Re: Синий экран смерти
<r><QUOTE author="const77"><s>
const77 написал(а):
</s>Добрый день. У нас собственно на данном этапе осталась одна проблема, периодический (3-4 раза в сутки) сбой системы (BSOD) со ссылкой на драйвер AMiIMFlt.sys. Мы к вам обратились в службу поддержки около месяца назад на тот момент у нас стояла версия 2.4.15. После этого мы поставили самые свежие драйвера на сетевые карты, пробовали отключать встроенный в ХP брэндмауер, устанавливали самые последние версии fpsu клиента, отсылали Вам информацию о системе (msinfo32). В службе поддержке нам даже сказали, что поняли в чем проблема и в следующей версии ошибка будет исправлена (на тот момент у нас стояла версия 2.5.1), сейчас 2.5.11, а результат тот же, разница только в том, что в версии 2.4.15 сбой был в драйвере nh.sys, а теперь в драйвере AMiIMFlt.sys. Уважаемые разработчики пожалуйста помогите решить проблему, а то уж очень эта проблема отнимает много моральных и физических сил. Машина должна работать круглосуточно, но человек не машина и не может работать круглосуточно, чтобы следить за работой fpsu клиента!!!<e>
</e></QUOTE>
Такая же ситуация! WinServer2003 SP2 R2, Версия драйвера 2.5.11. BSOD раз в сутки точно!
Прилагаю анализ дампа:
Microsoft (R) Windows Debugger Version 6.10.0003.233 X86
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [C:\Documents and Settings\Admin\Desktop\MEMORY.DMP]
Kernel Summary Dump File: Only kernel address space is available
Symbol search path is: C:\WINDOWS\Symbols
Executable search path is:
*** ERROR: Symbol file could not be found. Defaulted to export symbols for ntkrpamp.exe -
Windows Server 2003 Kernel Version 3790 (Service Pack 2) MP (4 procs) Free x86 compatible
Product: Server, suite: Enterprise TerminalServer
Built by: 3790.srv03_sp2_gdr.090319-1204
Machine Name:
Kernel base = 0x80800000 PsLoadedModuleList = 0x808a6ea8
Debug session time: Tue Jun 2 09:06:47.177 2009 (GMT+11)
System Uptime: 0 days 20:42:06.629
*** ERROR: Symbol file could not be found. Defaulted to export symbols for ntkrpamp.exe -
Loading Kernel Symbols
...............................................................
................................................
Loading User Symbols
Loading unloaded module list
.......................
*** ERROR: Module load completed but symbols could not be loaded for AmiIMFlt.sys
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck D1, {8, d0000002, 0, f6042258}
***** Kernel symbols are WRONG. Please fix symbols to do analysis.
*** ERROR: Module load completed but symbols could not be loaded for e1e5132.sys
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!KPRCB ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!KPRCB ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
*************************************************************************
Probably caused by : AmiIMFlt.sys ( AmiIMFlt+6258 )
Followup: MachineOwner
---------
2: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: 00000008, memory referenced
Arg2: d0000002, IRQL
Arg3: 00000000, value 0 = read operation, 1 = write operation
Arg4: f6042258, address which referenced memory
Debugging Details:
------------------
***** Kernel symbols are WRONG. Please fix symbols to do analysis.
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!KPRCB ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!KPRCB ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
*************************************************************************
FAULTING_MODULE: 80800000 nt
DEBUG_FLR_IMAGE_TIMESTAMP: 49ca1e28
READ_ADDRESS: unable to get nt!MmSpecialPoolStart
unable to get nt!MmSpecialPoolEnd
unable to get nt!MmPoolCodeStart
unable to get nt!MmPoolCodeEnd
00000008
CURRENT_IRQL: 0
FAULTING_IP:
AmiIMFlt+6258
f6042258 8b5108 mov edx,dword ptr [ecx+8]
DEFAULT_BUCKET_ID: WRONG_SYMBOLS
BUGCHECK_STR: 0xD1
LAST_CONTROL_TRANSFER: from f6042258 to 8088c993
STACK_TEXT:
WARNING: Stack unwind information not available. Following frames may be wrong.
f78b6b60 f6042258 badb0d00 8a2a3c50 0048c7a8 nt!Kei386EoiHelper+0x28d3
f78b6be4 f6042367 8a2a3c48 894439c8 00000000 AmiIMFlt+0x6258
f78b6bfc f603e257 894439c8 f78b6c14 8a699130 AmiIMFlt+0x6367
f78b6c1c f70b61f9 8a2a3b00 894439c8 00000000 AmiIMFlt+0x2257
f78b6c40 f60e00c8 8a699130 894439c8 00000000 NDIS!ndisMSendCompleteX+0x8a
f78b6c5c f60e8754 8a57a438 894439c8 00000000 e1e5132+0x20c8
f78b6c98 f60e6349 8a576000 00000000 f78b6cc4 e1e5132+0xa754
f78b6ccc f60e666f 00576000 8a57887c f78b6ce8 e1e5132+0x8349
f78b6cdc f60df3f1 8a576000 f78b6cf8 f709e0e8 e1e5132+0x866f
f78b6ce8 f709e0e8 8a57a438 8a578890 f78b6d50 e1e5132+0x13f1
f78b6cf8 80832110 8a578890 8a57887c 00000000 NDIS!ndisMDpcEx+0x1f
f78b6d50 8088de4f 00000000 0000000e 8d100000 nt!ZwYieldExecution+0x248c
f78b6d54 00000000 0000000e 8d100000 02000000 nt!KiDispatchInterrupt+0x32f
STACK_COMMAND: kb
FOLLOWUP_IP:
AmiIMFlt+6258
f6042258 8b5108 mov edx,dword ptr [ecx+8]
SYMBOL_STACK_INDEX: 1
SYMBOL_NAME: AmiIMFlt+6258
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: AmiIMFlt
IMAGE_NAME: AmiIMFlt.sys
BUCKET_ID: WRONG_SYMBOLS
Followup: MachineOwner
---------
2: kd> lmvm AmiIMFlt
start end module name
f603c000 f609f000 AmiIMFlt (no symbols)
Loaded symbol image file: AmiIMFlt.sys
Image path: \SystemRoot\system32\DRIVERS\AmiIMFlt.sys
Image name: AmiIMFlt.sys
Timestamp: Wed Mar 25 22:06:00 2009 (49CA1E28)
CheckSum: 0001CE56
ImageSize: 00063000
Translations: 0000.04b0 0000.04e4 0409.04b0 0409.04e4</r>