Vi-rus pisze:Jak na razie drugi dzień bez blue screen'ów, czyżby jednak te sterowniki
Trzeba jeszcze poczekać, nie ma się co cieszyć przed wcześnie.
ale według mnie był.Zmieniłem lokalizacje pliku zrzutu z powrotem na C:\WINDOWS\Minidump.Kod: Zaznacz cały
Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [C:\WINDOWS\Minidump\Mini070611-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows XP Kernel Version 2600 (Service Pack 3) UP Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 2600.xpsp.080413-2111
Machine Name:
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055b1c0
Debug session time: Wed Jul 6 14:43:56.484 2011 (GMT+2)
System Uptime: 0 days 0:20:00.083
Loading Kernel Symbols
...............................................................
...................................................
Loading User Symbols
Loading unloaded module list
.............
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 10000050, {a7c102ff, 0, 80567087, 0}
Could not read faulting driver name
Probably caused by : hardware ( nt!NtRemoveIoCompletion+e6 )
Followup: MachineOwner
---------
kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced. This cannot be protected by try-except,
it must be protected by a Probe. Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: a7c102ff, memory referenced.
Arg2: 00000000, value 0 = read operation, 1 = write operation.
Arg3: 80567087, If non-zero, the instruction address which referenced the bad memory
address.
Arg4: 00000000, (reserved)
Debugging Details:
------------------
Could not read faulting driver name
READ_ADDRESS: a7c102ff
FAULTING_IP:
nt!NtRemoveIoCompletion+e6
80567087 000f add byte ptr [edi],cl
MM_INTERNAL_CODE: 0
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: DRIVER_FAULT
BUGCHECK_STR: 0x50
PROCESS_NAME: ekrn.exe
MISALIGNED_IP:
nt!NtRemoveIoCompletion+e6
80567087 000f add byte ptr [edi],cl
LAST_CONTROL_TRANSFER: from 804de7ec to 80567087
STACK_TEXT:
f7a7ed48 804de7ec 000001e4 04abff88 04abff70 nt!NtRemoveIoCompletion+0xe6
f7a7ed48 7c90e4f4 000001e4 04abff88 04abff70 nt!KiFastCallEntry+0xf8
WARNING: Frame IP not in any known module. Following frames may be wrong.
04abff58 00000000 00000000 00000000 00000000 0x7c90e4f4
STACK_COMMAND: kb
FOLLOWUP_IP:
nt!NtRemoveIoCompletion+e6
80567087 000f add byte ptr [edi],cl
SYMBOL_STACK_INDEX: 0
SYMBOL_NAME: nt!NtRemoveIoCompletion+e6
FOLLOWUP_NAME: MachineOwner
IMAGE_NAME: hardware
DEBUG_FLR_IMAGE_TIMESTAMP: 0
MODULE_NAME: hardware
FAILURE_BUCKET_ID: IP_MISALIGNED
BUCKET_ID: IP_MISALIGNED
Followup: MachineOwner
---------
Kod: Zaznacz cały
Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [C:\WINDOWS\Minidump\Mini070711-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows XP Kernel Version 2600 (Service Pack 3) UP Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 2600.xpsp.080413-2111
Machine Name:
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055b1c0
Debug session time: Thu Jul 7 22:32:43.906 2011 (GMT+2)
System Uptime: 0 days 2:17:20.505
Loading Kernel Symbols
...............................................................
....................................................
Loading User Symbols
Loading unloaded module list
...............
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 19, {20, 864b7758, 864b79d0, a4f000a}
Probably caused by : ntoskrnl.exe ( nt!ExFreePoolWithTag+2be )
Followup: MachineOwner
---------
kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
BAD_POOL_HEADER (19)
The pool is already corrupt at the time of the current request.
This may or may not be due to the caller.
The internal pool links must be walked to figure out a possible cause of
the problem, and then special pool applied to the suspect tags or the driver
verifier to a suspect driver.
Arguments:
Arg1: 00000020, a pool block header size is corrupt.
Arg2: 864b7758, The pool entry we were looking for within the page.
Arg3: 864b79d0, The next pool entry.
