Me acaba de dar otro error (continúa de hilo anterior)

Ya he desinstalado el Norton, pero me dio otro error cuando lo estaba
desinstalando que no quedó registrado ;-((
Sigo pensando que debo tener un problema de hardware, así que supongo que
pronto os pediré ayuda con más cuelgues (ojalá que no).
Gracias a todos por vuestra paciencia.
Francisco.


"JM Tella Llop [MVP Windows]" escribió en el mensaje
news:

ejecuta el comando kv tal y como te dice...

perolos otros errores son de antivirus los cual no es de
estrañar.pero este es de kernel y cuando ocurren errores
totalmente diferentes, es problema hardware: memoria, cpu o placa madre
dañada.

Jose Manuel Tella Llop
MVP - Windows
(quitar XXX)
http://www.multingles.net/jmt.htm

Este mensaje se proporciona "como está" sin garantías de ninguna clase,
y no otorga ningún derecho.

This posting is provided "AS IS" with no warranties, and confers no
rights.
You assume all risk for your use.



"FJTL" wrote in message
news:

Si, si. Es que aún no me ha dado tiempo.
Y ahora otros dos errores, uno de Symevent.sys y ¡curioso!, otro que dice
(y esta vez no es el Norton)

Loading User Symbols

*******************************************************************************

* *

* Bugcheck Analysis *

* *

*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1000007F, {d, 0, 0, 0}

*** WARNING: Unable to verify timestamp for ati2mtag.sys

*** ERROR: Module load completed but symbols could not be loaded for
ati2mtag.sys

Probably caused by : ntoskrnl.exe ( nt!KiFlushNPXState+5c )

Followup: MachineOwner



kd> !analyze -v

*******************************************************************************

* *

* Bugcheck Analysis *

* *

*******************************************************************************

UNEXPECTED_KERNEL_MODE_TRAP_M (1000007f)

This means a trap occurred in kernel mode, and it's a trap of a kind

that the kernel isn't allowed to have/catch (bound trap) or that

is always instant death (double fault). The first number in the

bugcheck params is the number of the trap (8 = double fault, etc)

Consult an Intel x86 family manual to learn more about what these

traps are. Here is a *portion* of those codes:

If kv shows a taskGate

use .tss on the part before the colon, then kv.

Else if kv shows a trapframe

use .trap on that value

Else

.trap on the appropriate frame will show where the trap was taken

(on x86, this will be the ebp that goes with the procedure KiTrap)

Endif

kb will then show the corrected stack.

Arguments:

Arg1: 0000000d, EXCEPTION_GP_FAULT

Arg2: 00000000

Arg3: 00000000

Arg4: 00000000

Debugging Details:





BUGCHECK_STR: 0x7f_d

CUSTOMER_CRASH_COUNT: 4

DEFAULT_BUCKET_ID: COMMON_SYSTEM_FAULT

LAST_CONTROL_TRANSFER: from 00000000 to 804db5d8

STACK_TEXT:

e13c5a90 00000000 00000000 00000000 00000000 nt!RtlpGetStackLimits+0xa

ef599818 80565cec ef5998d0 ef5998cc ef599b18 nt!KiCallUserMode+0x4

ef599874 bf85c34f 00000042 ef5998e0 00000068 nt!KeUserModeCallback+0x87

ef599afc bf85c45a ef599b18 0000af15 00000000
win32k!ClientLoadLibrary+0xb2

ef599d2c bf80d093 00000000 0012fe48 0000001d win32k!xxxLoadHmodIndex+0x86

ef599d48 bf8010fa ef599d64 0012fe48 ef599d64
win32k!xxxLoadUserApiHook+0xa6

ef599d58 804de7ec 0000001d 0012fe74 7c91eb94
win32k!NtUserCallNoParam+0x1b

ef599d58 7c91eb94 0000001d 0012fe74 7c91eb94 nt!KiFastCallEntry+0xf8

WARNING: Frame IP not in any known module. Following frames may be wrong.

