Soporte analisis pantallazo

Pues no te puedo ayudar, ya que no has cargado los símbolos del depurador...

Debes tener mal la ruta de acceso a los mismos

"Symbol search path is:
SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols"

y al no cargarlos, no se entiende nada excepto que es un driver
(IRQL_NOT_LESS_OR_EQUAL (a))

Saludos,

Marc
MCP - MVP Windows Shell/User
Oracle9i Certified Associate (OCA)

Este mensaje se proporciona "como está" sin garantías de ninguna clase, y no
otorga ningún derecho.


"g" escribió:

Me podeis decir donde esta el fallo del pantallazo???



Microsoft (R) Windows Debugger Version 6.4.0007.2

Copyright (c) Microsoft Corporation. All rights reserved.



Loading Dump File [C:\Documents and
Settings\Administrador\Escritorio\Mini081905-01.dmp]

Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is:
SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols

Executable search path is:

*** ERROR: Symbol file could not be found. Defaulted to export symbols for
ntoskrnl.exe -

Windows XP Kernel Version 2600 (Service Pack 2) UP Free x86 compatible

Product: WinNt, suite: TerminalServer SingleUserTS

Built by: 2600.xpsp_sp2_rtm.040803-2158

Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055ab20

Debug session time: Fri Aug 19 11:33:41.879 2005 (GMT+2)

System Uptime: 0 days 19:03:49.656

*** ERROR: Symbol file could not be found. Defaulted to export symbols for
ntoskrnl.exe -

Loading Kernel Symbols

.

Loading unloaded module list



Loading User Symbols

*******************************************************************************

* *

* Bugcheck Analysis *

* *

*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1000000A, {28, 2, 0, 804f22b8}

***** Kernel symbols are WRONG. Please fix symbols to do analysis.

*************************************************************************

*** ***

*** ***

*** Your debugger is not using the correct symbols ***

*** ***

*** In order for this command to work properly, your symbol path ***

*** must point to .pdb files that have full type information. ***

*** ***

*** Certain .pdb files (such as the public OS symbols) do not ***

*** contain the required information. Contact the group that ***

*** provided you with these symbols if you need this command to ***

*** work. ***

*** ***

*** Type referenced: nt!_KPRCB ***

*** ***

*************************************************************************

Followup: MachineOwner



kd> !analyze -v

*******************************************************************************

* *

* Bugcheck Analysis *

* *

*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)

An attempt was made to access a pageable (or completely invalid) address at
an

interrupt request level (IRQL) that is too high. This is usually

caused by drivers using improper addresses.

If a kernel debugger is available get the stack backtrace.

Arguments:

Arg1: 00000028, memory referenced

Arg2: 00000002, IRQL

Arg3: 00000000, value 0 = read operation, 1 = write operation

Arg4: 804f22b8, address which referenced memory

Debugging Details:



***** Kernel symbols are WRONG. Please fix symbols to do analysis.

*************************************************************************

*** ***

*** ***

*** Your debugger is not using the correct symbols ***

*** ***

*** In order for this command to work properly, your symbol path ***

*** must point to .pdb files that have full type information. ***

*** ***

*** Certain .pdb files (such as the public OS symbols) do not ***

*** contain the required information. Contact the group that ***

*** provided you with these symbols if you need this command to ***

*** work. ***

*** ***

*** Type referenced: nt!_KPRCB ***

*** ***

*************************************************************************

MODULE_NAME: nt

FAULTING_MODULE: 804d7000 nt

DEBUG_FLR_IMAGE_TIMESTAMP: 41108004

READ_ADDRESS: unable to get nt!MmSpecialPoolStart

unable to get nt!MmSpecialPoolEnd

unable to get nt!MmPoolCodeStart

unable to get nt!MmPoolCodeEnd

unable to get nt!MiSessionPoolStart

unable to get nt!MiSessionPoolEnd

00000028

CURRENT_IRQL: 2

FAULTING_IP:

nt!PsGetProcessJob+5c8

804f22b8 8b7828 mov edi,[eax+0x28]

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: 0xA

LAST_CONTROL_TRANSFER: from 80500e5f to 804f22b8

STACK_TEXT:

WARNING: Stack unwind information not available. Following frames may be
wrong.

f6c1ac24 80500e5f 05812163 00000000 81d0f3c0 nt!PsGetProcessJob+0x5c8

f6c1ac4c 804e510e e17df528 00000000 e1209fa8
nt!FsRtlRemovePerStreamContext+0xa98

f6c1ac70 804e3d38 81d0f3c0 00000000 e1751500 nt!KeCancelTimer+0x4f

f6c1ac88 80564045 81d0f3c0 00000001 e1209f80 nt!MmIsAddressValid+0x157

f6c1aca4 80563ff6 81d0f3c0 e1209f90 00000000 nt!SeDeleteAccessState+0x5a7

f6c1acc0 804e3c55 e1209fa8 00000000 000005dc nt!SeDeleteAccessState+0x558

f6c1ace4 80567543 81d09260 e1a04f78 81ddd5d8 nt!MmIsAddressValid+0x74

f6c1acfc 805675ac e1a04f78 e1209fa8 000005dc nt!RtlAddAtomToAtomTable+0x5a6

f6c1ad44 805675f6 000005dc 00000001 00000000 nt!RtlAddAtomToAtomTable+0x60f

f6c1ad58 804df06b 000005dc 0117fc7c 7c91eb94 nt!NtClose+0x1d

f6c1ad64 7c91eb94 badb0d00 0117fc78 f780a54a nt!ZwYieldExecution+0xb96

0117fc7c 00000000 00000000 00000000 00000000 0x7c91eb94



STACK_COMMAND: .bugcheck ; kb

FOLLOWUP_NAME: MachineOwner

BUCKET_ID: WRONG_SYMBOLS

Followup: MachineOwner

Aps, por cierto, tienes la versión 6.5 del Debugger para descargar.

