Windows 7: Dump file

jgarcia · 23 Jun 2010

Here is the dump file

jgarcia · 23 Jun 2010

Thanks for the help

jgarcia · 23 Jun 2010

My problem is this

Code:

Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Windows\Minidump\062110-28031-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: C:\websymbols
Executable search path is: 
Unable to load image \SystemRoot\system32\ntkrnlpa.exe, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntkrnlpa.exe
*** ERROR: Module load completed but symbols could not be loaded for ntkrnlpa.exe
Windows 7 Kernel Version 7600 MP (4 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16385.x86fre.win7_rtm.090713-1255
Machine Name:
Kernel base = 0x82a39000 PsLoadedModuleList = 0x82b81810
Debug session time: Mon Jun 21 22:25:33.500 2010 (GMT-5)
System Uptime: 0 days 0:00:21.437
Unable to load image \SystemRoot\system32\ntkrnlpa.exe, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntkrnlpa.exe
*** ERROR: Module load completed but symbols could not be loaded for ntkrnlpa.exe
Loading Kernel Symbols
...............................................................
................................................................
...
Loading User Symbols
Loading unloaded module list
....
*** ERROR: Symbol file could not be found. Defaulted to export symbols for win32k.sys - 
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1000008E, {c0000005, 94d9c59b, 94557bc4, 0}

***** Kernel symbols are WRONG. Please fix symbols to do analysis.

*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
*************************************************************************
Probably caused by : win32k.sys ( win32k!EngLpkInstalled+ae72 )

Followup: MachineOwner
---------

2: kd> .restart /f

Loading Dump File [C:\Windows\Minidump\062110-28031-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: C:\websymbols
Executable search path is: 
Unable to load image \SystemRoot\system32\ntkrnlpa.exe, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntkrnlpa.exe
*** ERROR: Module load completed but symbols could not be loaded for ntkrnlpa.exe
Windows 7 Kernel Version 7600 MP (4 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16385.x86fre.win7_rtm.090713-1255
Machine Name:
Kernel base = 0x82a39000 PsLoadedModuleList = 0x82b81810
Debug session time: Mon Jun 21 22:25:33.500 2010 (GMT-5)
System Uptime: 0 days 0:00:21.437
Unable to load image \SystemRoot\system32\ntkrnlpa.exe, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntkrnlpa.exe
*** ERROR: Module load completed but symbols could not be loaded for ntkrnlpa.exe
Loading Kernel Symbols
...............................................................
................................................................
...
Loading User Symbols
Loading unloaded module list
....
*** ERROR: Symbol file could not be found. Defaulted to export symbols for win32k.sys - 
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1000008E, {c0000005, 94d9c59b, 94557bc4, 0}

***** Kernel symbols are WRONG. Please fix symbols to do analysis.

*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
*************************************************************************
Probably caused by : win32k.sys ( win32k!EngLpkInstalled+ae72 )

Followup: MachineOwner
---------

2: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

KERNEL_MODE_EXCEPTION_NOT_HANDLED_M (1000008e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003. This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG. This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG. This will let us see why this breakpoint is
happening.
Arguments:
Arg1: c0000005, The exception code that was not handled
Arg2: 94d9c59b, The address that the exception occurred at
Arg3: 94557bc4, Trap Frame
Arg4: 00000000

Debugging Details:
------------------

***** Kernel symbols are WRONG. Please fix symbols to do analysis.

*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
*************************************************************************

ADDITIONAL_DEBUG_TEXT: 
Use '!findthebuild' command to search for the target build information.
If the build information is available, run '!findthebuild -s ; .reload' to set symbol path and load symbols.

MODULE_NAME: win32k

FAULTING_MODULE: 82a39000 nt

DEBUG_FLR_IMAGE_TIMESTAMP: 4a5bc2a2

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - La instrucci n en 0x%08lx hace referencia a la memoria en 0x%08lx. La memoria no se pudo %s.

