locked
pantallas azules aleatorias RRS feed

  • Pregunta

  •  

    un amigo me llamo desesperado por telefono, que la pc le tira pantallas azules aleatorias, no me supo explicar muy bien.

    por lo que le pedi que me pase los arhivos dmp.

    por lo que tengo entendido. la pc es un viejo p4 socket 478 de 2,4ghz. un pentium 4 northwood.

    1 giga de ram

    mother intel 865 (video onboard)

    1 disco de 80 gb

    lectora de dvd.

     

    y monton de cosas conectadas por lo que no se si la fuente se banca todo eso. telefono de voip, camara webcam, telefonos celulares, y software de todo tipo (tipica pc de usuario inexperto y de pocos conocimientos)

     

    por un lado el dueño de la pc no me supo explicar si tenia virus o no, pero por otro lado yo se que los capacitores de las etapas de regulacion del micro estan hinchados y los de alimetacion de las memorias tambien. aunque hace 2 meses le avise de la situacion y le instale xp sp3 sin problemas.

     

    las pantallas azules que aparecen son:

     

    Primera:

    Loading Dump File [C:\Users\Agustín\Documents\Mis archivos recibidos\Mini010209-01.dmp]
    Mini Kernel Dump File: Only registers and stack trace are available

    Symbol search path is: SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols
    Executable search path is:
    Windows XP Kernel Version 2600 (Service Pack 3) MP (2 procs) Free x86 compatible
    Product: WinNt, suite: TerminalServer SingleUserTS
    Built by: 2600.xpsp_sp3_gdr.080814-1236
    Machine Name:
    Kernel base = 0x804d7000 PsLoadedModuleList = 0x805634c0
    Debug session time: Fri Jan  2 19:02:59.187 2009 (GMT-2)
    System Uptime: 0 days 2:13:47.874
    Loading Kernel Symbols
    ...............................................................
    ..............................................................
    Loading User Symbols
    Loading unloaded module list
    ........
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************

    Use !analyze -v to get detailed debugging information.

    BugCheck 1000000A, {4, 1c, 1, 804e1476}

    Probably caused by : USBPORT.SYS ( USBPORT!USBPORT_DM_TimerDpc+20d )

    Followup: MachineOwner
    ---------

    0: kd> !analyze -v
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************

    IRQL_NOT_LESS_OR_EQUAL (a)
    An attempt was made to access a pageable (or completely invalid) address at an
    interrupt request level (IRQL) that is too high.  This is usually
    caused by drivers using improper addresses.
    If a kernel debugger is available get the stack backtrace.
    Arguments:
    Arg1: 00000004, memory referenced
    Arg2: 0000001c, IRQL
    Arg3: 00000001, bitfield :
     bit 0 : value 0 = read operation, 1 = write operation
     bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
    Arg4: 804e1476, address which referenced memory

    Debugging Details:
    ------------------


    WRITE_ADDRESS:  00000004

    CURRENT_IRQL:  1c

    FAULTING_IP:
    nt!KiInsertTimerTable+4e
    804e1476 894204          mov     dword ptr [edx+4],eax

    CUSTOMER_CRASH_COUNT:  1

    DEFAULT_BUCKET_ID:  DRIVER_FAULT

    BUGCHECK_STR:  0xA

    PROCESS_NAME:  Idle

    LAST_CONTROL_TRANSFER:  from 804e14da to 804e1476

    STACK_TEXT: 
    8055725c 804e14da ffb15267 ffffffff b0fc5d0b nt!KiInsertTimerTable+0x4e
    80557278 804e2130 ffb15267 ffffffff 862a2028 nt!KiInsertTreeTimer+0x7d
    80557298 804e2167 002a2730 ffb15267 ffffffff nt!KeSetTimerEx+0x4d
    805572b4 f740c8e9 862a2730 ffb15267 ffffffff nt!KeSetTimer+0x18
    805572e0 804e2b4e 862a270c 862a2028 7dfb5fb8 USBPORT!USBPORT_DM_TimerDpc+0x20d
    805573fc 804e207d 80561f20 ffdff9c0 ffdff000 nt!KiTimerListExpire+0x14b
    80557428 804dcd22 80562320 00000000 0007d6f7 nt!KiTimerExpiration+0xb1
    80557440 80561cc0 ffdffc50 00000000 80561cc0 nt!KiRetireDpcList+0x61
    80557450 804dcc07 00000000 0000000e 00000000 nt!KiIdleThread0
    80557454 00000000 0000000e 00000000 00000000 nt!KiIdleLoop+0x28


