Now from one day to another it has become very dangerous for my system.
If I try to reboot/shutdown the system, WLM kills Windows suddenly without a BSOD or something else and resets my computer.
Same thing happens if I try to close WLM.
I post below some of the several different crash dumps and a screenshot of running tasks.
Microsoft ® Windows Debugger Version 6.6.0007.5
Copyright © Microsoft Corporation. All rights reserved.
Loading Dump File [C:\WINDOWS\Minidump\Mini102106-02.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: *** Invalid ***
****************************************************************************
* Symbol loading may be unreliable without a symbol search path. *
* Use .symfix to have the debugger choose a symbol path. *
* After setting your symbol path, use .reload to refresh symbol locations. *
****************************************************************************
Executable search path is:
*********************************************************************
* Symbols can not be loaded because symbol path is not initialized. *
* *
* The Symbol Path can be set by: *
* using the _NT_SYMBOL_PATH environment variable. *
* using the -y <symbol_path> argument when starting the debugger. *
* using .sympath and .sympath+ *
*********************************************************************
Unable to load image ntoskrnl.exe, Win32 error 2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
*** ERROR: Module load completed but symbols could not be loaded for ntoskrnl.exe
Windows XP Kernel Version 2600 (Service Pack 2) UP Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Kernel base = 0x804d7000 PsLoadedModuleList = 0x805531a0
Debug session time: Sat Oct 21 08:55:05.875 2006 (GMT+2)
System Uptime: 0 days 0:23:02.383
*********************************************************************
* Symbols can not be loaded because symbol path is not initialized. *
* *
* The Symbol Path can be set by: *
* using the _NT_SYMBOL_PATH environment variable. *
* using the -y <symbol_path> argument when starting the debugger. *
* using .sympath and .sympath+ *
*********************************************************************
Unable to load image ntoskrnl.exe, Win32 error 2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
*** ERROR: Module load completed but symbols could not be loaded for ntoskrnl.exe
Loading Kernel Symbols
..................................................................................................................................................
Loading User Symbols
Loading unloaded module list
..........
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 100000D1, {1, 2, 8, 1}
***** Kernel symbols are WRONG. Please fix symbols to do analysis.
***** Kernel symbols are WRONG. Please fix symbols to do analysis.
Probably caused by : ntoskrnl.exe ( nt+192a7 )
Followup: MachineOwner
---------
kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: 00000001, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000008, value 0 = read operation, 1 = write operation
Arg4: 00000001, address which referenced memory
Debugging Details:
------------------
***** Kernel symbols are WRONG. Please fix symbols to do analysis.
***** Kernel symbols are WRONG. Please fix symbols to do analysis.
MODULE_NAME: nt
FAULTING_MODULE: 804d7000 nt
DEBUG_FLR_IMAGE_TIMESTAMP: 42250a1d
WRITE_ADDRESS: unable to get nt!MmSpecialPoolStart
unable to get nt!MmSpecialPoolEnd
unable to get nt!MmPoolCodeStart
unable to get nt!MmPoolCodeEnd
00000001
CURRENT_IRQL: 2
FAULTING_IP:
+1
00000001 ?? ???
CUSTOMER_CRASH_COUNT: 2
DEFAULT_BUCKET_ID: WRONG_SYMBOLS
BUGCHECK_STR: 0xD1
LAST_CONTROL_TRANSFER: from 804f02a7 to 00000001
STACK_TEXT:
WARNING: Frame IP not in any known module. Following frames may be wrong.
