Random reboots

Tutorials Win: Microsoft Windows Forum

For about 2 months I've had random reboots. It's started shortly after I
upgraded to SP3 as well as to Norton Anti-virus 2008. I never get to see the
blue screen before it reboots, And had to download the debugger just to read
the dump files. I've upgraded the drivers, checked that everything was
seated. It doesn't matter what program it happens on, a game, just working
with files, etc. The one constant here, and I'm having trouble finding the
function in support is: FAILURE_BUCKET_ID:
0xA_W_nt!MiRestoreTransitionPte+6b. What does this call refer to? Physical
memory, hard drive, that sort of thing...

Microsoft (R) Windows Debugger Version 6.9.0003.113 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\WINDOWS\Minidump\Mini061808-02.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*C:\Program Files\Debugging Tools for Windows
(x86)\Symbols*http://msdl.microsoft,com/download/symbols
Executable search path is: C:\WINDOWS\system32; C:\WINDOWS\system\system32
Windows XP Kernel Version 2600 (Service Pack 3) UP Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 2600.xpsp.080413-2111
Kernel base = 0x804d7000 PsLoadedModuleList = 0x80553fc0
Debug session time: Wed Jun 18 20:26:07.750 2008 (GMT-7)
System Uptime: 0 days 0:37:18.315
Loading Kernel Symbol
.....................................................................................................................................................................................
Loading User Symbols
Loading unloaded module list
.................................
*******************************************************************************
*
*
* Bugcheck Analysis
*
*

*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1000000A, {4f000010, 2, 1, 80514135}

Probably caused by : memory_corruption ( nt!MiRestoreTransitionPte+6b )

Followup: MachineOwner
---------

kd> !analyze -
*******************************************************************************
*
*
* Bugcheck Analysis
*
*

*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 4f000010, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000001, bitfield :
bit 0 : value 0 = read operation, 1 = write operation
bit 3 : value 0 = not an execute operation, 1 = execute operation (only on
chips which support this level of status)
Arg4: 80514135, address which referenced memory

Debugging Details:
------------------


WRITE_ADDRESS: 4f000010

CURRENT_IRQL: 2

FAULTING_IP:
nt!MiRestoreTransitionPte+6b
80514135 ff4910 dec dword ptr [ecx+10h]

CUSTOMER_CRASH_COUNT: 2

DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: 0xA

PROCESS_NAME: System

LAST_CONTROL_TRANSFER: from 8051ec6d to 80514135

STACK_TEXT:
bace3aac 8051ec6d e7aea080 ffffffff 8a612408 nt!MiRestoreTransitionPte+0x6b
bace3ac4 8051f21e 87c265c0 805126d5 8a612438 nt!MiRemovePageFromList+0xd1
bace3acc 805126d5 8a612438 000004c0 00000400 nt!MiRemoveAnyPage+0x56
bace3af8 80513210 00010000 87c26634 87c26650 nt!MiResolveMappedFileFault+0x3dd
bace3b3c 805133ca 00000000 ced10000 c0676880 nt!MiResolveProtoPteFault+0x18c
bace3bc0 8051cb1c e7aea080 ced10000 c0676880 nt!MiDispatchFault+0xe8
bace3c24 80517c78 00000000 ced10000 00000000 nt!MmAccessFault+0x7b4
bace3c80 804e0fe7 ced10000 00000000 80550118 nt!MmCheckCachedPageState+0x56c
bace3d2c 804e620f 8a7b9298 8055b0c0 8a7bb830 nt!CcPerformReadAhead+0x1f1
bace3d74 80534c02 8a7b9298 00000000 8a7bb830 nt!CcWorkerThread+0x147
bace3dac 805c6160 8a7b9298 00000000 00000000 nt!ExpWorkerThread+0x100
bace3ddc 80541dd2 80534b02 00000000 00000000 nt!PspSystemThreadStartup+0x34
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16


STACK_COMMAND: kb

FOLLOWUP_IP:
nt!MiRestoreTransitionPte+6b
80514135 ff4910 dec dword ptr [ecx+10h]

SYMBOL_STACK_INDEX: 0

SYMBOL_NAME: nt!MiRestoreTransitionPte+6b

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nt

DEBUG_FLR_IMAGE_TIMESTAMP: 4802516a

IMAGE_NAME: memory_corruption

FAILURE_BUCKET_ID: 0xA_W_nt!MiRestoreTransitionPte+6b

BUCKET_ID: 0xA_W_nt!MiRestoreTransitionPte+6b

Followup: MachineOwner
---------

kd> lmvm nt
start end module name
804d7000 806cf580 nt (pdb symbols) C:\Program
Files\Debugging Tools for Windows
(x86)\Symbols\ntkrnlpa.pdb\30B5FB31AE7E4ACAABA750AA241FF3311\ntkrnlpa.pdb
Loaded symbol image file: ntkrnlpa.exe
Mapped memory image file: C:\WINDOWS\system32\ntkrnlpa.exe
Image path: ntkrnlpa.exe
Image name: ntkrnlpa.exe
Timestamp: Sun Apr 13 11:31:06 2008 (4802516A)
CheckSum: 00204E7E
ImageSize: 001F8580
File version: 5.1.2600.5512
Product version: 5.1.2600.5512
File flags: 0 (Mask 3F)
File OS: 40004 NT Win32
File type: 1.0 App
File date: 00000000.00000000
Translations: 0409.04b0
CompanyName: Microsoft Corporation
ProductName: Microsoft® Windows® Operating System
InternalName: ntkrnlpa.exe
OriginalFilename: ntkrnlpa.exe
ProductVersion: 5.1.2600.5512
FileVersion: 5.1.2600.5512 (xpsp.080413-2111)
FileDescription: NT Kernel & System
LegalCopyright: © Microsoft Corporation. All rights reserved.

Please note that I picked an older dump file, The parameters are almost the
same in each dump file. The executables in each dump are different, however.
The most current one:


Microsoft (R) Windows Debugger Version 6.9.0003.113 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\WINDOWS\Minidump\Mini081608-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*C:\Program Files\Debugging Tools for Windows
(x86)\Symbols*http://msdl.microsoft,com/download/symbols
Executable search path is: C:\WINDOWS\system32; C:\WINDOWS\system\system32
Windows XP Kernel Version 2600 (Service Pack 3) UP Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 2600.xpsp.080413-2111
Kernel base = 0x804d7000 PsLoadedModuleList = 0x80553fc0
Debug session time: Sat Aug 16 23:39:31.765 2008 (GMT-7)
System Uptime: 0 days 2:23:35.349
Loading Kernel Symbols
......................................................................................................................................................................................
Loading User Symbols
Loading unloaded module list
................................
*******************************************************************************
*
*
* Bugcheck Analysis
*
*
*
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1000000A, {a080014, 2, 1, 80514135}

Probably caused by : memory_corruption ( nt!MiRestoreTransitionPte+6b )

Followup: MachineOwner
---------

kd> !analyze -v
*******************************************************************************
*
*
* Bugcheck Analysis
*
*
*
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 0a080014, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000001, bitfield :
bit 0 : value 0 = read operation, 1 = write operation
bit 3 : value 0 = not an execute operation, 1 = execute operation (only on
chips which support this level of status)
Arg4: 80514135, address which referenced memory

Debugging Details:
------------------


WRITE_ADDRESS: 0a080014

CURRENT_IRQL: 2

FAULTING_IP:
nt!MiRestoreTransitionPte+6b
80514135 ff4910 dec dword ptr [ecx+10h]