Saludos,

Marc
MCP - MVP Windows Shell/User
Oracle9i Certified Associate (OCA)

Este mensaje se proporciona "como está" sin garantías de ninguna clase, y no
otorga ningún derecho.


"g" escribió:

Me podeis decir donde esta el fallo del pantallazo???



Microsoft (R) Windows Debugger Version 6.4.0007.2

Copyright (c) Microsoft Corporation. All rights reserved.



Loading Dump File [C:\Documents and
Settings\Administrador\Escritorio\Mini081905-01.dmp]

Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is:
SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols

Executable search path is:

*** ERROR: Symbol file could not be found. Defaulted to export symbols for
ntoskrnl.exe -

Windows XP Kernel Version 2600 (Service Pack 2) UP Free x86 compatible

Product: WinNt, suite: TerminalServer SingleUserTS

Built by: 2600.xpsp_sp2_rtm.040803-2158

Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055ab20

Debug session time: Fri Aug 19 11:33:41.879 2005 (GMT+2)

System Uptime: 0 days 19:03:49.656

*** ERROR: Symbol file could not be found. Defaulted to export symbols for
ntoskrnl.exe -

Loading Kernel Symbols

.

Loading unloaded module list



Loading User Symbols

*******************************************************************************

* *

* Bugcheck Analysis *

* *

*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1000000A, {28, 2, 0, 804f22b8}

***** Kernel symbols are WRONG. Please fix symbols to do analysis.

*************************************************************************

*** ***

*** ***

*** Your debugger is not using the correct symbols ***

*** ***

*** In order for this command to work properly, your symbol path ***

*** must point to .pdb files that have full type information. ***

*** ***

*** Certain .pdb files (such as the public OS symbols) do not ***

*** contain the required information. Contact the group that ***

*** provided you with these symbols if you need this command to ***

*** work. ***

*** ***

*** Type referenced: nt!_KPRCB ***

*** ***

*************************************************************************

Followup: MachineOwner



kd> !analyze -v

*******************************************************************************

* *

* Bugcheck Analysis *

* *

*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)

An attempt was made to access a pageable (or completely invalid) address at
an

interrupt request level (IRQL) that is too high. This is usually

caused by drivers using improper addresses.

If a kernel debugger is available get the stack backtrace.

Arguments:

Arg1: 00000028, memory referenced

Arg2: 00000002, IRQL

Arg3: 00000000, value 0 = read operation, 1 = write operation

Arg4: 804f22b8, address which referenced memory

Debugging Details:



***** Kernel symbols are WRONG. Please fix symbols to do analysis.

*************************************************************************

*** ***

*** ***

*** Your debugger is not using the correct symbols ***

*** ***

*** In order for this command to work properly, your symbol path ***

*** must point to .pdb files that have full type information. ***

*** ***

*** Certain .pdb files (such as the public OS symbols) do not ***

*** contain the required information. Contact the group that ***

*** provided you with these symbols if you need this command to ***

*** work. ***

*** ***

*** Type referenced: nt!_KPRCB ***

*** ***

*************************************************************************

MODULE_NAME: nt

FAULTING_MODULE: 804d7000 nt

DEBUG_FLR_IMAGE_TIMESTAMP: 41108004

READ_ADDRESS: unable to get nt!MmSpecialPoolStart

unable to get nt!MmSpecialPoolEnd

unable to get nt!MmPoolCodeStart

unable to get nt!MmPoolCodeEnd

unable to get nt!MiSessionPoolStart

unable to get nt!MiSessionPoolEnd

00000028

CURRENT_IRQL: 2

FAULTING_IP:

nt!PsGetProcessJob+5c8

804f22b8 8b7828 mov edi,[eax+0x28]

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: 0xA

LAST_CONTROL_TRANSFER: from 80500e5f to 804f22b8

STACK_TEXT:

WARNING: Stack unwind information not available. Following frames may be
wrong.

f6c1ac24 80500e5f 05812163 00000000 81d0f3c0 nt!PsGetProcessJob+0x5c8

f6c1ac4c 804e510e e17df528 00000000 e1209fa8
nt!FsRtlRemovePerStreamContext+0xa98

