Намертво зависает

Rich213, скорее удалить, чем отключить... Драйвер всё равно будет грузиться, даже если отключите каспера.

Понятно. Подобную уязвимость с klif.sys я встретил на сайте Касперского, но для 6-й и 7-й версий. У меня стоит KIS 2010 (9.0.0.736). В принципе меня он полностью устраивает и не хотелось бы менять продукт. Если полностью переусановить его проблема исчезнет? Как я понимаю здесь причина не в совместимости, а программного характера. Думаю, если взять свежий дистрибутив с оф сайта, то по идее драйвер должен работать нормально. Или я где то заблуждаюсь?

Rich213, как говорится, попытка - не пытка. Верно?:;) Попытаться всегда можно...

Спасибо за подсказку!!! Попробую переустановить. Если поможет - обязательно напишу. Johny-electric - МОЛОДЕЦ!!!

Вечер добрый! Снес каспера. Вроде бы лучше стало, но 1 раз снова повторилось зависание. В Дампе уже другой драйвер. Может видюха заболела?


Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Windows\MEMORY.DMP]
Kernel Summary Dump File: Only kernel address space is available

Symbol search path is: *** Invalid ***
****************************************************************************
* Symbol loading may be unreliable without a symbol search path. *
* Use .symfix to have the debugger choose a symbol path. *
* After setting your symbol path, use .reload to refresh symbol locations. *
****************************************************************************
Executable search path is:
*********************************************************************
* Symbols can not be loaded because symbol path is not initialized. *
* *
* The Symbol Path can be set by: *
* using the _NT_SYMBOL_PATH environment variable. *
* using the -y <symbol_path> argument when starting the debugger. *
* using .sympath and .sympath+ *
*********************************************************************
*** ERROR: Symbol file could not be found. Defaulted to export symbols for ntkrpamp.exe -
Windows 7 Kernel Version 7600 MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16385.x86fre.win7_rtm.090713-1255
Machine Name:
Kernel base = 0x83449000 PsLoadedModuleList = 0x83591810
Debug session time: Sat Feb 6 16:26:03.743 2010 (GMT+3)
System Uptime: 0 days 6:36:04.148
*********************************************************************
* Symbols can not be loaded because symbol path is not initialized. *
* *
* The Symbol Path can be set by: *
* using the _NT_SYMBOL_PATH environment variable. *
* using the -y <symbol_path> argument when starting the debugger. *
* using .sympath and .sympath+ *
*********************************************************************
*** ERROR: Symbol file could not be found. Defaulted to export symbols for ntkrpamp.exe -
Loading Kernel Symbols
...............................................................
................................................................
.....................
Loading User Symbols
PEB is paged out (Peb.Ldr = 7ffd600c). Type ".hh dbgerr001" for details
Loading unloaded module list
.....
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck A, {0, 2, 1, 834dcc97}

*** ERROR: Module load completed but symbols could not be loaded for nvlddmkm.sys
*** ERROR: Symbol file could not be found. Defaulted to export symbols for dxgkrnl.sys -
***** Kernel symbols are WRONG. Please fix symbols to do analysis.

*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!KPRCB ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!KPRCB ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
*************************************************************************
*********************************************************************
* Symbols can not be loaded because symbol path is not initialized. *
* *
* The Symbol Path can be set by: *
* using the _NT_SYMBOL_PATH environment variable. *
* using the -y <symbol_path> argument when starting the debugger. *
* using .sympath and .sympath+ *
*********************************************************************
*********************************************************************
* Symbols can not be loaded because symbol path is not initialized. *
* *
* The Symbol Path can be set by: *
* using the _NT_SYMBOL_PATH environment variable. *
* using the -y <symbol_path> argument when starting the debugger. *
* using .sympath and .sympath+ *
*********************************************************************
Probably caused by : nvlddmkm.sys ( nvlddmkm+117c4e )

Followup: MachineOwner
--------

Может с железом что не так? Хотя все оборудование работает нормально, драйвера тоже все стоят. Система проблем в них не видит.

Rich213, используйте программу BlueScreenView для просмотра дампов. Выложите результат сюда. Проверьте, не перегревается ли видеокарта (Post #167006).

Протестировал видюху. Температура стабилизировалась на 88-89 градусов, в течении 250-300 сек.
BlueScreenView показал следующюю информацию (прошу прощения если выложил не то).

