R
ricardo.l
I am going crazy to troubleshoot this problem: after googling it and also
reading throughout this community I got several hints but still working on it.
I was doing nothing special when BSOD appeared. Since then I was not able
anymore to boot the system in anyway. Not even safe mode.
It just goes blank right after logo screen and stuck there.
If (unlikely) due to a new disk added on a sata channel, days ago, for data
storage, which is still healthy and with data on it, then it could be
boot.ini problem...but why did It work finely for days?
I remember that last program installation was the asus smart doc utility to
manage Gpu fan control (which I found noisy and wanted to monitor) but it
never worked, just got the error kinda "missing resource.." when trying start
that application.
Can you provide help from the piece of debugger log attached below?
I can only add that never had disk problems till now (nor BSOD), although
when I ran chkdsk /f on primary partition it found several file record
segments unreadable between 12380 and 12402, it recovered lost files, saying
it made corrections to file system. And that an unspecified error occurred.
Thank you for providing suggestions...
ricardo
-----
Microsoft (R) Windows Debugger Version 6.8.0004.0 X86
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [d:\windows\minidump\mini111807-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is:
srv*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Unable to load image ntoskrnl.exe, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
*** ERROR: Module load completed but symbols could not be loaded for
ntoskrnl.exe
Windows XP Kernel Version 2600 (Service Pack 2) UP Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Kernel base = 0x804d7000 PsLoadedModuleList = 0x805533a0
Debug session time: Sun Nov 18 03:10:35.015 2007 (GMT+1)
System Uptime: 0 days 0:04:31.593
Unable to load image ntoskrnl.exe, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
*** ERROR: Module load completed but symbols could not be loaded for
ntoskrnl.exe
Loading Kernel Symbols
...................................................................................................................................................................
Loading User Symbols
Loading unloaded module list
...........
*******************************************************************************
*
*
* Bugcheck Analysis
*
*
*
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 100000EA, {870d0020, 89d0eed8, bacdfcb4, 1}
***** Kernel symbols are WRONG. Please fix symbols to do analysis.
Unable to load image watchdog.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for watchdog.sys
*** ERROR: Module load completed but symbols could not be loaded for
watchdog.sys
*** WARNING: Unable to verify timestamp for a347scsi.sys
*** ERROR: Module load completed but symbols could not be loaded for
a347scsi.sys
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
*************************************************************************
Probably caused by : ntoskrnl.exe
Followup: MachineOwner
---------
*******************************************************************************
*
*
* Bugcheck Analysis
*
*
*
*******************************************************************************
THREAD_STUCK_IN_DEVICE_DRIVER_M (100000ea)
The device driver is spinning in an infinite loop, most likely waiting for
hardware to become idle. This usually indicates problem with the hardware
itself or with the device driver programming the hardware incorrectly.
If the kernel debugger is connected and running when watchdog detects a
timeout condition then DbgBreakPoint() will be called instead of
KeBugCheckEx()
and detailed message including bugcheck arguments will be printed to the
debugger. This way we can identify an offending thread, set breakpoints in it,
and hit go to return to the spinning code to debug it further. Because
KeBugCheckEx() is not called the .bugcheck directive will not return bugcheck
information in this case. The arguments are already printed out to the kernel
debugger. You can also retrieve them from a global variable via
"dd watchdog!g_WdBugCheckData l5" (use dq on NT64).
On MP machines it is possible to hit a timeout when the spinning thread is
interrupted by hardware interrupt and ISR or DPC routine is running at the
time
of the bugcheck (this is because the timeout's work item can be delivered and
handled on the second CPU and the same time). If this is the case you will
have
to look deeper at the offending thread's stack (e.g. using dds) to determine
spinning code which caused the timeout to occur.
Arguments:
Arg1: 870d0020, Pointer to a stuck thread object. Do .thread then kb on it
to find
the hung location.
Arg2: 89d0eed8, Pointer to a DEFERRED_WATCHDOG object.
Arg3: bacdfcb4, Pointer to offending driver name.
Arg4: 00000001, Number of times "intercepted" bugcheck 0xEA was hit (see
notes).
