datorn startar om sig! hjälper en formatering?

jävligt konstigt... känns som det är olika sorters fel som orsakar omstarterna varje gång-- sasser/blaster-symptomet har bara skett 2 ggr.... bifogar den senaste dumpen:

Microsoft (R) Windows Debugger Version 6.4.0007.2
Copyright (c) Microsoft Corporation. All rights reserved.

Loading Dump File [C:\WINDOWS\Minidump\Mini052905-03.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows XP Kernel Version 2600 (Service Pack 2) MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 2600.xpsp_sp2_gdr.050301-1519
Kernel base = 0x804d7000 PsLoadedModuleList = 0x805624a0
Debug session time: Sun May 29 19:08:22.562 2005 (GMT+2)
System Uptime: 0 days 0:00:15.265
Loading Kernel Symbols
......................................................................................................................
Loading unloaded module list
....
Loading User Symbols
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1000008E, {c0000005, 80550ae2, f754783c, 0}

Probably caused by : Pool_Corruption ( nt!ExDeferredFreePool+107 )

Followup: Pool_corruption
---------

0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

KERNEL_MODE_EXCEPTION_NOT_HANDLED_M (1000008e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003. This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG. This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG. This will let us see why this breakpoint is
happening.
Arguments:
Arg1: c0000005, The exception code that was not handled
Arg2: 80550ae2, The address that the exception occurred at
Arg3: f754783c, Trap Frame
Arg4: 00000000

Debugging Details:
------------------

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - Instruktionen p "0x%08lx" refererade till minnet p "0x%08lx". Det gick inte att utf ra en minnes tg rd. F ljande fel returnerades: The memory could not be "%s".

FAULTING_IP:
nt!ExDeferredFreePool+107
80550ae2 893b mov [ebx],edi

TRAP_FRAME: f754783c -- (.trap fffffffff754783c)
ErrCode = 00000002
eax=e1c926f8 ebx=006c006f ecx=000001ff edx=e1c92d30 esi=863eb028 edi=00720074
eip=80550ae2 esp=f75478b0 ebp=f75478f0 iopl=0 nv up ei pl nz na po nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010206
nt!ExDeferredFreePool+0x107:
80550ae2 893b mov [ebx],edi ds:0023:006c006f=????????
Resetting default scope

CUSTOMER_CRASH_COUNT: 3

DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: 0x8E

LAST_CONTROL_TRANSFER: from 80550ac7 to 80550ae2

STACK_TEXT:
f75478f0 80550ac7 00000001 863ba598 860f8400 nt!ExDeferredFreePool+0x107
f7547930 805724ea e1c8c900 00000000 f754796c nt!ExFreePoolWithTag+0x47f
f7547940 8056caee e1c8c900 f7547901 00000000 nt!ObReleaseObjectSecurity+0x1a
f754796c 805726f7 e18b05e8 860f8400 00000001 nt!ObCheckObjectAccess+0xd3
f75479b8 805719e6 e1c2b008 00033c48 c90b4c4c nt!CmpDoOpen+0x256
f7547bb0 80571ef1 00033c48 00033c48 860f8400 nt!CmpParseKey+0x558
f7547c28 8056f2a8 000004ac f7547c68 00000040 nt!ObpLookupObjectName+0x119
f7547c7c 80571dbe 00000000 863ba558 8056e901 nt!ObOpenObjectByName+0xea
f7547d50 804dd99f 009cee34 00020019 009ced94 nt!NtOpenKey+0x1af
f7547d50 7c90eb94 009cee34 00020019 009ced94 nt!KiFastCallEntry+0xfc
WARNING: Frame IP not in any known module. Following frames may be wrong.
009ced70 00000000 00000000 00000000 00000000 0x7c90eb94

