Xp/2000 - Schermate blu (bsod):individuazione cause dell'errore e possibili soluzioni

[Danger]

Ciao, è da qualche giorno che le schermate blu mi perseguitano.
Il mio tecnico "di fiducia" (poca a di r la verità) propone un rapido format ma preferirei risolvere i problemi invece che girarci attorno.
La schermata di oggi mi ha segnalato
Driver IRL Not Less Or Equal
e di seguito mi indicava un problema con
OAMON.SYS
credo sia un file di Online Armor il firewall che ho installato, installando una nuova versione del firewall si potrebbe risolvere la magagna?

[VdW]

Originariamente inviato da Danger

Ciao, è da qualche giorno che le schermate blu mi perseguitano.
Il mio tecnico "di fiducia" (poca a di r la verità) propone un rapido format ma preferirei risolvere i problemi invece che girarci attorno.
La schermata di oggi mi ha segnalato
Driver IRL Not Less Or Equal
e di seguito mi indicava un problema con
OAMON.SYS
credo sia un file di Online Armor il firewall che ho installato, installando una nuova versione del firewall si potrebbe risolvere la magagna?

intanto se lo disinstalli e il problema scompare capisci che la causa era quel programma, altrimenti capisci che devi cercare altrove la causa.

[fk0]

Qualche idea su come forzare il salvataggio del minidump sun un path differente?
Se il sistema operativo sta su di una partizione crittografata il salvataggio fallisce, compare anche l'indicazione del fallito salvataggio per un istante e accade sia che l'SO sia un x86 che un x64.
Non ho particolari problemi ma aggiornare i driver ati e' ogni volta un calvario perche' devo prima disinstallarli, rimuovere tutti i files residui e tutte le chiavi nel registro manualmente e poi installare i nuovi, quindi ripetere se qualcosa va storto.
La mia intenzione era di restringere il problema e vedere come semplificare e ridurre almeno il numero di riavvii necessari, ma sprattutto scovare le eventuali incompatibilita' con ATT e altre utility che occasionalmente mi fanno impazzire.

Edit: con google non ho trovato niente ma cercando nel registro forse si; i path che cercavo si trovano nel registro in Control\CrashControl, lo edito e poi vediamo che succede.

[Gatzu81]

Salve a tutti, oggi ho dovuto formattare il pc di un mio amico. E' un vecchio P4 su Asus P4S8X-X con 512mb di ram ed un HDD Ide da 160Gb della Maxtor (Win Xp Pro).
Avvio la proceedura di installazione, arrivo alla schermata di formattazione, procedo con la stessa ma quano deve cominiciare a copiare i file dal lettore si blocca tutto con una schermata blu: driver irql not less or equal. Ho riprovato più volte ma continua a comparire questa schermata o quella relativa a PNF List Corrupt.
Ho provato a sostituira la Ram, l'hdd, la scheda video, ma niente da fare.
Ho anche creato un Cd di installazione con i driver Ide (anche se mi sembra strano dato che non è un Sata) tanto per provare, ma nulla.
Cosa potrebbe essere? La MB che sta per morire?
Non credo nemmeno sia un problema di alimentazione...

Grazie mille a tutti

[rgntms]

Salve a tutti...io ho un problema ogni qualvolta vado a riprodurre un file video di qualsiasi tipo e con qualsiasi programma mi si riavvia il pc dandomi la sk di errore blu---questo è il codice dell'errore

Si è verificato un errore e windows è stato arrestato per impedire danni al computer.
IRQL_NOT_LESS_OR_EQUAL

Se è la prima volta che ti succede riavviare il computer....( e via con la solita storia)......

Informazioni Tecniche:
*** STOP: 0X0000000 A(0X00000016 , 0X0000001C , 0X00000000, 0X805021DE)
Inizio creazione immagine fisica su disco
Scaricamento della memoria fisica completato
Contattare l'amministratore di sistema o il gruppo di supporto tecnico per ulteriori info

premetto ke ho già provato ad aggiornare i driver..e che dopo aver formattato il pc lo stesso problema mi mi si è ripresentato dopo pochi giorni
ho già aperto una discussione quihttp://www.hwupgrade.it/forum/showthread.php?t=2064207..e mi hanno detto di rivolgermi in questo topic

[flex990]

salve ragazzi. sono di fronte ad un nuovo problema. al pc di mio zio ho aggiornato il sistema operativo perchè dava la schermata blu con errore ntfs.sys. purtroppo dopo la copia dei file si riavvia come dovrebbe e all'istallazione delle periferiche da questa strana schermata blu:



cosa significa?

[mister marco]

Problema con windows?
La schermata blu che compare è questa:

Si è verificato un problema e Windows è stato arrestato per impedire danni al computer.
Se è la prima volta che appare la schermata di errore relativa all’arresto, riavviare il computer. Se la schermata riappare, procedere come segue:
Verificare che sia disponibile sufficiente spazio su disco. Se il messaggio di arresto specifica un driver, disattiva il driver o richieder gli aggiornamenti del driver. Provare a cambiare le schede video.
Contattare il fornitore dell’hardware per richiedere eventuali aggiornamenti del BIOS.
Disattivare nel BIOS le opzioni relative alla memoria quali cache o shadowing. Per utilizzare la modalità provvisoria allo scopo di rimuovere o disattivare componenti, riavviare il computer, premere F8 per selezionare le opzioni di avvio avanzate, quindi selezionare la modalità provvisoria.
Informazioni tecniche:
***STOP: 0x0000007E (0x0000005,0x00000000,0xFT8EEAC4,0xF78EE…

[Regedit_80]

Salve a tutti.Vorrei approfittare di questo topic per chiedere un aiuto.
ho un pc cosi' composto:

asrock k7s41gx
Amd sempron 2200+
1 Gb ddr a-data
Ati radeon 7000ve 32 MB agp4x
HD maxtor 80GB


Molto spesso (soprattutto al primo avvio del pc)mi appare la famigerata
schermata blu

Bad_pool_header
0x0000008E
0xc0000005
0xBF81B79B ---->questo tipo di codice non riesco a trovarlo sul sito microsoft
0x0000000
ADDRESS BF81B79B
BASE BF800000
win32k.sys

ho testato le ram con memtest86+ e con memory diagnostic tool della microsoft facendoli lavorare per 2 cicli continui ciascuno e non mi e' stato riportato nessun errore.

ho aggiornato il bios e l'ho settato di default

ho frammentato il disco rigido e l'ho testato con HDDLIFE e un altro tool che non ricordo.Tutto OK (l'unica cosa strana e' che pur risultando integro a volte sento uno scatto tipo "TLIC-TLAC" all'interno dell'HD e per quell'istante mi si pianta il pc-cursore compreso- per poi riprendere a funzionare subito dopo)

