PC keeps randomly restarting - Norton can't find any bugs

Norton Security | Norton Internet Security
1

Hi

My PC keeps randomly restarting.  It's not an overheating problem as it occurs within a couple of minutes of first boot up even when PC has been off for hours. It soesn;t happen if I boot up Windows in Safe Mode.

I ran a full system scan in Safe Mode and no errors came up.

I checked the event log and it says this:

 

 

The computer has reb ooted from a bugcheck.  The bugcheck was: 0x100000d1 (0x6b6f20c9, 0x00000002, 0x00000000, 0xf74a55a1).  a dump was saved in C:\\Windows\Minidump\Mini050409-05.dmp.

 

I can't open the dmp file.

 

I'm running Windows XP Ver 2002 SP3, Pentium(r) 4 CPU 3 GHz, 1GB RAM

 

Can anybody help?

 

:smileymad:

2

The error number is a Microsoft error number.  Information on this error can be found here.  Hopefully it is helpful.

 

http://support.microsoft.com/kb/810980

 

This error relates to an issue with Logitech software or mouse.  You may require a driver or program update.

 

If you don't have this particular mouse or software, or old versions on your computer, you might check the software for the equipment that you do have to see if there are updates.

 

It does semm to be a Windows issue rather than a Norton problem.

3

You can also run a checkdisk scan and a system file check scan.  But if you have an external mouse attached to your system; unplug it and reboot.  Do you still get the error then?

4

Thanks for the responses

I don't seem to have any Logitech software on the PC - nothing shows up through Control Panel/Add or Remove Programs.

I did a checkdisk but this doesn't seem to have solved the problem

When my mouse is not plugged in it seems to delay the problem but eventually it happens, whereas with the mouse plugged in it happens much quicker.

I'm at a loss now, the PC is basically unusable - any final thoughts before I take it to a techy?

5

This really sound like a hardware / driver error (most likely peripheral hardware).  Sounds weird but how about the keyboard being unplugged?  I'm going to go read up on the MS kb article.  I'll be back soon.

 

The article above talks about keyboards and mice.  Please check without the keyboard attached or borrow a friend's and use that to test the system. 

Message Edited by dbrisendine on 05-04-2009 01:11 AM
6

Time:

 

You didn't actually say, but are you using a laptop with an external mouse, or a tower with mouse and keyboard?  Curious if touchpad software is conflicting with mouse software.

7

Thanks again both.

I'm using a tower with external mouse and keyboard.

Removing the keyboard didn't solve the problem either!

 

8

Could you check the logs in Event Viewer and notice if there are suspicious errors causing this problem? To use “Event Viewer”, right click on Computer/My Computer from your desktop, click Manage, in the right pane go to Event Viewer - System. Look through the logs and report any suspicious errors/warnings, or you can just right-click on “System” and use “Save log file as” and attach the file.

9

If you want to send the file, post back here with that request and someone will PM the directions to you.  You can only attach images to posts or insert links to URL addresses.

10

OK, thanks all - finally found the time to do this. If someoner sends me the details I can attach the file.

The event log entries that seem to be most relevant are:

 

Information log

 

Log Name:      E:\Time event log file.evt
Source:        Save Dump
Date:          9/05/2009 8:59:18 AM
Event ID:      1001
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      P4-02E75AA35D26
Description:
The description for Event ID 1001 from source Save Dump cannot be found. Either the component that raises this event is not installed on your local computer or the installation is corrupted. You can install or repair the component on the local computer.

If the event originated on another computer, the display information had to be saved with the event.

The following information was included with the event:

0x100000d1 (0x6b6f20c9, 0x00000002, 0x00000000, 0xf74a55a1)
C:\WINDOWS\Minidump\Mini050909-01.dmp

Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Save Dump" />
    <EventID Qualifiers="16384">1001</EventID>
    <Level>4</Level>
    <Task>0</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2009-05-08T22:59:18.000Z" />
    <EventRecordID>17163</EventRecordID>
    <Channel>E:\Time event log file.evt</Channel>
    <Computer>P4-02E75AA35D26</Computer>
    <Security />
  </System>
  <EventData>
    <Data>0x100000d1 (0x6b6f20c9, 0x00000002, 0x00000000, 0xf74a55a1)</Data>
    <Data>C:\WINDOWS\Minidump\Mini050909-01.dmp</Data>
  </EventData>
</Event>