0012fdc0 00000000 00000000 00000000 00000000 0x7c91eb94



FOLLOWUP_IP:

nt!KiFlushNPXState+5c

804e1f7a 0fae09 fxrstor byte ptr [ecx]

SYMBOL_STACK_INDEX: 0

FOLLOWUP_NAME: MachineOwner

SYMBOL_NAME: nt!KiFlushNPXState+5c

MODULE_NAME: nt

IMAGE_NAME: ntoskrnl.exe

DEBUG_FLR_IMAGE_TIMESTAMP: 42250ff9

STACK_COMMAND: .trap ffffffffef599010 ; kb

FAILURE_BUCKET_ID: 0x7f_d_nt!KiFlushNPXState+5c

BUCKET_ID: 0x7f_d_nt!KiFlushNPXState+5c

Followup: MachineOwner



¡¡socorro!!



Francisco.




"Carlos Lasarte" escribió en el mensaje
news:OWfbz%

y porque no lo desinstalas de una vez por todas ?, veras como se
soluciona

Espero que esto resuelva tu problema, sino, no dudes en preguntar de
nuevo
Para la Seguridad de tu equipo, instala el SP2 de Windows XP
http://www.microsoft.com/downloads/...p;FamilyID9c9dbe-3b8e-4f30-8245-9e368d3cdb5a

Saludos
Carlos Lasarte

Windows XP Home
"FJTL" escribió en el mensaje
news:

Pues eso, que otro error. Supongo que está claro que es el Norton... ¿o
no?.

Loading User Symbols

*******************************************************************************

* *

* Bugcheck Analysis *

* *

*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck C4, {90, ffdff120, 0, 0}

Unable to load image SAVRT.SYS, Win32 error 2

*** WARNING: Unable to verify timestamp for SAVRT.SYS

*** ERROR: Module load completed but symbols could not be loaded for
SAVRT.SYS

Probably caused by : SAVRT.SYS ( SAVRT+33af4 )

Followup: MachineOwner



kd> !analyze -v

*******************************************************************************

* *

* Bugcheck Analysis *

* *

*******************************************************************************

DRIVER_VERIFIER_DETECTED_VIOLATION (c4)

A device driver attempting to corrupt the system has been caught. This
is

because the driver was specified in the registry as being suspect (by
the

administrator) and the kernel has enabled substantial checking of this
driver.

If the driver attempts to corrupt the system, bugchecks 0xC4, 0xC1 and
0xA will

be among the most commonly seen crashes.

Parameter 1 = 0x1000 .. 0x1020 - deadlock verifier error codes.

Typically the code is 0x1001 (deadlock detected) and you can

issue a '!deadlock' KD command to get more information.

Arguments:

Arg1: 00000090, A driver switched stacks. The current stack is neither
a thread

stack nor a DPC stack. Typically the driver doing this should be

on the stack obtained from `kb' command.

Arg2: ffdff120

Arg3: 00000000

Arg4: 00000000

Debugging Details:





BUGCHECK_STR: 0xc4_90

CUSTOMER_CRASH_COUNT: 2

DEFAULT_BUCKET_ID: DRIVER_FAULT

LAST_CONTROL_TRANSFER: from e295e33a to ef519af4

TRAP_FRAME: fbeccbe8 -- (.trap fffffffffbeccbe8)

ErrCode = 00000000

eaxá09a088 ebx000000 ecxá272260 edxâ95e008 esiá24007f
edi00007f

eip=ef519af4 esp=fbeccc5c ebp000000 iopl=0 nv up ei pl nz na pe nc

cs08 ss10 ds23 es23 fs30 gs00 efl010202

SAVRT+0x33af4:

ef519af4 ?? ???

Resetting default scope

STACK_TEXT:

WARNING: Stack unwind information not available. Following frames may
be wrong.

fbeccc58 e295e33a fbecccb0 e295e008 ef525392 SAVRT+0x33af4

00010202 00000000 00000000 00000000 00000000 0xe295e33a



FOLLOWUP_IP:

SAVRT+33af4

ef519af4 ?? ???

SYMBOL_STACK_INDEX: 0

FOLLOWUP_NAME: MachineOwner

SYMBOL_NAME: SAVRT+33af4

MODULE_NAME: SAVRT

IMAGE_NAME: SAVRT.SYS

DEBUG_FLR_IMAGE_TIMESTAMP: 41ba0a1f

STACK_COMMAND: .trap fffffffffbeccbe8 ; kb

FAILURE_BUCKET_ID: 0xc4_90_SAVRT+33af4

BUCKET_ID: 0xc4_90_SAVRT+33af4

Followup: MachineOwner



Francisco.

