PC keeps shutting down randomly DUMP files attached

I have a pc that keeps shutting down at random times. I collected the memory dump files (3) and am not sure how to read them. Any help would be appreciated.

Here are all 3 minidump files:

(1)

Microsoft (R) Windows Debugger Version 6.10.0003.233 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: C:\WINDOWS\Symbols
Executable search path is:
Unable to load image ntoskrnl.exe, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
Windows XP Kernel Version 2600 (Service Pack 3) MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Machine Name:
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055d720
Debug session time: Fri Jan 9 11:55:56.620 2009 (GMT-6)
System Uptime: 0 days 21:15:37.898
Unable to load image ntoskrnl.exe, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
Loading Kernel Symbols
...............................................................
................................................................
..........
Loading User Symbols
Loading unloaded module list
...........................
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 4E, {99, 6191d, 0, 0}

Probably caused by : memory_corruption ( nt!MmDeleteKernelStack+bb )

Followup: MachineOwner
---------

1: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

PFN_LIST_CORRUPT (4e)
Typically caused by drivers passing bad memory descriptor lists (ie: calling
MmUnlockPages twice with the same list, etc). If a kernel debugger is
available get the stack trace.
Arguments:
Arg1: 00000099, A PTE or PFN is corrupt
Arg2: 0006191d, page frame number
Arg3: 00000000, current page state
Arg4: 00000000, 0

Debugging Details:
------------------


BUGCHECK_STR: 0x4E_99

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: DRIVER_FAULT

PROCESS_NAME: EXCEL.EXE

LAST_CONTROL_TRANSFER: from 80505583 to 804f9f43

STACK_TEXT:
a6a3ea68 80505583 0000004e 00000099 0006191d nt!MmDeleteKernelStack+0xbb
a6a3eaa0 805058ec 010005a9 c004a100 0001386b nt!CcPfCancelTraceTimer+0x2e
a6a3eaa8 c004a100 0001386b 896e8be8 00000000 nt!_output+0x13
WARNING: Frame IP not in any known module. Following frames may be wrong.
a6a3eac8 80505b52 000005a9 c0883cfc c004a100 0xc004a100
a6a3ed38 89bc8500 a6a3ed64 8054162c 00580fc2 nt!_output+0x4e0
a6a3ed48 00000000 0000f020 000204bf 00000000 0x89bc8500


STACK_COMMAND: kb

FOLLOWUP_IP:
nt!MmDeleteKernelStack+bb
804f9f43 5d pop ebp

SYMBOL_STACK_INDEX: 0

SYMBOL_NAME: nt!MmDeleteKernelStack+bb

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nt

DEBUG_FLR_IMAGE_TIMESTAMP: 48a3fbd9

IMAGE_NAME: memory_corruption

FAILURE_BUCKET_ID: 0x4E_99_nt!MmDeleteKernelStack+bb

BUCKET_ID: 0x4E_99_nt!MmDeleteKernelStack+bb

Followup: MachineOwner
---------

***********************************************

(2)


Microsoft (R) Windows Debugger Version 6.10.0003.233 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: C:\WINDOWS\Symbols
Executable search path is:
Unable to load image ntoskrnl.exe, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
Windows XP Kernel Version 2600 (Service Pack 3) MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Machine Name:
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055d720
Debug session time: Thu Jan 8 14:40:04.073 2009 (GMT-6)
System Uptime: 1 days 4:59:04.417
Unable to load image ntoskrnl.exe, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
Loading Kernel Symbols
...............................................................
................................................................
..........
Loading User Symbols
Loading unloaded module list
...............................................
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1000000A, {815c12f8, 2, 0, 805172d4}

Probably caused by : ntoskrnl.exe ( nt!FsRtlRemoveMcbEntryPrivate+20e )

Followup: MachineOwner
---------

1: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 815c12f8, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000000, bitfield :
bit 0 : value 0 = read operation, 1 = write operation
bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: 805172d4, address which referenced memory

Debugging Details:
------------------


READ_ADDRESS: 815c12f8

CURRENT_IRQL: 2

FAULTING_IP:
nt!FsRtlRemoveMcbEntryPrivate+20e
805172d4 8b09 mov ecx,dword ptr [ecx]

