Blue Screen przy starcie systemu

[bodex 8]

Mam następujący problem:

Przy starcie systemu Vista HP 32 bit, wyskakuje mi za każdym razem blue screen po czym restart i tak w kółko.

W trybie awaryjnym jest wszystko ok, wcześniej też nie było problemów ( system stoi ponad 2 i pół roku i przez ten czas to z tego co pamiętam raz mnie tylko zawiódł ). Schody zaczynają się bo nie mam jak dojść do tego co się dzieje ( a format nie bardzo mi się uśmiecha ), bo nie mam zainstalowanego Debugging Tools...

No więc moje pytanie brzmi:

Czy da się jakoś to Debugging Tools zainstalować w trybie awaryjnym ?

Mogę jakoś inaczej dojść co powoduje BSODa ? Miał ktoś podobny przypadek ?

Jakby był ktoś miły i sprawdził mi dmp też byłoby fajnie

http://wrzucacz.pl/file/1241262561676

[HoZar 227]

jak treść blueskrina ?

 

masz dwie kości RAM ? wyjmij jedną i zobacz czy będzie to samo.

jak tak to zamień z wyjętą i sprawdź jeszcze raz. (możesz też sprawdzić w różnych slotach)

 

jak nie będzie efektu to będziemy kombinowali dalej

[bodex 8]

Mam te 2GB w jednej kości, ale gdyby to był ram to chyba w awaryjnym też tak by było, robiłem też windowsowski test pamięci i niby jest wszystko ok ...

Właśnie udało mi się odpalić normalnie system i użyłem debuggera, nie wiem czy poprawnie, bo większość loga jest o braku symboli ale uzyskałem takie coś:

Loading Dump File [C:\Windows\Minidump\Mini010310-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: *** Invalid ***
****************************************************************************
* Symbol loading may be unreliable without a symbol search path.		   *
* Use .symfix to have the debugger choose a symbol path.				   *
* After setting your symbol path, use .reload to refresh symbol locations. *
****************************************************************************
Executable search path is: 
*********************************************************************
* Symbols can not be loaded because symbol path is not initialized. *
*																   *
* The Symbol Path can be set by:									*
*   using the _NT_SYMBOL_PATH environment variable.				 *
*   using the -y <symbol_path> argument when starting the debugger. *
*   using .sympath and .sympath+									*
*********************************************************************
Unable to load image \SystemRoot\system32\ntkrnlpa.exe, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntkrnlpa.exe
*** ERROR: Module load completed but symbols could not be loaded for ntkrnlpa.exe
Windows Kernel Version 6002 (Service Pack 2) MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Kernel base = 0x8283c000 PsLoadedModuleList = 0x82953c70
Debug session time: Sun Jan  3 21:21:15.084 2010 (GMT+1)
System Uptime: 0 days 0:00:59.803
*********************************************************************
* Symbols can not be loaded because symbol path is not initialized. *
*																   *
* The Symbol Path can be set by:									*
*   using the _NT_SYMBOL_PATH environment variable.				 *
*   using the -y <symbol_path> argument when starting the debugger. *
*   using .sympath and .sympath+									*
*********************************************************************
Unable to load image \SystemRoot\system32\ntkrnlpa.exe, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntkrnlpa.exe
*** ERROR: Module load completed but symbols could not be loaded for ntkrnlpa.exe
Loading Kernel Symbols
................................................................................
................................................................................
.
.....
Loading User Symbols
Loading unloaded module list
....
*******************************************************************************
*																			 *
*						Bugcheck Analysis									*
*																			 *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 50, {b5e8375a, 8, b5e8375a, 2}

*** WARNING: Unable to verify timestamp for fltmgr.sys
*** ERROR: Module load completed but symbols could not be loaded for fltmgr.sys
***** Kernel symbols are WRONG. Please fix symbols to do analysis.