STACK_COMMAND: .bugcheck ; kb

FOLLOWUP_IP:
nt!ExDeferredFreePool+107
80550ae2 893b mov [ebx],edi

SYMBOL_STACK_INDEX: 0

FOLLOWUP_NAME: Pool_corruption

SYMBOL_NAME: nt!ExDeferredFreePool+107

MODULE_NAME: Pool_Corruption

IMAGE_NAME: Pool_Corruption

DEBUG_FLR_IMAGE_TIMESTAMP: 0

FAILURE_BUCKET_ID: 0x8E_nt!ExDeferredFreePool+107

BUCKET_ID: 0x8E_nt!ExDeferredFreePool+107

Followup: Pool_corruption
---------

Jag länkade tidigare till blaster-fixen. Prova sasser-fixe n och se om inte den hittar något.
Annars kan det vara värt att formatera om och följa de steg som tidigare givits.

så det verkar inte ha nåt med det nya ramminnet att göra? det är nåt mjukvarufel?

ska testa sasser-fixen. tack för all bra hjälp!

Klauz skrev:

så det verkar inte ha nåt med det nya ramminnet att göra?

Att du inte sa det innan. Prova Memtest

Har du kollat efter rootkits?

nä vad är rootkits? ska kolla memtest

Har liknand strul jag med

men jag vet att de inte är hårdvara på min eftersom datorn funkar perfect i Gentoo Linux

både under consoll o X11 med WM KDE Gnome Fluxbox

har kört memtest i över 2 timmar utan att nåt fel hittas.. (hur länge körs testet egentligen, jag avbröt det efter 4 felfria genomkörningar)

finns det inget annat buggigt i mina dumpfiler?

legis: vad är rootkits?

Klauz: Rootkits är kod som antingen existerar som filer på din maskin, eller enbart i minnet. Dess funktionalitet kan vara precis vadsomhelst, men ofta öppnar de upp en bakdörr på maskinen.

Det finns några enkla verktyg för att kolla, men de hittar inte 100%.

RootkitRevealer
http://www.sysinternals.com/ntw2k/freeware/rootkitreveal.shtml

BlackLight
http://www.f-secure.com/blacklight/

okej, finns det inget program som kan tolka dumpfiler?

sasser/blaster-symptomen verkar ha försvunnit nu iaf, nu är det mest omstarter utan förvarningar.

Jo, Debugging Tools. Det du skulle kunna göra är att du packar ner dina dumpfiler i en zip-fil och bifogar ett inlägg. Det är möjligt att vi andra kan göra en djupare analys av filerna. :)

Dumpfiler är en komplicerad process. Detta ingår till viss del i mittt jobb, men ibland kan man sitta i flera timmar om det är ett komplicerat problem. Debugging är en vetenskap, det är inget man lär sig rakt av.

Analyze -v är väl så långt man kan sträcka sig. Oftast kollar man då efter 'Image' och i 90% av alla kracher så står där en drivrutin.

Kortfattat kan man väl säga att om krascherna inte är likadana så är det till 99% hårdvaruproblem. Det kan vara minnet, processorn, PCU'n, värmeproblem etc.

Hej, det skulle vara otroligt snällt om ni kunde kolla igenom mina dumpar! :)

Den enda hårdvaran som det borde kunna vara fel på är minnet, men efter 2 timmars memtest så hittades inget fel...

bifogar dagens dumpar!

pliis, är det nån som orkar kolla mina dumpar?

kan det vara så att memtest inte hittar felen?

min dator har kraschat 69 ggr sen 23e maj.. får ingen ordning på vad som orsakar krascherna.

jag har som sagt ett extra ramminne i datorn som är av samma storlek och typ som det som redan sitter i. datorn är nyligen formaterad (23e maj) men ändå startar den om sig. omstarterna sker inom 5 min när jag har startat datorn. ofta kör jag igång outlook express, IE, miranda(icq&msn) o winamp direkt + att virusprogrammet AVPersonal autostartas.

Jag har avinstallerat Norton Antivorus 2005 samt daemon tools och kört memtest i 2timmar utan några fel...

är det nån som kan tolka dessa 2 dumpar från igår och se vad som är fel? pleeease

dump1

Microsoft (R) Windows Debugger Version 6.4.0007.2
Copyright (c) Microsoft Corporation. All rights reserved.