Arg4: 0a4f000a, (reserved)
Debugging Details:
------------------
BUGCHECK_STR: 0x19_20
POOL_ADDRESS: 864b7758
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: DRIVER_FAULT
PROCESS_NAME: winlogon.exe
LAST_CONTROL_TRANSFER: from 8054c4c1 to 8053380e
STACK_TEXT:
ed966c34 8054c4c1 00000019 00000020 864b7758 nt!KeBugCheckEx+0x1b
ed966c84 80564705 864b7760 e5726854 867c6cb8 nt!ExFreePoolWithTag+0x2be
ed966ca8 8056477f 864b7760 00000000 00000000 nt!ObpFreeObject+0x18d
ed966cc0 804e36d5 864b7778 00000000 000004d8 nt!ObpRemoveObjectRoutine+0xe8
ed966ce4 80567847 864ef770 e15dd640 86381760 nt!ObfDereferenceObject+0x5f
ed966cfc 805678b0 e15dd640 864b7778 000004d8 nt!ObpCloseHandleTableEntry+0x155
ed966d44 805678fa 000004d8 00000001 00000000 nt!ObpCloseHandle+0x87
ed966d58 804de7ec 000004d8 00f0ffb4 7c90e4f4 nt!NtClose+0x1d
ed966d58 7c90e4f4 000004d8 00f0ffb4 7c90e4f4 nt!KiFastCallEntry+0xf8
WARNING: Frame IP not in any known module. Following frames may be wrong.
00f0ffb4 00000000 00000000 00000000 00000000 0x7c90e4f4
STACK_COMMAND: kb
FOLLOWUP_IP:
nt!ExFreePoolWithTag+2be
8054c4c1 83f801 cmp eax,1
SYMBOL_STACK_INDEX: 1
SYMBOL_NAME: nt!ExFreePoolWithTag+2be
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntoskrnl.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 48025eab
FAILURE_BUCKET_ID: 0x19_20_nt!ExFreePoolWithTag+2be
BUCKET_ID: 0x19_20_nt!ExFreePoolWithTag+2be
Followup: MachineOwner
---------
Kod: Zaznacz cały
Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [C:\WINDOWS\Minidump\Mini101911-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows XP Kernel Version 2600 (Service Pack 3) UP Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 2600.xpsp.080413-2111
Machine Name:
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055b1c0
Debug session time: Wed Oct 19 17:25:00.781 2011 (GMT+2)
System Uptime: 0 days 0:00:59.360
Loading Kernel Symbols
...............................................................
.........................................................
Loading User Symbols
Loading unloaded module list
...........
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 1000008E, {c0000005, 85ede7fc, ba408cf0, 0}
Probably caused by : Unknown_Image ( ANALYSIS_INCONCLUSIVE )
Followup: MachineOwner
---------
kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
KERNEL_MODE_EXCEPTION_NOT_HANDLED_M (1000008e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003. This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG. This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG. This will let us see why this breakpoint is
happening.
Arguments:
Arg1: c0000005, The exception code that was not handled
Arg2: 85ede7fc, The address that the exception occurred at
Arg3: ba408cf0, Trap Frame
Arg4: 00000000
Debugging Details:
------------------
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - Instrukcja spod "0x%08lx" odwo
FAULTING_IP:
+0
85ede7fc 0000 add byte ptr [eax],al
TRAP_FRAME: ba408cf0 -- (.trap 0xffffffffba408cf0)
ErrCode = 00000002
eax=00000000 ebx=8056b82e ecx=8056b716 edx=421c0003 esi=058eff08 edi=ba408d64
eip=85ede7fc esp=ba408d64 ebp=bfe8adec iopl=0 nv up ei pl nz na po nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010202
85ede7fc 0000 add byte ptr [eax],al ds:0023:00000000=??