    STACK_COMMAND:  kb

    FOLLOWUP_IP:
    USBPORT!USBPORT_DM_TimerDpc+20d
    f740c8e9 6a01            push    1

    SYMBOL_STACK_INDEX:  4

    SYMBOL_NAME:  USBPORT!USBPORT_DM_TimerDpc+20d

    FOLLOWUP_NAME:  MachineOwner

    MODULE_NAME: USBPORT

    IMAGE_NAME:  USBPORT.SYS

    DEBUG_FLR_IMAGE_TIMESTAMP:  480254ce

    FAILURE_BUCKET_ID:  0xA_USBPORT!USBPORT_DM_TimerDpc+20d

    BUCKET_ID:  0xA_USBPORT!USBPORT_DM_TimerDpc+20d

    Followup: MachineOwner
    ---------

     

     

    segunda:


    Loading Dump File [C:\Users\Agustín\Documents\Mis archivos recibidos\Mini010409-01.dmp]
    Mini Kernel Dump File: Only registers and stack trace are available

    Symbol search path is: SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols
    Executable search path is:
    Windows XP Kernel Version 2600 (Service Pack 3) MP (2 procs) Free x86 compatible
    Product: WinNt, suite: TerminalServer SingleUserTS
    Built by: 2600.xpsp_sp3_gdr.080814-1236
    Machine Name:
    Kernel base = 0x804d7000 PsLoadedModuleList = 0x805634c0
    Debug session time: Sun Jan  4 15:18:33.093 2009 (GMT-2)
    System Uptime: 0 days 0:03:52.769
    Loading Kernel Symbols
    ...............................................................
    .............................................................
    Loading User Symbols
    Loading unloaded module list
    .........
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************

    Use !analyze -v to get detailed debugging information.

    BugCheck 35, {86039a50, 0, 0, 0}

    Probably caused by : ntkrnlmp.exe ( nt!KiFastCallEntry+fc )

    Followup: MachineOwner
    ---------

    0: kd> !analyze -v
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************

    NO_MORE_IRP_STACK_LOCATIONS (35)
    A higher level driver has attempted to call a lower level driver through
    the IoCallDriver() interface, but there are no more stack locations in the
    packet, hence, the lower level driver would not be able to access its
    parameters, as there are no parameters for it.  This is a disasterous
    situation, since the higher level driver "thinks" it has filled in the
    parameters for the lower level driver (something it MUST do before it calls
    it), but since there is no stack location for the latter driver, the former
    has written off of the end of the packet.  This means that some other memory
    has probably been trashed at this point.
    Arguments:
    Arg1: 86039a50, Address of the IRP
    Arg2: 00000000
    Arg3: 00000000
    Arg4: 00000000

    Debugging Details:
    ------------------


    CUSTOMER_CRASH_COUNT:  1

    DEFAULT_BUCKET_ID:  DRIVER_FAULT

    BUGCHECK_STR:  0x35

    PROCESS_NAME:  services.exe

    LAST_CONTROL_TRANSFER:  from 805202fe to 8053767a

    STACK_TEXT: 
    edab4c84 805202fe 00000035 86039a50 00000000 nt!KeBugCheckEx+0x1b
    edab4d48 804dd99f 015bfae8 dc17e241 ffffffff nt!IopfCallDriver+0x17
    edab4d48 c0000001 015bfae8 dc17e241 ffffffff nt!KiFastCallEntry+0xfc
    WARNING: Frame IP not in any known module. Following frames may be wrong.
    ed44e215 00000000 00000000 00000000 00000000 0xc0000001


    STACK_COMMAND:  kb

    FOLLOWUP_IP:
    nt!KiFastCallEntry+fc
    804dd99f 8be5            mov     esp,ebp

