System Restarts automatically or program hangs

My friends computer has been acting weird the last couple of days. Sometimes it will just restart itself with no BSOD or when he plays World of Warcraft it has just started to hang sometimes recently.

I play with him and mine has never hanged at the same locations yet. He has the same game so i know its his computer acting up. I check the event viewer and this is the error i see

Code:

Error code 0000004e, parameter1 00000099, parameter2 00000ff8, parameter3 00000000, parameter4 00000000.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

This is one of the Application errors concerning WoW.

Code:

Hanging application wowslaunch.exe, version 1.5.0.0, hang module hungapp, version 0.0.0.0, hang address 0x00000000.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Also for another error

Code:

Faulting application drwtsn32.exe, version 5.1.2600.0, faulting module dbghelp.dll, version 5.1.2600.2180, fault address 0x0001295d.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

This computer has been restored before and it seems it might be hardware but i do not want to rule out software issues either.

This is his computer specs
AMD Athlon XP Socket A (462) 2800+ 2.09 GHz
1 Stick 512 MB DDR1 PC2700 Nanaya Technology RAM
Western Digital WD1600AB 160 GB HD

So what could be the culprit?

 

Hi, pontiaclover.

Please have your friend carefully follow the instructions in this link and then post DebugWiz-generated dump logs for a few of the most recent crashes here.

 

First Dump

Code:

Opened log file 'c:\debuglog.txt'

Microsoft (R) Windows Debugger  Version 6.7.0005.0
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Documents and Settings\All Users\Application Data\Microsoft\Dr Watson\user.dmp]
User Mini Dump File: Only registers, stack and portions of memory are available

Comment: 'Dr. Watson generated MiniDump'
Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: C:\WINDOWS;C:\WINDOWS\system32;C:\WINDOWS\system32\drivers
Windows XP Version 2600 (Service Pack 2) UP Free x86 compatible
Product: WinNt, suite: SingleUserTS
Debug session time: Fri Jun 29 19:33:55.000 2007 (GMT-5)
System Uptime: not available
Process Uptime: 0 days 0:00:04.000
...........................
This dump file has an exception of interest stored in it.
The stored exception information can be accessed via .ecxr.
(37c.c48): Illegal instruction - code c000001d (first/second chance not available)
eax=007fe4fc ebx=77deb193 ecx=007fe52c edx=007fe550 esi=7c80b3d5 edi=00000000
eip=004033c7 esp=007fe4e0 ebp=007ff558 iopl=0         nv up ei pl nz ac pe nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000216
*** WARNING: Unable to verify timestamp for RpcDataSrv.exe
*** ERROR: Module load completed but symbols could not be loaded for RpcDataSrv.exe
RpcDataSrv+0x33c7:
004033c7 660fd644240c    movq    mmword ptr [esp+0Ch],xmm0 ss:0023:007fe4ec=000000007c80b46e
0:001> !analyze -v;r;kv;lmtn;.logclose;q
*******************************************************************************
*                                                                             *
*                        Exception Analysis                                   *
*                                                                             *
*******************************************************************************

And the mode recent Mini-Dump file

Code:

Opened log file 'c:\debuglog.txt'

Microsoft (R) Windows Debugger  Version 6.7.0005.0
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\WINDOWS\Minidump\Mini062807-02.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: C:\WINDOWS;C:\WINDOWS\system32;C:\WINDOWS\system32\drivers
Windows XP Kernel Version 2600 (Service Pack 2) UP Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 2600.xpsp_sp2_gdr.070227-2254
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055a620
Debug session time: Thu Jun 28 19:45:33.875 2007 (GMT-5)
System Uptime: 0 days 5:22:34.456
Loading Kernel Symbols
......................................................................................................................
Loading User Symbols
Loading unloaded module list
..........
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 4E, {99, ff8, 0, 0}

Probably caused by : memory_corruption ( nt!MiEliminateWorkingSetEntry+264 )

Followup: MachineOwner
---------

kd> !analyze -v;r;kv;lmtn;.logclose;q
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

PFN_LIST_CORRUPT (4e)
Typically caused by drivers passing bad memory descriptor lists (ie: calling
MmUnlockPages twice with the same list, etc).  If a kernel debugger is
available get the stack trace.
Arguments:
Arg1: 00000099, A PTE or PFN is corrupt
Arg2: 00000ff8, page frame number
Arg3: 00000000, current page state
Arg4: 00000000, 0

