Need help with a Memory Dump file

Hey guys so i have a user that when they log in to their machine the pc just reboots itself. But they can work in safe mode fine. seems like a driver issue. scanned for spyware and nothing came up. Can anyone help me with this dump? thanks!


Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Documents and Settings\mac665\Desktop\Mini030310-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: C:\WINDOWS\Symbols
Executable search path is:
Unable to load image \WINDOWS\system32\ntoskrnl.exe, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
Windows XP Kernel Version 2600 (Service Pack 2) MP (2 procs) Free x86 compatible
Product: WinNt
Machine Name:
Kernel base = 0x804d7000 PsLoadedModuleList = 0x805624a0
Debug session time: Wed Mar 3 07:00:45.187 2010 (GMT-5)
System Uptime: 0 days 0:01:35.890
Unable to load image \WINDOWS\system32\ntoskrnl.exe, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
Loading Kernel Symbols
...............................................................
..............................................................
Loading User Symbols
Loading unloaded module list
....
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck C000021A, {e561f2a8, c0000005, 7c910cce, 69f96c}

*** WARNING: Unable to verify timestamp for mssmbios.sys
unable to get nt!KiCurrentEtwBufferOffset
unable to get nt!KiCurrentEtwBufferBase
Probably caused by : memory_corruption ( nt!MiRemoveUnusedSegments+133 )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

WINLOGON_FATAL_ERROR (c000021a)
The Winlogon process terminated unexpectedly.
Arguments:
Arg1: e561f2a8, String that identifies the problem.
Arg2: c0000005, Error Code.
Arg3: 7c910cce
Arg4: 0069f96c

Debugging Details:
------------------

unable to get nt!KiCurrentEtwBufferOffset
unable to get nt!KiCurrentEtwBufferBase

BUGCHECK_STR: 0xc000021a_c0000005

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: DRIVER_FAULT

LAST_CONTROL_TRANSFER: from 8063101b to 805373ca

STACK_TEXT:
f7506934 8063101b 0000004c c000021a f75069b0 nt!MiRemoveUnusedSegments+0x133
f7506970 806714d3 00000001 0000004c c000021a nt!RtlUpcaseUnicodeToCustomCPN+0xb0
f7506b28 8061152f c000021a 00000004 00000001 nt!ViFreeMapRegisterFile+0x1e
f7506cd4 8064d74d c000021a 00000004 00000001 nt!CmRegisterCallback+0x20
f7506d44 804dd99f c000021a 00000004 00000001 nt!CcPfParametersSave+0x165
f7506d4c 00000000 00000001 0069f80c 00000006 nt!ZwSetSystemPowerState+0xf


STACK_COMMAND: kb

FOLLOWUP_IP:
nt!MiRemoveUnusedSegments+133
805373ca ?? ???

SYMBOL_STACK_INDEX: 0

SYMBOL_NAME: nt!MiRemoveUnusedSegments+133

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nt

DEBUG_FLR_IMAGE_TIMESTAMP: 4b1ea082

IMAGE_NAME: memory_corruption

FAILURE_BUCKET_ID: 0xc000021a_c0000005_nt!MiRemoveUnusedSegments+133

BUCKET_ID: 0xc000021a_c0000005_nt!MiRemoveUnusedSegments+133

Followup: MachineOwner
---------