hello cluberti thanks for the quick reply here is my dmp file if you can figure out whats going wrong.. Microsoft ® Windows Debugger Version 6.9.0003.113 X86 Copyright © Microsoft Corporation. All rights reserved. Loading Dump File [C:\Users\at\Desktop\Mini103108-01.dmp] Mini Kernel Dump File: Only registers and stack trace are available Symbol search path is: C:\Windows\symbols Executable search path is: Unable to load image ntoskrnl.exe, Win32 error 0n2 *** WARNING: Unable to verify timestamp for ntoskrnl.exe *** ERROR: Module load completed but symbols could not be loaded for ntoskrnl.exe Windows XP Kernel Version 2600 (Service Pack 3) MP (2 procs) Free x86 compatible Product: WinNt, suite: TerminalServer SingleUserTS Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055d720 Debug session time: Fri Oct 31 16:53:32.656 2008 (GMT+2) System Uptime: 0 days 0:02:30.338 Unable to load image ntoskrnl.exe, Win32 error 0n2 *** WARNING: Unable to verify timestamp for ntoskrnl.exe *** ERROR: Module load completed but symbols could not be loaded for ntoskrnl.exe Loading Kernel Symbols .................................................................................................... .............. Loading User Symbols Loading unloaded module list ....... ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* Use !analyze -v to get detailed debugging information. BugCheck 1000000A, {c0e12438, 1, 0, 80505f17} ***** Kernel symbols are WRONG. Please fix symbols to do analysis. *** WARNING: Unable to verify timestamp for Ntfs.sys ************************************************************************* *** *** *** *** *** Your debugger is not using the correct symbols *** *** *** *** In order for this command to work properly, your symbol path *** *** must point to .pdb files that have full type information. *** *** *** *** Certain .pdb files (such as the public OS symbols) do not *** *** contain the required information. Contact the group that *** *** provided you with these symbols if you need this command to *** *** work. *** *** *** *** Type referenced: nt!_KPRCB *** *** *** ************************************************************************* ************************************************************************* *** *** *** *** *** Your debugger is not using the correct symbols *** *** *** *** In order for this command to work properly, your symbol path *** *** must point to .pdb files that have full type information. *** *** *** *** Certain .pdb files (such as the public OS symbols) do not *** *** contain the required information. Contact the group that *** *** provided you with these symbols if you need this command to *** *** work. *** *** *** *** Type referenced: nt!KPRCB *** *** *** ************************************************************************* ************************************************************************* *** *** *** *** *** Your debugger is not using the correct symbols *** *** *** *** In order for this command to work properly, your symbol path *** *** must point to .pdb files that have full type information. *** *** *** *** Certain .pdb files (such as the public OS symbols) do not *** *** contain the required information. Contact the group that *** *** provided you with these symbols if you need this command to *** *** work. *** *** *** *** Type referenced: nt!_KPRCB *** *** *** ************************************************************************* ************************************************************************* *** *** *** *** *** Your debugger is not using the correct symbols *** *** *** *** In order for this command to work properly, your symbol path *** *** must point to .pdb files that have full type information. *** *** *** *** Certain .pdb files (such as the public OS symbols) do not *** *** contain the required information. Contact the group that *** *** provided you with these symbols if you need this command to *** *** work. *** *** *** *** Type referenced: nt!KPRCB *** *** *** ************************************************************************* ************************************************************************* *** *** *** *** *** Your debugger is not using the correct symbols *** *** *** *** In order for this command to work properly, your symbol path *** *** must point to .pdb files that have full type information. *** *** *** *** Certain .pdb files (such as the public OS symbols) do not *** *** contain the required information. Contact the group that *** *** provided you with these symbols if you need this command to *** *** work. *** *** *** *** Type referenced: nt!