Моля за анализ на dump файл чрез Windbg

11 март 200719 г.

Появиха ми се два сини екрана:

-от миналата седмица

-и от тази седмица друг

Пуснах създадените MEMORY.DMP файлове в дебъгера Windbg, само че не мога да разбера анализите, които ми дава. Ако някой може да ми помогне, ще съм му благодарен.

Първия анализ е

Use !analyze -v to get detailed debugging information.

BugCheck 50, {80a42038, 1, 20003, 0}

Probably caused by : win32k.sys ( win32k!GenerateNlsVkKey+26 )

Followup: MachineOwner

---------

kd> .reload

Loading Kernel Symbols

................................................................................

.......................................

Loading User Symbols

PEB is paged out (Peb.Ldr = 7ffdf00c). Type ".hh dbgerr001" for details

Loading unloaded module list

................

kd> !analyze -v

*******************************************************************************

* *

* Bugcheck Analysis *

* *

*******************************************************************************

PAGE_FAULT_IN_NONPAGED_AREA (50)

Invalid system memory was referenced. This cannot be protected by try-except,

it must be protected by a Probe. Typically the address is just plain bad or it

is pointing at freed memory.

Arguments:

Arg1: 80a42038, memory referenced.

Arg2: 00000001, value 0 = read operation, 1 = write operation.

Arg3: 00020003, If non-zero, the instruction address which referenced the bad memory

address.

Arg4: 00000000, (reserved)

Debugging Details:

------------------

WRITE_ADDRESS: 80a42038

FAULTING_IP:

+20003

00020003 ?? ???

MM_INTERNAL_CODE: 0

DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: 0x50

PROCESS_NAME: csrss.exe

TRAP_FRAME: f74a98c8 -- (.trap fffffffff74a98c8)

ErrCode = 00000002

eax=80a42038 ebx=bf990000 ecx=00000040 edx=00000004 esi=00868278 edi=f74a99d0

eip=00020003 esp=f74a993c ebp=f74a994c iopl=0 nv up ei ng nz na po nc

cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010282

00020003 ?? ???

Resetting default scope

LAST_CONTROL_TRANSFER: from 80523f44 to 8053331e

STACK_TEXT:

f74a9864 80523f44 00000050 80a42038 00000001 nt!KeBugCheckEx+0x1b

f74a98b0 804e1718 00000001 80a42038 00000000 nt!MmAccessFault+0x6f5

f74a98b0 00020003 00000001 80a42038 00000000 nt!KiTrap0E+0xcc

WARNING: Frame IP not in any known module. Following frames may be wrong.

f74a9938 bf930fbd f74a99d0 00000000 00000000 0x20003

f74a994c bf9310bf 00868278 bf990000 f74a99d0 win32k!GenerateNlsVkKey+0x26

f74a9974 bf8b712a 00868278 f74a99d0 00000000 win32k!KbdNlsFuncTypeAlt+0x85

f74a9990 bf8b85e1 f74a99d0 00000000 f74a99e8 win32k!xxxKENLSProcs+0x67

f74a99ac bf873940 f74a9912 00000000 00000000 win32k!xxxProcessKeyEvent+0x1f9

f74a99ec bf874449 e1ef8100 a4ef8180 00000001 win32k!ProcessKeyboardInputWorker+0x24d

f74a9a0c bf86dcb0 e1ef8180 8204bd58 f74a9a64 win32k!ProcessKeyboardInput+0x68

f74a9a1c 804f18b8 e1ef8180 e1ef81a8 00000000 win32k!InputApc+0x4e

f74a9a64 804f02c1 00000000 00000000 00000000 nt!KiDeliverApc+0x124

f74a9a7c 804e3b7d 804dcbe4 00000001 00000000 nt!KiSwapThread+0x64

f74a9ab4 bf888cc2 00000007 82108e20 00000001 nt!KeWaitForMultipleObjects+0x284

f74a9d30 bf86d09c f74b94a8 00000002 f74a9d54 win32k!RawInputThread+0x4f3

f74a9d40 bf8010ca f74b94a8 f74a9d64 006dfff4 win32k!xxxCreateSystemThreads+0x60

f74a9d54 804de7ec 00000000 00000022 00000000 win32k!NtUserCallOneParam+0x23

f74a9d54 7c90eb94 00000000 00000022 00000000 nt!KiFastCallEntry+0xf8

00000000 00000000 00000000 00000000 00000000 0x7c90eb94

STACK_COMMAND: kb

FOLLOWUP_IP:

win32k!GenerateNlsVkKey+26

bf930fbd 5d pop ebp

SYMBOL_STACK_INDEX: 4

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: win32k

IMAGE_NAME: win32k.sys

DEBUG_FLR_IMAGE_TIMESTAMP: 43446a58

SYMBOL_NAME: win32k!GenerateNlsVkKey+26

FAILURE_BUCKET_ID: 0x50_W_win32k!GenerateNlsVkKey+26

BUCKET_ID: 0x50_W_win32k!GenerateNlsVkKey+26

Followup: MachineOwner

---------

Вторият е

Use !analyze -v to get detailed debugging information.