    SYMBOL_STACK_INDEX:  2

    SYMBOL_NAME:  nt!KiFastCallEntry+fc

    FOLLOWUP_NAME:  MachineOwner

    MODULE_NAME: nt

    IMAGE_NAME:  ntkrnlmp.exe

    DEBUG_FLR_IMAGE_TIMESTAMP:  48a4044a

    FAILURE_BUCKET_ID:  0x35_nt!KiFastCallEntry+fc

    BUCKET_ID:  0x35_nt!KiFastCallEntry+fc

    Followup: MachineOwner
    ---------

    0: kd> !analyze -v
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************

    NO_MORE_IRP_STACK_LOCATIONS (35)
    A higher level driver has attempted to call a lower level driver through
    the IoCallDriver() interface, but there are no more stack locations in the
    packet, hence, the lower level driver would not be able to access its
    parameters, as there are no parameters for it.  This is a disasterous
    situation, since the higher level driver "thinks" it has filled in the
    parameters for the lower level driver (something it MUST do before it calls
    it), but since there is no stack location for the latter driver, the former
    has written off of the end of the packet.  This means that some other memory
    has probably been trashed at this point.
    Arguments:
    Arg1: 86039a50, Address of the IRP
    Arg2: 00000000
    Arg3: 00000000
    Arg4: 00000000

    Debugging Details:
    ------------------


    CUSTOMER_CRASH_COUNT:  1

    DEFAULT_BUCKET_ID:  DRIVER_FAULT

    BUGCHECK_STR:  0x35

    PROCESS_NAME:  services.exe

    LAST_CONTROL_TRANSFER:  from 805202fe to 8053767a

    STACK_TEXT: 
    edab4c84 805202fe 00000035 86039a50 00000000 nt!KeBugCheckEx+0x1b
    edab4d48 804dd99f 015bfae8 dc17e241 ffffffff nt!IopfCallDriver+0x17
    edab4d48 c0000001 015bfae8 dc17e241 ffffffff nt!KiFastCallEntry+0xfc
    WARNING: Frame IP not in any known module. Following frames may be wrong.
    ed44e215 00000000 00000000 00000000 00000000 0xc0000001


    STACK_COMMAND:  kb

    FOLLOWUP_IP:
    nt!KiFastCallEntry+fc
    804dd99f 8be5            mov     esp,ebp

    SYMBOL_STACK_INDEX:  2

    SYMBOL_NAME:  nt!KiFastCallEntry+fc

    FOLLOWUP_NAME:  MachineOwner

    MODULE_NAME: nt

    IMAGE_NAME:  ntkrnlmp.exe

    DEBUG_FLR_IMAGE_TIMESTAMP:  48a4044a

    FAILURE_BUCKET_ID:  0x35_nt!KiFastCallEntry+fc

    BUCKET_ID:  0x35_nt!KiFastCallEntry+fc

    Followup: MachineOwner

     

    tercera:
    Loading Dump File [C:\Users\Agustín\Documents\Mis archivos recibidos\Mini010409-02.dmp]
    Mini Kernel Dump File: Only registers and stack trace are available

    Symbol search path is: SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols
    Executable search path is:
    Windows XP Kernel Version 2600 (Service Pack 3) MP (2 procs) Free x86 compatible
    Product: WinNt, suite: TerminalServer SingleUserTS
    Built by: 2600.xpsp_sp3_gdr.080814-1236
    Machine Name:
    Kernel base = 0x804d7000 PsLoadedModuleList = 0x805634c0
    Debug session time: Sun Jan  4 15:47:19.609 2009 (GMT-2)
    System Uptime: 0 days 0:04:06.285
    Loading Kernel Symbols
    ...............................................................
    ..............................................................
    Loading User Symbols
    Loading unloaded module list
    .........
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************

    Use !analyze -v to get detailed debugging information.

    BugCheck 1000008E, {c0000005, 805512e0, ee0d195c, 0}

    *** WARNING: Unable to verify timestamp for Beep.SYS
    *** ERROR: Module load completed but symbols could not be loaded for Beep.SYS
    Probably caused by : Beep.SYS ( Beep+9821 )

    Followup: MachineOwner
    ---------

    1: kd> !analyze -v
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************