f6c1ac70 804e3d38 81d0f3c0 00000000 e1751500 nt!KeCancelTimer+0x4f

f6c1ac88 80564045 81d0f3c0 00000001 e1209f80 nt!MmIsAddressValid+0x157

f6c1aca4 80563ff6 81d0f3c0 e1209f90 00000000 nt!SeDeleteAccessState+0x5a7

f6c1acc0 804e3c55 e1209fa8 00000000 000005dc nt!SeDeleteAccessState+0x558

f6c1ace4 80567543 81d09260 e1a04f78 81ddd5d8 nt!MmIsAddressValid+0x74

f6c1acfc 805675ac e1a04f78 e1209fa8 000005dc nt!RtlAddAtomToAtomTable+0x5a6

f6c1ad44 805675f6 000005dc 00000001 00000000 nt!RtlAddAtomToAtomTable+0x60f

f6c1ad58 804df06b 000005dc 0117fc7c 7c91eb94 nt!NtClose+0x1d

f6c1ad64 7c91eb94 badb0d00 0117fc78 f780a54a nt!ZwYieldExecution+0xb96

0117fc7c 00000000 00000000 00000000 00000000 0x7c91eb94



STACK_COMMAND: .bugcheck ; kb

FOLLOWUP_NAME: MachineOwner

BUCKET_ID: WRONG_SYMBOLS

Followup: MachineOwner

Me dice lo mismo. He puesto esa ruta y nada. Con otros minidump o memory.dmp
me funciona bien.


"Marc [MVP Windows]" escribió en el mensaje
news:

Pues no te puedo ayudar, ya que no has cargado los símbolos del
depurador...

Debes tener mal la ruta de acceso a los mismos

"Symbol search path is:
SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols"

y al no cargarlos, no se entiende nada excepto que es un driver
(IRQL_NOT_LESS_OR_EQUAL (a))

Saludos,

Marc
MCP - MVP Windows Shell/User
Oracle9i Certified Associate (OCA)

Este mensaje se proporciona "como está" sin garantías de ninguna clase, y
no
otorga ningún derecho.


"g" escribió:

Me podeis decir donde esta el fallo del pantallazo???



Microsoft (R) Windows Debugger Version 6.4.0007.2

Copyright (c) Microsoft Corporation. All rights reserved.



Loading Dump File [C:\Documents and
Settings\Administrador\Escritorio\Mini081905-01.dmp]

Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is:
SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols

Executable search path is:

*** ERROR: Symbol file could not be found. Defaulted to export symbols
for
ntoskrnl.exe -

Windows XP Kernel Version 2600 (Service Pack 2) UP Free x86 compatible

Product: WinNt, suite: TerminalServer SingleUserTS

Built by: 2600.xpsp_sp2_rtm.040803-2158

Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055ab20

Debug session time: Fri Aug 19 11:33:41.879 2005 (GMT+2)

System Uptime: 0 days 19:03:49.656

*** ERROR: Symbol file could not be found. Defaulted to export symbols
for
ntoskrnl.exe -

Loading Kernel Symbols

.

Loading unloaded module list



Loading User Symbols

*******************************************************************************

* *

* Bugcheck Analysis *

* *

*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1000000A, {28, 2, 0, 804f22b8}

***** Kernel symbols are WRONG. Please fix symbols to do analysis.

*************************************************************************

*** ***

*** ***

*** Your debugger is not using the correct symbols ***

*** ***

*** In order for this command to work properly, your symbol path ***

*** must point to .pdb files that have full type information. ***

*** ***

*** Certain .pdb files (such as the public OS symbols) do not ***

*** contain the required information. Contact the group that ***

*** provided you with these symbols if you need this command to ***

*** work. ***

*** ***

*** Type referenced: nt!_KPRCB ***

*** ***

*************************************************************************

Followup: MachineOwner



kd> !analyze -v

*******************************************************************************

* *

* Bugcheck Analysis *

* *

*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)

An attempt was made to access a pageable (or completely invalid) address
at
an

interrupt request level (IRQL) that is too high. This is usually

caused by drivers using improper addresses.

If a kernel debugger is available get the stack backtrace.

Arguments:

Arg1: 00000028, memory referenced

Arg2: 00000002, IRQL

Arg3: 00000000, value 0 = read operation, 1 = write operation

Arg4: 804f22b8, address which referenced memory

Debugging Details:



***** Kernel symbols are WRONG. Please fix symbols to do analysis.

*************************************************************************

*** ***

*** ***

*** Your debugger is not using the correct symbols ***

*** ***

*** In order for this command to work properly, your symbol path ***

*** must point to .pdb files that have full type information. ***

*** ***

*** Certain .pdb files (such as the public OS symbols) do not ***

*** contain the required information. Contact the group that ***

*** provided you with these symbols if you need this command to ***

*** work. ***

*** ***

*** Type referenced: nt!_KPRCB ***

*** ***

*************************************************************************

MODULE_NAME: nt

FAULTING_MODULE: 804d7000 nt

DEBUG_FLR_IMAGE_TIMESTAMP: 41108004

READ_ADDRESS: unable to get nt!MmSpecialPoolStart

unable to get nt!MmSpecialPoolEnd

unable to get nt!MmPoolCodeStart

unable to get nt!MmPoolCodeEnd

unable to get nt!MiSessionPoolStart

unable to get nt!MiSessionPoolEnd

00000028

CURRENT_IRQL: 2

FAULTING_IP:

nt!PsGetProcessJob+5c8

804f22b8 8b7828 mov edi,[eax+0x28]

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: 0xA

LAST_CONTROL_TRANSFER: from 80500e5f to 804f22b8

STACK_TEXT:

WARNING: Stack unwind information not available. Following frames may be
wrong.

