Random Restarts

Bebiko · 09 Jun 2011

Hello SevenForums, i really need some help...i just started having problems with my pc it seems it's getting restarted really often...here si the event log:

Event xmlns="Error">
- <System>
<Provider Name="Microsoft-Windows-Kernel-Power" Guid="{331C3B3A-2005-44C2-AC5E-77220C37D6B4}" />

<EventID>41</EventID>

<Version>2</Version>

<Level>1</Level>

<Task>63</Task>

<Opcode>0</Opcode>

<Keywords>0x8000000000000002</Keywords>

<TimeCreated SystemTime="2011-06-09T13:14:15.125000000Z" />

<EventRecordID>130135</EventRecordID>

<Correlation />

<Execution ProcessID="4" ThreadID="8" />

<Channel>System</Channel>

<Computer>Bebiko-PC</Computer>

<Security UserID="S-1-5-18" />

</System>

- <EventData>
<Data Name="BugcheckCode">0</Data>

<Data Name="BugcheckParameter1">0x0</Data>

<Data Name="BugcheckParameter2">0x0</Data>

<Data Name="BugcheckParameter3">0x0</Data>

<Data Name="BugcheckParameter4">0x0</Data>

<Data Name="SleepInProgress">false</Data>

<Data Name="PowerButtonTimestamp">0</Data>

</EventData>

</Event>

PS: there is no BSOD just random restarts.

Maguscreed · 09 Jun 2011

If no crash files are being created my first guess would be a hardware level failure.

Does this problem occur if the computer is started in safe mode?

Bebiko · 09 Jun 2011

No the problem does not occur if the computer is started in safe mode...Well I actually turned off the Automatic Restart thingy in win7 and its stable now. No restarts so far...i'll come back if anything occurs. But still it is frustrating knowing there is something wrong.

Maguscreed · 09 Jun 2011

Well if you really want to push it, it's probably a driver related issue, we can possibly force it to crash and generate a dump file to be analyzed by the people here, but the procedure is can be a pain and leave you in a situation where you need to recover just to boot again.

Anyhow here's the instructions I leave it up to you whether you're willing to go to the trouble or not.
Driver Verifier - Enable and Disable

Bebiko · 09 Jun 2011

I'll do it i'll come with feedback :) Thank you for the quick replies.

Bebiko · 10 Jun 2011

Yes...you were right, BSOD immediatly after the reboot ...here is the dmp file

Bebiko · 10 Jun 2011

Also here:
- <Event xmlns="Error">
- <System>
<Provider Name="Microsoft-Windows-WER-SystemErrorReporting" Guid="{ABCE23E7-DE45-4366-8631-84FA6C525952}" EventSourceName="BugCheck" />

<EventID Qualifiers="16384">1001</EventID>

<Version>0</Version>

<Level>2</Level>

<Task>0</Task>

<Opcode>0</Opcode>

<Keywords>0x80000000000000</Keywords>

<TimeCreated SystemTime="2011-06-10T08:43:54.000000000Z" />

<EventRecordID>133056</EventRecordID>

<Correlation />

<Execution ProcessID="0" ThreadID="0" />

<Channel>System</Channel>

<Computer>BEBIKO-PC</Computer>

<Security />

</System>

- <EventData>
<Data Name="param1">0x000000cd (0x91b83000, 0x00000000, 0x83026309, 0x00000000)</Data>

<Data Name="param2">C:\Windows\MEMORY.DMP</Data>

<Data Name="param3">061011-21062-01</Data>

</EventData>

</Event>

Maguscreed · 10 Jun 2011

It's the ati tool overclocking software.

copied from driver reference site:
ATITool.sys Fri Nov 10 08:08:51 2006 (455479E3) Overclocking utility for ATI/nVidia cards - will only work on Windows 2000/XP/2003 ATITool - Overclocking utility for ATI and NVIDIA cards

Code:

PAGE_FAULT_BEYOND_END_OF_ALLOCATION (cd)
N bytes of memory was allocated and more than N bytes are being referenced.
This cannot be protected by try-except.
When possible, the guilty driver's name (Unicode string) is printed on
the bugcheck screen and saved in KiBugCheckDriver.
Arguments:
Arg1: 91b83000, memory referenced
Arg2: 00000000, value 0 = read operation, 1 = write operation
Arg3: 83026309, if non-zero, the address which referenced memory.
Arg4: 00000000, Mm internal code.

Debugging Details:
------------------

Unable to load image \SystemRoot\system32\DRIVERS\ATITool.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ATITool.sys
*** ERROR: Module load completed but symbols could not be loaded for ATITool.sys

READ_ADDRESS: GetPointerFromAddress: unable to read from 83168700
Unable to read MiSystemVaType memory at 83148100
 91b83000 

FAULTING_IP: 
nt!wcsrchr+a
83026309 668b08          mov     cx,word ptr [eax]

MM_INTERNAL_CODE:  0

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VERIFIER_ENABLED_VISTA_MINIDUMP

BUGCHECK_STR:  0xCD

PROCESS_NAME:  System

CURRENT_IRQL:  0

TRAP_FRAME:  80d86928 -- (.trap 0xffffffff80d86928)
ErrCode = 00000000
eax=91b83000 ebx=920e60a0 ecx=0000a5a5 edx=91b82fe0 esi=8d301568 edi=920e60c0
eip=83026309 esp=80d8699c ebp=80d8699c iopl=0         nv up ei ng nz na pe nc
cs=0008  ss=0010  ds=0023  es=0023  fs=0030  gs=0000             efl=00210286
nt!wcsrchr+0xa:
83026309 668b08          mov     cx,word ptr [eax]        ds:0023:91b83000=????
Resetting default scope

LAST_CONTROL_TRANSFER:  from 83040a68 to 83066d57

STACK_TEXT:  
80d86910 83040a68 00000000 91b83000 00000000 nt!MmAccessFault+0xbf
80d86910 83026309 00000000 91b83000 00000000 nt!KiTrap0E+0xdc
80d8699c 920e0017 91b82fe0 0000005c 8d2fb000 nt!wcsrchr+0xa
WARNING: Stack unwind information not available. Following frames may be wrong.
80d869b8 831c2358 8d301568 8d2fb000 00000000 ATITool+0x2017
00000000 00000000 00000000 00000000 00000000 nt!IopLoadDriver+0x7ed


STACK_COMMAND:  kb

FOLLOWUP_IP: 
ATITool+2017
920e0017 ??              ???

SYMBOL_STACK_INDEX:  3

SYMBOL_NAME:  ATITool+2017

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: ATITool

IMAGE_NAME:  ATITool.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  455479e3

FAILURE_BUCKET_ID:  0xCD_VRF_ATITool+2017

BUCKET_ID:  0xCD_VRF_ATITool+2017

Followup: MachineOwner
---------

Bebiko · 10 Jun 2011

What should i do ?

Maguscreed · 10 Jun 2011

Well turn driver verifier back off and remove atitool.