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: 0xA

PROCESS_NAME: WinRAR.exe

LAST_CONTROL_TRANSFER: from 8051ec6d to 80514135

STACK_TEXT:
a9405810 8051ec6d 00000000 ffffffff 9da00000 nt!MiRestoreTransitionPte+0x6b
a9405828 8051f21e e7dc0c30 80518793 00000000 nt!MiRemovePageFromList+0xd1
a9405830 80518793 00000000 c2146000 00001000 nt!MiRemoveAnyPage+0x56
a9405924 804e2d61 c2146000 01d29450 00000000 nt!MmCopyToCachedPage+0x1f3
a94059b4 804e0d21 87c25c60 01d29450 a94059e8 nt!CcMapAndCopy+0x1a9
a9405a34 ba646846 87d2bdb8 2ec80ebc 00007ff0 nt!CcFastCopyWrite+0x211
a9405a9c ba6d5018 87d2bdb8 a9405b0c 00007ff0 Ntfs!NtfsCopyWriteA+0x23d
a9405ad0 ba6e0b99 00000004 00000000 a9405b04
fltmgr!FltpPerformFastIoCall+0x230
a9405b24 ba6c7a27 87d2bdb8 8783b9e0 00007ff0 fltmgr!FltpFastIoWrite+0xa9
a9405b58 ba6d5018 87d2bdb8 8783b9e0 00007ff0 sr!SrFastIoWrite+0x77
a9405b8c ba6d51e4 00000004 00000000 8783b9d8
fltmgr!FltpPerformFastIoCall+0x230
a9405bb8 ba6e0c38 00405bd8 01d2430c 8a5eccc0 fltmgr!FltpPassThroughFastIo+0x78
a9405bf8 ba6d5018 87d2bdb8 a9405c68 00007ff0 fltmgr!FltpFastIoWrite+0x148
a9405c2c ba6e0b99 00000004 00000000 a9405c60
fltmgr!FltpPerformFastIoCall+0x230
a9405c80 8057256c 87d2bdb8 a9405cc4 00007ff0 fltmgr!FltpFastIoWrite+0xa9
a9405d38 8053d638 000001f4 00000000 00000000 nt!NtWriteFile+0x324
a9405d38 7c90e4f4 000001f4 00000000 00000000 nt!KiFastCallEntry+0xf8
WARNING: Frame IP not in any known module. Following frames may be wrong.
000eff78 00000000 00000000 00000000 00000000 0x7c90e4f4


STACK_COMMAND: kb

FOLLOWUP_IP:
nt!MiRestoreTransitionPte+6b
80514135 ff4910 dec dword ptr [ecx+10h]

SYMBOL_STACK_INDEX: 0

SYMBOL_NAME: nt!MiRestoreTransitionPte+6b

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nt

DEBUG_FLR_IMAGE_TIMESTAMP: 4802516a

IMAGE_NAME: memory_corruption

FAILURE_BUCKET_ID: 0xA_W_nt!MiRestoreTransitionPte+6b

BUCKET_ID: 0xA_W_nt!MiRestoreTransitionPte+6b

Followup: MachineOwner
---------

kd> lmvm nt
start end module name
804d7000 806cf580 nt (pdb symbols) C:\Program
Files\Debugging Tools for Windows
(x86)\Symbols\ntkrnlpa.pdb\30B5FB31AE7E4ACAABA750AA241FF3311\ntkrnlpa.pdb
Loaded symbol image file: ntkrnlpa.exe
Mapped memory image file: C:\WINDOWS\system32\ntkrnlpa.exe
Image path: ntkrnlpa.exe
Image name: ntkrnlpa.exe
Timestamp: Sun Apr 13 11:31:06 2008 (4802516A)
CheckSum: 00204E7E
ImageSize: 001F8580
File version: 5.1.2600.5512
Product version: 5.1.2600.5512
File flags: 0 (Mask 3F)
File OS: 40004 NT Win32
File type: 1.0 App
File date: 00000000.00000000
Translations: 0409.04b0
CompanyName: Microsoft Corporation
ProductName: Microsoft® Windows® Operating System
InternalName: ntkrnlpa.exe
OriginalFilename: ntkrnlpa.exe
ProductVersion: 5.1.2600.5512
FileVersion: 5.1.2600.5512 (xpsp.080413-2111)
FileDescription: NT Kernel & System
LegalCopyright: © Microsoft Corporation. All rights reserved.
Top

RE: Random reboots by Wolf

Wolf
Sun Aug 17 04:10:00 PDT 2008



"Wolf" wrote:

> For about 2 months I've had random reboots. It's started shortly after I
> upgraded to SP3 as well as to Norton Anti-virus 2008. I never get to see the
> blue screen before it reboots, And had to download the debugger just to read
> the dump files. I've upgraded the drivers, checked that everything was
> seated. It doesn't matter what program it happens on, a game, just working
> with files, etc. The one constant here, and I'm having trouble finding the
> function in support is: FAILURE_BUCKET_ID:
> 0xA_W_nt!MiRestoreTransitionPte+6b. What does this call refer to? Physical
> memory, hard drive, that sort of thing...
>
> Microsoft (R) Windows Debugger Version 6.9.0003.113 X86
> Copyright (c) Microsoft Corporation. All rights reserved.
>
>
> Loading Dump File [C:\WINDOWS\Minidump\Mini061808-02.dmp]
> Mini Kernel Dump File: Only registers and stack trace are available
>
> Symbol search path is: SRV*C:\Program Files\Debugging Tools for Windows
> (x86)\Symbols*http://msdl.microsoft,com/download/symbols
> Executable search path is: C:\WINDOWS\system32; C:\WINDOWS\system\system32
> Windows XP Kernel Version 2600 (Service Pack 3) UP Free x86 compatible
> Product: WinNt, suite: TerminalServer SingleUserTS
> Built by: 2600.xpsp.080413-2111
> Kernel base = 0x804d7000 PsLoadedModuleList = 0x80553fc0
> Debug session time: Wed Jun 18 20:26:07.750 2008 (GMT-7)
> System Uptime: 0 days 0:37:18.315
> Loading Kernel Symbols
> .....................................................................................................................................................................................
> Loading User Symbols
> Loading unloaded module list
> ..................................
> *******************************************************************************
> *
> *
> * Bugcheck Analysis
> *
> *
> *
> *******************************************************************************
>
> Use !analyze -v to get detailed debugging information.
>
> BugCheck 1000000A, {4f000010, 2, 1, 80514135}
>
> Probably caused by : memory_corruption ( nt!MiRestoreTransitionPte+6b )
>
> Followup: MachineOwner
> ---------
>
> kd> !analyze -v
> *******************************************************************************
> *
> *
> * Bugcheck Analysis
> *
> *
> *
> *******************************************************************************
>
> IRQL_NOT_LESS_OR_EQUAL (a)
> An attempt was made to access a pageable (or completely invalid) address at an
> interrupt request level (IRQL) that is too high. This is usually
> caused by drivers using improper addresses.
> If a kernel debugger is available get the stack backtrace.
> Arguments:
> Arg1: 4f000010, memory referenced
> Arg2: 00000002, IRQL
> Arg3: 00000001, bitfield :
> bit 0 : value 0 = read operation, 1 = write operation
> bit 3 : value 0 = not an execute operation, 1 = execute operation (only on
> chips which support this level of status)
> Arg4: 80514135, address which referenced memory
>
> Debugging Details:
> ------------------
>
>
> WRITE_ADDRESS: 4f000010
>
> CURRENT_IRQL: 2
>
> FAULTING_IP:
> nt!MiRestoreTransitionPte+6b
> 80514135 ff4910 dec dword ptr [ecx+10h]
>
> CUSTOMER_CRASH_COUNT: 2
>
> DEFAULT_BUCKET_ID: DRIVER_FAULT
>
> BUGCHECK_STR: 0xA
>
> PROCESS_NAME: System
>
> LAST_CONTROL_TRANSFER: from 8051ec6d to 80514135
>
> STACK_TEXT:
> bace3aac 8051ec6d e7aea080 ffffffff 8a612408 nt!MiRestoreTransitionPte+0x6b
> bace3ac4 8051f21e 87c265c0 805126d5 8a612438 nt!MiRemovePageFromList+0xd1
> bace3acc 805126d5 8a612438 000004c0 00000400 nt!MiRemoveAnyPage+0x56
> bace3af8 80513210 00010000 87c26634 87c26650 nt!MiResolveMappedFileFault+0x3dd
> bace3b3c 805133ca 00000000 ced10000 c0676880 nt!MiResolveProtoPteFault+0x18c
> bace3bc0 8051cb1c e7aea080 ced10000 c0676880 nt!MiDispatchFault+0xe8
> bace3c24 80517c78 00000000 ced10000 00000000 nt!MmAccessFault+0x7b4
> bace3c80 804e0fe7 ced10000 00000000 80550118 nt!MmCheckCachedPageState+0x56c
> bace3d2c 804e620f 8a7b9298 8055b0c0 8a7bb830 nt!CcPerformReadAhead+0x1f1
> bace3d74 80534c02 8a7b9298 00000000 8a7bb830 nt!CcWorkerThread+0x147
> bace3dac 805c6160 8a7b9298 00000000 00000000 nt!ExpWorkerThread+0x100
> bace3ddc 80541dd2 80534b02 00000000 00000000 nt!PspSystemThreadStartup+0x34
> 00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16
>
>
> STACK_COMMAND: kb
>
> FOLLOWUP_IP:
> nt!MiRestoreTransitionPte+6b
> 80514135 ff4910 dec dword ptr [ecx+10h]
>
> SYMBOL_STACK_INDEX: 0
>
> SYMBOL_NAME: nt!MiRestoreTransitionPte+6b
>
> FOLLOWUP_NAME: MachineOwner
>
> MODULE_NAME: nt
>
> DEBUG_FLR_IMAGE_TIMESTAMP: 4802516a
>
> IMAGE_NAME: memory_corruption
>
> FAILURE_BUCKET_ID: 0xA_W_nt!MiRestoreTransitionPte+6b
>
> BUCKET_ID: 0xA_W_nt!MiRestoreTransitionPte+6b
>
> Followup: MachineOwner
> ---------
>
> kd> lmvm nt
> start end module name
> 804d7000 806cf580 nt (pdb symbols) C:\Program
> Files\Debugging Tools for Windows
> (x86)\Symbols\ntkrnlpa.pdb\30B5FB31AE7E4ACAABA750AA241FF3311\ntkrnlpa.pdb
> Loaded symbol image file: ntkrnlpa.exe
> Mapped memory image file: C:\WINDOWS\system32\ntkrnlpa.exe
> Image path: ntkrnlpa.exe
> Image name: ntkrnlpa.exe
> Timestamp: Sun Apr 13 11:31:06 2008 (4802516A)
> CheckSum: 00204E7E
> ImageSize: 001F8580
> File version: 5.1.2600.5512
> Product version: 5.1.2600.5512
> File flags: 0 (Mask 3F)
> File OS: 40004 NT Win32
> File type: 1.0 App
> File date: 00000000.00000000
> Translations: 0409.04b0
> CompanyName: Microsoft Corporation
> ProductName: Microsoft® Windows® Operating System
> InternalName: ntkrnlpa.exe
> OriginalFilename: ntkrnlpa.exe
> ProductVersion: 5.1.2600.5512
> FileVersion: 5.1.2600.5512 (xpsp.080413-2111)
> FileDescription: NT Kernel & System
> LegalCopyright: © Microsoft Corporation. All rights reserved.
>
> Please note that I picked an older dump file, The parameters are almost the
> same in each dump file. The executables in each dump are different, however.
> The most current one:
>
>
> Microsoft (R) Windows Debugger Version 6.9.0003.113 X86
> Copyright (c) Microsoft Corporation. All rights reserved.
>
>
> Loading Dump File [C:\WINDOWS\Minidump\Mini081608-01.dmp]
> Mini Kernel Dump File: Only registers and stack trace are available
>
> Symbol search path is: SRV*C:\Program Files\Debugging Tools for Windows
> (x86)\Symbols*http://msdl.microsoft,com/download/symbols
> Executable search path is: C:\WINDOWS\system32; C:\WINDOWS\system\system32
> Windows XP Kernel Version 2600 (Service Pack 3) UP Free x86 compatible
> Product: WinNt, suite: TerminalServer SingleUserTS
> Built by: 2600.xpsp.080413-2111
> Kernel base = 0x804d7000 PsLoadedModuleList = 0x80553fc0
> Debug session time: Sat Aug 16 23:39:31.765 2008 (GMT-7)
> System Uptime: 0 days 2:23:35.349
> Loading Kernel Symbols
> .....................................................................................................................................................................................
> Loading User Symbols
> Loading unloaded module list
> ................................
> *******************************************************************************
> *
> *
> * Bugcheck Analysis
> *
> *
> *
> *******************************************************************************
>
> Use !analyze -v to get detailed debugging information.
>
> BugCheck 1000000A, {a080014, 2, 1, 80514135}
>
> Probably caused by : memory_corruption ( nt!MiRestoreTransitionPte+6b )
>
> Followup: MachineOwner
> ---------
>
> kd> !analyze -v
> *******************************************************************************
> *
> *
> * Bugcheck Analysis
> *
> *
> *
> *******************************************************************************
>
> IRQL_NOT_LESS_OR_EQUAL (a)
> An attempt was made to access a pageable (or completely invalid) address at an
> interrupt request level (IRQL) that is too high. This is usually
> caused by drivers using improper addresses.
> If a kernel debugger is available get the stack backtrace.
> Arguments:
> Arg1: 0a080014, memory referenced
> Arg2: 00000002, IRQL
> Arg3: 00000001, bitfield :
> bit 0 : value 0 = read operation, 1 = write operation
> bit 3 : value 0 = not an execute operation, 1 = execute operation (only on
> chips which support this level of status)
> Arg4: 80514135, address which referenced memory
>
> Debugging Details:
> ------------------
>
>
> WRITE_ADDRESS: 0a080014
>
> CURRENT_IRQL: 2
>
> FAULTING_IP:
> nt!MiRestoreTransitionPte+6b
> 80514135 ff4910 dec dword ptr [ecx+10h]
>
> CUSTOMER_CRASH_COUNT: 1
>
> DEFAULT_BUCKET_ID: DRIVER_FAULT
>
> BUGCHECK_STR: 0xA
>
> PROCESS_NAME: WinRAR.exe
>
> LAST_CONTROL_TRANSFER: from 8051ec6d to 80514135
>
> STACK_TEXT:
> a9405810 8051ec6d 00000000 ffffffff 9da00000 nt!MiRestoreTransitionPte+0x6b
> a9405828 8051f21e e7dc0c30 80518793 00000000 nt!MiRemovePageFromList+0xd1
> a9405830 80518793 00000000 c2146000 00001000 nt!MiRemoveAnyPage+0x56
> a9405924 804e2d61 c2146000 01d29450 00000000 nt!MmCopyToCachedPage+0x1f3
> a94059b4 804e0d21 87c25c60 01d29450 a94059e8 nt!CcMapAndCopy+0x1a9
> a9405a34 ba646846 87d2bdb8 2ec80ebc 00007ff0 nt!CcFastCopyWrite+0x211
> a9405a9c ba6d5018 87d2bdb8 a9405b0c 00007ff0 Ntfs!NtfsCopyWriteA+0x23d
> a9405ad0 ba6e0b99 00000004 00000000 a9405b04
> fltmgr!FltpPerformFastIoCall+0x230
> a9405b24 ba6c7a27 87d2bdb8 8783b9e0 00007ff0 fltmgr!FltpFastIoWrite+0xa9
> a9405b58 ba6d5018 87d2bdb8 8783b9e0 00007ff0 sr!SrFastIoWrite+0x77
> a9405b8c ba6d51e4 00000004 00000000 8783b9d8
> fltmgr!FltpPerformFastIoCall+0x230
> a9405bb8 ba6e0c38 00405bd8 01d2430c 8a5eccc0 fltmgr!FltpPassThroughFastIo+0x78
> a9405bf8 ba6d5018 87d2bdb8 a9405c68 00007ff0 fltmgr!FltpFastIoWrite+0x148
> a9405c2c ba6e0b99 00000004 00000000 a9405c60
> fltmgr!FltpPerformFastIoCall+0x230
> a9405c80 8057256c 87d2bdb8 a9405cc4 00007ff0 fltmgr!FltpFastIoWrite+0xa9
> a9405d38 8053d638 000001f4 00000000 00000000 nt!NtWriteFile+0x324
> a9405d38 7c90e4f4 000001f4 00000000 00000000 nt!KiFastCallEntry+0xf8
> WARNING: Frame IP not in any known module. Following frames may be wrong.
> 000eff78 00000000 00000000 00000000 00000000 0x7c90e4f4
>
>
> STACK_COMMAND: kb
>
> FOLLOWUP_IP:
> nt!MiRestoreTransitionPte+6b
> 80514135 ff4910 dec dword ptr [ecx+10h]
>
> SYMBOL_STACK_INDEX: 0
>
> SYMBOL_NAME: nt!MiRestoreTransitionPte+6b
>
> FOLLOWUP_NAME: MachineOwner
>
> MODULE_NAME: nt
>
> DEBUG_FLR_IMAGE_TIMESTAMP: 4802516a
>
> IMAGE_NAME: memory_corruption
>
> FAILURE_BUCKET_ID: 0xA_W_nt!MiRestoreTransitionPte+6b
>
> BUCKET_ID: 0xA_W_nt!MiRestoreTransitionPte+6b
>
> Followup: MachineOwner
> ---------
>
> kd> lmvm nt
> start end module name
> 804d7000 806cf580 nt (pdb symbols) C:\Program
> Files\Debugging Tools for Windows
> (x86)\Symbols\ntkrnlpa.pdb\30B5FB31AE7E4ACAABA750AA241FF3311\ntkrnlpa.pdb
> Loaded symbol image file: ntkrnlpa.exe

Almost forgot, from Event Viewer:
Error code 1000000a, parameter1 0a080014, parameter2 00000002, parameter3
00000001, parameter4 80514135. from the latest one.