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: 0xA

PROCESS_NAME: msiexec.exe

LAST_CONTROL_TRANSFER: from 805224ab to 805172d4

STACK_TEXT:
a7386bb8 805224ab 826baee4 0000003f 00000000 nt!FsRtlRemoveMcbEntryPrivate+0x20e
a7386bd0 80522c2e e6ab4f18 89add158 89513d80 nt!MiResolveTransitionFault+0x250
a7386be8 805157bb 00000400 00000460 89513dd0 nt!MiNotifyMemoryEvents+0xee
a7386bec 00000000 00000460 89513dd0 0001a000 nt!InbvRotBarInit+0x3


STACK_COMMAND: kb

FOLLOWUP_IP:
nt!FsRtlRemoveMcbEntryPrivate+20e
805172d4 8b09 mov ecx,dword ptr [ecx]

SYMBOL_STACK_INDEX: 0

SYMBOL_NAME: nt!FsRtlRemoveMcbEntryPrivate+20e

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nt

IMAGE_NAME: ntoskrnl.exe

DEBUG_FLR_IMAGE_TIMESTAMP: 48a3fbd9

FAILURE_BUCKET_ID: 0xA_nt!FsRtlRemoveMcbEntryPrivate+20e

BUCKET_ID: 0xA_nt!FsRtlRemoveMcbEntryPrivate+20e

Followup: MachineOwner
---------


***********************************************


(3)


Microsoft (R) Windows Debugger Version 6.10.0003.233 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: C:\WINDOWS\Symbols
Executable search path is:
Unable to load image ntoskrnl.exe, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
Windows XP Kernel Version 2600 (Service Pack 3) MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Machine Name:
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055d720
Debug session time: Wed Jan 7 09:40:45.328 2009 (GMT-6)
System Uptime: 27 days 17:24:14.296
Unable to load image ntoskrnl.exe, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
Loading Kernel Symbols
...............................................................
................................................................
.........
Loading User Symbols
Loading unloaded module list
..................................................
Unable to load image Ntfs.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for Ntfs.sys
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 10000050, {f190600c, 0, 8050924a, 2}


Could not read faulting driver name
*** WARNING: Unable to verify timestamp for SYMEVENT.SYS
*** ERROR: Module load completed but symbols could not be loaded for SYMEVENT.SYS
Probably caused by : SYMEVENT.SYS ( SYMEVENT+ed80 )

Followup: MachineOwner
---------

1: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced. This cannot be protected by try-except,
it must be protected by a Probe. Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: f190600c, memory referenced.
Arg2: 00000000, value 0 = read operation, 1 = write operation.
Arg3: 8050924a, If non-zero, the instruction address which referenced the bad memory
address.
Arg4: 00000002, (reserved)

Debugging Details:
------------------


Could not read faulting driver name

READ_ADDRESS: f190600c

FAULTING_IP:
nt!MmDetachSession+35
8050924a 8b530c mov edx,dword ptr [ebx+0Ch]

MM_INTERNAL_CODE: 2

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: 0x50

PROCESS_NAME: System

LAST_CONTROL_TRANSFER: from b9e20456 to 8050924a

STACK_TEXT:
ba4eb1ec b9e20456 ba4eb6a4 1f000000 00000001 nt!MmDetachSession+0x35
ba4eb210 b9e2100e 89191008 804ef912 ba4ebd2c Ntfs!NtfsNonCachedIo+0x29c
ba4eb3f0 b9e20c18 ba4eb400 89191008 0110070a Ntfs!NtfsCommonWrite+0x17f7
ba4eb564 804ef19e 8a60a020 89191008 8a5f2a58 Ntfs!NtfsFsdWrite+0x4a
ba4eb584 804ef19e 8a5f5dd0 89191008 804f0054 nt!IopUpdateReadOperationCount+0x2d
ba4eb5ac a8ae0d80 8a5f5dd0 8a551b20 ba4eb5e4 nt!IopUpdateReadOperationCount+0x2d
WARNING: Stack unwind information not available. Following frames may be wrong.
ba4eb5c8 a8ad97b9 ba4eb5e4 804f0054 a8ad9880 SYMEVENT+0xed80
ba4eb608 a8ad996f 89d80178 89191008 8a55d0c8 SYMEVENT+0x77b9
ba4eb61c 804ef19e 89d80178 89191008 89191008 SYMEVENT+0x796f
ba4eb658 804ef19e 8a551b20 89191008 037c9000 nt!IopUpdateReadOperationCount+0x2d
ba4eb67c 8050f082 8a5f3d0a ba4eb6a4 ba4eb744 nt!IopUpdateReadOperationCount+0x2d
ba4eb764 8050faa4 e6158e48 e6158ea0 e6158ea0 nt!IovUtilMarkStack+0x49
ba4eb7a0 804e4554 8a5f3b40 00000000 0000b000 nt!CcDeleteSharedCacheMap+0x74
ba4eb828 b9e41007 0000b000 ba4eb8c8 0000b000 nt!KeRemoveQueue+0xa8
ba4eb8f0 b9e41089 e1020008 e67fe2a0 e6a70760 Ntfs!LfsFlushLfcb+0x512
ba4eb914 b9e4251f e1020008 e67fe2a0 8a60a310 Ntfs!LfsFlushLfcb+0xa2
ba4eb920 8a60a310 e1020008 e53e5928 da6fa931 Ntfs!NtfsFreeRestartTable+0x5
ba4eb96c b9e41cf8 e1020008 000000e0 00000001 0x8a60a310
ba4eb9b8 b9e42278 e16f7170 00000068 ba4eba20 Ntfs!LfsFlushLfcb+0x4c0
ba4ebbe8 b9e42174 ba4ebc1c 8a60a100 00000000 Ntfs!LfsQueryLastLsn+0x22
ba4ebd7c 8053877d 00000000 00000000 8a6753c8 Ntfs!NtfsCheckpointVolume+0xdd2
ba4ebdac 805cff70 00000000 00000000 00000000 nt!MiSetPageModified+0x273
ba4ebddc 805460ee 8053868e 00000000 00000000 nt!IopInitializeDeviceInstanceKey+0x20d
ba4ebe14 00000000 00000000 00000000 00000000 nt!ExpAddTagForBigPages+0x18