Sinceramente
Ho alcuni dubbi con la mia scheda video(sino ad ora avevo i driver generici di microsoft ma che con la scheda montata su una ASUS CUV4X-X non mi hanno creato problemi)
...e' possibile che quella schermata dia indicazioni sul problema specifico e come faccio a stabilirlo con certezza?
Spero in un vostro aiuto illuminante.
Grazie

[Regedit_80]

allego la schermata completa di debug elaborata da "microsoft debugger"

Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\WINDOWS\Minidump\Mini110809-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: C:\WINDOWS\Symbols
Executable search path is: 
Unable to load image ntoskrnl.exe, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
Windows XP Kernel Version 2600 (Service Pack 3) UP Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Machine Name:
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055b1c0
Debug session time: Sun Nov  8 19:58:28.218 2009 (GMT+1)
System Uptime: 0 days 0:08:53.781
Unable to load image ntoskrnl.exe, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
Loading Kernel Symbols
...............................................................
...............................................
Loading User Symbols
Loading unloaded module list
..........
Unable to load image win32k.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for win32k.sys
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1000008E, {c0000005, bf81b79b, f2bd2c3c, 0}

Probably caused by : win32k.sys ( win32k!SearchIconCache+20 )

Followup: MachineOwner
---------

kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

KERNEL_MODE_EXCEPTION_NOT_HANDLED_M (1000008e)
This is a very common bugcheck.  Usually the exception address pinpoints
the driver/function that caused the problem.  Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003.  This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG.  This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG.  This will let us see why this breakpoint is
happening.
Arguments:
Arg1: c0000005, The exception code that was not handled
Arg2: bf81b79b, The address that the exception occurred at
Arg3: f2bd2c3c, Trap Frame
Arg4: 00000000

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - L'istruzione a "0x%08lx" ha fatto riferimento alla memoria a "0x%08lx". La memoria non poteva essere "%s".

FAULTING_IP: 
win32k!SearchIconCache+20
bf81b79b 663b461c        cmp     ax,word ptr [esi+1Ch]

TRAP_FRAME:  f2bd2c3c -- (.trap 0xfffffffff2bd2c3c)
ErrCode = 00000000
eax=e1b1c001 ebx=bf81b5fa ecx=f2bd2d18 edx=00000000 esi=005e0000 edi=f2bd2cfc
eip=bf81b79b esp=f2bd2cb0 ebp=f2bd2cb8 iopl=0         nv up ei pl nz na po cy
cs=0008  ss=0010  ds=0023  es=0023  fs=0030  gs=0000             efl=00010203
win32k!SearchIconCache+0x20:
bf81b79b 663b461c        cmp     ax,word ptr [esi+1Ch]    ds:0023:005e001c=????
Resetting default scope

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  DRIVER_FAULT

BUGCHECK_STR:  0x8E

PROCESS_NAME:  ctfmon.exe

LAST_CONTROL_TRANSFER:  from bf81b73a to bf81b79b

STACK_TEXT:  
f2bd2cb8 bf81b73a 005e0000 0000c001 f2bd2d18 win32k!SearchIconCache+0x20
f2bd2cd8 bf81b6c1 0000c001 f2bd2d18 e146e9e0 win32k!_FindExistingCursorIcon+0x38
f2bd2d50 804de7ec 0007f54c 0007f55c 0007f60c win32k!NtUserFindExistingCursorIcon+0xfe
f2bd2d50 7c91e4f4 0007f54c 0007f55c 0007f60c nt!KiFastCallEntry+0xf8
WARNING: Frame IP not in any known module. Following frames may be wrong.
0007f56c 00000000 00000000 00000000 00000000 0x7c91e4f4


STACK_COMMAND:  kb

FOLLOWUP_IP: 
win32k!SearchIconCache+20
bf81b79b 663b461c        cmp     ax,word ptr [esi+1Ch]

SYMBOL_STACK_INDEX:  0

SYMBOL_NAME:  win32k!SearchIconCache+20

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: win32k

IMAGE_NAME:  win32k.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  48025f2a

FAILURE_BUCKET_ID:  0x8E_win32k!SearchIconCache+20

BUCKET_ID:  0x8E_win32k!SearchIconCache+20

Followup: MachineOwner
---------

kd> .trap 0xfffffffff2bd2c3c
ErrCode = 00000000
eax=e1b1c001 ebx=bf81b5fa ecx=f2bd2d18 edx=00000000 esi=005e0000 edi=f2bd2cfc
eip=bf81b79b esp=f2bd2cb0 ebp=f2bd2cb8 iopl=0         nv up ei pl nz na po cy
cs=0008  ss=0010  ds=0023  es=0023  fs=0030  gs=0000             efl=00010203
win32k!SearchIconCache+0x20:
bf81b79b 663b461c        cmp     ax,word ptr [esi+1Ch]    ds:0023:005e001c=????

[Regedit_80]

ho appena notato che la mia mobo ha una decina di condensatori gonfi(!!!!) credo proprio che siano dovuti a questo problema tutti questi crash di sistema e anche il fatto che molte periferiche usb non mi vengono riconosciute dal sistema...
voi che ne pensate?

[gnpb]

Puoi starne certo

Qui un esempio ma ne ho diversi altri personali nel corso degli anni.

[Regedit_80]

intanto ho cambiato la modalità d'uso della memoria virtuale(impostandola in gestione automatica dal sistema) e il difetto non mi si presenta piu'...

Ovviamente i condensatori sono da cambiare ma mi hanno chiesto 30 euro....porca paletta....me la compro nuova per 30 euro !e che cacchio!
mi sa che la faccio funzionare finche' va' e poi si passa ad un socket 1366

cmq infinite grazie per il link gnpd!!!!

[Dumbledore]

Ragazzi da stamattina il pc si riavvia ogni tot e seguendo la procedura col debugger mi da questo. non sono riuscito a capire da cosa possa dipendere!Vi prego help se mi si riavvia di continuo e perdo il lavoro è una tragedia!Vi allego anche hj così magari si vede qualcosa!ciao

Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [D:\WINDOWS\Minidump\Mini111109-04.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: D:\WINDOWS\Symbols
Executable search path is: 
Unable to load image ntoskrnl.exe, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
Windows XP Kernel Version 2600 (Service Pack 3) MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Machine Name:
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055d720
Debug session time: Wed Nov 11 16:27:29.062 2009 (GMT+1)
System Uptime: 0 days 3:20:19.757
Unable to load image ntoskrnl.exe, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
Loading Kernel Symbols
...............................................................
................................................................
...
Loading User Symbols
Loading unloaded module list
................
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1000008E, {c0000005, 80608ff0, a8bf2938, 0}

Probably caused by : ntoskrnl.exe ( nt!NtOpenKeyedEvent+8c )

Followup: MachineOwner
---------

1: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

KERNEL_MODE_EXCEPTION_NOT_HANDLED_M (1000008e)
This is a very common bugcheck.  Usually the exception address pinpoints
the driver/function that caused the problem.  Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003.  This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG.  This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG.  This will let us see why this breakpoint is
happening.
Arguments:
Arg1: c0000005, The exception code that was not handled
Arg2: 80608ff0, The address that the exception occurred at
Arg3: a8bf2938, Trap Frame
Arg4: 00000000

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - L'istruzione a "0x%08lx" ha fatto riferimento alla memoria a "0x%08lx". La memoria non poteva essere "%s".