_KPRCB *** *** *** ************************************************************************* ************************************************************************* *** *** *** *** *** Your debugger is not using the correct symbols *** *** *** *** In order for this command to work properly, your symbol path *** *** must point to .pdb files that have full type information. *** *** *** *** Certain .pdb files (such as the public OS symbols) do not *** *** contain the required information. Contact the group that *** *** provided you with these symbols if you need this command to *** *** work. *** *** *** *** Type referenced: nt!_KPRCB *** *** *** ************************************************************************* ************************************************************************* *** *** *** *** *** Your debugger is not using the correct symbols *** *** *** *** In order for this command to work properly, your symbol path *** *** must point to .pdb files that have full type information. *** *** *** *** Certain .pdb files (such as the public OS symbols) do not *** *** contain the required information. Contact the group that *** *** provided you with these symbols if you need this command to *** *** work. *** *** *** *** Type referenced: nt!_KPRCB *** *** *** ************************************************************************* Probably caused by : ntoskrnl.exe ( nt+2ef17 ) Followup: MachineOwner --------- 0: kd> !analyze -v ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* IRQL_NOT_LESS_OR_EQUAL (a) An attempt was made to access a pageable (or completely invalid) address at an interrupt request level (IRQL) that is too high. This is usually caused by drivers using improper addresses. If a kernel debugger is available get the stack backtrace. Arguments: Arg1: c0e12438, memory referenced Arg2: 00000001, IRQL Arg3: 00000000, bitfield : bit 0 : value 0 = read operation, 1 = write operation bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status) Arg4: 80505f17, address which referenced memory Debugging Details: ------------------ ***** Kernel symbols are WRONG. Please fix symbols to do analysis. ************************************************************************* *** *** *** *** *** Your debugger is not using the correct symbols *** *** *** *** In order for this command to work properly, your symbol path *** *** must point to .pdb files that have full type information. *** *** *** *** Certain .pdb files (such as the public OS symbols) do not *** *** contain the required information. Contact the group that *** *** provided you with these symbols if you need this command to *** *** work. *** *** *** *** Type referenced: nt!_KPRCB *** *** *** ************************************************************************* ************************************************************************* *** *** *** *** *** Your debugger is not using the correct symbols *** *** *** *** In order for this command to work properly, your symbol path *** *** must point to .pdb files that have full type information. *** *** *** *** Certain .pdb files (such as the public OS symbols) do not *** *** contain the required information. Contact the group that *** *** provided you with these symbols if you need this command to *** *** work. *** *** *** *** Type referenced: nt!KPRCB *** *** *** ************************************************************************* ************************************************************************* *** *** *** *** *** Your debugger is not using the correct symbols *** *** *** *** In order for this command to work properly, your symbol path *** *** must point to .pdb files that have full type information. *** *** *** *** Certain .pdb files (such as the public OS symbols) do not *** *** contain the required information. Contact the group that *** *** provided you with these symbols if you need this command to *** *** work. *** *** *** *** Type referenced: nt!