BugCheck 50, {e34415e7, 0, bf887eef, 1}

Probably caused by : win32k.sys ( win32k!ReadLayoutFile+22c )

Followup: MachineOwner

---------

kd> .reload

Loading Kernel Symbols

................................................................................

.......................................

Loading User Symbols

PEB is paged out (Peb.Ldr = 7ffdf00c). Type ".hh dbgerr001" for details

Loading unloaded module list

.................

kd> !analyze -v

*******************************************************************************

* *

* Bugcheck Analysis *

* *

*******************************************************************************

PAGE_FAULT_IN_NONPAGED_AREA (50)

Invalid system memory was referenced. This cannot be protected by try-except,

it must be protected by a Probe. Typically the address is just plain bad or it

is pointing at freed memory.

Arguments:

Arg1: e34415e7, memory referenced.

Arg2: 00000000, value 0 = read operation, 1 = write operation.

Arg3: bf887eef, If non-zero, the instruction address which referenced the bad memory

address.

Arg4: 00000001, (reserved)

Debugging Details:

------------------

READ_ADDRESS: e34415e7 Paged pool

FAULTING_IP:

win32k!ReadLayoutFile+22c

bf887eef 397808 cmp dword ptr [eax+8],edi

MM_INTERNAL_CODE: 1

IMAGE_NAME: win32k.sys

DEBUG_FLR_IMAGE_TIMESTAMP: 43446a58

MODULE_NAME: win32k

FAULTING_MODULE: bf800000 win32k

DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: 0x50

PROCESS_NAME: winlogon.exe

TRAP_FRAME: f7cd18b4 -- (.trap fffffffff7cd18b4)

ErrCode = 00000000

eax=e34415df ebx=e343b7c8 ecx=e343a008 edx=e34415df esi=e343b5b4 edi=00000000

eip=bf887eef esp=f7cd1928 ebp=f7cd1944 iopl=0 nv up ei ng nz na po nc

cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010282

win32k!ReadLayoutFile+0x22c:

bf887eef 397808 cmp dword ptr [eax+8],edi ds:0023:e34415e7=????????

Resetting default scope

LAST_CONTROL_TRANSFER: from 80523f44 to 8053331e

STACK_TEXT:

f7cd1850 80523f44 00000050 e34415e7 00000000 nt!KeBugCheckEx+0x1b

f7cd189c 804e1718 00000000 e34415e7 00000000 nt!MmAccessFault+0x6f5

f7cd189c bf887eef 00000000 e34415e7 00000000 nt!KiTrap0E+0xcc

f7cd1944 bf887c93 e16c64a8 00a40178 00000858 win32k!ReadLayoutFile+0x22c

f7cd1964 bf87126f 00000920 000017c0 000075d7 win32k!LoadKeyboardLayoutFile+0x6a

f7cd19f0 bf870d72 82225120 00000920 00000000 win32k!xxxLoadKeyboardLayoutEx+0x1be

f7cd1d40 804de7ec 00000920 75d717c0 0006e1b4 win32k!NtUserLoadKeyboardLayoutEx+0x152

f7cd1d40 7c90eb94 00000920 75d717c0 0006e1b4 nt!KiFastCallEntry+0xf8

WARNING: Frame IP not in any known module. Following frames may be wrong.

0006e17c 00000000 00000000 00000000 00000000 0x7c90eb94

STACK_COMMAND: kb

FOLLOWUP_IP:

win32k!ReadLayoutFile+22c

bf887eef 397808 cmp dword ptr [eax+8],edi

SYMBOL_STACK_INDEX: 3

FOLLOWUP_NAME: MachineOwner

SYMBOL_NAME: win32k!ReadLayoutFile+22c

FAILURE_BUCKET_ID: 0x50_win32k!ReadLayoutFile+22c

BUCKET_ID: 0x50_win32k!ReadLayoutFile+22c

Followup: MachineOwner

--------

Редактирано 8 декември 200718 г. от stanley56 (преглед на промените)

9 ноември 200718 г.

ТУК.Станаха 3 за този месец.Рестартира ми се компа и това ме тормози.До колкото разбрах winbg ги отваря ама защо неможах да я намеря...

9 ноември 200718 г.

Обърни внимание на оградения файл: И трите дъмпа показват същото.Windbg може да я изтеглиш от сайта на Майкрософт.

10 ноември 200718 г.

Благодаря за бързия отговор.Трябвало е да търся в Debug tools за това не съм я намерил Windbg.Сега вече си я инсталнах и намерих още един пакосник.Който нищо не ми говори.За първия разбирам че става въпрос за аудиото ама какво точно.Драивери ли или в хардуера е проблема.Моля за малко инфо за да ми стане ясно как да си реша проблема.

10 ноември 200718 г.

Благодаря за бързия отговор.Трябвало е да търся в Debug tools за това не съм я намерил Windbg.Сега вече си я инсталнах и намерих още един пакосник.Който нищо не ми говори.За първия разбирам че става въпрос за аудиото ама какво точно.Драивери ли или в хардуера е проблема.Моля за малко инфо за да ми стане ясно как да си реша проблема.

Изглежда по-скоро проблем с драйверите

11 ноември 200718 г.

Можеш и сам да си ги разчиташ...самоцитирам се.

