sysdata.xml

[zestril5]

Every time I reboot this XP Pro system I get a "system has recovered froma serious error" message
The details of the message are as follows:
c:\windows\minidump\min072303-01.dmp
c;\windows\docume~\user\locals~1\temp\wer4.tmp.dir00\sysdata.xml

When I click on the don't send the message just reappears and the wer file referenced increments by one.
I can find no data in the knowledgebas except a reference to some ati or nvidia video problems. I have neither. the video is integrated trident.
A Google search turned up some info about the possibility of a bad user profile. No Luck with that.
Google search also turned up some refernces to clearing the paging file and resetting it. Again no luck.
I ran chkdsk /r and some problems were detected and fixed but not this one.
I started in safe mode and no problems
I then restarted normal mode and the following additional processes were running under task manager that were no while in safe mode.
dwwin
dumprep
avgcc
wanmpsvc
pctspk
avgserv
acsd
spoolsv
and 2 additional svchosts
I then stopped pctspk then acsd then dumprep then wanmpsvc then dwwin. When I stopped dwwin the "serious error message" went away. I looked at some google postings on dwwin but none seem to fit my profile.
I'm hoping someone has some ideas before reformatting and reinstalling.

 

[bcastner]

dwwin.exe is the XP client error reporting service module. It is added when a serious error report is required.

 

[linney]

When did this first start? Can you trace it back to some action?

The difference between Safe Mode and Normal Mode is that only the basic drivers are loaded. It may be worth following that clue.

Run the System File Checker program from the Run Box by typing.....Sfc /Scannow in it and have your XP CD handy.

HOW TO: Verify Unsigned Device Drivers in Windows XP

http://support.microsoft.com/support/kb/articles/q308/5/14.asp

If they don't work you could try repairing windows itself by running it over itself. You will lose all your windows updates but your files will be untouched.

How to Perform an In-Place Upgrade (Reinstallation) of Windows XP (Q315341)

http://support.microsoft.com/support/kb/articles/q315/3/41.asp

To get further information about any error look in your Event viewer.

Look in the System or Application folder. You can get to the Event Viewer via right click My Computer icon and select Manage.

Any errors logged in the Event Viewer can be expanded by double clicking on the error line.

Take any event error I.D. number and search for it on this site.

http://www.eventid.net/events.asp

Also check any "Information" line that mentions "savedump" and you should find reference to "recovered from a bug check". This is the Stop Error that caused your problem.

You can also turn off "automatically restart after an error" so it will just halt at the fault and display the full Stop Error and blue screen.

Right-click My Computer, and then click Properties .
On the Advanced tab, click Settings under Startup and Recovery .
Click to clear the Automatically restart check box under System failure , and then click OK . The error message on a blue screen should remain on the screen so you can record the error information.

You could try clearing your Temp files and anything that is in the Minidump folder.


Dwwin.exe is the program that manages error reports so it's not surprising that if you stop it the report disappears.

821253 - Update For Windows Error Reporting

http://support.microsoft.com/default.aspx?scid=kb;en-us;821253&FR=1&PA=1&SD=HSCH

C:\documents~1\defaut\locals~1\temp\wer3d.tmp.dir00\sysdata.xml

318023 - Computer Stops or Continually Restarts With ATI RADEON Video Adapter

http://support.microsoft.com/default.aspx?scid=kb;en-us;318023&FR=1&PA=1&SD=HSCH

 

[zestril5]

Thanks for the quick responses.
I had already deleted all minidump and tmp files and the ATI ref is moot since I don't have ATI.
I found that I had to stop bothe the dumprep and then dwwin to get the message to dissappear. I then checked msconfig and dumprep was there and checked. I unchecked it and Viola! no more error message.
The event viewer information was way too technichal for me so I deleted all the events and started again. I ran SFC and then read the event viewer. SFC apparently found 8 or 9 windows files where the signature was wrong and fixed them. I now get only one error in the event viewer whith startup which I'll check out, but it doesn't seem to be having any effect of anything at this time.
What's really strange is that this was not the customer's complaint. They reported that While connected to AOL through cable modem the system would just shut down on occasion. They upgraded to 9.0 (which I believe accounts for the acsd entry in the running services. Now that this problem is fixed I'll see if that is the case. Maybe their related maybe not.
Thanks for the help.