Верхнее поле:
020610-12854-01.dmp 06.02.2010 16:27:22 IRQL_NOT_LESS_OR_EQUAL 0x0000000a 0x00000000 0x00000002 0x00000001 0x834dcc97 klif.sys klif.sys+1d218 32-бит C:\Windows\minidump\020610-12854-01.dmp 2 15 7600
020510-21247-01.dmp 05.02.2010 20:29:28 IRQL_NOT_LESS_OR_EQUAL 0x0000000a 0x7857ffec 0x00000002 0x00000001 0x834a41d8 Ntfs.sys Ntfs.sys+a6592 Драйвер файловой системы NT Операционная система Microsoft® Windows® Microsoft Corporation 6.1.7600.16385 (win7_rtm.090713-1255) 32-бит C:\Windows\minidump\020510-21247-01.dmp 2 15 7600
020510-11310-01.dmp 05.02.2010 20:21:06 IRQL_NOT_LESS_OR_EQUAL 0x0000000a 0x687bffec 0x00000002 0x00000001 0x834df1d8 atapi.sys atapi.sys+2e3a ATAPI IDE Miniport Driver Microsoft® Windows® Operating System Microsoft Corporation 6.1.7600.16385 (win7_rtm.090713-1255) 32-бит C:\Windows\minidump\020510-11310-01.dmp 2 15 7600
012510-13572-01.dmp 25.01.2010 22:01:40 IRQL_NOT_LESS_OR_EQUAL 0x0000000a 0x67fbffec 0x00000002 0x00000001 0x82ea51d8 atapi.sys atapi.sys+2e3a ATAPI IDE Miniport Driver Microsoft® Windows® Operating System Microsoft Corporation 6.1.7600.16385 (win7_rtm.090713-1255) 32-бит C:\Windows\minidump\012510-13572-01.dmp 2 15 7600
012010-12448-01.dmp 20.01.2010 20:32:56 IRQL_NOT_LESS_OR_EQUAL 0x0000000a 0x67fbffec 0x00000002 0x00000001 0x82e9a1d8 ntkrnlpa.exe ntkrnlpa.exe+467eb NT Kernel & System Microsoft® Windows® Operating System Microsoft Corporation 6.1.7600.16385 (win7_rtm.090713-1255) 32-бит C:\Windows\minidump\012010-12448-01.dmp 2 15 7600

Нижнее поле (выделенные розовым цветом строки):
klif.sys klif.sys+1d218 0x9103a000 0x9108b000 0x00051000 0x4afabcf7 11.11.2009 16:32:39

ntkrnlpa.exe ntkrnlpa.exe+467eb 0x83449000 0x83859000 0x00410000 0x4a5bc007 14.07.2009 2:15:19 Microsoft® Windows® Operating System NT Kernel & System 6.1.7600.16385 (win7_rtm.090713-1255) Microsoft Corporation C:\Windows\system32\ntkrnlpa.exe

nvlddmkm.sys nvlddmkm.sys+325af4 0x92633000 0x92f504e0 0x0091d4e0 0x4a5ce288 14.07.2009 22:54:48 NVIDIA Windows Kernel Mode Driver, Version 190.38 NVIDIA Windows Kernel Mode Driver, Version 190.38 8.15.11.9038 NVIDIA Corporation C:\Windows\system32\drivers\nvlddmkm.sys

Rich213, я так понял, BSOD вылетает только когда отправляете на печать много листов? А драйвер принтера где брали? Принтер подключен по USB? Нагрев видеокарты до 90 градусов вполне допустим, но не желателен. Хотя ни одна игра не прогревает видеокарту так, как FurMark, так что у вас в этом плане всё нормально. Драйвер видеокарты вы всё-таки обновите. Настройки биоса меняли? Пробовали сбрасывать настройки по умолчанию?

Bug Check 0xA: IRQL_NOT_LESS_OR_EQUAL

Вчера с принтером была такая ситуация: при выводе на печать 20-30 страниц сразу всё виснет. Принтер подключен через USB. Драйвер сначала система не установила, потом через устранение неполадки нашла в интернете. В биосе менял для установки системы только устройства первоначальной загрузки. Настройки не сбрасывал на заводские. А последнее зависание было совсем не давно (минут 30 назад). Принтер в состоянии ожидания находился. Сейчас его совсем отключил.

