Felsökning

Jag har fått lite konstiga blåskärmar och omstarter sista veckan. Pillade lite med debuggingtools nu... Som jag tolkar det så är det npdriver.sys som krånglar. Söker jag i datorn så är det en fil som hör till norton antivirus\advTools. Det naturliga nu känns som att installera om norton. Finns det något annat att göra?

debuggintools skrev:

Microsoft (R) Windows Debugger Version 6.3.0017.0
Copyright (c) Microsoft Corporation. All rights reserved.

Loading Dump File [C:\WINDOWS\MEMORY.DMP]
Kernel Complete Dump File: Full address space is available

Symbol search path is: SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows XP Kernel Version 2600 (Service Pack 2) MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 2600.xpsp_sp2_rtm.040803-2158
Kernel base = 0x804d7000 PsLoadedModuleList = 0x805644a0
Debug session time: Sat Oct 16 17:09:07 2004
System Uptime: 0 days 4:25:10.738
Loading Kernel Symbols
................................................................................................................................................................
Loading unloaded module list
..................................................
Loading User Symbols
..................................................................................................................
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 8E, {c0000047, 80522362, eea413b4, 0}

*** ERROR: Symbol file could not be found. Defaulted to export symbols for SYMEVENT.SYS -
Probably caused by : NPDRIVER.SYS ( NPDRIVER+5e96 )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

KERNEL_MODE_EXCEPTION_NOT_HANDLED (8e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003. This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG. This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG. This will let us see why this breakpoint is
happening.
An exception code of 0x80000002 (STATUS_DATATYPE_MISALIGNMENT) indicates
that an unaligned data reference was encountered. The trap frame will
supply additional information.
Arguments:
Arg1: c0000047, The exception code that was not handled
Arg2: 80522362, The address that the exception occurred at
Arg3: eea413b4, Trap Frame
Arg4: 00000000

Debugging Details:
------------------

EXCEPTION_CODE: (NTSTATUS) 0xc0000047 - Ett f rs k gjordes att sl ppa en semafor s att dess maximalt till tna v rde skulle ha verskridits.

FAULTING_IP:
nt!KeReleaseSemaphore+3a
80522362 e9d585fcff jmp nt!KeReleaseSemaphore+0x3a (804ea93c)

TRAP_FRAME: eea413b4 -- (.trap ffffffffeea413b4)
ESP EDITED! New esp=eea41764
ErrCode = 00000000
eax=00000000 ebx=00000001 ecx=00000000 edx=00000000 esi=86181970 edi=00000002
eip=80522362 esp=eea41428 ebp=eea41778 iopl=0 nv up ei pl zr na po nc
cs=0000 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00000246
nt!KeReleaseSemaphore+0x3a:
80522362 e9d585fcff jmp nt!KeReleaseSemaphore+0x3a (804ea93c)
Resetting default scope

DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: 0x8E

LAST_CONTROL_TRANSFER: from f1849e96 to 80522362

STACK_TEXT:
eea41778 f1849e96 86181970 00000000 00000001 nt!KeReleaseSemaphore+0x3a
WARNING: Stack unwind information not available. Following frames may be wrong.
eea41794 f1847b08 861816d0 eea41b7c f1849166 NPDRIVER+0x5e96
eea417a0 f1849166 e31cade8 00000000 00002001 NPDRIVER+0x3b08
eea41b7c f1847022 eea41bc8 e308ade0 f17a5998 NPDRIVER+0x5166
eea41b88 f17a5998 e31cade8 eea41bc8 f17a7426 NPDRIVER+0x3022
e308ade0 e26ff260 f1799410 e1ab6190 f1799414 SYMEVENT!EventObjectDestroy+0x338
f17998b4 f179eee0 f179ef80 f179a7a0 f179efd0 0xe26ff260
f17a0310 ffffeb48 082444f6 56097401 00290be8 SYMEVENT!SYMEvent_GetVMDataPtr+0x4740
e8f18b56 00000000 00000000 00000000 00000000 0xffffeb48

FOLLOWUP_IP:
NPDRIVER+5e96
f1849e96 8b55fc mov edx,[ebp-0x4]

SYMBOL_STACK_INDEX: 1

FOLLOWUP_NAME: MachineOwner

SYMBOL_NAME: NPDRIVER+5e96

MODULE_NAME: NPDRIVER

IMAGE_NAME: NPDRIVER.SYS

DEBUG_FLR_IMAGE_TIMESTAMP: 3d59fb0a

STACK_COMMAND: .trap ffffffffeea413b4 ; kb

BUCKET_ID: 0x8E_NPDRIVER+5e96

Followup: MachineOwner
---------