair, but before risking disturbing a loaded work-horse machine, I thought I should try to see if anybody in this impressive forum has advice, suggestions, prayers, or magic spells that might throw some light on the issue.

Aris

[Advertisements]

At first please disable automatic rebooting:
1. Right-click My Computer, and then click Properties.
2. Click the Advanced tab.
3. Under Startup and Recovery, click Settings to open the Startup and Recovery dialog box.
4. Clear the Automatically restart check box, and click OK.

Next time windows will crash you should see blue screen showing some information about possible causes.

[luk79]

At first please disable automatic rebooting:
1. Right-click My Computer, and then click Properties.
2. Click the Advanced tab.
3. Under Startup and Recovery, click Settings to open the Startup and Recovery dialog box.
4. Clear the Automatically restart check box, and click OK.

Next time windows will crash you should see blue screen showing some information about possible causes.

[arisme]

luk79,

Thanks.

Done.

Now, we wait.

Aris

[Damien Kane]

If it doesn't work, from memory, there was a virus or some sort of malware going around about 2 years ago that had a similar behaviour. Just a thought.

[arisme]

Damien,

Thanks for the thought. The possibility cannot be ruled out, but is probably low on the suspect list.

We have some info. The machine crashed last night and I saw the welcome sight of a BSOD with writing on it. Welcome because it raises the prospect of diagnosis and cure. (Some recent reading suggested that the BSOD is shown every time, but may disappear quickly if AutoRestart is set. With a 2000GHz CPU and 1Gb memory, I guess the BSOD went by too quickly to be detected by the naked eye.)

The error reported is Stop code 0x000000D1, which most likely originates from a device driver behaving incorrectly. The report could not identify the driver.

My next task is identifying which of the hundreds of drivers on my machine is the culprit - and I have no idea what the best approach for this might be. MSDN suggests an elimination process, but this is not practical where the gap between boot and fault might be weeks.

As the fault could occur with a fair cross section of programs, the driver should be in the set shared universally. Is there somewhere a list of Windows drivers which identifies what areas they operate in? Are there any drivers from third party software that are likely to be active all the time?

I read about kernel debugging this morning, but do not know whether it's a good idea in the first place, and whether I have enough space for more software at the moment (and do we want any more drivers on board at the moment ?!!!).

So, thanks for a good first step - any ideas where next?

Aris

Edited by arisme, 16 April 2008 - 06:36 PM.

[Damien Kane]

Have you tried booting to dos and leaving the machine on to see if it reboots. If it still occurs, at least we would've ruled out a Windows problem. If you have a Linux cd you could boot to and work on at least for now, and see if it still happens. If it does, at least again, it'd narrow it down and you can still use the machine.

Do you have any hardware/sensor monitors on the computer, especially temperature monitors? If not, perhaps think about grabbing one and installing it. Unless anybody else in this forum could help, I'm at a bit of a loss if it isn't temp related.

[arisme]

Damien,

> Have you tried booting to dos and leaving the machine on to see if it reboots.

Nope. It has never rebooted when idle, The reboots have always occurred with program activity. Hopefully this characteristic should reduce the suspects list, but I lack the low level knowledge to identify which drivers qualify as suspects.

> If you have a Linux cd you could boot to and work on at least for now,
> and see if it still happens.

Alas, a short while ago, I used up the remaining free space on my disk by shuffling partitions along to make room for the ever more greedy C: drive. So the space I originally reserved for a Linux installation has been swallowed by the Windows bloatware.

> Do you have any hardware/sensor monitors on the computer,
> especially temperature monitors?

Yes - temperatures and voltages are all nominal. There is a surge suppressor in the power supply, and it normally takes a power cut to actually stop the machine. The occasional and rare power dips due to stormy weather usually do not cause reboots.

I have been wrestling with the computer beasts daily for a few decades, and over that period of time you develop a feel for how a machine runs. Apart from the wild driver, the rest is pretty good.

Thanks for your good suggestions; your interest is much appreciated.