Обновил драйвер для видеокарты. Но пока не могу уловить причину (действие) приводящее к такому странному зависанию. Ещё в журнале настораживает такая информация:

Доступ к источнику содержимого <csc://{S-1-5-21-3661508754-473893205-334250164-500}/> невозможен.

Контекст: приложение "", каталог "SystemIndex"

Подробности:
(HRESULT : 0x80004005) (0x80004005)

Это критично?

А вот ещё информация к размышлению. Сейчас, после 1-1,5 часов работы вылетел в BSOD. В дампе файл как я понял относящийся или являющийся компонентом ядра системы. Что то это меня совсем не радует. Может у кого было такое? Как докопаться до причины и что с этим делать?

Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Windows\MEMORY.DMP]
Kernel Summary Dump File: Only kernel address space is available

Symbol search path is: *** Invalid ***
****************************************************************************
* Symbol loading may be unreliable without a symbol search path. *
* Use .symfix to have the debugger choose a symbol path. *
* After setting your symbol path, use .reload to refresh symbol locations. *
****************************************************************************
Executable search path is:
*********************************************************************
* Symbols can not be loaded because symbol path is not initialized. *
* *
* The Symbol Path can be set by: *
* using the _NT_SYMBOL_PATH environment variable. *
* using the -y <symbol_path> argument when starting the debugger. *
* using .sympath and .sympath+ *
*********************************************************************
*** ERROR: Symbol file could not be found. Defaulted to export symbols for ntkrpamp.exe -
Windows 7 Kernel Version 7600 MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16385.x86fre.win7_rtm.090713-1255
Machine Name:
Kernel base = 0x83416000 PsLoadedModuleList = 0x8355e810
Debug session time: Sun Feb 7 11:17:33.898 2010 (GMT+3)
System Uptime: 0 days 0:48:15.303
*********************************************************************
* Symbols can not be loaded because symbol path is not initialized. *
* *
* The Symbol Path can be set by: *
* using the _NT_SYMBOL_PATH environment variable. *
* using the -y <symbol_path> argument when starting the debugger. *
* using .sympath and .sympath+ *
*********************************************************************
*** ERROR: Symbol file could not be found. Defaulted to export symbols for ntkrpamp.exe -
Loading Kernel Symbols
...............................................................
................................................................
.......................
Loading User Symbols
PEB is paged out (Peb.Ldr = 7ffdd00c). Type ".hh dbgerr001" for details
Loading unloaded module list
.....
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck A, {7857ffec, 2, 1, 834a21d8}

***** Kernel symbols are WRONG. Please fix symbols to do analysis.

*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!KPRCB ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!KPRCB ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
*************************************************************************
*********************************************************************
* Symbols can not be loaded because symbol path is not initialized. *
* *
* The Symbol Path can be set by: *
* using the _NT_SYMBOL_PATH environment variable. *
* using the -y <symbol_path> argument when starting the debugger. *
* using .sympath and .sympath+ *
*********************************************************************
*********************************************************************
* Symbols can not be loaded because symbol path is not initialized. *
* *
* The Symbol Path can be set by: *
* using the _NT_SYMBOL_PATH environment variable. *
* using the -y <symbol_path> argument when starting the debugger. *
* using .sympath and .sympath+ *
*********************************************************************
Probably caused by : ntkrpamp.exe ( nt!KeRevertToUserGroupAffinityThread+77b )

Followup: MachineOwner
---------

Rich213,
Тут описано, что для точной диагностики нужно использовать Symbol описание переменных.
Обычно он устанавливается в каталог С:\Symbol и такие программы например как ProcessExplorer, ProcMonitor, WPT и т.д.

Rich213, адрес до символов надо указать srv*http://msdl.microsoft.com/download/symbols

Если можно чуть поподробнее. Скачиваю Windows_Win7.7600.16385.090713-1255.X86FRE.Symbols.msi, но пока не очень понимаю где и как нужно указывать srv*http://msdl.microsoft.com/download/symbols.

Всё. Разобрался. Спасибо Бэлиан и arseny1992 что направили в нужное русло по поводу Symbol. Сейчас буду снова дамп анализировать дебуггером.