STACK_COMMAND: kb

FOLLOWUP_IP:
SYMEVENT+ed80
a8ae0d80 ?? ???

SYMBOL_STACK_INDEX: 6

SYMBOL_NAME: SYMEVENT+ed80

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: SYMEVENT

IMAGE_NAME: SYMEVENT.SYS

DEBUG_FLR_IMAGE_TIMESTAMP: 450f3f43

FAILURE_BUCKET_ID: 0x50_SYMEVENT+ed80

BUCKET_ID: 0x50_SYMEVENT+ed80

Followup: MachineOwner

 

Ran Dell's system test. Everything passes (including the log memory test). Not sure if it is a bad driver or if I have a krnl going bad...

Will try the other two memory tests.

Thanks

 

I ran Dell Diagnostics, Windows Memory Diagnostic, and MemTest86. I tried all three with single module installed, using different slots. All passed with no errors. Other thoughts?

Thanks!

 

Thanks.... I guess...

Anone else help with the dump files?

 

Yes, you have a memory problem. Oops, you've already been told that a couple of times. Perhaps you want to list what you have for installed memory and what the current memory settings are. Give us that along with the motherboard and CPU specs and perhaps there is an easy fix. No promises but ......

 

Did you build your system? If so, check to see that you didn't accidently get any thermal grease on your RAM modules. I accidently did, and was getting constant memory errors. Once I wiped it off, it was fine.

 

I would point out in Arie's quote:

So it can pass the tests, but still not work in Windows.

Other thoughts...
You say in the title that the system "shuts down ". Check that the system is not overheating. Check that all the fans are spinning freely when it is running, including the PSU fan and graphics card fan if it has an add-in graphics card with it's own fan.

Let us know some details about the system (Rockster's post). How long have you had the system running with the present hardware arrangement? If you run out of possibilities, consider that there may be a power supply problem.

Matt

 

Let me repeat... I DID...

General Information

Computer Model OptiPlex 755
BIOS Vendor Dell Inc.
BIOS Version A04
BIOS Date 11-05-07
Windows Version Microsoft Windows XP Professional


Mainboard Model 0HX555 (0x16F - 0x55C0A0)

LPCIO
-----------------------------------------------------
Vendor SMSC
Vendor ID 0x55
Chip ID 0x83
Config Mode I/O address 0x2E



Memory

Samsung DDR2
PC2-6400 (400 MHz)

DDR2 Dual Channel

Northbridge Intel Q35 rev. A2
Southbridge Intel 82801IH (ICH9DH) rev. 02
Memory Type DDR2
Memory Size 2048 MBytes
Channels Dual (Symmetric)
Memory Frequency 399.0 MHz (1:2)
CAS# 6.0
RAS# to CAS# 6
RAS# Precharge 6
Cycle Time (tRAS) 18
Command Rate 2T

