help required

[TheMysterio]

first thanks for your repies guys. as i was busy i didnt had time to check the forums. i am not sure of how to trun off the automatic rebooting..but will check that.. i will also post the file minidump tomorrow so that Sephiroth can help me out to fix the problem. I am using Fat 32.

Thanks
TheMysterio

[Brave01Heart]

Hi Sephiroth & Le Cactus

Many thanks for your help ......... you learn something knew everyday. )

Best regards

Brave01Heart

[Dudelive]

@ Sephiroth When you get time....which we all run out of ...it would be great help for a step by step as how to solve problems like that using the ms debugger. I know you said you would and just letting you know it will be nice and Many Thanks. Maybe we can help others

[TheMysterio]

hi Sephiroth
how do i attach a file

[Sephiroth]

Quote:

Originally posted by TheMysterio@Nov 13 2002, 03:02 AM
hi Sephiroth
how do i attach a file

try emailing it to Sephiroth@betaone.net and I'll get back to ya when I get it , sorry for the late reply, been a bit busy

[TheMysterio]

hey Sephiroth
I've emailed u the Mini110302-01.dmp file. please do the needful
TheMysterio

[Sephiroth]

Ok, here goes

I don't have the symbol package for Win2K SP3 (symbols are files to debug system files against), I'm not sure if they have even made them yet, and I can't get a detailed analysis as I'm not on 2K, but here's what i can get by comparing them to the xp symbols, which shouldn't be too much different.

Quote:

Symbol search path is: SRV*c:\windows\symbols*http://msdl.microsoft.com/download/symbols

Loading Dump File [C:\Documents and Settings\Sephiroth\Desktop\Mini110302-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\windows\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: c:\windows\system32\
Unable to load image ntoskrnl.exe
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
Windows 2000 Kernel Version 2195 (Service Pack 3) UP Free x86 compatible
Kernel base = 0x80400000 PsLoadedModuleList = 0x8046d9f0
Debug session time: Sun Nov 03 03:21:23 2002
System Uptime: not available
Unable to load image ntoskrnl.exe
*** WARNING: Unable to verify timestamp for ntoskrnl.exe

Loading Kernel Symbols
.................................................. ........................................
Loading unloaded module list
..........
Loading User Symbols
************************************************** *****************************
* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * *
* * * * * * * * * * * * *Bugcheck Analysis * * * * * * * * * * * * * * * * * **
* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * *
************************************************** *****************************

Use !analyze -v to get detailed debugging information.

BugCheck E3, {810e9760, 810f7020, 0, 2}

***** Kernel symbols are WRONG. Please fix symbols to do analysis.

Unable to load image UdfReadr.SYS
*** WARNING: Unable to verify timestamp for UdfReadr.SYS
*** ERROR: Module load completed but symbols could not be loaded for UdfReadr.SYS
Probably caused by : UdfReadr.SYS ( UdfReadr+411f )

Followup: MachineOwner
---------

UdfReadr.sys is what is causing it to crash and reboot. udfreader, I think that is probably Adaptec software. I would search for that file and see what app installed it, then either check for a newer version of the app and see if it stops, or if all else fails uninstall the app and see what happens. I'm just glad it wasn't an NT system file, else it would have been a pain in the ass to debug a 2K file on an XP box, lol. I'm pretty sure that's Adaptec software though, possibly DirectCD, good luck, let us know how it turns out

[Sephiroth]

Ok, before I go to bed, here's a quick run through of the MS Debugger.

You can grab the debugger from

http://www.microsoft.com/ddk/debugging/default.asp

After you've downloaded the debugger, click the Symbols link and there's an explination there of how to download kernel symbols.

Start the debugger, click file, source file path, and set that to C:\Windows\System32 (assuming that path is right to your system32 folder, and if it complains about not being able to load files, try either %systemroot% or C:\Windows) and do the same for Image File Path.

You'll then set the Symbol Path from the directions on the link, changing downstream store to the place on your hdd you want to store downloaded kernel symbols.

From there, you can do a few things, debug the windows kernel, attach the debugger to and debug a running process, debug a C source file, debug an exe, or debug a minidump. I haven't played around with any of the options other than debugging a minidump.

Choose file \ open crash dump, navigate to your Minidump folder after a blue screen, open the minidump, let it save workspace information, and then you'll get two windows.

One is line by line the assembly code for what's in memory when the crash happened, all jibberish to me , and the other is a screen that will look like what I pasted above. Play around with your image and source paths if you get files could not be loaded errors. Once it's done, type !analyze -v to get a detailed analysis, and it will usually be able to tell you the exact file or files that caused the system to crash, using the one above as an example it would be something like this:

UdfReadr.sys was loaded in ram, conflicted with ntoskrnl.exe, and that caused the machine to crash.

If you need anymore of an explination I'll be happy, just ask , for now, I must sleep, got classes at 8am, lol.

[TheMysterio]

hi Sephiroth

I have a CD Writer so i use Adaptec Direct CD. you Direct CD is the culprit?. I will also download the MS Debugger and play with it..if i have any problem will ping you

Thanks for ure help

Regards
Mysterio

[Sephiroth]

np , uninstall direct cd and see what happens