¿Cual me recomiendas?. Por cierto... ¿puedo reclamarle a Norton el precio
del programa que pagué religiosamente? (bueno ya hace unos meses).
Gracias.
Francisco.


"fermu" escribió en el mensaje
news:

Hash: SHA1

FJTL wrote:

Pues eso, que otro error. Supongo que está claro que es el Norton... ¿o
no?.

Ya te deciamos desde el principio que desinstalases norton... instalate
cualquier otro antivirus... saldrás ganando. ;-)

Saludos
Fernando M. / Registered Linux User #367696
Fermu's Website - http://www.fermu.com

Y esta vez no es el Norton (ya está desinstalado y reiniciado).

Loading User Symbols

*******************************************************************************

* *

* Bugcheck Analysis *

* *

*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1000008E, {c0000005, 0, f83de848, 0}

Probably caused by : Npfs.SYS ( Npfs!NpCommonCreateNamedPipe+1c1 )

Followup: MachineOwner



kd> !analyze -v

*******************************************************************************

* *

* Bugcheck Analysis *

* *

*******************************************************************************

KERNEL_MODE_EXCEPTION_NOT_HANDLED_M (1000008e)

This is a very common bugcheck. Usually the exception address pinpoints

the driver/function that caused the problem. Always note this address

as well as the link date of the driver/image that contains this address.

Some common problems are exception code 0x80000003. This means a hard

coded breakpoint or assertion was hit, but this system was booted

/NODEBUG. This is not supposed to happen as developers should never have

hardcoded breakpoints in retail code, but ...

If this happens, make sure a debugger gets connected, and the

system is booted /DEBUG. This will let us see why this breakpoint is

happening.

Arguments:

Arg1: c0000005, The exception code that was not handled

Arg2: 00000000, The address that the exception occurred at

Arg3: f83de848, Trap Frame

Arg4: 00000000

Debugging Details:





EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - La instrucci n en "0x%08lx" hace
referencia a la memoria en "0x%08lx". La memoria no se puede "%s".

FAULTING_IP:

+0

00000000 ?? ???

TRAP_FRAME: f83de848 -- (.trap fffffffff83de848)

ErrCode = 00000000

eaxÀ00009a ebx000044 ecx960002 edx950001 esi000008
edi€4e6b9c

eip000000 espø3de8bc ebpc46704e iopl=0 nv up ei pl zr na po cy

cs08 ss10 ds23 es23 fs30 gs00 efl010247

00000000 ?? ???

Resetting default scope

CUSTOMER_CRASH_COUNT: 5

DEFAULT_BUCKET_ID: COMMON_SYSTEM_FAULT

BUGCHECK_STR: 0x8E

LAST_CONTROL_TRANSFER: from 00000000 to 00000000

SYMBOL_ON_RAW_STACK: 1

STACK_TEXT:

f83de8b8 00000000 00000800 00000800 f83de904 0x0



STACK_COMMAND: .trap fffffffff83de848; dds @$csp ; kb

FOLLOWUP_IP:

Npfs!NpCommonCreateNamedPipe+1c1

f87f8beb ebb0 jmp Npfs!NpCommonCreateNamedPipe+0x173 (f87f8b9d)

FOLLOWUP_NAME: MachineOwner

SYMBOL_NAME: Npfs!NpCommonCreateNamedPipe+1c1

MODULE_NAME: Npfs

IMAGE_NAME: Npfs.SYS

DEBUG_FLR_IMAGE_TIMESTAMP: 41107b86

FAILURE_BUCKET_ID: 0x8E_Npfs!NpCommonCreateNamedPipe+1c1

BUCKET_ID: 0x8E_Npfs!NpCommonCreateNamedPipe+1c1

Followup: MachineOwner



¿¿¿¿????

¿Se me ha cascado el ordenador?. ¿Algún programa de diagnósticos?.

Francisco.




"FJTL" escribió en el mensaje
news:

Pues eso, que otro error. Supongo que está claro que es el Norton... ¿o
no?.

Loading User Symbols

*******************************************************************************

* *

* Bugcheck Analysis *

* *

*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck C4, {90, ffdff120, 0, 0}

Unable to load image SAVRT.SYS, Win32 error 2

*** WARNING: Unable to verify timestamp for SAVRT.SYS

*** ERROR: Module load completed but symbols could not be loaded for
SAVRT.SYS

Probably caused by : SAVRT.SYS ( SAVRT+33af4 )

Followup: MachineOwner



kd> !analyze -v

*******************************************************************************

* *

* Bugcheck Analysis *

* *

*******************************************************************************

DRIVER_VERIFIER_DETECTED_VIOLATION (c4)

A device driver attempting to corrupt the system has been caught. This is

because the driver was specified in the registry as being suspect (by the

administrator) and the kernel has enabled substantial checking of this
driver.

