SNeM
Newbie | Редактировать | Профиль | Сообщение | Цитировать | Сообщить модератору
Ух, народ, все-таки сделали анализ и даб результаты его вам, на осмотр:
Microsoft (R) Windows Debugger Version 6.7.0005.1
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [C:\Documents and Settings\Мак-Гуру\Desktop\Mini101907-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: *** Invalid ***
****************************************************************************
* Symbol loading may be unreliable without a symbol search path. *
* Use .symfix to have the debugger choose a symbol path. *
* After setting your symbol path, use .reload to refresh symbol locations. *
****************************************************************************
Executable search path is:
*********************************************************************
Symbols can not be loaded because symbol path is not initialized. *
* *
* The Symbol Path can be set by: *
* using the _NT_SYMBOL_PATH environment variable. *
* using the -y <symbol_path> argument when starting the debugger. *
* using .sympath and .sympath+ *
*********************************************************************
Unable to load image ntoskrnl.exe, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
*** ERROR: Module load completed but symbols could not be loaded for ntoskrnl.exe
Windows XP Kernel Version 2600 (Service Pack 2) UP Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055b0c0
Debug session time: Fri Oct 19 11:40:14.140 2007 (GMT-7)
System Uptime: 0 days 8:32:04.718
*********************************************************************
* Symbols can not be loaded because symbol path is not initialized. *
* *
* The Symbol Path can be set by: *
* using the _NT_SYMBOL_PATH environment variable. *
* using the -y <symbol_path> argument when starting the debugger. *
* using .sympath and .sympath+ *
*********************************************************************
Unable to load image ntoskrnl.exe, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
*** ERROR: Module load completed but symbols could not be loaded for ntoskrnl.exe
Loading Kernel Symbols
....................................................................................................................................
Loading User Symbols
Loading unloaded module list
*
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 10000050, {bad0b118, 0, 8056402f, 2}
***** Kernel symbols are WRONG. Please fix symbols to do analysis.
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!KPRCB ***
*** ***
***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!KPRCB ***
*** ***
*************************************************************************
***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
*************************************************************************
*** WARNING: Unable to verify timestamp for sp_rsdrv2.sys
*** ERROR: Module load completed but symbols could not be loaded for sp_rsdrv2.sys
Probably caused by : sp_rsdrv2.sys ( sp_rsdrv2+3230 )
Followup: MachineOwner
---------
Что скажете?! Бросается в глаза следующее:
1. *** WARNING: Unable to verify timestamp for sp_rsdrv2.sys
*** ERROR: Module load completed but symbols could not be loaded for sp_rsdrv2.sys
Probably caused by : sp_rsdrv2.sys ( sp_rsdrv2+3230 )
2. Unable to load image ntoskrnl.exe, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
*** ERROR: Module load completed but symbols could not be loaded for ntoskrnl.exe
Loading Kernel Symbols
Ваше мнение?!
Добавлено:
Так, узнал что за файлы, значит разбор таков -
1. sp_rsdrv2.sys - файл драйвера программы Spyware Terminator
2. ntoskrnl.exe information:
Path found: c:\ windows\ driver cache\ i386\ ntoskrnl.exe
Version: 5.1.2600.2622 (xpsp_sp2_gdr.050301-1519)
Company: Microsoft Corporation
Productname: Microsoft® Windows® Operating System
Description: NT Kernel & System
Добавлено:
Так же еще один вариант анализа:
Loading dump file C:\Mini101907-01.dmp
----- 32 bit Kernel Mini Dump Analysis
DUMP_HEADER32:
MajorVersion 0000000f
MinorVersion 00000a28
DirectoryTableBase 11616000
PfnDataBase 81053000
PsLoadedModuleList 8055b0c0
PsActiveProcessHead 805611d8
MachineImageType 0000014c
NumberProcessors 00000001
BugCheckCode 10000050
BugCheckParameter1 bad0b118
BugCheckParameter2 00000000
BugCheckParameter3 8056402f
BugCheckParameter4 00000002
PaeEnabled 00000000
KdDebuggerDataBlock 8054cce0
MiniDumpFields 00000dff
TRIAGE_DUMP32:
ServicePackBuild 00000200
SizeOfDump 00010000
ValidOffset 0000fffc
ContextOffset 00000320
ExceptionOffset 000007d0
MmOffset 00001068
UnloadedDriversOffset 000010a0
PrcbOffset 00001878
ProcessOffset 000024c8
ThreadOffset 00002728
CallStackOffset 00002980
SizeOfCallStack 00000510
DriverListOffset 00003120
DriverCount 00000085
StringPoolOffset 000058a0
StringPoolSize 00001258
BrokenDriverOffset 00000000
TriageOptions 00000041
TopOfStack f5883af0
DebuggerDataOffset 00002e90
DebuggerDataSize 00000290
DataBlocksOffset 00006af8
DataBlocksCount 00000001
Windows XP Kernel Version 2600 (Service Pack 2) UP Free x86 compatible
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055b0c0
Debug session time: Fri Oct 19 22:40:14 2007
System Uptime: 0 days 8:32:04
start end module name
804d7000 806ed000 nt Checksum: 0021FA20 Timestamp: Thu Jul 19 17:
01:15 2007 (469F609B)
Unloaded modules:
f7da3000 f7da5000 splitter.sys Timestamp: unavailable (00000000)
b75ee000 b7619000 kmixer.sys Timestamp: unavailable (00000000)
f7dc7000 f7dc9000 splitter.sys Timestamp: unavailable (00000000)
f7db9000 f7dbb000 splitter.sys Timestamp: unavailable (00000000)
f7d89000 f7d8b000 splitter.sys Timestamp: unavailable (00000000)
f7d91000 f7d93000 splitter.sys Timestamp: unavailable (00000000)
b8cda000 b8d05000 kmixer.sys Timestamp: unavailable (00000000)
f7e05000 f7e06000 drmkaud.sys Timestamp: unavailable (00000000)
b96e5000 b96f2000 DMusic.sys Timestamp: unavailable (00000000)
b9775000 b9783000 swmidi.sys Timestamp: unavailable (00000000)
b8d2d000 b8d50000 aec.sys Timestamp: unavailable (00000000)
f7d8d000 f7d8f000 splitter.sys Timestamp: unavailable (00000000)
f79bf000 f79c9000 processr.sys Timestamp: unavailable (00000000)
f7b77000 f7b7c000 Cdaudio.SYS Timestamp: unavailable (00000000)
f6fab000 f6fae000 Sfloppy.SYS Timestamp: unavailable (00000000)
Finished dump check |
спрашиваю исключительно для расширения кругозора.
