Foro de InfoSpyware - Foro de Hijackthis - Foro de Virus

hola, en estos dias se me apaga la compu caca 20 minutos. cuando reinicio me sale el cartelito q win se recupero de un error grave. a un chico le paso lo mismo, y alguien este foro le recomendo bajar un programa que tiraba los datos y asi ver el problema. lo baje y esto es lo que salio

Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\WINDOWS\Minidump\Mini110209-02.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: *** Invalid ***
************************************************** **************************
* Symbol loading may be unreliable without a symbol search path. *
* Use .symfix to have the debugger choose a symbol path. *
* After setting your symbol path, use .reload to refresh symbol locations. *
************************************************** **************************
Executable search path is:
************************************************** *******************
* Symbols can not be loaded because symbol path is not initialized. *
* *
* The Symbol Path can be set by: *
* using the _NT_SYMBOL_PATH environment variable. *
* using the -y <symbol_path> argument when starting the debugger. *
* using .sympath and .sympath+ *
************************************************** *******************
Unable to load image ntoskrnl.exe, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
*** ERROR: Module load completed but symbols could not be loaded for ntoskrnl.exe
Windows XP Kernel Version 2600 (Service Pack 2) UP Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Machine Name:
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055a6a0
Debug session time: Mon Nov 2 02:40:17.593 2009 (GMT-2)
System Uptime: 0 days 0:06:18.125
************************************************** *******************
* Symbols can not be loaded because symbol path is not initialized. *
* *
* The Symbol Path can be set by: *
* using the _NT_SYMBOL_PATH environment variable. *
* using the -y <symbol_path> argument when starting the debugger. *
* using .sympath and .sympath+ *
************************************************** *******************
Unable to load image ntoskrnl.exe, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
*** ERROR: Module load completed but symbols could not be loaded for ntoskrnl.exe
Loading Kernel Symbols
.................................................. .............
.................................................. ..............

Loading User Symbols
Loading unloaded module list
............
*** WARNING: Unable to verify timestamp for USBPORT.SYS
*** ERROR: Module load completed but symbols could not be loaded for USBPORT.SYS
************************************************** *****************************
* *
* Bugcheck Analysis *
* *
************************************************** *****************************

Use !analyze -v to get detailed debugging information.

BugCheck 100000D1, {fa5fe168, 2, 0, fa5fe168}

***** Kernel symbols are WRONG. Please fix symbols to do analysis.

*** WARNING: Unable to verify timestamp for usbhub.sys
*** ERROR: Module load completed but symbols could not be loaded for usbhub.sys
*** WARNING: Unable to verify timestamp for USBSTOR.SYS
*** ERROR: Module load completed but symbols could not be loaded for USBSTOR.SYS
*** WARNING: Unable to verify timestamp for CLASSPNP.SYS
*** ERROR: Module load completed but symbols could not be loaded for CLASSPNP.SYS
************************************************** ***********************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
************************************************** ***********************
************************************************** ***********************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
************************************************** ***********************
************************************************** *******************
* Symbols can not be loaded because symbol path is not initialized. *
* *
* The Symbol Path can be set by: *
* using the _NT_SYMBOL_PATH environment variable. *
* using the -y <symbol_path> argument when starting the debugger. *
* using .sympath and .sympath+ *
************************************************** *******************
************************************************** *******************
* Symbols can not be loaded because symbol path is not initialized. *
* *
* The Symbol Path can be set by: *
* using the _NT_SYMBOL_PATH environment variable. *
* using the -y <symbol_path> argument when starting the debugger. *
* using .sympath and .sympath+ *
************************************************** *******************
Probably caused by : USBSTOR.SYS ( USBSTOR+165f )

Followup: MachineOwner
---------

kd> !analyze -v
************************************************** *****************************
* *
* Bugcheck Analysis *
* *
************************************************** *****************************

DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: fa5fe168, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000000, value 0 = read operation, 1 = write operation
Arg4: fa5fe168, address which referenced memory

Debugging Details:
------------------

***** Kernel symbols are WRONG. Please fix symbols to do analysis.

************************************************** ***********************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
************************************************** ***********************
************************************************** ***********************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
************************************************** ***********************
************************************************** *******************
* Symbols can not be loaded because symbol path is not initialized. *
* *
* The Symbol Path can be set by: *
* using the _NT_SYMBOL_PATH environment variable. *
* using the -y <symbol_path> argument when starting the debugger. *
* using .sympath and .sympath+ *
************************************************** *******************
************************************************** *******************
* Symbols can not be loaded because symbol path is not initialized. *
* *
* The Symbol Path can be set by: *
* using the _NT_SYMBOL_PATH environment variable. *
* using the -y <symbol_path> argument when starting the debugger. *
* using .sympath and .sympath+ *
************************************************** *******************

ADDITIONAL_DEBUG_TEXT:
Use '!findthebuild' command to search for the target build information.
If the build information is available, run '!findthebuild -s ; .reload' to set symbol path and load symbols.