If the driver attempts to corrupt the system, bugchecks 0xC4, 0xC1 and 0xA
will

be among the most commonly seen crashes.

Parameter 1 = 0x1000 .. 0x1020 - deadlock verifier error codes.

Typically the code is 0x1001 (deadlock detected) and you can

issue a '!deadlock' KD command to get more information.

Arguments:

Arg1: 00000090, A driver switched stacks. The current stack is neither a
thread

stack nor a DPC stack. Typically the driver doing this should be

on the stack obtained from `kb' command.

Arg2: ffdff120

Arg3: 00000000

Arg4: 00000000

Debugging Details:





BUGCHECK_STR: 0xc4_90

CUSTOMER_CRASH_COUNT: 2

DEFAULT_BUCKET_ID: DRIVER_FAULT

LAST_CONTROL_TRANSFER: from e295e33a to ef519af4

TRAP_FRAME: fbeccbe8 -- (.trap fffffffffbeccbe8)

ErrCode = 00000000

eaxá09a088 ebx000000 ecxá272260 edxâ95e008 esiá24007f
edi00007f

eip=ef519af4 esp=fbeccc5c ebp000000 iopl=0 nv up ei pl nz na pe nc

cs08 ss10 ds23 es23 fs30 gs00 efl010202

SAVRT+0x33af4:

ef519af4 ?? ???

Resetting default scope

STACK_TEXT:

WARNING: Stack unwind information not available. Following frames may be
wrong.

fbeccc58 e295e33a fbecccb0 e295e008 ef525392 SAVRT+0x33af4

00010202 00000000 00000000 00000000 00000000 0xe295e33a



FOLLOWUP_IP:

SAVRT+33af4

ef519af4 ?? ???

SYMBOL_STACK_INDEX: 0

FOLLOWUP_NAME: MachineOwner

SYMBOL_NAME: SAVRT+33af4

MODULE_NAME: SAVRT

IMAGE_NAME: SAVRT.SYS

DEBUG_FLR_IMAGE_TIMESTAMP: 41ba0a1f

STACK_COMMAND: .trap fffffffffbeccbe8 ; kb

FAILURE_BUCKET_ID: 0xc4_90_SAVRT+33af4

BUCKET_ID: 0xc4_90_SAVRT+33af4

Followup: MachineOwner



Francisco.

Npfs.SYS
Algo relacionado con la red es como si hay restos en el stack IP de
algun componente que intenta (por ejemplo) actualizarte el software desde
remoto...

netstat -bv

(en una consola de comandos) puede que te de informacion...

Jose Manuel Tella Llop
MVP - Windows
(quitar XXX)
http://www.multingles.net/jmt.htm

Este mensaje se proporciona "como está" sin garantías de ninguna clase,
y no otorga ningún derecho.

This posting is provided "AS IS" with no warranties, and confers no
rights.
You assume all risk for your use.



"FJTL" wrote in message
news:%

Y esta vez no es el Norton (ya está desinstalado y reiniciado).

Loading User Symbols

*******************************************************************************

* *

* Bugcheck Analysis *

* *

*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1000008E, {c0000005, 0, f83de848, 0}

Probably caused by : Npfs.SYS ( Npfs!NpCommonCreateNamedPipe+1c1 )

Followup: MachineOwner



kd> !analyze -v

*******************************************************************************

* *

* Bugcheck Analysis *

* *

*******************************************************************************

KERNEL_MODE_EXCEPTION_NOT_HANDLED_M (1000008e)

This is a very common bugcheck. Usually the exception address pinpoints

the driver/function that caused the problem. Always note this address

as well as the link date of the driver/image that contains this address.

Some common problems are exception code 0x80000003. This means a hard

coded breakpoint or assertion was hit, but this system was booted

/NODEBUG. This is not supposed to happen as developers should never have

hardcoded breakpoints in retail code, but ...

If this happens, make sure a debugger gets connected, and the

system is booted /DEBUG. This will let us see why this breakpoint is

happening.