Incidentally, I have copies of the "bug check" report files normally forwarded to Doctor Watson at Microsoft, if anybody is skilled at extracting useful info from them.

Aris

[The Admiral]

Well Aris,

The bugcheck is what we need to be looking at here to see if it indicates a driver. The file we're looking for is in C:\WINDOWS\Minidump. there will be a few files there, just attach three so we can compare them and make sure it's the same file. Attach the files to a post, so we can pull them off and look at them on our machines using the Windows Debugger.

[The Skeptic]

The problem you have may be difficult to diagnose because of it's randomness (once a day, or so, is considered random, at least by me). We can't even tell at this moment whether it originates in the hardware or software because several programs that run at the same time can fail a hardware piece which is in a marginal state, or can increase the chance to some software problem.

1: Please load the computer heavily for about 15 minutes and report temperatures of the cpu, HD and motherboard. To do so please download Everest from my list of programs below. install and run it. Click Computer and then click Sensor. minimize to the task bar. Maximize after the computer has been run heavily loaded and report temperatures and voltages.

2: Look in the Event Viewer (Control Panel > Administrative Tools) if there are any errors (only the red ones interest us) related in time to shutdowns. Check in all the sub-catogries of Event Viewer.

[happyrock]

it could help if you gave us your system specs...make...model ect

[arisme]

Attached is Minidumps.zip, containing three files from C:\Wndows\Minidump (was not permitted to upload *.dmp files).

The latest of the three files was last nights reboot, the only one with Auto restart disabled. Strangely, it is also only about 65Kb, whereas all the other files are in the 90Kb range.

Another puzzling factor is that the Minidump directory only has 11 *.dmp files, but there have been at least 30 reboots.

Thank you for your willingness to help.

Aris
 Minidumps.zip   39.23KB   165 downloads

Attached Files

•  Minidumps.zip   39.23KB   113 downloads

[The Admiral]

I'll take a look at these dumps in a couple of hours when I'm home from work. Anyone else who has windbg?

Edited by The Admiral, 16 April 2008 - 11:47 AM.

[Robert W.]

The same thing was happening to my mother until we FINALLY found the problem. It was the Power Supply. I would take a voltmeter and check the molex connections as well as the motherboard ATX/BTX connector. Look on google for the schematics.

Hope this helps

[arisme]

it could help if you gave us your system specs...make...model ect

Machine is non-branded assembly by local computer shop.

Extract from Everest system summary:-

Computer:
Operating System Microsoft Windows XP Professional
OS Service Pack Service Pack 2
Internet Explorer 6.0.2900.2180
DirectX 4.09.00.0904 (DirectX 9.0)
Computer Name HOMEUSER
User Name Home User

Motherboard:
CPU Type AMD Athlon XP, 2000 MHz (15 x 133) 2400+
Motherboard Name ASRock K7S8X (6 PCI, 1 AGP, 3 DIMM, Audio, LAN)
Motherboard Chipset SiS 748
System Memory 1024 MB (DDR SDRAM)
BIOS Type AMI (10/07/03)
Communication Port Communications Port (COM1)
Communication Port ECP Printer Port (LPT1)

Display:
Video Adapter NVIDIA GeForce2 MX/MX 400 (64 MB)
3D Accelerator nVIDIA GeForce2 MX/MX 400

Multimedia:
Audio Adapter C-Media CMI8738/C3DX Audio Device
Audio Adapter SiS 7012 Audio Device
Audio Adapter Trident 4DWave NX Sound Accelerator

Storage:
IDE Controller SiS PCI IDE Controller
Floppy Drive Floppy disk drive
Disk Drive Maxtor 6L080L0 (76 GB, IDE)
Optical Drive HP CD-Writer cd16f (16x/10x/40x CD-RW)

Partitions:
C: (FAT32) 9998 MB (828 MB free)
D: (FAT32) 7687 MB (1971 MB free)
E: (FAT32) 7695 MB (1670 MB free)
F: (FAT32) 7695 MB (2522 MB free)
G: (FAT32) 7695 MB (1098 MB free)
H: (FAT32) 7695 MB (1653 MB free)
I: (FAT32) 7695 MB (1241 MB free)
J: (FAT32) 7687 MB (1309 MB free)

