[Para JM. Tella Llop] Ayuda analisis archivo DMP

Lo que te ha comentado Alezito. esl "casque" está realmente claro:
zd1201u.sys

Jose Manuel Tella Llop
MVP - Windows
(quitar XXX)
http://www.multingles.net/jmt.htm

Este mensaje se proporciona "como está" sin garantías de ninguna clase,
y no otorga ningún derecho.

This posting is provided "AS IS" with no warranties, and confers no
rights.
You assume all risk for your use.



"Shin-Shan" wrote in message
news:khKGe.2542612$
> Hola:
>
> Leido tu interesante artículo "BSOD - PANTALLA AZUL - CÓMO ANALIZAR EL
> ERROR",
> y siguiendolo paso a paso, he llegado a completar el analisis del archivo
> DMP, pero
> soy incapaz de descifrar el resultado. Te agradeceria mucho si me puedes
> echar una mano.
>
> Copio y pego aquí el resultado del analisis:
>
> Microsoft (R) Windows Debugger Version 6.5.0003.7
> Copyright (c) Microsoft Corporation. All rights reserved.
>
>
> Loading Dump File [C:\WINDOWS\MEMORY.DMP]
> Kernel Summary Dump File: Only kernel address space is available
>
> Symbol search path is:
> SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols
> Executable search path is:
> Windows XP Kernel Version 2600 (Service Pack 2) UP Free x86 compatible
> Product: WinNt, suite: TerminalServer SingleUserTS
> Built by: 2600.xpsp_sp2_rtm.040803-2158
> Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055ab20
> Debug session time: Sat Jul 16 02:03:49.390 2005 (GMT+2)
> System Uptime: 0 days 8:24:04.963
> Loading Kernel Symbols
>
>
> Loading unloaded module list
> ..
> Loading User Symbols
> ****************************************************************************
> ***
> *
> *
> * Bugcheck Analysis
> *
> *
> *
> ****************************************************************************
> ***
>
> Use !analyze -v to get detailed debugging information.
>
> BugCheck A, {4, 2, 1, 804ee2fe}
>
> *** ERROR: Module load completed but symbols could not be loaded for
> zd1201u.sys
> *** WARNING: Unable to verify timestamp for nv4_disp.dll
> *** ERROR: Module load completed but symbols could not be loaded for
> ZDNDIS5.SYS
> *** ERROR: Module load completed but symbols could not be loaded for
> klif.sys
> *** ERROR: Module load completed but symbols could not be loaded for
> vsdatant.sys
> *** ERROR: Module load completed but symbols could not be loaded for
> DCxxMJPG.sys
> *** ERROR: Module load completed but symbols could not be loaded for
> pfc.sys
> *** ERROR: Module load completed but symbols could not be loaded for
> snapman.sys
> *** ERROR: Module load completed but symbols could not be loaded for
> timntr.sys
> *** ERROR: Module load completed but symbols could not be loaded for
> a347bus.sys
> *** ERROR: Symbol file could not be found. Defaulted to export symbols
> for
> drmk.sys -
> *** ERROR: Module load completed but symbols could not be loaded for
> PxHelp20.sys
> *** WARNING: Unable to verify timestamp for fdc.sys
> *** ERROR: Module load completed but symbols could not be loaded for
> fdc.sys
> *** ERROR: Module load completed but symbols could not be loaded for
> ASAPIW2k.sys
> *** ERROR: Module load completed but symbols could not be loaded for
> tifsfilt.sys
> *** ERROR: Module load completed but symbols could not be loaded for