FAULTING_IP: 
nt!NtOpenKeyedEvent+8c
80608ff0 f3a7            repe cmps dword ptr [esi],dword ptr es:[edi]

TRAP_FRAME:  a8bf2938 -- (.trap 0xffffffffa8bf2938)
ErrCode = 00000000
eax=00090000 ebx=00000000 ecx=00000004 edx=805640c0 esi=e3c589f8 edi=0009002c
eip=80608ff0 esp=a8bf29ac ebp=a8bf29b8 iopl=0         nv up ei pl zr na pe nc
cs=0008  ss=0010  ds=0023  es=0023  fs=0030  gs=0000             efl=00010246
nt!NtOpenKeyedEvent+0x8c:
80608ff0 f3a7            repe cmps dword ptr [esi],dword ptr es:[edi]
Resetting default scope

CUSTOMER_CRASH_COUNT:  4

DEFAULT_BUCKET_ID:  COMMON_SYSTEM_FAULT

BUGCHECK_STR:  0x8E

PROCESS_NAME:  update.exe

LAST_CONTROL_TRANSFER:  from 8067faf4 to 80608ff0

STACK_TEXT:  
a8bf29a8 8067faf4 e3c589fc e3c589e0 a8bf29e4 nt!NtOpenKeyedEvent+0x8c
a8bf29b8 806084d2 e3c589f8 00000001 e3c58a58 nt!KdpLevelChange+0x129
a8bf29e4 8060a62b e3c589e0 00000001 00000000 nt!ExpRefreshTimeZoneInformation+0x2e8
a8bf2ab0 8060866c 89cc8d10 00000000 00000000 nt!NtQueryValueKey+0x324
a8bf2aec 00000000 005c005a a8bf2b1c 8883fbe0 nt!NtReleaseSemaphore+0x5c


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt!NtOpenKeyedEvent+8c
80608ff0 f3a7            repe cmps dword ptr [esi],dword ptr es:[edi]

SYMBOL_STACK_INDEX:  0

SYMBOL_NAME:  nt!NtOpenKeyedEvent+8c

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntoskrnl.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  4a784394

FAILURE_BUCKET_ID:  0x8E_nt!NtOpenKeyedEvent+8c

BUCKET_ID:  0x8E_nt!NtOpenKeyedEvent+8c

Followup: MachineOwner
---------

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 17.16.11, on 11/11/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
D:\WINDOWS\System32\smss.exe
D:\WINDOWS\system32\winlogon.exe
D:\WINDOWS\system32\services.exe
D:\WINDOWS\system32\lsass.exe
D:\WINDOWS\system32\Ati2evxx.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\System32\svchost.exe
D:\Programmi\Tall Emu\Online Armor\OAcat.exe
D:\WINDOWS\system32\Ati2evxx.exe
D:\Programmi\Tall Emu\Online Armor\oasrv.exe
D:\WINDOWS\system32\spoolsv.exe
D:\Programmi\Avira\AntiVir Desktop\sched.exe
D:\Programmi\Avira\AntiVir Desktop\avguard.exe
D:\WINDOWS\Explorer.EXE
D:\WINDOWS\RTHDCPL.EXE
D:\WINDOWS\System32\drivers\PhiBtn.exe
D:\WINDOWS\System32\drivers\Tray900.exe
D:\Programmi\Java\jre6\bin\jusched.exe
D:\Programmi\Tall Emu\Online Armor\oaui.exe
D:\Programmi\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
D:\WINDOWS\system32\ctfmon.exe
D:\Programmi\Windows Live\Messenger\msnmsgr.exe
D:\Programmi\Windows Desktop Search\WindowsSearch.exe
D:\Programmi\Tall Emu\Online Armor\OAhlp.exe
D:\Programmi\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
D:\Programmi\a-squared Free\a2service.exe
D:\Programmi\Avira\AntiVir Desktop\avmailc.exe
D:\Programmi\Avira\AntiVir Desktop\AVWEBGRD.EXE
D:\Programmi\Prevx\prevx.exe
D:\Programmi\Java\jre6\bin\jqs.exe
D:\Programmi\File comuni\Microsoft Shared\VS7DEBUG\mdm.exe
D:\WINDOWS\system32\svchost.exe
D:\Programmi\TeamViewer\Version4\TeamViewer_Service.exe
D:\Programmi\File comuni\Microsoft Shared\Windows Live\WLIDSVC.EXE
D:\Programmi\TeamViewer\Version4\TeamViewer.exe
D:\WINDOWS\system32\SearchIndexer.exe
D:\Programmi\Prevx\prevx.exe
D:\WINDOWS\system32\CNAC6RPK.EXE
D:\Programmi\File comuni\Microsoft Shared\Windows Live\WLIDSvcM.exe
D:\Programmi\Mozilla Firefox\firefox.exe
D:\WINDOWS\system32\wbem\wmiapsrv.exe
D:\WINDOWS\system32\SearchProtocolHost.exe
D:\Programmi\Avira\AntiVir Desktop\checkt.exe
D:\Programmi\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - D:\Programmi\File comuni\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Guida per l'accesso a Windows Live ID - {9030D464-4C02-4ABF-8ECC-5164760863C6} - D:\Programmi\File comuni\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - D:\Programmi\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - D:\Programmi\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "D:\Programmi\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "D:\Programmi\File comuni\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [StartCCC] "D:\Programmi\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [PhiBtn] %SystemRoot%\System32\drivers\PhiBtn.exe
O4 - HKLM\..\Run: [Traymin900] %SystemRoot%\System32\drivers\Tray900.exe
O4 - HKLM\..\Run: [avgnt] "D:\Programmi\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKLM\..\Run: [SunJavaUpdateSched] "D:\Programmi\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [@OnlineArmor GUI] "D:\Programmi\Tall Emu\Online Armor\oaui.exe"
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKCU\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "D:\Programmi\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\CTFMON.EXE (User 'SERVIZIO LOCALE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\CTFMON.EXE (User 'SERVIZIO DI RETE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Windows Search.lnk = D:\Programmi\Windows Desktop Search\WindowsSearch.exe
O8 - Extra context menu item: E&sporta in Microsoft Excel - res://D:\PROGRA~1\MICROS~4\Office12\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\PROGRA~1\MICROS~4\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - D:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - D:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Programmi\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Programmi\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1255535585696
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1255536083687
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - D:\PROGRA~1\FILECO~1\Skype\SKYPE4~1.DLL
O23 - Service: a-squared Free Service (a2free) - Emsi Software GmbH - D:\Programmi\a-squared Free\a2service.exe
O23 - Service: Avira Firewall (AntiVirFirewallService) - Avira GmbH - D:\Programmi\Avira\AntiVir Desktop\avfwsvc.exe
O23 - Service: Avira AntiVir MailGuard (AntiVirMailService) - Avira GmbH - D:\Programmi\Avira\AntiVir Desktop\avmailc.exe
O23 - Service: Avira AntiVir Scheduler (AntiVirSchedulerService) - Avira GmbH - D:\Programmi\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - D:\Programmi\Avira\AntiVir Desktop\avguard.exe
O23 - Service: Avira AntiVir WebGuard (AntiVirWebService) - Avira GmbH - D:\Programmi\Avira\AntiVir Desktop\AVWEBGRD.EXE
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - D:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - D:\WINDOWS\system32\ati2sgag.exe
O23 - Service: CSIScanner - Prevx - D:\Programmi\Prevx\prevx.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - D:\Programmi\Java\jre6\bin\jqs.exe
O23 - Service: Online Armor Helper Service (OAcat) - Tall Emu - D:\Programmi\Tall Emu\Online Armor\OAcat.exe
O23 - Service: Online Armor (SvcOnlineArmor) - Tall Emu - D:\Programmi\Tall Emu\Online Armor\oasrv.exe
O23 - Service: TeamViewer 4 (TeamViewer4) - TeamViewer GmbH - D:\Programmi\TeamViewer\Version4\TeamViewer_Service.exe