From the 15th of August:
Error code 1000000a, parameter1 00000010, parameter2 00000002, parameter3
00000001, parameter4 80514135.

From the 14th...:
Error code 1000000a, parameter1 0fdd6010, parameter2 00000002, parameter3
00000001, parameter4 80514135.

Anyways. that's the way it's been going. Thanks in advance.
Top

Re: Random reboots by Gerry

Gerry
Sun Aug 17 05:57:07 PDT 2008

Wolf

Disable automatic restart on system failure. This should help by
allowing time to write down the STOP code properly. Right click on
the My Computer icon on the Desktop and select Properties, Advanced,
Start-Up and Recovery, System Failure and uncheck box before
Automatically Restart.

Do not re-enable automatic restart on system failure. Check for variants
of the Stop Error message.

An alternative is to keep pressing the F8 key during Start-Up and select
option - Disable automatic restart on system failure.

I would uninstall WinRAR and observe for affect. What version do you
have installed?

When you post Event Viewer please post complete reports not parts of the
Report.

A tip for posting copies of Error Reports! Run Event Viewer and double
click on the error you want to copy. In the window, which appears is a
button resembling two pages. Click the button and close Event
Viewer.Now start your message (email) and do a paste into the body of
the message. Make sure this is the first paste after exiting from
Event Viewer.

--



Hope this helps.

