Event ID: 1001 (Rebooted from a bugcheck)

Archived from groups: microsoft.public.win2000.advanced_server (More info?)

Hi,

I just noticed this morning that my win2k3 Corp Ed server had rebooted from
a bugcheck. Here is the event log:

The computer has rebooted from a bugcheck. The bugcheck was: 0x000000c2
(0x0000000a, 0xff9968b8, 0x6e657645, 0x00000000). A dump was saved in:
C:\WINDOWS\MEMORY.DMP.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.

Does this mean my server has some bugs, viruses, trojan horses, spyware,
back doors?

--
Mazi

Archived from groups: microsoft.public.win2000.advanced_server (More info?)

Hi Feng Mao,

Thank you for your quick response to my post. Unfortunately, there was the
only one-time crashed from a bugcheck @ around 1:57AM. At first, I thought
the crashed was due to an outage and problem with the UPS system. However,
after reading the log through the even viewer, I noticed the crashed was due
to a bugcheck with and Event ID:1001 and the following description on the
Event viewer:

The computer has rebooted from a bugcheck. The bugcheck was: 0x000000c2
(0x0000000a, 0xff9968b8, 0x6e657645, 0x00000000). A dump was saved in:
C:\WINDOWS\MEMORY.DMP.

As with a blue screen, I could not testify it since the system rebooted by
itself. Would not the above description from the Event viewer help? There is
a C:\WINDOWS\MEMORY.DMP file on my system:

Directory of C:\WINDOWS

08/25/2004 01:57 AM 267,972,608 MEMORY.DMP
1 File(s) 267,972,608 bytes

Should I delete it or is there any use of it?

BTW, do you know how to launch "My Computer" from a Command Line Internet
(CLI) instead of from the "START" button? I usually login into my server as
a regular user with a CLI launched from the "runas" with administrator
priviledge to allow me to access some admin tasks, i.e. compmgmt.msc.

--
Mazi


"Feng Mao" <fengmao@online.microsoft.com> wrote in message
news:gO$yGv0iEHA.2936@cpmsftngxa10.phx.gbl...
> Hi Mazi,
>
> Thank you for posting!
>
> I think it is a kind of blue screen. The system will reboot itself if
there
> is a kernel crash in Windows. We can change some settings to let the
system
> show the error message. Right click the My Computer icon on the desktop
and
> choose Properties. On the Advanced table, click Startup and Recovery. In
> that dialog uncheck "Automatically reboot".
>
> Make sure you check "Write an event to the system log" and "send an
> administrative alert". In the Write Debugging Information section, choose
> "Complete Memory Dump" from the drop list. Then the file path is:
>
> %SystemRoot%\MEMORY.DMP
>
>
>
> Try to re-produce the problem. Do you encounter a blue screen? If there is
> a blue screen, let me know what exact error message you encounter. The
blue
> screen error usually in the following format:
>
> STOP: 0x0000000A (0x0000002e, 0x00000002, 0x00000000, 0xff0d9c07)
>
> IRQL_NOT_LESS_OR_EQUAL - NDIS.SYS
> --> This is only an example.
>
>
>
> The information in the error message will help us to troubleshoot the
> problem.
>
>
> Have a nice day!
>
> Thanks & Regards,
>
> Feng Mao [MSFT], MCSE
> Microsoft Online Partner Support
>
> Get Secure! - www.microsoft.com/security
>
> =====================================================
> When responding to posts, please "Reply to Group" via your newsreader so
> that others may learn and benefit from your issue.
> =====================================================
> This posting is provided "AS IS" with no warranties, and confers no
rights.
>
>
>
> --------------------
> | From: "!SpamMe" <a@b.com>
> | Newsgroups: microsoft.public.win2000.advanced_server
> | Subject: Event ID: 1001 (Rebooted from a bugcheck)
> | Lines: 22
> | X-Priority: 3
> | X-MSMail-Priority: Normal
> | X-Newsreader: Microsoft Outlook Express 6.00.3790.181
> | X-MimeOLE: Produced By Microsoft MimeOLE V6.00.3790.181
> | Message-ID: <Pg%Wc.179359$8_6.75522@attbi_s04>
> | NNTP-Posting-Host: 24.30.21.186
> | X-Complaints-To: abuse@comcast.net
> | X-Trace: attbi_s04 1093435567 24.30.21.186 (Wed, 25 Aug 2004 12:06:07
GMT)
> | NNTP-Posting-Date: Wed, 25 Aug 2004 12:06:07 GMT
> | Organization: Comcast Online
> | Date: Wed, 25 Aug 2004 12:06:07 GMT
> | Path:
>
cpmsftngxa10.phx.gbl!TK2MSFTNGXA01.phx.gbl!TK2MSFTNGP08.phx.gbl!newsfeed00.s
>
ul.t-online.de!t-online.de!border2.nntp.dca.giganews.com!nntp.giganews.com!w
> n14feed!worldnet.att.net!attbi_s04.POSTED!53ab2750!not-for-mail
> | Xref: cpmsftngxa10.phx.gbl
microsoft.public.win2000.advanced_server:26179
> | X-Tomcat-NG: microsoft.public.win2000.advanced_server
> |
> | Hi,
> |
> | I just noticed this morning that my win2k3 Corp Ed server had rebooted
> from
> | a bugcheck. Here is the event log:
> |
> | The computer has rebooted from a bugcheck. The bugcheck was: 0x000000c2
> | (0x0000000a, 0xff9968b8, 0x6e657645, 0x00000000). A dump was saved in:
> | C:\WINDOWS\MEMORY.DMP.
> |
> | For more information, see Help and Support Center at
> | http://go.microsoft.com/fwlink/events.asp.
> |
> | Does this mean my server has some bugs, viruses, trojan horses, spyware,
> | back doors?
> |
> | --
> | Mazi
> |
> |
> |
> |
> |
> |
>

