Random Restarts

Hi Having occasional random restarts on my PC. No pattern. Sometimes I get a 'Recovered from serious error…' message. Just had two on the bounce and I thought 'It's Tom Coyote time!' Any ideas where to start - words of one syllable please. Assume you are speaking to a moron. Thanks as ever. Nelclaret

Hello Nelclaret,

First let's get rid of the automatic restart so we can figure out which error your system is encountering:

• Go to Start, right-click My Computer and choose Properties
• Click the Advanced tab
• In the Startup and Recovery section, click Settings
• In the System failure section, uncheck "Automatically restart"
• Click OK twice

Now, your system will not automatically restart when the error occurs. This does not mean the issue is resolved, it just means you will be able to see the error encountered.

You will start seeing the Windows Stop Error screen, also known as the "Blue Screen of Death" (BSOD). Encountering this screen means that Windows can no longer continue operating normally and needs to be restarted. What is important is that, although daunting, this screen will tell you the error name and number that made your computer unhappy. Please write down this error name and number the next time you receive it and post it here.

The other option you have to get the error code is through the Event Viewer. Using this method, you won't have to wait for the system to encounter another error.:

• Go to Start|Run, type eventvwr.msc, and press Enter.
• When the Event Viewer opens, there will be two panes. The left pane is for event categories (Application, Security, and System). The right pane is for event messages (Information, Warning, and Error). We want to find errors.
• Left-click the Application category in the left pane and check for any error messages in the right pane. You want one that occurred the same time your system encountered the error.
• Repeat the previous step for each category, or until you find an appropriate error.
• Double-click the error message to bring up the information.
• Click the third button on the right side of the information window (copies information)
• Paste the information here

I hope I have explained clearly enough. I couldn't limit the words to one syllable, so I apologize for that. Please take your time going through this process, do one step at a time and it won't seem so difficult. If have any questions, just ask :).

Regards,

Ax

Hello Ax

Thank you for your reply and the instructions that even an idiot could follow.

When I went into the event viewer I found many errors showing (frightening really) but this one looks to me to be the most likely. I could be miles off here, of course.

If this is a red herring then I will indeed disable the restart and await the next BSOD.

Thanks in advance.

Nelclaret



Event Type: Error
Event Source: System Error
Event Category: (102)
Event ID: 1003
Date: 02/02/2007
Time: 09:44:25
User: N/A
Computer: DESKTOP
Description:
Error code 100000d1, parameter1 00000007, parameter2 00000002, parameter3 00000000, parameter4 f89ffe88.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 53 79 73 74 65 6d 20 45 System E
0008: 72 72 6f 72 20 20 45 72 rror Er
0010: 72 6f 72 20 63 6f 64 65 ror code
0018: 20 31 30 30 30 30 30 64 100000d
0020: 31 20 20 50 61 72 61 6d 1 Param
0028: 65 74 65 72 73 20 30 30 eters 00
0030: 30 30 30 30 30 37 2c 20 000007,
0038: 30 30 30 30 30 30 30 32 00000002
0040: 2c 20 30 30 30 30 30 30 , 000000
0048: 30 30 2c 20 66 38 39 66 00, f89f
0050: 66 65 38 38 fe88

Thanks, that's great, you performed wonderfully! I'm glad to hear you didn't get lost in the instructions. I hope these ones are straightforward as well.

We are going to attempt to delete and refresh your page file, as it may be corrupted. A page file is a portion of your hard drive that is reserved for the system to use in order to extend the system memory. Page files are typically 1.5-3 times the size of the amount of RAM (Random Access Memory) installed on a system.

In order to replace the page file, we first have to delete the current one and then create a new one:

• Go to Start, right-click My Computer, and choose Properties
• Click the Advanced tab
• In the Performance section, click Settings
• Click the Advanced tab
• In the Virtual memory section, click Change
• Take note of the current settings, in other words…write them down! You specifically need to know which radio button is selected and/or the "Initial size (MB)" and "Maximum size (MB)" values.
• Click the "No paging file" option
• Click the Set button
• OK out, you will get a prompt to restart your system, do this.
• After your system is restarted, repeat steps 1-5, change your settings back to what they were previously, and then repeat steps 8 and 9.