Debugging Details:
------------------


BUGCHECK_STR:  0x4E_99

CUSTOMER_CRASH_COUNT:  2

DEFAULT_BUCKET_ID:  DRIVER_FAULT

PROCESS_NAME:  System

LAST_CONTROL_TRANSFER:  from 8051dce7 to 8053354e

STACK_TEXT:  
f78eec68 8051dce7 0000004e 00000099 00000ff8 nt!KeBugCheckEx+0x1b
f78eec98 80506fb0 00000000 01312c64 00000000 nt!MiEliminateWorkingSetEntry+0x264
f78eecc0 80535055 00006ffd c0c0003c c0312c64 nt!MiFreeWsle+0x45
f78eecec 80522d34 00002e69 c0c0003c 00000002 nt!MiTrimWorkingSet+0x6e
f78eed38 804e5606 00000000 8530e020 00000000 nt!MmWorkingSetManager+0x151
f78eedac 8057d0f1 00000000 00000000 00000000 nt!KeBalanceSetManager+0x92
f78eeddc 804f827a 804e557a 00000000 00000000 nt!PspSystemThreadStartup+0x34
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt!MiEliminateWorkingSetEntry+264
8051dce7 008b461cc1e0    add     byte ptr [ebx-1F3EE3BAh],cl

SYMBOL_STACK_INDEX:  1

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

DEBUG_FLR_IMAGE_TIMESTAMP:  45e54711

SYMBOL_NAME:  nt!MiEliminateWorkingSetEntry+264

IMAGE_NAME:  memory_corruption

FAILURE_BUCKET_ID:  0x4E_99_nt!MiEliminateWorkingSetEntry+264

BUCKET_ID:  0x4E_99_nt!MiEliminateWorkingSetEntry+264

Followup: MachineOwner
---------

eax=ffdff13c ebx=00000ff8 ecx=00000000 edx=00000000 esi=00ff8802 edi=82017f40
eip=8053354e esp=f78eec50 ebp=f78eec68 iopl=0         nv up ei ng nz na pe nc
cs=0008  ss=0010  ds=0023  es=0023  fs=0030  gs=0000             efl=00000286
nt!KeBugCheckEx+0x1b:
8053354e 5d              pop     ebp
ChildEBP RetAddr  Args to Child              
f78eec68 8051dce7 0000004e 00000099 00000ff8 nt!KeBugCheckEx+0x1b (FPO: [Non-Fpo])
f78eec98 80506fb0 00000000 01312c64 00000000 nt!MiEliminateWorkingSetEntry+0x264 (FPO: [Non-Fpo])
f78eecc0 80535055 00006ffd c0c0003c c0312c64 nt!MiFreeWsle+0x45 (FPO: [Non-Fpo])
f78eecec 80522d34 00002e69 c0c0003c 00000002 nt!MiTrimWorkingSet+0x6e (FPO: [Non-Fpo])
f78eed38 804e5606 00000000 8530e020 00000000 nt!MmWorkingSetManager+0x151 (FPO: [Non-Fpo])
f78eedac 8057d0f1 00000000 00000000 00000000 nt!KeBalanceSetManager+0x92 (FPO: [Non-Fpo])
f78eeddc 804f827a 804e557a 00000000 00000000 nt!PspSystemThreadStartup+0x34 (FPO: [Non-Fpo])
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16
start    end        module name
804d7000 806eb500   nt       ntoskrnl.exe Wed Feb 28 03:10:41 2007 (45E54711)
806ec000 8070c380   hal      halaacpi.dll Wed Aug 04 00:59:05 2004 (41107B29)
bf000000 bf011580   dxg      dxg.sys      Wed Aug 04 01:00:51 2004 (41107B93)
bf012000 bf41ec00   nv4_disp nv4_disp.dll Mon Oct 06 19:03:41 2003 (3F8202DD)
bf800000 bf9c2180   win32k   win32k.sys   Thu Mar 08 07:47:34 2007 (45F013F6)
bffa0000 bffe5c00   ATMFD    ATMFD.DLL    Wed Aug 04 02:56:56 2004 (411096C8)
f29f4000 f2a1e180   kmixer   kmixer.sys   Wed Jun 14 03:47:45 2006 (448FCD31)
f36c0000 f36cf900   Cdfs     Cdfs.SYS     Wed Aug 04 01:14:09 2004 (41107EB1)
f3768000 f37a8280   HTTP     HTTP.sys     Thu Mar 16 19:33:09 2006 (441A03C5)
f3987000 f399b400   wdmaud   wdmaud.sys   Wed Jun 14 04:00:44 2006 (448FD03C)
f3a44000 f3a52d80   sysaudio sysaudio.sys Wed Aug 04 01:15:54 2004 (41107F1A)
f3b7c000 f3bcd480   srv      srv.sys      Mon Aug 14 05:34:39 2006 (44E051BF)
f3cbe000 f3cea400   mrxdav   mrxdav.sys   Wed Aug 04 01:00:49 2004 (41107B91)
f475b000 f475e280   ndisuio  ndisuio.sys  Wed Aug 04 01:03:10 2004 (41107C1E)
f583c000 f5853480   dump_atapi dump_atapi.sys Wed Aug 04 00:59:41 2004 (41107B4D)
f5854000 f5877000   Fastfat  Fastfat.SYS  Wed Aug 04 01:14:15 2004 (41107EB7)
f5917000 f59df6c0   avg7core avg7core.sys Fri Jun 15 04:13:22 2007 (46725832)
f5a08000 f5a28f00   ipnat    ipnat.sys    Wed Sep 29 17:28:36 2004 (415B3714)
f5a29000 f5a97a00   mrxsmb   mrxsmb.sys   Fri May 05 04:41:42 2006 (445B1DD6)
f5a98000 f5ac2a00   rdbss    rdbss.sys    Fri May 05 04:47:55 2006 (445B1F4B)