Loading Dump File [C:\WINDOWS\Minidump\Mini061105-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows XP Kernel Version 2600 (Service Pack 2) MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 2600.xpsp_sp2_gdr.050301-1519
Kernel base = 0x804d7000 PsLoadedModuleList = 0x805624a0
Debug session time: Sat Jun 11 00:54:18.328 2005 (GMT+2)
System Uptime: 0 days 0:00:22.031
Loading Kernel Symbols
......................................................................................................................................
Loading unloaded module list
.......................
Loading User Symbols
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 24, {1902fe, f78d3a64, f78d3760, 804f64a1}

Probably caused by : Ntfs.sys ( Ntfs!NtfsDeleteFcb+9f )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

NTFS_FILE_SYSTEM (24)
If you see NtfsExceptionFilter on the stack then the 2nd and 3rd
parameters are the exception record and context record. Do a .cxr
on the 3rd parameter and then kb to obtain a more informative stack
trace.
Arguments:
Arg1: 001902fe
Arg2: f78d3a64
Arg3: f78d3760
Arg4: 804f64a1

Debugging Details:
------------------

EXCEPTION_RECORD: f78d3a64 -- (.exr fffffffff78d3a64)
ExceptionAddress: 804f64a1 (nt!RebalanceNode+0x0000001c)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 00000000
Parameter[1]: 00ff010b
Attempt to read from address 00ff010b

CONTEXT: f78d3760 -- (.cxr fffffffff78d3760)
eax=000000ff ebx=e1a424ff ecx=00000000 edx=0000ff01 esi=00ff00ff edi=e1e764e8
eip=804f64a1 esp=f78d3b2c ebp=f78d3b3c iopl=0 nv up ei ng nz na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010282
nt!RebalanceNode+0x1c:
804f64a1 8a4e0c mov cl,[esi+0xc] ds:0023:00ff010b=??
Resetting default scope

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: 0x24

LAST_CONTROL_TRANSFER: from 804fe995 to 804f64a1

STACK_TEXT:
f78d3b3c 804fe995 e1e764e8 e1a364e8 8608e3c8 nt!RebalanceNode+0x1c
f78d3b54 804fe7c4 8608e3c8 e1a364e8 00000000 nt!DeleteNodeFromTree+0x94
f78d3b6c f732d54f 8608e3c8 e1a364e8 8608e260 nt!RtlDeleteElementGenericTableAvl+0x3b
f78d3b94 f730057a 86182008 f78d3bbc f78d3bc7 Ntfs!NtfsDeleteFcb+0x9f
f78d3be0 f7321d00 86182008 8608e100 e1a35820 Ntfs!NtfsTeardownFromLcb+0x1fd
f78d3c38 f72fc759 86182008 e1a358e8 00000000 Ntfs!NtfsTeardownStructures+0x125
f78d3c64 f731f6eb 86182008 01a358e8 00000000 Ntfs!NtfsDecrementCloseCounts+0x9e
f78d3ce8 f7327e13 86182008 e1a358e8 e1a35820 Ntfs!NtfsCommonClose+0x397
f78d3d7c 804e23b5 00000000 00000000 863c3a20 Ntfs!NtfsFspClose+0xe3
f78d3dac 80574128 00000000 00000000 00000000 nt!ExpWorkerThread+0xef
f78d3ddc 804efc81 804e22f1 00000000 00000000 nt!PspSystemThreadStartup+0x34
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16

FOLLOWUP_IP:
Ntfs!NtfsDeleteFcb+9f
f732d54f 8b06 mov eax,[esi]

SYMBOL_STACK_INDEX: 3

FOLLOWUP_NAME: MachineOwner

SYMBOL_NAME: Ntfs!NtfsDeleteFcb+9f

MODULE_NAME: Ntfs

IMAGE_NAME: Ntfs.sys

DEBUG_FLR_IMAGE_TIMESTAMP: 41107eea

STACK_COMMAND: .cxr fffffffff78d3760 ; kb

FAILURE_BUCKET_ID: 0x24_Ntfs!NtfsDeleteFcb+9f

BUCKET_ID: 0x24_Ntfs!NtfsDeleteFcb+9f

Followup: MachineOwner
---------

dump2

Microsoft (R) Windows Debugger Version 6.4.0007.2
Copyright (c) Microsoft Corporation. All rights reserved.

