Windows XP Pro - Intermittent Restarts [DUMP]

Hello;

I have been experiencing intermittent restarts within Windows XP for a little while now. I have looked at the dump files though WinDBG and am still unable to solve the issue. Any assistance would be greatly appreciated.
The debugging results are:


Microsoft (R) Windows Debugger Version 6.3.0017.0
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\WINDOWS\Minidump\Mini011605-04.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: C:\WINDOWS\Symbols
Executable search path is: C:\WINDOWS\system32
Windows XP Kernel Version 2600 (Service Pack 2) UP Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 2600.xpsp_sp2_rtm.040803-2158
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055ab20
Debug session time: Sun Jan 16 12:50:36 2005
System Uptime: 0 days 1:45:57.198
Loading Kernel Symbols
.................................................................................................................................
Loading unloaded module list
....................
Loading User Symbols
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1000000A, {ffdfb128, 2, 1, 804d8f0a}

Probably caused by : ntoskrnl.exe ( nt!KiReadyThread+133 )

Followup: MachineOwner
---------

kd> .reload
Loading Kernel Symbols
.................................................................................................................................
Loading unloaded module list
....................
Loading User Symbols
kd> .reload
Loading Kernel Symbols
.................................................................................................................................
Loading unloaded module list
....................
Loading User Symbols
kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: ffdfb128, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000001, value 0 = read operation, 1 = write operation
Arg4: 804d8f0a, address which referenced memory

Debugging Details:
------------------


WRITE_ADDRESS: ffdfb128

CURRENT_IRQL: 2

FAULTING_IP:
nt!KiReadyThread+133
804d8f0a 894708 mov [edi+0x8],eax

CUSTOMER_CRASH_COUNT: 4

DEFAULT_BUCKET_ID: COMMON_SYSTEM_FAULT

BUGCHECK_STR: 0xA

LAST_CONTROL_TRANSFER: from 804dc3c3 to 804d8f0a

STACK_TEXT:
80550754 804dc3c3 877cbce8 8055078c 80550764 nt!KiReadyThread+0x133
80550774 804dca58 877cbd00 0000004c 8055089c nt!KiWaitTest+0xcd
80550880 804dc928 80559580 80559320 ffdff000 nt!KiTimerListExpire+0x7a
805508ac 804dc179 80559980 00000000 0006354c nt!KiTimerExpiration+0xaf
805508c0 80559320 ffdffc50 00000000 00000000 nt!KiRetireDpcList+0x46
805508d0 804dc0ed 00000000 0000000e 00000000 nt!KiIdleThread0


FOLLOWUP_IP:
nt!KiReadyThread+133
804d8f0a 894708 mov [edi+0x8],eax

SYMBOL_STACK_INDEX: 0

FOLLOWUP_NAME: MachineOwner

SYMBOL_NAME: nt!KiReadyThread+133

MODULE_NAME: nt

IMAGE_NAME: ntoskrnl.exe

DEBUG_FLR_IMAGE_TIMESTAMP: 41108004

STACK_COMMAND: kb

BUCKET_ID: 0xA_W_nt!KiReadyThread+133

Followup: MachineOwner
---------

Thank you
Kevin

 

Hello again...
I set the debug option in Windows for a complete memory dump and this is the information that was in the dump file.


Microsoft (R) Windows Debugger Version 6.3.0017.0
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\WINDOWS\Minidump\Mini011605-05.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: C:\WINDOWS\Symbols
Executable search path is: C:\WINDOWS\system32
Windows XP Kernel Version 2600 (Service Pack 2) UP Free x86 compatible
Product: WinNt
Built by: 2600.xpsp_sp2_rtm.040803-2158
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055ab20
Debug session time: Sun Jan 16 13:29:55 2005
System Uptime: 0 days 0:38:47.571
Loading Kernel Symbols
................................................................................................................................
Loading unloaded module list
................
Loading User Symbols
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck A, {0, 2, 1, 804dc901}

Probably caused by : ntoskrnl.exe ( nt!KiTimerExpiration+84 )

Followup: MachineOwner
---------

kd> .reload
Loading Kernel Symbols
................................................................................................................................
Loading unloaded module list
................
Loading User Symbols
kd> .reload
Loading Kernel Symbols
................................................................................................................................
Loading unloaded module list
................
Loading User Symbols
kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 00000000, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000001, value 0 = read operation, 1 = write operation
Arg4: 804dc901, address which referenced memory

Debugging Details:
------------------


WRITE_ADDRESS: 00000000

CURRENT_IRQL: 2

FAULTING_IP:
nt!KiTimerExpiration+84
804dc901 893b mov [ebx],edi

CUSTOMER_CRASH_COUNT: 5

DEFAULT_BUCKET_ID: COMMON_SYSTEM_FAULT

BUGCHECK_STR: 0xA

LAST_CONTROL_TRANSFER: from 804dc179 to 804dc901

TRAP_FRAME: f78a2f38 -- (.trap fffffffff78a2f38)
ErrCode = 00000002
eax=8055a320 ebx=00000000 ecx=877f9cb8 edx=000000ff esi=000000e4 edi=00000000
eip=804dc901 esp=f78a2fac ebp=f78a2fd0 iopl=0 nv up ei ng nz ac pe cy
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010293
nt!KiTimerExpiration+0x84:
804dc901 893b mov [ebx],edi ds:0023:00000000=????????
Resetting default scope

