TechSpot

Could someone pls explain my minidump to me

By rain
Sep 28, 2006
  1. Hi i have just this minute figured out how to read the .dmp file using WinDgb

    this is what i retrieved, could some one please explain it to me thank you.

    my pc randomly restarted

    ------------------------------

    Microsoft (R) Windows Debugger Version 6.6.0007.5
    Copyright (c) Microsoft Corporation. All rights reserved.


    Loading Dump File [C:\WINDOWS\Minidump\Mini092806-01.dmp]
    Mini Kernel Dump File: Only registers and stack trace are available

    Symbol search path is: *** Invalid ***
    ****************************************************************************
    * Symbol loading may be unreliable without a symbol search path. *
    * Use .symfix to have the debugger choose a symbol path. *
    * After setting your symbol path, use .reload to refresh symbol locations. *
    ****************************************************************************
    Executable search path is:
    *********************************************************************
    * Symbols can not be loaded because symbol path is not initialized. *
    * *
    * The Symbol Path can be set by: *
    * using the _NT_SYMBOL_PATH environment variable. *
    * using the -y <symbol_path> argument when starting the debugger. *
    * using .sympath and .sympath+ *
    *********************************************************************
    Unable to load image ntoskrnl.exe, Win32 error 2
    *** WARNING: Unable to verify timestamp for ntoskrnl.exe
    *** ERROR: Module load completed but symbols could not be loaded for ntoskrnl.exe
    Windows XP Kernel Version 2600 (Service Pack 2) UP Free x86 compatible
    Product: WinNt, suite: TerminalServer SingleUserTS
    Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055ab20
    Debug session time: Thu Sep 28 15:51:32.453 2006 (GMT+1)
    System Uptime: 0 days 2:33:16.041
    *********************************************************************
    * Symbols can not be loaded because symbol path is not initialized. *
    * *
    * The Symbol Path can be set by: *
    * using the _NT_SYMBOL_PATH environment variable. *
    * using the -y <symbol_path> argument when starting the debugger. *
    * using .sympath and .sympath+ *
    *********************************************************************
    Unable to load image ntoskrnl.exe, Win32 error 2
    *** WARNING: Unable to verify timestamp for ntoskrnl.exe
    *** ERROR: Module load completed but symbols could not be loaded for ntoskrnl.exe
    Loading Kernel Symbols
    .....................................................................................................................
    Loading User Symbols
    Loading unloaded module list
    .............
    Unable to load image Ntfs.sys, Win32 error 2
    *** WARNING: Unable to verify timestamp for Ntfs.sys
    *** ERROR: Module load completed but symbols could not be loaded for Ntfs.sys
    *******************************************************************************
    * *
    * Bugcheck Analysis *
    * *
    *******************************************************************************

    Use !analyze -v to get detailed debugging information.

    BugCheck 24, {1902fe, f7a7e300, f7a7dffc, f76a0365}

    ANALYSIS: Kernel with unknown size. Will force reload symbols with known size.
    ANALYSIS: Force reload command: .reload /f ntoskrnl.exe=FFFFFFFF804D7000,214600,41108004
    ***** Kernel symbols are WRONG. Please fix symbols to do analysis.

    ***** Kernel symbols are WRONG. Please fix symbols to do analysis.

    *** WARNING: Unable to verify timestamp for avg7rsxp.sys
    *** ERROR: Module load completed but symbols could not be loaded for avg7rsxp.sys
    *** WARNING: Unable to verify timestamp for avg7rsw.sys
    *** ERROR: Module load completed but symbols could not be loaded for avg7rsw.sys
    *** WARNING: Unable to verify timestamp for vsdatant.sys
    *** ERROR: Module load completed but symbols could not be loaded for vsdatant.sys
    *** WARNING: Unable to verify timestamp for dump_atapi.sys
    *** ERROR: Module load completed but symbols could not be loaded for dump_atapi.sys
    Probably caused by : Ntfs.sys ( Ntfs+32365 )

    Followup: MachineOwner
    ---------


    Thanks alot for any help

    Regards

    Rain
     
  2. rain

    rain TS Rookie Topic Starter

    Hi all again i could really do with the help

    ive uploaded my dmp file
     
  3. N3051M

    N3051M TS Evangelist Posts: 2,115

    you forgot to set the symbol's source and reanalyze with it.

    Code:
    NTFS_FILE_SYSTEM (24)
        If you see NtfsExceptionFilter on the stack then the 2nd and 3rd
        parameters are the exception record and context record. Do a .cxr
        on the 3rd parameter and then kb to obtain a more informative stack
        trace.
    
    this will help you solve your problem, http://aumha.org/win5/kbestop.php#0x24

    attatched is my analysis.
     

    Attached Files:

  4. hnsexeter

    hnsexeter TS Rookie Posts: 43

    Hi there - looked at the dmp

    The crash occured in Internet Explorer, through ntfs.sys - As its ntfs.sys I'd recommend doing a chkdsk /r at the command prompt to check and repair any hard disk sectors

    If that fails, your hard disk could be on its way out

    Chris
    www.wpcpoorly.com
     
Topic Status:
Not open for further replies.

Similar Topics

Add New Comment

You need to be a member to leave a comment. Join thousands of tech enthusiasts and participate.
TechSpot Account You may also...