Bleuscreen (nog maar is)

[jv9090]

Ga eens handmatig naar de map c:/windows/minidump/ . Staat er wel een bestand in?

Als er geen verdere gegevens beschikbaar zijn, zullen we het met deze info moeten doen om een oplossing te vinden.

[ward]

Had er over gezien om de symbols te installen. Staan er nu in en ben geraakt tot: nadat de symbols geladen zijn kan de dumpfile geopend worden via file> open crash dump, brows naar de locatie waar de dumpfile staat enz. Hier raak ik het spoor bijster, vind die dumpfile niet.

Of het zou één- of beiden van deze moeten zijn:

dumpchk.exe

dumpexam.exe

[ward]

Ga eens handmatig naar de map c:/windows/minidump/ . Staat er wel een bestand in?

Als er geen verdere gegevens beschikbaar zijn, zullen we het met deze info moeten doen om een oplossing te vinden.

Idd, er staat een minidump met bestanden in, wist niet dat "minidump" bedoeld werd

Nu moet ik het resultaat nog kunnen kopieren, wat blijkbaar niet lukt

22 februari 2010 aangepast door ward

[ward]

Idd, er staat een minidump met bestanden in, wist niet dat "minidump" bedoeld werd

Nu moet ik het resultaat nog kunnen kopieren, wat blijkbaar niet lukt

Hier is dan de eerste van de 3:

Microsoft ® Windows Debugger Version 6.11.0001.404 X86

Copyright © Microsoft Corporation. All rights reserved.

Loading Dump File [C:\WINDOWS\Minidump\Mini022110-01.dmp]

Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: C:\WINDOWS\Symbols

Executable search path is:

Unable to load image ntoskrnl.exe, Win32 error 0n2

*** WARNING: Unable to verify timestamp for ntoskrnl.exe

Windows XP Kernel Version 2600 (Service Pack 3) UP Free x86 compatible

Product: WinNt, suite: TerminalServer SingleUserTS Personal

Machine Name:

Kernel base = 0x804d7000 PsLoadedModuleList = 0x80554040

Debug session time: Sun Feb 21 11:17:49.328 2010 (GMT+1)

System Uptime: 0 days 0:13:16.922

Unable to load image ntoskrnl.exe, Win32 error 0n2

*** WARNING: Unable to verify timestamp for ntoskrnl.exe

Loading Kernel Symbols

...............................................................

............................................................

Loading User Symbols

Loading unloaded module list

...............

*******************************************************************************

* *

* Bugcheck Analysis *

* *

*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 100000C5, {387501f0, 2, 0, 805447b7}

Unable to load image USBPORT.SYS, Win32 error 0n2

*** WARNING: Unable to verify timestamp for USBPORT.SYS

Probably caused by : USBPORT.SYS ( USBPORT!USBPORT_CompleteTransfer+43f )

Followup: MachineOwner

---------

kd> !analyse -v

No export analyse found

kd> !analyse -v

No export analyse found

kd> !analyze -v

*******************************************************************************

* *

* Bugcheck Analysis *

* *

*******************************************************************************

DRIVER_CORRUPTED_EXPOOL (c5)

An attempt was made to access a pageable (or completely invalid) address at an

interrupt request level (IRQL) that is too high. This is

caused by drivers that have corrupted the system pool. Run the driver

verifier against any new (or suspect) drivers, and if that doesn't turn up

the culprit, then use gflags to enable special pool.

Arguments:

Arg1: 387501f0, memory referenced

Arg2: 00000002, IRQL

Arg3: 00000000, value 0 = read operation, 1 = write operation

Arg4: 805447b7, address which referenced memory

Debugging Details:

------------------

BUGCHECK_STR: 0xC5_2

CURRENT_IRQL: 2

FAULTING_IP:

nt!VERIFY_BUFFER_LOCKED+169

805447b7 837df001 cmp dword ptr [ebp-10h],1

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: DRIVER_FAULT

PROCESS_NAME: Idle

LAST_CONTROL_TRANSFER: from 80544cef to 805447b7

STACK_TEXT:

80549b04 80544cef 86b05c58 86e6f0ec 86edb8e8 nt!VERIFY_BUFFER_LOCKED+0x169

80549b44 80544ef7 86edb8e8 00000000 80549bc0 nt!ViSwap+0x9c

80549b54 f6f611a1 86edb8e8 86e2b008 86edb8e8 nt!ViPnpVerifyMinorWasProcessedProperly+0xaf

80549bc0 f6f61d47 85ec8818 00000000 86e6f7d8 USBPORT!USBPORT_CompleteTransfer+0x43f

80549bf0 f6f62944 026e6f44 86e6f0e0 86e6f0e0 USBPORT!USBPORT_DoneTransfer+0x137

80549c28 f6f6413a 86e6f028 80542708 86e6f230 USBPORT!USBPORT_FlushDoneTransferList+0x16c

80549c54 f6f7224b 86e6f028 80542708 86e6f028 USBPORT!USBPORT_DpcWorker+0x224

80549c90 f6f723c2 86e6f028 00000001 80552a20 USBPORT!USBPORT_IsrDpcWorker+0x38f

80549cac 80541bbd 86e6f64c 6b755044 00000000 USBPORT!USBPORT_IsrDpc+0x166

ffdff980 86e6f670 f7a70000 00035c0a 00000001 nt!RtlTraceDatabaseCreate+0x7f

WARNING: Frame IP not in any known module. Following frames may be wrong.

ffdff998 00035c08 00000005 00000001 00000003 0x86e6f670

ffdff99c 00000000 00000001 00000003 00000000 0x35c08

STACK_COMMAND: kb

FOLLOWUP_IP:

USBPORT!USBPORT_CompleteTransfer+43f

f6f611a1 ?? ???

SYMBOL_STACK_INDEX: 3

SYMBOL_NAME: USBPORT!USBPORT_CompleteTransfer+43f

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: USBPORT

IMAGE_NAME: USBPORT.SYS

DEBUG_FLR_IMAGE_TIMESTAMP: 480254ce

FAILURE_BUCKET_ID: 0xC5_2_USBPORT!USBPORT_CompleteTransfer+43f

BUCKET_ID: 0xC5_2_USBPORT!USBPORT_CompleteTransfer+43f

Followup: MachineOwner

---------

dit is de 2de:

Microsoft ® Windows Debugger Version 6.11.0001.404 X86

Copyright © Microsoft Corporation. All rights reserved.

Loading Dump File [C:\WINDOWS\Minidump\Mini022210-01.dmp]

Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: C:\WINDOWS\Symbols

Executable search path is:

Unable to load image ntoskrnl.exe, Win32 error 0n2

*** WARNING: Unable to verify timestamp for ntoskrnl.exe

Windows XP Kernel Version 2600 (Service Pack 3) UP Free x86 compatible

Product: WinNt, suite: TerminalServer SingleUserTS Personal

Machine Name:

Kernel base = 0x804d7000 PsLoadedModuleList = 0x80554040

Debug session time: Mon Feb 22 10:11:01.843 2010 (GMT+1)

System Uptime: 0 days 0:17:50.447

Unable to load image ntoskrnl.exe, Win32 error 0n2

*** WARNING: Unable to verify timestamp for ntoskrnl.exe

Loading Kernel Symbols

...............................................................

.............................................................

Loading User Symbols

Loading unloaded module list

..............

*******************************************************************************

* *

* Bugcheck Analysis *

* *

*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1000000A, {f000e819, 2, 1, 80500d28}

Unable to load image win32k.sys, Win32 error 0n2

*** WARNING: Unable to verify timestamp for win32k.sys

Probably caused by : win32k.sys ( win32k!SetWakeBit+a5 )

Followup: MachineOwner

---------

kd> !analyze -v

*******************************************************************************

* *

* Bugcheck Analysis *

* *

*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)

An attempt was made to access a pageable (or completely invalid) address at an

interrupt request level (IRQL) that is too high. This is usually

caused by drivers using improper addresses.

If a kernel debugger is available get the stack backtrace.

