Foro de InfoSpyware - Foro de Hijackthis - Foro de Virus

Buenas

Tengo el Windows XP Professional SP2, Intel Pentium Dual 2 GHz, 250 GB Disco duro, 3 GB de RAM. Antivirus Eset NOD32 Antivirus 4 (Actualizado)

El S.O que me vino preinstalado era el Windows Vista Home Basic. Pero lo quité porque no me gustó y tuve problemas graves.

Me ha salido una pantalla azul.

Causante: NVENETFD.sys

Por lo que he podido buscar en internet... es un driver Ethernet de NVIDIA. También lo he comprobado en mi PC. Esta en la carpeta de controladores NVIDIA, en Ethernet.

He identificado el error con el programa: Debugging Tools for Windows (x86)

Lo he analizado poniendo !analyze -v y me ha salido esto:

Probably caused by : NVENETFD.sys ( NVENETFD+2a82 )

Followup: MachineOwner
---------

0: kd> !analyze -v
************************************************** *****************************
* *
* Bugcheck Analysis *
* *
************************************************** *****************************

DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: 0ae0c948, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000001, value 0 = read operation, 1 = write operation
Arg4: b4292c22, address which referenced memory

Debugging Details:
------------------

***** Kernel symbols are WRONG. Please fix symbols to do analysis.

************************************************** ***********************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
************************************************** ***********************
************************************************** ***********************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!KPRCB ***
*** ***
************************************************** ***********************
************************************************** ***********************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
************************************************** ***********************
************************************************** ***********************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!KPRCB ***
*** ***
************************************************** ***********************
************************************************** ***********************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
************************************************** ***********************
************************************************** ***********************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
************************************************** ***********************
************************************************** ***********************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
************************************************** ***********************
************************************************** *******************
* Symbols can not be loaded because symbol path is not initialized. *
* *
* The Symbol Path can be set by: *
* using the _NT_SYMBOL_PATH environment variable. *
* using the -y <symbol_path> argument when starting the debugger. *
* using .sympath and .sympath+ *
************************************************** *******************
************************************************** *******************
* Symbols can not be loaded because symbol path is not initialized. *
* *
* The Symbol Path can be set by: *
* using the _NT_SYMBOL_PATH environment variable. *
* using the -y <symbol_path> argument when starting the debugger. *
* using .sympath and .sympath+ *
************************************************** *******************

ADDITIONAL_DEBUG_TEXT:
Use '!findthebuild' command to search for the target build information.
If the build information is available, run '!findthebuild -s ; .reload' to set symbol path and load symbols.

FAULTING_MODULE: 804d7000 nt

DEBUG_FLR_IMAGE_TIMESTAMP: 4a4bb0a9

WRITE_ADDRESS: unable to get nt!MmSpecialPoolStart
unable to get nt!MmSpecialPoolEnd
unable to get nt!MmPoolCodeStart
unable to get nt!MmPoolCodeEnd
0ae0c948

CURRENT_IRQL: 2

FAULTING_IP:
tcpip!ARPRcv+276f
b4292c22 1083f8020f82 adc byte ptr [ebx-7DF0FD08h],al

DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: 0xD1

LAST_CONTROL_TRANSFER: from b4292c22 to 805437d0

STACK_TEXT:
WARNING: Stack unwind information not available. Following frames may be wrong.
8054ffac b4292c22 badb0d00 00000000 80550004 nt!Kei386EoiHelper+0x2834
80550020 b42948da 89f00878 00000002 00000005 tcpip!ARPRcv+0x276f
80550064 b4294a30 89f00878 00000000 000005b4 tcpip!ARPRcv+0x4427
805500b8 b428f3e2 89e2b2b0 00001050 c000021b tcpip!ARPRcv+0x457d
80550140 b428cef5 89bcd238 0a00a8c0 c3cde954 tcpip!IPTransmit+0x17a4
805501a0 b428cb19 00000020 89bcd238 b428f0b6 tcpip!IPFreeBuff+0x634
8055021c b428c836 b42cc5f0 89bcd238 896d6018 tcpip!IPFreeBuff+0x258
805502d4 b428b922 89bcd238 896d602c 000005c8 tcpip!IPRcvPacket+0x296
80550314 b428b84d 00000000 89828440 896d600a tcpip!ARPRcvPacket+0x128
80550350 b7d4cf45 89f3f440 00000000 00000001 tcpip!ARPRcvPacket+0x53
805503a4 b4a8aa82 00767e08 89bb56c0 00000001 NDIS!FddiFilterDprIndicateReceive+0xd4d
00000000 00000000 00000000 00000000 00000000 NVENETFD+0x2a82