Gerry
~~~~
FCA
Stourport, England
Enquire, plan and execute
~~~~~~~~~~~~~~~~~~~

Wolf wrote:
> "Wolf" wrote:
>
>> For about 2 months I've had random reboots. It's started shortly
>> after I upgraded to SP3 as well as to Norton Anti-virus 2008. I
>> never get to see the blue screen before it reboots, And had to
>> download the debugger just to read the dump files. I've upgraded the
>> drivers, checked that everything was seated. It doesn't matter what
>> program it happens on, a game, just working with files, etc. The one
>> constant here, and I'm having trouble finding the function in
>> support is: FAILURE_BUCKET_ID: 0xA_W_nt!MiRestoreTransitionPte+6b.
>> What does this call refer to? Physical memory, hard drive, that sort
>> of thing...
>>
>> Microsoft (R) Windows Debugger Version 6.9.0003.113 X86
>> Copyright (c) Microsoft Corporation. All rights reserved.
>>
>>
>> Loading Dump File [C:\WINDOWS\Minidump\Mini061808-02.dmp]
>> Mini Kernel Dump File: Only registers and stack trace are available
>>
>> Symbol search path is: SRV*C:\Program Files\Debugging Tools for
>> Windows (x86)\Symbols*http://msdl.microsoft,com/download/symbols
>> Executable search path is: C:\WINDOWS\system32;
>> C:\WINDOWS\system\system32 Windows XP Kernel Version 2600 (Service
>> Pack 3) UP Free x86 compatible Product: WinNt, suite: TerminalServer
>> SingleUserTS
>> Built by: 2600.xpsp.080413-2111
>> Kernel base = 0x804d7000 PsLoadedModuleList = 0x80553fc0
>> Debug session time: Wed Jun 18 20:26:07.750 2008 (GMT-7)
>> System Uptime: 0 days 0:37:18.315
>> Loading Kernel Symbols
>> .....................................................................................................................................................................................
>> Loading User Symbols
>> Loading unloaded module list
>> ..................................
>> *******************************************************************************
>> *
>> *
>> * Bugcheck Analysis
>> *
>> *
>> *
>> *******************************************************************************
>>
>> Use !analyze -v to get detailed debugging information.
>>
>> BugCheck 1000000A, {4f000010, 2, 1, 80514135}
>>
>> Probably caused by : memory_corruption (
>> nt!MiRestoreTransitionPte+6b )
>>
>> Followup: MachineOwner
>> ---------
>>
>> kd> !analyze -v
>> *******************************************************************************
>> *
>> *
>> * Bugcheck Analysis
>> *
>> *
>> *
>> *******************************************************************************
>>
>> IRQL_NOT_LESS_OR_EQUAL (a)
>> An attempt was made to access a pageable (or completely invalid)
>> address at an interrupt request level (IRQL) that is too high. This
>> is usually
>> caused by drivers using improper addresses.
>> If a kernel debugger is available get the stack backtrace.
>> Arguments:
>> Arg1: 4f000010, memory referenced
>> Arg2: 00000002, IRQL
>> Arg3: 00000001, bitfield :
>> bit 0 : value 0 = read operation, 1 = write operation
>> bit 3 : value 0 = not an execute operation, 1 = execute operation
>> (only on chips which support this level of status)
>> Arg4: 80514135, address which referenced memory
>>
>> Debugging Details:
>> ------------------
>>
>>
>> WRITE_ADDRESS: 4f000010
>>
>> CURRENT_IRQL: 2
>>
>> FAULTING_IP:
>> nt!MiRestoreTransitionPte+6b
>> 80514135 ff4910 dec dword ptr [ecx+10h]
>>
>> CUSTOMER_CRASH_COUNT: 2
>>
>> DEFAULT_BUCKET_ID: DRIVER_FAULT
>>
>> BUGCHECK_STR: 0xA
>>
>> PROCESS_NAME: System
>>
>> LAST_CONTROL_TRANSFER: from 8051ec6d to 80514135
>>
>> STACK_TEXT:
>> bace3aac 8051ec6d e7aea080 ffffffff 8a612408
>> nt!MiRestoreTransitionPte+0x6b bace3ac4 8051f21e 87c265c0 805126d5
>> 8a612438 nt!MiRemovePageFromList+0xd1 bace3acc 805126d5 8a612438
>> 000004c0 00000400 nt!MiRemoveAnyPage+0x56
>> bace3af8 80513210 00010000 87c26634 87c26650
>> nt!MiResolveMappedFileFault+0x3dd bace3b3c 805133ca 00000000
>> ced10000 c0676880 nt!MiResolveProtoPteFault+0x18c bace3bc0 8051cb1c
>> e7aea080 ced10000 c0676880 nt!MiDispatchFault+0xe8
>> bace3c24 80517c78 00000000 ced10000 00000000 nt!MmAccessFault+0x7b4
>> bace3c80 804e0fe7 ced10000 00000000 80550118
>> nt!MmCheckCachedPageState+0x56c bace3d2c 804e620f 8a7b9298 8055b0c0
>> 8a7bb830 nt!CcPerformReadAhead+0x1f1 bace3d74 80534c02 8a7b9298
>> 00000000 8a7bb830 nt!CcWorkerThread+0x147
>> bace3dac 805c6160 8a7b9298 00000000 00000000 nt!ExpWorkerThread+0x100
>> bace3ddc 80541dd2 80534b02 00000000 00000000
>> nt!PspSystemThreadStartup+0x34 00000000 00000000 00000000 00000000
>> 00000000 nt!KiThreadStartup+0x16
>>
>>
>> STACK_COMMAND: kb
>>
>> FOLLOWUP_IP:
>> nt!MiRestoreTransitionPte+6b
>> 80514135 ff4910 dec dword ptr [ecx+10h]
>>
>> SYMBOL_STACK_INDEX: 0
>>
>> SYMBOL_NAME: nt!MiRestoreTransitionPte+6b
>>
>> FOLLOWUP_NAME: MachineOwner
>>
>> MODULE_NAME: nt
>>
>> DEBUG_FLR_IMAGE_TIMESTAMP: 4802516a
>>
>> IMAGE_NAME: memory_corruption
>>
>> FAILURE_BUCKET_ID: 0xA_W_nt!MiRestoreTransitionPte+6b
>>
>> BUCKET_ID: 0xA_W_nt!MiRestoreTransitionPte+6b
>>
>> Followup: MachineOwner
>> ---------
>>
>> kd> lmvm nt
>> start end module name
>> 804d7000 806cf580 nt (pdb symbols) C:\Program
>> Files\Debugging Tools for Windows
>> (x86)\Symbols\ntkrnlpa.pdb\30B5FB31AE7E4ACAABA750AA241FF3311\ntkrnlpa.pdb
>> Loaded symbol image file: ntkrnlpa.exe
>> Mapped memory image file: C:\WINDOWS\system32\ntkrnlpa.exe
>> Image path: ntkrnlpa.exe
>> Image name: ntkrnlpa.exe
>> Timestamp: Sun Apr 13 11:31:06 2008 (4802516A)
>> CheckSum: 00204E7E
>> ImageSize: 001F8580
>> File version: 5.1.2600.5512
>> Product version: 5.1.2600.5512
>> File flags: 0 (Mask 3F)
>> File OS: 40004 NT Win32
>> File type: 1.0 App
>> File date: 00000000.00000000
>> Translations: 0409.04b0
>> CompanyName: Microsoft Corporation
>> ProductName: Microsoft® Windows® Operating System
>> InternalName: ntkrnlpa.exe
>> OriginalFilename: ntkrnlpa.exe
>> ProductVersion: 5.1.2600.5512
>> FileVersion: 5.1.2600.5512 (xpsp.080413-2111)