Arguments:

Arg1: c0000005, The exception code that was not handled

Arg2: 00000000, The address that the exception occurred at

Arg3: f83de848, Trap Frame

Arg4: 00000000

Debugging Details:





EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - La instrucci n en "0x%08lx" hace
referencia a la memoria en "0x%08lx". La memoria no se puede "%s".

FAULTING_IP:

+0

00000000 ?? ???

TRAP_FRAME: f83de848 -- (.trap fffffffff83de848)

ErrCode = 00000000

eaxÀ00009a ebx000044 ecx960002 edx950001 esi000008
edi€4e6b9c

eip000000 espø3de8bc ebpc46704e iopl=0 nv up ei pl zr na po cy

cs08 ss10 ds23 es23 fs30 gs00 efl010247

00000000 ?? ???

Resetting default scope

CUSTOMER_CRASH_COUNT: 5

DEFAULT_BUCKET_ID: COMMON_SYSTEM_FAULT

BUGCHECK_STR: 0x8E

LAST_CONTROL_TRANSFER: from 00000000 to 00000000

SYMBOL_ON_RAW_STACK: 1

STACK_TEXT:

f83de8b8 00000000 00000800 00000800 f83de904 0x0



STACK_COMMAND: .trap fffffffff83de848; dds @$csp ; kb

FOLLOWUP_IP:

Npfs!NpCommonCreateNamedPipe+1c1

f87f8beb ebb0 jmp Npfs!NpCommonCreateNamedPipe+0x173 (f87f8b9d)

FOLLOWUP_NAME: MachineOwner

SYMBOL_NAME: Npfs!NpCommonCreateNamedPipe+1c1

MODULE_NAME: Npfs

IMAGE_NAME: Npfs.SYS

DEBUG_FLR_IMAGE_TIMESTAMP: 41107b86

FAILURE_BUCKET_ID: 0x8E_Npfs!NpCommonCreateNamedPipe+1c1

BUCKET_ID: 0x8E_Npfs!NpCommonCreateNamedPipe+1c1

Followup: MachineOwner



¿¿¿¿????

¿Se me ha cascado el ordenador?. ¿Algún programa de diagnósticos?.

Francisco.




"FJTL" escribió en el mensaje
news:

Pues eso, que otro error. Supongo que está claro que es el Norton... ¿o
no?.

Loading User Symbols

*******************************************************************************

* *

* Bugcheck Analysis *

* *

*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck C4, {90, ffdff120, 0, 0}

Unable to load image SAVRT.SYS, Win32 error 2

*** WARNING: Unable to verify timestamp for SAVRT.SYS

*** ERROR: Module load completed but symbols could not be loaded for
SAVRT.SYS

Probably caused by : SAVRT.SYS ( SAVRT+33af4 )

Followup: MachineOwner



kd> !analyze -v

*******************************************************************************

* *

* Bugcheck Analysis *

* *

*******************************************************************************

DRIVER_VERIFIER_DETECTED_VIOLATION (c4)

A device driver attempting to corrupt the system has been caught. This is

because the driver was specified in the registry as being suspect (by the

administrator) and the kernel has enabled substantial checking of this
driver.

If the driver attempts to corrupt the system, bugchecks 0xC4, 0xC1 and
0xA will

be among the most commonly seen crashes.

Parameter 1 = 0x1000 .. 0x1020 - deadlock verifier error codes.

Typically the code is 0x1001 (deadlock detected) and you can

issue a '!deadlock' KD command to get more information.

Arguments:

Arg1: 00000090, A driver switched stacks. The current stack is neither a
thread

stack nor a DPC stack. Typically the driver doing this should be

on the stack obtained from `kb' command.

Arg2: ffdff120

Arg3: 00000000

Arg4: 00000000

Debugging Details:





BUGCHECK_STR: 0xc4_90

CUSTOMER_CRASH_COUNT: 2

DEFAULT_BUCKET_ID: DRIVER_FAULT

LAST_CONTROL_TRANSFER: from e295e33a to ef519af4

TRAP_FRAME: fbeccbe8 -- (.trap fffffffffbeccbe8)

ErrCode = 00000000

eaxá09a088 ebx000000 ecxá272260 edxâ95e008 esiá24007f
edi00007f

eip=ef519af4 esp=fbeccc5c ebp000000 iopl=0 nv up ei pl nz na pe nc

cs08 ss10 ds23 es23 fs30 gs00 efl010202

SAVRT+0x33af4:

ef519af4 ?? ???

