okej, ska testa det! finns det nåt alternativ till daemon tools då?
o vad är alcohol 120%?
datorn startar om sig! hjälper en formatering?
56 svar · 1 457 visningar · startad av Klauz · sida 2 av 3
Frågan, av Klauz
Har haft min laptop (3,06Ghz, 512ram, radeon 9000) i snart ett år och den har funkat felfritt, fram tills för ca 2 veckor sedan när jag testade med att installera en extra 512a ramminne. Nu har den börjat starta om sig , ibland frågar den om jag vill spara dokumenten jag jobbar med och ibland startar den bara om sig eller stänger av sig helt utan någon förvarning. Har tagit ut minnet, men proble
Läs frågan i sin helhet →jag har även norton av 2003, funkar det bättre`? sjukt att Norton AV orsakar omstarter...
Alcohol120% är ett program som fungerar som D-Tools, dock med ytterligare funktionalitet. Något alternativ känner jag inte till, dock kan det vara en idé att vara utan det ett tag för att se om det är där skon klämmer. Annars kan du ju åter installera det för vidare felsökning.
alright, danke för hjälpen :)
en till fråga.. AVG är ju bara en trial version som senare kostar pengar! eller har jag fel nu? har du nån direktlänk till gratisprogrammet i sådana fall?
den kräver en licensnyckel, scheisse. har dom börjat ta betalt för sitt program kanske?
här finns gratisprogrammet! http://free.grisoft.com/
Avinstallerade Norton AV och lade in free-av.com-programmet som har fått bra recensioner.. datorn funkade i nån dag, men nu har den startat om sig igen..
ska fixa dumpfilerna..o postar strax
dump1:
Microsoft (R) Windows Debugger Version 6.4.0007.2
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [C:\WINDOWS\Minidump\Mini052805-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows XP Kernel Version 2600 (Service Pack 2) MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 2600.xpsp_sp2_gdr.050301-1519
Kernel base = 0x804d7000 PsLoadedModuleList = 0x805624a0
Debug session time: Sat May 28 10:43:44.109 2005 (GMT+2)
System Uptime: 0 days 0:03:43.821
Loading Kernel Symbols
......................................................................................................................................
Loading unloaded module list
...........
Loading User Symbols
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 10000050, {c9c754d2, 1, 80550ae2, 0}
Could not read faulting driver name
Unable to load image d347bus.sys, Win32 error 2
*** WARNING: Unable to verify timestamp for d347bus.sys
*** ERROR: Module load completed but symbols could not be loaded for d347bus.sys
Probably caused by : Pool_Corruption ( nt!ExDeferredFreePool+107 )
Followup: Pool_corruption
---------
0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced. This cannot be protected by try-except,
it must be protected by a Probe. Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: c9c754d2, memory referenced.
Arg2: 00000001, value 0 = read operation, 1 = write operation.
Arg3: 80550ae2, If non-zero, the instruction address which referenced the bad memory
address.
Arg4: 00000000, (reserved)
Debugging Details:
------------------
Could not read faulting driver name
WRITE_ADDRESS: c9c754d2
FAULTING_IP:
nt!ExDeferredFreePool+107
80550ae2 893b mov [ebx],edi
MM_INTERNAL_CODE: 0
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: DRIVER_FAULT
BUGCHECK_STR: 0x50
LAST_CONTROL_TRANSFER: from 80550ac7 to 80550ae2
STACK_TEXT:
f6b818d4 80550ac7 00000001 863ba400 85e709f8 nt!ExDeferredFreePool+0x107
f6b81914 805724ea e11e5008 00000000 f6b81950 nt!ExFreePoolWithTag+0x47f
f6b81924 8056caee e11e5008 f6b81901 00000000 nt!ObReleaseObjectSecurity+0x1a
f6b81950 805726f7 e1f76168 85e709f8 00000001 nt!ObCheckObjectAccess+0xd3
f6b8199c 805719e6 e1bb8b60 00000020 00000000 nt!CmpDoOpen+0x256
f6b81b94 8056c063 00000020 00000000 85e709f8 nt!CmpParseKey+0x558
f6b81c0c 8056f2a8 00000000 f6b81c4c 00000440 nt!ObpLookupObjectName+0x53c
f6b81c60 80571dbe 00000000 863ba3c0 f745e801 nt!ObOpenObjectByName+0xea
f6b81d34 f745e7ac 0006e844 80000000 0006e810 nt!NtOpenKey+0x1af
WARNING: Stack unwind information not available. Following frames may be wrong.