a658ac04 804f02a7 856eb6c8 850af980 8525821c 0x1
a658ac20 80571cd0 850af980 00000000 850af980 nt+0x192a7
a658ac3c 80573bbb 8525821c 850af980 850afa5c nt+0x9acd0
a658ac58 805749c9 86ca3b90 00000103 852581c0 nt+0x9cbbb
a658ad00 8056d326 00000c8c 000008a8 00000000 nt+0x9d9c9
a658ad34 8053c808 00000c8c 000008a8 00000000 nt+0x96326
a658ad64 7c91eb94 badb0d00 076ae900 a6a0fd98 nt+0x65808
a658ad68 badb0d00 076ae900 a6a0fd98 a6a0fdcc 0x7c91eb94
a658ad6c 076ae900 a6a0fd98 a6a0fdcc 00000000 0xbadb0d00
a658ad70 a6a0fd98 a6a0fdcc 00000000 00000000 0x76ae900
a658ad74 a6a0fdcc 00000000 00000000 00000000 0xa6a0fd98
a658ad78 00000000 00000000 00000000 00000000 0xa6a0fdcc
STACK_COMMAND: kb
FOLLOWUP_IP:
nt+192a7
804f02a7 ?? ???
SYMBOL_STACK_INDEX: 1
FOLLOWUP_NAME: MachineOwner
IMAGE_NAME: ntoskrnl.exe
SYMBOL_NAME: nt+192a7
BUCKET_ID: WRONG_SYMBOLS
Followup: MachineOwner
---------
kd> .restart /f
Loading Dump File [C:\WINDOWS\Minidump\Mini102106-02.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: *** Invalid ***
****************************************************************************
* Symbol loading may be unreliable without a symbol search path. *
* Use .symfix to have the debugger choose a symbol path. *
* After setting your symbol path, use .reload to refresh symbol locations. *
****************************************************************************
Executable search path is:
*********************************************************************
* Symbols can not be loaded because symbol path is not initialized. *
* *
* The Symbol Path can be set by: *
* using the _NT_SYMBOL_PATH environment variable. *
* using the -y <symbol_path> argument when starting the debugger. *
* using .sympath and .sympath+ *
*********************************************************************
Unable to load image ntoskrnl.exe, Win32 error 2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
*** ERROR: Module load completed but symbols could not be loaded for ntoskrnl.exe
Windows XP Kernel Version 2600 (Service Pack 2) UP Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Kernel base = 0x804d7000 PsLoadedModuleList = 0x805531a0
Debug session time: Sat Oct 21 08:55:05.875 2006 (GMT+2)
System Uptime: 0 days 0:23:02.383
*********************************************************************
* Symbols can not be loaded because symbol path is not initialized. *
* *
* The Symbol Path can be set by: *
* using the _NT_SYMBOL_PATH environment variable. *
* using the -y <symbol_path> argument when starting the debugger. *
* using .sympath and .sympath+ *
*********************************************************************
Unable to load image ntoskrnl.exe, Win32 error 2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
*** ERROR: Module load completed but symbols could not be loaded for ntoskrnl.exe
Loading Kernel Symbols
..................................................................................................................................................
Loading User Symbols
Loading unloaded module list
..........
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 100000D1, {1, 2, 8, 1}
***** Kernel symbols are WRONG. Please fix symbols to do analysis.
***** Kernel symbols are WRONG. Please fix symbols to do analysis.
Probably caused by : ntoskrnl.exe ( nt+192a7 )
Followup: MachineOwner
---------
kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: 00000001, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000008, value 0 = read operation, 1 = write operation
Arg4: 00000001, address which referenced memory
Debugging Details:
------------------
***** Kernel symbols are WRONG. Please fix symbols to do analysis.
***** Kernel symbols are WRONG. Please fix symbols to do analysis.
MODULE_NAME: nt
FAULTING_MODULE: 804d7000 nt
DEBUG_FLR_IMAGE_TIMESTAMP: 42250a1d
WRITE_ADDRESS: unable to get nt!MmSpecialPoolStart
unable to get nt!MmSpecialPoolEnd
unable to get nt!MmPoolCodeStart
unable to get nt!MmPoolCodeEnd
00000001
CURRENT_IRQL: 2
FAULTING_IP:
+1
00000001 ?? ???