Resetting default scope

STACK_TEXT:

WARNING: Stack unwind information not available. Following frames may be
wrong.

fbeccc58 e295e33a fbecccb0 e295e008 ef525392 SAVRT+0x33af4

00010202 00000000 00000000 00000000 00000000 0xe295e33a



FOLLOWUP_IP:

SAVRT+33af4

ef519af4 ?? ???

SYMBOL_STACK_INDEX: 0

FOLLOWUP_NAME: MachineOwner

SYMBOL_NAME: SAVRT+33af4

MODULE_NAME: SAVRT

IMAGE_NAME: SAVRT.SYS

DEBUG_FLR_IMAGE_TIMESTAMP: 41ba0a1f

STACK_COMMAND: .trap fffffffffbeccbe8 ; kb

FAILURE_BUCKET_ID: 0xc4_90_SAVRT+33af4

BUCKET_ID: 0xc4_90_SAVRT+33af4

Followup: MachineOwner



Francisco.

El netstat dice:

Microsoft Windows XP [Versión 5.1.2600]
(C) Copyright 1985-2001 Microsoft Corp.

C:\Documents and Settings\Francisco>netstat -bv

Conexiones activas

Proto Dirección local Dirección remota Estado
PID
TCP fran:1033 localhost:1052 ESTABLISHED 1048

¿¿¿???
Francisco.

"JM Tella Llop [MVP Windows]" escribió en el mensaje
news:

Npfs.SYS
Algo relacionado con la red es como si hay restos en el stack IP de
algun componente que intenta (por ejemplo) actualizarte el software desde
remoto...

netstat -bv

(en una consola de comandos) puede que te de informacion...

Jose Manuel Tella Llop
MVP - Windows
(quitar XXX)
http://www.multingles.net/jmt.htm

Este mensaje se proporciona "como está" sin garantías de ninguna clase,
y no otorga ningún derecho.

This posting is provided "AS IS" with no warranties, and confers no
rights.
You assume all risk for your use.



"FJTL" wrote in message
news:%

Y esta vez no es el Norton (ya está desinstalado y reiniciado).

Loading User Symbols

*******************************************************************************

* *

* Bugcheck Analysis *

* *

*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1000008E, {c0000005, 0, f83de848, 0}

Probably caused by : Npfs.SYS ( Npfs!NpCommonCreateNamedPipe+1c1 )

Followup: MachineOwner



kd> !analyze -v

*******************************************************************************

* *

* Bugcheck Analysis *

* *

*******************************************************************************

KERNEL_MODE_EXCEPTION_NOT_HANDLED_M (1000008e)

This is a very common bugcheck. Usually the exception address pinpoints

the driver/function that caused the problem. Always note this address

as well as the link date of the driver/image that contains this address.

Some common problems are exception code 0x80000003. This means a hard

coded breakpoint or assertion was hit, but this system was booted

/NODEBUG. This is not supposed to happen as developers should never have

hardcoded breakpoints in retail code, but ...

If this happens, make sure a debugger gets connected, and the

system is booted /DEBUG. This will let us see why this breakpoint is

happening.

Arguments:

Arg1: c0000005, The exception code that was not handled

Arg2: 00000000, The address that the exception occurred at

Arg3: f83de848, Trap Frame

Arg4: 00000000

Debugging Details:





EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - La instrucci n en "0x%08lx" hace
referencia a la memoria en "0x%08lx". La memoria no se puede "%s".

FAULTING_IP:

+0

00000000 ?? ???

TRAP_FRAME: f83de848 -- (.trap fffffffff83de848)

ErrCode = 00000000

eaxÀ00009a ebx000044 ecx960002 edx950001 esi000008
edi€4e6b9c

eip000000 espø3de8bc ebpc46704e iopl=0 nv up ei pl zr na po cy

cs08 ss10 ds23 es23 fs30 gs00 efl010247

00000000 ?? ???