--
End of file - 7521 bytes

L'errore si presenta all'improvviso senza motivo non riesco a capire cosa possa essere.Help! chiedetemi se vi servono altre info.

[Dumbledore]

Altro errore oggi, ho fatto la scansione con Gmer, prevx, malwarebytes e non è uscito nulla. Non riesco a capire cosa cavolo possa essere!

Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [D:\WINDOWS\Minidump\Mini111209-02.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: D:\WINDOWS\Symbols
Executable search path is: 
Unable to load image ntoskrnl.exe, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
Windows XP Kernel Version 2600 (Service Pack 3) MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Machine Name:
Kernel base = 0x804d7000 PsLoadedModuleList = 0x805634c0
Debug session time: Thu Nov 12 14:32:11.750 2009 (GMT+1)
System Uptime: 0 days 0:04:33.375
Unable to load image ntoskrnl.exe, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
Loading Kernel Symbols
...............................................................
.........
Loading User Symbols
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1000007F, {d, 0, 0, 0}

*** WARNING: Unable to verify timestamp for win32k.sys
Probably caused by : win32k.sys ( win32k!xxxSleepThread+185 )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

UNEXPECTED_KERNEL_MODE_TRAP_M (1000007f)
This means a trap occurred in kernel mode, and it's a trap of a kind
that the kernel isn't allowed to have/catch (bound trap) or that
is always instant death (double fault).  The first number in the
bugcheck params is the number of the trap (8 = double fault, etc)
Consult an Intel x86 family manual to learn more about what these
traps are. Here is a *portion* of those codes:
If kv shows a taskGate
        use .tss on the part before the colon, then kv.
Else if kv shows a trapframe
        use .trap on that value
Else
        .trap on the appropriate frame will show where the trap was taken
        (on x86, this will be the ebp that goes with the procedure KiTrap)
Endif
kb will then show the corrected stack.
Arguments:
Arg1: 0000000d, EXCEPTION_GP_FAULT
Arg2: 00000000
Arg3: 00000000
Arg4: 00000000

Debugging Details:
------------------


BUGCHECK_STR:  0x7f_d

CUSTOMER_CRASH_COUNT:  2

DEFAULT_BUCKET_ID:  DRIVER_FAULT

PROCESS_NAME:  48dt3nx0.exe

LAST_CONTROL_TRANSFER:  from b9a46b74 to 8987a70f

STACK_TEXT:  
WARNING: Frame IP not in any known module. Following frames may be wrong.
b9a46b30 b9a46b74 89860870 ffdff120 89921930 0x8987a70f
b9a46b34 89860870 ffdff120 89921930 804e1bd2 0xb9a46b74
b9a46b74 bf802f45 00000000 0000000d 00000001 0x89860870
b9a46bb0 bf840f3c 00000200 00000000 00000000 win32k!xxxSleepThread+0x185
b9a46c4c bf8141ba bbec30d8 0000000c 00000000 win32k!xxxInterSendMsgEx+0x7b2
b9a46c98 bf836337 bbec30d8 0000000c 00000000 win32k!xxxSendMessageTimeout+0x11a
b9a46cbc bf814d2e bbec30d8 0000000c 00000000 win32k!bIsSourceBGRA+0x30
b9a46d08 bf80eece bbec30d8 0000000c 00000000 win32k!NtUserfnINSTRINGNULL+0x86
b9a46d40 804dd99f 00010176 0000000c 00000000 win32k!NtUserMessageCall+0xa9
b9a46d60 00fdff28 7c91e514 badb0d00 00fdfef8 nt!ZwSetSystemPowerState+0xf
b9a46d64 7c91e514 badb0d00 00fdfef8 00000124 0xfdff28
b9a46d68 badb0d00 00fdfef8 00000124 00d488ff 0x7c91e514
b9a46d6c 00fdfef8 00000124 00d488ff 00000000 0xbadb0d00
b9a46d70 00000000 00d488ff 00000000 00000000 0xfdfef8


STACK_COMMAND:  kb

FOLLOWUP_IP: 
win32k!xxxSleepThread+185
bf802f45 ??              ???

SYMBOL_STACK_INDEX:  3

SYMBOL_NAME:  win32k!xxxSleepThread+185

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: win32k

IMAGE_NAME:  win32k.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4a8564c7

FAILURE_BUCKET_ID:  0x7f_d_win32k!xxxSleepThread+185

BUCKET_ID:  0x7f_d_win32k!xxxSleepThread+185

Followup: MachineOwner
---------

0: kd> lmvm win32k
start    end        module name
bf800000 bf9c3d00   win32k   M (pdb symbols)          d:\windows\symbols\sys\win32k.pdb
    Loaded symbol image file: win32k.sys
    Image path: win32k.sys
    Image name: win32k.sys
    Timestamp:        Fri Aug 14 15:21:11 2009 (4A8564C7)
    CheckSum:         001D2377
    ImageSize:        001C3D00
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4

Questo è appena venuto fuori!

