<r>Добрый день. Есть Win XP sp 3 ru. На ней установлен ФПСУ-IP / Client v 3.0.0.0 ;
Прошу помоч в ниже указанной проблеме.
На экране ПК стал появляться синий экран. Этот ПК настрое на полный дамп памяти. Я этот файл дампа прогнал через WinDbg v6.2 и вот что получилось :
<SPOILER><s>
</e></SPOILER></r>
Прошу помоч в ниже указанной проблеме.
На экране ПК стал появляться синий экран. Этот ПК настрое на полный дамп памяти. Я этот файл дампа прогнал через WinDbg v6.2 и вот что получилось :
<SPOILER><s>
</s>----------------------------------------------------------------------------------------------------
Microsoft (R) Windows Debugger Version 6.2.9200.20512 X86
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [C:\Documents and Settings\morozovsv\Рабочий стол\KASPER\ПК_Accountant_damp_mamory\Полный дамп\MEMORY.DMP]
Kernel Complete Dump File: Full address space is available
Symbol search path is: srv*c:\symbols*<URL url="http://msdl.microsoft.com/download/symbols">http://msdl.microsoft.com/download/symbols</URL>
Executable search path is:
Windows XP Kernel Version 2600 (Service Pack 3) MP (4 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 2600.xpsp_sp3_qfe.130704-0421
Machine Name:
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055d720
Debug session time: Tue Sep 10 12:26:50.786 2013 (UTC + 4:00)
System Uptime: 0 days 2:31:23.158
Loading Kernel Symbols
...............................................................
.........................................................
Loading User Symbols
Loading unloaded module list
................
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck D1, {ffffffff, 2, 0, b580d258}
*** ERROR: Module load completed but symbols could not be loaded for AmiIMFlt.sys
*** ERROR: Module load completed but symbols could not be loaded for e1q5132.sys
<B><s></s>Probably caused by : AmiIMFlt.sys ( AmiIMFlt+431b )<e></e></B>
Followup: MachineOwner
---------
0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: ffffffff, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000000, value 0 = read operation, 1 = write operation
Arg4: b580d258, address which referenced memory
Debugging Details:
------------------
READ_ADDRESS: ffffffff
CURRENT_IRQL: 2
FAULTING_IP:
psched!ClReceivePacket+90
b580d258 833e01 cmp dword ptr [esi],1
DEFAULT_BUCKET_ID: DRIVER_FAULT
BUGCHECK_STR: 0xD1
PROCESS_NAME: Idle
TRAP_FRAME: 805510e4 -- (.trap 0xffffffff805510e4)
ErrCode = 00000000
eax=00000002 ebx=8a71de98 ecx=8a67f5c0 edx=8b248102 esi=ffffffff edi=00000000
eip=b580d258 esp=80551158 ebp=80551174 iopl=0 nv up ei ng nz na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010286
psched!ClReceivePacket+0x90:
b580d258 833e01 cmp dword ptr [esi],1 ds:0023:ffffffff=????????
Resetting default scope
LAST_CONTROL_TRANSFER: from b580d258 to 8054480c
STACK_TEXT:
805510e4 b580d258 badb0d00 8b248102 80551124 nt!KiTrap0E+0x180
80551174 b7d67b9f 8a67f5b8 8a71de98 8a734104 psched!ClReceivePacket+0x90
805511c8 b583131b 00f94488 805511f4 00000001 NDIS!ethFilterDprIndicateReceivePacket+0x1c2
WARNING: Stack unwind information not available. Following frames may be wrong.
805511ec b5831525 8a71de98 00000000 8a6e7784 AmiIMFlt+0x431b
80551200 b582e8d3 00000000 8a76d130 8a6e7628 AmiIMFlt+0x4525
80551218 b582f088 8a6e7628 8a33af30 8a33af30 AmiIMFlt+0x18d3
80551234 b7d67b9f 8a6e7628 8a33af30 00000001 AmiIMFlt+0x2088
80551288 b5901150 00671b58 805512cc 00000001 NDIS!ethFilterDprIndicateReceivePacket+0x1c2
805512a8 b590124c 8a3dc000 8a3dc8c0 805512cc e1q5132+0x11150
805513dc b58ff305 8a3dc000 013dc8c0 00000000 e1q5132+0x1124c
80551404 b58fe564 8a3dc000 80551428 b7d5de99 e1q5132+0xf305
80551410 b7d5de99 8a3dc000 8055c0c0 ffdff9c0 e1q5132+0xe564
80551428 80545f9f 8a3e7dfc 8a3e7de8 00000000 NDIS!ndisMDpcX+0x21
80551450 80545e84 00000000 0000000e 00000000 nt!KiRetireDpcList+0x61
80551454 00000000 0000000e 00000000 00000000 nt!KiIdleLoop+0x28
STACK_COMMAND: kb
FOLLOWUP_IP:
AmiIMFlt+431b
b583131b 57 push edi
SYMBOL_STACK_INDEX: 3
SYMBOL_NAME: AmiIMFlt+431b
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: AmiIMFlt
IMAGE_NAME: AmiIMFlt.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 4e9d5c56
FAILURE_BUCKET_ID: 0xD1_AmiIMFlt+431b
BUCKET_ID: 0xD1_AmiIMFlt+431b
Followup: MachineOwner
---------
0: kd> lmvm AmiIMFlt
start end module name
b582d000 b58b7000 AmiIMFlt (no symbols)
Loaded symbol image file: AmiIMFlt.sys
<B><s></s> Image path: \SystemRoot\system32\DRIVERS\AmiIMFlt.sys<e></e></B>
Image name: AmiIMFlt.sys
Timestamp: Tue Oct 18 15:00:38 2011 (4E9D5C56)
CheckSum: 00026F68
ImageSize: 0008A000
Translations: 0000.04b0 0000.04e4 0409.04b0 0409.04e4
----------------------------------------------------------------------------------------------------------------------<e>
Microsoft (R) Windows Debugger Version 6.2.9200.20512 X86
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [C:\Documents and Settings\morozovsv\Рабочий стол\KASPER\ПК_Accountant_damp_mamory\Полный дамп\MEMORY.DMP]
Kernel Complete Dump File: Full address space is available
Symbol search path is: srv*c:\symbols*<URL url="http://msdl.microsoft.com/download/symbols">http://msdl.microsoft.com/download/symbols</URL>
Executable search path is:
Windows XP Kernel Version 2600 (Service Pack 3) MP (4 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 2600.xpsp_sp3_qfe.130704-0421
Machine Name:
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055d720
Debug session time: Tue Sep 10 12:26:50.786 2013 (UTC + 4:00)
System Uptime: 0 days 2:31:23.158
Loading Kernel Symbols
...............................................................
