Solved

Blue Screen

Posted on 2009-05-12
13
348 Views
Last Modified: 2012-05-06
Any thoughts on this dump file?


Loading Dump File [C:\Documents and Settings\Administrator.CSE\Desktop\DMP\Mini050409-02.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: *** Invalid ***
****************************************************************************
* Symbol loading may be unreliable without a symbol search path.           *
* Use .symfix to have the debugger choose a symbol path.                   *
* After setting your symbol path, use .reload to refresh symbol locations. *
****************************************************************************
Executable search path is:
*********************************************************************
* Symbols can not be loaded because symbol path is not initialized. *
*                                                                   *
* The Symbol Path can be set by:                                    *
*   using the _NT_SYMBOL_PATH environment variable.                 *
*   using the -y <symbol_path> argument when starting the debugger. *
*   using .sympath and .sympath+                                    *
*********************************************************************
Unable to load image ntoskrnl.exe, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
*** ERROR: Module load completed but symbols could not be loaded for ntoskrnl.exe
Windows XP Kernel Version 2600 (Service Pack 3) UP Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Machine Name:
Kernel base = 0x804d7000 PsLoadedModuleList = 0x80554040
Debug session time: Mon May  4 21:40:13.968 2009 (GMT-5)
System Uptime: 0 days 2:04:49.541
*********************************************************************
* Symbols can not be loaded because symbol path is not initialized. *
*                                                                   *
* The Symbol Path can be set by:                                    *
*   using the _NT_SYMBOL_PATH environment variable.                 *
*   using the -y <symbol_path> argument when starting the debugger. *
*   using .sympath and .sympath+                                    *
*********************************************************************
Unable to load image ntoskrnl.exe, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
*** ERROR: Module load completed but symbols could not be loaded for ntoskrnl.exe
Loading Kernel Symbols
...............................................................
.............................................................
Loading User Symbols
Loading unloaded module list
...........................
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1000000A, {3005c, 2, 1, 80500d12}

***** Kernel symbols are WRONG. Please fix symbols to do analysis.

*************************************************************************
***                                                                   ***
***                                                                   ***
***    Your debugger is not using the correct symbols                 ***
***                                                                   ***
***    In order for this command to work properly, your symbol path   ***
***    must point to .pdb files that have full type information.      ***
***                                                                   ***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                          ***
***                                                                   ***
***    Type referenced: nt!_KPRCB                                     ***
***                                                                   ***
*************************************************************************
*************************************************************************
***                                                                   ***
***                                                                   ***
***    Your debugger is not using the correct symbols                 ***
***                                                                   ***
***    In order for this command to work properly, your symbol path   ***
***    must point to .pdb files that have full type information.      ***
***                                                                   ***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                          ***
***                                                                   ***
***    Type referenced: nt!_KPRCB                                     ***
***                                                                   ***
*************************************************************************
*********************************************************************
* Symbols can not be loaded because symbol path is not initialized. *
*                                                                   *
* The Symbol Path can be set by:                                    *
*   using the _NT_SYMBOL_PATH environment variable.                 *
*   using the -y <symbol_path> argument when starting the debugger. *
*   using .sympath and .sympath+                                    *
*********************************************************************
*********************************************************************
* Symbols can not be loaded because symbol path is not initialized. *
*                                                                   *
* The Symbol Path can be set by:                                    *
*   using the _NT_SYMBOL_PATH environment variable.                 *
*   using the -y <symbol_path> argument when starting the debugger. *
*   using .sympath and .sympath+                                    *
*********************************************************************
Probably caused by : ntoskrnl.exe ( nt+29d12 )

Followup: MachineOwner
---------

0
Comment
Question by:KCDean
13 Comments
 
LVL 8

Expert Comment

by:skywalker39
ID: 24370908
Hi KCDean,

Have you installed any new hardware, software or updated any drivers? Have you installed anything at all? What happens if you go into Safe Mode, do you still get the same results?
0
 
LVL 1

Author Comment

by:KCDean
ID: 24371128
Noticed when playing mild games like deer hunter and stuff, then video on skype. So I put an 8500 radeon in it, instead of the MB video card. But now its still blue screening, we put in a new stick of ram, so I asked him to pull the ram now... (lets see)
0
 
LVL 91

Expert Comment

by:nobus
ID: 24372034
this dump file tells nothing : you have the wrong symbols, or none loaded - fix it first, as suggested :
Symbol search path is: *** Invalid ***
****************************************************************************
* Symbol loading may be unreliable without a symbol search path.           *
* Use .symfix to have the debugger choose a symbol path.                   *
* After setting your symbol path, use .reload to refresh symbol locations. *
0
 
LVL 4

Expert Comment

by:althakar
ID: 24372398
do fixboot from ur xp cd...


insert ur xp cd, go for installation and select repair, eneter ur login details and type FIXBOOT
0
 
LVL 1

Author Comment

by:KCDean
ID: 24374072
I'm attempting to find the right symbols for it and I'll repost the dump.
0
 
LVL 1

Author Comment

by:KCDean
ID: 24385814
I have not had much time to look into this symbol thing does anyone have experience with this? (thanks just to busy)
0
Free Trending Threat Insights Every Day

Enhance your security with threat intelligence from the web. Get trending threat insights on hackers, exploits, and suspicious IP addresses delivered to your inbox with our free Cyber Daily.

 
LVL 91

Expert Comment

by:nobus
ID: 24386757
ook here how to set the symbol path :  http://support.microsoft.com/kb/311503
Using the Microsoft Symbol Server with WinDbg
To use the Symbol Server Web site from within WinDbg, follow these steps:
Start the Windows Debugger (WinDbg.exe).
On the File menu, click Symbol File Path.
In the Symbol path box, type the following command:
SRV*your local folder for symbols*http://msdl.microsoft.com/download/symbols
where your local folder for symbols is the folder in which you copy your local symbol cache. The debug symbols are downloaded to this location.