f6c1ac24 80500e5f 05812163 00000000 81d0f3c0 nt!PsGetProcessJob+0x5c8

f6c1ac4c 804e510e e17df528 00000000 e1209fa8
nt!FsRtlRemovePerStreamContext+0xa98

f6c1ac70 804e3d38 81d0f3c0 00000000 e1751500 nt!KeCancelTimer+0x4f

f6c1ac88 80564045 81d0f3c0 00000001 e1209f80 nt!MmIsAddressValid+0x157

f6c1aca4 80563ff6 81d0f3c0 e1209f90 00000000 nt!SeDeleteAccessState+0x5a7

f6c1acc0 804e3c55 e1209fa8 00000000 000005dc nt!SeDeleteAccessState+0x558

f6c1ace4 80567543 81d09260 e1a04f78 81ddd5d8 nt!MmIsAddressValid+0x74

f6c1acfc 805675ac e1a04f78 e1209fa8 000005dc
nt!RtlAddAtomToAtomTable+0x5a6

f6c1ad44 805675f6 000005dc 00000001 00000000
nt!RtlAddAtomToAtomTable+0x60f

f6c1ad58 804df06b 000005dc 0117fc7c 7c91eb94 nt!NtClose+0x1d

f6c1ad64 7c91eb94 badb0d00 0117fc78 f780a54a nt!ZwYieldExecution+0xb96

0117fc7c 00000000 00000000 00000000 00000000 0x7c91eb94



STACK_COMMAND: .bugcheck ; kb

FOLLOWUP_NAME: MachineOwner

BUCKET_ID: WRONG_SYMBOLS

Followup: MachineOwner

Has de poner la ruta en donde tengas descargados los símbolos, no la que yo
te he puesto, que era a modo de ejemplo.

Si la ruta es correcta, y viendo los errores que te da, sólo se me ocurre
que el .dmp esté mal.

Saludos,

Marc
MCP - MVP Windows Shell/User
Oracle9i Certified Associate (OCA)

Este mensaje se proporciona "como está" sin garantías de ninguna clase, y no
otorga ningún derecho.


"g" wrote:

Me dice lo mismo. He puesto esa ruta y nada. Con otros minidump o memory.dmp
me funciona bien.


