Random reboots every few days around 9am...wtf

[n7]

I cannot figure out wtf is going on.
System is stable, isn't infected with virus/spyware, yet for the last little while, every few days, when i wake up or come home from work, my PC has restarted.

I initially thought it was random, but it certainly isn't really; it's happening at a somewhat similar time (8.50am - 9.30am).

And no, it's not automatic updates set to install.
I have updates set to "Check for & let me choose".

Pic of what event viewer looks like: http://www.imageannex.com/out....eventlogvista64ult.jpg

Here are the last times it has rebooted.

The previous system shutdown at 8:50:53 AM on 8/19/2007 was unexpected.
The previous system shutdown at 8:59:32 AM on 8/16/2007 was unexpected.
The previous system shutdown at 8:46:55 AM on 8/11/2007 was unexpected.
The previous system shutdown at 9:00:01 PM on 8/7/2007 was unexpected.
The previous system shutdown at 9:32:46 AM on 8/2/2007 was unexpected.




Any ideas or help with other ways to find out what's going on would be appreciated, thanx.

 

[Cutthroat]

Do you have any crash dumps?

Just a wild guess, take your Audigy out for a week and use your onboard sound, I don't trust Creative drivers.

 

[n7]

How would i look up crash dumps?

As for the Audigy being the problem, i'm sure it's possible, but why would it be crashing things when it's not even in use?

I play games, music, etc. & no issues.

The reboots are happening when the PC is basically idling doing nothing.

 

[Cutthroat]

If you haven't turned off automatic restart after system failure you may be having a BSOD and not seeing it. Have a look at "dclive" signature, if you have any dump files he can read them.

I doubt your Audigy is causing the problem, but I don't trust the drivers as I said so it wouldn't be a bad idea to eliminate it as the problem.

 

[Chadder007]

Do you have any antivirus, antispyware doing a scheduled routine scan at that time?

 

[stash]

What's with all the disk errors?

 

[n7]

Originally posted by: Cutthroat
If you haven't turned off automatic restart after system failure you may be having a BSOD and not seeing it. Have a look at "dclive" signature, if you have any dump files he can read them.

That's turned off: pic of startup & recovery options

So it shows it's doing a Kernel memory dump...but to where?
I don't understand what %SystemRoot%\MEMORY.DMP is, sorry.

Originally posted by: Chadder007
Do you have any antivirus, antispyware doing a scheduled routine scan at that time?

Negative.

Originally posted by: stash
What's with all the disk errors?

The device, \Device\Harddisk2\DR2, has a bad block.

One of my storage HDDs has two pending sectors. (BTW, it's had two pending sectors forever...how can that be fixed, or can it?)

Other five HDDs (including OS HDD) are fine.


Ideas are still welcome, since i while i'm sure the dump files have great info, i don't know how to find them, nevermind read them.

Thanx.

 

[n7]

I figured out where teh memory.dmp file is.

I got the latest x64 debugger from MS, since the x86 was giving me errors.

Same issue though.

This is what it tells me when i attempt to load the file:




Microsoft (R) Windows Debugger Version 6.7.0005.1
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Windows\MEMORY.DMP]
Kernel Summary Dump File: Only kernel address space is available

Symbol search path is: *** Invalid ***
****************************************************************************
* Symbol loading may be unreliable without a symbol search path. *
* Use .symfix to have the debugger choose a symbol path. *
* After setting your symbol path, use .reload to refresh symbol locations. *
****************************************************************************
Executable search path is:
*********************************************************************
* Symbols can not be loaded because symbol path is not initialized. *
* *
* The Symbol Path can be set by: *
* using the _NT_SYMBOL_PATH environment variable. *
* using the -y <symbol_path> argument when starting the debugger. *
* using .sympath and .sympath+ *
*********************************************************************
*** ERROR: Symbol file could not be found. Defaulted to export symbols for ntkrnlmp.exe -
Windows Vista Kernel Version 6000 MP (2 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 6000.16386.amd64fre.vista_rtm.061101-2205
Kernel base = 0xfffff800`02800000 PsLoadedModuleList = 0xfffff800`02999e90
Debug session time: Sun Aug 19 13:51:30.009 2007 (GMT-6)
System Uptime: 0 days 0:00:14.774
*********************************************************************
* Symbols can not be loaded because symbol path is not initialized. *
* *
* The Symbol Path can be set by: *
* using the _NT_SYMBOL_PATH environment variable. *
* using the -y <symbol_path> argument when starting the debugger. *
* using .sympath and .sympath+ *
*********************************************************************
*** ERROR: Symbol file could not be found. Defaulted to export symbols for ntkrnlmp.exe -
Loading Kernel Symbols
.....................................................................................................................
Loading User Symbols

Loading unloaded module list
.......
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck A0, {101, 7, fffff980012a9610, 0}

*** ERROR: Module load completed but symbols could not be loaded for ecache.sys
***** Kernel symbols are WRONG. Please fix symbols to do analysis.

*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
*************************************************************************
Probably caused by : ecache.sys ( ecache+7ad5 )

Followup: MachineOwner
---------

 

[Cutthroat]

Probably caused by : ecache.sys ( ecache+7ad5 )

Are you using a thumb drive for Readyboost?