_KPRCB *** *** *** ************************************************************************* ************************************************************************* *** *** *** *** *** Your debugger is not using the correct symbols *** *** *** *** In order for this command to work properly, your symbol path *** *** must point to .pdb files that have full type information. *** *** *** *** Certain .pdb files (such as the public OS symbols) do not *** *** contain the required information. Contact the group that *** *** provided you with these symbols if you need this command to *** *** work. *** *** *** *** Type referenced: nt!KPRCB *** *** *** ************************************************************************* ************************************************************************* *** *** *** *** *** Your debugger is not using the correct symbols *** *** *** *** In order for this command to work properly, your symbol path *** *** must point to .pdb files that have full type information. *** *** *** *** Certain .pdb files (such as the public OS symbols) do not *** *** contain the required information. Contact the group that *** *** provided you with these symbols if you need this command to *** *** work. *** *** *** *** Type referenced: nt!_KPRCB *** *** *** ************************************************************************* ************************************************************************* *** *** *** *** *** Your debugger is not using the correct symbols *** *** *** *** In order for this command to work properly, your symbol path *** *** must point to .pdb files that have full type information. *** *** *** *** Certain .pdb files (such as the public OS symbols) do not *** *** contain the required information. Contact the group that *** *** provided you with these symbols if you need this command to *** *** work. *** *** *** *** Type referenced: nt!_KPRCB *** *** *** ************************************************************************* ************************************************************************* *** *** *** *** *** Your debugger is not using the correct symbols *** *** *** *** In order for this command to work properly, your symbol path *** *** must point to .pdb files that have full type information. *** *** *** *** Certain .pdb files (such as the public OS symbols) do not *** *** contain the required information. Contact the group that *** *** provided you with these symbols if you need this command to *** *** work. *** *** *** *** Type referenced: nt!_KPRCB *** *** *** ************************************************************************* MODULE_NAME: nt FAULTING_MODULE: 804d7000 nt DEBUG_FLR_IMAGE_TIMESTAMP: 48a3fbd9 READ_ADDRESS: unable to get nt!MmSpecialPoolStart unable to get nt!MmSpecialPoolEnd unable to get nt!MmPoolCodeStart unable to get nt!MmPoolCodeEnd c0e12438 CURRENT_IRQL: 1 FAULTING_IP: nt+2ef17 80505f17 8b0c81 mov ecx,dword ptr [ecx+eax*4] CUSTOMER_CRASH_COUNT: 1 DEFAULT_BUCKET_ID: WRONG_SYMBOLS BUGCHECK_STR: 0xA LAST_CONTROL_TRANSFER: from 8051af5d to 80505f17 STACK_TEXT: WARNING: Stack unwind information not available. Following frames may be wrong. a8b0c404 8051af5d c0e0003c 898f8da8 00000000 nt+0x2ef17 a8b0c458 804e2480 c6e34000 00000000 a8b0c584 nt+0x43f5d a8b0c4a0 804e3f0a 89ba0008 a8b0c4e0 00001000 nt+0xb480 a8b0c534 8056a5ab 89ba7258 a8b0c574 00001000 nt+0xcf0a a8b0c5a8 b9e67bc3 89ba7258 a8b0c5e8 00001000 nt+0x935ab a8b0c628 b9e67d21 e13da830 e100fb50 00000028 Ntfs!NtfsRepairItem+0x2f1 a8b0c63c b9e679a2 e13da830 00000010 e100fb50 Ntfs!NtfsRepairItem+0x44f a8b0c66c b9e676d6 e13da830 e100fb50 00000001 Ntfs!NtfsRepairItem+0xd0 a8b0c748 b9e671ff e100fb50 00000001 a8b0c808 Ntfs!NtfsVerifyAndFixFileRecord+0xa08 a8b0c8cc b9e6759a 89ae3a40 89b9b320 00000000 Ntfs!NtfsVerifyAndFixFileRecord+0x531 a8b0c92c b9e70ffc 89ae3a40 e15d3988 e15d3a50 Ntfs!NtfsVerifyAndFixFileRecord+0x8cc a8b0c940 b9e71f46 89ae3a40 89ae3a40 e15d3a50 Ntfs!TxfFsctlRollforwardUndo+0x1e2 a8b0ca14 b9e71d6b 89ae3a40 898fc6f0 89423b40 Ntfs!TxfHandleRecoveryError+0x32a a8b0ca84 b9e49b3b 89ae3a40 89423b40 898fc6f0 Ntfs!TxfHandleRecoveryError+0x14f a8b0caec 804ef19f 89ba5020 89423b40 89423b50 Ntfs!WPP_SF_D+0x13 a8b0cb84 8054162c 80000638 a8b0cc38 a8b0cc48 nt+0x1819f a8b0cba0 80500ecd badb0d00 a8b0cc18 ffffffff nt+0x6a62c a8b0cc50 8063b454 e150b700 00000001 00000400 nt+0x29ecd a8b0ccd8 8063b8ce e150b758 00000000 e150b758 nt+0x164454 a8b0ccf0 80632a96 e150b701 e13dd5c8 00000000 nt+0x1648ce a8b0cd04 8062452e e150b758 00000120 a8b0cd64 nt+0x15ba96 a8b0cd58 8054162c 000000fc 00a8f770 7c91e4f4 nt+0x14d52e a8b0cd64 7c91e4f4 badb0d00 00a8f758 00000000 nt+0x6a62c a8b0cd68 badb0d00 00a8f758 00000000 00000000 0x7c91e4f4 a8b0cd6c 00a8f758 00000000 00000000 00000000 0xbadb0d00 a8b0cd70 00000000 00000000 00000000 00000000 0xa8f758 STACK_COMMAND: kb FOLLOWUP_IP: nt+2ef17 80505f17 8b0c81 mov ecx,dword ptr [ecx+eax*4] SYMBOL_STACK_INDEX: 0 SYMBOL_NAME: nt+2ef17 FOLLOWUP_NAME: MachineOwner IMAGE_NAME: ntoskrnl.exe BUCKET_ID: WRONG_SYMBOLS Followup: MachineOwner ---------