"Marc [MVP Windows]" escribió en el mensaje
news:
> Pues no te puedo ayudar, ya que no has cargado los símbolos del
> depurador...
>
> Debes tener mal la ruta de acceso a los mismos
>
> "Symbol search path is:
> SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols"
>
> y al no cargarlos, no se entiende nada excepto que es un driver
> (IRQL_NOT_LESS_OR_EQUAL (a))
>
> Saludos,
>
> Marc
> MCP - MVP Windows Shell/User
> Oracle9i Certified Associate (OCA)
>
> Este mensaje se proporciona "como está" sin garantías de ninguna clase, y
> no
> otorga ningún derecho.
>
>
> "g" escribió:
>
>> Me podeis decir donde esta el fallo del pantallazo???
>>
>>
>>
>> Microsoft (R) Windows Debugger Version 6.4.0007.2
>>
>> Copyright (c) Microsoft Corporation. All rights reserved.
>>
>>
>>
>> Loading Dump File [C:\Documents and
>> Settings\Administrador\Escritorio\Mini081905-01.dmp]
>>
>> Mini Kernel Dump File: Only registers and stack trace are available
>>
>> Symbol search path is:
>> SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols
>>
>> Executable search path is:
>>
>> *** ERROR: Symbol file could not be found. Defaulted to export symbols
>> for
>> ntoskrnl.exe -
>>
>> Windows XP Kernel Version 2600 (Service Pack 2) UP Free x86 compatible
>>
>> Product: WinNt, suite: TerminalServer SingleUserTS
>>
>> Built by: 2600.xpsp_sp2_rtm.040803-2158
>>
>> Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055ab20
>>
>> Debug session time: Fri Aug 19 11:33:41.879 2005 (GMT+2)
>>
>> System Uptime: 0 days 19:03:49.656
>>
>> *** ERROR: Symbol file could not be found. Defaulted to export symbols
>> for
>> ntoskrnl.exe -
>>
>> Loading Kernel Symbols
>>
>> .
>>
>> Loading unloaded module list
>>
>>
>>
>> Loading User Symbols
>>
>> *******************************************************************************
>>
>> * *
>>
>> * Bugcheck Analysis *
>>
>> * *
>>
>> *******************************************************************************
>>
>> Use !analyze -v to get detailed debugging information.
>>
>> BugCheck 1000000A, {28, 2, 0, 804f22b8}
>>
>> ***** Kernel symbols are WRONG. Please fix symbols to do analysis.
>>
>> *************************************************************************
>>
>> *** ***
>>
>> *** ***
>>
>> *** Your debugger is not using the correct symbols ***
>>
>> *** ***
>>
>> *** In order for this command to work properly, your symbol path ***
>>
>> *** must point to .pdb files that have full type information. ***
>>
>> *** ***
>>
>> *** Certain .pdb files (such as the public OS symbols) do not ***
>>
>> *** contain the required information. Contact the group that ***
>>
>> *** provided you with these symbols if you need this command to ***
>>
>> *** work. ***
>>
>> *** ***
>>
>> *** Type referenced: nt!_KPRCB ***
>>
>> *** ***
>>
>> *************************************************************************
>>
>> Followup: MachineOwner
>>
>>
>>
>> kd> !analyze -v
>>
>> *******************************************************************************
>>
>> * *
>>
>> * Bugcheck Analysis *
>>
>> * *
>>
>> *******************************************************************************
>>
>> IRQL_NOT_LESS_OR_EQUAL (a)
>>
>> An attempt was made to access a pageable (or completely invalid) address
>> at
>> an
>>
>> interrupt request level (IRQL) that is too high. This is usually
>>
>> caused by drivers using improper addresses.
>>
>> If a kernel debugger is available get the stack backtrace.
>>
>> Arguments:
>>
>> Arg1: 00000028, memory referenced
>>
>> Arg2: 00000002, IRQL
>>
>> Arg3: 00000000, value 0 = read operation, 1 = write operation
>>
>> Arg4: 804f22b8, address which referenced memory
>>
>> Debugging Details:
>>
>>
>>
>> ***** Kernel symbols are WRONG. Please fix symbols to do analysis.
>>
>> *************************************************************************
>>
>> *** ***
>>
>> *** ***
>>
>> *** Your debugger is not using the correct symbols ***
>>
>> *** ***
>>
>> *** In order for this command to work properly, your symbol path ***
>>
>> *** must point to .pdb files that have full type information. ***
>>
>> *** ***
>>
>> *** Certain .pdb files (such as the public OS symbols) do not ***
>>
>> *** contain the required information. Contact the group that ***
>>
>> *** provided you with these symbols if you need this command to ***
>>
>> *** work. ***
>>
>> *** ***
>>
>> *** Type referenced: nt!_KPRCB ***
>>
>> *** ***
>>
>> *************************************************************************
>>
>> MODULE_NAME: nt
>>
>> FAULTING_MODULE: 804d7000 nt
>>
>> DEBUG_FLR_IMAGE_TIMESTAMP: 41108004
>>
>> READ_ADDRESS: unable to get nt!MmSpecialPoolStart
>>
>> unable to get nt!MmSpecialPoolEnd
>>
>> unable to get nt!MmPoolCodeStart
>>
>> unable to get nt!MmPoolCodeEnd
>>
>> unable to get nt!MiSessionPoolStart
>>
>> unable to get nt!MiSessionPoolEnd
>>
>> 00000028
>>
>> CURRENT_IRQL: 2
>>
>> FAULTING_IP:
>>
>> nt!PsGetProcessJob+5c8
>>
>> 804f22b8 8b7828 mov edi,[eax+0x28]
>>
>> CUSTOMER_CRASH_COUNT: 1
>>
>> DEFAULT_BUCKET_ID: DRIVER_FAULT
>>
>> BUGCHECK_STR: 0xA
>>
>> LAST_CONTROL_TRANSFER: from 80500e5f to 804f22b8
>>
>> STACK_TEXT:
>>
>> WARNING: Stack unwind information not available. Following frames may be
>> wrong.
>>
>> f6c1ac24 80500e5f 05812163 00000000 81d0f3c0 nt!PsGetProcessJob+0x5c8
>>
>> f6c1ac4c 804e510e e17df528 00000000 e1209fa8
>> nt!FsRtlRemovePerStreamContext+0xa98
>>
>> f6c1ac70 804e3d38 81d0f3c0 00000000 e1751500 nt!KeCancelTimer+0x4f
>>
>> f6c1ac88 80564045 81d0f3c0 00000001 e1209f80 nt!MmIsAddressValid+0x157
>>
>> f6c1aca4 80563ff6 81d0f3c0 e1209f90 00000000 nt!SeDeleteAccessState+0x5a7
>>
>> f6c1acc0 804e3c55 e1209fa8 00000000 000005dc nt!SeDeleteAccessState+0x558
>>
>> f6c1ace4 80567543 81d09260 e1a04f78 81ddd5d8 nt!MmIsAddressValid+0x74
>>
>> f6c1acfc 805675ac e1a04f78 e1209fa8 000005dc
>> nt!RtlAddAtomToAtomTable+0x5a6
>>
>> f6c1ad44 805675f6 000005dc 00000001 00000000
>> nt!RtlAddAtomToAtomTable+0x60f
>>
>> f6c1ad58 804df06b 000005dc 0117fc7c 7c91eb94 nt!NtClose+0x1d
>>
>> f6c1ad64 7c91eb94 badb0d00 0117fc78 f780a54a nt!ZwYieldExecution+0xb96
>>
>> 0117fc7c 00000000 00000000 00000000 00000000 0x7c91eb94
>>
>>
>>
>> STACK_COMMAND: .bugcheck ; kb
>>
>> FOLLOWUP_NAME: MachineOwner
>>
>> BUCKET_ID: WRONG_SYMBOLS
>>
>> Followup: MachineOwner
>>
>>
>>
>>
>>
>>

el memory.dmp me da lo siguiente:

Microsoft (R) Windows Debugger Version 6.4.0007.2

Copyright (c) Microsoft Corporation. All rights reserved.



Loading Dump File [\edac00\c$\WINDOWS\MEMORY.DMP]

Kernel Complete Dump File: Full address space is available

Symbol search path is:
SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols"

Executable search path is:

*** ERROR: Symbol file could not be found. Defaulted to export symbols for
ntoskrnl.exe -

Windows XP Kernel Version 2600 (Service Pack 2) UP Free x86 compatible

Product: WinNt, suite: TerminalServer SingleUserTS

Built by: 2600.xpsp_sp2_rtm.040803-2158

Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055ab20

Debug session time: Fri Aug 19 13:21:02.187 2005 (GMT+2)

System Uptime: 0 days 0:18:53.149

*** ERROR: Symbol file could not be found. Defaulted to export symbols for
ntoskrnl.exe -

Loading Kernel Symbols

.