.........................................................
Loading User Symbols
Loading unloaded module list
................
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck D1, {ffffffff, 2, 0, b580d258}
*** ERROR: Module load completed but symbols could not be loaded for AmiIMFlt.sys
*** ERROR: Module load completed but symbols could not be loaded for e1q5132.sys
<B><s></s>Probably caused by : AmiIMFlt.sys ( AmiIMFlt+431b )<e></e></B>
Followup: MachineOwner
---------
0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: ffffffff, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000000, value 0 = read operation, 1 = write operation
Arg4: b580d258, address which referenced memory
Debugging Details:
------------------
READ_ADDRESS: ffffffff
CURRENT_IRQL: 2
FAULTING_IP:
psched!ClReceivePacket+90
b580d258 833e01 cmp dword ptr [esi],1
DEFAULT_BUCKET_ID: DRIVER_FAULT
BUGCHECK_STR: 0xD1
PROCESS_NAME: Idle
TRAP_FRAME: 805510e4 -- (.trap 0xffffffff805510e4)
ErrCode = 00000000
eax=00000002 ebx=8a71de98 ecx=8a67f5c0 edx=8b248102 esi=ffffffff edi=00000000
eip=b580d258 esp=80551158 ebp=80551174 iopl=0 nv up ei ng nz na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010286
psched!ClReceivePacket+0x90:
b580d258 833e01 cmp dword ptr [esi],1 ds:0023:ffffffff=????????
Resetting default scope
LAST_CONTROL_TRANSFER: from b580d258 to 8054480c
STACK_TEXT:
805510e4 b580d258 badb0d00 8b248102 80551124 nt!KiTrap0E+0x180
80551174 b7d67b9f 8a67f5b8 8a71de98 8a734104 psched!ClReceivePacket+0x90
805511c8 b583131b 00f94488 805511f4 00000001 NDIS!ethFilterDprIndicateReceivePacket+0x1c2
WARNING: Stack unwind information not available. Following frames may be wrong.
805511ec b5831525 8a71de98 00000000 8a6e7784 AmiIMFlt+0x431b
80551200 b582e8d3 00000000 8a76d130 8a6e7628 AmiIMFlt+0x4525
80551218 b582f088 8a6e7628 8a33af30 8a33af30 AmiIMFlt+0x18d3
80551234 b7d67b9f 8a6e7628 8a33af30 00000001 AmiIMFlt+0x2088
80551288 b5901150 00671b58 805512cc 00000001 NDIS!ethFilterDprIndicateReceivePacket+0x1c2
805512a8 b590124c 8a3dc000 8a3dc8c0 805512cc e1q5132+0x11150
805513dc b58ff305 8a3dc000 013dc8c0 00000000 e1q5132+0x1124c
80551404 b58fe564 8a3dc000 80551428 b7d5de99 e1q5132+0xf305
80551410 b7d5de99 8a3dc000 8055c0c0 ffdff9c0 e1q5132+0xe564
80551428 80545f9f 8a3e7dfc 8a3e7de8 00000000 NDIS!ndisMDpcX+0x21
80551450 80545e84 00000000 0000000e 00000000 nt!KiRetireDpcList+0x61
80551454 00000000 0000000e 00000000 00000000 nt!KiIdleLoop+0x28
STACK_COMMAND: kb
FOLLOWUP_IP:
AmiIMFlt+431b
b583131b 57 push edi
SYMBOL_STACK_INDEX: 3
SYMBOL_NAME: AmiIMFlt+431b
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: AmiIMFlt
IMAGE_NAME: AmiIMFlt.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 4e9d5c56
FAILURE_BUCKET_ID: 0xD1_AmiIMFlt+431b
BUCKET_ID: 0xD1_AmiIMFlt+431b
Followup: MachineOwner
---------
0: kd> lmvm AmiIMFlt
start end module name
b582d000 b58b7000 AmiIMFlt (no symbols)
Loaded symbol image file: AmiIMFlt.sys
<B><s></s> Image path: \SystemRoot\system32\DRIVERS\AmiIMFlt.sys<e></e></B>
Image name: AmiIMFlt.sys
Timestamp: Tue Oct 18 15:00:38 2011 (4E9D5C56)
CheckSum: 00026F68
ImageSize: 0008A000
Translations: 0000.04b0 0000.04e4 0409.04b0 0409.04e4
----------------------------------------------------------------------------------------------------------------------<e>