Note You can point to any local path or share that your computer can reach; it does not have to be a location on the computer's hard disk.
Alternatively, you can also use the .sympath command at a command prompt to set the symbol path.


note :    Use .symfix to have the debugger choose a symbol path.      
0
 
LVL 1

Author Comment

by:KCDean
ID: 24396303
Ok this looks better -- me thinks

WARNING: Inaccessible path: 'SRV'
WARNING: Whitespace at start of path element
WARNING: Whitespace at start of path element

Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Documents and Settings\casey\Desktop\RICK\Mini050409-02.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

WARNING: Inaccessible path: 'SRV'
WARNING: Whitespace at start of path element
WARNING: Whitespace at start of path element
Symbol search path is: SRV; C:\symbols; http://msdl.microsoft.com/download/symbols/
Executable search path is:
Windows XP Kernel Version 2600 (Service Pack 3) UP Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 2600.xpsp_sp3_gdr.090206-1234
Machine Name:
Kernel base = 0x804d7000 PsLoadedModuleList = 0x80554040
Debug session time: Mon May  4 21:40:13.968 2009 (GMT-5)
System Uptime: 0 days 2:04:49.541
Loading Kernel Symbols
...............................................................
.............................................................
Loading User Symbols
Loading unloaded module list
...........................
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1000000A, {3005c, 2, 1, 80500d12}

Probably caused by : ntkrnlpa.exe ( nt!KiUnlinkThread+0 )

Followup: MachineOwner
---------

kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 0003005c, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000001, bitfield :
      bit 0 : value 0 = read operation, 1 = write operation
      bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: 80500d12, address which referenced memory

Debugging Details:
------------------


WRITE_ADDRESS:  0003005c

CURRENT_IRQL:  2

FAULTING_IP:
nt!KiUnlinkThread+0
80500d12 095154          or      dword ptr [ecx+54h],edx

CUSTOMER_CRASH_COUNT:  2

DEFAULT_BUCKET_ID:  DRIVER_FAULT

BUGCHECK_STR:  0xA

PROCESS_NAME:  Skype.exe

LAST_CONTROL_TRANSFER:  from 80500d80 to 80500d12

STACK_TEXT:  
af6f6ca8 80500d80 89005ab8 89005ac0 00000100 nt!KiUnlinkThread
af6f6cbc 80500f77 00000001 af6f6cd8 00000000 nt!KiUnwaitThread+0x12
af6f6ce8 804f9014 00000000 89005ab8 00000000 nt!KiWaitTest+0xab
af6f6cfc 80605692 89005ab8 00000001 00000000 nt!KeSetEvent+0x58
af6f6d54 8053d648 00000df8 00000000 0f4efe08 nt!NtSetEvent+0x72
af6f6d54 7c90e514 00000df8 00000000 0f4efe08 nt!KiFastCallEntry+0xf8
WARNING: Frame IP not in any known module. Following frames may be wrong.
0f4efe08 00000000 00000000 00000000 00000000 0x7c90e514


STACK_COMMAND:  kb

FOLLOWUP_IP:
nt!KiUnlinkThread+0
80500d12 095154          or      dword ptr [ecx+54h],edx

SYMBOL_STACK_INDEX:  0

SYMBOL_NAME:  nt!KiUnlinkThread+0

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlpa.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  498c11d3

FAILURE_BUCKET_ID:  0xA_nt!KiUnlinkThread+0

BUCKET_ID:  0xA_nt!KiUnlinkThread+0

Followup: MachineOwner
---------

What do you think Nobus?
0
 
LVL 1

Author Comment

by:KCDean
ID: 24396356
Hmmm I wonder it looks like his skype might need reinstalling or possibly his webcam for skype? What do you think Nobus..
0
 
LVL 91

Expert Comment

by:nobus
ID: 24396606
>>  An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.         <<<<<<<<<<<<Here he talks about a driver
and farther about skype; so yes that is a possibility.
check also your device manager for errors - or try updating the drivers
0
 
LVL 1

Author Comment

by:KCDean
ID: 24396919
Yea I told him he needs to look at his drivers on his Webcam I bet that's the problem. (or possibly a real old version of skype and incompatability)
0
 
LVL 91

Accepted Solution

by:
nobus earned 500 total points
ID: 24396990
ok , we'll see..
0
 
LVL 1

Author Closing Comment

by:KCDean
ID: 31580815
You helped me out the most I will give you the points. I have not heard back from the guy in a while so issue must be going away.
Thanks,
0

Featured Post

Top 6 Sources for Identifying Threat Actor TTPs

Understanding your enemy is essential. These six sources will help you identify the most popular threat actor tactics, techniques, and procedures (TTPs).

Join & Write a Comment

It is only natural that we all want our PCs to be in good working order, improved system performance, so that is exactly how programs are advertised to entice. They say things like:            •      PC crashes? Get registry cleaner to repair it!    …
When you start your Windows 10 PC and got an "Operating system not found" error or just saw  "Auto repair for startup". After a while, you have entered a loop for Auto repair which does not fix anything and you will be in a  panic as all your work w…
This video shows how to remove a single email address from the Outlook 2010 Auto Suggestion memory. NOTE: For Outlook 2016 and 2013 perform the exact same steps. Open a new email: Click the New email button in Outlook. Start typing the address: …
When you create an app prototype with Adobe XD, you can insert system screens -- sharing or Control Center, for example -- with just a few clicks. This video shows you how. You can take the full course on Experts Exchange at http://bit.ly/XDcourse.

746 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

9 Experts available now in Live!

Get 1:1 Help Now