> klmc.sys
> *** ERROR: Module load completed but symbols could not be loaded for
> a347scsi.sys
> Probably caused by : zd1201u.sys ( zd1201u+6eb3 )
>
> Followup: MachineOwner
>
>
> kd> !analyze -v
> ****************************************************************************
> ***
> *
> *
> * Bugcheck Analysis
> *
> *
> *
> ****************************************************************************
> ***
>
> IRQL_NOT_LESS_OR_EQUAL (a)
> An attempt was made to access a pageable (or completely invalid) address
> at
> an
> interrupt request level (IRQL) that is too high. This is usually
> caused by drivers using improper addresses.
> If a kernel debugger is available get the stack backtrace.
> Arguments:
> Arg1: 00000004, memory referenced
> Arg2: 00000002, IRQL
> Arg3: 00000001, value 0 = read operation, 1 = write operation
> Arg4: 804ee2fe, address which referenced memory
>
> Debugging Details:
>
>
>
> WRITE_ADDRESS: 00000004
>
> CURRENT_IRQL: 2
>
> FAULTING_IP:
> nt!KiActivateWaiterQueue+27
> 804ee2fe 897004 mov [eax+0x4],esi
>
> DEFAULT_BUCKET_ID: DRIVER_FAULT
>
> BUGCHECK_STR: 0xA
>
> LAST_CONTROL_TRANSFER: from 804e8f17 to 804ee2fe
>
> TRAP_FRAME: f8961c30 -- (.trap fffffffff8961c30)
> ErrCode = 00000002
> eax000000 ebxø961cf8 ecx€561b40 edxc7e67c esi€561b50
> edifc76b0
> eip€4ee2fe espø961ca4 ebpø961cd0 iopl=0 nv up ei pl nz ac pe
> nc
> cs08 ss10 ds23 es23 fs30 gs00
> efl010212
> nt!KiActivateWaiterQueue+0x27:
> 804ee2fe 897004 mov [eax+0x4],esi
> ds:0023:00000004=????????
> Resetting default scope
>
> STACK_TEXT:
> f8961ca8 804e8f17 804dc750 81c7e248 00000000 nt!KiActivateWaiterQueue+0x27
> f8961cd0 f877ceb3 00000000 00000000 00000000
> nt!KeWaitForSingleObject+0x19a
> WARNING: Stack unwind information not available. Following frames may be
> wrong.
> f8961d20 f877cf6d 81881000 81564008 0000f100 zd1201u+0x6eb3
> f8961d44 f877ddd5 81881000 00000011 00000001 zd1201u+0x6f6d
> f8961d64 f833dbfe 81c7e674 81881000 f8961dac zd1201u+0x7dd5
> f8961d74 804e47fe 81c7e674 00000000 81fc7b30 NDIS!ndisWorkItemHandler+0xe
> f8961dac 8057dfed 81c7e674 00000000 00000000 nt!ExpWorkerThread+0x100
> f8961ddc 804fa477 804e4729 00000000 00000000
> nt!PspSystemThreadStartup+0x34
> 00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16
>
>
> FOLLOWUP_IP:
> zd1201u+6eb3
> f877ceb3 3d02010000 cmp eax,0x102
>
> SYMBOL_STACK_INDEX: 2
>
> FOLLOWUP_NAME: MachineOwner
>
> SYMBOL_NAME: zd1201u+6eb3
>
> MODULE_NAME: zd1201u
>
> IMAGE_NAME: zd1201u.sys
>
> DEBUG_FLR_IMAGE_TIMESTAMP: 404d3b5b
>
> STACK_COMMAND: .trap fffffffff8961c30 ; kb
>
> FAILURE_BUCKET_ID: 0xA_W_p3_8_4_2004_zd1201u+6eb3
>
> BUCKET_ID: 0xA_W_p3_8_4_2004_zd1201u+6eb3
>
> Followup: MachineOwner
>
>
>

Tengo el mismo problema.
El último driver está certificado por Microsoft pero ahora casca. Esto me
ocurre desde una de las últimas actualizaciones desde Microsoft :)
Mi driver es la version 1.99.309.2004

¿Solución?

"JM Tella Llop [MVP Windows]" escribió:

Lo que te ha comentado Alezito. esl "casque" está realmente claro:
zd1201u.sys

Jose Manuel Tella Llop
MVP - Windows
(quitar XXX)
http://www.multingles.net/jmt.htm

Este mensaje se proporciona "como está" sin garantías de ninguna clase,
y no otorga ningún derecho.