STACK_COMMAND: kb

FOLLOWUP_IP:
NVENETFD+2a82
b4a8aa82 39aec4070000 cmp dword ptr [esi+7C4h],ebp

SYMBOL_STACK_INDEX: b

SYMBOL_NAME: NVENETFD+2a82

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: NVENETFD

IMAGE_NAME: NVENETFD.sys

BUCKET_ID: WRONG_SYMBOLS

Followup: MachineOwner
---------


LO MAS EXTRAÑO ES QUE MI PC VA BIEN, ES DECIR, NO TENGO NINGUN PROBLEMA. ME FUNCIONA TODO A LA PERFECCIÓN Y DE REPENTE PANTALLA AZUL.
REPITO TODO ME FUNCIONA A LA PERFECCIÓN EXCEPTO LO DE LA PANTALLA AZUL.


NECESITO AYUDA POR FAVOR. GRACIAS Y SALUDOS

Hola

El problema esta relacionado con un driver de Nvidia NVENETFD.sys
NVIDIA nForce Networking Controller Driver

Prueba actualizar los controladores de Red.

O entra a Modo Seguro después te vas a MI PC>Propiedades>Administrador de Dispositivos y desactiva el adaptador de Red. Comprueba si la pantalla azul desapareció o sigue saliendo

Muchisimas gracias por responderme amigo.

He probado actualizar el controlador. Nada está actualizado.

Como se entra en Modo Seguro en el Win XP? porque al apretar F8 me aparece una ventanita azul y diciendome si quiero bootear desde el disco duro, cd/dvd,usb.

Por ahora no me ha salido ni 1 pantalla azul ni un error, nada.

De nuevo muchas gracias :)

Espera un poco a la hora de presionar F8, sólo deja que pase la pantalla del BIOS.

Si vuelve a salir la pantalla azul me avizas.

Un saludo

Buenas

Muchas gracias amigo.

He de informarte que me ha salido otra. Bien hay un problema con los drivers de NVIDIA. Porque los archivos causantes son archivos de NVIDIA. Esta vez es del Display.


Probably caused by : nv4_disp.dll ( nv4_disp+23298 )




Probably caused by : nv4_disp.dll ( nv4_disp+23298 )

Followup: MachineOwner
---------

1: kd> !analyze -v
************************************************** *****************************
* *
* Bugcheck Analysis *
* *
************************************************** *****************************

KERNEL_MODE_EXCEPTION_NOT_HANDLED (8e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003. This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG. This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG. This will let us see why this breakpoint is
happening.
Arguments:
Arg1: c0000005, The exception code that was not handled
Arg2: bd035298, The address that the exception occurred at
Arg3: b2c0dbe0, Trap Frame
Arg4: 00000000

Debugging Details:
------------------

***** Kernel symbols are WRONG. Please fix symbols to do analysis.

************************************************** ***********************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
************************************************** ***********************
************************************************** ***********************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!KPRCB ***
*** ***
************************************************** ***********************
************************************************** ***********************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
************************************************** ***********************
************************************************** ***********************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!KPRCB ***
*** ***
************************************************** ***********************
************************************************** ***********************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
************************************************** ***********************
************************************************** ***********************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
************************************************** ***********************
************************************************** ***********************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
************************************************** ***********************
************************************************** *******************
* Symbols can not be loaded because symbol path is not initialized. *
* *
* The Symbol Path can be set by: *
* using the _NT_SYMBOL_PATH environment variable. *
* using the -y <symbol_path> argument when starting the debugger. *
* using .sympath and .sympath+ *
************************************************** *******************
************************************************** *******************
* Symbols can not be loaded because symbol path is not initialized. *
* *
* The Symbol Path can be set by: *
* using the _NT_SYMBOL_PATH environment variable. *
* using the -y <symbol_path> argument when starting the debugger. *
* using .sympath and .sympath+ *
************************************************** *******************

ADDITIONAL_DEBUG_TEXT:
Use '!findthebuild' command to search for the target build information.
If the build information is available, run '!findthebuild -s ; .reload' to set symbol path and load symbols.