f6b81d64 7c90eb94 badb0d00 0006e7fc ffffffff d347bus+0xd7ac
0006e834 00000000 00000000 00000000 00000000 0x7c90eb94
STACK_COMMAND: .bugcheck ; kb
FOLLOWUP_IP:
nt!ExDeferredFreePool+107
80550ae2 893b mov [ebx],edi
SYMBOL_STACK_INDEX: 0
FOLLOWUP_NAME: Pool_corruption
SYMBOL_NAME: nt!ExDeferredFreePool+107
MODULE_NAME: Pool_Corruption
IMAGE_NAME: Pool_Corruption
DEBUG_FLR_IMAGE_TIMESTAMP: 0
FAILURE_BUCKET_ID: 0x50_W_nt!ExDeferredFreePool+107
BUCKET_ID: 0x50_W_nt!ExDeferredFreePool+107
Followup: Pool_corruption
---------
dump2:
Microsoft (R) Windows Debugger Version 6.4.0007.2
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [C:\WINDOWS\Minidump\Mini052805-02.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows XP Kernel Version 2600 (Service Pack 2) MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 2600.xpsp_sp2_gdr.050301-1519
Kernel base = 0x804d7000 PsLoadedModuleList = 0x805624a0
Debug session time: Sat May 28 10:44:15.828 2005 (GMT+2)
System Uptime: 0 days 0:00:16.531
Loading Kernel Symbols
...............................................................................................................................
Loading unloaded module list
....
Loading User Symbols
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 19, {20, e1a0f848, e1a0fbc8, c70066e}
Probably caused by : ntkrnlmp.exe ( nt!ExFreePoolWithTag+2c1 )
Followup: MachineOwner
---------
0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
BAD_POOL_HEADER (19)
The pool is already corrupt at the time of the current request.
This may or may not be due to the caller.
The internal pool links must be walked to figure out a possible cause of
the problem, and then special pool applied to the suspect tags or the driver
verifier to a suspect driver.
Arguments:
Arg1: 00000020, a pool block header size is corrupt.
Arg2: e1a0f848, The pool entry we were looking for within the page.
Arg3: e1a0fbc8, The next pool entry.
Arg4: 0c70066e, (reserved)
Debugging Details:
------------------
BUGCHECK_STR: 0x19_20
POOL_ADDRESS: e1a0f848
CUSTOMER_CRASH_COUNT: 2
DEFAULT_BUCKET_ID: DRIVER_FAULT
LAST_CONTROL_TRANSFER: from 80550fc5 to 805371aa
STACK_TEXT:
eecb46a8 80550fc5 00000019 00000020 e1a0f848 nt!KeBugCheckEx+0x1b
eecb46f8 f72ce6c2 e1a0f850 00000000 f72ce0cc nt!ExFreePoolWithTag+0x2c1
eecb4704 f72ce0cc eecb49cc eecb497c 00000000 Ntfs!NtfsCommonCreate+0x19d6
eecb4848 f72cef72 eecb486c 86202668 eecb499c Ntfs!NtfsCommonCreate+0x14c0
eecb49f4 f7355f70 86202668 eecb4bfc 8637d020 Ntfs!NtfsNetworkOpenCreate+0x8a
eecb4a14 80581c87 86202668 eecb4bfc 86328020 sr!SrFastIoQueryOpen+0x40
eecb4b00 8056c063 8636fb20 00000000 860f23b0 nt!IopParseDevice+0x95c
eecb4b78 8056f2a8 00000000 eecb4bb8 00000040 nt!ObpLookupObjectName+0x53c
eecb4bcc 80584468 00000000 00000000 00000001 nt!ObOpenObjectByName+0xea
eecb4d54 804dd99f 00b1ee18 00b1ede0 00b1ee44 nt!NtQueryFullAttributesFile+0x121
eecb4d54 7c90eb94 00b1ee18 00b1ede0 00b1ee44 nt!KiFastCallEntry+0xfc
WARNING: Frame IP not in any known module. Following frames may be wrong.