[Dumbledore]

nessuno saprebbe dirmi cosa ha avuto il mio pc?

p.s. oggi non si è impallato ed è acceso da 11 ore! gli ho dato na pulita stamattina con aria compressa! è mai possibile che sia stato quello?bho!

[xcdegasp]

Originariamente inviato da Dumbledore

nessuno saprebbe dirmi cosa ha avuto il mio pc?

p.s. oggi non si è impallato ed è acceso da 11 ore! gli ho dato na pulita stamattina con aria compressa! è mai possibile che sia stato quello?bho!

possibilissimo se era pieno di polvere è proprio per surriscaldamento che diventava instabile

[The Don]

Ciao, ragazzi allora il pc di un mio amico si impalla principalmente quando accede alla rete internet, mentre quando guarda film o fa altro il pc sembra funzionare bene. Di seguito il listato del debugger, io non ci ho capito molto, qualcuno può aiutarmi?

Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\Fabio\Desktop\Minidump\Mini111909-04.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: srv*c:\symbols*http://msdl.microsoft.com/download/symbols;set _NT_SYMBOL_PATH=srv*DownstreamStore*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows XP Kernel Version 2600 (Service Pack 3) UP Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 2600.xpsp_sp3_gdr.090804-1435
Machine Name:
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055b1c0
Debug session time: Thu Nov 19 18:36:39.046 2009 (GMT+1)
System Uptime: 0 days 0:07:35.609
Loading Kernel Symbols
...............................................................
.....................................................
Loading User Symbols
Loading unloaded module list
.................................
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 10000050, {ffffffec, 1, 804d9079, 0}


Could not read faulting driver name
Probably caused by : ntoskrnl.exe ( nt!NtWaitForMultipleObjects+2ec )

Followup: MachineOwner
---------

kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced.  This cannot be protected by try-except,
it must be protected by a Probe.  Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: ffffffec, memory referenced.
Arg2: 00000001, value 0 = read operation, 1 = write operation.
Arg3: 804d9079, If non-zero, the instruction address which referenced the bad memory
	address.
Arg4: 00000000, (reserved)

Debugging Details:
------------------


Could not read faulting driver name

WRITE_ADDRESS:  ffffffec 

FAULTING_IP: 
nt!ObfDereferenceObject+2c
804d9079 0fc101          xadd    dword ptr [ecx],eax

MM_INTERNAL_CODE:  0

CUSTOMER_CRASH_COUNT:  4

DEFAULT_BUCKET_ID:  COMMON_SYSTEM_FAULT

BUGCHECK_STR:  0x50

PROCESS_NAME:  svchost.exe

LAST_CONTROL_TRANSFER:  from 805668be to 804d9079

STACK_TEXT:  
b55779d8 805668be b5577d64 01f9fbf0 805666c6 nt!ObfDereferenceObject+0x2c
b5577d48 804de7ec 0000001e 031a6678 00000001 nt!NtWaitForMultipleObjects+0x2ec
b5577d48 7c91e514 0000001e 031a6678 00000001 nt!KiFastCallEntry+0xf8
WARNING: Frame IP not in any known module. Following frames may be wrong.
01f9fc70 00000000 00000000 00000000 00000000 0x7c91e514


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt!NtWaitForMultipleObjects+2ec
805668be ebe9            jmp     nt!NtWaitForMultipleObjects+0x2ec (805668a9)

SYMBOL_STACK_INDEX:  1

SYMBOL_NAME:  nt!NtWaitForMultipleObjects+2ec

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntoskrnl.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  4a78505a

FAILURE_BUCKET_ID:  0x50_nt!NtWaitForMultipleObjects+2ec

BUCKET_ID:  0x50_nt!NtWaitForMultipleObjects+2ec

Followup: MachineOwner
---------

kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced.  This cannot be protected by try-except,
it must be protected by a Probe.  Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: ffffffec, memory referenced.
Arg2: 00000001, value 0 = read operation, 1 = write operation.
Arg3: 804d9079, If non-zero, the instruction address which referenced the bad memory
	address.
Arg4: 00000000, (reserved)

Debugging Details:
------------------


Could not read faulting driver name

WRITE_ADDRESS:  ffffffec 

FAULTING_IP: 
nt!ObfDereferenceObject+2c
804d9079 0fc101          xadd    dword ptr [ecx],eax

MM_INTERNAL_CODE:  0

CUSTOMER_CRASH_COUNT:  4

DEFAULT_BUCKET_ID:  COMMON_SYSTEM_FAULT

BUGCHECK_STR:  0x50

PROCESS_NAME:  svchost.exe

LAST_CONTROL_TRANSFER:  from 805668be to 804d9079

STACK_TEXT:  
b55779d8 805668be b5577d64 01f9fbf0 805666c6 nt!ObfDereferenceObject+0x2c
b5577d48 804de7ec 0000001e 031a6678 00000001 nt!NtWaitForMultipleObjects+0x2ec
b5577d48 7c91e514 0000001e 031a6678 00000001 nt!KiFastCallEntry+0xf8
WARNING: Frame IP not in any known module. Following frames may be wrong.
01f9fc70 00000000 00000000 00000000 00000000 0x7c91e514


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt!NtWaitForMultipleObjects+2ec
805668be ebe9            jmp     nt!NtWaitForMultipleObjects+0x2ec (805668a9)

SYMBOL_STACK_INDEX:  1

SYMBOL_NAME:  nt!NtWaitForMultipleObjects+2ec

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntoskrnl.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  4a78505a

FAILURE_BUCKET_ID:  0x50_nt!NtWaitForMultipleObjects+2ec

BUCKET_ID:  0x50_nt!NtWaitForMultipleObjects+2ec

Followup: MachineOwner
---------

kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced.  This cannot be protected by try-except,
it must be protected by a Probe.  Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: ffffffec, memory referenced.
Arg2: 00000001, value 0 = read operation, 1 = write operation.
Arg3: 804d9079, If non-zero, the instruction address which referenced the bad memory
	address.
Arg4: 00000000, (reserved)

Debugging Details:
------------------


Could not read faulting driver name

WRITE_ADDRESS:  ffffffec 

FAULTING_IP: 
nt!ObfDereferenceObject+2c
804d9079 0fc101          xadd    dword ptr [ecx],eax

MM_INTERNAL_CODE:  0

CUSTOMER_CRASH_COUNT:  4

DEFAULT_BUCKET_ID:  COMMON_SYSTEM_FAULT

BUGCHECK_STR:  0x50

PROCESS_NAME:  svchost.exe

LAST_CONTROL_TRANSFER:  from 805668be to 804d9079

STACK_TEXT:  
b55779d8 805668be b5577d64 01f9fbf0 805666c6 nt!ObfDereferenceObject+0x2c
b5577d48 804de7ec 0000001e 031a6678 00000001 nt!NtWaitForMultipleObjects+0x2ec
b5577d48 7c91e514 0000001e 031a6678 00000001 nt!KiFastCallEntry+0xf8
WARNING: Frame IP not in any known module. Following frames may be wrong.
01f9fc70 00000000 00000000 00000000 00000000 0x7c91e514