This posting is provided "AS IS" with no warranties, and confers no
rights.
You assume all risk for your use.



"Shin-Shan" wrote in message
news:khKGe.2542612$
> Hola:
>
> Leido tu interesante artículo "BSOD - PANTALLA AZUL - CÓMO ANALIZAR EL
> ERROR",
> y siguiendolo paso a paso, he llegado a completar el analisis del
> archivo
> DMP, pero
> soy incapaz de descifrar el resultado. Te agradeceria mucho si me
> puedes
> echar una mano.
>
> Copio y pego aquí el resultado del analisis:
>
> Microsoft (R) Windows Debugger Version 6.5.0003.7
> Copyright (c) Microsoft Corporation. All rights reserved.
>
>
> Loading Dump File [C:\WINDOWS\MEMORY.DMP]
> Kernel Summary Dump File: Only kernel address space is available
>
> Symbol search path is:
> SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols
> Executable search path is:
> Windows XP Kernel Version 2600 (Service Pack 2) UP Free x86 compatible
> Product: WinNt, suite: TerminalServer SingleUserTS
> Built by: 2600.xpsp_sp2_rtm.040803-2158
> Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055ab20
> Debug session time: Sat Jul 16 02:03:49.390 2005 (GMT+2)
> System Uptime: 0 days 8:24:04.963
> Loading Kernel Symbols
>
>
> Loading unloaded module list
> ..
> Loading User Symbols
> ****************************************************************************
> ***
> *
> *
> * Bugcheck Analysis
> *
> *
> *
> ****************************************************************************
> ***
>
> Use !analyze -v to get detailed debugging information.
>
> BugCheck A, {4, 2, 1, 804ee2fe}
>
> *** ERROR: Module load completed but symbols could not be loaded for
> zd1201u.sys
> *** WARNING: Unable to verify timestamp for nv4_disp.dll
> *** ERROR: Module load completed but symbols could not be loaded for
> ZDNDIS5.SYS
> *** ERROR: Module load completed but symbols could not be loaded for
> klif.sys
> *** ERROR: Module load completed but symbols could not be loaded for
> vsdatant.sys
> *** ERROR: Module load completed but symbols could not be loaded for
> DCxxMJPG.sys
> *** ERROR: Module load completed but symbols could not be loaded for
> pfc.sys
> *** ERROR: Module load completed but symbols could not be loaded for
> snapman.sys
> *** ERROR: Module load completed but symbols could not be loaded for
> timntr.sys
> *** ERROR: Module load completed but symbols could not be loaded for
> a347bus.sys
> *** ERROR: Symbol file could not be found. Defaulted to export symbols
> for
> drmk.sys -
> *** ERROR: Module load completed but symbols could not be loaded for
> PxHelp20.sys
> *** WARNING: Unable to verify timestamp for fdc.sys
> *** ERROR: Module load completed but symbols could not be loaded for
> fdc.sys
> *** ERROR: Module load completed but symbols could not be loaded for
> ASAPIW2k.sys
> *** ERROR: Module load completed but symbols could not be loaded for