f5ac3000 f5ae4d00   afd      afd.sys      Wed Aug 04 01:14:13 2004 (41107EB5)
f5ae5000 f5b0cc00   netbt    netbt.sys    Wed Aug 04 01:14:36 2004 (41107ECC)
f5b0d000 f5b64d80   tcpip    tcpip.sys    Thu Apr 20 06:51:47 2006 (444775D3)
f5b65000 f5b77400   ipsec    ipsec.sys    Wed Aug 04 01:14:27 2004 (41107EC3)
f6cb0000 f6cc0480   nvarm    nvarm.sys    Tue May 25 17:58:00 2004 (40B3CF78)
f6cc1000 f6dac000   nvmcp    nvmcp.sys    Tue May 25 17:58:01 2004 (40B3CF79)
f6dac000 f6dcf980   portcls  portcls.sys  Wed Aug 04 01:15:47 2004 (41107F13)
f6dd0000 f6e30b00   nvapu    nvapu.sys    Tue May 25 17:58:02 2004 (40B3CF7A)
f6f26000 f6f59200   update   update.sys   Wed Aug 04 00:58:32 2004 (41107B08)
f6f6a000 f6f6c280   rasacd   rasacd.sys   Fri Aug 17 15:55:39 2001 (3B7D84CB)
f6f7a000 f6f7df00   MODEMCSA MODEMCSA.sys Fri Aug 17 15:57:37 2001 (3B7D8541)
f6f82000 f6fb2100   rdpdr    rdpdr.sys    Wed Aug 04 01:01:10 2004 (41107BA6)
f6fb3000 f6fc3e00   psched   psched.sys   Wed Aug 04 01:04:16 2004 (41107C60)
f6fc4000 f6fda680   ndiswan  ndiswan.sys  Wed Aug 04 01:14:30 2004 (41107EC6)
f6fdb000 f6fee900   parport  parport.sys  Wed Aug 04 00:59:04 2004 (41107B28)
f6fef000 f7002780   VIDEOPRT VIDEOPRT.SYS Wed Aug 04 01:07:04 2004 (41107D08)
f7003000 f7168be0   nv4_mini nv4_mini.sys Mon Oct 06 18:56:53 2003 (3F820145)
f7169000 f718b680   ks       ks.sys       Wed Aug 04 01:15:20 2004 (41107EF8)
f718c000 f71a7dc0   Mtlmnt5  Mtlmnt5.sys  Sun Feb 16 08:08:15 2003 (3E4F9B4F)
f71bf000 f720d700   slntamr  slntamr.sys  Sun Feb 16 08:11:52 2003 (3E4F9C28)
f720e000 f721fc00   NVENET   NVENET.sys   Fri Aug 15 21:22:15 2003 (3F3D9557)
f7220000 f7242e80   USBPORT  USBPORT.SYS  Wed Aug 04 01:08:34 2004 (41107D62)
f7243000 f7245900   Dxapi    Dxapi.sys    Fri Aug 17 15:53:19 2001 (3B7D843F)
f72ac000 f72c6580   Mup      Mup.sys      Wed Aug 04 01:15:20 2004 (41107EF8)
f72c7000 f72f3a80   NDIS     NDIS.sys     Wed Aug 04 01:14:27 2004 (41107EC3)
f72f4000 f7380400   Ntfs     Ntfs.sys     Fri Feb 09 05:10:31 2007 (45CC56A7)
f7381000 f7397780   KSecDD   KSecDD.sys   Wed Aug 04 00:59:45 2004 (41107B51)
f7398000 f73a9f00   sr       sr.sys       Wed Aug 04 01:06:22 2004 (41107CDE)
f73aa000 f73ab000   fltMgr   fltMgr.sys   unavailable (00000000)
f73ca000 f73e1480   atapi    atapi.sys    Wed Aug 04 00:59:41 2004 (41107B4D)
f73e2000 f7407700   dmio     dmio.sys     Wed Aug 04 01:07:13 2004 (41107D11)
f7408000 f7426880   ftdisk   ftdisk.sys   Fri Aug 17 15:52:41 2001 (3B7D8419)
f7427000 f7437a80   pci      pci.sys      Wed Aug 04 01:07:45 2004 (41107D31)
f7438000 f7465d80   ACPI     ACPI.sys     Wed Aug 04 01:07:35 2004 (41107D27)
f7487000 f748fc00   isapnp   isapnp.sys   Fri Aug 17 15:58:01 2001 (3B7D8559)
f7497000 f74a1500   MountMgr MountMgr.sys Wed Aug 04 00:58:29 2004 (41107B05)
f74a7000 f74b3c80   VolSnap  VolSnap.sys  Wed Aug 04 01:00:14 2004 (41107B6E)
f74b7000 f74bfe00   disk     disk.sys     Wed Aug 04 00:59:53 2004 (41107B59)
f74c7000 f74d3200   CLASSPNP CLASSPNP.SYS Wed Aug 04 01:14:26 2004 (41107EC2)
f7507000 f750f700   netbios  netbios.sys  Wed Aug 04 01:03:19 2004 (41107C27)
f7517000 f751f880   Fips     Fips.SYS     Fri Aug 17 20:31:49 2001 (3B7DC585)
f7527000 f752f700   wanarp   wanarp.sys   Wed Aug 04 01:04:57 2004 (41107C89)
f7557000 f7560200   amdk7    amdk7.sys    Wed Aug 04 00:59:19 2004 (41107B37)
f7567000 f7572e00   nvax     nvax.sys     Tue May 25 17:58:00 2004 (40B3CF78)
f7577000 f7581380   imapi    imapi.sys    Wed Aug 04 01:00:12 2004 (41107B6C)
f7587000 f7593180   cdrom    cdrom.sys    Wed Aug 04 00:59:52 2004 (41107B58)
f7597000 f75a5080   redbook  redbook.sys  Wed Aug 04 00:59:34 2004 (41107B46)
f75a7000 f75b6d80   serial   serial.sys   Wed Aug 04 01:15:51 2004 (41107F17)
f75b7000 f75c3e00   i8042prt i8042prt.sys Wed Aug 04 01:14:36 2004 (41107ECC)