Arguments:

Arg1: f000e819, memory referenced

Arg2: 00000002, IRQL

Arg3: 00000001, bitfield :

bit 0 : value 0 = read operation, 1 = write operation

bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)

Arg4: 80500d28, address which referenced memory

Debugging Details:

------------------

WRITE_ADDRESS: f000e819

CURRENT_IRQL: 2

FAULTING_IP:

nt!CcPfTraceTimerRoutine+23

80500d28 8916 mov dword ptr [esi],edx

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: 0xA

PROCESS_NAME: csrss.exe

LAST_CONTROL_TRANSFER: from 80500f81 to 80500d28

STACK_TEXT:

f6c99a50 80500f81 00000002 f6c99a6c 00000000 nt!CcPfTraceTimerRoutine+0x23

f6c99a7c 804f9014 00000010 e33965a0 00000010 nt!IoAcquireRemoveLockEx+0x28

f6c99a90 bf801776 86715f60 00000002 00000000 nt!MiWaitForInPageComplete+0xb

f6c99aac bf801295 e33965a0 00000010 804fe2d0 win32k!SetWakeBit+0xa5

f6c99ad4 bf8905d2 00000022 006efff4 bf8010da win32k!TimersProc+0xde

f6c99d30 bf87500f f6ca9490 00000002 f6c99d54 win32k!RemoteConnect+0x1e2

f6c99d40 bf8010fd f6ca9490 f6c99d64 006efff4 win32k!EngStretchBlt+0xb3a

f6c99d54 8053d658 00000000 00000022 00000000 win32k!NtUserCallOneParam+0x16

f6c99d60 00000000 7c90e514 badb0d00 006effec nt!PoRegisterDeviceNotify+0x5

STACK_COMMAND: kb

FOLLOWUP_IP:

win32k!SetWakeBit+a5

bf801776 ?? ???

SYMBOL_STACK_INDEX: 3

SYMBOL_NAME: win32k!SetWakeBit+a5

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: win32k

IMAGE_NAME: win32k.sys

DEBUG_FLR_IMAGE_TIMESTAMP: 4a8564c7

FAILURE_BUCKET_ID: 0xA_win32k!SetWakeBit+a5

BUCKET_ID: 0xA_win32k!SetWakeBit+a5

Followup: MachineOwner

---------

3de:

Microsoft ® Windows Debugger Version 6.11.0001.404 X86

Copyright © Microsoft Corporation. All rights reserved.

Loading Dump File [C:\WINDOWS\Minidump\Mini022210-02.dmp]

Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: C:\WINDOWS\Symbols

Executable search path is:

Unable to load image ntoskrnl.exe, Win32 error 0n2

*** WARNING: Unable to verify timestamp for ntoskrnl.exe

Windows XP Kernel Version 2600 (Service Pack 3) UP Free x86 compatible

Product: WinNt, suite: TerminalServer SingleUserTS Personal

Machine Name:

Kernel base = 0x804d7000 PsLoadedModuleList = 0x80554040

Debug session time: Mon Feb 22 11:34:27.281 2010 (GMT+1)

System Uptime: 0 days 1:18:47.875

Unable to load image ntoskrnl.exe, Win32 error 0n2

*** WARNING: Unable to verify timestamp for ntoskrnl.exe

Loading Kernel Symbols

...............................................................

.............................................................

Loading User Symbols

Loading unloaded module list

................

Unable to load image ALCXWDM.SYS, Win32 error 0n2

*** WARNING: Unable to verify timestamp for ALCXWDM.SYS

*** ERROR: Module load completed but symbols could not be loaded for ALCXWDM.SYS

*******************************************************************************

* *

* Bugcheck Analysis *

* *

*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 100000D1, {a06000e, 2, 0, f63498ce}

Probably caused by : ALCXWDM.SYS ( ALCXWDM+1458ce )

Followup: MachineOwner

---------

kd> !analyze -v

*******************************************************************************

* *

* Bugcheck Analysis *

* *

*******************************************************************************

DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)

An attempt was made to access a pageable (or completely invalid) address at an

interrupt request level (IRQL) that is too high. This is usually

caused by drivers using improper addresses.