Loading unloaded module list



Loading User Symbols

..

*** ERROR: Symbol file could not be found. Defaulted to export symbols for
ntdll.dll -

*******************************************************************************

* *

* Bugcheck Analysis *

* *

*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck DE, {2, e4adfffc, e1862c3c, 155888c2}

***** Kernel symbols are WRONG. Please fix symbols to do analysis.

*************************************************************************

*** ***

*** ***

*** Your debugger is not using the correct symbols ***

*** ***

*** In order for this command to work properly, your symbol path ***

*** must point to .pdb files that have full type information. ***

*** ***

*** Certain .pdb files (such as the public OS symbols) do not ***

*** contain the required information. Contact the group that ***

*** provided you with these symbols if you need this command to ***

*** work. ***

*** ***

*** Type referenced: nt!_KPRCB ***

*** ***

*************************************************************************

*** ERROR: Symbol file could not be found. Defaulted to export symbols for
TmPreFlt.sys -

*** ERROR: Symbol file could not be found. Defaulted to export symbols for
guitrn.dll -

*** ERROR: Module load completed but symbols could not be loaded for
MIGISM.dll

*** ERROR: Module load completed but symbols could not be loaded for
migwiz.exe

*** ERROR: Symbol file could not be found. Defaulted to export symbols for
SHLWAPI.dll -

*** ERROR: Symbol file could not be found. Defaulted to export symbols for
kernel32.dll -

Probably caused by : TmPreFlt.sys ( TmPreFlt!TmpQueryFullName+4b4d )

Followup: MachineOwner



kd> !analyze -v

*******************************************************************************

* *

* Bugcheck Analysis *

* *

*******************************************************************************

POOL_CORRUPTION_IN_FILE_AREA (de)

A driver corrupted pool memory used for holding pages destined for disk.

This was discovered by the memory manager when dereferencing the file.

Arguments:

Arg1: 00000002

Arg2: e4adfffc

Arg3: e1862c3c

Arg4: 155888c2

Debugging Details:



***** Kernel symbols are WRONG. Please fix symbols to do analysis.

*************************************************************************

*** ***

*** ***

*** Your debugger is not using the correct symbols ***

*** ***

*** In order for this command to work properly, your symbol path ***

*** must point to .pdb files that have full type information. ***

*** ***

*** Certain .pdb files (such as the public OS symbols) do not ***

*** contain the required information. Contact the group that ***

*** provided you with these symbols if you need this command to ***

*** work. ***

*** ***

*** Type referenced: nt!_KPRCB ***

*** ***

*************************************************************************

FAULTING_MODULE: 804d7000 nt

DEBUG_FLR_IMAGE_TIMESTAMP: 4215cbc0

DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: 0xDE

LAST_CONTROL_TRANSFER: from 80520b7d to 805339ae

STACK_TEXT:

WARNING: Stack unwind information not available. Following frames may be
wrong.

f66c652c 80520b7d 000000de 00000002 e4adfffc nt!KeBugCheckEx+0x1b

f66c6570 804f71d0 e4adfffc 01000000 00000001 nt!PoSetSystemState+0x85c2

f66c65a0 804f802d 81bc12fc f66c6634 00000000 nt!CcPurgeCacheSection+0x4f

f66c6600 804f8088 81a615c8 f66c6634 ffffffff nt!FsRtlTruncateLargeMcb+0x4c5

f66c663c f83c1c0c 00000000 00a93658 f83d5f60 nt!FsRtlTruncateLargeMcb+0x520

f66c6664 f83ef76e 81c733a0 e4a93658 e4a93648 Ntfs!NtfsSetBothCacheSizes+0x71

f66c66c8 f83f60e1 f66c6a9c 81c733a0 00000001 Ntfs!NtfsDeleteAllocation+0x380

f66c6738 f83f6189 f66c6a9c e4a93580 f66c67e0
Ntfs!NtfsDeleteAllocationFromRecord+0x15a