f75c7000 f75d3880   rasl2tp  rasl2tp.sys  Wed Aug 04 01:14:21 2004 (41107EBD)
f75d7000 f75e1200   raspppoe raspppoe.sys Wed Aug 04 01:05:06 2004 (41107C92)
f75e7000 f75f2d00   raspptp  raspptp.sys  Wed Aug 04 01:14:26 2004 (41107EC2)
f75f7000 f75ff900   msgpc    msgpc.sys    Wed Aug 04 01:04:11 2004 (41107C5B)
f7607000 f7610f00   termdd   termdd.sys   Wed Aug 04 00:58:52 2004 (41107B1C)
f7617000 f7620480   NDProxy  NDProxy.SYS  Fri Aug 17 15:55:30 2001 (3B7D84C2)
f7627000 f7635100   usbhub   usbhub.sys   Wed Aug 04 01:08:40 2004 (41107D68)
f7657000 f7665b80   drmk     drmk.sys     Wed Aug 04 01:07:54 2004 (41107D3A)
f7707000 f770d200   PCIIDEX  PCIIDEX.SYS  Wed Aug 04 00:59:40 2004 (41107B4C)
f770f000 f7713900   PartMgr  PartMgr.sys  Fri Aug 17 20:32:23 2001 (3B7DC5A7)
f7717000 f771b900   nv_agp   nv_agp.sys   Wed Mar 19 19:13:47 2003 (3E7907BB)
f774f000 f7753280   usbohci  usbohci.sys  Wed Aug 04 01:08:34 2004 (41107D62)
f7757000 f775d800   usbehci  usbehci.sys  Wed Aug 04 01:08:34 2004 (41107D62)
f775f000 f7763240   SlWdmSup SlWdmSup.sys Thu Jan 16 17:19:30 2003 (3E273E02)
f7767000 f776e580   Modem    Modem.SYS    Wed Aug 04 01:08:04 2004 (41107D44)
f776f000 f7770000   fdc      fdc.sys      unavailable (00000000)
f7777000 f777ca00   mouclass mouclass.sys Wed Aug 04 00:58:32 2004 (41107B08)
f777f000 f7785000   kbdclass kbdclass.sys Wed Aug 04 00:58:32 2004 (41107B08)
f7787000 f778b880   TDI      TDI.SYS      Wed Aug 04 01:07:47 2004 (41107D33)
f778f000 f7793580   ptilink  ptilink.sys  Fri Aug 17 15:49:53 2001 (3B7D8371)
f7797000 f779b080   raspti   raspti.sys   Fri Aug 17 15:55:32 2001 (3B7D84C4)
f77a7000 f77ac6a0   sunkfilt sunkfilt.sys Fri May 02 05:52:17 2003 (3EB24DE1)
f77b7000 f77bd780   USBSTOR  USBSTOR.SYS  Wed Aug 04 01:08:44 2004 (41107D6C)
f77d7000 f77dc000   flpydisk flpydisk.sys Wed Aug 04 00:59:24 2004 (41107B3C)
f77e7000 f77ec200   vga      vga.sys      Wed Aug 04 01:07:06 2004 (41107D0A)
f77ef000 f77f0000   Msfs     Msfs.SYS     unavailable (00000000)
f77f7000 f77fe880   Npfs     Npfs.SYS     Wed Aug 04 01:00:38 2004 (41107B86)
f7807000 f780dc80   avg7rsxp avg7rsxp.sys Tue Jan 30 09:08:42 2007 (45BF5F7A)
f783f000 f7843500   watchdog watchdog.sys Wed Aug 04 01:07:32 2004 (41107D24)
f7897000 f789a000   BOOTVID  BOOTVID.dll  Fri Aug 17 15:49:09 2001 (3B7D8345)
f793b000 f793ec80   serenum  serenum.sys  Wed Aug 04 00:59:06 2004 (41107B2A)
f793f000 f7941580   ndistapi ndistapi.sys Fri Aug 17 15:55:29 2001 (3B7D84C1)
f7957000 f795ac80   mssmbios mssmbios.sys Wed Aug 04 01:07:47 2004 (41107D33)
f7987000 f7988b80   kdcom    kdcom.dll    Fri Aug 17 15:49:10 2001 (3B7D8346)
f7989000 f798a100   WMILIB   WMILIB.SYS   Fri Aug 17 16:07:23 2001 (3B7D878B)
f798b000 f798c000   dmload   dmload.sys   unavailable (00000000)
f7999000 f799a100   swenum   swenum.sys   Wed Aug 04 00:58:41 2004 (41107B11)
f799b000 f799c280   USBD     USBD.SYS     Fri Aug 17 16:02:58 2001 (3B7D8682)
f79c9000 f79ca000   Fs_Rec   Fs_Rec.SYS   unavailable (00000000)
f79cb000 f79cc080   Beep     Beep.SYS     Fri Aug 17 15:47:33 2001 (3B7D82E5)
f79cd000 f79ce080   mnmdd    mnmdd.SYS    Fri Aug 17 15:57:28 2001 (3B7D8538)
f79cf000 f79d0080   RDPCDD   RDPCDD.sys   Fri Aug 17 15:46:56 2001 (3B7D82C0)
f79d5000 f79d6080   avg7rsw  avg7rsw.sys  Tue Jul 26 07:10:51 2005 (42E6284B)
f79dd000 f79de100   dump_WMILIB dump_WMILIB.SYS Fri Aug 17 16:07:23 2001 (3B7D878B)
f7a23000 f7a24000   ParVdm   ParVdm.SYS   unavailable (00000000)
f7a4f000 f7a4fd00   pciide   pciide.sys   Fri Aug 17 15:51:49 2001 (3B7D83E5)
f7a7c000 f7a7cd00   dxgthk   dxgthk.sys   Fri Aug 17 15:53:12 2001 (3B7D8438)
f7b04000 f7b04c00   audstub  audstub.sys  Fri Aug 17 15:59:40 2001 (3B7D85BC)
f7b12000 f7b13000   Null     Null.SYS     unavailable (00000000)
f7b13000 f7b13f80   avgclean avgclean.sys Mon Aug 21 17:55:15 2006 (44EA39D3)