*************************************************************************
***																   ***
***																   ***
***	Your debugger is not using the correct symbols				 ***
***																   ***
***	In order for this command to work properly, your symbol path   ***
***	must point to .pdb files that have full type information.	  ***
***																   ***
***	Certain .pdb files (such as the public OS symbols) do not	  ***
***	contain the required information.  Contact the group that	  ***
***	provided you with these symbols if you need this command to	***
***	work.														  ***
***																   ***
***	Type referenced: nt!_KPRCB									 ***
***																   ***
*************************************************************************
*************************************************************************
***																   ***
***																   ***
***	Your debugger is not using the correct symbols				 ***
***																   ***
***	In order for this command to work properly, your symbol path   ***
***	must point to .pdb files that have full type information.	  ***
***																   ***
***	Certain .pdb files (such as the public OS symbols) do not	  ***
***	contain the required information.  Contact the group that	  ***
***	provided you with these symbols if you need this command to	***
***	work.														  ***
***																   ***
***	Type referenced: nt!KPRCB									  ***
***																   ***
*************************************************************************
*************************************************************************
***																   ***
***																   ***
***	Your debugger is not using the correct symbols				 ***
***																   ***
***	In order for this command to work properly, your symbol path   ***
***	must point to .pdb files that have full type information.	  ***
***																   ***
***	Certain .pdb files (such as the public OS symbols) do not	  ***
***	contain the required information.  Contact the group that	  ***
***	provided you with these symbols if you need this command to	***
***	work.														  ***
***																   ***
***	Type referenced: nt!_KPRCB									 ***
***																   ***
*************************************************************************
*************************************************************************
***																   ***
***																   ***
***	Your debugger is not using the correct symbols				 ***
***																   ***
***	In order for this command to work properly, your symbol path   ***
***	must point to .pdb files that have full type information.	  ***
***																   ***
***	Certain .pdb files (such as the public OS symbols) do not	  ***
***	contain the required information.  Contact the group that	  ***
***	provided you with these symbols if you need this command to	***
***	work.														  ***
***																   ***
***	Type referenced: nt!KPRCB									  ***
***																   ***
*************************************************************************
*************************************************************************
***																   ***
***																   ***
***	Your debugger is not using the correct symbols				 ***
***																   ***
***	In order for this command to work properly, your symbol path   ***
***	must point to .pdb files that have full type information.	  ***
***																   ***
***	Certain .pdb files (such as the public OS symbols) do not	  ***
***	contain the required information.  Contact the group that	  ***
***	provided you with these symbols if you need this command to	***
***	work.														  ***
***																   ***
***	Type referenced: nt!_KPRCB									 ***
***																   ***
*************************************************************************
*************************************************************************
***																   ***
***																   ***
***	Your debugger is not using the correct symbols				 ***
***																   ***
***	In order for this command to work properly, your symbol path   ***
***	must point to .pdb files that have full type information.	  ***
***																   ***
***	Certain .pdb files (such as the public OS symbols) do not	  ***
***	contain the required information.  Contact the group that	  ***
***	provided you with these symbols if you need this command to	***
***	work.														  ***
***																   ***
***	Type referenced: nt!_KPRCB									 ***
***																   ***
*************************************************************************
*************************************************************************
***																   ***
***																   ***
***	Your debugger is not using the correct symbols				 ***
***																   ***
***	In order for this command to work properly, your symbol path   ***
***	must point to .pdb files that have full type information.	  ***
***																   ***
***	Certain .pdb files (such as the public OS symbols) do not	  ***
***	contain the required information.  Contact the group that	  ***
***	provided you with these symbols if you need this command to	***
***	work.														  ***
***																   ***
***	Type referenced: nt!_KPRCB									 ***
***																   ***
*************************************************************************
*************************************************************************
***																   ***
***																   ***
***	Your debugger is not using the correct symbols				 ***
***																   ***
***	In order for this command to work properly, your symbol path   ***
***	must point to .pdb files that have full type information.	  ***
***																   ***
***	Certain .pdb files (such as the public OS symbols) do not	  ***
***	contain the required information.  Contact the group that	  ***
***	provided you with these symbols if you need this command to	***
***	work.														  ***
***																   ***
***	Type referenced: nt!_KPRCB									 ***
***																   ***
*************************************************************************
*********************************************************************
* Symbols can not be loaded because symbol path is not initialized. *
*																   *
* The Symbol Path can be set by:									*
*   using the _NT_SYMBOL_PATH environment variable.				 *
*   using the -y <symbol_path> argument when starting the debugger. *
*   using .sympath and .sympath+									*
*********************************************************************
*********************************************************************
* Symbols can not be loaded because symbol path is not initialized. *
*																   *
* The Symbol Path can be set by:									*
*   using the _NT_SYMBOL_PATH environment variable.				 *
*   using the -y <symbol_path> argument when starting the debugger. *
*   using .sympath and .sympath+									*
*********************************************************************
Probably caused by : ntkrnlpa.exe ( nt+9836d )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*																			 *
*						Bugcheck Analysis									*
*																			 *
*******************************************************************************

PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced.  This cannot be protected by try-except,
it must be protected by a Probe.  Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: b5e8375a, memory referenced.
Arg2: 00000008, value 0 = read operation, 1 = write operation.
Arg3: b5e8375a, If non-zero, the instruction address which referenced the bad memory
address.
Arg4: 00000002, (reserved)

Debugging Details:
------------------

***** Kernel symbols are WRONG. Please fix symbols to do analysis.

*************************************************************************
***																   ***
***																   ***
***	Your debugger is not using the correct symbols				 ***
***																   ***
***	In order for this command to work properly, your symbol path   ***
***	must point to .pdb files that have full type information.	  ***
***																   ***
***	Certain .pdb files (such as the public OS symbols) do not	  ***
***	contain the required information.  Contact the group that	  ***
***	provided you with these symbols if you need this command to	***
***	work.														  ***
***																   ***
***	Type referenced: nt!_KPRCB									 ***
***																   ***
*************************************************************************
*************************************************************************
***																   ***
***																   ***
***	Your debugger is not using the correct symbols				 ***
***																   ***
***	In order for this command to work properly, your symbol path   ***
***	must point to .pdb files that have full type information.	  ***
***																   ***
***	Certain .pdb files (such as the public OS symbols) do not	  ***
***	contain the required information.  Contact the group that	  ***
***	provided you with these symbols if you need this command to	***
***	work.														  ***
***																   ***
***	Type referenced: nt!KPRCB									  ***
***																   ***
*************************************************************************
*************************************************************************
***																   ***
***																   ***
***	Your debugger is not using the correct symbols				 ***
***																   ***
***	In order for this command to work properly, your symbol path   ***
***	must point to .pdb files that have full type information.	  ***
***																   ***
***	Certain .pdb files (such as the public OS symbols) do not	  ***
***	contain the required information.  Contact the group that	  ***
***	provided you with these symbols if you need this command to	***
***	work.														  ***
***																   ***
***	Type referenced: nt!_KPRCB									 ***
***																   ***
*************************************************************************
*************************************************************************
***																   ***
***																   ***
***	Your debugger is not using the correct symbols				 ***
***																   ***
***	In order for this command to work properly, your symbol path   ***
***	must point to .pdb files that have full type information.	  ***
***																   ***
***	Certain .pdb files (such as the public OS symbols) do not	  ***
***	contain the required information.  Contact the group that	  ***
***	provided you with these symbols if you need this command to	***
***	work.														  ***
***																   ***
***	Type referenced: nt!KPRCB									  ***
***																   ***
*************************************************************************
*************************************************************************
***																   ***
***																   ***
***	Your debugger is not using the correct symbols				 ***
***																   ***
***	In order for this command to work properly, your symbol path   ***
***	must point to .pdb files that have full type information.	  ***
***																   ***
***	Certain .pdb files (such as the public OS symbols) do not	  ***
***	contain the required information.  Contact the group that	  ***
***	provided you with these symbols if you need this command to	***
***	work.														  ***
***																   ***
***	Type referenced: nt!_KPRCB									 ***
***																   ***
*************************************************************************
*************************************************************************
***																   ***
***																   ***
***	Your debugger is not using the correct symbols				 ***
***																   ***
***	In order for this command to work properly, your symbol path   ***
***	must point to .pdb files that have full type information.	  ***
***																   ***
***	Certain .pdb files (such as the public OS symbols) do not	  ***
***	contain the required information.  Contact the group that	  ***
***	provided you with these symbols if you need this command to	***
***	work.														  ***
***																   ***
***	Type referenced: nt!_KPRCB									 ***
***																   ***
*************************************************************************
*************************************************************************
***																   ***
***																   ***
***	Your debugger is not using the correct symbols				 ***
***																   ***
***	In order for this command to work properly, your symbol path   ***
***	must point to .pdb files that have full type information.	  ***
***																   ***
***	Certain .pdb files (such as the public OS symbols) do not	  ***
***	contain the required information.  Contact the group that	  ***
***	provided you with these symbols if you need this command to	***
***	work.														  ***
***																   ***
***	Type referenced: nt!_KPRCB									 ***
***																   ***
*************************************************************************
*************************************************************************
***																   ***
***																   ***
***	Your debugger is not using the correct symbols				 ***
***																   ***
***	In order for this command to work properly, your symbol path   ***
***	must point to .pdb files that have full type information.	  ***
***																   ***
***	Certain .pdb files (such as the public OS symbols) do not	  ***
***	contain the required information.  Contact the group that	  ***
***	provided you with these symbols if you need this command to	***
***	work.														  ***
***																   ***
***	Type referenced: nt!_KPRCB									 ***
***																   ***
*************************************************************************
*********************************************************************
* Symbols can not be loaded because symbol path is not initialized. *
*																   *
* The Symbol Path can be set by:									*
*   using the _NT_SYMBOL_PATH environment variable.				 *
*   using the -y <symbol_path> argument when starting the debugger. *
*   using .sympath and .sympath+									*
*********************************************************************
*********************************************************************
* Symbols can not be loaded because symbol path is not initialized. *
*																   *
* The Symbol Path can be set by:									*
*   using the _NT_SYMBOL_PATH environment variable.				 *
*   using the -y <symbol_path> argument when starting the debugger. *
*   using .sympath and .sympath+									*
*********************************************************************