> tifsfilt.sys
> *** ERROR: Module load completed but symbols could not be loaded for
> klmc.sys
> *** ERROR: Module load completed but symbols could not be loaded for
> a347scsi.sys
> Probably caused by : zd1201u.sys ( zd1201u+6eb3 )
>
> Followup: MachineOwner
>
>
> kd> !analyze -v
> ****************************************************************************
> ***
> *
> *
> * Bugcheck Analysis
> *
> *
> *
> ****************************************************************************
> ***
>
> IRQL_NOT_LESS_OR_EQUAL (a)
> An attempt was made to access a pageable (or completely invalid)
> address
> at
> an
> interrupt request level (IRQL) that is too high. This is usually
> caused by drivers using improper addresses.
> If a kernel debugger is available get the stack backtrace.
> Arguments:
> Arg1: 00000004, memory referenced
> Arg2: 00000002, IRQL
> Arg3: 00000001, value 0 = read operation, 1 = write operation
> Arg4: 804ee2fe, address which referenced memory
>
> Debugging Details:
>
>
>
> WRITE_ADDRESS: 00000004
>
> CURRENT_IRQL: 2
>
> FAULTING_IP:
> nt!KiActivateWaiterQueue+27
> 804ee2fe 897004 mov [eax+0x4],esi
>
> DEFAULT_BUCKET_ID: DRIVER_FAULT
>
> BUGCHECK_STR: 0xA
>
> LAST_CONTROL_TRANSFER: from 804e8f17 to 804ee2fe
>
> TRAP_FRAME: f8961c30 -- (.trap fffffffff8961c30)
> ErrCode = 00000002
> eax000000 ebxø961cf8 ecx€561b40 edxc7e67c esi€561b50
> edifc76b0
> eip€4ee2fe espø961ca4 ebpø961cd0 iopl=0 nv up ei pl nz ac
> pe
> nc
> cs08 ss10 ds23 es23 fs30 gs00
> efl010212
> nt!KiActivateWaiterQueue+0x27:
> 804ee2fe 897004 mov [eax+0x4],esi
> ds:0023:00000004=????????
> Resetting default scope
>
> STACK_TEXT:
> f8961ca8 804e8f17 804dc750 81c7e248 00000000
> nt!KiActivateWaiterQueue+0x27
> f8961cd0 f877ceb3 00000000 00000000 00000000
> nt!KeWaitForSingleObject+0x19a
> WARNING: Stack unwind information not available. Following frames may
> be
> wrong.
> f8961d20 f877cf6d 81881000 81564008 0000f100 zd1201u+0x6eb3
> f8961d44 f877ddd5 81881000 00000011 00000001 zd1201u+0x6f6d
> f8961d64 f833dbfe 81c7e674 81881000 f8961dac zd1201u+0x7dd5
> f8961d74 804e47fe 81c7e674 00000000 81fc7b30
> NDIS!ndisWorkItemHandler+0xe
> f8961dac 8057dfed 81c7e674 00000000 00000000 nt!ExpWorkerThread+0x100
> f8961ddc 804fa477 804e4729 00000000 00000000
> nt!PspSystemThreadStartup+0x34
> 00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16
>
>
> FOLLOWUP_IP:
> zd1201u+6eb3
> f877ceb3 3d02010000 cmp eax,0x102
>
> SYMBOL_STACK_INDEX: 2
>
> FOLLOWUP_NAME: MachineOwner
>
> SYMBOL_NAME: zd1201u+6eb3
>
> MODULE_NAME: zd1201u
>
> IMAGE_NAME: zd1201u.sys
>
> DEBUG_FLR_IMAGE_TIMESTAMP: 404d3b5b
>
> STACK_COMMAND: .trap fffffffff8961c30 ; kb
>
> FAILURE_BUCKET_ID: 0xA_W_p3_8_4_2004_zd1201u+6eb3
>
> BUCKET_ID: 0xA_W_p3_8_4_2004_zd1201u+6eb3
>
> Followup: MachineOwner
>
>
>