FAULTING_IP: 
win32k!EngLpkInstalled+ae72
94d9c59b 8b80b8000000 mov eax,dword ptr [eax+0B8h]

TRAP_FRAME: 94557bc4 -- (.trap 0xffffffff94557bc4)
ErrCode = 00000000
eax=00000000 ebx=00000002 ecx=00000000 edx=00000000 esi=000000c0 edi=00000010
eip=94d9c59b esp=94557c38 ebp=94557c50 iopl=0 nv up ei pl nz na po nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010202
win32k!EngLpkInstalled+0xae72:
94d9c59b 8b80b8000000 mov eax,dword ptr [eax+0B8h] ds:0023:000000b8=????????
Resetting default scope

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT

BUGCHECK_STR: 0x8E

CURRENT_IRQL: 0

LAST_CONTROL_TRANSFER: from 94d9c7de to 94d9c59b

STACK_TEXT: 
WARNING: Stack unwind information not available. Following frames may be wrong.
94557c50 94d9c7de 00000000 00000000 00000010 win32k!EngLpkInstalled+0xae72
94557c7c 94da1c29 00000000 00000000 000088b8 win32k!EngLpkInstalled+0xb0b5
94557c98 94da160d 00000000 000088b8 94d4639e win32k!EngLpkInstalled+0x10500
94557cb0 94da21e2 ffb6f550 ffb6f550 ffb6f550 win32k!EngLpkInstalled+0xfee4
94557cd0 94d9e777 00000000 ffb6f550 874077c0 win32k!EngLpkInstalled+0x10ab9
94557cf4 94d9e91d ffb6f550 00000001 874077c0 win32k!EngLpkInstalled+0xd04e
94557d10 82cb2c5a 85de0118 00000001 82ba19d0 win32k!EngLpkInstalled+0xd1f4
94557d34 77ab64f4 badb0d00 0012e4bc 00000000 nt+0x279c5a
94557d38 badb0d00 0012e4bc 00000000 00000000 0x77ab64f4
94557d3c 0012e4bc 00000000 00000000 00000000 0xbadb0d00
94557d40 00000000 00000000 00000000 00000000 0x12e4bc


STACK_COMMAND: kb

FOLLOWUP_IP: 
win32k!EngLpkInstalled+ae72
94d9c59b 8b80b8000000 mov eax,dword ptr [eax+0B8h]

SYMBOL_STACK_INDEX: 0

SYMBOL_NAME: win32k!EngLpkInstalled+ae72

FOLLOWUP_NAME: MachineOwner

IMAGE_NAME: win32k.sys

BUCKET_ID: WRONG_SYMBOLS

Followup: MachineOwner

Lordbob75 · 23 Jun 2010

This seems to be caused, at least in part, by AVG. AVG is known to cause problems (one of the biggest causes here), and I recommend you remove it to check. Microsoft Security Essentials is a good alternative, and it is compatible!

Code:

Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\David\AppData\Local\Temp\Temp1_062110-28031-01.zip\062110-28031-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7600 MP (4 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16385.x86fre.win7_rtm.090713-1255
Machine Name:
Kernel base = 0x82a39000 PsLoadedModuleList = 0x82b81810
Debug session time: Mon Jun 21 20:25:33.500 2010 (UTC - 7:00)
System Uptime: 0 days 0:00:21.437
Loading Kernel Symbols
...............................................................
................................................................
...
Loading User Symbols
Loading unloaded module list
....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1000008E, {c0000005, 94d9c59b, 94557bc4, 0}

Probably caused by : win32k.sys ( win32k!HMAllocObject+29 )

Followup: MachineOwner
---------

2: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

KERNEL_MODE_EXCEPTION_NOT_HANDLED_M (1000008e)
This is a very common bugcheck.  Usually the exception address pinpoints
the driver/function that caused the problem.  Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003.  This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG.  This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG.  This will let us see why this breakpoint is
happening.
Arguments:
Arg1: c0000005, The exception code that was not handled
Arg2: 94d9c59b, The address that the exception occurred at
Arg3: 94557bc4, Trap Frame
Arg4: 00000000