MODULE_NAME: USBSTOR

FAULTING_MODULE: 804d7000 nt

DEBUG_FLR_IMAGE_TIMESTAMP: 41107d6c

READ_ADDRESS: unable to get nt!MmSpecialPoolStart
unable to get nt!MmSpecialPoolEnd
unable to get nt!MmPoolCodeStart
unable to get nt!MmPoolCodeEnd
fa5fe168

CURRENT_IRQL: 2

FAULTING_IP:
USBPORT+14168
fa5fe168 ?? ???

CUSTOMER_CRASH_COUNT: 2

DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: 0xD1

LAST_CONTROL_TRANSFER: from fa5fdd5c to fa5fe168

FAILED_INSTRUCTION_ADDRESS:
USBPORT+14168
fa5fe168 ?? ???

STACK_TEXT:
WARNING: Stack unwind information not available. Following frames may be wrong.
faf77c78 fa5fdd5c 81137028 ffaed008 ffb092ec USBPORT+0x14168
faf77ca4 fa602dfe ff9f5030 81137028 00000090 USBPORT+0x13d5c
faf77cc4 fa5ec1e2 ff9f5030 ffaed008 ffaed008 USBPORT+0x18dfe
faf77ce8 804e37f7 ffaed0e4 ff9f5188 ffb092ec USBPORT+0x21e2
faf77d00 fac602d9 ffaed008 ff9f5030 ffaed008 nt+0xc7f7
faf77d20 fac60afa ff9f5d50 ffaed008 ffaed008 usbhub+0x42d9
faf77d3c fac5e1d8 ffb092ec ffaed008 faf77d70 usbhub+0x4afa
faf77d4c 804e37f7 ff9f5a50 ffaed008 ffb09250 usbhub+0x21d8
faf77d70 fae1565f ffb09198 ffaed008 ffb339fc nt+0xc7f7
faf77da8 fae16061 ffb09198 ffaed008 ffb09198 USBSTOR+0x165f
faf77dd0 804e3e9d ffb09198 00aed008 8124f620 USBSTOR+0x2061
faf77df0 fae14aee ffb09198 ffaed008 8116ad5c nt+0xce9d
faf77e14 804e37f7 8124f568 ffaed008 8116ad28 USBSTOR+0xaee
faf77e38 fab9c616 ffba00e8 8116ace8 00000000 nt+0xc7f7
faf77e50 fab9c621 ffba00e8 80557fe0 8128beb4 CLASSPNP+0x616
faf77e68 804e3f3b ffba0030 00000000 804e3ef7 CLASSPNP+0x621
faf77e88 804dc4fd 80557fc0 00000000 93b627dc nt+0xcf3b
faf77fa4 804dc378 e1614bd0 00000000 ffdff000 nt+0x54fd
faf77fd0 804dbbd4 80559500 00000000 00005e88 nt+0x5378
faf77fd4 80559500 00000000 00005e88 00000000 nt+0x4bd4
faf77fd8 00000000 00005e88 00000000 6beef8a5 nt+0x82500


STACK_COMMAND: kb

FOLLOWUP_IP:
USBSTOR+165f
fae1565f ?? ???