Los pantallazos azules solo son por dos motivos: o driver... o hardware.

Jose Manuel Tella Llop
MVP - Windows
(quitar XXX)
http://www.multingles.net/jmt.htm

Este mensaje se proporciona "como está" sin garantías de ninguna clase,
y no otorga ningún derecho.

This posting is provided "AS IS" with no warranties, and confers no
rights.
You assume all risk for your use.



"pinguino" wrote in message
news:

Tengo el mismo problema.
El último driver está certificado por Microsoft pero ahora casca. Esto me
ocurre desde una de las últimas actualizaciones desde Microsoft :)
Mi driver es la version 1.99.309.2004

¿Solución?

"JM Tella Llop [MVP Windows]" escribió:

Lo que te ha comentado Alezito. esl "casque" está realmente claro:
zd1201u.sys

Jose Manuel Tella Llop
MVP - Windows
(quitar XXX)
http://www.multingles.net/jmt.htm

Este mensaje se proporciona "como está" sin garantías de ninguna clase,
y no otorga ningún derecho.

This posting is provided "AS IS" with no warranties, and confers no
rights.
You assume all risk for your use.



"Shin-Shan" wrote in message
news:khKGe.2542612$
> Hola:
>
> Leido tu interesante artículo "BSOD - PANTALLA AZUL - CÓMO ANALIZAR EL
> ERROR",
> y siguiendolo paso a paso, he llegado a completar el analisis del
> archivo
> DMP, pero
> soy incapaz de descifrar el resultado. Te agradeceria mucho si me
> puedes
> echar una mano.
>
> Copio y pego aquí el resultado del analisis:
>
> Microsoft (R) Windows Debugger Version 6.5.0003.7
> Copyright (c) Microsoft Corporation. All rights reserved.
>
>
> Loading Dump File [C:\WINDOWS\MEMORY.DMP]
> Kernel Summary Dump File: Only kernel address space is available
>
> Symbol search path is:
> SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols
> Executable search path is:
> Windows XP Kernel Version 2600 (Service Pack 2) UP Free x86 compatible
> Product: WinNt, suite: TerminalServer SingleUserTS
> Built by: 2600.xpsp_sp2_rtm.040803-2158
> Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055ab20
> Debug session time: Sat Jul 16 02:03:49.390 2005 (GMT+2)
> System Uptime: 0 days 8:24:04.963
> Loading Kernel Symbols
>
>
> Loading unloaded module list
> ..
> Loading User Symbols
> ****************************************************************************
> ***
> *
> *
> * Bugcheck Analysis
> *
> *
> *
> ****************************************************************************
> ***
>
> Use !analyze -v to get detailed debugging information.
>
> BugCheck A, {4, 2, 1, 804ee2fe}
>
> *** ERROR: Module load completed but symbols could not be loaded for
> zd1201u.sys
> *** WARNING: Unable to verify timestamp for nv4_disp.dll
> *** ERROR: Module load completed but symbols could not be loaded for
> ZDNDIS5.SYS
> *** ERROR: Module load completed but symbols could not be loaded for
> klif.sys
> *** ERROR: Module load completed but symbols could not be loaded for
> vsdatant.sys
> *** ERROR: Module load completed but symbols could not be loaded for
> DCxxMJPG.sys
> *** ERROR: Module load completed but symbols could not be loaded for
> pfc.sys
> *** ERROR: Module load completed but symbols could not be loaded for
> snapman.sys
> *** ERROR: Module load completed but symbols could not be loaded for
> timntr.sys
> *** ERROR: Module load completed but symbols could not be loaded for