-WindBG 6.8.4.0 (Debugging Tools for Windows - програма за "прочитане на лог файлове - с разширение *.dmp които се създават при срив на някое приложение и по този начин получаваме насока как да елиминираме изникналия приблем").

За 32-битова версия на Windows

http://msdl.microsoft.com/download/symbols...x86_6.8.4.0.msi

За 64-битова версия на Windows

http://msdl.microsoft.com/download/symbols...a64_6.8.4.0.msi

Стартирайте приложението и направете следните настройки за да си тегли само необходимите символики за разчитането на даден *.dmp а не всички такива (който са над 200 MB и няма смисъл да ви заемат само място на хард диска)

На Symbol Search Path сложи този ред - SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols

На Executable image search path - C:\WINDOWS\system32

Примерен такъв "разшифрован" файл - обърнете внимание на заграденото с червена рамка *.EXE!

11 ноември 200718 г.

Благодаря много. Публикувано изображение А сега да обесня каква я свърших.Windbg вече си я инсталирах.Стартирам я,от FILE давам Open Crash Dump и зареждам съответния файл от папка mini dump.B-boy[styLe] на правих каквото ми каза с настройките.При много от dump файловете виновника е cmaudio.sys.Дали разбрах правилно дали не изтрих аудио драиверите и ги инсталнах наново.В единия dump виновника е ntoskrnl.exe.Ама с него какво да правя незнам.И да попитам правилно ли постъпих в първия случай и какво да правя с втория.А windbg само за това ли ни служи да покаже грешката?

11 ноември 200718 г.

Благодаря много. А сега да обесня каква я свърших.Windbg вече си я инсталирах.Стартирам я,от FILE давам Open Crash Dump и зареждам съответния файл от папка mini dump.B-boy[styLe] на правих каквото ми каза с настройките.При много от dump файловете виновника е cmaudio.sys.Дали разбрах правилно дали не изтрих аудио драиверите и ги инсталнах наново.В единия dump виновника е ntoskrnl.exe.Ама с него какво да правя незнам.И да попитам правилно ли постъпих в първия случай и какво да правя с втория.А windbg само за това ли ни служи да покаже грешката?

За аудио драйверите бива да се изтрият и преинсталират, но ntoskrnl.exe е ядрото на операционната система, по-добре ъпдейтни с последните кръпки или инсталирай от читав Windows+сървис пак

Редактирано 11 ноември 200718 г. от capnemo (преглед на промените)

12 ноември 200718 г.

Благодаря за съдействието момчета.Направих всичко което ми препоръчахте.Ъпдейтнах и уина.дано няма проблеми вече.

29 октомври 200817 г.