    KERNEL_MODE_EXCEPTION_NOT_HANDLED_M (1000008e)
    This is a very common bugcheck.  Usually the exception address pinpoints
    the driver/function that caused the problem.  Always note this address
    as well as the link date of the driver/image that contains this address.
    Some common problems are exception code 0x80000003.  This means a hard
    coded breakpoint or assertion was hit, but this system was booted
    /NODEBUG.  This is not supposed to happen as developers should never have
    hardcoded breakpoints in retail code, but ...
    If this happens, make sure a debugger gets connected, and the
    system is booted /DEBUG.  This will let us see why this breakpoint is
    happening.
    Arguments:
    Arg1: c0000005, The exception code that was not handled
    Arg2: 805512e0, The address that the exception occurred at
    Arg3: ee0d195c, Trap Frame
    Arg4: 00000000

    Debugging Details:
    ------------------


    EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - La instrucci n en 0x%08lx hace referencia a la memoria en 0x%08lx. La memoria no se pudo %s.

    FAULTING_IP:
    nt!ExFreePoolWithTag+43c
    805512e0 668b4b04        mov     cx,word ptr [ebx+4]

    TRAP_FRAME:  ee0d195c -- (.trap 0xffffffffee0d195c)
    ErrCode = 00000000
    eax=f7a43120 ebx=00000000 ecx=00000000 edx=00000000 esi=85c61898 edi=8056aac0
    eip=805512e0 esp=ee0d19d0 ebp=ee0d1a04 iopl=0         nv up ei pl zr na pe nc
    cs=0008  ss=0010  ds=0023  es=0023  fs=0030  gs=0000             efl=00010246
    nt!ExFreePoolWithTag+0x43c:
    805512e0 668b4b04        mov     cx,word ptr [ebx+4]      ds:0023:00000004=????
    Resetting default scope

    CUSTOMER_CRASH_COUNT:  2

    DEFAULT_BUCKET_ID:  DRIVER_FAULT

    BUGCHECK_STR:  0x8E

    PROCESS_NAME:  svchost.exe

    LAST_CONTROL_TRANSFER:  from 8057c2b7 to 805512e0

    STACK_TEXT: 
    ee0d1a04 8057c2b7 85c618a0 00000000 ee0d1b3c nt!ExFreePoolWithTag+0x43c
    ee0d1a6c 8057c315 85c4244c c0000000 ee0d1c70 nt!IopCreateFile+0x53b
    ee0d1ac8 8057c358 85c4244c c0000000 ee0d1c70 nt!IoCreateFile+0x8e
    ee0d1b08 804dd99f 85c4244c c0000000 ee0d1c70 nt!NtCreateFile+0x30
    ee0d1b08 804e3577 85c4244c c0000000 ee0d1c70 nt!KiFastCallEntry+0xfc
    ee0d1bac ed372821 85c4244c c0000000 ee0d1c70 nt!ZwCreateFile+0x11
    WARNING: Stack unwind information not available. Following frames may be wrong.
    ee0d1c24 804e1442 fa0a1f00 eea9ddc1 804e2448 Beep+0x9821
    ee0d1c64 804e3487 badb0d00 00000018 00000000 nt!KiInsertTimerTable+0x1b
    ee0d1d48 804dd99f 01fefbf0 dc17e241 ffffffff nt!ZwClose+0x11
    ee0d1d48 00000000 01fefbf0 dc17e241 ffffffff nt!KiFastCallEntry+0xfc


    STACK_COMMAND:  kb

    FOLLOWUP_IP:
    Beep+9821
    ed372821 ??              ???

    SYMBOL_STACK_INDEX:  6

    SYMBOL_NAME:  Beep+9821

    FOLLOWUP_NAME:  MachineOwner

    MODULE_NAME: Beep

    IMAGE_NAME:  Beep.SYS

    DEBUG_FLR_IMAGE_TIMESTAMP:  49607b7a

    FAILURE_BUCKET_ID:  0x8E_Beep+9821

    BUCKET_ID:  0x8E_Beep+9821

    Followup: MachineOwner
    ---------

    domingo, 4 de enero de 2009 17:35

Respuestas

  • La proxima vez Microsoft ofrece una herramienta oara analizar los minidump..Lo abres y la ventana de texto pones
    !analyze -v
    Y acorta mas excactamente el problema..

    Aquí tienes una explicacion del Primer Minidump
    http://support.microsoft.com/default.aspx/kb/812580/es
    Y el segundo hay un conflicto con el driver del USB has echo alguna instalación hace poco?
    martes, 6 de enero de 2009 0:53