> a347bus.sys
> *** ERROR: Symbol file could not be found. Defaulted to export
> symbols
> for
> drmk.sys -
> *** ERROR: Module load completed but symbols could not be loaded for
> PxHelp20.sys
> *** WARNING: Unable to verify timestamp for fdc.sys
> *** ERROR: Module load completed but symbols could not be loaded for
> fdc.sys
> *** ERROR: Module load completed but symbols could not be loaded for
> ASAPIW2k.sys
> *** ERROR: Module load completed but symbols could not be loaded for
> tifsfilt.sys
> *** ERROR: Module load completed but symbols could not be loaded for
> klmc.sys
> *** ERROR: Module load completed but symbols could not be loaded for
> a347scsi.sys
> Probably caused by : zd1201u.sys ( zd1201u+6eb3 )
>
> Followup: MachineOwner
>
>
> kd> !analyze -v
> ****************************************************************************
> ***
> *
> *
> * Bugcheck Analysis
> *
> *
> *
> ****************************************************************************
> ***
>
> IRQL_NOT_LESS_OR_EQUAL (a)
> An attempt was made to access a pageable (or completely invalid)
> address
> at
> an
> interrupt request level (IRQL) that is too high. This is usually
> caused by drivers using improper addresses.
> If a kernel debugger is available get the stack backtrace.
> Arguments:
> Arg1: 00000004, memory referenced
> Arg2: 00000002, IRQL
> Arg3: 00000001, value 0 = read operation, 1 = write operation
> Arg4: 804ee2fe, address which referenced memory
>
> Debugging Details:
>
>
>
> WRITE_ADDRESS: 00000004
>
> CURRENT_IRQL: 2
>
> FAULTING_IP:
> nt!KiActivateWaiterQueue+27
> 804ee2fe 897004 mov [eax+0x4],esi
>
> DEFAULT_BUCKET_ID: DRIVER_FAULT
>
> BUGCHECK_STR: 0xA
>
> LAST_CONTROL_TRANSFER: from 804e8f17 to 804ee2fe
>
> TRAP_FRAME: f8961c30 -- (.trap fffffffff8961c30)
> ErrCode = 00000002
> eax000000 ebxø961cf8 ecx€561b40 edxc7e67c esi€561b50
> edifc76b0
> eip€4ee2fe espø961ca4 ebpø961cd0 iopl=0 nv up ei pl nz
> ac pe
> nc
> cs08 ss10 ds23 es23 fs30 gs00
> efl010212
> nt!KiActivateWaiterQueue+0x27:
> 804ee2fe 897004 mov [eax+0x4],esi
> ds:0023:00000004=????????
> Resetting default scope
>
> STACK_TEXT:
> f8961ca8 804e8f17 804dc750 81c7e248 00000000
> nt!KiActivateWaiterQueue+0x27
> f8961cd0 f877ceb3 00000000 00000000 00000000
> nt!KeWaitForSingleObject+0x19a
> WARNING: Stack unwind information not available. Following frames may
> be
> wrong.
> f8961d20 f877cf6d 81881000 81564008 0000f100 zd1201u+0x6eb3
> f8961d44 f877ddd5 81881000 00000011 00000001 zd1201u+0x6f6d
> f8961d64 f833dbfe 81c7e674 81881000 f8961dac zd1201u+0x7dd5
> f8961d74 804e47fe 81c7e674 00000000 81fc7b30
> NDIS!ndisWorkItemHandler+0xe
> f8961dac 8057dfed 81c7e674 00000000 00000000 nt!ExpWorkerThread+0x100
> f8961ddc 804fa477 804e4729 00000000 00000000
> nt!PspSystemThreadStartup+0x34
> 00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16
>
>
> FOLLOWUP_IP:
> zd1201u+6eb3
> f877ceb3 3d02010000 cmp eax,0x102
>
> SYMBOL_STACK_INDEX: 2
>
> FOLLOWUP_NAME: MachineOwner
>
> SYMBOL_NAME: zd1201u+6eb3
>
> MODULE_NAME: zd1201u
>
> IMAGE_NAME: zd1201u.sys
>
> DEBUG_FLR_IMAGE_TIMESTAMP: 404d3b5b
>
> STACK_COMMAND: .trap fffffffff8961c30 ; kb
>
> FAILURE_BUCKET_ID: 0xA_W_p3_8_4_2004_zd1201u+6eb3
>
> BUCKET_ID: 0xA_W_p3_8_4_2004_zd1201u+6eb3
>
> Followup: MachineOwner
>
>
>

