Здравствуйте у меня 2 раза был синий экран с разными ошибками
вот 1:
Microsoft ® Windows Debugger Version 6.11.0001.404 X86
Copyright © Microsoft Corporation. All rights reserved.
Loading Dump File [C:\Windows\Minidump\010411-13203-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: srv*C:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: srv*C:\symbols*http://msdl.microsoft.com/download/symbols
Windows 7 Kernel Version 7600 MP (4 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16385.x86fre.win7_rtm.090713-1255
Machine Name:
Kernel base = 0x82a3d000 PsLoadedModuleList = 0x82b85810
Debug session time: Tue Jan 4 16:58:50.977 2011 (GMT+2)
System Uptime: 0 days 0:03:31.915
Loading Kernel Symbols
...............................................................
................................................................
..............................
Loading User Symbols
Loading unloaded module list
........
Unable to load image \SystemRoot\system32\DRIVERS\ewusbnet.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ewusbnet.sys
*** ERROR: Module load completed but symbols could not be loaded for ewusbnet.sys
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 1000007E, {c0000005, 9636f8bd, 9b65bba8, 9b65b780}
Probably caused by : ewusbnet.sys ( ewusbnet+28bd )
Followup: MachineOwner
---------
3: kd> kd: Reading initial command '!analyze -v; q'
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
SYSTEM_THREAD_EXCEPTION_NOT_HANDLED_M (1000007e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003. This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG. This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG. This will let us see why this breakpoint is
happening.
Arguments:
Arg1: c0000005, The exception code that was not handled
Arg2: 9636f8bd, The address that the exception occurred at
Arg3: 9b65bba8, Exception Record Address
Arg4: 9b65b780, Context Record Address
Debugging Details:
------------------
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - <Unable to get error code text>
FAULTING_IP:
ewusbnet+28bd
9636f8bd f6400605 test byte ptr [eax+6],5
EXCEPTION_RECORD: 9b65bba8 -- (.exr 0xffffffff9b65bba8)
ExceptionAddress: 9636f8bd (ewusbnet+0x000028bd)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 00000000
Parameter[1]: 00000006
Attempt to read from address 00000006
CONTEXT: 9b65b780 -- (.cxr 0xffffffff9b65b780)
eax=00000000 ebx=8771510c ecx=00000008 edx=00000000 esi=87715000 edi=87715108
eip=9636f8bd esp=9b65bc70 ebp=9b65bc84 iopl=0 nv up ei pl nz na po nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010202
ewusbnet+0x28bd:
9636f8bd f6400605 test byte ptr [eax+6],5 ds:0023:00000006=??
Resetting default scope
CUSTOMER_CRASH_COUNT: 1
PROCESS_NAME: System
CURRENT_IRQL: 0
ERROR_CODE: (NTSTATUS) 0xc0000005 - <Unable to get error code text>
EXCEPTION_PARAMETER1: 00000000
EXCEPTION_PARAMETER2: 00000006
READ_ADDRESS: GetPointerFromAddress: unable to read from 82ba5718
Unable to read MiSystemVaType memory at 82b85160
00000006
FOLLOWUP_IP:
ewusbnet+28bd
9636f8bd f6400605 test byte ptr [eax+6],5
BUGCHECK_STR: 0x7E
DEFAULT_BUCKET_ID: NULL_CLASS_PTR_DEREFERENCE
LAST_CONTROL_TRANSFER: from 82aa5b33 to 9636f8bd
STACK_TEXT:
WARNING: Stack unwind information not available. Following frames may be wrong.
9b65bc84 82aa5b33 00000000 84d91808 0000003a ewusbnet+0x28bd
9b65bcc8 9637f338 82a79443 86d58008 874e8cc8 nt!IopfCompleteRequest+0x128
9b65bcdc 9637e70f 86d58008 86d58ab8 86d58184 ewusbnet+0x12338
9b65bd50 82c4b66d 01d58008 beaa91cc 00000000 ewusbnet+0x1170f
9b65bd90 82afd0d9 9637e27a 86d58008 00000000 nt!PspSystemThreadStartup+0x9e
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x19
SYMBOL_STACK_INDEX: 0
SYMBOL_NAME: ewusbnet+28bd
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: ewusbnet
IMAGE_NAME: ewusbnet.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 4bbc6b2a
STACK_COMMAND: .cxr 0xffffffff9b65b780 ; kb
FAILURE_BUCKET_ID: 0x7E_ewusbnet+28bd
BUCKET_ID: 0x7E_ewusbnet+28bd
Followup: MachineOwner
Вот 2:
Microsoft ® Windows Debugger Version 6.11.0001.404 X86
Copyright © Microsoft Corporation. All rights reserved.
