Hängningar

Jag har under en tid fått hängningar i systemet som endast gått att lösa genom en omstart via strömbrytaren. Jag avinstallerade innan helgen en del program som jag trodde kunde orsaka felet. Helgen förlöpte utan en hängning och i gårkväll så installerade jag Norton Av 2005 igen för att se vad som hände. Installationen gick bra men när jag skannar efter virus så hänger sig allt efter ett tag. I natt fick jag "äntligen" en minidump som kanske kan ge lite ledtrådar. problemet nu är att debuggern inte gillar mina symbolsfiles och länken i Rikard eminenta felsökningstråd inte verka fungera längre. Jag laddade hem symbolsfilerna till xp och har pekat på C:\websymbols men det hjälper inte.

Finns det ngn vänlig själ (det vet jag ju att det gör) som har lust att titta på min dumpfil.

Är det ngn som har en fungerande länk att lägga in som sökväg till symbolfiles är det inte fel :)

// Nicro

Föräldrarmöte om 12 min så ev. stavfel rättas senare :)

Det fungerar fint för mig, är det inte så att du bara är lite för ivrig? :)

*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced. This cannot be protected by try-except,
it must be protected by a Probe. Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: 90909090, memory referenced.
Arg2: 00000000, value 0 = read operation, 1 = write operation.
Arg3: 90909090, If non-zero, the instruction address which referenced the bad memory
address.
Arg4: 00000000, (reserved)

Debugging Details:
------------------

Could not read faulting driver name

READ_ADDRESS: 90909090

FAULTING_IP:
+ffffffff90909090
90909090 ?? ???

MM_INTERNAL_CODE: 0

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: 0x50

LAST_CONTROL_TRANSFER: from ba981234 to 90909090

STACK_TEXT:
WARNING: Frame IP not in any known module. Following frames may be wrong.
ba980d70 ba981234 ba980eb8 ba980da0 bf853668 0x90909090
ba980d7c bf853668 e402a338 ba980eb8 000000c8 0xba981234
ba980da0 bf834828 00000001 ba981340 ba981344 win32k!vSrcCopyS16D16Identity+0x58
ba981320 bf833df0 00000045 00000000 e401d000 win32k!BltLnkRect+0x8c8
ba9815bc bf82f5b5 00000000 e36ca660 00000000 win32k!BltLnk+0x74a
ba981640 bf8468da e1a16008 e36ca670 e1a16008 win32k!EngBitBlt+0x3c9
ba981790 bf84741c ba98188c e3cff800 00000000 win32k!BLTRECORD::bBitBlt+0x725
ba9818c0 bf835c0c 53010ae0 000001e6 00000022 win32k!GreStretchBltInternal+0x5fd
ba9818fc 804dd99f 53010ae0 000001e6 00000022 win32k!GreStretchBlt+0x30
ba9818fc 7c90eb94 53010ae0 000001e6 00000022 nt!KiFastCallEntry+0xfc
0012909c 00000000 00000000 00000000 00000000 0x7c90eb94

FAILED_INSTRUCTION_ADDRESS:
+ffffffff90909090
90909090 ?? ???

FOLLOWUP_IP:
win32k!vSrcCopyS16D16Identity+58
bf853668 83c40c add esp,0xc

SYMBOL_STACK_INDEX: 2

FOLLOWUP_NAME: MachineOwner

SYMBOL_NAME: win32k!vSrcCopyS16D16Identity+58

MODULE_NAME: win32k

IMAGE_NAME: win32k.sys

DEBUG_FLR_IMAGE_TIMESTAMP: 422511a2

STACK_COMMAND: kb

FAILURE_BUCKET_ID: 0x50_CODE_AV_BAD_IP_win32k!vSrcCopyS16D16Identity+58

BUCKET_ID: 0x50_CODE_AV_BAD_IP_win32k!vSrcCopyS16D16Identity+58

Followup: MachineOwner
---------

/r Kod-taggen har gått och blivit alldeles för luftig för att vara användbar.

Thx

Det gav ju inte mig så mycket som jag hade hoppats :) (Kan ju bero på att jag är kass på sånthär ;) )

Jag hittade en dump som inträffat i eftermiddag, så här ser den ut i min debugger (verkar funka bättre nu).

Ger denna bättre tipps om vad som kan vara felet?

Microsoft (R) Windows Debugger  Version 6.5.0003.7
Copyright (c) Microsoft Corporation. All rights reserved.

