[ufo56]

hei

Igatahes nüüd selline asi serveriga, vahel põhjustab bsodi mingi imelik cd-rommi error "the following boot-start or system-start driver s failed to load cdrom" Füüsilist cd rommi pole olemas muidu isegi. Ainuke cd rommi võimalus on üle võrgu läbi ipmi kvmi.See on disabletud. On kellelgi miskit soovitust mida proovida ? Antud error on tekkinud lambist. Võin jagada pikemaid event vieweri logisi

Logi antud errorist http://www.alienservers.org/upload/files/1/logi.evtx

[friik1]

Lingi taga on 404.
Võta debugging tools ette ning sööda talle dump ette, vaata mis räägib. Annab sulle mõne dll'i või sys'i ehk.

[ufo56]

Logi fail muidu http://www.alienservers.org/upload/files/1/logi.rar

dump file näitab csrss.exe

Spoiler

Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64 Copyright (c) Microsoft Corporation. All rights reserved. Loading Dump File [C:\Windows\Minidump\061410-11668-01.dmp] Mini Kernel Dump File: Only registers and stack trace are available Symbol search path is: *** Invalid *** **************************************************************************** * Symbol loading may be unreliable without a symbol search path.           * * Use .symfix to have the debugger choose a symbol path.                   * * After setting your symbol path, use .reload to refresh symbol locations. * **************************************************************************** Executable search path is: ********************************************************************* * Symbols can not be loaded because symbol path is not initialized. * *                                                                   * * The Symbol Path can be set by:                                    * *   using the _NT_SYMBOL_PATH environment variable.                 * *   using the -y <symbol_path> argument when starting the debugger. * *   using .sympath and .sympath+                                    * ********************************************************************* Unable to load image \SystemRoot\system32\ntoskrnl.exe, Win32 error 0n2 *** WARNING: Unable to verify timestamp for ntoskrnl.exe *** ERROR: Module load completed but symbols could not be loaded for ntoskrnl.exe Windows 7 Kernel Version 7600 MP (8 procs) Free x64 Product: Server, suite: TerminalServer SingleUserTS Built by: 7600.16539.amd64fre.win7_gdr.100226-1909 Machine Name: Kernel base = 0xfffff800`01665000 PsLoadedModuleList = 0xfffff800`018a2e50 Debug session time: Mon Jun 14 16:38:17.771 2010 (UTC + 3:00) System Uptime: 0 days 2:16:55.349 ********************************************************************* * Symbols can not be loaded because symbol path is not initialized. * *                                                                   * * The Symbol Path can be set by:                                    * *   using the _NT_SYMBOL_PATH environment variable.                 * *   using the -y <symbol_path> argument when starting the debugger. * *   using .sympath and .sympath+                                    * ********************************************************************* Unable to load image \SystemRoot\system32\ntoskrnl.exe, Win32 error 0n2 *** WARNING: Unable to verify timestamp for ntoskrnl.exe *** ERROR: Module load completed but symbols could not be loaded for ntoskrnl.exe Loading Kernel Symbols ............................................................... ................................................................ ... Loading User Symbols Loading unloaded module list ...... ******************************************************************************* *                                                                             * *                        Bugcheck Analysis                                    * *                                                                             * ******************************************************************************* Use !analyze -v to get detailed debugging information. BugCheck F4, {3, fffffa800d10cb30, fffffa800d10ce10, fffff800019e1540} ***** Kernel symbols are WRONG. Please fix symbols to do analysis. unable to get nt!KiCurrentEtwBufferOffset unable to get nt!KiCurrentEtwBufferBase ************************************************************************* ***                                                                   *** ***                                                                   *** ***    Your debugger is not using the correct symbols                 *** ***                                                                   *** ***    In order for this command to work properly, your symbol path   *** ***    must point to .pdb files that have full type information.      *** ***                                                                   *** ***    Certain .pdb files (such as the public OS symbols) do not      *** ***    contain the required information.  Contact the group that      *** ***    provided you with these symbols if you need this command to    *** ***    work.                                                          *** ***                                                                   *** ***    Type referenced: nt!_KPRCB                                     *** ***                                                                   *** ************************************************************************* ************************************************************************* ***                                                                   *** ***                                                                   *** ***    Your debugger is not using the correct symbols                 *** ***                                                                   *** ***    In order for this command to work properly, your symbol path   *** ***    must point to .pdb files that have full type information.      *** ***                                                                   *** ***    Certain .pdb files (such as the public OS symbols) do not      *** ***    contain the required information.  Contact the group that      *** ***    provided you with these symbols if you need this command to    *** ***    work.                                                          *** ***                                                                   *** ***    Type referenced: nt!KPRCB                                      *** ***                                                                   *** ************************************************************************* ************************************************************************* ***                                                                   *** ***                                                                   *** ***    Your debugger is not using the correct symbols                 *** ***                                                                   *** ***    In order for this command to work properly, your symbol path   *** ***    must point to .pdb files that have full type information.      *** ***                                                                   *** ***    Certain .pdb files (such as the public OS symbols) do not      *** ***    contain the required information.  Contact the group that      *** ***    provided you with these symbols if you need this command to    *** ***    work.                                                          *** ***                                                                   *** ***    Type referenced: nt!_KPRCB                                     *** ***                                                                   *** ************************************************************************* ************************************************************************* ***                                                                   *** ***                                                                   *** ***    Your debugger is not using the correct symbols                 *** ***                                                                   *** ***    In order for this command to work properly, your symbol path   *** ***    must point to .pdb files that have full type information.      *** ***                                                                   *** ***    Certain .pdb files (such as the public OS symbols) do not      *** ***    contain the required information.  Contact the group that      *** ***    provided you with these symbols if you need this command to    *** ***    work.                                                          *** ***                                                                   *** ***    Type referenced: nt!KPRCB                                      *** ***                                                                   *** ************************************************************************* ************************************************************************* ***                                                                   *** ***                                                                   *** ***    Your debugger is not using the correct symbols                 *** ***                                                                   *** ***    In order for this command to work properly, your symbol path   *** ***    must point to .pdb files that have full type information.      *** ***                                                                   *** ***    Certain .pdb files (such as the public OS symbols) do not      *** ***    contain the required information.  Contact the group that      *** ***    provided you with these symbols if you need this command to    *** ***    work.                                                          *** ***                                                                   *** ***    Type referenced: nt!_KPRCB                                     *** ***                                                                   *** ************************************************************************* ************************************************************************* ***                                                                   *** ***                                                                   *** ***    Your debugger is not using the correct symbols                 *** ***                                                                   *** ***    In order for this command to work properly, your symbol path   *** ***    must point to .pdb files that have full type information.      *** ***                                                                   *** ***    Certain .pdb files (such as the public OS symbols) do not      *** ***    contain the required information.  Contact the group that      *** ***    provided you with these symbols if you need this command to    *** ***    work.                                                          *** ***                                                                   *** ***    Type referenced: nt!_KPRCB                                     *** ***                                                                   *** ************************************************************************* ************************************************************************* ***                                                                   *** ***                                                                   *** ***    Your debugger is not using the correct symbols                 *** ***                                                                   *** ***    In order for this command to work properly, your symbol path   *** ***    must point to .pdb files that have full type information.      *** ***                                                                   *** ***    Certain .pdb files (such as the public OS symbols) do not      *** ***    contain the required information.  Contact the group that      *** ***    provided you with these symbols if you need this command to    *** ***    work.                                                          *** ***                                                                   *** ***    Type referenced: nt!_KPRCB                                     *** ***                                                                   *** ************************************************************************* ************************************************************************* ***                                                                   *** ***                                                                   *** ***    Your debugger is not using the correct symbols                 *** ***                                                                   *** ***    In order for this command to work properly, your symbol path   *** ***    must point to .pdb files that have full type information.      *** ***                                                                   *** ***    Certain .pdb files (such as the public OS symbols) do not      *** ***    contain the required information.  Contact the group that      *** ***    provided you with these symbols if you need this command to    *** ***    work.                                                          *** ***                                                                   *** ***    Type referenced: nt!_KPRCB                                     *** ***                                                                   *** ************************************************************************* Probably caused by : csrss.exe Followup: MachineOwner ---------