If kernel debugger is available get stack backtrace.

Arguments:

Arg1: 0a06000e, memory referenced

Arg2: 00000002, IRQL

Arg3: 00000000, value 0 = read operation, 1 = write operation

Arg4: f63498ce, address which referenced memory

Debugging Details:

------------------

READ_ADDRESS: 0a06000e

CURRENT_IRQL: 2

FAULTING_IP:

ALCXWDM+1458ce

f63498ce ff5008 call dword ptr [eax+8]

CUSTOMER_CRASH_COUNT: 2

DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: 0xD1

PROCESS_NAME: Idle

LAST_CONTROL_TRANSFER: from 86a91240 to f63498ce

STACK_TEXT:

WARNING: Stack unwind information not available. Following frames may be wrong.

80549894 86a91240 86a6d000 00000060 86a77b10 ALCXWDM+0x1458ce

80549898 86a6d000 00000060 86a77b10 8672f338 0x86a91240

8054989c 00000000 86a77b10 8672f338 8671fc28 0x86a6d000

STACK_COMMAND: kb

FOLLOWUP_IP:

ALCXWDM+1458ce

f63498ce ff5008 call dword ptr [eax+8]

SYMBOL_STACK_INDEX: 0

SYMBOL_NAME: ALCXWDM+1458ce

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: ALCXWDM

IMAGE_NAME: ALCXWDM.SYS

DEBUG_FLR_IMAGE_TIMESTAMP: 4312b502

FAILURE_BUCKET_ID: 0xD1_ALCXWDM+1458ce

BUCKET_ID: 0xD1_ALCXWDM+1458ce

Followup: MachineOwner

---------

Hoop dat het goed gelukt is en je er iets mee kan doen.

[ward]

Hier is dan de eerste van de 3:

Microsoft ® Windows Debugger Version 6.11.0001.404 X86

Copyright © Microsoft Corporation. All rights reserved.

Loading Dump File [C:\WINDOWS\Minidump\Mini022110-01.dmp]

Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: C:\WINDOWS\Symbols

Executable search path is:

Unable to load image ntoskrnl.exe, Win32 error 0n2

*** WARNING: Unable to verify timestamp for ntoskrnl.exe

Windows XP Kernel Version 2600 (Service Pack 3) UP Free x86 compatible

Product: WinNt, suite: TerminalServer SingleUserTS Personal

Machine Name:

Kernel base = 0x804d7000 PsLoadedModuleList = 0x80554040

Debug session time: Sun Feb 21 11:17:49.328 2010 (GMT+1)

System Uptime: 0 days 0:13:16.922

Unable to load image ntoskrnl.exe, Win32 error 0n2

*** WARNING: Unable to verify timestamp for ntoskrnl.exe

Loading Kernel Symbols

...............................................................

............................................................

Loading User Symbols

Loading unloaded module list

...............

*******************************************************************************

* *

* Bugcheck Analysis *

* *

*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 100000C5, {387501f0, 2, 0, 805447b7}

Unable to load image USBPORT.SYS, Win32 error 0n2

*** WARNING: Unable to verify timestamp for USBPORT.SYS

Probably caused by : USBPORT.SYS ( USBPORT!USBPORT_CompleteTransfer+43f )

Followup: MachineOwner

---------

kd> !analyse -v

No export analyse found

kd> !analyse -v

No export analyse found

kd> !analyze -v

*******************************************************************************

* *

* Bugcheck Analysis *

* *

*******************************************************************************

DRIVER_CORRUPTED_EXPOOL (c5)

An attempt was made to access a pageable (or completely invalid) address at an

interrupt request level (IRQL) that is too high. This is

caused by drivers that have corrupted the system pool. Run the driver

verifier against any new (or suspect) drivers, and if that doesn't turn up

the culprit, then use gflags to enable special pool.