На какво се дължи това.. ако някои има идея да помага, че вече обърнах google-а наопаки и нищо и нищо... Microsoft ® Windows Debugger Version 6.9.0003.113 X86 Copyright © Microsoft Corporation. All rights reserved. Loading Dump File [C:\WINDOWS\Minidump\Mini102808-01.dmp] Mini Kernel Dump File: Only registers and stack trace are available Symbol search path is: *** Invalid *** **************************************************************************** * Symbol loading may be unreliable without a symbol search path. * * Use .symfix to have the debugger choose a symbol path. * * After setting your symbol path, use .reload to refresh symbol locations. * **************************************************************************** Executable search path is: ********************************************************************* * Symbols can not be loaded because symbol path is not initialized. * * * * The Symbol Path can be set by: * * using the _NT_SYMBOL_PATH environment variable. * * using the -y <symbol_path> argument when starting the debugger. * * using .sympath and .sympath+ * ********************************************************************* Unable to load image ntoskrnl.exe, Win32 error 0n2 *** WARNING: Unable to verify timestamp for ntoskrnl.exe *** ERROR: Module load completed but symbols could not be loaded for ntoskrnl.exe Windows XP Kernel Version 2600 (Service Pack 2) UP Free x86 compatible Product: WinNt, suite: TerminalServer SingleUserTS Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055ab20 Debug session time: Tue Oct 28 18:49:20.171 2008 (GMT+2) System Uptime: 0 days 0:00:56.746 ********************************************************************* * Symbols can not be loaded because symbol path is not initialized. * * * * The Symbol Path can be set by: * * using the _NT_SYMBOL_PATH environment variable. * * using the -y <symbol_path> argument when starting the debugger. * * using .sympath and .sympath+ * ********************************************************************* Unable to load image ntoskrnl.exe, Win32 error 0n2 *** WARNING: Unable to verify timestamp for ntoskrnl.exe *** ERROR: Module load completed but symbols could not be loaded for ntoskrnl.exe Loading Kernel Symbols ................................................................................ .................................. Loading User Symbols Loading unloaded module list ........ Unable to load image win32k.sys, Win32 error 0n2 *** WARNING: Unable to verify timestamp for win32k.sys *** ERROR: Module load completed but symbols could not be loaded for win32k.sys ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* Use !analyze -v to get detailed debugging information. BugCheck 1000008E, {c0000005, 80563935, ba747680, 0} *** WARNING: Unable to verify timestamp for mssmbios.sys *** ERROR: Module load completed but symbols could not be loaded for mssmbios.sys ANALYSIS: Kernel with unknown size. Will force reload symbols with known size. ANALYSIS: Force reload command: .reload /f ntoskrnl.exe=FFFFFFFF804D7000,214600,41108004 ***** Kernel symbols are WRONG. Please fix symbols to do analysis. ************************************************************************* *** *** *** *** *** Your debugger is not using the correct symbols *** *** *** *** In order for this command to work properly, your symbol path *** *** must point to .pdb files that have full type information. *** *** *** *** Certain .pdb files (such as the public OS symbols) do not *** *** contain the required information. Contact the group that *** *** provided you with these symbols if you need this command to *** *** work. *** *** *** *** Type referenced: nt!_KPRCB *** *** *** ************************************************************************* ************************************************************************* *** *** *** *** *** Your debugger is not using the correct symbols *** *** *** *** In order for this command to work properly, your symbol path *** *** must point to .pdb files that have full type information. *** *** *** *** Certain .pdb files (such as the public OS symbols) do not *** *** contain the required information. Contact the group that *** *** provided you with these symbols if you need this command to *** *** work. *** *** *** *** Type referenced: nt!_KPRCB *** *** *** ************************************************************************* ********************************************************************* * Symbols can not be loaded because symbol path is not initialized. * * * * The Symbol Path can be set by: * * using the _NT_SYMBOL_PATH environment variable. * * using the -y <symbol_path> argument when starting the debugger. * * using .sympath and .sympath+ * ********************************************************************* ********************************************************************* * Symbols can not be loaded because symbol path is not initialized. * * * * The Symbol Path can be set by: * * using the _NT_SYMBOL_PATH environment variable. * * using the -y <symbol_path> argument when starting the debugger. * * using .sympath and .sympath+ * ********************************************************************* Probably caused by : win32k.sys ( win32k+dc065 ) Followup: MachineOwner --------- kd> !analyze -v ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* KERNEL_MODE_EXCEPTION_NOT_HANDLED_M (1000008e) This is a very common bugcheck. Usually the exception address pinpoints the driver/function that caused the problem. Always note this address as well as the link date of the driver/image that contains this address. Some common problems are exception code 0x80000003. This means a hard coded breakpoint or assertion was hit, but this system was booted /NODEBUG. This is not supposed to happen as developers should never have hardcoded breakpoints in retail code, but ... If this happens, make sure a debugger gets connected, and the system is booted /DEBUG. This will let us see why this breakpoint is happening. Arguments: Arg1: c0000005, The exception code that was not handled Arg2: 80563935, The address that the exception occurred at Arg3: ba747680, Trap Frame Arg4: 00000000 Debugging Details: ------------------ ANALYSIS: Kernel with unknown size. Will force reload symbols with known size. ANALYSIS: Force reload command: .reload /f ntoskrnl.exe=FFFFFFFF804D7000,214600,41108004 ***** Kernel symbols are WRONG. Please fix symbols to do analysis. ************************************************************************* *** *** *** *** *** Your debugger is not using the correct symbols *** *** *** *** In order for this command to work properly, your symbol path *** *** must point to .pdb files that have full type information. *** *** *** *** Certain .pdb files (such as the public OS symbols) do not *** *** contain the required information. Contact the group that *** *** provided you with these symbols if you need this command to *** *** work. *** *** *** *** Type referenced: nt!_KPRCB *** *** *** ************************************************************************* ************************************************************************* *** *** *** *** *** Your debugger is not using the correct symbols *** *** *** *** In order for this command to work properly, your symbol path *** *** must point to .pdb files that have full type information. *** *** *** *** Certain .pdb files (such as the public OS symbols) do not *** *** contain the required information. Contact the group that *** *** provided you with these symbols if you need this command to *** *** work. *** *** *** *** Type referenced: nt!_KPRCB *** *** *** ************************************************************************* ********************************************************************* * Symbols can not be loaded because symbol path is not initialized. * * * * The Symbol Path can be set by: * * using the _NT_SYMBOL_PATH environment variable. * * using the -y <symbol_path> argument when starting the debugger. * * using .sympath and .sympath+ * ********************************************************************* ********************************************************************* * Symbols can not be loaded because symbol path is not initialized. * * * * The Symbol Path can be set by: * * using the _NT_SYMBOL_PATH environment variable. * * using the -y <symbol_path> argument when starting the debugger. * * using .sympath and .sympath+ * ********************************************************************* MODULE_NAME: win32k FAULTING_MODULE: 804d7000 nt DEBUG_FLR_IMAGE_TIMESTAMP: 41107f7a EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx". The memory could not be "%s". FAULTING_IP: nt+8c935 80563935 c3 ret TRAP_FRAME: ba747680 -- (.trap 0xffffffffba747680) ErrCode = 00000002 eax=e24723e8 ebx=88de7860 ecx=88de7928 edx=e24723ec esi=00000000 edi=bbe50be0 eip=80563935 esp=ba7476f4 ebp=ba747708 iopl=0 nv up ei pl nz na po nc cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010202 nt+0x8c935: 80563935 c3 ret Resetting default scope CUSTOMER_CRASH_COUNT: 1 DEFAULT_BUCKET_ID: WRONG_SYMBOLS BUGCHECK_STR: 0x8E LAST_CONTROL_TRANSFER: from bf8dc065 to 80563935 STACK_TEXT: WARNING: Stack unwind information not available. Following frames may be wrong. ba747708 bf8dc065 88de7860 e24b9518 00000000 nt+0x8c935 ba747724 bf83ad9d 88e00a28 0012fdc8 ba7477e8 win32k+0xdc065 ba747790 bf8d4b79 03e50be0 00000000 00000000 win32k+0x3ad9d ba7477ac bf862156 00000000 00000000 00000002 win32k+0xd4b79 ba747800 bf8d4af6 00000003 00000000 00000000 win32k+0x62156 ba74781c 804df06b 00000000 00000000 0012fdac win32k+0xd4af6 ba747834 7c90eb94 badb0d00 0012fcd8 bbc0eb60 nt+0x806b ba747838 badb0d00 0012fcd8 bbc0eb60 00000eb6 0x7c90eb94 ba74783c 0012fcd8 bbc0eb60 00000eb6 bbc0eb60 0xbadb0d00 ba747840 bbc0eb60 00000eb6 bbc0eb60 bf806be9 0x12fcd8 ba747844 00000000 bbc0eb60 bf806be9 ba747a6c 0xbbc0eb60 STACK_COMMAND: kb FOLLOWUP_IP: win32k+dc065 bf8dc065 ?? ??? SYMBOL_STACK_INDEX: 1 SYMBOL_NAME: win32k+dc065 FOLLOWUP_NAME: MachineOwner IMAGE_NAME: win32k.sys BUCKET_ID: WRONG_SYMBOLS Followup: MachineOwner --------- kd> lmvm win32k start end module name bf800000 bf9c0380 win32k T (no symbols) Loaded symbol image file: win32k.sys Image path: win32k.sys Image name: win32k.sys Timestamp: Wed Aug 04 09:17:30 2004 (41107F7A) CheckSum: 001CCC5F ImageSize: 001C0380 Translations: 0000.04b0 0000.04e0 0409.04b0 0409.04e0 kd> lmvm nt start end module name 804d7000 806eb780 nt T (no symbols) Loaded symbol image file: ntoskrnl.exe Image path: ntoskrnl.exe Image name: ntoskrnl.exe Timestamp: Wed Aug 04 09:19:48 2004 (41108004) CheckSum: 002160C9 ImageSize: 00214780 Translations: 0000.04b0 0000.04e0 0409.04b0 0409.04e0 kd> .trap 0xffffffffba747680 ErrCode = 00000002 eax=e24723e8 ebx=88de7860 ecx=88de7928 edx=e24723ec esi=00000000 edi=bbe50be0 eip=80563935 esp=ba7476f4 ebp=ba747708 iopl=0 nv up ei pl nz na po nc cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010202 nt+0x8c935: 80563935 c3 ret