Perdona que te haga una corrección. El antivirus también puede darte
pantallazos azules (yo los he sufrido con Mcafee hasta que sacaron el
patch 11 de la versión 8i.

Saludos:

"JM Tella Llop [MVP Windows]" escribió en el mensaje
news:OzHf%

Los pantallazos azules solo son por dos motivos: o driver... o hardware.

Jose Manuel Tella Llop
MVP - Windows
(quitar XXX)
http://www.multingles.net/jmt.htm

Este mensaje se proporciona "como está" sin garantías de ninguna clase,
y no otorga ningún derecho.

This posting is provided "AS IS" with no warranties, and confers no
rights.
You assume all risk for your use.



"pinguino" wrote in message
news:

Tengo el mismo problema.
El último driver está certificado por Microsoft pero ahora casca. Esto
me
ocurre desde una de las últimas actualizaciones desde Microsoft :)
Mi driver es la version 1.99.309.2004

¿Solución?

"JM Tella Llop [MVP Windows]" escribió:

Lo que te ha comentado Alezito. esl "casque" está realmente claro:
zd1201u.sys

Jose Manuel Tella Llop
MVP - Windows
(quitar XXX)
http://www.multingles.net/jmt.htm

Este mensaje se proporciona "como está" sin garantías de ninguna clase,
y no otorga ningún derecho.

This posting is provided "AS IS" with no warranties, and confers no
rights.
You assume all risk for your use.