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt!NtWaitForMultipleObjects+2ec
805668be ebe9            jmp     nt!NtWaitForMultipleObjects+0x2ec (805668a9)

SYMBOL_STACK_INDEX:  1

SYMBOL_NAME:  nt!NtWaitForMultipleObjects+2ec

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntoskrnl.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  4a78505a

FAILURE_BUCKET_ID:  0x50_nt!NtWaitForMultipleObjects+2ec

BUCKET_ID:  0x50_nt!NtWaitForMultipleObjects+2ec

Followup: MachineOwner
---------

kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced.  This cannot be protected by try-except,
it must be protected by a Probe.  Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: ffffffec, memory referenced.
Arg2: 00000001, value 0 = read operation, 1 = write operation.
Arg3: 804d9079, If non-zero, the instruction address which referenced the bad memory
	address.
Arg4: 00000000, (reserved)

Debugging Details:
------------------


Could not read faulting driver name

WRITE_ADDRESS:  ffffffec 

FAULTING_IP: 
nt!ObfDereferenceObject+2c
804d9079 0fc101          xadd    dword ptr [ecx],eax

MM_INTERNAL_CODE:  0

CUSTOMER_CRASH_COUNT:  4

DEFAULT_BUCKET_ID:  COMMON_SYSTEM_FAULT

BUGCHECK_STR:  0x50

PROCESS_NAME:  svchost.exe

LAST_CONTROL_TRANSFER:  from 805668be to 804d9079

STACK_TEXT:  
b55779d8 805668be b5577d64 01f9fbf0 805666c6 nt!ObfDereferenceObject+0x2c
b5577d48 804de7ec 0000001e 031a6678 00000001 nt!NtWaitForMultipleObjects+0x2ec
b5577d48 7c91e514 0000001e 031a6678 00000001 nt!KiFastCallEntry+0xf8
WARNING: Frame IP not in any known module. Following frames may be wrong.
01f9fc70 00000000 00000000 00000000 00000000 0x7c91e514


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt!NtWaitForMultipleObjects+2ec
805668be ebe9            jmp     nt!NtWaitForMultipleObjects+0x2ec (805668a9)

SYMBOL_STACK_INDEX:  1

SYMBOL_NAME:  nt!NtWaitForMultipleObjects+2ec

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntoskrnl.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  4a78505a

FAILURE_BUCKET_ID:  0x50_nt!NtWaitForMultipleObjects+2ec

BUCKET_ID:  0x50_nt!NtWaitForMultipleObjects+2ec

Followup: MachineOwner
---------

kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced.  This cannot be protected by try-except,
it must be protected by a Probe.  Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: ffffffec, memory referenced.
Arg2: 00000001, value 0 = read operation, 1 = write operation.
Arg3: 804d9079, If non-zero, the instruction address which referenced the bad memory
	address.
Arg4: 00000000, (reserved)

Debugging Details:
------------------


Could not read faulting driver name

WRITE_ADDRESS:  ffffffec 

FAULTING_IP: 
nt!ObfDereferenceObject+2c
804d9079 0fc101          xadd    dword ptr [ecx],eax

MM_INTERNAL_CODE:  0

CUSTOMER_CRASH_COUNT:  4

DEFAULT_BUCKET_ID:  COMMON_SYSTEM_FAULT

BUGCHECK_STR:  0x50

PROCESS_NAME:  svchost.exe

LAST_CONTROL_TRANSFER:  from 805668be to 804d9079

STACK_TEXT:  
b55779d8 805668be b5577d64 01f9fbf0 805666c6 nt!ObfDereferenceObject+0x2c
b5577d48 804de7ec 0000001e 031a6678 00000001 nt!NtWaitForMultipleObjects+0x2ec
b5577d48 7c91e514 0000001e 031a6678 00000001 nt!KiFastCallEntry+0xf8
WARNING: Frame IP not in any known module. Following frames may be wrong.
01f9fc70 00000000 00000000 00000000 00000000 0x7c91e514


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt!NtWaitForMultipleObjects+2ec
805668be ebe9            jmp     nt!NtWaitForMultipleObjects+0x2ec (805668a9)

SYMBOL_STACK_INDEX:  1

SYMBOL_NAME:  nt!NtWaitForMultipleObjects+2ec

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntoskrnl.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  4a78505a

FAILURE_BUCKET_ID:  0x50_nt!NtWaitForMultipleObjects+2ec

BUCKET_ID:  0x50_nt!NtWaitForMultipleObjects+2ec

Followup: MachineOwner
---------

kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced.  This cannot be protected by try-except,
it must be protected by a Probe.  Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: ffffffec, memory referenced.
Arg2: 00000001, value 0 = read operation, 1 = write operation.
Arg3: 804d9079, If non-zero, the instruction address which referenced the bad memory
	address.
Arg4: 00000000, (reserved)

Debugging Details:
------------------


Could not read faulting driver name

WRITE_ADDRESS:  ffffffec 

FAULTING_IP: 
nt!ObfDereferenceObject+2c
804d9079 0fc101          xadd    dword ptr [ecx],eax

MM_INTERNAL_CODE:  0

CUSTOMER_CRASH_COUNT:  4

DEFAULT_BUCKET_ID:  COMMON_SYSTEM_FAULT

BUGCHECK_STR:  0x50

PROCESS_NAME:  svchost.exe

LAST_CONTROL_TRANSFER:  from 805668be to 804d9079

STACK_TEXT:  
b55779d8 805668be b5577d64 01f9fbf0 805666c6 nt!ObfDereferenceObject+0x2c
b5577d48 804de7ec 0000001e 031a6678 00000001 nt!NtWaitForMultipleObjects+0x2ec
b5577d48 7c91e514 0000001e 031a6678 00000001 nt!KiFastCallEntry+0xf8
WARNING: Frame IP not in any known module. Following frames may be wrong.
01f9fc70 00000000 00000000 00000000 00000000 0x7c91e514


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt!NtWaitForMultipleObjects+2ec
805668be ebe9            jmp     nt!NtWaitForMultipleObjects+0x2ec (805668a9)

SYMBOL_STACK_INDEX:  1

SYMBOL_NAME:  nt!NtWaitForMultipleObjects+2ec

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntoskrnl.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  4a78505a

FAILURE_BUCKET_ID:  0x50_nt!NtWaitForMultipleObjects+2ec

BUCKET_ID:  0x50_nt!NtWaitForMultipleObjects+2ec

Followup: MachineOwner
---------

kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced.  This cannot be protected by try-except,
it must be protected by a Probe.  Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: ffffffec, memory referenced.
Arg2: 00000001, value 0 = read operation, 1 = write operation.
Arg3: 804d9079, If non-zero, the instruction address which referenced the bad memory
	address.
Arg4: 00000000, (reserved)