2 ноември 200817 г.

win32k.sys is related to the graphics subsystem, yes.

it's more likely a conflict between win32k.sys and the graphics driver, but if you replace the card, you probably end up using a card that has different drivers and hence doesn't cause a problem.

Демек...пробвай с друга версия на драйверите за видеокартата или с друга такава (ако имаш тази възможност) Публикувано изображение

Иначе като универсални решения се препоръчват следните неща:

1. Check the temperature of the CPU and make sure that it is not overheat (ie temperature < 60C)
2. Reseat the memory stick to another memory slot
3. Downclock the ram
4. Clean the dust inside the computer case
5. Make sure that the ram is compatible to the motherboard
6. Check the bios setting about memory timing and make sure that it is on
If it still crashes, diagnostic which memory stick is faulty
1. Take out one memory stick. If windows does not crash, the removed memory stick is faulty.
2. If you have only one memory stick, replace the ram

Какво е съобщението от BSOD ?

Какви са настройките ти на WindBG ? Сравни ги с тези:

http://www.kaldata.com/forums/index.php?s=...st&p=726652

Виж и тази тема:

http://www.kaldata.com/forums/index.php?s=...t&p=1003155

Ако си клоквал някой компонент също върни настройките по подразбиране...

В Биос-а зареди Load optimized defaults или Load fail-safe defaults.

23 ноември 200916 г.

На какво се може да се дължи това(dump file)

dump.txt

3 юни 201214 г.

При мен не става да прочете файла въпреки, че правя настройките както е описал

B-boy[styLe]

и ми излиза това

Microsoft (R) Windows Debugger Version 6.8.0004.0 X86
Copyright (c) Microsoft Corporation. All rights reserved.

Loading Dump File [C:WindowsMinidump051312-18782-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Mini Kernel Dump does not have thread information
Symbol search path is: SRV*c:websymbols*http://msdl.microsoft.com/download/symbols
Executable search path is: C:WINDOWSsystem32

"nt" was not found in the image list.
Debugger will attempt to load "nt" at given base 00000000.
Please provide the full image name, including the extension (i.e. kernel32.dll)
for more reliable results.Base address and size overrides can be given as
.reload <image.ext>=<base>,<size>.
Unable to load image nt, Win32 error 0n2
Unable to add module at 00000000
Debugger can not determine kernel base address
Windows Kernel Version 7601 (Service Pack 1) MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.17803.x86fre.win7sp1_gdr.120330-1504
Kernel base = 0x82e3a000 PsLoadedModuleList = 0x82f834d0
Debug session time: Sun May 13 17:08:00.830 2012 (GMT+3)
System Uptime: 1 days 2:42:19.974

"nt" was not found in the image list.
Debugger will attempt to load "nt" at given base 00000000.
Please provide the full image name, including the extension (i.e. kernel32.dll)
for more reliable results.Base address and size overrides can be given as
.reload <image.ext>=<base>,<size>.
Unable to load image nt, Win32 error 0n2
Unable to add module at 00000000
Debugger can not determine kernel base address
Loading Kernel Symbols
Loading User Symbols

Някой има ли идея защо при мен не става?