f66c6864 f83f5373 f66c6a9c e4a93580 e4a93d20 Ntfs!NtfsDeleteFile+0x245

f66c6a80 f83e3d83 f66c6a9c 81baba68 81fcbac0 Ntfs!NtfsCommonCleanup+0x1212

f66c6bf8 804e3d77 81fca020 81baba68 81fa1418 Ntfs!NtfsFsdCleanup+0xcf

f66c6c18 804e3d77 81fcba08 e4acd890 81babc1c nt!IofCallDriver+0x32

f66c6c50 f7894409 00000000 81baba68 f66c6ca4 nt!IofCallDriver+0x32

f66c6c60 804e3d77 81def020 81baba68 81baba68
TmPreFlt!TmpQueryFullName+0x4b4d

f66c6ca4 80567391 81ca2448 81def020 00010080 nt!IofCallDriver+0x32

f66c6cd4 8056753b 81ca2448 81748ed8 81fb2560 nt!RtlAddAtomToAtomTable+0x3f4

f66c6cfc 805675ac e33d1670 81748ed8 00000394 nt!RtlAddAtomToAtomTable+0x59e

f66c6d44 805675f6 00000394 00000001 00000000 nt!RtlAddAtomToAtomTable+0x60f

f66c6d58 804df06b 00000394 01d3f818 7c91eb94 nt!NtClose+0x1d

f66c6d64 7c91eb94 badb0d00 01d3f7bc f64b2d98 nt!ZwYieldExecution+0xb96

01d3f818 66b150d6 01d3f848 00000008 66b014f4 ntdll!KiFastSystemCallRet

01d3faa4 66b089ba 00ee9b64 00000001 66b09a27 guitrn!TransportModule+0x12fdc

01d3fc3c 66b09f76 00000001 00000000 00000001 guitrn!TransportModule+0x68c0

01d3fc9c 61d87f45 00000000 00000000 00000000 guitrn!TransportModule+0x7e7c

01d3fedc 01005beb 00000000 011f8c10 00000000 MIGISM+0x7f45

01d3ff1c 0100692b 00000001 00000000 011f9b18 migwiz+0x5beb

01d3ff30 0100f54f 010193d0 00030164 0003016e migwiz+0x692b

01d3ff50 77f5f5de 011f9b18 00000000 00000000 migwiz+0xf54f

01d3ffb4 7c80b50b 00000000 00000000 00000000 SHLWAPI!Ordinal505+0x369

01d3ffec 00000000 77f5f56f 00a0e8f0 00000000
kernel32!GetModuleFileNameA+0x1b4



FOLLOWUP_IP:

TmPreFlt!TmpQueryFullName+4b4d

f7894409 eb05 jmp TmPreFlt!TmpQueryFullName+0x4b54 (f7894410)

SYMBOL_STACK_INDEX: d

FOLLOWUP_NAME: MachineOwner

SYMBOL_NAME: TmPreFlt!TmpQueryFullName+4b4d

MODULE_NAME: TmPreFlt

IMAGE_NAME: TmPreFlt.sys

STACK_COMMAND: kb

BUCKET_ID: WRONG_SYMBOLS

Followup: MachineOwner



"Marc [MVP Windows]" escribió en el mensaje
news:

Has de poner la ruta en donde tengas descargados los símbolos, no la que
yo
te he puesto, que era a modo de ejemplo.

Si la ruta es correcta, y viendo los errores que te da, sólo se me ocurre
que el .dmp esté mal.

Saludos,

Marc
MCP - MVP Windows Shell/User
Oracle9i Certified Associate (OCA)

Este mensaje se proporciona "como está" sin garantías de ninguna clase, y
no
otorga ningún derecho.


"g" wrote:

Me dice lo mismo. He puesto esa ruta y nada. Con otros minidump o
memory.dmp
me funciona bien.