DIMM #1

General
Memory type DDR2
Module format Regular UDIMM
Manufacturer (ID) Samsung (CE00000000000000)
Size 1024 MBytes
Max bandwidth PC2-6400 (400 MHz)
Part number M3 78T2953EZ3-CF7
Manufacturing date Week 41/Year 07

Attributes
Number of banks 2
Data width 64 bits
Correction None
Nominal Voltage 1.80 Volts
EPP no
XMP no

Timings table
Frequency (MHz) 266 333 400
CAS# 4.0 5.0 6.0
RAS# to CAS# delay 4 5 6
RAS# Precharge 4 5 6
TRAS 12 15 18
TRC 16 20 24

DIMM #2

General
Memory type DDR2
Module format Regular UDIMM
Manufacturer (ID) Samsung (CE00000000000000)
Size 1024 MBytes
Max bandwidth PC2-6400 (400 MHz)
Part number M3 78T2953EZ3-CF7
Manufacturing date Week 41/Year 07

Attributes
Number of banks 2
Data width 64 bits
Correction None
Nominal Voltage 1.80 Volts
EPP no
XMP no

Timings table
Frequency (MHz) 266 333 400
CAS# 4.0 5.0 6.0
RAS# to CAS# delay 4 5 6
RAS# Precharge 4 5 6
TRAS 12 15 18
TRC 16 20 24

Nope... Dell Optiplex 755

 

Thanks Matt,

The system does not look to be overheating. There are 3 fans total, and all are working. The system has been running for at least 6 months with the same configuration, used by the same user. The power supply was sometihing I was thinking about, but I noticed that the system was set to shutdown after a fatal error, not blue screen. So I am putting the idea of the problem being the power supply on the back burner for now, but I agree, it is still a possible culprit.

 

If you are happy to spend a little time on it, do all the basics. Run Error Checking (CHKDSK) on each drive. Clean up the HDD and uninstall any unnecessary (junk? ) programs. Do a defrag.

Look for drivers that are up to date with Service Pack 3, especially the chipset drivers. If there are no new drivers at Dell, try looking for them at chipset manufacturer's website (Intel?).

I swap out the RAM modules with compatible types for testing. See if Rockster has some suggestions.

Matt

 

iBooger - unfortunately nothing jumps off the page screaming, "Fix me, Fix me ".

I've always had pretty good luck with Samsung memory and considered it a very good choice for the money. Ive also used single sticks with similar mfg dates in dual channel systems (Samsung doesn't sell dual channel per se) the same way you are using it. So what to do now?

The only spec you are not in conformity with is CAS or (tcl) which should be 5 and you are running at 6. This is no big deal and 6 should give you more latitude anyway so I don't see this as a potential fix. Your voltage is stated at 1.8 which is the spec but as has already been suggested, you can try another PSU. Why would this matter? Just because your machine says its putting out 1.8V doesn't mean its so and an underpowered SSTL value will throw errors. A new PSU may give you a more stable and correct voltage (speculative but worth a try).

As another option, if your BIOS will let you adjust this manually, set it at 1.9V. That's only about a 5% increase and its not going to do any damage to anything (short term or long term). The fact that you have a Dell machine probably means the BIOS is crippled and isn't going to let you make this change but its worth investigating.

Lastly, I'd encourage you to consider buying some better memory that your machine is going to be nicer to. Get some low latency OCZ over at NewEgg and buy a dual channel pair of sticks that have been tested and packaged as such. Right now you can get 4 Gigs for 69.99 with a $30 rebate. (I just bought some for someone else).

Good Luck and keep us posted.

 

Thanks all for the help... I have another Dell 755 with the exact same setup, that I am going to try to swap memory modules. Going to run the other memory in the new pc to see if I get the same shutdowns. Thanks for all the suggestions. I really appreciate it.

 

Hi iBooger...just want to add on to the great advice you are getting here.

Is your Dell still covered by warranty or should I ask...did you get warranty for this unit? Depending on what coverage was purchased at the time of the PC purchase you might be covered by Dell Technical and could have a Dell Cert. Tech come out to your place and repair. No, I don't work for Dell, We just use Dell PC's\Laptops\Workstations at my place of work. When I order the units I will usually pick Dell Gold Warranty for approx 3 to 4 yrs and it has definitely been used.

Also if you do have warranty you might not want to do anything to drastic that will void the warranty.

 

Well, I took the other system and swapped both memory modules. Same memory type (Samsung), same computer (Dell Optiplex 755 mini).

I have not received errors on either system since... Not sure what is going on, but both systems seem to be running with no problems.