 

Another couple of entries that may be relevant are:

 

Log Name:      E:\Time event log file.evt
Source:        Dhcp
Date:          9/05/2009 8:59:24 AM
Event ID:      1002
Task Category: None
Level:         Error
Keywords:      Classic
User:          N/A
Computer:      P4-02E75AA35D26
Description:
The description for Event ID 1002 from source Dhcp cannot be found. Either the component that raises this event is not installed on your local computer or the installation is corrupted. You can install or repair the component on the local computer.

If the event originated on another computer, the display information had to be saved with the event.

The following information was included with the event:

192.168.0.101
001B11C9D170
192.168.0.1

Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Dhcp" />
    <EventID Qualifiers="0">1002</EventID>
    <Level>2</Level>
    <Task>0</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2009-05-08T22:59:24.000Z" />
    <EventRecordID>17165</EventRecordID>
    <Channel>E:\Time event log file.evt</Channel>
    <Computer>P4-02E75AA35D26</Computer>
    <Security />
  </System>
  <EventData>
    <Data>192.168.0.101</Data>
    <Data>001B11C9D170</Data>
    <Data>192.168.0.1</Data>
  </EventData>
</Event>

 

another one

 

Log Name:      E:\Time event log file.evt
Source:        Dhcp
Date:          9/05/2009 8:59:24 AM
Event ID:      1003
Task Category: None
Level:         Warning
Keywords:      Classic
User:          N/A
Computer:      P4-02E75AA35D26
Description:
The description for Event ID 1003 from source Dhcp cannot be found. Either the component that raises this event is not installed on your local computer or the installation is corrupted. You can install or repair the component on the local computer.

If the event originated on another computer, the display information had to be saved with the event.

The following information was included with the event:

001B11C9D170
%%1223

Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Dhcp" />
    <EventID Qualifiers="0">1003</EventID>
    <Level>3</Level>
    <Task>0</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2009-05-08T22:59:24.000Z" />
    <EventRecordID>17164</EventRecordID>
    <Channel>E:\Time event log file.evt</Channel>
    <Computer>P4-02E75AA35D26</Computer>
    <Security />
  </System>
  <EventData>
    <Data>001B11C9D170</Data>
    <Data>%%1223</Data>
    <Binary>C7040000</Binary>
  </EventData>
</Event>

11

Okay, next bizarre question, have you got wake and sleep buttons on the keyboard?

12

Are you using Norton Save & Restore?

Or any other live backup utility?

 

I have had two clients where removing those applications completely stopped the rebooting problem.

13

Time -

 

I have PM you with some instructions and email for the Event logs.  Check your envelope for a message.

14

Yes, my keyboard does have a sleep and wake-up key I think (one is a moon and the other an alarm clock - I'm presuming that is what they are!)

No I'm not running any save and restore software

Thanks again

15

Have a look at this, and maybe see if you have another keyboard you can try.

 

http://support.microsoft.com/kb/302092

16

Hi

 

2 of your errors, point to the Dhcp, which could mean that it could be to do with the dhcp service in the Administrator Tools, Services, or a Service that the dhcp depends on.

 

DHCP.jpg

 

Quads 

17

If you have not done this yet please run a System File Check on this installation.  Click START and then Run and type in sfc /scannow and press ENTER.  Please have your Windows Install CD handy for when it asks for a source of the files to copy.  Please post the results here.  I need to check one more thing in your log.

18

I did the scan and when it finished no results came up - it just went back to the Windows desktop.  Is there somehere to go to find the results?

19

You can check the Event Viewer but I'm not sure.  Did it ever ask for the CD or a different location for the files to copy?

 

Additional info:

 

You should be able to view the results in the log file at &windir%\Logs\CBS\CBS.log .  For example C:\Windows\logs\CBS\CBS.log .

Message Edited by dbrisendine on 05-09-2009 10:01 PM
20

The event log said "Windows File Protection file scan completed successfully"

It did prompt me for the CD on a number of occassions as it went through the scan