Arguments:

Arg1: 387501f0, memory referenced

Arg2: 00000002, IRQL

Arg3: 00000000, value 0 = read operation, 1 = write operation

Arg4: 805447b7, address which referenced memory

Debugging Details:

------------------

BUGCHECK_STR: 0xC5_2

CURRENT_IRQL: 2

FAULTING_IP:

nt!VERIFY_BUFFER_LOCKED+169

805447b7 837df001 cmp dword ptr [ebp-10h],1

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: DRIVER_FAULT

PROCESS_NAME: Idle

LAST_CONTROL_TRANSFER: from 80544cef to 805447b7

STACK_TEXT:

80549b04 80544cef 86b05c58 86e6f0ec 86edb8e8 nt!VERIFY_BUFFER_LOCKED+0x169

80549b44 80544ef7 86edb8e8 00000000 80549bc0 nt!ViSwap+0x9c

80549b54 f6f611a1 86edb8e8 86e2b008 86edb8e8 nt!ViPnpVerifyMinorWasProcessedProperly+0xaf

80549bc0 f6f61d47 85ec8818 00000000 86e6f7d8 USBPORT!USBPORT_CompleteTransfer+0x43f

80549bf0 f6f62944 026e6f44 86e6f0e0 86e6f0e0 USBPORT!USBPORT_DoneTransfer+0x137

80549c28 f6f6413a 86e6f028 80542708 86e6f230 USBPORT!USBPORT_FlushDoneTransferList+0x16c

80549c54 f6f7224b 86e6f028 80542708 86e6f028 USBPORT!USBPORT_DpcWorker+0x224

80549c90 f6f723c2 86e6f028 00000001 80552a20 USBPORT!USBPORT_IsrDpcWorker+0x38f

80549cac 80541bbd 86e6f64c 6b755044 00000000 USBPORT!USBPORT_IsrDpc+0x166

ffdff980 86e6f670 f7a70000 00035c0a 00000001 nt!RtlTraceDatabaseCreate+0x7f

WARNING: Frame IP not in any known module. Following frames may be wrong.

ffdff998 00035c08 00000005 00000001 00000003 0x86e6f670

ffdff99c 00000000 00000001 00000003 00000000 0x35c08

STACK_COMMAND: kb

FOLLOWUP_IP:

USBPORT!USBPORT_CompleteTransfer+43f

f6f611a1 ?? ???

SYMBOL_STACK_INDEX: 3

SYMBOL_NAME: USBPORT!USBPORT_CompleteTransfer+43f

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: USBPORT

IMAGE_NAME: USBPORT.SYS

DEBUG_FLR_IMAGE_TIMESTAMP: 480254ce

FAILURE_BUCKET_ID: 0xC5_2_USBPORT!USBPORT_CompleteTransfer+43f

BUCKET_ID: 0xC5_2_USBPORT!USBPORT_CompleteTransfer+43f

Followup: MachineOwner

---------

dit is de 2de:

Microsoft ® Windows Debugger Version 6.11.0001.404 X86

Copyright © Microsoft Corporation. All rights reserved.

Loading Dump File [C:\WINDOWS\Minidump\Mini022210-01.dmp]

Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: C:\WINDOWS\Symbols

Executable search path is:

Unable to load image ntoskrnl.exe, Win32 error 0n2

*** WARNING: Unable to verify timestamp for ntoskrnl.exe

Windows XP Kernel Version 2600 (Service Pack 3) UP Free x86 compatible

Product: WinNt, suite: TerminalServer SingleUserTS Personal

Machine Name:

Kernel base = 0x804d7000 PsLoadedModuleList = 0x80554040

Debug session time: Mon Feb 22 10:11:01.843 2010 (GMT+1)

System Uptime: 0 days 0:17:50.447

Unable to load image ntoskrnl.exe, Win32 error 0n2

*** WARNING: Unable to verify timestamp for ntoskrnl.exe

Loading Kernel Symbols

...............................................................

.............................................................

Loading User Symbols

Loading unloaded module list

..............