19 юни 201214 г.

Здравейте. Моя компютър от известно време започна да забива. Прегряваше ми чипсета и му смених охлаждането и сега вече не прегрява но проблема със забиването си остана. Отворих 2 дъмп файла които ми изкараха следната информация:

Microsoft (R) Windows Debugger Version 6.12.0002.633 X86
Copyright (c) Microsoft Corporation. All rights reserved.

Loading Dump File [C:UsersDraculaDesktop061712-11421-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:websymbols*http://msdl.microsoft.com/download/symbols
Executable search path is: C:WINDOWSsystem32
Windows 7 Kernel Version 7600 MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16988.x86fre.win7_gdr.120401-1505
Machine Name:
Kernel base = 0x82a4a000 PsLoadedModuleList = 0x82b92810
Debug session time: Sun Jun 17 11:37:58.250 2012 (UTC + 3:00)
System Uptime: 0 days 0:00:17.921
Loading Kernel Symbols
...............................................................
..............................
Loading User Symbols
*******************************************************************************
*																			 *
*					 Bugcheck Analysis								 *
*																			 *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck D1, {0, 2, 0, 88947b89}
Probably caused by : hardware ( nvstor!NvStorReqCompleteRequest+1 )
Followup: MachineOwner
---------
1: kd> !analyze -v
*******************************************************************************
*																			 *
*					 Bugcheck Analysis								 *
*																			 *
*******************************************************************************
DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: 00000000, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000000, value 0 = read operation, 1 = write operation
Arg4: 88947b89, address which referenced memory
Debugging Details:
------------------

READ_ADDRESS: GetPointerFromAddress: unable to read from 82bb2718
Unable to read MiSystemVaType memory at 82b92160
00000000
CURRENT_IRQL: 2
FAULTING_IP:
nvstor!NvStorReqCompleteRequest+1
88947b89 ff558b		 call dword ptr [ebp-75h]
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
BUGCHECK_STR: 0xD1
PROCESS_NAME: System
TRAP_FRAME: 807e2b64 -- (.trap 0xffffffff807e2b64)
ErrCode = 00000000
eax=fffffffd ebx=807c7a00 ecx=889545e0 edx=00000000 esi=8566f288 edi=00000000
eip=88947b89 esp=807e2bd8 ebp=807e2be8 iopl=0		 nv up ei pl zr na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000			 efl=00010246
nvstor!NvStorReqCompleteRequest+0x1:
88947b89 ff558b		 call dword ptr [ebp-75h] ss:0010:807e2b73=9530b000
Resetting default scope
MISALIGNED_IP:
nvstor!NvStorReqCompleteRequest+1
88947b89 ff558b		 call dword ptr [ebp-75h]
LAST_CONTROL_TRANSFER: from 88947b89 to 82a9082b
STACK_TEXT:
807e2b64 88947b89 badb0d00 00000000 889530b0 nt!KiTrap0E+0x2cf
807e2be8 8893c725 8566f288 8566f288 807e2c14 nvstor!NvStorReqCompleteRequest+0x1
807e2bf8 88936e2d 8566f288 00000002 00000000 nvstor!NvStorSataAtaSuccess+0x43
807e2c14 88937109 00000000 00000000 848b6000 nvstor!NvStorProtocolAtaSendCommandAndBusyWaitInterrupt+0x121
807e2c28 889369af 848b6000 8566f288 855600d4 nvstor!NvStorProtocolAtaDmaInterrupt+0x73
807e2c3c 88942cb1 848b6000 85561d30 807cb884 nvstor!NvStorProtocolAtaNonQueuedHandleInterrupt+0x3f
807e2c68 88944d57 855600d4 00000000 807e2cd4 nvstor!NvStorIntPortDpcSingleDevice+0x69
807e2c78 82ab24f5 85561d30 85560004 855600d4 nvstor!NvStorDpcForIsr+0x13
807e2cd4 82ab2358 807c6120 807cb800 00000000 nt!KiExecuteAllDpcs+0xf9
807e2d20 82ab2178 00000000 0000000e 00000000 nt!KiRetireDpcList+0xd5
807e2d24 00000000 0000000e 00000000 00000000 nt!KiIdleLoop+0x38

STACK_COMMAND: kb
FOLLOWUP_IP:
nvstor!NvStorReqCompleteRequest+1
88947b89 ff558b		 call dword ptr [ebp-75h]
SYMBOL_STACK_INDEX: 1
SYMBOL_NAME: nvstor!NvStorReqCompleteRequest+1
FOLLOWUP_NAME: MachineOwner
IMAGE_NAME: hardware
DEBUG_FLR_IMAGE_TIMESTAMP: 0
MODULE_NAME: hardware
FAILURE_BUCKET_ID: IP_MISALIGNED_nvstor.sys
BUCKET_ID: IP_MISALIGNED_nvstor.sys
Followup: MachineOwner
---------

