commission
Posts: 26 +0
Hello
I have a Windows XP machine that has restarted twice in the last week for no particular reason. Can someone please make sense of this minidump please? What does all of this mean?
Microsoft (R) Windows Debugger Version 6.8.0004.0 X86
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [C:\Documents and Settings\Minidump\Mini112607-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: C:\WINDOWS\symbols
Executable search path is:
Windows XP Kernel Version 2600 (Service Pack 2) UP Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 2600.xpsp_sp2_gdr.070227-2254
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055a620
Debug session time: Mon Nov 26 14:22:48.259 2007 (GMT+11)
System Uptime: 0 days 5:13:32.701
Loading Kernel Symbols
.......................................................................................................................
Loading User Symbols
Loading unloaded module list
..................
*** ERROR: Module load completed but symbols could not be loaded for Ntfs.sys
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 24, {1902fe, add480f8, add47df4, f7b7a44a}
*** ERROR: Module load completed but symbols could not be loaded for sr.sys
*** WARNING: Unable to verify timestamp for VET-FILT.SYS
*** ERROR: Module load completed but symbols could not be loaded for VET-FILT.SYS
*** WARNING: Unable to verify timestamp for VETMONNT.SYS
*** ERROR: Module load completed but symbols could not be loaded for VETMONNT.SYS
Probably caused by : Ntfs.sys ( Ntfs+2844a )
Followup: MachineOwner
---------
kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
NTFS_FILE_SYSTEM (24)
If you see NtfsExceptionFilter on the stack then the 2nd and 3rd
parameters are the exception record and context record. Do a .cxr
on the 3rd parameter and then kb to obtain a more informative stack
trace.
Arguments:
Arg1: 001902fe
Arg2: add480f8
Arg3: add47df4
Arg4: f7b7a44a
Debugging Details:
------------------
EXCEPTION_RECORD: add480f8 -- (.exr 0xffffffffadd480f8)
ExceptionAddress: f7b7a44a (Ntfs+0x0002844a)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 00000000
Parameter[1]: 000002da
Attempt to read from address 000002da
CONTEXT: add47df4 -- (.cxr 0xffffffffadd47df4)
eax=000002da ebx=add40053 ecx=e31eead4 edx=e31e0057 esi=e2087288 edi=e2087290
eip=f7b7a44a esp=add481c0 ebp=add481cc iopl=0 nv up ei ng nz na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010286
Ntfs+0x2844a:
f7b7a44a 668b10 mov dx,word ptr [eax] ds:0023:000002da=????
Resetting default scope
CUSTOMER_CRASH_COUNT: 1
PROCESS_NAME: wmiprvse.exe
ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx". The memory could not be "%s".
READ_ADDRESS: 000002da
BUGCHECK_STR: 0x24
DEFAULT_BUCKET_ID: NULL_CLASS_PTR_DEREFERENCE
LAST_CONTROL_TRANSFER: from f7b7a4f4 to f7b7a44a
STACK_TEXT:
WARNING: Stack unwind information not available. Following frames may be wrong.
add481cc f7b7a4f4 e180523c add48210 e18050d0 Ntfs+0x2844a
add481f8 f7b7a622 8a6a4db8 e18050d0 add48338 Ntfs+0x284f4
add4835c f7b77d2d 8a6a4db8 89f65008 add483b4 Ntfs+0x28622
add48440 804e37f7 8a6fe020 89f65008 8a6a9640 Ntfs+0x25d2d
add48450 f746d876 89f651bc 8a6f5980 89f65008 nt!IopfCallDriver+0x31
add4849c 804e37f7 8a6f0e88 00000001 89f651e0 sr+0x5876
add48540 804e37f7 8a5ac958 89f65008 89f65008 nt!IopfCallDriver+0x31
add48550 8056f54a 8a6fe8e8 8a368a54 add486f8 nt!IopfCallDriver+0x31
add484dc f7809939 8a5aca10 89f65008 00000add nt!IopParseDevice+0xa12
add48540 804e37f7 8a5ac958 89f65008 89f65008 VET_FILT+0x2939
add48550 8056f54a 8a6fe8e8 8a368a54 add486f8 nt!IopfCallDriver+0x31
add48630 8056336c 8a6fe900 00000000 8a3689b0 nt!IopParseDevice+0xa12
add486b8 8056749a 00000000 add486f8 00000240 nt!ObpLookupObjectName+0x56a
add4870c 8056fa23 00000000 00000000 00000000 nt!ObOpenObjectByName+0xeb
add48788 8056faf2 add4894c 80000000 add48920 nt!IopCreateFile+0x407
add487e4 8056fbba add4894c 80000000 add48920 nt!IoCreateFile+0x8e