>> FileDescription: NT Kernel & System
>> LegalCopyright: © Microsoft Corporation. All rights reserved.
>>
>> Please note that I picked an older dump file, The parameters are
>> almost the same in each dump file. The executables in each dump are
>> different, however. The most current one:
>>
>>
>> Microsoft (R) Windows Debugger Version 6.9.0003.113 X86
>> Copyright (c) Microsoft Corporation. All rights reserved.
>>
>>
>> Loading Dump File [C:\WINDOWS\Minidump\Mini081608-01.dmp]
>> Mini Kernel Dump File: Only registers and stack trace are available
>>
>> Symbol search path is: SRV*C:\Program Files\Debugging Tools for
>> Windows (x86)\Symbols*http://msdl.microsoft,com/download/symbols
>> Executable search path is: C:\WINDOWS\system32;
>> C:\WINDOWS\system\system32 Windows XP Kernel Version 2600 (Service
>> Pack 3) UP Free x86 compatible Product: WinNt, suite: TerminalServer
>> SingleUserTS
>> Built by: 2600.xpsp.080413-2111
>> Kernel base = 0x804d7000 PsLoadedModuleList = 0x80553fc0
>> Debug session time: Sat Aug 16 23:39:31.765 2008 (GMT-7)
>> System Uptime: 0 days 2:23:35.349
>> Loading Kernel Symbols
>> .....................................................................................................................................................................................
>> Loading User Symbols
>> Loading unloaded module list
>> ................................
>> *******************************************************************************
>> *
>> *
>> * Bugcheck Analysis
>> *
>> *
>> *
>> *******************************************************************************
>>
>> Use !analyze -v to get detailed debugging information.
>>
>> BugCheck 1000000A, {a080014, 2, 1, 80514135}
>>
>> Probably caused by : memory_corruption (
>> nt!MiRestoreTransitionPte+6b )
>>
>> Followup: MachineOwner
>> ---------
>>
>> kd> !analyze -v
>> *******************************************************************************
>> *
>> *
>> * Bugcheck Analysis
>> *
>> *
>> *
>> *******************************************************************************
>>
>> IRQL_NOT_LESS_OR_EQUAL (a)
>> An attempt was made to access a pageable (or completely invalid)
>> address at an interrupt request level (IRQL) that is too high. This
>> is usually
>> caused by drivers using improper addresses.
>> If a kernel debugger is available get the stack backtrace.
>> Arguments:
>> Arg1: 0a080014, memory referenced
>> Arg2: 00000002, IRQL
>> Arg3: 00000001, bitfield :
>> bit 0 : value 0 = read operation, 1 = write operation
>> bit 3 : value 0 = not an execute operation, 1 = execute operation
>> (only on chips which support this level of status)
>> Arg4: 80514135, address which referenced memory
>>
>> Debugging Details:
>> ------------------
>>
>>
>> WRITE_ADDRESS: 0a080014
>>
>> CURRENT_IRQL: 2
>>
>> FAULTING_IP:
>> nt!MiRestoreTransitionPte+6b
>> 80514135 ff4910 dec dword ptr [ecx+10h]
>>
>> CUSTOMER_CRASH_COUNT: 1
>>
>> DEFAULT_BUCKET_ID: DRIVER_FAULT
>>
>> BUGCHECK_STR: 0xA
>>
>> PROCESS_NAME: WinRAR.exe
>>
>> LAST_CONTROL_TRANSFER: from 8051ec6d to 80514135
>>
>> STACK_TEXT:
>> a9405810 8051ec6d 00000000 ffffffff 9da00000
>> nt!MiRestoreTransitionPte+0x6b a9405828 8051f21e e7dc0c30 80518793
>> 00000000 nt!MiRemovePageFromList+0xd1 a9405830 80518793 00000000
>> c2146000 00001000 nt!MiRemoveAnyPage+0x56
>> a9405924 804e2d61 c2146000 01d29450 00000000
>> nt!MmCopyToCachedPage+0x1f3 a94059b4 804e0d21 87c25c60 01d29450
>> a94059e8 nt!CcMapAndCopy+0x1a9
>> a9405a34 ba646846 87d2bdb8 2ec80ebc 00007ff0 nt!CcFastCopyWrite+0x211
>> a9405a9c ba6d5018 87d2bdb8 a9405b0c 00007ff0
>> Ntfs!NtfsCopyWriteA+0x23d a9405ad0 ba6e0b99 00000004 00000000
>> a9405b04 fltmgr!FltpPerformFastIoCall+0x230
>> a9405b24 ba6c7a27 87d2bdb8 8783b9e0 00007ff0
>> fltmgr!FltpFastIoWrite+0xa9 a9405b58 ba6d5018 87d2bdb8 8783b9e0
>> 00007ff0 sr!SrFastIoWrite+0x77
>> a9405b8c ba6d51e4 00000004 00000000 8783b9d8
>> fltmgr!FltpPerformFastIoCall+0x230
>> a9405bb8 ba6e0c38 00405bd8 01d2430c 8a5eccc0
>> fltmgr!FltpPassThroughFastIo+0x78 a9405bf8 ba6d5018 87d2bdb8
>> a9405c68 00007ff0 fltmgr!FltpFastIoWrite+0x148 a9405c2c ba6e0b99
>> 00000004 00000000 a9405c60 fltmgr!FltpPerformFastIoCall+0x230
>> a9405c80 8057256c 87d2bdb8 a9405cc4 00007ff0
>> fltmgr!FltpFastIoWrite+0xa9 a9405d38 8053d638 000001f4 00000000
>> 00000000 nt!NtWriteFile+0x324
>> a9405d38 7c90e4f4 000001f4 00000000 00000000 nt!KiFastCallEntry+0xf8
>> WARNING: Frame IP not in any known module. Following frames may be
>> wrong. 000eff78 00000000 00000000 00000000 00000000 0x7c90e4f4
>>
>>
>> STACK_COMMAND: kb
>>
>> FOLLOWUP_IP:
>> nt!MiRestoreTransitionPte+6b
>> 80514135 ff4910 dec dword ptr [ecx+10h]
>>
>> SYMBOL_STACK_INDEX: 0
>>
>> SYMBOL_NAME: nt!MiRestoreTransitionPte+6b
>>
>> FOLLOWUP_NAME: MachineOwner
>>
>> MODULE_NAME: nt
>>
>> DEBUG_FLR_IMAGE_TIMESTAMP: 4802516a
>>
>> IMAGE_NAME: memory_corruption
>>
>> FAILURE_BUCKET_ID: 0xA_W_nt!MiRestoreTransitionPte+6b
>>
>> BUCKET_ID: 0xA_W_nt!MiRestoreTransitionPte+6b
>>
>> Followup: MachineOwner
>> ---------
>>
>> kd> lmvm nt
>> start end module name
>> 804d7000 806cf580 nt (pdb symbols) C:\Program
>> Files\Debugging Tools for Windows
>> (x86)\Symbols\ntkrnlpa.pdb\30B5FB31AE7E4ACAABA750AA241FF3311\ntkrnlpa.pdb
>> Loaded symbol image file: ntkrnlpa.exe
>
> Almost forgot, from Event Viewer:
> Error code 1000000a, parameter1 0a080014, parameter2 00000002,
> parameter3 00000001, parameter4 80514135. from the latest one.
>
> From the 15th of August:
> Error code 1000000a, parameter1 00000010, parameter2 00000002,
> parameter3 00000001, parameter4 80514135.
>
> From the 14th...:
> Error code 1000000a, parameter1 0fdd6010, parameter2 00000002,
> parameter3 00000001, parameter4 80514135.
>
> Anyways. that's the way it's been going. Thanks in advance.


Top

Re: Random reboots by databaseben

databaseben
Sun Aug 17 10:55:41 PDT 2008

you might try to
further analyze
your issue by
uninstalling norton.

