Foro de InfoSpyware - Foro de Hijackthis - Foro de Virus

Hola a todos, el pc presenta el problema de reinicios repentinos con pantallazo azul (IRQL NOT LESS...), por fin di con una página que se acerca a la causa del problema, instale el WinDbg e hice el análisis pero llega a un punto que no se que más hacer. Pongo aqui el análisis hasta donde lo llevo, espero puedan ayudarme...


Microsoft (R) Windows Debugger Version 6.9.0003.113 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\WINDOWS\Minidump\Mini102808-05.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: C:\websymbols
Executable search path is:
Windows XP Kernel Version 2600 (Service Pack 2) UP Free x86 compatible
Product: WinNt
Built by: 2600.xpsp_sp2_qfe.070227-2300
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055a820
Debug session time: Tue Oct 28 15:50:03.718 2008 (GMT-5)
System Uptime: 0 days 0:12:02.286
Loading Kernel Symbols
.................................................. .................................................. ........................
Loading User Symbols
Loading unloaded module list
...........
************************************************** *****************************
* *
* Bugcheck Analysis *
* *
************************************************** *****************************

Use !analyze -v to get detailed debugging information.

BugCheck A, {3, 2, 0, 804dc25d}

Probably caused by : ntoskrnl.exe ( nt!KeWaitForSingleObject+bb )

Followup: MachineOwner
---------

kd> !analyze -v
************************************************** *****************************
* *
* Bugcheck Analysis *
* *
************************************************** *****************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 00000003, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000000, bitfield :
bit 0 : value 0 = read operation, 1 = write operation
bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: 804dc25d, address which referenced memory

Debugging Details:
------------------


READ_ADDRESS: 00000003

CURRENT_IRQL: 2

FAULTING_IP:
nt!KeWaitForSingleObject+bb
804dc25d 803b02 cmp byte ptr [ebx],2

CUSTOMER_CRASH_COUNT: 5

DEFAULT_BUCKET_ID: COMMON_SYSTEM_FAULT

BUGCHECK_STR: 0xA

TRAP_FRAME: f8ea0c9c -- (.trap 0xfffffffff8ea0c9c)
ESP EDITED! New esp=00000000
ErrCode = 00000000
eax=00000000 ebx=00000000 ecx=00000000 edx=00000000 esi=00000000 edi=00000000
eip=00000000 esp=f8ea0d10 ebp=00000000 iopl=0 nv up di pl nz na po nc
cs=0000 ss=0010 ds=0000 es=0000 fs=0000 gs=0000 efl=00000000
00000000 ?? ???
Resetting default scope

LAST_CONTROL_TRANSFER: from 00000000 to 804e187f

STACK_TEXT:
f8ea0c9c 00000000 00000000 00000000 00000000 nt!KiTrap0E+0x233
WARNING: Frame IP not in any known module. Following frames may be wrong.
00000000 00000000 00000000 00000000 00000000 0x0


STACK_COMMAND: .bugcheck ; kb

FOLLOWUP_IP:
nt!KeWaitForSingleObject+bb
804dc25d 803b02 cmp byte ptr [ebx],2

SYMBOL_NAME: nt!KeWaitForSingleObject+bb

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nt

IMAGE_NAME: ntoskrnl.exe

DEBUG_FLR_IMAGE_TIMESTAMP: 45e55172

FAILURE_BUCKET_ID: 0xA_nt!KeWaitForSingleObject+bb

BUCKET_ID: 0xA_nt!KeWaitForSingleObject+bb

Followup: MachineOwner