и

Loading Dump File [C:UsersDraculaDesktop061312-13296-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:websymbols*http://msdl.microsoft.com/download/symbols
Executable search path is: C:WINDOWSsystem32
Windows 7 Kernel Version 7600 MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16988.x86fre.win7_gdr.120401-1505
Machine Name:
Kernel base = 0x82a13000 PsLoadedModuleList = 0x82b5b810
Debug session time: Wed Jun 13 23:40:54.661 2012 (UTC + 3:00)
System Uptime: 0 days 0:37:48.489
Loading Kernel Symbols
...............................................................
................................................................
...............
Loading User Symbols
Loading unloaded module list
.......
*******************************************************************************
*																			 *
*					 Bugcheck Analysis								 *
*																			 *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck A, {169a2, 2, 1, 82a7d2c0}
Probably caused by : ntkrpamp.exe ( nt!KiTimerWaitTest+d9 )
Followup: MachineOwner
---------
0: kd>

Някой може ли да ми каже в какво може да се дължи този проблем? С 2 хард диска съм смених им сата кабелите наскоро не се оправи проблема захранването ми е Fortron Bluestorm II 500W тоците според еверест и биоса са перфектни дори и в момент на забиване ги видях пак са добре температурите след като смених охлаждането на чипсета са добри рам паметта не изкарва грешки през тест от уиндоус и хиренс буут сд и няма никви ерори макар че ме съмнява самата тя но не изкарва грешки.Попитах хора за процесора дали може да се гъне и ми казаха че той или работи или не неможел да прави такива проблеми. Моля който може да помогне защото много ме нерви тоя компютър ... Благодаря предварително!

Поздрави!

ПС: Сега отворих още един от предните които ми е изкарвало и показва това:

Loading Dump File [C:UsersDraculaDesktop061512-27546-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:websymbols*http://msdl.microsoft.com/download/symbols
Executable search path is: C:WINDOWSsystem32
Windows 7 Kernel Version 7600 MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16988.x86fre.win7_gdr.120401-1505
Machine Name:
Kernel base = 0x82a3b000 PsLoadedModuleList = 0x82b83810
Debug session time: Fri Jun 15 20:47:24.301 2012 (UTC + 3:00)
System Uptime: 0 days 0:10:45.973
Loading Kernel Symbols
...............................................................
................................................................
..................
Loading User Symbols
Loading unloaded module list
......
1: kd> !analyze -V
Unknown option '-V'
*******************************************************************************
*																			 *
*					    Bugcheck Analysis								    *
*																			 *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 124, {0, 85a07024, b63d0000, 10015}
Probably caused by : hardware
Followup: MachineOwner
---------
1: kd> !analyze -v
*******************************************************************************
*																			 *
*					    Bugcheck Analysis								    *
*																			 *
*******************************************************************************
WHEA_UNCORRECTABLE_ERROR (124)
A fatal hardware error has occurred. Parameter 1 identifies the type of error
source that reported the error. Parameter 2 holds the address of the
WHEA_ERROR_RECORD structure that describes the error conditon.
Arguments:
Arg1: 00000000, Machine Check Exception
Arg2: 85a07024, Address of the WHEA_ERROR_RECORD structure.
Arg3: b63d0000, High order 32-bits of the MCi_STATUS value.
Arg4: 00010015, Low order 32-bits of the MCi_STATUS value.
Debugging Details:
------------------

BUGCHECK_STR:  0x124_AuthenticAMD
CUSTOMER_CRASH_COUNT:  1
DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT
PROCESS_NAME:  opera_plugin_w
CURRENT_IRQL:  1f
STACK_TEXT: 
807ce8cc 82a12f3f 00000124 00000000 85a07024 nt!KeBugCheckEx+0x1e
807ce908 82b0a084 85992b69 85a07024 82aa3610 hal!HalBugCheckSystem+0xab
807ce938 82a131f1 85991500 82a20e40 00000000 nt!WheaReportHwError+0x230
807cea4c 82a132e3 85991500 85991550 00000000 hal!HalpMcaReportError+0x3b
807cea70 82a1354f 00000000 85991550 807ceb90 hal!HalpMceHandler+0x8b
807cea80 82a095f5 00000000 00000000 00000000 hal!HalpHandleMachineCheck+0x3b
807ceb90 82a06261 00000000 807c9750 00000000 hal!HalpMcaExceptionHandler+0x87
807ceb90 00000000 00000000 807c9750 00000000 hal!HalpMcaExceptionHandlerWrapper+0x89

STACK_COMMAND:  kb
FOLLOWUP_NAME:  MachineOwner
MODULE_NAME: hardware
IMAGE_NAME:  hardware
DEBUG_FLR_IMAGE_TIMESTAMP:  0
FAILURE_BUCKET_ID:  0x124_AuthenticAMD_PROCESSOR_TLB
BUCKET_ID:  0x124_AuthenticAMD_PROCESSOR_TLB
Followup: MachineOwner
---------
1: kd> lmvm hardware
start    end	    module name

Така както аз го разчитам това показва че процесора нещо прави мизерии. Та възможно ли е след като уж процесора или работи или не да прави това?