00b1edc0 00000000 00000000 00000000 00000000 0x7c90eb94
FOLLOWUP_IP:
nt!ExFreePoolWithTag+2c1
80550fc5 83f801 cmp eax,0x1
SYMBOL_STACK_INDEX: 1
FOLLOWUP_NAME: MachineOwner
SYMBOL_NAME: nt!ExFreePoolWithTag+2c1
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 42250f77
STACK_COMMAND: kb
FAILURE_BUCKET_ID: 0x19_20_nt!ExFreePoolWithTag+2c1
BUCKET_ID: 0x19_20_nt!ExFreePoolWithTag+2c1
Followup: MachineOwner
---------
Du verkar ju fortfarande ha daemon tools installerat:
f6b81d64 7c90eb94 badb0d00 0006e7fc ffffffff d347bus+0xd7ac
Andra dumpen kan man inte säga mycket om. För att få mer information än vad dumpen ger måste man aktivera Special Pool. Men då är vi inne på mer avancerad felsökning. Mest troligt är nämligen minnesdelen redan korrupt när nuvarande funktion exekveras.
alright, daemon tools är avinstallerat nu, hoppas det gör susen.
har ju iofs haft det installerat hur länge som helst så det låter ju lite skumt att det orsakar allt strul helt plötsligt.
men men, hoppas hoppas
fortfarande skit med datorn.. nu får jag upp ett felmeddelande som säger att datorn stänger av sig inom en minut. har haft detta för länge sedan men då var det ett virus som kunde avbrytas genom att skriva "shutdown -a" i kör. nu får man bort meddelandet men datorn startas ändå om efter en minut..
konstigt med alla dessa fel, eftersom datorn är helt nyformaterad!! här kommer ny dump:
Microsoft (R) Windows Debugger Version 6.4.0007.2
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [C:\WINDOWS\Minidump\Mini052905-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows XP Kernel Version 2600 (Service Pack 2) MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 2600.xpsp_sp2_gdr.050301-1519
Kernel base = 0x804d7000 PsLoadedModuleList = 0x805624a0
Debug session time: Sun May 29 10:00:05.875 2005 (GMT+2)
System Uptime: 0 days 0:01:20.578
Loading Kernel Symbols
.............................................................................................................................
Loading unloaded module list
....
Loading User Symbols
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 10000050, {e1be1804, 1, 805505a1, 1}
Could not read faulting driver name
Probably caused by : win32k.sys ( win32k!FastGetProfileStringW+60 )
Followup: MachineOwner
---------
0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced. This cannot be protected by try-except,
it must be protected by a Probe. Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: e1be1804, memory referenced.
Arg2: 00000001, value 0 = read operation, 1 = write operation.
Arg3: 805505a1, If non-zero, the instruction address which referenced the bad memory
address.
Arg4: 00000001, (reserved)
Debugging Details:
------------------
Could not read faulting driver name
WRITE_ADDRESS: e1be1804
FAULTING_IP:
nt!ExAllocatePoolWithTag+66a
805505a1 894804 mov [eax+0x4],ecx
MM_INTERNAL_CODE: 1
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: DRIVER_FAULT
BUGCHECK_STR: 0x50
LAST_CONTROL_TRANSFER: from 8058201d to 805505a1
STACK_TEXT:
eea386bc 8058201d 00000001 00000001 61564d43 nt!ExAllocatePoolWithTag+0x66a
eea386dc 805722fc e16ce9c8 e1d60d04 00000009 nt!CmpGetValueKeyFromCache+0x73
eea38738 805720ad e16ce9c8 e1a954f4 eea387a4 nt!CmpFindValueByNameFromCache+0x65
eea38798 8057227b e1a954d0 0010000e eea38b00 nt!CmQueryValueKey+0x96
eea38840 804dd99f 80000858 eea388fc 00000002 nt!NtQueryValueKey+0x2cc
eea38840 804e4067 80000858 eea388fc 00000002 nt!KiFastCallEntry+0xfc
eea388d0 bf8c2e51 80000858 eea388fc 00000002 nt!ZwQueryValueKey+0x11
eea3890c bf8c2f55 00000000 0000001f eea38b00 win32k!FastGetProfileStringW+0x60
eea38a04 bf821871 e19c5cf8 eea38a24 00000000 win32k!SetAppImeCompatFlags+0x43
eea38bd0 bf822c80 e19c5cf8 860e6bf8 00000000 win32k!SetAppCompatFlags+0x251
eea38cc0 bf80effa 860e6bf8 00000000 00000000 win32k!xxxCreateThreadInfo+0x865
eea38cd4 bf80f100 860e6bf8 00000000 00000000 win32k!UserThreadCallout+0x72
eea38cf0 80584b4f 860e6bf8 00000000 80561510 win32k!W32pThreadCallout+0x3d
eea38d54 804dd68e 000010dc 0007f460 0007f464 nt!PsConvertToGuiThread+0x139
ee9bed64 00000000 00000000 00000000 00000000 nt!KiBBTUnexpectedRange+0xc
FOLLOWUP_IP:
win32k!FastGetProfileStringW+60
bf8c2e51 3d05000080 cmp eax,0x80000005
SYMBOL_STACK_INDEX: 7
FOLLOWUP_NAME: MachineOwner
SYMBOL_NAME: win32k!FastGetProfileStringW+60
MODULE_NAME: win32k
IMAGE_NAME: win32k.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 422511a2
STACK_COMMAND: kb
FAILURE_BUCKET_ID: 0x50_W_win32k!FastGetProfileStringW+60
BUCKET_ID: 0x50_W_win32k!FastGetProfileStringW+60
Followup: MachineOwner
---------
Blaster/Sasser. En viktig sak att komma ihåg efter formatering är att slå igång en brandvägg innan nätverkskabeln pluggas i. Kör fixen (på den länkade sidan) samt Windows Update.