"Marc [MVP Windows]" escribió en el mensaje
news:
> Pues no te puedo ayudar, ya que no has cargado los símbolos del
> depurador...
>
> Debes tener mal la ruta de acceso a los mismos
>
> "Symbol search path is:
> SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols"
>
> y al no cargarlos, no se entiende nada excepto que es un driver
> (IRQL_NOT_LESS_OR_EQUAL (a))
>
> Saludos,
>
> Marc
> MCP - MVP Windows Shell/User
> Oracle9i Certified Associate (OCA)
>
> Este mensaje se proporciona "como está" sin garantías de ninguna clase,
> y
> no
> otorga ningún derecho.
>
>
> "g" escribió:
>
>> Me podeis decir donde esta el fallo del pantallazo???
>>
>>
>>
>> Microsoft (R) Windows Debugger Version 6.4.0007.2
>>
>> Copyright (c) Microsoft Corporation. All rights reserved.
>>
>>
>>
>> Loading Dump File [C:\Documents and
>> Settings\Administrador\Escritorio\Mini081905-01.dmp]
>>
>> Mini Kernel Dump File: Only registers and stack trace are available
>>
>> Symbol search path is:
>> SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols
>>
>> Executable search path is:
>>
>> *** ERROR: Symbol file could not be found. Defaulted to export symbols
>> for
>> ntoskrnl.exe -
>>
>> Windows XP Kernel Version 2600 (Service Pack 2) UP Free x86 compatible
>>
>> Product: WinNt, suite: TerminalServer SingleUserTS
>>
>> Built by: 2600.xpsp_sp2_rtm.040803-2158
>>
>> Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055ab20
>>
>> Debug session time: Fri Aug 19 11:33:41.879 2005 (GMT+2)
>>
>> System Uptime: 0 days 19:03:49.656
>>
>> *** ERROR: Symbol file could not be found. Defaulted to export symbols
>> for
>> ntoskrnl.exe -
>>
>> Loading Kernel Symbols
>>
>> .
>>
>> Loading unloaded module list
>>
>>
>>
>> Loading User Symbols
>>
>> *******************************************************************************
>>
>> * *
>>
>> * Bugcheck Analysis *
>>
>> * *
>>
>> *******************************************************************************
>>
>> Use !analyze -v to get detailed debugging information.
>>
>> BugCheck 1000000A, {28, 2, 0, 804f22b8}
>>
>> ***** Kernel symbols are WRONG. Please fix symbols to do analysis.
>>
>> *************************************************************************
>>
>> *** ***
>>
>> *** ***
>>
>> *** Your debugger is not using the correct symbols ***
>>
>> *** ***
>>
>> *** In order for this command to work properly, your symbol path ***
>>
>> *** must point to .pdb files that have full type information. ***
>>
>> *** ***
>>
>> *** Certain .pdb files (such as the public OS symbols) do not ***
>>
>> *** contain the required information. Contact the group that ***
>>
>> *** provided you with these symbols if you need this command to ***
>>
>> *** work. ***
>>
>> *** ***
>>
>> *** Type referenced: nt!_KPRCB ***
>>
>> *** ***
>>
>> *************************************************************************
>>
>> Followup: MachineOwner
>>
>>
>>
>> kd> !analyze -v
>>
>> *******************************************************************************
>>
>> * *
>>
>> * Bugcheck Analysis *
>>
>> * *
>>
>> *******************************************************************************
>>
>> IRQL_NOT_LESS_OR_EQUAL (a)
>>
>> An attempt was made to access a pageable (or completely invalid)
>> address
>> at
>> an
>>
>> interrupt request level (IRQL) that is too high. This is usually
>>
>> caused by drivers using improper addresses.
>>
>> If a kernel debugger is available get the stack backtrace.
>>
>> Arguments:
>>
>> Arg1: 00000028, memory referenced
>>
>> Arg2: 00000002, IRQL
>>
>> Arg3: 00000000, value 0 = read operation, 1 = write operation
>>
>> Arg4: 804f22b8, address which referenced memory
>>
>> Debugging Details:
>>
>>
>>
>> ***** Kernel symbols are WRONG. Please fix symbols to do analysis.
>>
>> *************************************************************************
>>
>> *** ***
>>
>> *** ***
>>
>> *** Your debugger is not using the correct symbols ***
>>
>> *** ***
>>
>> *** In order for this command to work properly, your symbol path ***
>>
>> *** must point to .pdb files that have full type information. ***
>>
>> *** ***
>>
>> *** Certain .pdb files (such as the public OS symbols) do not ***
>>
>> *** contain the required information. Contact the group that ***
>>
>> *** provided you with these symbols if you need this command to ***
>>
>> *** work. ***
>>
>> *** ***
>>
>> *** Type referenced: nt!_KPRCB ***
>>
>> *** ***
>>
>> *************************************************************************
>>
>> MODULE_NAME: nt
>>
>> FAULTING_MODULE: 804d7000 nt
>>
>> DEBUG_FLR_IMAGE_TIMESTAMP: 41108004
>>
>> READ_ADDRESS: unable to get nt!MmSpecialPoolStart
>>
>> unable to get nt!MmSpecialPoolEnd
>>
>> unable to get nt!MmPoolCodeStart
>>
>> unable to get nt!MmPoolCodeEnd
>>
>> unable to get nt!MiSessionPoolStart
>>
>> unable to get nt!MiSessionPoolEnd
>>
>> 00000028
>>
>> CURRENT_IRQL: 2
>>
>> FAULTING_IP:
>>
>> nt!PsGetProcessJob+5c8
>>
>> 804f22b8 8b7828 mov edi,[eax+0x28]
>>
>> CUSTOMER_CRASH_COUNT: 1
>>
>> DEFAULT_BUCKET_ID: DRIVER_FAULT
>>
>> BUGCHECK_STR: 0xA
>>
>> LAST_CONTROL_TRANSFER: from 80500e5f to 804f22b8
>>
>> STACK_TEXT:
>>
>> WARNING: Stack unwind information not available. Following frames may
>> be
>> wrong.
>>
>> f6c1ac24 80500e5f 05812163 00000000 81d0f3c0 nt!PsGetProcessJob+0x5c8
>>
>> f6c1ac4c 804e510e e17df528 00000000 e1209fa8
>> nt!FsRtlRemovePerStreamContext+0xa98
>>
>> f6c1ac70 804e3d38 81d0f3c0 00000000 e1751500 nt!KeCancelTimer+0x4f
>>
>> f6c1ac88 80564045 81d0f3c0 00000001 e1209f80 nt!MmIsAddressValid+0x157
>>
>> f6c1aca4 80563ff6 81d0f3c0 e1209f90 00000000
>> nt!SeDeleteAccessState+0x5a7
>>
>> f6c1acc0 804e3c55 e1209fa8 00000000 000005dc
>> nt!SeDeleteAccessState+0x558
>>
>> f6c1ace4 80567543 81d09260 e1a04f78 81ddd5d8 nt!MmIsAddressValid+0x74
>>
>> f6c1acfc 805675ac e1a04f78 e1209fa8 000005dc
>> nt!RtlAddAtomToAtomTable+0x5a6
>>
>> f6c1ad44 805675f6 000005dc 00000001 00000000
>> nt!RtlAddAtomToAtomTable+0x60f
>>
>> f6c1ad58 804df06b 000005dc 0117fc7c 7c91eb94 nt!NtClose+0x1d
>>
>> f6c1ad64 7c91eb94 badb0d00 0117fc78 f780a54a nt!ZwYieldExecution+0xb96
>>
>> 0117fc7c 00000000 00000000 00000000 00000000 0x7c91eb94
>>
>>
>>
>> STACK_COMMAND: .bugcheck ; kb
>>
>> FOLLOWUP_NAME: MachineOwner
>>
>> BUCKET_ID: WRONG_SYMBOLS
>>
>> Followup: MachineOwner
>>
>>
>>
>>
>>
>>