I have run debugwiz, as Jephree has suggested on previous threads, to analyise the minidump that is generated after my laptop crashes. Is anyone able to explain what the problem is!
Opened log file 'c:\debuglog.txt'
Microsoft (R) Windows Debugger Version 6.5.0003.7
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [D:\Mini110905-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: C:\WINDOWS;C:\WINDOWS\system32;C:\WINDOWS\system32 \drivers
*** ERROR: Symbol file could not be found. Defaulted to export symbols for ntkrnlpa.exe -
Windows XP Kernel Version 2600 (Service Pack 2) UP Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 2600.xpsp_sp2_rtm.040803-2158
Kernel base = 0x804d7000 PsLoadedModuleList = 0x805531a0
Debug session time: Wed Nov 9 14:04:43.898 2005 (GMT+0)
System Uptime: 0 days 5:25:00.105
*** ERROR: Symbol file could not be found. Defaulted to export symbols for ntkrnlpa.exe -
Loading Kernel Symbols
.................................................. .................................................. .................................................. ...........................................
Loading unloaded module list
...........................
Loading User Symbols
************************************************** *****************************
* *
* Bugcheck Analysis *
* *
************************************************** *****************************
Use !analyze -v to get detailed debugging information.
BugCheck 1000008E, {c0000005, eb288258, eb346bd0, 0}
***** Kernel symbols are WRONG. Please fix symbols to do analysis.
Unable to load image arpcollector.sys, Win32 error 2
*** WARNING: Unable to verify timestamp for arpcollector.sys
*** ERROR: Module load completed but symbols could not be loaded for arpcollector.sys
************************************************** ***********************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
************************************************** ***********************
*** ERROR: Symbol file could not be found. Defaulted to export symbols for NDIS.sys -
Probably caused by : arpcollector.sys ( arpcollector+1258 )
Followup: MachineOwner
---------
kd> !analyze -v;r;kv;lmtn;.logclose;q
************************************************** *****************************
* *
* Bugcheck Analysis *
* *
************************************************** *****************************
KERNEL_MODE_EXCEPTION_NOT_HANDLED_M (1000008e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003. This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG. This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG. This will let us see why this breakpoint is
happening.
Arguments:
Arg1: c0000005, The exception code that was not handled
Arg2: eb288258, The address that the exception occurred at
Arg3: eb346bd0, Trap Frame
Arg4: 00000000
Debugging Details:
------------------
***** Kernel symbols are WRONG. Please fix symbols to do analysis.
************************************************** ***********************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
************************************************** ***********************
FAULTING_MODULE: 804d7000 nt
DEBUG_FLR_IMAGE_TIMESTAMP: 41ef7683
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx". The memory could not be "%s".
FAULTING_IP:
arpcollector+1258
eb288258 890411 mov [ecx+edx],eax
TRAP_FRAME: eb346bd0 -- (.trap ffffffffeb346bd0)
.trap ffffffffeb346bd0
ErrCode = 00000002
eax=0000002e ebx=861c5a78 ecx=00000000 edx=00000000 esi=85de32e8 edi=861c5a30
eip=eb288258 esp=eb346c44 ebp=eb346c6c iopl=0 nv up ei ng nz na pe cy
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010283
arpcollector+0x1258:
eb288258 890411 mov [ecx+edx],eax ds:0023:00000000=????????
.trap
Resetting default scope
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: DRIVER_FAULT
BUGCHECK_STR: 0x8E
LAST_CONTROL_TRANSFER: from 804eddf9 to eb288258
STACK_TEXT:
WARNING: Stack unwind information not available. Following frames may be wrong.
eb346c6c 804eddf9 860d2368 85de32e8 806cf070 arpcollector+0x1258
eb346c90 80570b98 860d2368 85de32e8 8676ae20 nt!IoBuildPartialMdl+0xed
eb346d38 8053c808 00000184 00000000 00000000 nt!NtReadFile+0x580
eb346ddc 80540fa2 f7170b85 8601e378 00000000 nt!KeReleaseInStackQueuedSpinLockFromDpcLevel+0xb1 4
eb346de0 f7170b85 8601e378 00000000 0000027f nt!KiDispatchInterrupt+0x5a2
eb346de4 8601e378 00000000 0000027f 00f20000 NDIS!NdisFreeToBlockPool+0x15e1
f7170b85 08458bec 3bf63356 840f57c6 00006fb1 0x8601e378
f7170b89 3bf63356 840f57c6 00006fb1 54bff08b 0x8458bec
f7170b8d 840f57c6 00006fb1 54bff08b a5f71704 0x3bf63356
f7170b91 00000000 54bff08b a5f71704 ffa5a5a5 0x840f57c6
FOLLOWUP_IP:
arpcollector+1258
eb288258 890411 mov [ecx+edx],eax
SYMBOL_STACK_INDEX: 0
FOLLOWUP_NAME: MachineOwner
SYMBOL_NAME: arpcollector+1258
MODULE_NAME: arpcollector
IMAGE_NAME: arpcollector.sys
STACK_COMMAND: .trap ffffffffeb346bd0 ; kb
BUCKET_ID: WRONG_SYMBOLS
Followup: MachineOwner
---------
.......continued on next post....



56 2004 (411096C8)