Loading Dump File [C:\Windows\Minidump\010311-17203-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: srv*C:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: srv*C:\symbols*http://msdl.microsoft.com/download/symbols
*** ERROR: Symbol file could not be found. Defaulted to export symbols for ntkrpamp.exe -
Windows 7 Kernel Version 7600 MP (4 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16385.x86fre.win7_rtm.090713-1255
Machine Name:
Kernel base = 0x82a10000 PsLoadedModuleList = 0x82b58810
Debug session time: Mon Jan 3 13:50:00.928 2011 (GMT+2)
System Uptime: 0 days 2:47:11.866
*** ERROR: Symbol file could not be found. Defaulted to export symbols for ntkrpamp.exe -
Loading Kernel Symbols
...............................................................
................................................................
.............................
Loading User Symbols
Loading unloaded module list
.........
2: kd> kd: Reading initial command '!analyze -v; q'
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
REFERENCE_BY_POINTER (18)
Arguments:
Arg1: 00000000, Object type of the object whose reference count is being lowered
Arg2: 8583f7d0, Object whose reference count is being lowered
Arg3: 00000002, Reserved
Arg4: ffffffff, Reserved
The reference count of an object is illegal for the current state of the object.
Each time a driver uses a pointer to an object the driver calls a kernel routine
to increment the reference count of the object. When the driver is done with the
pointer the driver calls another kernel routine to decrement the reference count.
Drivers must match calls to the increment and decrement routines. This bugcheck
can occur because an object's reference count goes to zero while there are still
open handles to the object, in which case the fourth parameter indicates the number
of opened handles. It may also occur when the object?s reference count drops below zero
whether or not there are open handles to the object, and in that case the fourth parameter
contains the actual value of the pointer references count.
Debugging Details:
------------------
***** Kernel symbols are WRONG. Please fix symbols to do analysis.
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
*************************************************************************
ADDITIONAL_DEBUG_TEXT:
Use '!findthebuild' command to search for the target build information.
If the build information is available, run '!findthebuild -s ; .reload' to set symbol path and load symbols.
MODULE_NAME: nt
FAULTING_MODULE: 82a10000 nt
DEBUG_FLR_IMAGE_TIMESTAMP: 4a5bc007
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
BUGCHECK_STR: 0x18
CURRENT_IRQL: 0
LAST_CONTROL_TRANSFER: from 82a78f22 to 82aecd10
STACK_TEXT:
WARNING: Stack unwind information not available. Following frames may be wrong.
9a9efaf0 82a78f22 00000018 00000000 8583f7d0 nt!KeBugCheckEx+0x1e
9a9efb14 82a78ed0 8583f7d0 88fede96 86822448 nt!ObfDereferenceObjectWithTag+0x4b
00000000 00000000 00000000 00000000 00000000 nt!ObfDereferenceObject+0xd
STACK_COMMAND: kb
FOLLOWUP_IP:
nt!ObfDereferenceObjectWithTag+4b
82a78f22 cc int 3
SYMBOL_STACK_INDEX: 1
SYMBOL_NAME: nt!ObfDereferenceObjectWithTag+4b
FOLLOWUP_NAME: MachineOwner
IMAGE_NAME: ntkrpamp.exe
BUCKET_ID: WRONG_SYMBOLS
Followup: MachineOwner
Помогите разобраться. ЗАРАНЕЕ спасибо.
![[Изображение: 05cf82eda7e45b0df1cc2f534b77eb03.jpeg]](http://fastpic.ru/view/13/2011/0105/05cf82eda7e45b0df1cc2f534b77eb03.png.html)