*******************************************************************************

* *

* Bugcheck Analysis *

* *

*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1000000A, {f000e819, 2, 1, 80500d28}

Unable to load image win32k.sys, Win32 error 0n2

*** WARNING: Unable to verify timestamp for win32k.sys

Probably caused by : win32k.sys ( win32k!SetWakeBit+a5 )

Followup: MachineOwner

---------

kd> !analyze -v

*******************************************************************************

* *

* Bugcheck Analysis *

* *

*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)

An attempt was made to access a pageable (or completely invalid) address at an

interrupt request level (IRQL) that is too high. This is usually

caused by drivers using improper addresses.

If a kernel debugger is available get the stack backtrace.

Arguments:

Arg1: f000e819, memory referenced

Arg2: 00000002, IRQL

Arg3: 00000001, bitfield :

bit 0 : value 0 = read operation, 1 = write operation

bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)

Arg4: 80500d28, address which referenced memory

Debugging Details:

------------------

WRITE_ADDRESS: f000e819

CURRENT_IRQL: 2

FAULTING_IP:

nt!CcPfTraceTimerRoutine+23

80500d28 8916 mov dword ptr [esi],edx

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: 0xA

PROCESS_NAME: csrss.exe

LAST_CONTROL_TRANSFER: from 80500f81 to 80500d28

STACK_TEXT:

f6c99a50 80500f81 00000002 f6c99a6c 00000000 nt!CcPfTraceTimerRoutine+0x23

f6c99a7c 804f9014 00000010 e33965a0 00000010 nt!IoAcquireRemoveLockEx+0x28

f6c99a90 bf801776 86715f60 00000002 00000000 nt!MiWaitForInPageComplete+0xb

f6c99aac bf801295 e33965a0 00000010 804fe2d0 win32k!SetWakeBit+0xa5

f6c99ad4 bf8905d2 00000022 006efff4 bf8010da win32k!TimersProc+0xde

f6c99d30 bf87500f f6ca9490 00000002 f6c99d54 win32k!RemoteConnect+0x1e2

f6c99d40 bf8010fd f6ca9490 f6c99d64 006efff4 win32k!EngStretchBlt+0xb3a

f6c99d54 8053d658 00000000 00000022 00000000 win32k!NtUserCallOneParam+0x16

f6c99d60 00000000 7c90e514 badb0d00 006effec nt!PoRegisterDeviceNotify+0x5

STACK_COMMAND: kb

FOLLOWUP_IP:

win32k!SetWakeBit+a5

bf801776 ?? ???

SYMBOL_STACK_INDEX: 3

SYMBOL_NAME: win32k!SetWakeBit+a5

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: win32k

IMAGE_NAME: win32k.sys

DEBUG_FLR_IMAGE_TIMESTAMP: 4a8564c7

FAILURE_BUCKET_ID: 0xA_win32k!SetWakeBit+a5

BUCKET_ID: 0xA_win32k!SetWakeBit+a5

Followup: MachineOwner

---------

3de:

Microsoft ® Windows Debugger Version 6.11.0001.404 X86

Copyright © Microsoft Corporation. All rights reserved.

Loading Dump File [C:\WINDOWS\Minidump\Mini022210-02.dmp]

Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: C:\WINDOWS\Symbols

Executable search path is:

Unable to load image ntoskrnl.exe, Win32 error 0n2

*** WARNING: Unable to verify timestamp for ntoskrnl.exe

Windows XP Kernel Version 2600 (Service Pack 3) UP Free x86 compatible

Product: WinNt, suite: TerminalServer SingleUserTS Personal

Machine Name:

Kernel base = 0x804d7000 PsLoadedModuleList = 0x80554040

Debug session time: Mon Feb 22 11:34:27.281 2010 (GMT+1)

System Uptime: 0 days 1:18:47.875

Unable to load image ntoskrnl.exe, Win32 error 0n2

*** WARNING: Unable to verify timestamp for ntoskrnl.exe

Loading Kernel Symbols

...............................................................

.............................................................

Loading User Symbols

Loading unloaded module list

................