"Shin-Shan" wrote in message
news:khKGe.2542612$
> Hola:
>
> Leido tu interesante artículo "BSOD - PANTALLA AZUL - CÓMO ANALIZAR
> EL
> ERROR",
> y siguiendolo paso a paso, he llegado a completar el analisis del
> archivo
> DMP, pero
> soy incapaz de descifrar el resultado. Te agradeceria mucho si me
> puedes
> echar una mano.
>
> Copio y pego aquí el resultado del analisis:
>
> Microsoft (R) Windows Debugger Version 6.5.0003.7
> Copyright (c) Microsoft Corporation. All rights reserved.
>
>
> Loading Dump File [C:\WINDOWS\MEMORY.DMP]
> Kernel Summary Dump File: Only kernel address space is available
>
> Symbol search path is:
> SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols
> Executable search path is:
> Windows XP Kernel Version 2600 (Service Pack 2) UP Free x86
> compatible
> Product: WinNt, suite: TerminalServer SingleUserTS
> Built by: 2600.xpsp_sp2_rtm.040803-2158
> Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055ab20
> Debug session time: Sat Jul 16 02:03:49.390 2005 (GMT+2)
> System Uptime: 0 days 8:24:04.963
> Loading Kernel Symbols
>
>
> Loading unloaded module list
> ..
> Loading User Symbols
> ****************************************************************************
> ***
> *
> *
> * Bugcheck Analysis
> *
> *
> *
> ****************************************************************************
> ***
>
> Use !analyze -v to get detailed debugging information.
>
> BugCheck A, {4, 2, 1, 804ee2fe}
>
> *** ERROR: Module load completed but symbols could not be loaded for
> zd1201u.sys
> *** WARNING: Unable to verify timestamp for nv4_disp.dll
> *** ERROR: Module load completed but symbols could not be loaded for
> ZDNDIS5.SYS
> *** ERROR: Module load completed but symbols could not be loaded for
> klif.sys
> *** ERROR: Module load completed but symbols could not be loaded for
> vsdatant.sys
> *** ERROR: Module load completed but symbols could not be loaded for
> DCxxMJPG.sys
> *** ERROR: Module load completed but symbols could not be loaded for
> pfc.sys
> *** ERROR: Module load completed but symbols could not be loaded for
> snapman.sys
> *** ERROR: Module load completed but symbols could not be loaded for
> timntr.sys
> *** ERROR: Module load completed but symbols could not be loaded for
> a347bus.sys
> *** ERROR: Symbol file could not be found. Defaulted to export
> symbols
> for
> drmk.sys -
> *** ERROR: Module load completed but symbols could not be loaded for
> PxHelp20.sys
> *** WARNING: Unable to verify timestamp for fdc.sys
> *** ERROR: Module load completed but symbols could not be loaded for
> fdc.sys
> *** ERROR: Module load completed but symbols could not be loaded for
> ASAPIW2k.sys
> *** ERROR: Module load completed but symbols could not be loaded for
> tifsfilt.sys
> *** ERROR: Module load completed but symbols could not be loaded for
> klmc.sys
> *** ERROR: Module load completed but symbols could not be loaded for
> a347scsi.sys
> Probably caused by : zd1201u.sys ( zd1201u+6eb3 )
>
> Followup: MachineOwner
>
>
> kd> !analyze -v
> ****************************************************************************
> ***
> *
> *
> * Bugcheck Analysis
> *
> *
> *
> ****************************************************************************
> ***
>
> IRQL_NOT_LESS_OR_EQUAL (a)
> An attempt was made to access a pageable (or completely invalid)
> address
> at
> an
> interrupt request level (IRQL) that is too high. This is usually
> caused by drivers using improper addresses.
> If a kernel debugger is available get the stack backtrace.
> Arguments:
> Arg1: 00000004, memory referenced
> Arg2: 00000002, IRQL
> Arg3: 00000001, value 0 = read operation, 1 = write operation
> Arg4: 804ee2fe, address which referenced memory
>
> Debugging Details:
>
>
>
> WRITE_ADDRESS: 00000004
>
> CURRENT_IRQL: 2
>
> FAULTING_IP:
> nt!KiActivateWaiterQueue+27
> 804ee2fe 897004 mov [eax+0x4],esi
>
> DEFAULT_BUCKET_ID: DRIVER_FAULT
>
> BUGCHECK_STR: 0xA
>
> LAST_CONTROL_TRANSFER: from 804e8f17 to 804ee2fe
>
> TRAP_FRAME: f8961c30 -- (.trap fffffffff8961c30)
> ErrCode = 00000002
> eax000000 ebxø961cf8 ecx€561b40 edxc7e67c esi€561b50
> edifc76b0
> eip€4ee2fe espø961ca4 ebpø961cd0 iopl=0 nv up ei pl nz
> ac pe
> nc
> cs08 ss10 ds23 es23 fs30 gs00
> efl010212
> nt!KiActivateWaiterQueue+0x27:
> 804ee2fe 897004 mov [eax+0x4],esi
> ds:0023:00000004=????????
> Resetting default scope
>
> STACK_TEXT:
> f8961ca8 804e8f17 804dc750 81c7e248 00000000
> nt!KiActivateWaiterQueue+0x27
> f8961cd0 f877ceb3 00000000 00000000 00000000
> nt!KeWaitForSingleObject+0x19a
> WARNING: Stack unwind information not available. Following frames may
> be
> wrong.
> f8961d20 f877cf6d 81881000 81564008 0000f100 zd1201u+0x6eb3
> f8961d44 f877ddd5 81881000 00000011 00000001 zd1201u+0x6f6d
> f8961d64 f833dbfe 81c7e674 81881000 f8961dac zd1201u+0x7dd5
> f8961d74 804e47fe 81c7e674 00000000 81fc7b30
> NDIS!ndisWorkItemHandler+0xe
> f8961dac 8057dfed 81c7e674 00000000 00000000 nt!ExpWorkerThread+0x100
> f8961ddc 804fa477 804e4729 00000000 00000000
> nt!PspSystemThreadStartup+0x34
> 00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16
>
>
> FOLLOWUP_IP:
> zd1201u+6eb3
> f877ceb3 3d02010000 cmp eax,0x102
>
> SYMBOL_STACK_INDEX: 2
>
> FOLLOWUP_NAME: MachineOwner
>
> SYMBOL_NAME: zd1201u+6eb3
>
> MODULE_NAME: zd1201u
>
> IMAGE_NAME: zd1201u.sys
>
> DEBUG_FLR_IMAGE_TIMESTAMP: 404d3b5b
>
> STACK_COMMAND: .trap fffffffff8961c30 ; kb
>
> FAILURE_BUCKET_ID: 0xA_W_p3_8_4_2004_zd1201u+6eb3
>
> BUCKET_ID: 0xA_W_p3_8_4_2004_zd1201u+6eb3
>
> Followup: MachineOwner
>
>
>