MODULE_NAME: nt

FAULTING_MODULE: 8283c000 nt

DEBUG_FLR_IMAGE_TIMESTAMP:  4a77feb3

WRITE_ADDRESS: unable to get nt!MmSpecialPoolStart
unable to get nt!MmSpecialPoolEnd
unable to get nt!MmPoolCodeStart
unable to get nt!MmPoolCodeEnd
b5e8375a 

FAULTING_IP: 
+ffffffffb5e8375a
b5e8375a ??			  ???

MM_INTERNAL_CODE:  2

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  WRONG_SYMBOLS

BUGCHECK_STR:  0x50

LAST_CONTROL_TRANSFER:  from 82889db4 to 828d436d

STACK_TEXT:  
WARNING: Stack unwind information not available. Following frames may be wrong.
8ade0b90 82889db4 00000008 b5e8375a 00000000 nt+0x9836d
8ade0ba8 b5e8375a badb0d00 8ade0c18 91bb99b0 nt+0x4ddb4
8ade0c30 835aeba7 872e1298 91482118 00000000 0xb5e8375a
8ade0c54 835aed64 8ade0c74 872e1298 00000000 fltmgr+0x5ba7
8ade0c8c 82880976 872e1298 91482118 91482118 fltmgr+0x5d64
8ade0ca4 82a826a1 914822cc 91482118 20206f49 nt+0x44976
8ade0cc4 82a81aa4 872e1298 9ff75630 00000001 nt+0x2466a1
8ade0d48 82886c7a 00000501 0537eb10 0537eb4c nt+0x245aa4
8ade0d64 77c05e74 badb0d00 0537eaf0 00000000 nt+0x4ac7a
8ade0d68 badb0d00 0537eaf0 00000000 00000000 0x77c05e74
8ade0d6c 0537eaf0 00000000 00000000 00000000 0xbadb0d00
8ade0d70 00000000 00000000 00000000 00000000 0x537eaf0


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt+9836d
828d436d 8b03			mov	 eax,dword ptr [ebx]

SYMBOL_STACK_INDEX:  0

SYMBOL_NAME:  nt+9836d

FOLLOWUP_NAME:  MachineOwner

IMAGE_NAME:  ntkrnlpa.exe

BUCKET_ID:  WRONG_SYMBOLS

Followup: MachineOwner

 

Rozumiem z tego, że problem powoduje ntkrnlpa.exe czymkolwiek jest, więc macie jakieś pomysły ? Wujek google nie wiele mi powiedział.

Jedyny pomysł jaki podrzuciło mi google było użycie Start -> Uruchom -> cmd -> sfc /scannow i właśnie się za to biorę.

[HoZar 227]

powodzenia w debugowaniu windowsa

 

sciągnij sonie hirensa, zbootuj i odpal memtesta

[bodex 8]

Robiłem memtesta - wszystko jest ok.

Użyłem jeszcze sigverif i mam parę niepodpisanych sterowników, może to przez któryś z nich ?

[2002JSQ 0]

Dodam, że mój debuger z zainstalowanymi symbolami wskazał powód inny:

 

Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Documents and Settings\Jasiek\Pulpit\Mini010310-05.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: C:\WINDOWS\Symbols
Executable search path is: 
Unable to load image \SystemRoot\system32\ntkrnlpa.exe, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntkrnlpa.exe
Windows Server 2008/Windows Vista Kernel Version 6002 (Service Pack 2) MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Machine Name:
Kernel base = 0x82816000 PsLoadedModuleList = 0x8292dc70
Debug session time: Sun Jan  3 21:56:19.979 2010 (GMT+1)
System Uptime: 0 days 0:00:37.727
Unable to load image \SystemRoot\system32\ntkrnlpa.exe, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntkrnlpa.exe
Loading Kernel Symbols
...............................................................
................................................................
.......................................
Loading User Symbols
Loading unloaded module list
....
*******************************************************************************
*																			 *
*						Bugcheck Analysis									*
*																			 *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1000008E, {c0000005, 25e8d75a, 8f7a67c8, 0}

Unable to load image \SystemRoot\system32\drivers\fltmgr.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for fltmgr.sys
Probably caused by : memory_corruption ( nt!MiCheckPteRelease+c4 )

Followup: MachineOwner
---------
---------

 

Nie doczytałem jaki masz system.