CUSTOMER_CRASH_COUNT: 2
DEFAULT_BUCKET_ID: WRONG_SYMBOLS
BUGCHECK_STR: 0xD1
LAST_CONTROL_TRANSFER: from 804f02a7 to 00000001
STACK_TEXT:
WARNING: Frame IP not in any known module. Following frames may be wrong.
a658ac04 804f02a7 856eb6c8 850af980 8525821c 0x1
a658ac20 80571cd0 850af980 00000000 850af980 nt+0x192a7
a658ac3c 80573bbb 8525821c 850af980 850afa5c nt+0x9acd0
a658ac58 805749c9 86ca3b90 00000103 852581c0 nt+0x9cbbb
a658ad00 8056d326 00000c8c 000008a8 00000000 nt+0x9d9c9
a658ad34 8053c808 00000c8c 000008a8 00000000 nt+0x96326
a658ad64 7c91eb94 badb0d00 076ae900 a6a0fd98 nt+0x65808
a658ad68 badb0d00 076ae900 a6a0fd98 a6a0fdcc 0x7c91eb94
a658ad6c 076ae900 a6a0fd98 a6a0fdcc 00000000 0xbadb0d00
a658ad70 a6a0fd98 a6a0fdcc 00000000 00000000 0x76ae900
a658ad74 a6a0fdcc 00000000 00000000 00000000 0xa6a0fd98
a658ad78 00000000 00000000 00000000 00000000 0xa6a0fdcc
STACK_COMMAND: kb
FOLLOWUP_IP:
nt+192a7
804f02a7 ?? ???
SYMBOL_STACK_INDEX: 1
FOLLOWUP_NAME: MachineOwner
IMAGE_NAME: ntoskrnl.exe
SYMBOL_NAME: nt+192a7
BUCKET_ID: WRONG_SYMBOLS
Followup: MachineOwner
---------
Microsoft ® Windows Debugger Version 6.6.0007.5
Copyright © Microsoft Corporation. All rights reserved.
Loading Dump File [C:\WINDOWS\Minidump\Mini102106-03.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: *** Invalid ***
****************************************************************************
* Symbol loading may be unreliable without a symbol search path. *
* Use .symfix to have the debugger choose a symbol path. *
* After setting your symbol path, use .reload to refresh symbol locations. *
****************************************************************************
Executable search path is:
*********************************************************************
* Symbols can not be loaded because symbol path is not initialized. *
* *
* The Symbol Path can be set by: *
* using the _NT_SYMBOL_PATH environment variable. *
* using the -y <symbol_path> argument when starting the debugger. *
* using .sympath and .sympath+ *
*********************************************************************
Unable to load image ntoskrnl.exe, Win32 error 2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
*** ERROR: Module load completed but symbols could not be loaded for ntoskrnl.exe
Windows XP Kernel Version 2600 (Service Pack 2) UP Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Kernel base = 0x804d7000 PsLoadedModuleList = 0x805531a0
Debug session time: Sat Oct 21 09:29:08.546 2006 (GMT+2)
System Uptime: 0 days 0:33:20.056
*********************************************************************
* Symbols can not be loaded because symbol path is not initialized. *
* *
* The Symbol Path can be set by: *
* using the _NT_SYMBOL_PATH environment variable. *
* using the -y <symbol_path> argument when starting the debugger. *
* using .sympath and .sympath+ *
*********************************************************************
Unable to load image ntoskrnl.exe, Win32 error 2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
*** ERROR: Module load completed but symbols could not be loaded for ntoskrnl.exe
Loading Kernel Symbols
.....................................................................................................................................................
Loading User Symbols
Loading unloaded module list
...........