Unloaded modules:
f7b66000 f7b67000   drmkaud.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
f3871000 f389c000   kmixer.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
f3964000 f3987000   aec.sys 
    Timestamp: unavailable (00000000)
    Checksum:  00000000
f39e4000 f39f1000   DMusic.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
f39f4000 f3a02000   swmidi.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
f79c3000 f79c5000   splitter.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
f7827000 f782e000   USBSTOR.SYS
    Timestamp: unavailable (00000000)
    Checksum:  00000000
f781f000 f7825000   sunkfilt.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
f77df000 f77e4000   Cdaudio.SYS
    Timestamp: unavailable (00000000)
    Checksum:  00000000
f6f6e000 f6f71000   Sfloppy.SYS
    Timestamp: unavailable (00000000)
    Checksum:  00000000
Closing open log file c:\debuglog.txt

 

Probably because the computer is configured to automatically restart on such fatal errors.

Here is how to configure one's machine to display a BSOD for a system crash instead of automatically rebooting.

• While holding down the Windows Key, press the Pause Key to bring up the "System Properties" window.
• Click the Advanced tab.
• In the Startup and Recovery section, click the Settings button.

Make the following settings in the "System failure" section:

• Check mark: "Write an event to the system log "
• Check mark: "Send an administrative alert "
• NO check mark: "Automatically restart "
  (One should be able to read the BSOD screens after making this setting.)
• Write debugging information: Complete memory dump
• Dump file: %SystemRoot%\MEMORY.DMP
• Click on the OK buttons until back to normal desktop screen.

Then the next time the computer crashes, one should see a BSOD with error information.

It's possible your friend's graphics card (GPU) temperature or CPU temperature is getting too high while playing WoW. EVEREST Free Edition is handy for monitoring temperatures. EVEREST has been known to not accurately reflect the actual CPU temperature in some cases (as would more likely be shown accurately via the BIOS) but it would probably be useful for monitoring changes in temperature.

I suggest your friend check these temperatures before playing WoW. Then play the game and check the temperature at 15-minute intervals during typical gaming to see if the GPU and/or CPU temperatures rise significantly.

The section in EVEREST to look in is Computer > Sensor.

 

I've checked the tempatures and this what he gets

Motherboard 45C (113F)
CPU 49C (120F)
WDC WD1600AB 41C (106F)

I did this with my computer and mine all below 100F but i cant really compare a amd an intel lol.

I am helping him via remote assistance just so you guys know.

 

Thanks for the dump logs.