Debugging Details:
------------------
***** Kernel symbols are WRONG. Please fix symbols to do analysis.
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
*************************************************************************
MODULE_NAME: nt
FAULTING_MODULE: 804d7000 nt
DEBUG_FLR_IMAGE_TIMESTAMP: 45e53f9c
FAULTING_THREAD: 870d0020
DEFAULT_BUCKET_ID: WRONG_SYMBOLS
CUSTOMER_CRASH_COUNT: 1
BUGCHECK_STR: 0xEA
LAST_CONTROL_TRANSFER: from 8053e2e3 to 80540c9f
STACK_TEXT:
WARNING: Stack unwind information not available. Following frames may be
wrong.
b342b418 8053e2e3 badb0d00 00000001 000b0217 nt+0x69c9f
b342b494 00000000 badb0d00 00000000 00000240 nt+0x672e3
STACK_COMMAND: .thread 0xffffffff870d0020 ; kb
FOLLOWUP_IP:
nt+69c9f
80540c9f 8b2c24 mov ebp,dword ptr [esp]
SYMBOL_STACK_INDEX: 0
SYMBOL_NAME: nt+69c9f
FOLLOWUP_NAME: MachineOwner
IMAGE_NAME: ntoskrnl.exe
BUCKET_ID: WRONG_SYMBOLS
Followup: MachineOwner
---------
GetPointerFromAddress: unable to read from 80557db4
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_ETHREAD ***
*** ***
*************************************************************************
89e403c8: Unable to get thread contents
start end module name
804d7000 806ce400 nt T (no symbols)
Loaded symbol image file: ntoskrnl.exe
Image path: ntoskrnl.exe
Image name: ntoskrnl.exe
Timestamp: Wed Feb 28 09:38:52 2007 (45E53F9C)
CheckSum: 001F9460
ImageSize: 001F7400
Translations: 0000.04b0 0000.04e0 0409.04b0 0409.04e0
806cf000 806ef380 hal (deferred)
Image path: hal.dll
Image name: hal.dll
Timestamp: Wed Aug 04 07:59:05 2004 (41107B29)
CheckSum: 0002CFD1
ImageSize: 00020380
Translations: 0000.04b0 0000.04e0 0409.04b0 0409.04e0
.....
long list of deferred modules, and unloaded as well
reading throughout this community I got several hints but still working on it.
I was doing nothing special when BSOD appeared. Since then I was not able
anymore to boot the system in anyway. Not even safe mode.
It just goes blank right after logo screen and stuck there.
If (unlikely) due to a new disk added on a sata channel, days ago, for data
storage, which is still healthy and with data on it, then it could be
boot.ini problem...but why did It work finely for days?
I remember that last program installation was the asus smart doc utility to
manage Gpu fan control (which I found noisy and wanted to monitor) but it
never worked, just got the error kinda "missing resource.." when trying start
that application.
Can you provide help from the piece of debugger log attached below?
I can only add that never had disk problems till now (nor BSOD), although
when I ran chkdsk /f on primary partition it found several file record
segments unreadable between 12380 and 12402, it recovered lost files, saying
it made corrections to file system. And that an unspecified error occurred.
Thank you for providing suggestions...
ricardo
-----
Microsoft (R) Windows Debugger Version 6.8.0004.0 X86
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [d:\windows\minidump\mini111807-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is:
srv*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Unable to load image ntoskrnl.exe, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
*** ERROR: Module load completed but symbols could not be loaded for
ntoskrnl.exe
Windows XP Kernel Version 2600 (Service Pack 2) UP Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Kernel base = 0x804d7000 PsLoadedModuleList = 0x805533a0
Debug session time: Sun Nov 18 03:10:35.015 2007 (GMT+1)
System Uptime: 0 days 0:04:31.593
Unable to load image ntoskrnl.exe, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
*** ERROR: Module load completed but symbols could not be loaded for
ntoskrnl.exe
Loading Kernel Symbols
...................................................................................................................................................................
Loading User Symbols
Loading unloaded module list
...........