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 1000007F, {d, 0, 0, 0}
***** Kernel symbols are WRONG. Please fix symbols to do analysis.
***** Kernel symbols are WRONG. Please fix symbols to do analysis.
Probably caused by : ntoskrnl.exe ( nt+192a7 )
Followup: MachineOwner
---------
kd> t
^ No runnable debuggees error in 't'
kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
UNEXPECTED_KERNEL_MODE_TRAP_M (1000007f)
This means a trap occurred in kernel mode, and it's a trap of a kind
that the kernel isn't allowed to have/catch (bound trap) or that
is always instant death (double fault). The first number in the
bugcheck params is the number of the trap (8 = double fault, etc)
Consult an Intel x86 family manual to learn more about what these
traps are. Here is a *portion* of those codes:
If kv shows a taskGate
use .tss on the part before the colon, then kv.
Else if kv shows a trapframe
use .trap on that value
Else
.trap on the appropriate frame will show where the trap was taken
(on x86, this will be the ebp that goes with the procedure KiTrap)
Endif
kb will then show the corrected stack.
Arguments:
Arg1: 0000000d, EXCEPTION_GP_FAULT
Arg2: 00000000
Arg3: 00000000
Arg4: 00000000
Debugging Details:
------------------
***** Kernel symbols are WRONG. Please fix symbols to do analysis.
***** Kernel symbols are WRONG. Please fix symbols to do analysis.
MODULE_NAME: nt
FAULTING_MODULE: 804d7000 nt
DEBUG_FLR_IMAGE_TIMESTAMP: 42250a1d
BUGCHECK_STR: 0x7f_d
CUSTOMER_CRASH_COUNT: 3
DEFAULT_BUCKET_ID: WRONG_SYMBOLS
LAST_CONTROL_TRANSFER: from 804f02a7 to 8194c75c
STACK_TEXT:
WARNING: Frame IP not in any known module. Following frames may be wrong.
a6f49c04 804f02a7 00000000 84e25988 84f917ec 0x8194c75c
a6f49c20 80571cd0 84e25988 00000000 84e25988 nt+0x192a7
a6f49c3c 80573bbb 84f917ec 84e25988 84e25a64 nt+0x9acd0
a6f49c58 805749c9 862518d0 00000103 84f91790 nt+0x9cbbb
a6f49d00 8056d326 00000c68 000008e8 00000000 nt+0x9d9c9
a6f49d34 8053c808 00000c68 000008e8 00000000 nt+0x96326
a6f49d64 7c91eb94 badb0d00 0437e900 a75ffd98 nt+0x65808
a6f49d68 badb0d00 0437e900 a75ffd98 a75ffdcc 0x7c91eb94
a6f49d6c 0437e900 a75ffd98 a75ffdcc 00000000 0xbadb0d00
a6f49d70 a75ffd98 a75ffdcc 00000000 00000000 0x437e900
a6f49d74 a75ffdcc 00000000 00000000 00000000 0xa75ffd98
a6f49d78 00000000 00000000 00000000 00000000 0xa75ffdcc
STACK_COMMAND: kb
FOLLOWUP_IP:
nt+192a7
804f02a7 ?? ???
SYMBOL_STACK_INDEX: 1
FOLLOWUP_NAME: MachineOwner
IMAGE_NAME: ntoskrnl.exe
SYMBOL_NAME: nt+192a7
BUCKET_ID: WRONG_SYMBOLS
Followup: MachineOwner
---------
Microsoft ® Windows Debugger Version 6.6.0007.5
Copyright © Microsoft Corporation. All rights reserved.