--

db·´¯`·...¸><)))º>


"Wolf" <Wolf@discussions.microsoft.com> wrote in message news:E39208BF-D890-4C05-A6EB-8AE36B9DA5B8@microsoft.com...
>
>
> "Wolf" wrote:
>
>> For about 2 months I've had random reboots. It's started shortly after I
>> upgraded to SP3 as well as to Norton Anti-virus 2008. I never get to see the
>> blue screen before it reboots, And had to download the debugger just to read
>> the dump files. I've upgraded the drivers, checked that everything was
>> seated. It doesn't matter what program it happens on, a game, just working
>> with files, etc. The one constant here, and I'm having trouble finding the
>> function in support is: FAILURE_BUCKET_ID:
>> 0xA_W_nt!MiRestoreTransitionPte+6b. What does this call refer to? Physical
>> memory, hard drive, that sort of thing...
>>
>> Microsoft (R) Windows Debugger Version 6.9.0003.113 X86
>> Copyright (c) Microsoft Corporation. All rights reserved.
>>
>>
>> Loading Dump File [C:\WINDOWS\Minidump\Mini061808-02.dmp]
>> Mini Kernel Dump File: Only registers and stack trace are available
>>
>> Symbol search path is: SRV*C:\Program Files\Debugging Tools for Windows
>> (x86)\Symbols*http://msdl.microsoft,com/download/symbols
>> Executable search path is: C:\WINDOWS\system32; C:\WINDOWS\system\system32
>> Windows XP Kernel Version 2600 (Service Pack 3) UP Free x86 compatible
>> Product: WinNt, suite: TerminalServer SingleUserTS
>> Built by: 2600.xpsp.080413-2111
>> Kernel base = 0x804d7000 PsLoadedModuleList = 0x80553fc0
>> Debug session time: Wed Jun 18 20:26:07.750 2008 (GMT-7)
>> System Uptime: 0 days 0:37:18.315
>> Loading Kernel Symbols
>> .....................................................................................................................................................................................
>> Loading User Symbols
>> Loading unloaded module list
>> ..................................
>> *******************************************************************************
>> *
>> *
>> * Bugcheck Analysis
>> *
>> *
>> *
>> *******************************************************************************
>>
>> Use !analyze -v to get detailed debugging information.
>>
>> BugCheck 1000000A, {4f000010, 2, 1, 80514135}
>>
>> Probably caused by : memory_corruption ( nt!MiRestoreTransitionPte+6b )
>>
>> Followup: MachineOwner
>> ---------
>>
>> kd> !analyze -v
>> *******************************************************************************
>> *
>> *
>> * Bugcheck Analysis
>> *
>> *
>> *
>> *******************************************************************************
>>
>> IRQL_NOT_LESS_OR_EQUAL (a)
>> An attempt was made to access a pageable (or completely invalid) address at an
>> interrupt request level (IRQL) that is too high. This is usually
>> caused by drivers using improper addresses.
>> If a kernel debugger is available get the stack backtrace.
>> Arguments:
>> Arg1: 4f000010, memory referenced
>> Arg2: 00000002, IRQL
>> Arg3: 00000001, bitfield :
>> bit 0 : value 0 = read operation, 1 = write operation
>> bit 3 : value 0 = not an execute operation, 1 = execute operation (only on
>> chips which support this level of status)
>> Arg4: 80514135, address which referenced memory
>>
>> Debugging Details:
>> ------------------
>>
>>
>> WRITE_ADDRESS: 4f000010
>>
>> CURRENT_IRQL: 2
>>
>> FAULTING_IP:
>> nt!MiRestoreTransitionPte+6b
>> 80514135 ff4910 dec dword ptr [ecx+10h]
>>
>> CUSTOMER_CRASH_COUNT: 2
>>
>> DEFAULT_BUCKET_ID: DRIVER_FAULT
>>
>> BUGCHECK_STR: 0xA
>>
>> PROCESS_NAME: System
>>
>> LAST_CONTROL_TRANSFER: from 8051ec6d to 80514135
>>
>> STACK_TEXT:
>> bace3aac 8051ec6d e7aea080 ffffffff 8a612408 nt!MiRestoreTransitionPte+0x6b
>> bace3ac4 8051f21e 87c265c0 805126d5 8a612438 nt!MiRemovePageFromList+0xd1
>> bace3acc 805126d5 8a612438 000004c0 00000400 nt!MiRemoveAnyPage+0x56
>> bace3af8 80513210 00010000 87c26634 87c26650 nt!MiResolveMappedFileFault+0x3dd
>> bace3b3c 805133ca 00000000 ced10000 c0676880 nt!MiResolveProtoPteFault+0x18c
>> bace3bc0 8051cb1c e7aea080 ced10000 c0676880 nt!MiDispatchFault+0xe8
>> bace3c24 80517c78 00000000 ced10000 00000000 nt!MmAccessFault+0x7b4
>> bace3c80 804e0fe7 ced10000 00000000 80550118 nt!MmCheckCachedPageState+0x56c
>> bace3d2c 804e620f 8a7b9298 8055b0c0 8a7bb830 nt!CcPerformReadAhead+0x1f1
>> bace3d74 80534c02 8a7b9298 00000000 8a7bb830 nt!CcWorkerThread+0x147
>> bace3dac 805c6160 8a7b9298 00000000 00000000 nt!ExpWorkerThread+0x100
>> bace3ddc 80541dd2 80534b02 00000000 00000000 nt!PspSystemThreadStartup+0x34
>> 00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16
>>
>>
>> STACK_COMMAND: kb
>>
>> FOLLOWUP_IP:
>> nt!MiRestoreTransitionPte+6b
>> 80514135 ff4910 dec dword ptr [ecx+10h]
>>
>> SYMBOL_STACK_INDEX: 0
>>
>> SYMBOL_NAME: nt!MiRestoreTransitionPte+6b
>>
>> FOLLOWUP_NAME: MachineOwner
>>
>> MODULE_NAME: nt
>>
>> DEBUG_FLR_IMAGE_TIMESTAMP: 4802516a
>>
>> IMAGE_NAME: memory_corruption
>>
>> FAILURE_BUCKET_ID: 0xA_W_nt!MiRestoreTransitionPte+6b
>>
>> BUCKET_ID: 0xA_W_nt!MiRestoreTransitionPte+6b
>>
>> Followup: MachineOwner
>> ---------
>>
>> kd> lmvm nt
>> start end module name
>> 804d7000 806cf580 nt (pdb symbols) C:\Program
>> Files\Debugging Tools for Windows
>> (x86)\Symbols\ntkrnlpa.pdb\30B5FB31AE7E4ACAABA750AA241FF3311\ntkrnlpa.pdb
>> Loaded symbol image file: ntkrnlpa.exe
>> Mapped memory image file: C:\WINDOWS\system32\ntkrnlpa.exe
>> Image path: ntkrnlpa.exe
>> Image name: ntkrnlpa.exe
>> Timestamp: Sun Apr 13 11:31:06 2008 (4802516A)
>> CheckSum: 00204E7E
>> ImageSize: 001F8580
>> File version: 5.1.2600.5512
>> Product version: 5.1.2600.5512
>> File flags: 0 (Mask 3F)
>> File OS: 40004 NT Win32
>> File type: 1.0 App
>> File date: 00000000.00000000
>> Translations: 0409.04b0
>> CompanyName: Microsoft Corporation
>> ProductName: Microsoft® Windows® Operating System
>> InternalName: ntkrnlpa.exe
>> OriginalFilename: ntkrnlpa.exe
>> ProductVersion: 5.1.2600.5512
>> FileVersion: 5.1.2600.5512 (xpsp.080413-2111)
>> FileDescription: NT Kernel & System
>> LegalCopyright: © Microsoft Corporation. All rights reserved.
>>
>> Please note that I picked an older dump file, The parameters are almost the
>> same in each dump file. The executables in each dump are different, however.
>> The most current one:
>>
>>
>> Microsoft (R) Windows Debugger Version 6.9.0003.113 X86
>> Copyright (c) Microsoft Corporation. All rights reserved.
>>
>>
>> Loading Dump File [C:\WINDOWS\Minidump\Mini081608-01.dmp]
>> Mini Kernel Dump File: Only registers and stack trace are available
>>
>> Symbol search path is: SRV*C:\Program Files\Debugging Tools for Windows
>> (x86)\Symbols*http://msdl.microsoft,com/download/symbols
>> Executable search path is: C:\WINDOWS\system32; C:\WINDOWS\system\system32
>> Windows XP Kernel Version 2600 (Service Pack 3) UP Free x86 compatible
>> Product: WinNt, suite: TerminalServer SingleUserTS
>> Built by: 2600.xpsp.080413-2111
>> Kernel base = 0x804d7000 PsLoadedModuleList = 0x80553fc0
>> Debug session time: Sat Aug 16 23:39:31.765 2008 (GMT-7)
>> System Uptime: 0 days 2:23:35.349
>> Loading Kernel Symbols
>> .....................................................................................................................................................................................
>> Loading User Symbols
>> Loading unloaded module list
>> ................................
>> *******************************************************************************
>> *
>> *
>> * Bugcheck Analysis
>> *
>> *
>> *
>> *******************************************************************************
>>
>> Use !analyze -v to get detailed debugging information.
>>
>> BugCheck 1000000A, {a080014, 2, 1, 80514135}
>>
>> Probably caused by : memory_corruption ( nt!MiRestoreTransitionPte+6b )
>>
>> Followup: MachineOwner
>> ---------
>>
>> kd> !analyze -v
>> *******************************************************************************
>> *
>> *
>> * Bugcheck Analysis
>> *
>> *
>> *
>> *******************************************************************************
>>
>> IRQL_NOT_LESS_OR_EQUAL (a)
>> An attempt was made to access a pageable (or completely invalid) address at an
>> interrupt request level (IRQL) that is too high. This is usually
>> caused by drivers using improper addresses.
>> If a kernel debugger is available get the stack backtrace.
>> Arguments:
>> Arg1: 0a080014, memory referenced
>> Arg2: 00000002, IRQL
>> Arg3: 00000001, bitfield :
>> bit 0 : value 0 = read operation, 1 = write operation
>> bit 3 : value 0 = not an execute operation, 1 = execute operation (only on
>> chips which support this level of status)
>> Arg4: 80514135, address which referenced memory
>>
>> Debugging Details:
>> ------------------
>>
>>
>> WRITE_ADDRESS: 0a080014
>>
>> CURRENT_IRQL: 2
>>
>> FAULTING_IP:
>> nt!MiRestoreTransitionPte+6b
>> 80514135 ff4910 dec dword ptr [ecx+10h]
>>
>> CUSTOMER_CRASH_COUNT: 1
>>
>> DEFAULT_BUCKET_ID: DRIVER_FAULT
>>
>> BUGCHECK_STR: 0xA
>>
>> PROCESS_NAME: WinRAR.exe
>>
>> LAST_CONTROL_TRANSFER: from 8051ec6d to 80514135
>>
>> STACK_TEXT:
>> a9405810 8051ec6d 00000000 ffffffff 9da00000 nt!MiRestoreTransitionPte+0x6b
>> a9405828 8051f21e e7dc0c30 80518793 00000000 nt!MiRemovePageFromList+0xd1
>> a9405830 80518793 00000000 c2146000 00001000 nt!MiRemoveAnyPage+0x56
>> a9405924 804e2d61 c2146000 01d29450 00000000 nt!MmCopyToCachedPage+0x1f3
>> a94059b4 804e0d21 87c25c60 01d29450 a94059e8 nt!CcMapAndCopy+0x1a9
>> a9405a34 ba646846 87d2bdb8 2ec80ebc 00007ff0 nt!CcFastCopyWrite+0x211
>> a9405a9c ba6d5018 87d2bdb8 a9405b0c 00007ff0 Ntfs!NtfsCopyWriteA+0x23d
>> a9405ad0 ba6e0b99 00000004 00000000 a9405b04
>> fltmgr!FltpPerformFastIoCall+0x230
>> a9405b24 ba6c7a27 87d2bdb8 8783b9e0 00007ff0 fltmgr!FltpFastIoWrite+0xa9
>> a9405b58 ba6d5018 87d2bdb8 8783b9e0 00007ff0 sr!SrFastIoWrite+0x77
>> a9405b8c ba6d51e4 00000004 00000000 8783b9d8
>> fltmgr!FltpPerformFastIoCall+0x230
>> a9405bb8 ba6e0c38 00405bd8 01d2430c 8a5eccc0 fltmgr!FltpPassThroughFastIo+0x78
>> a9405bf8 ba6d5018 87d2bdb8 a9405c68 00007ff0 fltmgr!FltpFastIoWrite+0x148
>> a9405c2c ba6e0b99 00000004 00000000 a9405c60
>> fltmgr!FltpPerformFastIoCall+0x230
>> a9405c80 8057256c 87d2bdb8 a9405cc4 00007ff0 fltmgr!FltpFastIoWrite+0xa9
>> a9405d38 8053d638 000001f4 00000000 00000000 nt!NtWriteFile+0x324
>> a9405d38 7c90e4f4 000001f4 00000000 00000000 nt!KiFastCallEntry+0xf8
>> WARNING: Frame IP not in any known module. Following frames may be wrong.
>> 000eff78 00000000 00000000 00000000 00000000 0x7c90e4f4
>>
>>
>> STACK_COMMAND: kb
>>
>> FOLLOWUP_IP:
>> nt!MiRestoreTransitionPte+6b
>> 80514135 ff4910 dec dword ptr [ecx+10h]
>>
>> SYMBOL_STACK_INDEX: 0
>>
>> SYMBOL_NAME: nt!MiRestoreTransitionPte+6b
>>
>> FOLLOWUP_NAME: MachineOwner
>>
>> MODULE_NAME: nt
>>
>> DEBUG_FLR_IMAGE_TIMESTAMP: 4802516a
>>
>> IMAGE_NAME: memory_corruption
>>
>> FAILURE_BUCKET_ID: 0xA_W_nt!MiRestoreTransitionPte+6b
>>
>> BUCKET_ID: 0xA_W_nt!MiRestoreTransitionPte+6b
>>
>> Followup: MachineOwner
>> ---------
>>
>> kd> lmvm nt
>> start end module name
>> 804d7000 806cf580 nt (pdb symbols) C:\Program
>> Files\Debugging Tools for Windows
>> (x86)\Symbols\ntkrnlpa.pdb\30B5FB31AE7E4ACAABA750AA241FF3311\ntkrnlpa.pdb
>> Loaded symbol image file: ntkrnlpa.exe
>
> Almost forgot, from Event Viewer:
> Error code 1000000a, parameter1 0a080014, parameter2 00000002, parameter3
> 00000001, parameter4 80514135. from the latest one.
>
> From the 15th of August:
> Error code 1000000a, parameter1 00000010, parameter2 00000002, parameter3
> 00000001, parameter4 80514135.
>
> From the 14th...:
> Error code 1000000a, parameter1 0fdd6010, parameter2 00000002, parameter3
> 00000001, parameter4 80514135.
>
> Anyways. that's the way it's been going. Thanks in advance.