Loading Dump File [C:\WINDOWS\Minidump\Mini061105-02.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows XP Kernel Version 2600 (Service Pack 2) MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 2600.xpsp_sp2_gdr.050301-1519
Kernel base = 0x804d7000 PsLoadedModuleList = 0x805624a0
Debug session time: Sat Jun 11 11:28:48.234 2005 (GMT+2)
System Uptime: 0 days 0:07:02.814
Loading Kernel Symbols
..........................................................................................................................................
Loading unloaded module list
...............................
Loading User Symbols
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1000008E, {c0000005, bf8011d7, f6e34a48, 0}

Probably caused by : win32k.sys ( win32k!TimersProc+68 )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

KERNEL_MODE_EXCEPTION_NOT_HANDLED_M (1000008e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003. This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG. This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG. This will let us see why this breakpoint is
happening.
Arguments:
Arg1: c0000005, The exception code that was not handled
Arg2: bf8011d7, The address that the exception occurred at
Arg3: f6e34a48, Trap Frame
Arg4: 00000000

Debugging Details:
------------------

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - Instruktionen p "0x%08lx" refererade till minnet p "0x%08lx". Det gick inte att utf ra en minnes tg rd. F ljande fel returnerades: The memory could not be "%s".

FAULTING_IP:
win32k!TimersProc+68
bf8011d7 894e1c mov [esi+0x1c],ecx

TRAP_FRAME: f6e34a48 -- (.trap fffffffff6e34a48)
ErrCode = 00000003
eax=2b484f13 ebx=00000032 ecx=21a02152 edx=00000673 esi=00ffffff edi=0000003e
eip=bf8011d7 esp=f6e34abc ebp=f6e34ad4 iopl=0 nv up ei pl nz ac pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010212
win32k!TimersProc+0x68:
bf8011d7 894e1c mov [esi+0x1c],ecx ds:0023:0100001b=????????
Resetting default scope

CUSTOMER_CRASH_COUNT: 2

DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: 0x8E

LAST_CONTROL_TRANSFER: from bf888cf2 to bf8011d7

STACK_TEXT:
f6e34ad4 bf888cf2 00000022 0072fff4 bf801097 win32k!TimersProc+0x68
f6e34d30 bf86d76e f6e444a8 00000002 f6e34d54 win32k!RawInputThread+0x634
f6e34d40 bf8010ba f6e444a8 f6e34d64 0072fff4 win32k!xxxCreateSystemThreads+0x60
f6e34d54 804dd99f 00000000 00000022 00000000 win32k!NtUserCallOneParam+0x23
f6e34d54 7c90eb94 00000000 00000022 00000000 nt!KiFastCallEntry+0xfc
WARNING: Frame IP not in any known module. Following frames may be wrong.
0072ffe0 00000000 00000000 00000000 00000000 0x7c90eb94

FOLLOWUP_IP:
win32k!TimersProc+68
bf8011d7 894e1c mov [esi+0x1c],ecx

SYMBOL_STACK_INDEX: 0

FOLLOWUP_NAME: MachineOwner

SYMBOL_NAME: win32k!TimersProc+68

MODULE_NAME: win32k

IMAGE_NAME: win32k.sys

DEBUG_FLR_IMAGE_TIMESTAMP: 422511a2

STACK_COMMAND: .trap fffffffff6e34a48 ; kb

FAILURE_BUCKET_ID: 0x8E_win32k!TimersProc+68

BUCKET_ID: 0x8E_win32k!TimersProc+68

Followup: MachineOwner
---------

emm kolla ström o tempratur

borde väl inte kunna va strömmen? datorn går ju över till batteri om strömmen inte funkar--? hur kollar jag tempen?