Buenos dias, tengo un equipo acer al cual tuve que hacerle una buena limpieza de virus... (con el dichoso ndisvvan.sys y el passthrump), lo cual me hizo eliminar todo lo referido a la red. Finalmente logre repara todo y dejar el sistema limpio y estable.
Lo unico que cuando lo apago y e estado moviendo entre los equipos de la red local, en el proceso de cerrando conexiones de red lanza un blue screen 0x8e
Os dejo el minidump para ver si me podriais decir que lo provoca, pues yo no se analizarlo 100%. Un saludo y gracias.
Loading Dump File [F:\Mini021710-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Unable to load image \WINDOWS\system32\ntkrnlpa.exe, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntkrnlpa.exe
*** ERROR: Module load completed but symbols could not be loaded for ntkrnlpa.exe
Windows XP Kernel Version 2600 (Service Pack 3) MP (2 procs) Free x86 compatible
Product: WinNt
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055d720
Debug session time: Wed Feb 17 12:22:42.437 2010 (GMT+1)
System Uptime: 0 days 0:01:49.116
Unable to load image \WINDOWS\system32\ntkrnlpa.exe, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntkrnlpa.exe
*** ERROR: Module load completed but symbols could not be loaded for ntkrnlpa.exe
Loading Kernel Symbols
...............................................................................................................
Loading User Symbols
Loading unloaded module list
...........
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 1000008E, {c0000005, 80637421, ba2a7a90, 0}
***** Kernel symbols are WRONG. Please fix symbols to do analysis.
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
*************************************************************************
Probably caused by : ntkrnlpa.exe ( nt+160421 )
Followup: MachineOwner
---------
0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
KERNEL_MODE_EXCEPTION_NOT_HANDLED_M (1000008e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003. This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG. This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG. This will let us see why this breakpoint is
happening.
Arguments:
Arg1: c0000005, The exception code that was not handled
Arg2: 80637421, The address that the exception occurred at
Arg3: ba2a7a90, Trap Frame
Arg4: 00000000
Debugging Details:
------------------
***** Kernel symbols are WRONG. Please fix symbols to do analysis.
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
*************************************************************************
MODULE_NAME: nt
FAULTING_MODULE: 804d7000 nt
DEBUG_FLR_IMAGE_TIMESTAMP: 4b1e9e60
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - La instrucci n en 0x%08lx hace referencia a la memoria en 0x%08lx. La memoria no se pudo %s.
FAULTING_IP:
nt+160421
80637421 ?? ???
TRAP_FRAME: ba2a7a90 -- (.trap 0xffffffffba2a7a90)
Unable to read trap frame at ba2a7a90
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: WRONG_SYMBOLS
BUGCHECK_STR: 0x8E
LAST_CONTROL_TRANSFER: from da5291bc to 80637421
STACK_TEXT:
WARNING: Stack unwind information not available. Following frames may be wrong.
ba2a7b00 da5291bc e29b2008 e29b2008 00000001 nt+0x160421
ba2a7b4c 806389b4 e29b2008 ffffffff e13e7008 0xda5291bc
ba2a7b68 80638da4 e29b2008 ffffffff e13e7008 nt+0x1619b4
ba2a7b9c 806393ad 019b2008 000681b8 005ee658 nt+0x161da4
ba2a7be4 80639864 e29b2008 00067f98 005ee468 nt+0x1623ad
ba2a7c24 80639971 e10d2000 00000400 00000006 nt+0x162864
ba2a7c54 80635360 e29b2008 00000020 e13e7008 nt+0x162971
ba2a7c88 80625339 00000020 80000ac8 00000003 nt+0x15e360
ba2a7cb0 8054163c e1aa9278 80000ac8 ba2a7d54 nt+0x14e339
ba2a7cc0 80500d79 badb0d00 ba2a7d38 00000ac8 nt+0x6a63c
ba2a7d54 8054163c 00000090 00000644 0006f8ac nt+0x29d79
ba2a7d64 7c91e514 badb0d00 0006f864 00000000 nt+0x6a63c
ba2a7d68 badb0d00 0006f864 00000000 01008084 0x7c91e514
ba2a7d6c 0006f864 00000000 01008084 00000001 0xbadb0d00
ba2a7d70 00000000 01008084 00000001 00000002 0x6f864
STACK_COMMAND: kb
FOLLOWUP_IP:
nt+160421
80637421 ?? ???
SYMBOL_STACK_INDEX: 0
SYMBOL_NAME: nt+160421
FOLLOWUP_NAME: MachineOwner
IMAGE_NAME: ntkrnlpa.exe
BUCKET_ID: WRONG_SYMBOLS
Followup: MachineOwner