Debugging Details:
------------------


Could not read faulting driver name

WRITE_ADDRESS:  ffffffec 

FAULTING_IP: 
nt!ObfDereferenceObject+2c
804d9079 0fc101          xadd    dword ptr [ecx],eax

MM_INTERNAL_CODE:  0

CUSTOMER_CRASH_COUNT:  4

DEFAULT_BUCKET_ID:  COMMON_SYSTEM_FAULT

BUGCHECK_STR:  0x50

PROCESS_NAME:  svchost.exe

LAST_CONTROL_TRANSFER:  from 805668be to 804d9079

STACK_TEXT:  
b55779d8 805668be b5577d64 01f9fbf0 805666c6 nt!ObfDereferenceObject+0x2c
b5577d48 804de7ec 0000001e 031a6678 00000001 nt!NtWaitForMultipleObjects+0x2ec
b5577d48 7c91e514 0000001e 031a6678 00000001 nt!KiFastCallEntry+0xf8
WARNING: Frame IP not in any known module. Following frames may be wrong.
01f9fc70 00000000 00000000 00000000 00000000 0x7c91e514


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt!NtWaitForMultipleObjects+2ec
805668be ebe9            jmp     nt!NtWaitForMultipleObjects+0x2ec (805668a9)

SYMBOL_STACK_INDEX:  1

SYMBOL_NAME:  nt!NtWaitForMultipleObjects+2ec

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntoskrnl.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  4a78505a

FAILURE_BUCKET_ID:  0x50_nt!NtWaitForMultipleObjects+2ec

BUCKET_ID:  0x50_nt!NtWaitForMultipleObjects+2ec

Followup: MachineOwner
---------

kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced.  This cannot be protected by try-except,
it must be protected by a Probe.  Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: ffffffec, memory referenced.
Arg2: 00000001, value 0 = read operation, 1 = write operation.
Arg3: 804d9079, If non-zero, the instruction address which referenced the bad memory
	address.
Arg4: 00000000, (reserved)

Debugging Details:
------------------


Could not read faulting driver name

WRITE_ADDRESS:  ffffffec 

FAULTING_IP: 
nt!ObfDereferenceObject+2c
804d9079 0fc101          xadd    dword ptr [ecx],eax

MM_INTERNAL_CODE:  0

CUSTOMER_CRASH_COUNT:  4

DEFAULT_BUCKET_ID:  COMMON_SYSTEM_FAULT

BUGCHECK_STR:  0x50

PROCESS_NAME:  svchost.exe

LAST_CONTROL_TRANSFER:  from 805668be to 804d9079

STACK_TEXT:  
b55779d8 805668be b5577d64 01f9fbf0 805666c6 nt!ObfDereferenceObject+0x2c
b5577d48 804de7ec 0000001e 031a6678 00000001 nt!NtWaitForMultipleObjects+0x2ec
b5577d48 7c91e514 0000001e 031a6678 00000001 nt!KiFastCallEntry+0xf8
WARNING: Frame IP not in any known module. Following frames may be wrong.
01f9fc70 00000000 00000000 00000000 00000000 0x7c91e514


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt!NtWaitForMultipleObjects+2ec
805668be ebe9            jmp     nt!NtWaitForMultipleObjects+0x2ec (805668a9)

SYMBOL_STACK_INDEX:  1

SYMBOL_NAME:  nt!NtWaitForMultipleObjects+2ec

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntoskrnl.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  4a78505a

FAILURE_BUCKET_ID:  0x50_nt!NtWaitForMultipleObjects+2ec

BUCKET_ID:  0x50_nt!NtWaitForMultipleObjects+2ec

Followup: MachineOwner
---------

kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced.  This cannot be protected by try-except,
it must be protected by a Probe.  Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: ffffffec, memory referenced.
Arg2: 00000001, value 0 = read operation, 1 = write operation.
Arg3: 804d9079, If non-zero, the instruction address which referenced the bad memory
	address.
Arg4: 00000000, (reserved)

Debugging Details:
------------------


Could not read faulting driver name

WRITE_ADDRESS:  ffffffec 

FAULTING_IP: 
nt!ObfDereferenceObject+2c
804d9079 0fc101          xadd    dword ptr [ecx],eax

MM_INTERNAL_CODE:  0

CUSTOMER_CRASH_COUNT:  4

DEFAULT_BUCKET_ID:  COMMON_SYSTEM_FAULT

BUGCHECK_STR:  0x50

PROCESS_NAME:  svchost.exe

LAST_CONTROL_TRANSFER:  from 805668be to 804d9079

STACK_TEXT:  
b55779d8 805668be b5577d64 01f9fbf0 805666c6 nt!ObfDereferenceObject+0x2c
b5577d48 804de7ec 0000001e 031a6678 00000001 nt!NtWaitForMultipleObjects+0x2ec
b5577d48 7c91e514 0000001e 031a6678 00000001 nt!KiFastCallEntry+0xf8
WARNING: Frame IP not in any known module. Following frames may be wrong.
01f9fc70 00000000 00000000 00000000 00000000 0x7c91e514


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt!NtWaitForMultipleObjects+2ec
805668be ebe9            jmp     nt!NtWaitForMultipleObjects+0x2ec (805668a9)

SYMBOL_STACK_INDEX:  1

SYMBOL_NAME:  nt!NtWaitForMultipleObjects+2ec

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntoskrnl.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  4a78505a

FAILURE_BUCKET_ID:  0x50_nt!NtWaitForMultipleObjects+2ec

BUCKET_ID:  0x50_nt!NtWaitForMultipleObjects+2ec

Followup: MachineOwner
---------

kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced.  This cannot be protected by try-except,
it must be protected by a Probe.  Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: ffffffec, memory referenced.
Arg2: 00000001, value 0 = read operation, 1 = write operation.
Arg3: 804d9079, If non-zero, the instruction address which referenced the bad memory
	address.
Arg4: 00000000, (reserved)

Debugging Details:
------------------


Could not read faulting driver name

WRITE_ADDRESS:  ffffffec 

FAULTING_IP: 
nt!ObfDereferenceObject+2c
804d9079 0fc101          xadd    dword ptr [ecx],eax