Sprawdzałem na lapku z XP SP3 (symbole dla tego systemu)

[bodex 8]

Mam Viste Home premium z SP2.

Hmmm na razie nie wyłączam systemu żeby do momentu wyjaśnienia tego.

Sprawdziłem u siebie z symbolami i uzyskuje teraz coś takiego:

Probably caused by : ntkrpamp.exe ( nt!IofCallDriver+63 )



Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - Instrukcja spod 0x%08lx odwo

FAULTING_IP: 
+25e8d75a
25e8d75a ??			  ???

TRAP_FRAME:  8f7a67c8 -- (.trap 0xffffffff8f7a67c8)
ErrCode = 00000010
eax=00000000 ebx=91761b30 ecx=25e8d75a edx=8f7a6838 esi=874b5020 edi=00000000
eip=25e8d75a esp=8f7a683c ebp=8f7a6850 iopl=0		 nv up ei pl nz na pe nc
cs=0008  ss=0010  ds=0023  es=0023  fs=0030  gs=0000			 efl=00010206
25e8d75a ??			  ???
Resetting default scope

CUSTOMER_CRASH_COUNT:  5

DEFAULT_BUCKET_ID:  COMMON_SYSTEM_FAULT

BUGCHECK_STR:  0x8E

PROCESS_NAME:  svchost.exe

CURRENT_IRQL:  0

LAST_CONTROL_TRANSFER:  from 8285a976 to 25e8d75a

STACK_TEXT:  
WARNING: Frame IP not in any known module. Following frames may be wrong.
8f7a6838 8285a976 874b5020 90abf6c0 90abf6c0 0x25e8d75a
8f7a6850 835aaba7 874b05e8 90abf6c0 00000000 nt!IofCallDriver+0x63
8f7a6874 835aad64 8f7a6894 874b05e8 00000000 fltmgr!FltpLegacyProcessingAfterPreCallbacksCompleted+0x251
8f7a68ac 8285a976 874b05e8 90abf6c0 90abf6c0 fltmgr!FltpDispatch+0xc2
8f7a68c4 82a5c6a1 90abf874 90abf6c0 20206f49 nt!IofCallDriver+0x63
8f7a68e4 82a5baa4 874b05e8 91bfaf80 00000001 nt!IopSynchronousServiceTail+0x1d9
8f7a6968 82860c7a 80000600 8f7a6a54 8f7a6a20 nt!NtQueryVolumeInformationFile+0x458
8f7a6968 8285f69d 80000600 8f7a6a54 8f7a6a20 nt!KiFastCallEntry+0x12a
8f7a69f4 82993462 800006f0 8f7a6a54 8f7a6a20 nt!ZwQueryVolumeInformationFile+0x11
8f7a6a60 82995fb9 8f7a6ab4 00000005 00000000 nt!CmpInitializeHive+0xd9
8f7a6ad8 82998259 8f7a6ce8 00000000 8f7a6b4c nt!CmpInitHiveFromFile+0x19e
8f7a6b18 829972b3 8f7a6ce8 8f7a6bd0 8f7a6b68 nt!CmpCmdHiveOpen+0x36
8f7a6c10 82996dbc 8f7a6cc4 8f7a6ce8 00000000 nt!CmLoadKey+0x36b
8f7a6d3c 82860c7a 0287f914 00000000 00000000 nt!NtLoadKeyEx+0x559
8f7a6d3c 77dd5e74 0287f914 00000000 00000000 nt!KiFastCallEntry+0x12a
0287fb78 00000000 00000000 00000000 00000000 0x77dd5e74


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt!IofCallDriver+63
8285a976 5e			  pop	 esi

SYMBOL_STACK_INDEX:  1

SYMBOL_NAME:  nt!IofCallDriver+63

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrpamp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  4a77feb3

FAILURE_BUCKET_ID:  0x8E_nt!IofCallDriver+63

BUCKET_ID:  0x8E_nt!IofCallDriver+63