The first one (the user.dmp application crash) doesn't display much information. Did you paste the entire contents of that log?

We're short on dump log analysis experts around here so please keep that in mind. (I am not an expert. ) I will poke around though and see if I can find any possible solutions.


BTW, in the future, please paste the dump logs directly into your messages (without using the CODE tags). Although the message will be significantly longer, the dump log will be easier for us to read. Thanks!

 

They should remain well below about 65°C if I am not mistaken.

You did not post any temperature info for your friend's graphics card (GPU).

Would also like to see temperature info after some heavy gaming.

BTW, you/your friend can right-click on the Sensor window in EVEREST for handy copying/pasting.

 

Sorry... i will not longer use the code tags. I redid the first one and this time got a longer dump file.

Opened log file 'c:\debuglog.txt'

Microsoft (R) Windows Debugger Version 6.7.0005.0
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Documents and Settings\All Users\Application Data\Microsoft\Dr Watson\user.dmp]
User Mini Dump File: Only registers, stack and portions of memory are available

Comment: 'Dr. Watson generated MiniDump'
Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: C:\WINDOWS;C:\WINDOWS\system32;C:\WINDOWS\system32\drivers
Windows XP Version 2600 (Service Pack 2) UP Free x86 compatible
Product: WinNt, suite: SingleUserTS
Debug session time: Fri Jun 29 19:33:55.000 2007 (GMT-5)
System Uptime: not available
Process Uptime: 0 days 0:00:04.000
...........................
This dump file has an exception of interest stored in it.
The stored exception information can be accessed via .ecxr.
(37c.c48): Illegal instruction - code c000001d (first/second chance not available)
eax=007fe4fc ebx=77deb193 ecx=007fe52c edx=007fe550 esi=7c80b3d5 edi=00000000
eip=004033c7 esp=007fe4e0 ebp=007ff558 iopl=0 nv up ei pl nz ac pe nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000216
*** WARNING: Unable to verify timestamp for RpcDataSrv.exe
*** ERROR: Module load completed but symbols could not be loaded for RpcDataSrv.exe
RpcDataSrv+0x33c7:
004033c7 660fd644240c movq mmword ptr [esp+0Ch],xmm0 ss:0023:007fe4ec=000000007c80b46e
0:001> !analyze -v;r;kv;lmtn;.logclose;q
*******************************************************************************
* *
* Exception Analysis *
* *
*******************************************************************************


FAULTING_IP:
RpcDataSrv+33c7
004033c7 660fd644240c movq mmword ptr [esp+0Ch],xmm0

EXCEPTION_RECORD: ffffffff -- (.exr 0xffffffffffffffff)
.exr 0xffffffffffffffff
ExceptionAddress: 004033c7 (RpcDataSrv+0x000033c7)
ExceptionCode: c000001d (Illegal instruction)
ExceptionFlags: 00000000
NumberParameters: 0

DEFAULT_BUCKET_ID: BAD_INSTRUCTION_PTR

PROCESS_NAME: RpcDataSrv.exe

ERROR_CODE: (NTSTATUS) 0xc000001d - {EXCEPTION} Illegal Instruction An attempt was made to execute an illegal instruction.

LAST_CONTROL_TRANSFER: from 0040223f to 004033c7

FAILED_INSTRUCTION_ADDRESS:
RpcDataSrv+33c7
004033c7 660fd644240c movq mmword ptr [esp+0Ch],xmm0

STACK_TEXT:
WARNING: Stack unwind information not available. Following frames may be wrong.
007ff558 0040223f 00000000 00000000 007fffb4 RpcDataSrv+0x33c7
007fffb4 7c80b683 00159258 00000000 0012e83c RpcDataSrv+0x223f
007fffec 00000000 77deb479 00159258 00000000 kernel32!BaseThreadStart+0x37


STACK_COMMAND: ~1s; .ecxr ; kb

FOLLOWUP_IP:
RpcDataSrv+33c7
004033c7 660fd644240c movq mmword ptr [esp+0Ch],xmm0

