Could someone pls explain my minidump to me

[rain]

Hi i have just this minute figured out how to read the .dmp file using WinDgb

this is what i retrieved, could some one please explain it to me thank you.

my pc randomly restarted

------------------------------

Microsoft (R) Windows Debugger Version 6.6.0007.5
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\WINDOWS\Minidump\Mini092806-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: *** Invalid ***
****************************************************************************
* Symbol loading may be unreliable without a symbol search path. *
* Use .symfix to have the debugger choose a symbol path. *
* After setting your symbol path, use .reload to refresh symbol locations. *
****************************************************************************
Executable search path is:
*********************************************************************
* Symbols can not be loaded because symbol path is not initialized. *
* *
* The Symbol Path can be set by: *
* using the _NT_SYMBOL_PATH environment variable. *
* using the -y <symbol_path> argument when starting the debugger. *
* using .sympath and .sympath+ *
*********************************************************************
Unable to load image ntoskrnl.exe, Win32 error 2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
*** ERROR: Module load completed but symbols could not be loaded for ntoskrnl.exe
Windows XP Kernel Version 2600 (Service Pack 2) UP Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055ab20
Debug session time: Thu Sep 28 15:51:32.453 2006 (GMT+1)
System Uptime: 0 days 2:33:16.041
*********************************************************************
* Symbols can not be loaded because symbol path is not initialized. *
* *
* The Symbol Path can be set by: *
* using the _NT_SYMBOL_PATH environment variable. *
* using the -y <symbol_path> argument when starting the debugger. *
* using .sympath and .sympath+ *
*********************************************************************
Unable to load image ntoskrnl.exe, Win32 error 2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
*** ERROR: Module load completed but symbols could not be loaded for ntoskrnl.exe
Loading Kernel Symbols
.....................................................................................................................
Loading User Symbols
Loading unloaded module list
.............
Unable to load image Ntfs.sys, Win32 error 2
*** WARNING: Unable to verify timestamp for Ntfs.sys
*** ERROR: Module load completed but symbols could not be loaded for Ntfs.sys
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 24, {1902fe, f7a7e300, f7a7dffc, f76a0365}

ANALYSIS: Kernel with unknown size. Will force reload symbols with known size.
ANALYSIS: Force reload command: .reload /f ntoskrnl.exe=FFFFFFFF804D7000,214600,41108004
***** Kernel symbols are WRONG. Please fix symbols to do analysis.

***** Kernel symbols are WRONG. Please fix symbols to do analysis.

*** WARNING: Unable to verify timestamp for avg7rsxp.sys
*** ERROR: Module load completed but symbols could not be loaded for avg7rsxp.sys
*** WARNING: Unable to verify timestamp for avg7rsw.sys
*** ERROR: Module load completed but symbols could not be loaded for avg7rsw.sys
*** WARNING: Unable to verify timestamp for vsdatant.sys
*** ERROR: Module load completed but symbols could not be loaded for vsdatant.sys
*** WARNING: Unable to verify timestamp for dump_atapi.sys
*** ERROR: Module load completed but symbols could not be loaded for dump_atapi.sys
Probably caused by : Ntfs.sys ( Ntfs+32365 )

Followup: MachineOwner
---------


Thanks alot for any help

Regards

Rain

 

[rain]

Hi all again i could really do with the help

ive uploaded my dmp file

 

[N3051M]

You forgot to set the symbol's source and reanalyze with it.

NTFS_FILE_SYSTEM (24)
    If you see NtfsExceptionFilter on the stack then the 2nd and 3rd
    parameters are the exception record and context record. Do a .cxr
    on the 3rd parameter and then kb to obtain a more informative stack
    trace.

this will help you solve your problem, http://aumha.org/win5/kbestop.php#0x24

attatched is my analysis.

 

[hnsexeter]

Hi there - looked at the dmp

The crash occured in Internet Explorer, through ntfs.sys - As its ntfs.sys I'd recommend doing a chkdsk /r at the command prompt to check and repair any hard disk sectors

If that fails, your hard disk could be on its way out

Chris
www.wpcpoorly.com