 

[NewMaxx]

The ecache.sys file can relate to any file system, including an external flash drive (as used by ReadyBoost, like Cutthroat pointed out), although it could be related to other drive errors. The 0xA0 bugcheck usually relates to IDE or a file system, too, especially when involved with power options (i.e., hibernate), as it is often INTERNAL_POWER_ERROR. Almost always deals with standby/hibernation or a peripheral device. I found more information here:

http://msdn2.microsoft.com/en-us/library/ms793980.aspx

Researching your specific error return, I found problems to be the keyboard (PS/2), USB devices, blue-tooth dongles, and one solution indicated a BIOS update (may be related to the others).

As a side-note, you can increase dump information by installing the OS symbols and running !analyze -v, etc.

 

[n7]

Originally posted by: Cutthroat

Probably caused by : ecache.sys ( ecache+7ad5 )

Are you using a thumb drive for Readyboost?

Yes.

Originally posted by: NewMaxx
The ecache.sys file can relate to any file system, including an external flash drive (as used by ReadyBoost, like Cutthroat pointed out), although it could be related to other drive errors. The 0xA0 bugcheck usually relates to IDE or a file system, too, especially when involved with power options (i.e., hibernate), as it is often INTERNAL_POWER_ERROR. Almost always deals with standby/hibernation or a peripheral device. I found more information here:

http://msdn2.microsoft.com/en-us/library/ms793980.aspx

Researching your specific error return, I found problems to be the keyboard (PS/2), USB devices, blue-tooth dongles, and one solution indicated a BIOS update (may be related to the others).

As a side-note, you can increase dump information by installing the OS symbols and running !analyze -v, etc.

Okay.
I barely figured out where memory.dmp was & got windbg installed.

I have absolutely no clue what that last part means...gotta help me out as if i'm a baby here, since i don't understand what you mean.

 

[n7]

Eh i just realized these .dmp files are only for the one crash that occurs; anything prior gets erased, right?

IOW, that .dmp i posted is no help anyway, since it's not the most recent bsod i've had; & the most recent ones were triggered by me, not the random restarts (assuming it's even a bsod causing the restarts).

 

[MrChad]

Originally posted by: n7

Originally posted by: Cutthroat

Probably caused by : ecache.sys ( ecache+7ad5 )

Are you using a thumb drive for Readyboost?

Yes.

Originally posted by: NewMaxx
The ecache.sys file can relate to any file system, including an external flash drive (as used by ReadyBoost, like Cutthroat pointed out), although it could be related to other drive errors. The 0xA0 bugcheck usually relates to IDE or a file system, too, especially when involved with power options (i.e., hibernate), as it is often INTERNAL_POWER_ERROR. Almost always deals with standby/hibernation or a peripheral device. I found more information here:

http://msdn2.microsoft.com/en-us/library/ms793980.aspx

Researching your specific error return, I found problems to be the keyboard (PS/2), USB devices, blue-tooth dongles, and one solution indicated a BIOS update (may be related to the others).

As a side-note, you can increase dump information by installing the OS symbols and running !analyze -v, etc.

Okay.
I barely figured out where memory.dmp was & got windbg installed.

I have absolutely no clue what that last part means...gotta help me out as if i'm a baby here, since i don't understand what you mean.

Use the Microsoft Symbol Server to obtain debug symbol files

Using the Microsoft Symbol Server with WinDbg
To use the Symbol Server Web site from within WinDbg, follow these steps:
1. Start the Windows Debugger (WinDbg.exe).
2. On the File menu, click Symbol File Path.
3. In the Symbol path box, type the following command:

SRV*your local folder for symbols*http://msdl.microsoft.com/download/symbols

where your local folder for symbols is the folder in which you copy your local symbol cache. The debug symbols are downloaded to this location.

Note You can point to any local path or share that your computer can reach; it does not have to be a location on the computer's hard disk.

 

[CSHawkeye]

wow, I am not the only one with these issues, now I also use a raptor as my main OS HD and 2 750gb drives in a Raid 1 on my p5k deluxe. I have started to notice this alot on my comptuer as it randomly reboots and as of late it crashes all the time. I am running DFT on my raptor as we speak to make sure the drive is ok, but I think this might be a Vista related issue and you might want to reload your OS. Though I will take out my audigy tonight and see if thats the cause before I do that.

 

[dds14u]

How long has your PC been stable? Did you overclock?

 

[Mr Fox]

Originally posted by: n7
Eh i just realized these .dmp files are only for the one crash that occurs; anything prior gets erased, right?

IOW, that .dmp i posted is no help anyway, since it's not the most recent bsod i've had; & the most recent ones were triggered by me, not the random restarts (assuming it's even a bsod causing the restarts).

I'm wondering about all your drivers... and if they are up to snuff... I almost believe that something on your PC is accessing Hard Drives, and you are getting the dreaded J Micron
issue.. or defender is causing an issue. also one other thing.. are you up on all of your updates ?

The timing leads me to believe that some event is triggering this.. I know my machine accesses HD's allot early in AM for whatever events are scheduled .. that is what I have noticed and i have been running 64 Bit since Feb.





























/

 

[CSHawkeye]

Originally posted by: dds14u
How long has your PC been stable? Did you overclock?

Well right now for me I reloaded vista x64 back onto my computer and applied the patches i saw on another forum that were recommended to install. Once I was done there I rebooted the machine and installed drives just fine without any hicups. I then went ahead and put the other 2 sticks back in the computer (I have tried both sets by themselves and they are fine) and the blue screens and reboots come back. So for fun I went ahead and knocked the ram speed down to DDR2 800 and right now that seems to do the trick. I think its either timmings or voltage that is causing this as the Corsair XMS2 ram needs to run I guess at 2.2v at 1066. I will try this out when i get home tonight.