SYMBOL_STACK_INDEX: 0

SYMBOL_NAME: RpcDataSrv+33c7

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: RpcDataSrv

IMAGE_NAME: RpcDataSrv.exe

DEBUG_FLR_IMAGE_TIMESTAMP: 463732dd

FAULTING_THREAD: 00000c48

PRIMARY_PROBLEM_CLASS: BAD_INSTRUCTION_PTR

BUGCHECK_STR: APPLICATION_FAULT_BAD_INSTRUCTION_PTR

FAILURE_BUCKET_ID: APPLICATION_FAULT_BAD_INSTRUCTION_PTR_BAD_IP_RpcDataSrv+33c7

BUCKET_ID: APPLICATION_FAULT_BAD_INSTRUCTION_PTR_BAD_IP_RpcDataSrv+33c7

Followup: MachineOwner
---------

eax=007fe4fc ebx=77deb193 ecx=007fe52c edx=007fe550 esi=7c80b3d5 edi=00000000
eip=004033c7 esp=007fe4e0 ebp=007ff558 iopl=0 nv up ei pl nz ac pe nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000216
RpcDataSrv+0x33c7:
004033c7 660fd644240c movq mmword ptr [esp+0Ch],xmm0 ss:0023:007fe4ec=000000007c80b46e
ChildEBP RetAddr Args to Child
WARNING: Stack unwind information not available. Following frames may be wrong.
007ff558 0040223f 00000000 00000000 007fffb4 RpcDataSrv+0x33c7
007fffb4 7c80b683 00159258 00000000 0012e83c RpcDataSrv+0x223f
007fffec 00000000 77deb479 00159258 00000000 kernel32!BaseThreadStart+0x37 (FPO: [Non-Fpo])
start end module name
00400000 0041f000 RpcDataSrv RpcDataSrv.exe Tue May 01 07:30:21 2007 (463732DD)
0ffd0000 0fff8000 rsaenh rsaenh.dll Tue Jul 06 21:17:12 2004 (40EB5D28)
20000000 202c5000 xpsp2res xpsp2res.dll Wed Aug 04 02:56:41 2004 (411096B9)
5ad70000 5ada8000 uxtheme uxtheme.dll Wed Aug 04 02:56:43 2004 (411096BB)
5b860000 5b8b4000 netapi32 netapi32.dll Thu Aug 17 07:28:27 2006 (44E460EB)
71aa0000 71aa8000 ws2help ws2help.dll Wed Aug 04 02:57:39 2004 (411096F3)
71ab0000 71ac7000 ws2_32 ws2_32.dll Wed Aug 04 02:57:38 2004 (411096F2)
767a0000 767b3000 ntdsapi ntdsapi.dll Wed Aug 04 02:56:57 2004 (411096C9)
76c30000 76c5e000 wintrust wintrust.dll Wed Aug 04 02:56:41 2004 (411096B9)
76c90000 76cb8000 imagehlp imagehlp.dll Wed Aug 04 02:56:25 2004 (411096A9)
76f20000 76f47000 dnsapi dnsapi.dll Mon Jun 26 12:37:10 2006 (44A01B46)
76f60000 76f8c000 wldap32 wldap32.dll Wed Aug 04 02:56:43 2004 (411096BB)
77120000 771ac000 oleaut32 oleaut32.dll Wed Aug 04 02:57:39 2004 (411096F3)
774e0000 7761d000 ole32 ole32.dll Mon Jul 25 23:39:47 2005 (42E5BE93)
77a80000 77b14000 crypt32 crypt32.dll Wed Aug 04 02:56:01 2004 (41109691)
77b20000 77b32000 msasn1 msasn1.dll Wed Aug 04 02:57:23 2004 (411096E3)
77b40000 77b62000 apphelp apphelp.dll Wed Aug 04 02:56:36 2004 (411096B4)
77c00000 77c08000 version version.dll Wed Aug 04 02:56:39 2004 (411096B7)
77c10000 77c68000 msvcrt msvcrt.dll Wed Aug 04 02:59:14 2004 (41109752)
77dd0000 77e6b000 advapi32 advapi32.dll Wed Aug 04 02:56:23 2004 (411096A7)
77e70000 77f01000 rpcrt4 rpcrt4.dll Wed Aug 04 02:56:30 2004 (411096AE)
77f10000 77f57000 gdi32 gdi32.dll Thu Mar 08 09:36:28 2007 (45F02D7C)
77fe0000 77ff1000 secur32 secur32.dll Wed Aug 04 02:56:49 2004 (411096C1)
78130000 781cb000 msvcr80 msvcr80.dll Sat Dec 02 00:50:32 2006 (45712238)
7c800000 7c8f5000 kernel32 kernel32.dll Mon Apr 16 10:52:53 2007 (46239BD5)
7c900000 7c9b0000 ntdll ntdll.dll Wed Aug 04 02:56:36 2004 (411096B4)
7e410000 7e4a0000 user32 user32.dll Thu Mar 08 09:36:28 2007 (45F02D7C)
Closing open log file c:\debuglog.txt

 

It didn't give me anything about the GPU temp.

Thanks for tip!

 

On second thought, some people might prefer you use the CODE tags because the columns might make the logs easier for them. We'll wait to see their opinions.

Until then, it's your choice. I'll work with the info either way.

 

On future crashes, please try to see if you can find any patterns.

Is each crash the same?

• i.e., same DEFAULT_BUCKET_ID, PROCESS_NAME, ERROR_CODE for program crashes?
• i.e., same BUGCHECK_STR (such as "0x4E_99" in your DSOD dump log already posted), PROCESS_NAME, and/or IMAGE_NAME for BSOD crashes?

If there is no such pattern, then people seem to think hardware issues might be at the root of the problem. One common suggestion is to check RAM for errors.

In case you decide to test your RAM for errors, all of the following RAM testers have been recommended in this forum. However, opinions differ about which RAM tester is "best ".

