none
插U盘 XP会重启 RRS feed

  • 问题

  • 偶尔插U盘,XP会重启,查了一下,没发现病毒,频率是插十次重启二次。


    Microsoft (R) Windows Debugger Version 6.8.0004.0 X86
    Copyright (c) Microsoft Corporation. All rights reserved.


    Loading Dump File [e:\Documents and Settings\user\桌面\Mini010909-01.dmp]
    Mini Kernel Dump File: Only registers and stack trace are available

    Symbol search path is: *** Invalid ***
    ****************************************************************************
    * Symbol loading may be unreliable without a symbol search path.           *
    * Use .symfix to have the debugger choose a symbol path.                   *
    * After setting your symbol path, use .reload to refresh symbol locations. *
    ****************************************************************************
    Executable search path is:
    *********************************************************************
    * Symbols can not be loaded because symbol path is not initialized. *
    *                                                                   *
    * The Symbol Path can be set by:                                    *
    *   using the _NT_SYMBOL_PATH environment variable.                 *
    *   using the -y <symbol_path> argument when starting the debugger. *
    *   using .sympath and .sympath+                                    *
    *********************************************************************
    Unable to load image ntoskrnl.exe, Win32 error 0n2
    *** WARNING: Unable to verify timestamp for ntoskrnl.exe
    *** ERROR: Module load completed but symbols could not be loaded for ntoskrnl.exe
    Windows XP Kernel Version 2600 (Service Pack 2) MP (2 procs) Free x86 compatible
    Product: WinNt, suite: TerminalServer SingleUserTS
    Kernel base = 0x804d8000 PsLoadedModuleList = 0x8055d700
    Debug session time: Fri Jan  9 13:07:11.453 2009 (GMT+8)
    System Uptime: 0 days 22:28:43.150
    *********************************************************************
    * Symbols can not be loaded because symbol path is not initialized. *
    *                                                                   *
    * The Symbol Path can be set by:                                    *
    *   using the _NT_SYMBOL_PATH environment variable.                 *
    *   using the -y <symbol_path> argument when starting the debugger. *
    *   using .sympath and .sympath+                                    *
    *********************************************************************
    Unable to load image ntoskrnl.exe, Win32 error 0n2
    *** WARNING: Unable to verify timestamp for ntoskrnl.exe
    *** ERROR: Module load completed but symbols could not be loaded for ntoskrnl.exe
    Loading Kernel Symbols
    ..........................................................................................................
    Loading User Symbols
    Loading unloaded module list
    ................
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************

    Use !analyze -v to get detailed debugging information.

    BugCheck F4, {3, 895ca020, 895ca194, 805d21f8}

    ***** Kernel symbols are WRONG. Please fix symbols to do analysis.

    *************************************************************************
    ***                                                                   ***
    ***                                                                   ***
    ***    Your debugger is not using the correct symbols                 ***
    ***                                                                   ***
    ***    In order for this command to work properly, your symbol path   ***
    ***    must point to .pdb files that have full type information.      ***
    ***                                                                   ***
    ***    Certain .pdb files (such as the public OS symbols) do not      ***
    ***    contain the required information.  Contact the group that      ***
    ***    provided you with these symbols if you need this command to    ***
    ***    work.                                                          ***
    ***                                                                   ***
    ***    Type referenced: nt!_KPRCB                                     ***
    ***                                                                   ***
    *************************************************************************
    *************************************************************************
    ***                                                                   ***
    ***                                                                   ***
    ***    Your debugger is not using the correct symbols                 ***
    ***                                                                   ***
    ***    In order for this command to work properly, your symbol path   ***
    ***    must point to .pdb files that have full type information.      ***
    ***                                                                   ***
    ***    Certain .pdb files (such as the public OS symbols) do not      ***
    ***    contain the required information.  Contact the group that      ***
    ***    provided you with these symbols if you need this command to    ***
    ***    work.                                                          ***
    ***                                                                   ***
    ***    Type referenced: nt!_KPRCB                                     ***
    ***                                                                   ***
    *************************************************************************
    *********************************************************************
    * Symbols can not be loaded because symbol path is not initialized. *
    *                                                                   *
    * The Symbol Path can be set by:                                    *
    *   using the _NT_SYMBOL_PATH environment variable.                 *
    *   using the -y <symbol_path> argument when starting the debugger. *
    *   using .sympath and .sympath+                                    *
    *********************************************************************
    *********************************************************************
    * Symbols can not be loaded because symbol path is not initialized. *
    *                                                                   *
    * The Symbol Path can be set by:                                    *
    *   using the _NT_SYMBOL_PATH environment variable.                 *
    *   using the -y <symbol_path> argument when starting the debugger. *
    *   using .sympath and .sympath+                                    *
    *********************************************************************
    Probably caused by : csrss.exe

    Followup: MachineOwner
    ---------

     

    2009年1月9日 8:10

全部回复

  •  

    首先下载windebug

     

    http://www.microsoft.com/whdc/devtools/debugging/installx86.mspx

    说下debug方法
    1.
    我的电脑,属性->高级->启动,最下面的内存调试选最后一项的全部,确定后重新启动
    2.
    蓝屏后不要急着重启,系统会保存整个内存内容,然后会自动重启
    3.
    找到e:\Documents and Settings\user\桌面\Mini010909-01.dmp

    4. 下载安装windwos debug tools, 我这有下载地址,或微软网站
    http://public.hshh.org/SysTools/debug/dbg_x86_6.6.07.5.exe
    5.
    安装后创建一个临时目录,例如 c:\temp
    6.
    启动 windbg
    7. windbg
    界面: file->symbol file path (ctrl+s) 输入:
    SRV*c:\temp*http://msdl.microsoft.com/download/symbols
    然后确定
    8. windbg
    界面: file->open crash dump(ctrl+d),打开

    9. 打开e:\Documents and Settings\user\桌面\Mini010909-01.dmp后,等待提示
    当出现 Use !analyze -v to get detailed debugging information. 字样后,在下面输入框
    !analyze -v
    10.
    等待分析完毕,可以知道什么导致的出错
    11. windbg
    使用中需要网上下载调试内容,这个速度嘛,取决于你的网络了。

    -----------------------------------------------------------------------

     

    你把敲完!analyze -v后的信息发上来!

     

    你的这个 dump 的 symbol file 有问题,分析也是白搭!
    2009年1月9日 9:20