Loading Dump File [C:\WINDOWS\Minidump\Mini102006-04.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: *** Invalid ***
****************************************************************************
* Symbol loading may be unreliable without a symbol search path. *
* Use .symfix to have the debugger choose a symbol path. *
* After setting your symbol path, use .reload to refresh symbol locations. *
****************************************************************************
Executable search path is:
*********************************************************************
* Symbols can not be loaded because symbol path is not initialized. *
* *
* The Symbol Path can be set by: *
* using the _NT_SYMBOL_PATH environment variable. *
* using the -y <symbol_path> argument when starting the debugger. *
* using .sympath and .sympath+ *
*********************************************************************
Unable to load image ntoskrnl.exe, Win32 error 2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
*** ERROR: Module load completed but symbols could not be loaded for ntoskrnl.exe
Windows XP Kernel Version 2600 (Service Pack 2) UP Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Kernel base = 0x804d7000 PsLoadedModuleList = 0x805531a0
Debug session time: Fri Oct 20 13:52:09.078 2006 (GMT+2)
System Uptime: 0 days 1:05:58.582
*********************************************************************
* Symbols can not be loaded because symbol path is not initialized. *
* *
* The Symbol Path can be set by: *
* using the _NT_SYMBOL_PATH environment variable. *
* using the -y <symbol_path> argument when starting the debugger. *
* using .sympath and .sympath+ *
*********************************************************************
Unable to load image ntoskrnl.exe, Win32 error 2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
*** ERROR: Module load completed but symbols could not be loaded for ntoskrnl.exe
Loading Kernel Symbols
.....................................................................................................................................................
Loading User Symbols
Loading unloaded module list
............
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 100000D1, {1, 2, 8, 1}
***** Kernel symbols are WRONG. Please fix symbols to do analysis.
***** Kernel symbols are WRONG. Please fix symbols to do analysis.
Probably caused by : ntoskrnl.exe ( nt+192a7 )
Followup: MachineOwner
---------
kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: 00000001, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000008, value 0 = read operation, 1 = write operation
Arg4: 00000001, address which referenced memory
Debugging Details:
------------------
***** Kernel symbols are WRONG. Please fix symbols to do analysis.
***** Kernel symbols are WRONG. Please fix symbols to do analysis.
MODULE_NAME: nt
FAULTING_MODULE: 804d7000 nt
DEBUG_FLR_IMAGE_TIMESTAMP: 42250a1d
WRITE_ADDRESS: unable to get nt!MmSpecialPoolStart
unable to get nt!MmSpecialPoolEnd
unable to get nt!MmPoolCodeStart
unable to get nt!MmPoolCodeEnd
00000001
CURRENT_IRQL: 2
FAULTING_IP:
+1
00000001 ?? ???
CUSTOMER_CRASH_COUNT: 4
DEFAULT_BUCKET_ID: WRONG_SYMBOLS
BUGCHECK_STR: 0xD1
LAST_CONTROL_TRANSFER: from 804f02a7 to 00000001
STACK_TEXT:
WARNING: Frame IP not in any known module. Following frames may be wrong.
a8080c04 804f02a7 855b6f14 8503ce70 84f411dc 0x1
a8080c20 80571cd0 8503ce70 00000000 8503ce70 nt+0x192a7
a8080c3c 80573bbb 84f411dc 8503ce70 8503cf4c nt+0x9acd0
a8080c58 805749c9 864f9860 00000103 84f41180 nt+0x9cbbb
a8080d00 8056d326 00000aa8 00000980 00000000 nt+0x9d9c9
a8080d34 8053c808 00000aa8 00000980 00000000 nt+0x96326
a8080d64 7c91eb94 badb0d00 041ee900 a823cd98 nt+0x65808
a8080d68 badb0d00 041ee900 a823cd98 a823cdcc 0x7c91eb94
a8080d6c 041ee900 a823cd98 a823cdcc 00000000 0xbadb0d00
a8080d70 a823cd98 a823cdcc 00000000 00000000 0x41ee900
a8080d74 a823cdcc 00000000 00000000 00000000 0xa823cd98
a8080d78 00000000 00000000 00000000 00000000 0xa823cdcc
STACK_COMMAND: kb
FOLLOWUP_IP:
nt+192a7
804f02a7 ?? ???
SYMBOL_STACK_INDEX: 1
FOLLOWUP_NAME: MachineOwner
IMAGE_NAME: ntoskrnl.exe
SYMBOL_NAME: nt+192a7
BUCKET_ID: WRONG_SYMBOLS
Followup: MachineOwner
---------
Sign In
Create Account
