BSOD in windows 7

jgarcia · 22 Jun 2010

My problem is this

Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
Copyright (c) Microsoft Corporation. All rights reserved.

Loading Dump File [C:\Windows\Minidump\062110-28031-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: C:\websymbols
Executable search path is:
Unable to load image \SystemRoot\system32\ntkrnlpa.exe, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntkrnlpa.exe
*** ERROR: Module load completed but symbols could not be loaded for ntkrnlpa.exe
Windows 7 Kernel Version 7600 MP (4 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16385.x86fre.win7_rtm.090713-1255
Machine Name:
Kernel base = 0x82a39000 PsLoadedModuleList = 0x82b81810
Debug session time: Mon Jun 21 22:25:33.500 2010 (GMT-5)
System Uptime: 0 days 0:00:21.437
Unable to load image \SystemRoot\system32\ntkrnlpa.exe, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntkrnlpa.exe
*** ERROR: Module load completed but symbols could not be loaded for ntkrnlpa.exe
Loading Kernel Symbols
...............................................................
................................................................
...
Loading User Symbols
Loading unloaded module list
....
*** ERROR: Symbol file could not be found. Defaulted to export symbols for win32k.sys -
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1000008E, {c0000005, 94d9c59b, 94557bc4, 0}

***** Kernel symbols are WRONG. Please fix symbols to do analysis.

*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
*************************************************************************
Probably caused by : win32k.sys ( win32k!EngLpkInstalled+ae72 )

Followup: MachineOwner
---------

2: kd> .restart /f

Loading Dump File [C:\Windows\Minidump\062110-28031-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: C:\websymbols
Executable search path is:
Unable to load image \SystemRoot\system32\ntkrnlpa.exe, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntkrnlpa.exe
*** ERROR: Module load completed but symbols could not be loaded for ntkrnlpa.exe
Windows 7 Kernel Version 7600 MP (4 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16385.x86fre.win7_rtm.090713-1255
Machine Name:
Kernel base = 0x82a39000 PsLoadedModuleList = 0x82b81810
Debug session time: Mon Jun 21 22:25:33.500 2010 (GMT-5)
System Uptime: 0 days 0:00:21.437
Unable to load image \SystemRoot\system32\ntkrnlpa.exe, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntkrnlpa.exe
*** ERROR: Module load completed but symbols could not be loaded for ntkrnlpa.exe
Loading Kernel Symbols
...............................................................
................................................................
...
Loading User Symbols
Loading unloaded module list
....
*** ERROR: Symbol file could not be found. Defaulted to export symbols for win32k.sys -
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1000008E, {c0000005, 94d9c59b, 94557bc4, 0}

***** Kernel symbols are WRONG. Please fix symbols to do analysis.

*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
*************************************************************************
Probably caused by : win32k.sys ( win32k!EngLpkInstalled+ae72 )

Followup: MachineOwner
---------

2: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

KERNEL_MODE_EXCEPTION_NOT_HANDLED_M (1000008e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003. This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG. This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG. This will let us see why this breakpoint is
happening.
Arguments:
Arg1: c0000005, The exception code that was not handled
Arg2: 94d9c59b, The address that the exception occurred at
Arg3: 94557bc4, Trap Frame
Arg4: 00000000

Debugging Details:
------------------

***** Kernel symbols are WRONG. Please fix symbols to do analysis.

*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
*************************************************************************

ADDITIONAL_DEBUG_TEXT:
Use '!findthebuild' command to search for the target build information.
If the build information is available, run '!findthebuild -s ; .reload' to set symbol path and load symbols.

MODULE_NAME: win32k

FAULTING_MODULE: 82a39000 nt

DEBUG_FLR_IMAGE_TIMESTAMP: 4a5bc2a2

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - La instrucci n en 0x%08lx hace referencia a la memoria en 0x%08lx. La memoria no se pudo %s.