Loading Dump File [C:\WINDOWS\Minidump\Mini101604-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: C:\websymbols
Executable search path is: 
Windows XP Kernel Version 2600 (Service Pack 2) MP (2 procs) Free x86 compatible
Product: WinNt
Built by: 2600.xpsp_sp2_rtm.040803-2158
Kernel base = 0x804d7000 PsLoadedModuleList = 0x805644a0
Debug session time: Sat Oct 16 17:09:07.046 2004 (GMT+2)
System Uptime: 0 days 4:25:10.738
Loading Kernel Symbols
................................................................................................................................................................
Loading unloaded module list
..................................................
Loading User Symbols
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1000008E, {c0000047, 80522362, eea413b4, 0}

Unable to load image \??\C:\WINDOWS\system32\Drivers\NPDRIVER.SYS, Win32 error 2
*** WARNING: Unable to verify timestamp for NPDRIVER.SYS
*** ERROR: Module load completed but symbols could not be loaded for NPDRIVER.SYS
*** WARNING: Unable to verify timestamp for mssmbios.sys
*** ERROR: Module load completed but symbols could not be loaded for mssmbios.sys
*** WARNING: Unable to verify timestamp for SYMEVENT.SYS
*** ERROR: Module load completed but symbols could not be loaded for SYMEVENT.SYS
Probably caused by : NPDRIVER.SYS ( NPDRIVER+5e96 )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

KERNEL_MODE_EXCEPTION_NOT_HANDLED_M (1000008e)
This is a very common bugcheck.  Usually the exception address pinpoints
the driver/function that caused the problem.  Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003.  This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG.  This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG.  This will let us see why this breakpoint is
happening.
Arguments:
Arg1: c0000047, The exception code that was not handled
Arg2: 80522362, The address that the exception occurred at
Arg3: eea413b4, Trap Frame
Arg4: 00000000

Debugging Details:
------------------

EXCEPTION_CODE: (NTSTATUS) 0xc0000047 - Ett f rs k gjordes att sl ppa en semafor s  att dess maximalt till tna v rde skulle ha  verskridits.

FAULTING_IP: 
nt!KeReleaseSemaphore+3a
80522362 e9d585fcff       jmp     nt!KeReleaseSemaphore+0x3a (804ea93c)

TRAP_FRAME:  eea413b4 -- (.trap ffffffffeea413b4)
Unable to read trap frame at eea413b4

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  DRIVER_FAULT

BUGCHECK_STR:  0x8E

LAST_CONTROL_TRANSFER:  from f1849e96 to 80522362

STACK_TEXT:  
eea41778 f1849e96 86181970 00000000 00000001 nt!KeReleaseSemaphore+0x3a
WARNING: Stack unwind information not available. Following frames may be wrong.
eea41794 f1847b08 861816d0 eea41b7c f1849166 NPDRIVER+0x5e96
eea417a0 f1849166 e31cade8 00000000 00002001 NPDRIVER+0x3b08
eea41b7c f1847022 eea41bc8 e308ade0 f17a5998 NPDRIVER+0x5166
eea41b88 f17a5998 e31cade8 eea41bc8 f17a7426 NPDRIVER+0x3022
eea41c64 804e19ee 86339628 867d7310 867d7310 SYMEVENT+0xc998
eea41c74 8057e818 85fde140 873e7ca0 00000001 nt!IopfCallDriver+0x31
eea41ca4 80570c83 860b3da0 86339628 00010080 nt!IopCloseFile+0x26b
eea41cd4 80570dd6 860b3da0 01fde140 873e7ca0 nt!ObpDecrementHandleCount+0x11b
eea41cfc 80570cfc e308e510 85fde158 00000ac4 nt!ObpCloseHandleTableEntry+0x14d
eea41d44 80570d46 00000ac4 00000001 00000000 nt!ObpCloseHandle+0x87
eea41d58 804ddf0f 00000ac4 0442e92c 7c90eb94 nt!NtClose+0x1d
eea41d58 7c90eb94 00000ac4 0442e92c 7c90eb94 nt!KiFastCallEntry+0xfc
0442e92c 00000000 00000000 00000000 00000000 0x7c90eb94

FOLLOWUP_IP: 
NPDRIVER+5e96
f1849e96 ??               ???

SYMBOL_STACK_INDEX:  1

FOLLOWUP_NAME:  MachineOwner

SYMBOL_NAME:  NPDRIVER+5e96

MODULE_NAME:  NPDRIVER

IMAGE_NAME:  NPDRIVER.SYS

DEBUG_FLR_IMAGE_TIMESTAMP:  3d59fb0a

STACK_COMMAND:  .trap ffffffffeea413b4 ; kb

FAILURE_BUCKET_ID:  0x8E_NPDRIVER+5e96

BUCKET_ID:  0x8E_NPDRIVER+5e96

Followup: MachineOwner

Inte direkt, men npdriver.sys tyder ju på att det är relaterat till Norton AV.

Jag var inne på det innan helgen och avinstallerade det. När jag installerade det igen så brjade det strula.. Får bli ett annat antivirus i framtiden.