Input:
Keyboard Standard 101/102-Key PS/2 Keyboard
Mouse HID-compliant mouse
Mouse Microsoft PS/2 Port Mouse (IntelliPoint)

Network:
Network Adapter SiS 900-Based PCI Fast Ethernet Adapter
Network Adapter WAN (PPP/SLIP) Interface
Modem Intel V92 External Modem

Peripherals:
USB1 Controller SiS 7001 PCI-USB Open Host Controller
USB1 Controller SiS 7001 PCI-USB Open Host Controller
USB2 Controller SiS 7002 USB 2.0 Enhanced Host Controller
USB Device USB ADSL WAN Adapter
USB Device USB Human Interface Device

Aris

[arisme]

1: Please load the computer heavily for about 15 minutes and report temperatures of the cpu, HD and motherboard. To do so please download Everest from my list of programs below. install and run it. Click Computer and then click Sensor. minimize to the task bar. Maximize after the computer has been run heavily loaded and report temperatures and voltages.

2: Look in the Event Viewer (Control Panel > Administrative Tools) if there are any errors (only the red ones interest us) related in time to shutdowns. Check in all the sub-catogries of Event Viewer.

Everest reports
Date 2008-04-17
Time 04:34

Sensor Properties:
Sensor Type Winbond W83697HF
Sensor Access ISA 290h
Motherboard Name ASRock K7S8X / K7S8XE / K7VM2 / K7VM4 / K7VT4-4X

Temperatures:
Motherboard 32 °C (90 °F)
CPU 44 °C (111 °F)
Maxtor 6L080L0 29 °C (84 °F)

Cooling Fans:
CPU 4066 RPM

Voltage Values:
CPU Core 1.62 V
+3.3 V 3.26 V
+5 V 4.84 V
+12 V 11.83 V
+5 V Standby 4.92 V
Debug Info 65 00 CC B4 B8 BD BE 2C 53 FF FF 24 (01)

Start searching whole file system for files containing "abc"
======================================
Date 2008-04-17
Time 04:50

Temperatures:
Motherboard 32 °C (90 °F)
CPU 46 °C (115 °F)
Maxtor 6L080L0 29 °C (84 °F)

Cooling Fans:
CPU 4066 RPM

Voltage Values:
CPU Core 1.62 V
+3.3 V 3.23 V
+5 V 4.81 V
+12 V 11.90 V
+5 V Standby 4.90 V
Debug Info 65 00 CA B3 B9 BE C0 2E 53 FF FF 24 (01)

=========================================================

Event viewer - Red errors at reboots
Applications
14 April 08
Error ID: 1000
Faulting application seamonkey.exe, version 1.8.20080.20123, faulting module ntdll.dll, version 5.1.2600.2180, fault address 0x000188fa.

(SeaMonkey was the advanced development version of the Firefox browser, and is now available in its own right.)

I am not sure whether the browser was the cause of the reboot or the victim of it. There are a number of identical entries for SeaMonkey with identical failing modules and fault addresses at various reboot dates. A daily activity is the download of some 60 or more data documents from the web. I suspect it might be a victim.

Reboots have also happened when programs not using telecommunications have been started. Notably, one program which does nothing more than read downloaded html files and remove blank lines.

Security
Plenty of failure audits, but no reds.

System
Error ID: 7000
The General Purpose USB Driver (adildr.sys) service failed to start due to the following error:
The service cannot be started, either because it is disabled or because it has no enabled devices associated with it.

This is by far the most common entry, and is a boot sequence failure. The Microsoft optical mouse fails to activate. This has been a characteristic since Win98 SE.

I am still searching for Red errors here, that can positively be tied in to a reboot and precedes it. Will report further.

Is there a good Event log analyser available, or will I have to write my own?

Aris