Resetting default scope
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: DRIVER_FAULT
BUGCHECK_STR: 0x8E
PROCESS_NAME: ekrn.exe
LAST_CONTROL_TRANSFER: from 058eff5c to 85ede7fc
STACK_TEXT:
WARNING: Frame IP not in any known module. Following frames may be wrong.
ba408d60 058eff5c 7c90e4f4 badb0d00 058efef8 0x85ede7fc
ba408d64 7c90e4f4 badb0d00 058efef8 6141e95e 0x58eff5c
ba408d68 badb0d00 058efef8 6141e95e 20954086 0x7c90e4f4
ba408d6c 058efef8 6141e95e 20954086 00000000 0xbadb0d00
ba408d70 6141e95e 20954086 00000000 00000000 0x58efef8
ba408d74 20954086 00000000 00000000 00000000 0x6141e95e
ba408d78 00000000 00000000 00000000 00000000 0x20954086
STACK_COMMAND: .trap 0xffffffffba408cf0 ; kb
SYMBOL_NAME: ANALYSIS_INCONCLUSIVE
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: Unknown_Module
IMAGE_NAME: Unknown_Image
DEBUG_FLR_IMAGE_TIMESTAMP: 0
BUCKET_ID: BAD_STACK
Followup: MachineOwner
---------
Kod: Zaznacz cały
Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [C:\WINDOWS\Minidump\Mini101911-02.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows XP Kernel Version 2600 (Service Pack 3) UP Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 2600.xpsp.080413-2111
Machine Name:
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055b1c0
Debug session time: Wed Oct 19 18:08:28.734 2011 (GMT+2)
System Uptime: 0 days 0:07:33.320
Loading Kernel Symbols
...............................................................
..........................................................
Loading User Symbols
Loading unloaded module list
.............
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 1000000A, {b3af1ed0, 2, 1, 804e43a5}
Probably caused by : ntoskrnl.exe ( nt!KiReadyThread+12c )
Followup: MachineOwner
---------
kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: b3af1ed0, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000001, bitfield :
bit 0 : value 0 = read operation, 1 = write operation
bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: 804e43a5, address which referenced memory
Debugging Details:
------------------
WRITE_ADDRESS: b3af1ed0
CURRENT_IRQL: 2
FAULTING_IP:
nt!KiReadyThread+12c
804e43a5 c6822801000001 mov byte ptr [edx+128h],1
CUSTOMER_CRASH_COUNT: 2
DEFAULT_BUCKET_ID: DRIVER_FAULT
BUGCHECK_STR: 0xA
PROCESS_NAME: firefox.exe
LAST_CONTROL_TRANSFER: from 804dbe14 to 804e43a5
STACK_TEXT:
f78cee78 804dbe14 865146e0 f78ceeb0 f78cee88 nt!KiReadyThread+0x12c
f78cee98 804dc4a8 0e33a7ba 00000054 f78cefc0 nt!KiWaitTest+0xcd
f78cefa4 804dc378 0e3330b5 00000001 ffdff000 nt!KiTimerListExpire+0x7a
f78cefd0 804dbbd4 8055a020 00000000 00007154 nt!KiTimerExpiration+0xaf
f78ceff4 804db89e ebdf2d44 00000000 00000000 nt!KiRetireDpcList+0x46
f78ceff8 ebdf2d44 00000000 00000000 00000000 nt!KiDispatchInterrupt+0x2a
WARNING: Frame IP not in any known module. Following frames may be wrong.
804db89e 00000000 00000009 bb835675 00000128 0xebdf2d44
STACK_COMMAND: kb
FOLLOWUP_IP:
nt!KiReadyThread+12c
804e43a5 c6822801000001 mov byte ptr [edx+128h],1
SYMBOL_STACK_INDEX: 0
SYMBOL_NAME: nt!KiReadyThread+12c
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntoskrnl.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 48025eab
FAILURE_BUCKET_ID: 0xA_nt!KiReadyThread+12c
BUCKET_ID: 0xA_nt!KiReadyThread+12c
Followup: MachineOwner
---------
Kod: Zaznacz cały
PROCESS_NAME: firefox.exeKod: Zaznacz cały
PROCESS_NAME: ekrn.exe Kod: Zaznacz cały
Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [C:\WINDOWS\Minidump\Mini102111-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows XP Kernel Version 2600 (Service Pack 3) UP Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 2600.xpsp.080413-2111
Machine Name:
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055b1c0
Debug session time: Fri Oct 21 20:04:12.312 2011 (GMT+2)
System Uptime: 0 days 0:50:54.915
Loading Kernel Symbols
...............................................................