SYMBOL_STACK_INDEX: 9

SYMBOL_NAME: USBSTOR+165f

FOLLOWUP_NAME: MachineOwner

IMAGE_NAME: USBSTOR.SYS

BUCKET_ID: WRONG_SYMBOLS

Followup: MachineOwner
---------

kd> !analyze -v
************************************************** *****************************
* *
* Bugcheck Analysis *
* *
************************************************** *****************************

DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: fa5fe168, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000000, value 0 = read operation, 1 = write operation
Arg4: fa5fe168, address which referenced memory

Debugging Details:
------------------

***** Kernel symbols are WRONG. Please fix symbols to do analysis.

************************************************** ***********************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
************************************************** ***********************
************************************************** ***********************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
************************************************** ***********************
************************************************** *******************
* Symbols can not be loaded because symbol path is not initialized. *
* *
* The Symbol Path can be set by: *
* using the _NT_SYMBOL_PATH environment variable. *
* using the -y <symbol_path> argument when starting the debugger. *
* using .sympath and .sympath+ *
************************************************** *******************
************************************************** *******************
* Symbols can not be loaded because symbol path is not initialized. *
* *
* The Symbol Path can be set by: *
* using the _NT_SYMBOL_PATH environment variable. *
* using the -y <symbol_path> argument when starting the debugger. *
* using .sympath and .sympath+ *
************************************************** *******************

ADDITIONAL_DEBUG_TEXT:
Use '!findthebuild' command to search for the target build information.
If the build information is available, run '!findthebuild -s ; .reload' to set symbol path and load symbols.

MODULE_NAME: USBSTOR

FAULTING_MODULE: 804d7000 nt

DEBUG_FLR_IMAGE_TIMESTAMP: 41107d6c

READ_ADDRESS: fa5fe168

CURRENT_IRQL: 2

FAULTING_IP:
USBPORT+14168
fa5fe168 ?? ???

CUSTOMER_CRASH_COUNT: 2

DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: 0xD1

LAST_CONTROL_TRANSFER: from fa5fdd5c to fa5fe168

FAILED_INSTRUCTION_ADDRESS:
USBPORT+14168
fa5fe168 ?? ???

STACK_TEXT:
WARNING: Stack unwind information not available. Following frames may be wrong.
faf77c78 fa5fdd5c 81137028 ffaed008 ffb092ec USBPORT+0x14168
faf77ca4 fa602dfe ff9f5030 81137028 00000090 USBPORT+0x13d5c
faf77cc4 fa5ec1e2 ff9f5030 ffaed008 ffaed008 USBPORT+0x18dfe
faf77ce8 804e37f7 ffaed0e4 ff9f5188 ffb092ec USBPORT+0x21e2
faf77d00 fac602d9 ffaed008 ff9f5030 ffaed008 nt+0xc7f7
faf77d20 fac60afa ff9f5d50 ffaed008 ffaed008 usbhub+0x42d9
faf77d3c fac5e1d8 ffb092ec ffaed008 faf77d70 usbhub+0x4afa
faf77d4c 804e37f7 ff9f5a50 ffaed008 ffb09250 usbhub+0x21d8
faf77d70 fae1565f ffb09198 ffaed008 ffb339fc nt+0xc7f7
faf77da8 fae16061 ffb09198 ffaed008 ffb09198 USBSTOR+0x165f
faf77dd0 804e3e9d ffb09198 00aed008 8124f620 USBSTOR+0x2061
faf77df0 fae14aee ffb09198 ffaed008 8116ad5c nt+0xce9d
faf77e14 804e37f7 8124f568 ffaed008 8116ad28 USBSTOR+0xaee
faf77e38 fab9c616 ffba00e8 8116ace8 00000000 nt+0xc7f7
faf77e50 fab9c621 ffba00e8 80557fe0 8128beb4 CLASSPNP+0x616
faf77e68 804e3f3b ffba0030 00000000 804e3ef7 CLASSPNP+0x621
faf77e88 804dc4fd 80557fc0 00000000 93b627dc nt+0xcf3b
faf77fa4 804dc378 e1614bd0 00000000 ffdff000 nt+0x54fd
faf77fd0 804dbbd4 80559500 00000000 00005e88 nt+0x5378
faf77fd4 80559500 00000000 00005e88 00000000 nt+0x4bd4
faf77fd8 00000000 00005e88 00000000 6beef8a5 nt+0x82500


STACK_COMMAND: kb

FOLLOWUP_IP:
USBSTOR+165f
fae1565f ?? ???

SYMBOL_STACK_INDEX: 9

SYMBOL_NAME: USBSTOR+165f

FOLLOWUP_NAME: MachineOwner

IMAGE_NAME: USBSTOR.SYS

BUCKET_ID: WRONG_SYMBOLS

Followup: MachineOwner
---------

Lo tienes repetido: se me reinicia sola la compu.

Saludos