FAULTING_IP:
win32k!EngLpkInstalled+ae72
94d9c59b 8b80b8000000 mov eax,dword ptr [eax+0B8h]

TRAP_FRAME: 94557bc4 -- (.trap 0xffffffff94557bc4)
ErrCode = 00000000
eax=00000000 ebx=00000002 ecx=00000000 edx=00000000 esi=000000c0 edi=00000010
eip=94d9c59b esp=94557c38 ebp=94557c50 iopl=0 nv up ei pl nz na po nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010202
win32k!EngLpkInstalled+0xae72:
94d9c59b 8b80b8000000 mov eax,dword ptr [eax+0B8h] ds:0023:000000b8=????????
Resetting default scope

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT

BUGCHECK_STR: 0x8E

CURRENT_IRQL: 0

LAST_CONTROL_TRANSFER: from 94d9c7de to 94d9c59b

STACK_TEXT:
WARNING: Stack unwind information not available. Following frames may be wrong.
94557c50 94d9c7de 00000000 00000000 00000010 win32k!EngLpkInstalled+0xae72
94557c7c 94da1c29 00000000 00000000 000088b8 win32k!EngLpkInstalled+0xb0b5
94557c98 94da160d 00000000 000088b8 94d4639e win32k!EngLpkInstalled+0x10500
94557cb0 94da21e2 ffb6f550 ffb6f550 ffb6f550 win32k!EngLpkInstalled+0xfee4
94557cd0 94d9e777 00000000 ffb6f550 874077c0 win32k!EngLpkInstalled+0x10ab9
94557cf4 94d9e91d ffb6f550 00000001 874077c0 win32k!EngLpkInstalled+0xd04e
94557d10 82cb2c5a 85de0118 00000001 82ba19d0 win32k!EngLpkInstalled+0xd1f4
94557d34 77ab64f4 badb0d00 0012e4bc 00000000 nt+0x279c5a
94557d38 badb0d00 0012e4bc 00000000 00000000 0x77ab64f4
94557d3c 0012e4bc 00000000 00000000 00000000 0xbadb0d00
94557d40 00000000 00000000 00000000 00000000 0x12e4bc

STACK_COMMAND: kb

FOLLOWUP_IP:
win32k!EngLpkInstalled+ae72
94d9c59b 8b80b8000000 mov eax,dword ptr [eax+0B8h]

SYMBOL_STACK_INDEX: 0

SYMBOL_NAME: win32k!EngLpkInstalled+ae72

FOLLOWUP_NAME: MachineOwner

IMAGE_NAME: win32k.sys

BUCKET_ID: WRONG_SYMBOLS

Followup: MachineOwner
---------

Please helpme

richc46 · 22 Jun 2010

All the members will be anxious to help, if you upload the information in the proper format.
https://www.sevenforums.com/tutorials...en-forums.html

Required information is not available in the format that you presented.

fishnbanjo · 23 Jun 2010

Agree with richc46 your mini.dmp file for this BSOD would help.

In the mean time here are some things you should consider doing. Download Memtest then run it a minimum of 5 cycles to ensure your RAM is functioning error free.

Go to start and type scannow /sfc in the box then right mouse click on it when it comes up at the top and choose run as administrator. This will identify any corrupt files which will either be repaired or the need to run a repair installation will become known.

Finally make sure your drivers, firmware and BIOS are all up to date, this will eliminate the bulk of problems causing a BSOD.

Jonathan_King · 23 Jun 2010

I agree with Rich, we need the dump files.

You didn't have the correct symbols loaded.

Code:

Symbol search path is: C:\websymbols

If you extracted the symbol packages to C:\Websymbols, load this for the Symbols path: SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols

As for the other generic BSOD troubleshooting steps, I don't recommend doing them at this point. It won't take us long to look at the dumps, and the time it takes to run Memtest alone will take longer.

jgarcia · 23 Jun 2010

It went up the dump file, and thanks for answering