Hey Gurus, Im trying WinDbg for the first time. I have an XP machne that keeps rebooting randomly. Can you please help me find out what may be causing this from this dumpfile?

Thanks for all your help and suggestions.




Loading Dump File [\c:\windows\Minidump\Mini111011-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: srv*
Executable search path is:
Windows XP Kernel Version 2600 (Service Pack 3) MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 2600.xpsp_sp3_gdr.100427-1636
Machine Name:
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055d720
Debug session time: Thu Nov 10 15:57:42.467 2011 (UTC - 5:00)
System Uptime: 13 days 5:43:21.654
Loading Kernel Symbols
.................................................. .............
.................................................. ....
Loading User Symbols
Loading unloaded module list
..................................................
************************************************** *****************************
* *
* Bugcheck Analysis *
* *
************************************************** *****************************

Use !analyze -v to get detailed debugging information.

BugCheck 1A, {41284, 13a1f001, a8e2, c0883000}

Probably caused by : memory_corruption ( nt!MiLocateWsle+c1 )

Followup: MachineOwner
---------

0: kd> !analyze -v
************************************************** *****************************
* *
* Bugcheck Analysis *
* *
************************************************** *****************************

MEMORY_MANAGEMENT (1a)
# Any other values for parameter 1 must be individually examined.
Arguments:
Arg1: 00041284, A PTE or the working set list is corrupt.
Arg2: 13a1f001
Arg3: 0000a8e2
Arg4: c0883000

Debugging Details:
------------------


BUGCHECK_STR: 0x1a_41284

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: DRIVER_FAULT

PROCESS_NAME: iexplore.exe

LAST_CONTROL_TRANSFER: from 80523339 to 804f9f43

STACK_TEXT:
a2c6f6c4 80523339 0000001a 00041284 13a1f001 nt!KeBugCheckEx+0x1b
a2c6f6fc 80523bbf 0000a8e2 13a1f000 c06004e8 nt!MiLocateWsle+0xc1
a2c6f730 80523fd8 c009d0f8 13a1f000 00000000 nt!MiDeletePte+0x1fd
a2c6f7f8 805135e6 00002378 175affff 00000000 nt!MiDeleteVirtualAddresses+0x164
a2c6f838 805d26ea 01a22a98 88f1c020 88f1c268 nt!MmCleanProcessAddressSpace+0x262
a2c6f8d8 805d28ac c0000005 88f1c020 00000000 nt!PspExitThread+0x680
a2c6f8f8 805d2a87 88f1c020 c0000005 a2c6f934 nt!PspTerminateThreadByPointer+0x52
a2c6f924 8054164c 00000000 c0000005 272fffa0 nt!NtTerminateProcess+0x105
a2c6f924 7c90e514 00000000 c0000005 272fffa0 nt!KiFastCallEntry+0xfc
WARNING: Frame IP not in any known module. Following frames may be wrong.
272fffa0 00000000 00000000 00000000 00000000 0x7c90e514


STACK_COMMAND: kb

FOLLOWUP_IP:
nt!MiLocateWsle+c1
80523339 2b45f0 sub eax,dword ptr [ebp-10h]

SYMBOL_STACK_INDEX: 1

SYMBOL_NAME: nt!MiLocateWsle+c1

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nt

DEBUG_FLR_IMAGE_TIMESTAMP: 4bd6e0e8

IMAGE_NAME: memory_corruption

FAILURE_BUCKET_ID: 0x1a_41284_nt!MiLocateWsle+c1

BUCKET_ID: 0x1a_41284_nt!MiLocateWsle+c1

Followup: MachineOwner

The first thing I would suspect is defective memory. Download Memtest86+ (you want the 2nd one Download - Pre-Compiled Bootable ISO (.zip)). Unzip it then create a CD from the iso file using your CD burning software. There is a good freeware burner called ImgBurn which will do this easily.

Boot the CD and run for at least 3 complete passes unless it shows errors sooner than that.