Archived from groups: microsoft.public.win2000.advanced_server (More info?)

Hi Mazi,

The following article may shed some light on the matter:

265879 How to Debug "Stop 0xC2" or "Stop 0x000000C2" Error Messages
http://support.microsoft.com/?id=265879

You can choose from one of the following options:

1. You can upload the memory dump to the following Microsoft® Online Crash
Analysis link: http://oca.microsoft.com.

2. If you're feeling adventurous, you can download the Debugging Tools and
try to analyze the memory dump yourself from the following link:
http://www.microsoft.com/whdc/devt [...] llx86.mspx

Using the Microsoft Symbol Server on
http://www.microsoft.com/whdc/ddk/ [...] bols.mspx.

3. But if you would like some to analyze the MEMORY.DMP for you, then call
the toll free number below and request someone to assist you in getting to
the next available Support Engineer in the Platforms Setup group who deal in
the analysis of memory dumps.

Microsoft Technical Support 1-800-Microsoft (642-7676)

--
Hope this helps,
Mike Rosado
Windows 2000 MCSE + MCDBA
Microsoft Enterprise Platform Support
Windows NT/2000/2003 Cluster Technologies

**Please do not send e-mail directly to this alias. This alias is for
newsgroup purposes only***

This posting is provided "AS IS" with no warranties, and confers no rights.
<http://www.microsoft.com/info/cpyright.htm>

Delighting customers is our top priority. We welcome your valuable comments
and suggestions about how to improve the service we provide you. So if you
would like provided us feedback, feel free to e-mail my manager Brian
Pennington then click on the following e-mail hyperlink with a short
statement with regards to your Online support experience
<mailto:BPenning@microsoft.com?subject=Newsgroup_Experience&body=Brian,>.
Thank you.