..........................................................
Loading User Symbols
Loading unloaded module list
.............
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 19, {20, 86907928, 869079d0, a15000d}
Probably caused by : ntoskrnl.exe ( nt!ExFreePoolWithTag+2be )
Followup: MachineOwner
---------
kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
BAD_POOL_HEADER (19)
The pool is already corrupt at the time of the current request.
This may or may not be due to the caller.
The internal pool links must be walked to figure out a possible cause of
the problem, and then special pool applied to the suspect tags or the driver
verifier to a suspect driver.
Arguments:
Arg1: 00000020, a pool block header size is corrupt.
Arg2: 86907928, The pool entry we were looking for within the page.
Arg3: 869079d0, The next pool entry.
Arg4: 0a15000d, (reserved)
Debugging Details:
------------------
BUGCHECK_STR: 0x19_20
POOL_ADDRESS: 86907928
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: DRIVER_FAULT
PROCESS_NAME: System
LAST_CONTROL_TRANSFER: from 8054c4c1 to 8053380e
STACK_TEXT:
f78dacd4 8054c4c1 00000019 00000020 86907928 nt!KeBugCheckEx+0x1b
f78dad24 80564705 86907930 e56c6946 86fe9090 nt!ExFreePoolWithTag+0x2be
f78dad48 8056477f 00000000 86907960 86fc5da8 nt!ObpFreeObject+0x18d
f78dad60 8057304e 86907960 00000001 805609c0 nt!ObpRemoveObjectRoutine+0xe8
f78dad74 804e426b 00000000 00000000 86fc5da8 nt!ObpProcessRemoveObjectQueue+0x38
f78dadac 8057aeff 00000000 00000000 00000000 nt!ExpWorkerThread+0x100
f78daddc 804f88ea 804e4196 00000000 00000000 nt!PspSystemThreadStartup+0x34
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16
STACK_COMMAND: kb
FOLLOWUP_IP:
nt!ExFreePoolWithTag+2be
8054c4c1 83f801 cmp eax,1
SYMBOL_STACK_INDEX: 1
SYMBOL_NAME: nt!ExFreePoolWithTag+2be
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntoskrnl.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 48025eab
FAILURE_BUCKET_ID: 0x19_20_nt!ExFreePoolWithTag+2be
BUCKET_ID: 0x19_20_nt!ExFreePoolWithTag+2be
Followup: MachineOwner
---------
kd> lmvm nt
start end module name
804d7000 806edc00 nt (pdb symbols) c:\symbols\ntoskrnl.pdb\47A5AC97343A4A7ABF14EFD9E99337722\ntoskrnl.pdb
Loaded symbol image file: ntoskrnl.exe
Mapped memory image file: c:\symbols\ntoskrnl.exe\48025EAB216c00\ntoskrnl.exe
Image path: ntoskrnl.exe
Image name: ntoskrnl.exe
Timestamp: Sun Apr 13 21:27:39 2008 (48025EAB)
CheckSum: 002259BA
ImageSize: 00216C00
File version: 5.1.2600.5512
Product version: 5.1.2600.5512
File flags: 0 (Mask 3F)
File OS: 40004 NT Win32
File type: 1.0 App
File date: 00000000.00000000
Translations: 0415.04b0
CompanyName: Microsoft Corporation
ProductName: System operacyjny Microsoft® Windows®
InternalName: ntoskrnl.exe
OriginalFilename: ntoskrnl.exe
ProductVersion: 5.1.2600.5512
FileVersion: 5.1.2600.5512 (xpsp.080413-2111)
FileDescription: Jądro i system NT
LegalCopyright: © Microsoft Corporation. Wszelkie prawa zastrzeżone.
Kod: Zaznacz cały
Probably caused by : ntoskrnl.exe 
Użytkownicy przeglądający to forum: Obecnie na forum nie ma żadnego zarejestrowanego użytkownika i 9 gości
