hallo,
eindelijk eruit geraakt en dit is wat ik nu te zien krijg:
Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [C:\WINDOWS\Minidump\Mini112409-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: C:\WINDOWS\Symbols
Executable search path is:
Unable to load image ntoskrnl.exe, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
Windows XP Kernel Version 2600 (Service Pack 3) MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Machine Name:
Kernel base = 0x804d7000 PsLoadedModuleList = 0x805634c0
Debug session time: Tue Nov 24 21:19:08.046 2009 (GMT+1)
System Uptime: 0 days 0:24:10.593
Unable to load image ntoskrnl.exe, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
Loading Kernel Symbols
...............................................................
...................................................
Loading User Symbols
Loading unloaded module list
.............
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 1000000A, {c0cd5a42, 1, 0, 804ea268}
Probably caused by : ntoskrnl.exe ( nt!KeDetachProcess+32 )
Followup: MachineOwner
---------
0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: c0cd5a42, memory referenced
Arg2: 00000001, IRQL
Arg3: 00000000, bitfield :
bit 0 : value 0 = read operation, 1 = write operation
bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: 804ea268, address which referenced memory
Debugging Details:
------------------
READ_ADDRESS: c0cd5a42
CURRENT_IRQL: 1
FAULTING_IP:
nt!KeDetachProcess+32
804ea268 8b3c98 mov edi,dword ptr [eax+ebx*4]
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: DRIVER_FAULT
BUGCHECK_STR: 0xA
PROCESS_NAME: nod32.exe
LAST_CONTROL_TRANSFER: from 804f49d5 to 804ea268
STACK_TEXT:
b88aa500 804f49d5 0000e161 890a6150 89b319c8 nt!KeDetachProcess+0x32
b88aa540 805709ac dd300000 00000000 00000000 nt!CcGetVacbMiss+0x1a9
b88aa558 804f48c0 89b319c8 890a6150 00000000 nt!CmQueryKey+0x2
b88aa58c 804f8e48 00000000 00000000 00d220e0 nt!ExpFindCurrentThread+0x48
b88aa594 00000000 00d220e0 00000001 890a6150 nt!RtlImageNtHeader+0x3
STACK_COMMAND: kb
FOLLOWUP_IP:
nt!KeDetachProcess+32
804ea268 8b3c98 mov edi,dword ptr [eax+ebx*4]
SYMBOL_STACK_INDEX: 0
SYMBOL_NAME: nt!KeDetachProcess+32
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntoskrnl.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 48a4044a
FAILURE_BUCKET_ID: 0xA_nt!KeDetachProcess+32
BUCKET_ID: 0xA_nt!KeDetachProcess+32
Followup: MachineOwner
---------
Zie ik daar ergens driver fault?
Of kan iemand me wat verder helpen?
Grtz Marcel