• DocMem
• Memtest86 (downloadable via the "Free Download" link on their home page menu)
• Microsoft's Windows Memory Diagnostic

If you discover an error with any of these RAM testers and the RAM tester does not identify which RAM module is defective, then re-run the test with only a single RAM module installed until you identify which module is defective. (I am not familiar with the exact information output of any of these RAM testers when they find errors.)


Another possible method to follow:

1. Remove some of the memory modules from the computer (while the computer is off, of course).
   • For example, if two RAM modules are installed in your computer, remove one of the RAM modules.
2. Start your computer and see if the problem goes away.
3. If you continue to have unexpected reboots, then replace that RAM module with another module, or install the module in a different memory slot.
4. Start your computer and see if the problem goes away.

Continue this process to see if you can pinpoint the cause of your problem to a specific RAM module or slot.

====
There...with that all that said, I'll start poking around with the info you have already provided. Wish me luck!

 

BTW, since you stated these crash issues started occurring only a couple days ago, please suggest to your friend to think about any possible software/hardware changes (s)he might have made immediately before the crashes started occurring.

If any such changes were made, I would start investigating those first.

 

From your BSOD "Mini-Dump" log:

• Microsoft KB291806: How to Troubleshoot a "STOP: 0x0000004E PFN_LIST_CORRUPT" Error Message

EDIT: As I highlighted in red above, there might be a problematic driver at the heart of this. Has your friend installed or updated any drivers recently?

 

Right now he is running memtest86 on his computer. I am watching through Xbox 360 Video Chat lol.

As far as i know, all drivers are ok and updated. The restarting just happens at random times and he said it was once a day. i am just hopping its bad ram since we live long distances away and he doesn't know much about computers.

 

Cool! I have never used Remote Desktop or anything of the sort to see someone else's screen. Must be interesting.

In regards to drivers, I suppose a driver might have become corrupt.

• Microsoft KB244617: How to Use Driver Verifier to Troubleshoot Windows Drivers
  

• Click Start > Run... and type [FONT= "Fixedsys"]verifier.exe[/FONT] in the "Open:" field.
• Click OK.
• Make your selections. <--I am testing these out. (See my post below.)
• Then restart the computer.

(I bet you can't watch what happens after the restart. )

 

I am not familiar with Driver Verifier so I am testing it out. Therefore, please hold off on using Driver Verifier (unless you want to experiment with it yourself, of course). Since you can view his computer screen, you might want to check it out yourself.

Appears there are additional instructions I should add to my instructions above.

If necessary, I'll post revised instructions after some testing on my computer.

EDIT: Do NOT use Driver Verifier without expert guidance. See post #19 below.

 

The memtest86 crashed. It just stayed at 79% for over 15 min.

We will try another tester while you help us with the verifier.

 

We are running th MS Version and it keeps failing on "StrIde6" with Cache = On.

We are still running the test but it seems to only keep failing on this same thing. We are currently on pass 12 and all 11 passes have only failed on this test.

Just posting a follow up

EDIT: It did it on all Passes. that was the only error

 

OK...from the looks of things, it appears he might have a faulty RAM stick (which may or may not be causing the crashes). Any chance he can swap it out with a known good stick (same specs)?


BTW, I suggest people should not try using Driver Verifier unless they know how to use it and what to expect.


Short Story: After a few hours I finally had to resort to Safe Mode to get my computer to boot normally and run normally again.


Long Story:
I experimented a bit and got less-than-desirable results. I tried a setting via the GUI interface for Driver Verifier and rebooted. It seemed like nothing happened out of the ordinary...no pop-up window to show what was happening...just a normal boot.

My second experiment was to go to the DOS command prompt and type [FONT= "Fixedsys"]verifier.exe /all[/FONT] and then [FONT= "Fixedsys"]exit[/FONT]. When I rebooted, the boot up was noticeably slower, the shortcut icons took a long time to appear on the screen, and my startups slowed to a CRAWL. It took a few HOURS for most of my system tray to populate and my Firewall icon never appeared. I lost patience with it and clicked around to open folders and Process Explorer. My computer did not respond immediately to those clicks and my mouse froze so I left the computer as is for an hour or so. When I came back those folders and Process explorer were open but pretty unresponsive. Then I got a DCOM error which required shutdown. The shutdown hung so I had to hit the Reset button. A couple more boots still acted like it was apparently in Driver Verifier mode. I finally had to boot into Safe Mode and "Delete" my Driver Verifier settings. After doing that, my computer was back to normal.

Clearly, I need to research Driver Verifier more before I experiment with it again.

 

Well i have used it before but ya i had that same problem until i deleted all settings (which i see you did). But i know it isn't a driver issue. I did what you said to do with the blue screen showing and its the same error every time with the same parameters and everything. So my guess is the RAM. I did a search with the stride6 error and thats what it seems to be.

He will probably be purchasing a new stick of ram (hopefully from newegg since its cheaper) but what his computer supports is PC-2700 and he will get 512 mb or 1 gb depending on his decision. But from the start i kinda though it was the ram when i say the error "Memory_corruption "... it just rang a bell in my head....

Oh well Thanks for helping me out and confirming what you know/think it is.