[XP] Reboot van PC. Minidumps uitgelezen

[Ralphie]

Sinds 28 januari zit ik hier met een systeem dat een aantal keer per dag spontaan reboot. De minidumps die worden wegschreven hebben allen betrekking op NTOSKRNL.exe. Verdere analyze vertelt mij dat de fout daarin word veroorzaakt door een:

KERNEL_MODE_EXCEPTION_NOT_HANDLED_M (1000008e) error.

PC is al helemaal nagekeken op hardware fouten (Memtest, HotCPU). Deze vertonen geen fouten. Systeem wordt ook niet te heet.

Misschien dat een van jullie nog iets meer info uit deze minidump kunnen halen, zodat ik hopelijk het hele systeem niet opnieuw hoef te installeren?

Loading Dump File [C:\Documents and Settings\Ralf.IQDOMAIN2\Desktop\minidump wim\Mini020206-03.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols

Executable search path is: C:\WINDOWS\
Windows XP Kernel Version 2600 (Service Pack 2) UP Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 2600.xpsp_sp2_gdr.050301-1519
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055a420
Debug session time: Thu Feb 2 07:06:19.390 2006 (GMT+1)
System Uptime: 0 days 0:48:32.500
Loading Kernel Symbols
............................................................................................................
Loading User Symbols
Loading unloaded module list
.
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1000008E, {c0000005, 818f75d0, f543bcb0, 0}

Probably caused by : ntoskrnl.exe ( nt!KiFastCallEntry+f8 )

Followup: MachineOwner
---------

kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

KERNEL_MODE_EXCEPTION_NOT_HANDLED_M (1000008e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003. This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG. This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG. This will let us see why this breakpoint is
happening.
Arguments:
Arg1: c0000005, The exception code that was not handled
Arg2: 818f75d0, The address that the exception occurred at
Arg3: f543bcb0, Trap Frame
Arg4: 00000000

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx". The memory could not be "%s".

FAULTING_IP:
+ffffffff818f75d0
818f75d0 033e add edi,[esi]

TRAP_FRAME: f543bcb0 -- (.trap fffffffff543bcb0)
ErrCode = 00000000
eax=0174c400 ebx=00000000 ecx=819fd6c8 edx=6ab30003 esi=0474c403 edi=03000003
eip=818f75d0 esp=f543bd24 ebp=f543bd30 iopl=0 nv up ei pl nz na po nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010206
818f75d0 033e add edi,[esi] ds:0023:0474c403=????????
Resetting default scope

CUSTOMER_CRASH_COUNT: 3

DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: 0x8E

LAST_CONTROL_TRANSFER: from 804de7ec to 818f75d0

STACK_TEXT:
WARNING: Frame IP not in any known module. Following frames may be wrong.
f543bd30 804de7ec 00000508 00000000 00000000 0x818f75d0
f543bd30 7c90eb94 00000508 00000000 00000000 nt!KiFastCallEntry+0xf8
00c7fb00 00000000 00000000 00000000 00000000 0x7c90eb94


STACK_COMMAND: kb

FOLLOWUP_IP:
nt!KiFastCallEntry+f8
804de7ec 8be5 mov esp,ebp

FAULTING_SOURCE_CODE:


SYMBOL_STACK_INDEX: 1

FOLLOWUP_NAME: MachineOwner

SYMBOL_NAME: nt!KiFastCallEntry+f8

MODULE_NAME: nt

IMAGE_NAME: ntoskrnl.exe

DEBUG_FLR_IMAGE_TIMESTAMP: 42250ff9

FAILURE_BUCKET_ID: 0x8E_nt!KiFastCallEntry+f8

BUCKET_ID: 0x8E_nt!KiFastCallEntry+f8

Followup: MachineOwner
---------

[alt-92]

Ik zou 'm dan toch eens een volledige memory.dmp laten aanmaken.

En ntoskrnl.exe kan ook klappen op een andere call gedaan door een driver, dus staar je niet te blind op de genoemde executable.