add48824 804de7ec add4894c 80000000 add48920 nt!NtOpenFile+0x27
add48824 804dcfdd add4894c 80000000 add48920 nt!KiFastCallEntry+0xf8
add488b4 f7817a2b add4894c 80000000 add48920 nt!ZwOpenFile+0x11
add48950 f7818b43 89eed840 89eed888 00000000 VETMONNT+0xa2b
add489a0 f7818c8b 8a027e0c 0000003f 00000000 VETMONNT+0x1b43
add489b4 f7817904 8a6f0dd0 8a027c58 add489e8 VETMONNT+0x1c8b
add48a04 f7809846 8a6f0dd0 8a027c58 8a027c68 VETMONNT+0x904
add48a60 804e37f7 8a5ac958 8a027c58 8a027c58 VET_FILT+0x2846
add48a70 8056f54a 8a6fe8e8 89f7d7a4 add48c18 nt!IopfCallDriver+0x31
add48b50 8056336c 8a6fe900 00000000 89f7d700 nt!IopParseDevice+0xa12
add48bd8 8056749a 00000000 add48c18 00000040 nt!ObpLookupObjectName+0x56a
add48c2c 8056fa23 00000000 00000000 72000001 nt!ObOpenObjectByName+0xeb
add48ca8 8056faf2 0007eee8 001200a9 0007ede4 nt!IopCreateFile+0x407
add48d04 8056fbba 0007eee8 001200a9 0007ede4 nt!IoCreateFile+0x8e
add48d44 804de7ec 0007eee8 001200a9 0007ede4 nt!NtOpenFile+0x27
add48d44 7c90eb94 0007eee8 001200a9 0007ede4 nt!KiFastCallEntry+0xf8
0007ee04 00000000 00000000 00000000 00000000 0x7c90eb94
FOLLOWUP_IP:
Ntfs+2844a
f7b7a44a 668b10 mov dx,word ptr [eax]
SYMBOL_STACK_INDEX: 0
SYMBOL_NAME: Ntfs+2844a
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: Ntfs
IMAGE_NAME: Ntfs.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 45cc56a7
STACK_COMMAND: .cxr 0xffffffffadd47df4 ; kb
FAILURE_BUCKET_ID: 0x24_Ntfs+2844a
BUCKET_ID: 0x24_Ntfs+2844a
Followup: MachineOwner
---------
I have a Windows XP machine that has restarted twice in the last week for no particular reason. Can someone please make sense of this minidump please? What does all of this mean?
Microsoft (R) Windows Debugger Version 6.8.0004.0 X86
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [C:\Documents and Settings\Minidump\Mini112607-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: C:\WINDOWS\symbols
Executable search path is:
Windows XP Kernel Version 2600 (Service Pack 2) UP Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 2600.xpsp_sp2_gdr.070227-2254
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055a620
Debug session time: Mon Nov 26 14:22:48.259 2007 (GMT+11)
System Uptime: 0 days 5:13:32.701
Loading Kernel Symbols
.......................................................................................................................
Loading User Symbols
Loading unloaded module list
..................
*** ERROR: Module load completed but symbols could not be loaded for Ntfs.sys
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 24, {1902fe, add480f8, add47df4, f7b7a44a}
*** ERROR: Module load completed but symbols could not be loaded for sr.sys
*** WARNING: Unable to verify timestamp for VET-FILT.SYS
*** ERROR: Module load completed but symbols could not be loaded for VET-FILT.SYS
*** WARNING: Unable to verify timestamp for VETMONNT.SYS
*** ERROR: Module load completed but symbols could not be loaded for VETMONNT.SYS
Probably caused by : Ntfs.sys ( Ntfs+2844a )
Followup: MachineOwner
---------
kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
NTFS_FILE_SYSTEM (24)
If you see NtfsExceptionFilter on the stack then the 2nd and 3rd
parameters are the exception record and context record. Do a .cxr
on the 3rd parameter and then kb to obtain a more informative stack
trace.
Arguments:
Arg1: 001902fe
Arg2: add480f8
Arg3: add47df4
Arg4: f7b7a44a
Debugging Details:
------------------
EXCEPTION_RECORD: add480f8 -- (.exr 0xffffffffadd480f8)
ExceptionAddress: f7b7a44a (Ntfs+0x0002844a)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 00000000
Parameter[1]: 000002da
Attempt to read from address 000002da
CONTEXT: add47df4 -- (.cxr 0xffffffffadd47df4)
eax=000002da ebx=add40053 ecx=e31eead4 edx=e31e0057 esi=e2087288 edi=e2087290
eip=f7b7a44a esp=add481c0 ebp=add481cc iopl=0 nv up ei ng nz na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010286
Ntfs+0x2844a:
f7b7a44a 668b10 mov dx,word ptr [eax] ds:0023:000002da=????
