Windows XP randomly restart itself

[midgar99]

Dear all:

I have a Windows XP computer with this hardware setting

Board: ASUSTeK Computer INC. P4B266 REV 2.xx
Bus Clock: 100 megahertz
BIOS: Award Software, Inc. ASUS P4B266 ACPI BIOS Revision 1007

Intel Pentium 4 1.6GHz
8 Kb primary memory cache
256 Kb secondary memory cache

Slot 'DIMM 1' has 512 MB
Slot 'DIMM 2' has 256 MB
Slot 'DIMM 3' is Empty

I am not quite sure what is wrong with my Windows XP computer, but it randomly restarts itself. I have to keep it on all the time, so that I can access it from my work. So far I tried the followings:

1. Set Automatic Windows Update to Notify me when new update is ready and before install any new update so that it will not restart itself

2. Set the Power option to never turn off

3. Clean the computer

4. Put more Ram (it used to have only 256 MB)

5. Uninstall Intel Application Accelerator (I read it from some web site that it might cause this problem)

6. Use Norton Antivirus with the up to date virus definition to search for virus: No virus found

7. Use Spybot Search and Destroy with up to date detection to search for spyware: No spyware found except some cookies

From all this attempts, I have not yet able to solve the problem.

My friend suggested me to check the System Log in Event Viewer and I found out that one error occurred very frequently before my computer restart itself.

The error information:

Event Type: Error
Event Source: Srv
Event Category: None
Event ID: 2019
Date: 6/30/2004
Time: 6:47:28 AM
User: N/A
Computer: MYCOMPUTER
Description:
The server was unable to allocate from the system nonpaged pool because the pool was empty.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 00 00 04 00 01 00 54 00 ......T.
0008: 00 00 00 00 e3 07 00 c0 ....ã..À
0010: 00 00 00 00 9a 00 00 c0 ....š..À
0018: 00 00 00 00 00 00 00 00 ........
0020: 00 00 00 00 00 00 00 00 ........
0028: 04 00 00 00 ....


In addition, my computer usually recorded this warning before the error.


The warning is:

Event Type: Warning
Event Source: LSASRV
Event Category: SPNEGO (Negotiator)
Event ID: 40961
Date: 6/30/2004
Time: 3:14:43 PM
User: N/A
Computer: MYCOMPUTER
Description:
The Security System could not establish a secured connection with the server DNS/prisoner.iana.org. No authentication protocol was available.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.


I tried looking for more information on the error and warning, but I have not found any useful information for my case.

If you have any suggestion, please let me know.

Thank you very much

[ski]

Common causes:

-Everything not completely seated on the motherboard.
Reseat everything.

-Overheating
Check the system and CPU's temps either in BIOS or with temperature monitoring software.
If the system temp gets over 45 deg. C, then make sure the computer's fans are running, the vents are open, the computer is not located in an enclosed space or near a heat source, and there is no internal dust build up.
If those are ok, then remove the computer's cover, and run an external fan. If this fixes things, then install additional case fans. Recommended locations are lower front and upper rear of the case.
If the CPU gets over 60 deg. C, then make sure there is thermal compound between it and the heat sink. If that's ok, then replace the compound with Arctic Silver3.
If no luck, then install a higher capacity heat sink fan.
If still no luck, then replace the heatsink with a more efficient unit.

-Overtaxed or bad power supply
Swap it out with a different(preferably higher wattage) unit.

-Bad memory
Remove and reinsert the memory a few times, try it in different slots, do not use any optimal settings for the memory in BIOS, run Memtest-86, and swap it out with known good memory.
Also, do not mix parity and non-parity memory.

-Bad video card.
Swap it out with a known good card.

-Bad MB.
Swap it out with a known good MB.

-IRQ conflict with a network card.
If no problems show up for the NIC in Device Manager, then remove it from DM, shut down, uninstall the card, and restart.

Also, d/l and run Ad-aware and CWShredder to check for spyware.

[deddard]

Originally posted by midgar99



In addition, my computer usually recorded this warning before the error.


The warning is:

Event Type: Warning
Event Source: LSASRV
Event Category: SPNEGO (Negotiator)
Event ID: 40961
Date: 6/30/2004
Time: 3:14:43 PM
User: N/A
Computer: MYCOMPUTER
Description:
The Security System could not establish a secured connection with the server DNS/prisoner.iana.org. No authentication protocol was available.



Do you recognise the above DNS/prisoner.iana.org? it seems that a secure connection is being attempted before the system crash. Do you initiate the connection, or is it done automatically?
If you don't recognise it, it could well be some sort of malware trying to send info from your PC to somewhere, or hijack the machine.

Unless anyone else can give you a difinitive answer to your problem, I'd suggest posting a hijackthis log (check out the posts here for hijackthis - apparently the latest version isn't the most stable)

..........edit

It appears that it isn't as bad as I thought - it's a M$ default when a DHCP is incorrectly configured.
here's a link:
http://archives.neohapsis.com/archives/incidents/2002-09/0052.html

Another:
http://www.neowin.net/forum/index.php?showtopic=172564

It seems that Windoze isn't able to resolve names to IP addresses. It could be something as simple as making sure your DNS settings (under TCP/IP) are set to automatic (rather than use a specific DNS Server)
Are you using a Router? Router's will often act as a DNS Server (by proxy) and your machine may need to use the router's internal IP address as a DNS server (assuming you are using a router)

I'd still go with a hijackthis log, just to make sure that there isn't a redirector going on in there. otherwise, just run through your settings under TCP/IP, check to see if your browser settings are all ok.

[Chendo]

Have updated Ur WinXP??? Did U get the patch for the Sasser Worm?

Quote_____________________________________________ ____________________
In addition, my computer usually recorded this warning before the error.


The warning is:

Event Type: Warning
Event Source: LSASRV
Event Category: SPNEGO (Negotiator)
Event ID: 40961
Date: 6/30/2004
Time: 3:14:43 PM
User: N/A
Computer: MYCOMPUTER
Description:
The Security System could not establish a secured connection with the server DNS/prisoner.iana.org. No authentication protocol was available.
__________________________________________________ _____________________
Does that the entry LSASRV look familiar to anybody???

I think U have the Sasser Worm, I might be wrong, but it can happen. How many variats are out there now?
Get the patch and the tool for removal at:

Patch: http://www.microsoft.com/downloads/details.aspx?FamilyID=3549ea9e-da3f-43b9-a4f1-af243b6168f3&displaylang=en

Tool: http://www.microsoft.com/downloads/details.aspx?FamilyID=76c6de7e-1b6b-4fc3-90d4-9fa42d14cc17&displaylang=en

Hope I'm wrong about the worm.:D

[dinakar]

we also got the same error in our network , get the patch of sasser virus , or update ur anti virus updation patch , scan in safe mode , after remooving the system restore option , if u not found any virus
then u suspect the other things like winxp service pack updation , ram changing etc
good luck