Resetting default scope

CUSTOMER_CRASH_COUNT: 5

DEFAULT_BUCKET_ID: COMMON_SYSTEM_FAULT

BUGCHECK_STR: 0x8E

LAST_CONTROL_TRANSFER: from 00000000 to 00000000

SYMBOL_ON_RAW_STACK: 1

STACK_TEXT:

f83de8b8 00000000 00000800 00000800 f83de904 0x0



STACK_COMMAND: .trap fffffffff83de848; dds @$csp ; kb

FOLLOWUP_IP:

Npfs!NpCommonCreateNamedPipe+1c1

f87f8beb ebb0 jmp Npfs!NpCommonCreateNamedPipe+0x173 (f87f8b9d)

FOLLOWUP_NAME: MachineOwner

SYMBOL_NAME: Npfs!NpCommonCreateNamedPipe+1c1

MODULE_NAME: Npfs

IMAGE_NAME: Npfs.SYS

DEBUG_FLR_IMAGE_TIMESTAMP: 41107b86

FAILURE_BUCKET_ID: 0x8E_Npfs!NpCommonCreateNamedPipe+1c1

BUCKET_ID: 0x8E_Npfs!NpCommonCreateNamedPipe+1c1

Followup: MachineOwner



¿¿¿¿????

¿Se me ha cascado el ordenador?. ¿Algún programa de diagnósticos?.

Francisco.




"FJTL" escribió en el mensaje
news:

Pues eso, que otro error. Supongo que está claro que es el Norton... ¿o
no?.

Loading User Symbols

*******************************************************************************

* *

* Bugcheck Analysis *

* *

*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck C4, {90, ffdff120, 0, 0}

Unable to load image SAVRT.SYS, Win32 error 2

*** WARNING: Unable to verify timestamp for SAVRT.SYS

*** ERROR: Module load completed but symbols could not be loaded for
SAVRT.SYS

Probably caused by : SAVRT.SYS ( SAVRT+33af4 )

Followup: MachineOwner



kd> !analyze -v

*******************************************************************************

* *

* Bugcheck Analysis *

* *

*******************************************************************************

DRIVER_VERIFIER_DETECTED_VIOLATION (c4)

A device driver attempting to corrupt the system has been caught. This
is

because the driver was specified in the registry as being suspect (by
the

administrator) and the kernel has enabled substantial checking of this
driver.

If the driver attempts to corrupt the system, bugchecks 0xC4, 0xC1 and
0xA will

be among the most commonly seen crashes.

Parameter 1 = 0x1000 .. 0x1020 - deadlock verifier error codes.

Typically the code is 0x1001 (deadlock detected) and you can

issue a '!deadlock' KD command to get more information.

Arguments:

Arg1: 00000090, A driver switched stacks. The current stack is neither a
thread

stack nor a DPC stack. Typically the driver doing this should be

on the stack obtained from `kb' command.

Arg2: ffdff120

Arg3: 00000000

Arg4: 00000000

Debugging Details:





BUGCHECK_STR: 0xc4_90

CUSTOMER_CRASH_COUNT: 2

DEFAULT_BUCKET_ID: DRIVER_FAULT

LAST_CONTROL_TRANSFER: from e295e33a to ef519af4

TRAP_FRAME: fbeccbe8 -- (.trap fffffffffbeccbe8)

ErrCode = 00000000

eaxá09a088 ebx000000 ecxá272260 edxâ95e008 esiá24007f
edi00007f

eip=ef519af4 esp=fbeccc5c ebp000000 iopl=0 nv up ei pl nz na pe nc

cs08 ss10 ds23 es23 fs30 gs00 efl010202

SAVRT+0x33af4:

ef519af4 ?? ???

Resetting default scope

STACK_TEXT:

WARNING: Stack unwind information not available. Following frames may be
wrong.

fbeccc58 e295e33a fbecccb0 e295e008 ef525392 SAVRT+0x33af4

00010202 00000000 00000000 00000000 00000000 0xe295e33a



FOLLOWUP_IP:

SAVRT+33af4

ef519af4 ?? ???

SYMBOL_STACK_INDEX: 0

FOLLOWUP_NAME: MachineOwner

SYMBOL_NAME: SAVRT+33af4

MODULE_NAME: SAVRT

IMAGE_NAME: SAVRT.SYS

DEBUG_FLR_IMAGE_TIMESTAMP: 41ba0a1f

STACK_COMMAND: .trap fffffffffbeccbe8 ; kb

FAILURE_BUCKET_ID: 0xc4_90_SAVRT+33af4

BUCKET_ID: 0xc4_90_SAVRT+33af4

Followup: MachineOwner



Francisco.