Feel free to stop and ask a question if you get lost. Please let me know if this resolves your issue. If not, we will continue working through to a solution.

Regards,

Ax

Hello Ax

Thank you for your reply.

I have not yet updated my page file (due to other commitments). However, before I do so I have just had another random crash/restart. I went straight to the event viewer and obtained the details. Two errors are shown and I post then below.

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7000
Date: 04/02/2007
Time: 11:25:59
User: N/A
Computer: DESKTOP
Description:
The DigitalCam Pro Video Camera Device service failed to start due to the following error:
The service cannot be started, either because it is disabled or because it has no enabled devices associated with it.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.


Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7000
Date: 04/02/2007
Time: 11:25:59
User: N/A
Computer: DESKTOP
Description:
The LicCtrl Service service failed to start due to the following error:
The system cannot find the file specified.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.


These are obviously different to the error I originally pasted.

I thought I would let you see these before acting on your earlier advice. just to emphasise - I have NOT yet updated the page file per your instructions as yet and I will await to hear from you before proceding further.

Sorry if this is wrong or a red herring.

Thanks again for your time.

Nelclaret

Hello Nelclaret, I am not entirely sure that those are the events causing the restarts. Let's start with my advice from the previous post first. Also, if you haven't already followed the advice in my first post to prevent the system from automatically restarting, please do so. Then, when the system restarts, write down the information in the error and then post it here. This may be the best way for us to get the issue narrowed down, since it seems the event logger is having errors on startup as well. Regards, Ax

Hi Ax Thanks for your eminently sensible advice (which I have at last taken!) I have disabled the auto re-start and I await the BSOD with trepidation. To show how ignorant I am, can you confirm that after I have taken the BSOD error details it is correct to just turn off the PC then re-boot (I have never seen a BSOD you see)? Also. with regard to the page file update procedure, If I make a hash of it will a system restore put things back OK - or am I worrying unnecessarily. Thanks again. Nelclaret

Nelclaret,

No problem at all, hopefully we can get to the bottom of this without much trouble. Good job, I'm glad you were able to disable the auto restart.

To show how ignorant I am, can you confirm that after I have taken the BSOD error details it is correct to just turn off the PC then re-boot (I have never seen a BSOD you see)?

Also. with regard to the page file update procedure, If I make a hash of it will a system restore put things back OK - or am I worrying unnecessarily.

You are correct that you can just power down your system and then reboot (you'll be hard-pressed to be able to do anything else for that matter!).

With the procedure I gave you to refresh the page file, there should be no problems if you follow my directions well.

I look forward to your update,

Ax

Hello Ax We have just had the BSOD. I wasn't around when this happened but my wife wrote down the error message in my absence before restarting. As follows: "STOP: 0x00000050(0x8A8ADDAF,0x00000000,0x804E87E1,0x00000000)" I hope this is what is needed. If not, let me know what is missing, if anything, and I will look out for it next BSOD! Many thanks Nelclaret

Thanks for getting back to me Nelclaret, you've gotten all of the information required. This is also consistent with the first System Error you posted. It appears you may have a rootkit. Here's an MS KB that addresses the issue:
http://support.microsoft.com/kb/894278

The steps are laid out in a relatively straightforward manner and give you several options for resolving the issue.

Regards,

Ax

Hi Ax I attempted to fix this using IE (option1) in the link procedure. Accessed the drivers list but no sign of any .sys file at all! I am hesitating about trying methods 2 and 3 as yet as I presume the failure to find this system file in IE may mean the rest would be a wild goose chase? What do you think? Thanks Nelclaret

Well I'm not sure it would be a wild goose chase, as the methods are telling you where to find the files. We won't know if this is what's wrong with your system or not until you work through the resolution. I think if you follow the steps closely you will do fine. Also, if you need any help, you can always ask us here. Regards, Ax

Ax Just to let you know that I am currently holding fire as I have not had a BSOD for over a week and I am following the principle of if it aint broke… But there again, I'm an idiot… Thanks for all your help to date. If the problem resurfaces I'll spring into action… Nelclaret

Good to hear Nelclaret. If/When you spring, I'll be ready for the recoil.