http://securityresponse.symantec.com/avcenter/venc/data/w32.blaster.worm.removal.tool.html
här kommer dump2 , den startar fortfarande om sig 2 ggr.
Microsoft (R) Windows Debugger Version 6.4.0007.2
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [C:\WINDOWS\Minidump\Mini052905-02.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows XP Kernel Version 2600 (Service Pack 2) MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 2600.xpsp_sp2_gdr.050301-1519
Kernel base = 0x804d7000 PsLoadedModuleList = 0x805624a0
Debug session time: Sun May 29 14:28:24.953 2005 (GMT+2)
System Uptime: 0 days 0:05:13.656
Loading Kernel Symbols
....................................................................................................................................
Loading unloaded module list
..........
Loading User Symbols
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 100000D1, {ffffffff, 2, 0, ffffffff}
Probably caused by : irda.sys ( irda!InitiateDiscoveryReq+d4 )
Followup: MachineOwner
---------
1: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: ffffffff, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000000, value 0 = read operation, 1 = write operation
Arg4: ffffffff, address which referenced memory
Debugging Details:
------------------
READ_ADDRESS: ffffffff
CURRENT_IRQL: 2
FAULTING_IP:
+ffffffffffffffff
ffffffff ?? ???
CUSTOMER_CRASH_COUNT: 2
DEFAULT_BUCKET_ID: DRIVER_FAULT
BUGCHECK_STR: 0xD1
LAST_CONTROL_TRANSFER: from eea44bdc to ffffffff
STACK_TEXT:
f78efcd8 eea44bdc eea47a93 eea49d64 00000000 0xffffffff
f78efd50 eea47ab3 00000000 eea49d60 f78efd7c irda!InitiateDiscoveryReq+0xd4
f78efd60 f77f03e4 eea49d60 00000000 eea49d70 irda!IrdaEventCallback+0x20
f78efd7c 804e23b5 00000000 00000000 863c2b30 TDI!CTEpEventHandler+0x32
f78efdac 80574128 eea49d60 00000000 00000000 nt!ExpWorkerThread+0xef
f78efddc 804efc81 804e22f1 00000001 00000000 nt!PspSystemThreadStartup+0x34
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16
FAILED_INSTRUCTION_ADDRESS:
+ffffffffffffffff
ffffffff ?? ???
FOLLOWUP_IP:
irda!InitiateDiscoveryReq+d4
eea44bdc ff7608 push dword ptr [esi+0x8]
SYMBOL_STACK_INDEX: 1
FOLLOWUP_NAME: MachineOwner
SYMBOL_NAME: irda!InitiateDiscoveryReq+d4
MODULE_NAME: irda
IMAGE_NAME: irda.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 41107b92
STACK_COMMAND: kb
FAILURE_BUCKET_ID: 0xD1_CODE_AV_BAD_IP_irda!InitiateDiscoveryReq+d4
BUCKET_ID: 0xD1_CODE_AV_BAD_IP_irda!InitiateDiscoveryReq+d4
Followup: MachineOwner
---------
nix , verkar inte va blaster/sasser. fix-programmet hittar inget.
Fixprogrammet? Har du testat http://windowsupdate.microsoft.com ?
jepp, jag har redan alla uppdateringar installerade..
Om lsass kraschar ( vilket gör att maskinen stängs ner inom 60 sekunder) så har du någon typ av virus på maskinen. Maskarna Sasser/Blaster ska du vara fri från om du kört WU OCH allt installerats ok.