Resetting default scope
CUSTOMER_CRASH_COUNT: 1
PROCESS_NAME: wmiprvse.exe
ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx". The memory could not be "%s".
READ_ADDRESS: 000002da
BUGCHECK_STR: 0x24
DEFAULT_BUCKET_ID: NULL_CLASS_PTR_DEREFERENCE
LAST_CONTROL_TRANSFER: from f7b7a4f4 to f7b7a44a
STACK_TEXT:
WARNING: Stack unwind information not available. Following frames may be wrong.
add481cc f7b7a4f4 e180523c add48210 e18050d0 Ntfs+0x2844a
add481f8 f7b7a622 8a6a4db8 e18050d0 add48338 Ntfs+0x284f4
add4835c f7b77d2d 8a6a4db8 89f65008 add483b4 Ntfs+0x28622
add48440 804e37f7 8a6fe020 89f65008 8a6a9640 Ntfs+0x25d2d
add48450 f746d876 89f651bc 8a6f5980 89f65008 nt!IopfCallDriver+0x31
add4849c 804e37f7 8a6f0e88 00000001 89f651e0 sr+0x5876
add48540 804e37f7 8a5ac958 89f65008 89f65008 nt!IopfCallDriver+0x31
add48550 8056f54a 8a6fe8e8 8a368a54 add486f8 nt!IopfCallDriver+0x31
add484dc f7809939 8a5aca10 89f65008 00000add nt!IopParseDevice+0xa12
add48540 804e37f7 8a5ac958 89f65008 89f65008 VET_FILT+0x2939
add48550 8056f54a 8a6fe8e8 8a368a54 add486f8 nt!IopfCallDriver+0x31
add48630 8056336c 8a6fe900 00000000 8a3689b0 nt!IopParseDevice+0xa12
add486b8 8056749a 00000000 add486f8 00000240 nt!ObpLookupObjectName+0x56a
add4870c 8056fa23 00000000 00000000 00000000 nt!ObOpenObjectByName+0xeb
add48788 8056faf2 add4894c 80000000 add48920 nt!IopCreateFile+0x407
add487e4 8056fbba add4894c 80000000 add48920 nt!IoCreateFile+0x8e
add48824 804de7ec add4894c 80000000 add48920 nt!NtOpenFile+0x27
add48824 804dcfdd add4894c 80000000 add48920 nt!KiFastCallEntry+0xf8
add488b4 f7817a2b add4894c 80000000 add48920 nt!ZwOpenFile+0x11
add48950 f7818b43 89eed840 89eed888 00000000 VETMONNT+0xa2b
add489a0 f7818c8b 8a027e0c 0000003f 00000000 VETMONNT+0x1b43
add489b4 f7817904 8a6f0dd0 8a027c58 add489e8 VETMONNT+0x1c8b
add48a04 f7809846 8a6f0dd0 8a027c58 8a027c68 VETMONNT+0x904
add48a60 804e37f7 8a5ac958 8a027c58 8a027c58 VET_FILT+0x2846
add48a70 8056f54a 8a6fe8e8 89f7d7a4 add48c18 nt!IopfCallDriver+0x31
add48b50 8056336c 8a6fe900 00000000 89f7d700 nt!IopParseDevice+0xa12
add48bd8 8056749a 00000000 add48c18 00000040 nt!ObpLookupObjectName+0x56a
add48c2c 8056fa23 00000000 00000000 72000001 nt!ObOpenObjectByName+0xeb
add48ca8 8056faf2 0007eee8 001200a9 0007ede4 nt!IopCreateFile+0x407
add48d04 8056fbba 0007eee8 001200a9 0007ede4 nt!IoCreateFile+0x8e
add48d44 804de7ec 0007eee8 001200a9 0007ede4 nt!NtOpenFile+0x27
add48d44 7c90eb94 0007eee8 001200a9 0007ede4 nt!KiFastCallEntry+0xf8
0007ee04 00000000 00000000 00000000 00000000 0x7c90eb94
FOLLOWUP_IP:
Ntfs+2844a
f7b7a44a 668b10 mov dx,word ptr [eax]
SYMBOL_STACK_INDEX: 0
SYMBOL_NAME: Ntfs+2844a
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: Ntfs
IMAGE_NAME: Ntfs.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 45cc56a7
STACK_COMMAND: .cxr 0xffffffffadd47df4 ; kb
FAILURE_BUCKET_ID: 0x24_Ntfs+2844a
BUCKET_ID: 0x24_Ntfs+2844a
Followup: MachineOwner
---------