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

FAULTING_IP: 
win32k!HMAllocObject+29
94d9c59b 8b80b8000000    mov     eax,dword ptr [eax+0B8h]

TRAP_FRAME:  94557bc4 -- (.trap 0xffffffff94557bc4)
ErrCode = 00000000
eax=00000000 ebx=00000002 ecx=00000000 edx=00000000 esi=000000c0 edi=00000010
eip=94d9c59b esp=94557c38 ebp=94557c50 iopl=0         nv up ei pl nz na po nc
cs=0008  ss=0010  ds=0023  es=0023  fs=0030  gs=0000             efl=00010202
win32k!HMAllocObject+0x29:
94d9c59b 8b80b8000000    mov     eax,dword ptr [eax+0B8h] ds:0023:000000b8=????????
Resetting default scope

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0x8E

PROCESS_NAME:  avgchsvx.exe

CURRENT_IRQL:  0

LAST_CONTROL_TRANSFER:  from 94d9c7de to 94d9c59b

STACK_TEXT:  
94557c50 94d9c7de 00000000 00000000 00000010 win32k!HMAllocObject+0x29
94557c7c 94da1c29 00000000 00000000 000088b8 win32k!InternalSetTimer+0x91
94557c98 94da160d 00000000 000088b8 94d4639e win32k!SetRITTimer+0x22
94557cb0 94da21e2 ffb6f550 ffb6f550 ffb6f550 win32k!SetAppStarting+0x43
94557cd0 94d9e777 00000000 ffb6f550 874077c0 win32k!xxxInitProcessInfo+0xb4
94557cf4 94d9e91d ffb6f550 00000001 874077c0 win32k!xxxUserProcessCallout+0x1f
94557d10 82cb2c5a 85de0118 00000001 82ba19d0 win32k!W32pProcessCallout+0x43
94557d24 82a7c0ee 000010e6 0012e4bc 0012e4c0 nt!PsConvertToGuiThread+0x47
94557d34 77ab64f4 badb0d00 0012e4bc 00000000 nt!KiBBTUnexpectedRange+0xc
WARNING: Frame IP not in any known module. Following frames may be wrong.
94557d38 badb0d00 0012e4bc 00000000 00000000 0x77ab64f4
94557d3c 0012e4bc 00000000 00000000 00000000 0xbadb0d00
94557d40 00000000 00000000 00000000 00000000 0x12e4bc


STACK_COMMAND:  kb

FOLLOWUP_IP: 
win32k!HMAllocObject+29
94d9c59b 8b80b8000000    mov     eax,dword ptr [eax+0B8h]

SYMBOL_STACK_INDEX:  0

SYMBOL_NAME:  win32k!HMAllocObject+29

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: win32k

IMAGE_NAME:  win32k.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4a5bc2a2

FAILURE_BUCKET_ID:  0x8E_win32k!HMAllocObject+29

BUCKET_ID:  0x8E_win32k!HMAllocObject+29

Followup: MachineOwner
---------

~Lordbob

ttran · 24 Jun 2010

Hi there
I also see that you have some old drivers, please download and install fresh copy of them:

First of all, nVidia Storage Driver (nForce chipset driver), need to be updated:

Code:

nvstor32 nvstor32.sys Tue Aug 19 08:53:17 2008 (48AA278D)

Secondly, nVidia Networking Controller Driver (nForce chipset driver), need to be updated as wells:

Code:

nvmfdx32 nvmfdx32.sys Wed Mar 26 01:49:06 2008 (47E94922)

And this, date from 1996

Code:

giveio   giveio.sys   Thu Apr 04 09:33:25 1996 (316334F5)

Good Luck buddie
~Tuan

jgarcia · 25 Jun 2010

thanks for the help

jgarcia · 25 Jun 2010

according to what happens I am commenting

Windows 7: Dump file

Dump file problems?