STACK_TEXT:
f78a2fd0 804dc179 80559980 00000000 000245e4 nt!KiTimerExpiration+0x84
f78a2ff4 804dbe2d b2210260 00000000 00000000 nt!KiRetireDpcList+0x46


FOLLOWUP_IP:
nt!KiTimerExpiration+84
804dc901 893b mov [ebx],edi

SYMBOL_STACK_INDEX: 0

FOLLOWUP_NAME: MachineOwner

SYMBOL_NAME: nt!KiTimerExpiration+84

MODULE_NAME: nt

IMAGE_NAME: ntoskrnl.exe

DEBUG_FLR_IMAGE_TIMESTAMP: 41108004

STACK_COMMAND: .trap fffffffff78a2f38 ; kb

BUCKET_ID: 0xA_W_nt!KiTimerExpiration+84

Followup: MachineOwner
---------

kd> u nt!KiTimerExpiration+84
nt!KiTimerExpiration+0x84:
804dc901 893b mov [ebx],edi
804dc903 895f04 mov [edi+0x4],ebx
804dc906 8b7df4 mov edi,[ebp-0xc]
804dc909 8d5df0 lea ebx,[ebp-0x10]
804dc90c 8919 mov [ecx],ebx
804dc90e 897904 mov [ecx+0x4],edi
804dc911 890f mov [edi],ecx
804dc913 894df4 mov [ebp-0xc],ecx
kd> u nt!KiRetireDpcList+0x46
nt!KiRetireDpcList+0x46:
804dc179 837c240c00 cmp dword ptr [esp+0xc],0x0
804dc17e 7559 jnz nt!KiRetireDpcList+0xa6 (804dc1d9)
804dc180 fa cli
804dc181 3b6d00 cmp ebp,[ebp]
804dc184 75c1 jnz nt!KiRetireDpcList+0x14 (804dc147)
804dc186 c7839409000000000000 mov dword ptr [ebx+0x994],0x0
804dc190 c7839809000000000000 mov dword ptr [ebx+0x998],0x0
804dc19a 3b6d00 cmp ebp,[ebp]
kd> u trap fffffffff78a2f38
*** ERROR: Module load completed but symbols could not be loaded for PfModNT.sys
*** ERROR: Module load completed but symbols could not be loaded for ipnat.sys
*** ERROR: Module load completed but symbols could not be loaded for mrxsmb.sys
*** ERROR: Symbol file could not be found. Defaulted to export symbols for rdbss.sys -
*** WARNING: Unable to verify timestamp for InCDfs.SYS
*** ERROR: Module load completed but symbols could not be loaded for InCDfs.SYS
*** ERROR: Module load completed but symbols could not be loaded for ctac32k.sys
*** ERROR: Module load completed but symbols could not be loaded for ctsfm2k.sys
*** ERROR: Module load completed but symbols could not be loaded for emupia2k.sys
*** ERROR: Module load completed but symbols could not be loaded for ha10kx2k.sys
*** ERROR: Module load completed but symbols could not be loaded for hap16v2k.sys
*** ERROR: Module load completed but symbols could not be loaded for ati2mtag.sys
*** ERROR: Module load completed but symbols could not be loaded for ctoss2k.sys
*** ERROR: Module load completed but symbols could not be loaded for ctaud2k.sys
*** ERROR: Module load completed but symbols could not be loaded for el90xbc5.sys
*** ERROR: Module load completed but symbols could not be loaded for Pcouffin.sys
*** ERROR: Module load completed but symbols could not be loaded for ati2dvag.dll
*** ERROR: Symbol file could not be found. Defaulted to export symbols for ati2cqag.dll -
*** ERROR: Symbol file could not be found. Defaulted to export symbols for ati3duag.dll -
*** ERROR: Symbol file could not be found. Defaulted to export symbols for ativvaxx.dll -
*** ERROR: Symbol file could not be found. Defaulted to export symbols for drmk.sys -
*** ERROR: Module load completed but symbols could not be loaded for ultra.sys
*** ERROR: Module load completed but symbols could not be loaded for PxHelp20.sys
*** WARNING: Unable to verify checksum for InCDPass.sys
*** ERROR: Module load completed but symbols could not be loaded for InCDPass.sys
*** ERROR: Module load completed but symbols could not be loaded for secdrv.sys
*** ERROR: Module load completed but symbols could not be loaded for ctprxy2k.sys
*** WARNING: Unable to verify timestamp for InCDrec.SYS
*** ERROR: Module load completed but symbols could not be loaded for InCDrec.SYS
Couldn't resolve error at 'trap fffffffff78a2f38'
kd> u fffffffff78a2f38
f78a2f38 d02f shr byte ptr [edi],1
f78a2f3a 8af7 mov dh,bh
f78a2f3c 01c9 add ecx,ecx
f78a2f3e 4d dec ebp
f78a2f3f 80000d add byte ptr [eax],0xd
f78a2f42 dbbaff000000 fstp tbyte ptr [edx+0xff]
f78a2f48 782f js f78a2f79
f78a2f4a 8a02 mov al,[edx]

I hope this additional information will help.

Kevin