Windows 7: Random Restarts

Bebiko · 09 Jun 2011

Hello SevenForums, i really need some help...i just started having problems with my pc it seems it's getting restarted really often...here si the event log:

Event xmlns="Error">
- <System>
<Provider Name="Microsoft-Windows-Kernel-Power" Guid="{331C3B3A-2005-44C2-AC5E-77220C37D6B4}" />

<EventID>41</EventID>

<Version>2</Version>

<Level>1</Level>

<Task>63</Task>

<Opcode>0</Opcode>

<Keywords>0x8000000000000002</Keywords>

<TimeCreated SystemTime="2011-06-09T13:14:15.125000000Z" />

<EventRecordID>130135</EventRecordID>

<Correlation />

<Execution ProcessID="4" ThreadID="8" />

<Channel>System</Channel>

<Computer>Bebiko-PC</Computer>

<Security UserID="S-1-5-18" />

</System>

- <EventData>
<Data Name="BugcheckCode">0</Data>

<Data Name="BugcheckParameter1">0x0</Data>

<Data Name="BugcheckParameter2">0x0</Data>

<Data Name="BugcheckParameter3">0x0</Data>

<Data Name="BugcheckParameter4">0x0</Data>

<Data Name="SleepInProgress">false</Data>

<Data Name="PowerButtonTimestamp">0</Data>

</EventData>

</Event>

PS: there is no BSOD just random restarts.

Maguscreed · 09 Jun 2011

If no crash files are being created my first guess would be a hardware level failure.

Does this problem occur if the computer is started in safe mode?

Bebiko · 09 Jun 2011

No the problem does not occur if the computer is started in safe mode...Well I actually turned off the Automatic Restart thingy in Windows 7 and its stable now. No restarts so far...i'll come back if anything occurs. But still it is frustrating knowing there is something wrong.

Maguscreed · 09 Jun 2011

Well if you really want to push it, it's probably a driver related issue, we can possibly force it to crash and generate a dump file to be analyzed by the people here, but the procedure is can be a pain and leave you in a situation where you need to recover just to boot again.

Anyhow here's the instructions I leave it up to you whether you're willing to go to the trouble or not.
Driver Verifier - Enable and Disable

Bebiko · 09 Jun 2011

I'll do it i'll come with feedback

Thank you for the quick replies.

Bebiko · 10 Jun 2011

Yes...you were right, BSOD immediatly after the reboot ...here is the dmp file

Bebiko · 10 Jun 2011

Also here:
- <Event xmlns="Error">
- <System>
<Provider Name="Microsoft-Windows-WER-SystemErrorReporting" Guid="{ABCE23E7-DE45-4366-8631-84FA6C525952}" EventSourceName="BugCheck" />

<EventID Qualifiers="16384">1001</EventID>

<Version>0</Version>

<Level>2</Level>

<Task>0</Task>

<Opcode>0</Opcode>

<Keywords>0x80000000000000</Keywords>

<TimeCreated SystemTime="2011-06-10T08:43:54.000000000Z" />

<EventRecordID>133056</EventRecordID>

<Correlation />

<Execution ProcessID="0" ThreadID="0" />

<Channel>System</Channel>

<Computer>BEBIKO-PC</Computer>

<Security />

</System>

- <EventData>
<Data Name="param1">0x000000cd (0x91b83000, 0x00000000, 0x83026309, 0x00000000)</Data>

<Data Name="param2">C:\Windows\MEMORY.DMP</Data>

<Data Name="param3">061011-21062-01</Data>

</EventData>

</Event>

Maguscreed · 10 Jun 2011

It's the ati tool overclocking software.

copied from driver reference site:
ATITool.sys Fri Nov 10 08:08:51 2006 (455479E3) Overclocking utility for ATI/nVidia cards - will only work on Windows 2000/XP/2003 ATITool - Overclocking utility for ATI and NVIDIA cards

Code:

PAGE_FAULT_BEYOND_END_OF_ALLOCATION (cd)
N bytes of memory was allocated and more than N bytes are being referenced.
This cannot be protected by try-except.
When possible, the guilty driver's name (Unicode string) is printed on
the bugcheck screen and saved in KiBugCheckDriver.
Arguments:
Arg1: 91b83000, memory referenced
Arg2: 00000000, value 0 = read operation, 1 = write operation
Arg3: 83026309, if non-zero, the address which referenced memory.
Arg4: 00000000, Mm internal code.

Debugging Details:
------------------

Unable to load image \SystemRoot\system32\DRIVERS\ATITool.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ATITool.sys
*** ERROR: Module load completed but symbols could not be loaded for ATITool.sys

READ_ADDRESS: GetPointerFromAddress: unable to read from 83168700
Unable to read MiSystemVaType memory at 83148100
 91b83000 

FAULTING_IP: 
nt!wcsrchr+a
83026309 668b08          mov     cx,word ptr [eax]

MM_INTERNAL_CODE:  0

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VERIFIER_ENABLED_VISTA_MINIDUMP

BUGCHECK_STR:  0xCD

PROCESS_NAME:  System

CURRENT_IRQL:  0

TRAP_FRAME:  80d86928 -- (.trap 0xffffffff80d86928)
ErrCode = 00000000
eax=91b83000 ebx=920e60a0 ecx=0000a5a5 edx=91b82fe0 esi=8d301568 edi=920e60c0
eip=83026309 esp=80d8699c ebp=80d8699c iopl=0         nv up ei ng nz na pe nc
cs=0008  ss=0010  ds=0023  es=0023  fs=0030  gs=0000             efl=00210286
nt!wcsrchr+0xa:
83026309 668b08          mov     cx,word ptr [eax]        ds:0023:91b83000=????
Resetting default scope

LAST_CONTROL_TRANSFER:  from 83040a68 to 83066d57

STACK_TEXT:  
80d86910 83040a68 00000000 91b83000 00000000 nt!MmAccessFault+0xbf
80d86910 83026309 00000000 91b83000 00000000 nt!KiTrap0E+0xdc
80d8699c 920e0017 91b82fe0 0000005c 8d2fb000 nt!wcsrchr+0xa
WARNING: Stack unwind information not available. Following frames may be wrong.
80d869b8 831c2358 8d301568 8d2fb000 00000000 ATITool+0x2017
00000000 00000000 00000000 00000000 00000000 nt!IopLoadDriver+0x7ed


STACK_COMMAND:  kb

FOLLOWUP_IP: 
ATITool+2017
920e0017 ??              ???

SYMBOL_STACK_INDEX:  3

SYMBOL_NAME:  ATITool+2017

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: ATITool

IMAGE_NAME:  ATITool.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  455479e3

FAILURE_BUCKET_ID:  0xCD_VRF_ATITool+2017

BUCKET_ID:  0xCD_VRF_ATITool+2017

Followup: MachineOwner
---------

Bebiko · 10 Jun 2011

What should i do ?

Maguscreed · 10 Jun 2011

Well turn driver verifier back off and remove atitool.

Windows 7: Random Restarts

Random Restarts problems?