FAULTING_MODULE: 804d7000 nt

DEBUG_FLR_IMAGE_TIMESTAMP: 4a54d414

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - La instrucci n en "0x%08lx" hace referencia a la memoria en "0x%08lx". La memoria no se puede "%s".

FAULTING_IP:
nv4_disp+23298
bd035298 8994887c010000 mov dword ptr [eax+ecx*4+17Ch],edx

TRAP_FRAME: b2c0dbe0 -- (.trap 0xffffffffb2c0dbe0)
ErrCode = 00000002
eax=b2c0dcd0 ebx=e2065a80 ecx=e20b5f40 edx=e2a844a0 esi=e1d98800 edi=00000000
eip=bd035298 esp=b2c0dc54 ebp=b2c0dce8 iopl=0 nv up ei pl nz na po nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010202
nv4_disp+0x23298:
bd035298 8994887c010000 mov dword ptr [eax+ecx*4+17Ch],edx ds:0023:3aee5b4c=????????
Resetting default scope

DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: 0x8E

LAST_CONTROL_TRANSFER: from 804fe5eb to 804f9d1b

STACK_TEXT:
WARNING: Stack unwind information not available. Following frames may be wrong.
b2c0d7a8 804fe5eb 0000008e c0000005 bd035298 nt!KeBugCheckEx+0x1b
b2c0db70 80541175 b2c0db8c 00000000 b2c0dbe0 nt!KeRaiseUserException+0xc29
b2c0dc24 bd0f5bbd b2c0dcc0 00000030 00000000 nt!Kei386EoiHelper+0x1d9
b2c0dd48 8054070c 02400002 02400005 00000000 nv4_disp+0xe3bbd
b2c0dd4c 02400002 02400005 00000000 00000000 nt!KeReleaseInStackQueuedSpinLockFromDpcLevel+0xb7 4
b2c0dd50 02400005 00000000 00000000 05bafc40 0x2400002
b2c0dd54 00000000 00000000 05bafc40 05bafb9c 0x2400005


STACK_COMMAND: kb

FOLLOWUP_IP:
nv4_disp+23298
bd035298 8994887c010000 mov dword ptr [eax+ecx*4+17Ch],edx

SYMBOL_STACK_INDEX: 0

SYMBOL_NAME: nv4_disp+23298

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nv4_disp

IMAGE_NAME: nv4_disp.dll

BUCKET_ID: WRONG_SYMBOLS

Followup: MachineOwner
---------







En fin.... Muchas gracias amigo y disculpa las molestias. A ver que me recomiendas hacer. Thanks Thanks.

Vaya que son varios problemas

Los dos pantallazos que han salido pertenecen a Nvidia pero son diferentes.
Uno pertencese a la tarjeta de red y otro al controlador de video.

Fíjate en la carpeta C:\Windows\MiniDum haber si hay mas archivos .DMP, si los hay analízalos todos con la herramienta Debugging Tool y pégalos aquí para ver si no hay mas errores.


Un saludo

Buenas.

No tengo esa carpeta porque tengo el Windows XP Professional SP2 uE (es decir, el modificado) Pero me sale el archivo MEMORY.DMP

Pero vamos lo que no entiendo es como me pueden dar errores de Driver... si el PC siempre me va bien excepto los pantallazos. No entiendo. Algunas veces (cuando tenia el XP 64 bit y el Windows Vista) algunas veces eran controladores del procesador, otras ... bueno no me acuerdo.

Mi propia opinion es que el error esta en los controladores de NVIDIA, en general. Tal vez sea una incopatibilidad entre la placa base (nvidia) y la versión de los controladores. No sé. Los pantallazos azules, incluso hoy en dia, todavia son un misterio.

Otra cosa, el tema de los pantallazos me paso al tener instalado el Windows XP Professional x64 bit SP2 (creo que era SP2 no recuerdo jeje).

Y por último creo que debo de llevar el PC a un tecnico y que le haga diagnosticos y que lo mire por dentro. Es que NI FORMATEANDO SE ELIMINA ESO DE LOS PANTALLAZOS.

Muchas gracias y saludos.

Hola

Entonces el dispositivo es el que está fallando.

Buenas

El dispositivo te refieres a la placa base??? o a los controladores?. Es que no tengo mucha idea de informatica.


Saludos

No a la placa completa, solamente a la tarjeta de red y video.

Aunque otra opción que tienes es probar con un Windows que no sea modificado.

Un saludo