Редактирано 19 юни 201214 г. от rokkoilinda (преглед на промените)

8 февруари 201313 г.

Microsoft ® Windows Debugger Version 6.2.9200.16384 X86

Loading Dump File [C:WindowsDUMP362c.tmp]

Kernel Summary Dump File: Only kernel address space is available

Symbol search path is: srv*c:symbols*http://msdl.microsoft.com/download/symbols

Executable search path is:

Windows Vista Kernel Version 6000 MP (4 procs) Free x86 compatible

Product: WinNt, suite: TerminalServer SingleUserTS

Built by: 6000.16386.x86fre.vista_rtm.061101-2205

Machine Name:

Kernel base = 0x82000000 PsLoadedModuleList = 0x82111db0

Debug session time: Thu Feb 7 15:12:30.934 2013 (UTC + 2:00)

System Uptime: 0 days 21:27:06.958

Loading Kernel Symbols

...............................................................

................................................................

.......................

Loading User Symbols

PEB is paged out (Peb.Ldr = 7ffdd00c). Type ".hh dbgerr001" for details

Loading unloaded module list

.............

*******************************************************************************

* *

* Bugcheck Analysis *

* *

*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 4E, {99, 1c5c5, 2, 580f8}

*** ERROR: Module load completed but symbols could not be loaded for klif.sys

Page c7050 too large to be in the dump file.

Page cba55 too large to be in the dump file.

Probably caused by : Unknown_Image ( PAGE_NOT_ZERO )

Followup: MachineOwner

---------

*** Memory manager detected 6 instance(s) of page corruption, target is likely to have memory corruption.

2 ноември 201411 г.

Периодично ми дава син екран,а напоследък все почесто. информацията в минидъмп файла е:

Microsoft ® Windows Debugger Version 6.8.0004.0 X86
Copyright © Microsoft Corporation. All rights reserved.

Loading Dump File [C:\WINDOWS\Minidump\Mini010814-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols
Executable search path is: C:\WINDOWS\system32
Windows XP Kernel Version 2600 (Service Pack 3) MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 2600.xpsp_sp3_gdr.090206-1234
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055d720
Debug session time: Wed Jan 8 22:10:43.070 2014 (GMT+2)
System Uptime: 17 days 0:55:24.690
Loading Kernel Symbols
...................................................................................................................................
Loading User Symbols
Loading unloaded module list
..................................................
*** ERROR: Module load completed but symbols could not be loaded for GV800S.sys
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1000000A, {3c74c09b, 1c, 0, 804fa276}

Probably caused by : GV800S.sys ( GV800S+5405 )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 3c74c09b, memory referenced
Arg2: 0000001c, IRQL
Arg3: 00000000, bitfield :
   bit 0 : value 0 = read operation, 1 = write operation
   bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: 804fa276, address which referenced memory

Debugging Details:
------------------

READ_ADDRESS: 3c74c09b

CURRENT_IRQL: 1c

FAULTING_IP:
nt!KeSetEvent+32
804fa276 66394616        cmp     word ptr [esi+16h],ax

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: 0xA

PROCESS_NAME: DMWebCam.exe

LAST_CONTROL_TRANSFER: from b9494405 to 804fa276

STACK_TEXT:
ba4c7f98 b9494405 b949455c 00000000 00000000 nt!KeSetEvent+0x32
WARNING: Stack unwind information not available. Following frames may be wrong.
ba4c7fc8 b9491dfd 80545e7f 89944284 89944000 GV800S+0x5405
ba4c7fcc 80545e7f 89944284 89944000 00000000 GV800S+0x2dfd
ba4c7ff4 805459eb a6d57b5c 00000000 00000000 nt!KiRetireDpcList+0x61
ba4c7ff8 a6d57b5c 00000000 00000000 00000000 nt!KiDispatchInterrupt+0x2b
805459eb 00000000 00000009 0081850f bb830000 0xa6d57b5c

STACK_COMMAND: kb

FOLLOWUP_IP:
GV800S+5405
b9494405 c3              ret

SYMBOL_STACK_INDEX: 1

SYMBOL_NAME: GV800S+5405

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: GV800S

IMAGE_NAME: GV800S.sys

DEBUG_FLR_IMAGE_TIMESTAMP: 460b466e

FAILURE_BUCKET_ID: 0xA_GV800S+5405

BUCKET_ID: 0xA_GV800S+5405

Followup: MachineOwner
---------

Редактирано 2 ноември 201411 г. от vesi333 (преглед на промените)

Добре дошли!

Моля за анализ на dump файл чрез Windbg

Featured Replies

Архивирана тема

Разглеждащи това в момента 0

Дарение

Бюлетин

Профил

Навигация

Търсене

Конфигуриране на push известия в браузъра

Chrome (Android)

Chrome (Desktop)

Safari (iOS 16.4+)

Safari (macOS)

Edge (Android)

Edge (Desktop)

Firefox (Android)

Firefox (Desktop)