Unable to load image ALCXWDM.SYS, Win32 error 0n2

*** WARNING: Unable to verify timestamp for ALCXWDM.SYS

*** ERROR: Module load completed but symbols could not be loaded for ALCXWDM.SYS

*******************************************************************************

* *

* Bugcheck Analysis *

* *

*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 100000D1, {a06000e, 2, 0, f63498ce}

Probably caused by : ALCXWDM.SYS ( ALCXWDM+1458ce )

Followup: MachineOwner

---------

kd> !analyze -v

*******************************************************************************

* *

* Bugcheck Analysis *

* *

*******************************************************************************

DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)

An attempt was made to access a pageable (or completely invalid) address at an

interrupt request level (IRQL) that is too high. This is usually

caused by drivers using improper addresses.

If kernel debugger is available get stack backtrace.

Arguments:

Arg1: 0a06000e, memory referenced

Arg2: 00000002, IRQL

Arg3: 00000000, value 0 = read operation, 1 = write operation

Arg4: f63498ce, address which referenced memory

Debugging Details:

------------------

READ_ADDRESS: 0a06000e

CURRENT_IRQL: 2

FAULTING_IP:

ALCXWDM+1458ce

f63498ce ff5008 call dword ptr [eax+8]

CUSTOMER_CRASH_COUNT: 2

DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: 0xD1

PROCESS_NAME: Idle

LAST_CONTROL_TRANSFER: from 86a91240 to f63498ce

STACK_TEXT:

WARNING: Stack unwind information not available. Following frames may be wrong.

80549894 86a91240 86a6d000 00000060 86a77b10 ALCXWDM+0x1458ce

80549898 86a6d000 00000060 86a77b10 8672f338 0x86a91240

8054989c 00000000 86a77b10 8672f338 8671fc28 0x86a6d000

STACK_COMMAND: kb

FOLLOWUP_IP:

ALCXWDM+1458ce

f63498ce ff5008 call dword ptr [eax+8]

SYMBOL_STACK_INDEX: 0

SYMBOL_NAME: ALCXWDM+1458ce

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: ALCXWDM

IMAGE_NAME: ALCXWDM.SYS

DEBUG_FLR_IMAGE_TIMESTAMP: 4312b502

FAILURE_BUCKET_ID: 0xD1_ALCXWDM+1458ce

BUCKET_ID: 0xD1_ALCXWDM+1458ce

Followup: MachineOwner

---------

Hoop dat het goed gelukt is en je er iets mee kan doen.

Klopt er iets niet? Geen reaktie meer?

[jv9090]

Ik heb nog bezigheden naast dit forum dus je zal soms geduld moeten hebben.

Die eerste foutmelding wordt veroorzaakt door usbport.sys.

Heb je onlangs nieuwe apparaten geïnstalleerd op je pc?

De tweede heeft betrekking op win32k.sys. Dit bestand bevindt zich in de system32 map. Het kan zijn dat dit bestand is beschadigd of dat er iets fout is met je virtueel geheugen. Hoe je dat laaste tijdelijk uitschakeld, moet ik even opzoeken.

De derde foutmelding heeft betrekking op alcxwdm.sys. Dit zijn de drivers van je geluid.

Je kan eens proberen deze opnieuw te installeren.

[ward]

Ik heb nog bezigheden naast dit forum dus je zal soms geduld moeten hebben.

Die eerste foutmelding wordt veroorzaakt door usbport.sys.

Heb je onlangs nieuwe apparaten geïnstalleerd op je pc?

De tweede heeft betrekking op win32k.sys. Dit bestand bevindt zich in de system32 map. Het kan zijn dat dit bestand is beschadigd of dat er iets fout is met je virtueel geheugen. Hoe je dat laaste tijdelijk uitschakeld, moet ik even opzoeken.

De derde foutmelding heeft betrekking op alcxwdm.sys. Dit zijn de drivers van je geluid.

Je kan eens proberen deze opnieuw te installeren.

OK, capito.

Neen, niets meer van apparaten installed de laatste tijd.

[jv9090]

Kijk eens na of er voor de apparaten die toch aangesloten zijn er geen nieuwe drivers beschikbaar zijn.

[ward]

Kijk eens na of er voor de apparaten die toch aangesloten zijn er geen nieuwe drivers beschikbaar zijn.

OK, thx voor uw onvolprezen hulp.