מחשב ניכנס למסך כחול ועשה ריסט

stolen · 2008 במרץ 11

המחשב ניתקע ניכנס למסך כחול ואז עשה ריסט הנה המפרט של קבצי DUMP

Microsoft ® Windows Debugger Version 6.8.0004.0 X86

Loading Dump File [C:\WINDOWS\Minidump\Mini031008-01.dmp]

Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols

Executable search path is:

Windows XP Kernel Version 2600 (Service Pack 2) MP (2 procs) Free x86 compatible

Product: WinNt, suite: TerminalServer SingleUserTS

Built by: 2600.xpsp_sp2_gdr.070227-2254

Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055c700

Debug session time: Mon Mar 10 07:04:41.031 2008 (GMT+2)

System Uptime: 0 days 8:14:07.769

Loading Kernel Symbols

...

Loading User Symbols

Loading unloaded module list

..................

*******************************************************************************

* *

* Bugcheck Analysis *

* *

*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1000000A, {90edc008, 2, 1, 80522bd9}

Probably caused by : memory_corruption ( nt!MiReleasePageFileSpace+55 )

Followup: MachineOwner

---------

1: kd> !analyze -v

*******************************************************************************

* *

* Bugcheck Analysis *

* *

*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)

An attempt was made to access a pageable (or completely invalid) address at an

interrupt request level (IRQL) that is too high. This is usually

caused by drivers using improper addresses.

If a kernel debugger is available get the stack backtrace.

Arguments:

Arg1: 90edc008, memory referenced

Arg2: 00000002, IRQL

Arg3: 00000001, bitfield :

bit 0 : value 0 = read operation, 1 = write operation

bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)

Arg4: 80522bd9, address which referenced memory

Debugging Details:

------------------

WRITE_ADDRESS: 90edc008

CURRENT_IRQL: 2

FAULTING_IP:

nt!MiReleasePageFileSpace+55

80522bd9 213e and dword ptr [esi],edi

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: 0xA

PROCESS_NAME: HPZipm12.exe

LAST_CONTROL_TRANSFER: from 80523110 to 80522bd9

STACK_TEXT:

b5a4c674 80523110 00000000 40000000 629c3000 nt!MiReleasePageFileSpace+0x55

b5a4c6ac 80523284 c0314e18 629c3000 00000000 nt!MiDeletePte+0x4a2

b5a4c774 80519509 e1ab13c0 629c8fff 00000000 nt!MiDeleteVirtualAddresses+0x164

b5a4c824 805b17f1 88e46af8 890a5708 b5a4c894 nt!MiRemoveMappedView+0x237

b5a4c868 805b18e0 8a603e30 89525928 00000000 nt!MiUnmapViewOfSection+0x12b

b5a4c884 8054086c ffffffff 88e46af8 0012ecf8 nt!NtUnmapViewOfSection+0x54

b5a4c884 7c90eb94 ffffffff 88e46af8 0012ecf8 nt!KiFastCallEntry+0xfc

WARNING: Frame IP not in any known module. Following frames may be wrong.

0012ecf8 00000000 00000000 00000000 00000000 0x7c90eb94

STACK_COMMAND: kb

FOLLOWUP_IP:

nt!MiReleasePageFileSpace+55

80522bd9 213e and dword ptr [esi],edi

SYMBOL_STACK_INDEX: 0

SYMBOL_NAME: nt!MiReleasePageFileSpace+55

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nt

DEBUG_FLR_IMAGE_TIMESTAMP: 45e53f9d

IMAGE_NAME: memory_corruption

FAILURE_BUCKET_ID: 0xA_W_nt!MiReleasePageFileSpace+55

BUCKET_ID: 0xA_W_nt!MiReleasePageFileSpace+55