MM_INTERNAL_CODE:  0

CUSTOMER_CRASH_COUNT:  4

DEFAULT_BUCKET_ID:  COMMON_SYSTEM_FAULT

BUGCHECK_STR:  0x50

PROCESS_NAME:  svchost.exe

LAST_CONTROL_TRANSFER:  from 805668be to 804d9079

STACK_TEXT:  
b55779d8 805668be b5577d64 01f9fbf0 805666c6 nt!ObfDereferenceObject+0x2c
b5577d48 804de7ec 0000001e 031a6678 00000001 nt!NtWaitForMultipleObjects+0x2ec
b5577d48 7c91e514 0000001e 031a6678 00000001 nt!KiFastCallEntry+0xf8
WARNING: Frame IP not in any known module. Following frames may be wrong.
01f9fc70 00000000 00000000 00000000 00000000 0x7c91e514


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt!NtWaitForMultipleObjects+2ec
805668be ebe9            jmp     nt!NtWaitForMultipleObjects+0x2ec (805668a9)

SYMBOL_STACK_INDEX:  1

SYMBOL_NAME:  nt!NtWaitForMultipleObjects+2ec

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntoskrnl.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  4a78505a

FAILURE_BUCKET_ID:  0x50_nt!NtWaitForMultipleObjects+2ec

BUCKET_ID:  0x50_nt!NtWaitForMultipleObjects+2ec

Followup: MachineOwner

[Dumbledore]

Originariamente inviato da xcdegasp

possibilissimo se era pieno di polvere è proprio per surriscaldamento che diventava instabile

Purtroppo mi sa che non è bastato! Oggi dinuovo mentre era acceso senza che toccassi nulla schermata blu (c'era un quadrato sul rosa (color big buble) sulla schermata blu non capisco perchè). Riporto il minidump

Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [D:\WINDOWS\Minidump\Mini112209-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: D:\WINDOWS\Symbols
Executable search path is: 
Unable to load image ntoskrnl.exe, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
Windows XP Kernel Version 2600 (Service Pack 3) MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Machine Name:
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055d720
Debug session time: Sun Nov 22 13:41:29.593 2009 (GMT+1)
System Uptime: 0 days 1:56:00.282
Unable to load image ntoskrnl.exe, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
Loading Kernel Symbols
...............................................................
................................................................
......
Loading User Symbols
Loading unloaded module list
...............
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1000007E, {c0000005, 8053b88b, ba503b84, ba503880}

Probably caused by : ntoskrnl.exe ( nt!NtGetWriteWatch+126 )

Followup: MachineOwner
---------

1: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

SYSTEM_THREAD_EXCEPTION_NOT_HANDLED_M (1000007e)
This is a very common bugcheck.  Usually the exception address pinpoints
the driver/function that caused the problem.  Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003.  This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG.  This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG.  This will let us see why this breakpoint is
happening.
Arguments:
Arg1: c0000005, The exception code that was not handled
Arg2: 8053b88b, The address that the exception occurred at
Arg3: ba503b84, Exception Record Address
Arg4: ba503880, Context Record Address

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - L'istruzione a "0x%08lx" ha fatto riferimento alla memoria a "0x%08lx". La memoria non poteva essere "%s".

FAULTING_IP: 
nt!NtGetWriteWatch+126
8053b88b 668b0e          mov     cx,word ptr [esi]

EXCEPTION_RECORD:  ba503b84 -- (.exr 0xffffffffba503b84)
ExceptionAddress: 8053b88b (nt!NtGetWriteWatch+0x00000126)
   ExceptionCode: c0000005 (Access violation)
  ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 00000000
   Parameter[1]: 00300046
Attempt to read from address 00300046

CONTEXT:  ba503880 -- (.cxr 0xffffffffba503880)
eax=00300046 ebx=e15077d4 ecx=e1b283dc edx=e434d1cc esi=00300046 edi=e15077f8
eip=8053b88b esp=ba503c4c ebp=ba503c54 iopl=0         nv up ei pl nz na po nc
cs=0008  ss=0010  ds=0023  es=0023  fs=0030  gs=0000             efl=00210202
nt!NtGetWriteWatch+0x126:
8053b88b 668b0e          mov     cx,word ptr [esi]        ds:0023:00300046=????
Resetting default scope

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  STRING_DEREFERENCE

PROCESS_NAME:  System

ERROR_CODE: (NTSTATUS) 0xc0000005 - L'istruzione a "0x%08lx" ha fatto riferimento alla memoria a "0x%08lx". La memoria non poteva essere "%s".

EXCEPTION_PARAMETER1:  00000000

EXCEPTION_PARAMETER2:  00300046

READ_ADDRESS:  00300046 

FOLLOWUP_IP: 
nt!NtGetWriteWatch+126
8053b88b 668b0e          mov     cx,word ptr [esi]

BUGCHECK_STR:  0x7E

LAST_CONTROL_TRANSFER:  from 8060a153 to 8053b88b

STACK_TEXT:  
ba503c54 8060a153 e434d1cc 00300046 e434d222 nt!NtGetWriteWatch+0x126
ba503c74 8060a452 886c110c e434d1cc 00000001 nt!CcPfGetParameter+0x94
ba503ca0 8060b24b 886c110c 886c10f8 000000fc nt!NtQueryValueKey+0x77
ba503ce8 80605dfa 891ff640 886c10f8 000000fc nt!NtEnumerateKey+0x225
ba503d18 80605ece 891ff640 00000000 00000000 nt!WmipQuerySetExecuteSI+0xbd
ba503d54 80605f11 891ff640 00000000 ba503d7c nt!WmipQuerySetExecuteSI+0x188
ba503d64 80606257 891ff640 80564120 8056485c nt!WmipCopyFromEventQueues+0x3b
ba503d7c 8053877d 00000000 00000000 89e3d3c8 nt!WmipCreateUMLogger+0x88
ba503dac 805cff72 00000000 00000000 00000000 nt!MiTrimPte+0x1fe
ba503ddc 805460ee 8053868e 00000001 00000000 nt!IopQueryReconfiguration+0x25
ba503df8 00000000 00000000 00000000 00001f80 nt!ExpRemovePoolTracker+0x7b


SYMBOL_STACK_INDEX:  0

SYMBOL_NAME:  nt!NtGetWriteWatch+126

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntoskrnl.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  4a784394

STACK_COMMAND:  .cxr 0xffffffffba503880 ; kb

FAILURE_BUCKET_ID:  0x7E_nt!NtGetWriteWatch+126

BUCKET_ID:  0x7E_nt!NtGetWriteWatch+126

Followup: MachineOwner
---------

Non riesco proprio a capire cosa diavolo possa essere!

[The Don]

Qualche suggerimento?

[Adriano_87]

ciao a tutti
ho un pc di un amico che non entra più in windows xp pro, neanche in schermata provvisoria...
viene fuori questa blu screen disattivando il riavvio automatico in caso di errore:

STOP: c000021a [Errore irreversibile di sistema]
Processo di sistema Session Manager Initialization terminato in modo inatteso con stato di 0xc000026c (0x00000000, 0x00000000)
Il sistema è stato chiuso.


che fare?
ciao
grazie