*******************************************************************************
*
*
* Bugcheck Analysis
*
*
*
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 100000EA, {870d0020, 89d0eed8, bacdfcb4, 1}
***** Kernel symbols are WRONG. Please fix symbols to do analysis.
Unable to load image watchdog.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for watchdog.sys
*** ERROR: Module load completed but symbols could not be loaded for
watchdog.sys
*** WARNING: Unable to verify timestamp for a347scsi.sys
*** ERROR: Module load completed but symbols could not be loaded for
a347scsi.sys
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
*************************************************************************
Probably caused by : ntoskrnl.exe
Followup: MachineOwner
---------
*******************************************************************************
*
*
* Bugcheck Analysis
*
*
*
*******************************************************************************
THREAD_STUCK_IN_DEVICE_DRIVER_M (100000ea)
The device driver is spinning in an infinite loop, most likely waiting for
hardware to become idle. This usually indicates problem with the hardware
itself or with the device driver programming the hardware incorrectly.
If the kernel debugger is connected and running when watchdog detects a
timeout condition then DbgBreakPoint() will be called instead of
KeBugCheckEx()
and detailed message including bugcheck arguments will be printed to the
debugger. This way we can identify an offending thread, set breakpoints in it,
and hit go to return to the spinning code to debug it further. Because
KeBugCheckEx() is not called the .bugcheck directive will not return bugcheck
information in this case. The arguments are already printed out to the kernel
debugger. You can also retrieve them from a global variable via
"dd watchdog!g_WdBugCheckData l5" (use dq on NT64).
On MP machines it is possible to hit a timeout when the spinning thread is
interrupted by hardware interrupt and ISR or DPC routine is running at the
time
of the bugcheck (this is because the timeout's work item can be delivered and
handled on the second CPU and the same time). If this is the case you will
have
to look deeper at the offending thread's stack (e.g. using dds) to determine
spinning code which caused the timeout to occur.
Arguments:
Arg1: 870d0020, Pointer to a stuck thread object. Do .thread then kb on it
to find
the hung location.
Arg2: 89d0eed8, Pointer to a DEFERRED_WATCHDOG object.
Arg3: bacdfcb4, Pointer to offending driver name.
Arg4: 00000001, Number of times "intercepted" bugcheck 0xEA was hit (see
notes).
Debugging Details:
------------------
***** Kernel symbols are WRONG. Please fix symbols to do analysis.
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
*************************************************************************
MODULE_NAME: nt
FAULTING_MODULE: 804d7000 nt
DEBUG_FLR_IMAGE_TIMESTAMP: 45e53f9c
FAULTING_THREAD: 870d0020
DEFAULT_BUCKET_ID: WRONG_SYMBOLS
CUSTOMER_CRASH_COUNT: 1
BUGCHECK_STR: 0xEA
LAST_CONTROL_TRANSFER: from 8053e2e3 to 80540c9f
STACK_TEXT:
WARNING: Stack unwind information not available. Following frames may be
wrong.
b342b418 8053e2e3 badb0d00 00000001 000b0217 nt+0x69c9f
b342b494 00000000 badb0d00 00000000 00000240 nt+0x672e3
STACK_COMMAND: .thread 0xffffffff870d0020 ; kb
FOLLOWUP_IP:
nt+69c9f
80540c9f 8b2c24 mov ebp,dword ptr [esp]
SYMBOL_STACK_INDEX: 0
SYMBOL_NAME: nt+69c9f
FOLLOWUP_NAME: MachineOwner
IMAGE_NAME: ntoskrnl.exe
BUCKET_ID: WRONG_SYMBOLS
Followup: MachineOwner
---------
GetPointerFromAddress: unable to read from 80557db4
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_ETHREAD ***
*** ***
*************************************************************************
89e403c8: Unable to get thread contents
start end module name
804d7000 806ce400 nt T (no symbols)
Loaded symbol image file: ntoskrnl.exe
Image path: ntoskrnl.exe
Image name: ntoskrnl.exe
Timestamp: Wed Feb 28 09:38:52 2007 (45E53F9C)
CheckSum: 001F9460
ImageSize: 001F7400
Translations: 0000.04b0 0000.04e0 0409.04b0 0409.04e0
806cf000 806ef380 hal (deferred)
Image path: hal.dll
Image name: hal.dll
Timestamp: Wed Aug 04 07:59:05 2004 (41107B29)
CheckSum: 0002CFD1
ImageSize: 00020380
Translations: 0000.04b0 0000.04e0 0409.04b0 0409.04e0
.....
long list of deferred modules, and unloaded as well