-----Original Message-----

"!SpamMe" <a@b.com> wrote in message
news:3nrXc.320474$%_6.87638@attbi_s01...
> Hi Feng Mao,
>
> Thank you for your quick response to my post. Unfortunately, there was the
> only one-time crashed from a bugcheck @ around 1:57AM. At first, I thought
> the crashed was due to an outage and problem with the UPS system. However,
> after reading the log through the even viewer, I noticed the crashed was
due
> to a bugcheck with and Event ID:1001 and the following description on the
> Event viewer:
>
> The computer has rebooted from a bugcheck. The bugcheck was: 0x000000c2
> (0x0000000a, 0xff9968b8, 0x6e657645, 0x00000000). A dump was saved in:
> C:\WINDOWS\MEMORY.DMP.
>
> As with a blue screen, I could not testify it since the system rebooted by
> itself. Would not the above description from the Event viewer help? There
is
> a C:\WINDOWS\MEMORY.DMP file on my system:
>
> Directory of C:\WINDOWS
>
> 08/25/2004 01:57 AM 267,972,608 MEMORY.DMP
> 1 File(s) 267,972,608 bytes
>
> Should I delete it or is there any use of it?
>
> BTW, do you know how to launch "My Computer" from a Command Line Internet
> (CLI) instead of from the "START" button? I usually login into my server
as
> a regular user with a CLI launched from the "runas" with administrator
> priviledge to allow me to access some admin tasks, i.e. compmgmt.msc.
>
> --
> Mazi
>
>
> "Feng Mao" <fengmao@online.microsoft.com> wrote in message
> news:gO$yGv0iEHA.2936@cpmsftngxa10.phx.gbl...
> > Hi Mazi,
> >
> > Thank you for posting!
> >
> > I think it is a kind of blue screen. The system will reboot itself if
> there
> > is a kernel crash in Windows. We can change some settings to let the
> system
> > show the error message. Right click the My Computer icon on the desktop
> and
> > choose Properties. On the Advanced table, click Startup and Recovery. In
> > that dialog uncheck "Automatically reboot".
> >
> > Make sure you check "Write an event to the system log" and "send an
> > administrative alert". In the Write Debugging Information section,
choose
> > "Complete Memory Dump" from the drop list. Then the file path is:
> >
> > %SystemRoot%\MEMORY.DMP
> >
> >
> >
> > Try to re-produce the problem. Do you encounter a blue screen? If there
is
> > a blue screen, let me know what exact error message you encounter. The
> blue
> > screen error usually in the following format:
> >
> > STOP: 0x0000000A (0x0000002e, 0x00000002, 0x00000000, 0xff0d9c07)
> >
> > IRQL_NOT_LESS_OR_EQUAL - NDIS.SYS
> > --> This is only an example.
> >
> >
> >
> > The information in the error message will help us to troubleshoot the
> > problem.
> >
> >
> > Have a nice day!
> >
> > Thanks & Regards,
> >
> > Feng Mao [MSFT], MCSE
> > Microsoft Online Partner Support
> >
> > Get Secure! - www.microsoft.com/security
> >
> > =====================================================
> > When responding to posts, please "Reply to Group" via your newsreader so
> > that others may learn and benefit from your issue.
> > =====================================================
> > This posting is provided "AS IS" with no warranties, and confers no
> rights.
> >
> >
> >
> > --------------------
> > | From: "!SpamMe" <a@b.com>
> > | Newsgroups: microsoft.public.win2000.advanced_server
> > | Subject: Event ID: 1001 (Rebooted from a bugcheck)
> > | Lines: 22
> > | X-Priority: 3
> > | X-MSMail-Priority: Normal
> > | X-Newsreader: Microsoft Outlook Express 6.00.3790.181
> > | X-MimeOLE: Produced By Microsoft MimeOLE V6.00.3790.181
> > | Message-ID: <Pg%Wc.179359$8_6.75522@attbi_s04>
> > | NNTP-Posting-Host: 24.30.21.186
> > | X-Complaints-To: abuse@comcast.net
> > | X-Trace: attbi_s04 1093435567 24.30.21.186 (Wed, 25 Aug 2004 12:06:07
> GMT)
> > | NNTP-Posting-Date: Wed, 25 Aug 2004 12:06:07 GMT
> > | Organization: Comcast Online
> > | Date: Wed, 25 Aug 2004 12:06:07 GMT
> > | Path:
> >
>
cpmsftngxa10.phx.gbl!TK2MSFTNGXA01.phx.gbl!TK2MSFTNGP08.phx.gbl!newsfeed00.s
> >
>
ul.t-online.de!t-online.de!border2.nntp.dca.giganews.com!nntp.giganews.com!w
> > n14feed!worldnet.att.net!attbi_s04.POSTED!53ab2750!not-for-mail
> > | Xref: cpmsftngxa10.phx.gbl
> microsoft.public.win2000.advanced_server:26179
> > | X-Tomcat-NG: microsoft.public.win2000.advanced_server
> > |
> > | Hi,
> > |
> > | I just noticed this morning that my win2k3 Corp Ed server had rebooted
> > from
> > | a bugcheck. Here is the event log:
> > |
> > | The computer has rebooted from a bugcheck. The bugcheck was:
0x000000c2
> > | (0x0000000a, 0xff9968b8, 0x6e657645, 0x00000000). A dump was saved in:
> > | C:\WINDOWS\MEMORY.DMP.
> > |
> > | For more information, see Help and Support Center at
> > | http://go.microsoft.com/fwlink/events.asp.
> > |
> > | Does this mean my server has some bugs, viruses, trojan horses,
spyware,
> > | back doors?
> > |
> > | --
> > | Mazi
> > |
> > |
> > |
> > |
> > |
> > |
> >
>
>