Top

Re: Random reboots by Wolf

Wolf
Sun Aug 17 11:24:01 PDT 2008

Thanks. I'll try both the suggestions. This was a very reliable system before
a few months ago. I have other PC's to work from, but this one has the
horsepower to do dang near anything. Hate to lose it for something like this,
even for a short time. One more thing, as in my first post, this is a
recurring theme: MiRestoreTransitionPte+6b... In english, what's it refer to?

"db.·.. ><))) ·>` .. ." wrote:

> you might try to
> further analyze
> your issue by
> uninstalling norton.
>
> --
>
> db·´¯`·...¸><)))º>
>
>
> "Wolf" <Wolf@discussions.microsoft.com> wrote in message news:E39208BF-D890-4C05-A6EB-8AE36B9DA5B8@microsoft.com...
> >
> >
> > "Wolf" wrote:
> >
> >> For about 2 months I've had random reboots. It's started shortly after I
> >> upgraded to SP3 as well as to Norton Anti-virus 2008. I never get to see the
> >> blue screen before it reboots, And had to download the debugger just to read
> >> the dump files. I've upgraded the drivers, checked that everything was
> >> seated. It doesn't matter what program it happens on, a game, just working
> >> with files, etc. The one constant here, and I'm having trouble finding the
> >> function in support is: FAILURE_BUCKET_ID:
> >> 0xA_W_nt!MiRestoreTransitionPte+6b. What does this call refer to? Physical
> >> memory, hard drive, that sort of thing...
> >>
> >> Microsoft (R) Windows Debugger Version 6.9.0003.113 X86
> >> Copyright (c) Microsoft Corporation. All rights reserved.
> >>
> >>
> >> Loading Dump File [C:\WINDOWS\Minidump\Mini061808-02.dmp]
> >> Mini Kernel Dump File: Only registers and stack trace are available
> >>
> >> Symbol search path is: SRV*C:\Program Files\Debugging Tools for Windows
> >> (x86)\Symbols*http://msdl.microsoft,com/download/symbols
> >> Executable search path is: C:\WINDOWS\system32; C:\WINDOWS\system\system32
> >> Windows XP Kernel Version 2600 (Service Pack 3) UP Free x86 compatible
> >> Product: WinNt, suite: TerminalServer SingleUserTS
> >> Built by: 2600.xpsp.080413-2111
> >> Kernel base = 0x804d7000 PsLoadedModuleList = 0x80553fc0
> >> Debug session time: Wed Jun 18 20:26:07.750 2008 (GMT-7)
> >> System Uptime: 0 days 0:37:18.315
> >> Loading Kernel Symbols
> >> .....................................................................................................................................................................................
> >> Loading User Symbols
> >> Loading unloaded module list
> >> ..................................
> >> *******************************************************************************
> >> *
> >> *
> >> * Bugcheck Analysis
> >> *
> >> *
> >> *
> >> *******************************************************************************
> >>
> >> Use !analyze -v to get detailed debugging information.
> >>
> >> BugCheck 1000000A, {4f000010, 2, 1, 80514135}
> >>
> >> Probably caused by : memory_corruption ( nt!MiRestoreTransitionPte+6b )
> >>
> >> Followup: MachineOwner
> >> ---------
> >>
> >> kd> !analyze -v
> >> *******************************************************************************
> >> *
> >> *
> >> * Bugcheck Analysis
> >> *
> >> *
> >> *
> >> *******************************************************************************
> >>
> >> IRQL_NOT_LESS_OR_EQUAL (a)
> >> An attempt was made to access a pageable (or completely invalid) address at an
> >> interrupt request level (IRQL) that is too high. This is usually
> >> caused by drivers using improper addresses.
> >> If a kernel debugger is available get the stack backtrace.
> >> Arguments:
> >> Arg1: 4f000010, memory referenced
> >> Arg2: 00000002, IRQL
> >> Arg3: 00000001, bitfield :
> >> bit 0 : value 0 = read operation, 1 = write operation
> >> bit 3 : value 0 = not an execute operation, 1 = execute operation (only on
> >> chips which support this level of status)
> >> Arg4: 80514135, address which referenced memory
> >>
> >> Debugging Details:
> >> ------------------
> >>
> >>
> >> WRITE_ADDRESS: 4f000010
> >>
> >> CURRENT_IRQL: 2
> >>
> >> FAULTING_IP:
> >> nt!MiRestoreTransitionPte+6b
> >> 80514135 ff4910 dec dword ptr [ecx+10h]
> >>
> >> CUSTOMER_CRASH_COUNT: 2
> >>
> >> DEFAULT_BUCKET_ID: DRIVER_FAULT
> >>
> >> BUGCHECK_STR: 0xA
> >>
> >> PROCESS_NAME: System
> >>
> >> LAST_CONTROL_TRANSFER: from 8051ec6d to 80514135
> >>
> >> STACK_TEXT:
> >> bace3aac 8051ec6d e7aea080 ffffffff 8a612408 nt!MiRestoreTransitionPte+0x6b
> >> bace3ac4 8051f21e 87c265c0 805126d5 8a612438 nt!MiRemovePageFromList+0xd1
> >> bace3acc 805126d5 8a612438 000004c0 00000400 nt!MiRemoveAnyPage+0x56
> >> bace3af8 80513210 00010000 87c26634 87c26650 nt!MiResolveMappedFileFault+0x3dd
> >> bace3b3c 805133ca 00000000 ced10000 c0676880 nt!MiResolveProtoPteFault+0x18c
> >> bace3bc0 8051cb1c e7aea080 ced10000 c0676880 nt!MiDispatchFault+0xe8
> >> bace3c24 80517c78 00000000 ced10000 00000000 nt!MmAccessFault+0x7b4
> >> bace3c80 804e0fe7 ced10000 00000000 80550118 nt!MmCheckCachedPageState+0x56c
> >> bace3d2c 804e620f 8a7b9298 8055b0c0 8a7bb830 nt!CcPerformReadAhead+0x1f1
> >> bace3d74 80534c02 8a7b9298 00000000 8a7bb830 nt!CcWorkerThread+0x147
> >> bace3dac 805c6160 8a7b9298 00000000 00000000 nt!ExpWorkerThread+0x100
> >> bace3ddc 80541dd2 80534b02 00000000 00000000 nt!PspSystemThreadStartup+0x34
> >> 00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16
> >>
> >>
> >> STACK_COMMAND: kb
> >>
> >> FOLLOWUP_IP:
> >> nt!MiRestoreTransitionPte+6b
> >> 80514135 ff4910 dec dword ptr [ecx+10h]
> >>
> >> SYMBOL_STACK_INDEX: 0
> >>
> >> SYMBOL_NAME: nt!MiRestoreTransitionPte+6b
> >>
> >> FOLLOWUP_NAME: MachineOwner
> >>
> >> MODULE_NAME: nt
> >>
> >> DEBUG_FLR_IMAGE_TIMESTAMP: 4802516a
> >>
> >> IMAGE_NAME: memory_corruption
> >>
> >> FAILURE_BUCKET_ID: 0xA_W_nt!MiRestoreTransitionPte+6b
> >>
> >> BUCKET_ID: 0xA_W_nt!MiRestoreTransitionPte+6b
> >>
> >> Followup: MachineOwner
> >> ---------
> >>
> >> kd> lmvm nt
> >> start end module name
> >> 804d7000 806cf580 nt (pdb symbols) C:\Program
> >> Files\Debugging Tools for Windows
> >> (x86)\Symbols\ntkrnlpa.pdb\30B5FB31AE7E4ACAABA750AA241FF3311\ntkrnlpa.pdb
> >> Loaded symbol image file: ntkrnlpa.exe
> >> Mapped memory image file: C:\WINDOWS\system32\ntkrnlpa.exe
> >> Image path: ntkrnlpa.exe
> >> Image name: ntkrnlpa.exe
> >> Timestamp: Sun Apr 13 11:31:06 2008 (4802516A)
> >> CheckSum: 00204E7E
> >> ImageSize: 001F8580
> >> File version: 5.1.2600.5512
> >> Product version: 5.1.2600.5512
> >> File flags: 0 (Mask 3F)
> >> File OS: 40004 NT Win32
> >> File type: 1.0 App
> >> File date: 00000000.00000000
> >> Translations: 0409.04b0
> >> CompanyName: Microsoft Corporation
> >> ProductName: Microsoft® Windows® Operating System
> >> InternalName: ntkrnlpa.exe
> >> OriginalFilename: ntkrnlpa.exe
> >> ProductVersion: 5.1.2600.5512
> >> FileVersion: 5.1.2600.5512 (xpsp.080413-2111)
> >> FileDescription: NT Kernel & System
> >> LegalCopyright: © Microsoft Corporation. All rights reserved.
> >>
> >> Please note that I picked an older dump file, The parameters are almost the
> >> same in each dump file. The executables in each dump are different, however.
> >> The most current one:
> >>
> >>
> >> Microsoft (R) Windows Debugger Version 6.9.0003.113 X86
> >> Copyright (c) Microsoft Corporation. All rights reserved.
> >>
> >>
> >> Loading Dump File [C:\WINDOWS\Minidump\Mini081608-01.dmp]
> >> Mini Kernel Dump File: Only registers and stack trace are available
> >>
> >> Symbol search path is: SRV*C:\Program Files\Debugging Tools for Windows
> >> (x86)\Symbols*http://msdl.microsoft,com/download/symbols
> >> Executable search path is: C:\WINDOWS\system32; C:\WINDOWS\system\system32
> >> Windows XP Kernel Version 2600 (Service Pack 3) UP Free x86 compatible
> >> Product: WinNt, suite: TerminalServer SingleUserTS
> >> Built by: 2600.xpsp.080413-2111
> >> Kernel base = 0x804d7000 PsLoadedModuleList = 0x80553fc0
> >> Debug session time: Sat Aug 16 23:39:31.765 2008 (GMT-7)
> >> System Uptime: 0 days 2:23:35.349
> >> Loading Kernel Symbols
> >> .....................................................................................................................................................................................
> >> Loading User Symbols
> >> Loading unloaded module list
> >> ................................
> >> *******************************************************************************
> >> *
> >> *
> >> * Bugcheck Analysis
> >> *
> >> *
> >> *
> >> *******************************************************************************
> >>
> >> Use !analyze -v to get detailed debugging information.
> >>
> >> BugCheck 1000000A, {a080014, 2, 1, 80514135}
> >>
> >> Probably caused by : memory_corruption ( nt!MiRestoreTransitionPte+6b )
> >>
> >> Fo