--- title: "Felsökning" type: "forum-thread" url: "https://www.webforum.nu/amne/datorhardvara/113683-felsökning" topic: "Datorhårdvara" topic_url: "https://www.webforum.nu/amne/datorhardvara" author: "Nicrosoft" published: "2004-10-16T16:13:06.000Z" updated: "2004-10-16T16:27:27.000Z" replies: 1 views: 213 page: 1 pages: 1 language: "sv-SE" site: "webForum — webforum.nu" rights: "Upphovsrätten till varje inlägg tillhör dess författare." attribution: "Citera som: webForum, https://www.webforum.nu/amne/datorhardvara/113683-felsökning" --- # Felsökning ## #1 — Nicrosoft, 2004-10-16T16:13Z Jag har fått lite konstiga blåskärmar och omstarter sista veckan. Pillade lite med debuggingtools nu... Som jag tolkar det så är det npdriver.sys som krånglar. Söker jag i datorn så är det en fil som hör till norton antivirus\\advTools. Det naturliga nu känns som att installera om norton. Finns det något annat att göra? > **debuggintools skrev:** > > Microsoft (R) Windows Debugger Version 6.3.0017.0 > Copyright (c) Microsoft Corporation. All rights reserved. > > > Loading Dump File \[C:\\WINDOWS\\MEMORY.DMP\] > Kernel Complete Dump File: Full address space is available > > Symbol search path is: SRV\*c:\\websymbols\* > Executable search path is: > Windows XP Kernel Version 2600 (Service Pack 2) MP (2 procs) Free x86 compatible > Product: WinNt, suite: TerminalServer SingleUserTS > Built by: 2600.xpsp_sp2_rtm.040803-2158 > Kernel base = 0x804d7000 PsLoadedModuleList = 0x805644a0 > Debug session time: Sat Oct 16 17:09:07 2004 > System Uptime: 0 days 4:25:10.738 > Loading Kernel Symbols > ................................................................................................................................................................ > Loading unloaded module list > .................................................. > Loading User Symbols > .................................................................................................................. > \*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\* > \* \* > \* Bugcheck Analysis \* > \* \* > \*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\* > > Use !analyze -v to get detailed debugging information. > > BugCheck 8E, {c0000047, 80522362, eea413b4, 0} > > \*\*\* ERROR: Symbol file could not be found. Defaulted to export symbols for SYMEVENT.SYS - > Probably caused by : NPDRIVER.SYS ( NPDRIVER+5e96 ) > > Followup: MachineOwner > \--------- > > 0: kd\> !analyze -v > \*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\* > \* \* > \* Bugcheck Analysis \* > \* \* > \*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\* > > KERNEL_MODE_EXCEPTION_NOT_HANDLED (8e) > This is a very common bugcheck. Usually the exception address pinpoints > the driver/function that caused the problem. Always note this address > as well as the link date of the driver/image that contains this address. > Some common problems are exception code 0x80000003. This means a hard > coded breakpoint or assertion was hit, but this system was booted > /NODEBUG. This is not supposed to happen as developers should never have > hardcoded breakpoints in retail code, but ... > If this happens, make sure a debugger gets connected, and the > system is booted /DEBUG. This will let us see why this breakpoint is > happening. > An exception code of 0x80000002 (STATUS_DATATYPE_MISALIGNMENT) indicates > that an unaligned data reference was encountered. The trap frame will > supply additional information. > Arguments: > Arg1: c0000047, The exception code that was not handled > Arg2: 80522362, The address that the exception occurred at > Arg3: eea413b4, Trap Frame > Arg4: 00000000 > > Debugging Details: > \------------------ > > > EXCEPTION_CODE: (NTSTATUS) 0xc0000047 - Ett f rs k gjordes att sl ppa en semafor s att dess maximalt till tna v rde skulle ha verskridits. > > FAULTING_IP: > nt!KeReleaseSemaphore+3a > 80522362 e9d585fcff jmp nt!KeReleaseSemaphore+0x3a (804ea93c) > > TRAP_FRAME: eea413b4 -- (.trap ffffffffeea413b4) > ESP EDITED! New esp=eea41764 > ErrCode = 00000000 > eax=00000000 ebx=00000001 ecx=00000000 edx=00000000 esi=86181970 edi=00000002 > eip=80522362 esp=eea41428 ebp=eea41778 iopl=0 nv up ei pl zr na po nc > cs=0000 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00000246 > nt!KeReleaseSemaphore+0x3a: > 80522362 e9d585fcff jmp nt!KeReleaseSemaphore+0x3a (804ea93c) > Resetting default scope > > DEFAULT_BUCKET_ID: DRIVER_FAULT > > BUGCHECK_STR: 0x8E > > LAST_CONTROL_TRANSFER: from f1849e96 to 80522362 > > STACK_TEXT: > eea41778 f1849e96 86181970 00000000 00000001 nt!KeReleaseSemaphore+0x3a > WARNING: Stack unwind information not available. Following frames may be wrong. > eea41794 f1847b08 861816d0 eea41b7c f1849166 NPDRIVER+0x5e96 > eea417a0 f1849166 e31cade8 00000000 00002001 NPDRIVER+0x3b08 > eea41b7c f1847022 eea41bc8 e308ade0 f17a5998 NPDRIVER+0x5166 > eea41b88 f17a5998 e31cade8 eea41bc8 f17a7426 NPDRIVER+0x3022 > e308ade0 e26ff260 f1799410 e1ab6190 f1799414 SYMEVENT!EventObjectDestroy+0x338 > f17998b4 f179eee0 f179ef80 f179a7a0 f179efd0 0xe26ff260 > f17a0310 ffffeb48 082444f6 56097401 00290be8 SYMEVENT!SYMEvent_GetVMDataPtr+0x4740 > e8f18b56 00000000 00000000 00000000 00000000 0xffffeb48 > > > FOLLOWUP_IP: > NPDRIVER+5e96 > f1849e96 8b55fc mov edx,\[ebp-0x4\] > > SYMBOL_STACK_INDEX: 1 > > FOLLOWUP_NAME: MachineOwner > > SYMBOL_NAME: NPDRIVER+5e96 > > MODULE_NAME: NPDRIVER > > IMAGE_NAME: NPDRIVER.SYS > > DEBUG_FLR_IMAGE_TIMESTAMP: 3d59fb0a > > STACK_COMMAND: .trap ffffffffeea413b4 ; kb > > BUCKET_ID: 0x8E_NPDRIVER+5e96 > > Followup: MachineOwner > \--------- Permalänk: https://www.webforum.nu/p/113683 ## #2 — legis, 2004-10-16T16:27Z Du kan kolla information om npdriver genom kommandot lm (om du inte vill ta properties på den direkt) och sen se om det finns en uppdaterad version av den filen hos Symatec. Permalänk: https://www.webforum.nu/p/1460452 --- Tråden på webben: https://www.webforum.nu/amne/datorhardvara/113683-felsökning