[arvi16]

enne tuleb õiged sümbolid path'i sisse toksida, enne midagi ei näe

http://msdl.microsoft.com/download/symbols <= debuggerisse

[ufo56]

Uurin

[arvi16]

http://support.theplanet.com/kb/operatingsystems/microsoftwindows/how-can-i-read-memory-dump-files-windows-creates-debugging

[friik1]

No ma ei usu, et see cdrom üldse asjaga seotud on aga...
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\cdrom
Start = 4
See keelab draiveri laadimise.

[ufo56]

Nüüd näitab miskit sellist, alguses on vana jutt et pole sümboleid aga lõpus miskit uut

Spoiler

Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64 Copyright (c) Microsoft Corporation. All rights reserved. Loading Dump File [C:\Windows\Minidump\061410-11668-01.dmp] Mini Kernel Dump File: Only registers and stack trace are available Symbol search path is: *** Invalid *** **************************************************************************** * Symbol loading may be unreliable without a symbol search path.           * * Use .symfix to have the debugger choose a symbol path.                   * * After setting your symbol path, use .reload to refresh symbol locations. * **************************************************************************** Executable search path is: ********************************************************************* * Symbols can not be loaded because symbol path is not initialized. * *                                                                   * * The Symbol Path can be set by:                                    * *   using the _NT_SYMBOL_PATH environment variable.                 * *   using the -y <symbol_path> argument when starting the debugger. * *   using .sympath and .sympath+                                    * ********************************************************************* Unable to load image \SystemRoot\system32\ntoskrnl.exe, Win32 error 0n2 *** WARNING: Unable to verify timestamp for ntoskrnl.exe *** ERROR: Module load completed but symbols could not be loaded for ntoskrnl.exe Windows 7 Kernel Version 7600 MP (8 procs) Free x64 Product: Server, suite: TerminalServer SingleUserTS Built by: 7600.16539.amd64fre.win7_gdr.100226-1909 Machine Name: Kernel base = 0xfffff800`01665000 PsLoadedModuleList = 0xfffff800`018a2e50 Debug session time: Mon Jun 14 16:38:17.771 2010 (UTC + 3:00) System Uptime: 0 days 2:16:55.349 ********************************************************************* * Symbols can not be loaded because symbol path is not initialized. * *                                                                   * * The Symbol Path can be set by:                                    * *   using the _NT_SYMBOL_PATH environment variable.                 * *   using the -y <symbol_path> argument when starting the debugger. * *   using .sympath and .sympath+                                    * ********************************************************************* Unable to load image \SystemRoot\system32\ntoskrnl.exe, Win32 error 0n2 *** WARNING: Unable to verify timestamp for ntoskrnl.exe *** ERROR: Module load completed but symbols could not be loaded for ntoskrnl.exe Loading Kernel Symbols ............................................................... ................................................................ ... Loading User Symbols Loading unloaded module list ...... ******************************************************************************* *                                                                             * *                        Bugcheck Analysis                                    * *                                                                             * ******************************************************************************* Use !analyze -v to get detailed debugging information. BugCheck F4, {3, fffffa800d10cb30, fffffa800d10ce10, fffff800019e1540} ***** Kernel symbols are WRONG. Please fix symbols to do analysis. unable to get nt!KiCurrentEtwBufferOffset unable to get nt!KiCurrentEtwBufferBase ************************************************************************* ***                                                                   *** ***                                                                   *** ***    Your debugger is not using the correct symbols                 *** ***                                                                   *** ***    In order for this command to work properly, your symbol path   *** ***    must point to .pdb files that have full type information.      *** ***                                                                   *** ***    Certain .pdb files (such as the public OS symbols) do not      *** ***    contain the required information.  Contact the group that      *** ***    provided you with these symbols if you need this command to    *** ***    work.                                                          *** ***                                                                   *** ***    Type referenced: nt!_KPRCB                                     *** ***                                                                   *** ************************************************************************* ************************************************************************* ***                                                                   *** ***                                                                   *** ***    Your debugger is not using the correct symbols                 *** ***                                                                   *** ***    In order for this command to work properly, your symbol path   *** ***    must point to .pdb files that have full type information.      *** ***                                                                   *** ***    Certain .pdb files (such as the public OS symbols) do not      *** ***    contain the required information.  Contact the group that      *** ***    provided you with these symbols if you need this command to    *** ***    work.                                                          *** ***                                                                   *** ***    Type referenced: nt!KPRCB                                      *** ***                                                                   *** ************************************************************************* ************************************************************************* ***                                                                   *** ***                                                                   *** ***    Your debugger is not using the correct symbols                 *** ***                                                                   *** ***    In order for this command to work properly, your symbol path   *** ***    must point to .pdb files that have full type information.      *** ***                                                                   *** ***    Certain .pdb files (such as the public OS symbols) do not      *** ***    contain the required information.  Contact the group that      *** ***    provided you with these symbols if you need this command to    *** ***    work.                                                          *** ***                                                                   *** ***    Type referenced: nt!_KPRCB                                     *** ***                                                                   *** ************************************************************************* ************************************************************************* ***                                                                   *** ***                                                                   *** ***    Your debugger is not using the correct symbols                 *** ***                                                                   *** ***    In order for this command to work properly, your symbol path   *** ***    must point to .pdb files that have full type information.      *** ***                                                                   *** ***    Certain .pdb files (such as the public OS symbols) do not      *** ***    contain the required information.  Contact the group that      *** ***    provided you with these symbols if you need this command to    *** ***    work.                                                          *** ***                                                                   *** ***    Type referenced: nt!KPRCB                                      *** ***                                                                   *** ************************************************************************* ************************************************************************* ***                                                                   *** ***                                                                   *** ***    Your debugger is not using the correct symbols                 *** ***                                                                   *** ***    In order for this command to work properly, your symbol path   *** ***    must point to .pdb files that have full type information.      *** ***                                                                   *** ***    Certain .pdb files (such as the public OS symbols) do not      *** ***    contain the required information.  Contact the group that      *** ***    provided you with these symbols if you need this command to    *** ***    work.                                                          *** ***                                                                   *** ***    Type referenced: nt!_KPRCB                                     *** ***                                                                   *** ************************************************************************* ************************************************************************* ***                                                                   *** ***                                                                   *** ***    Your debugger is not using the correct symbols                 *** ***                                                                   *** ***    In order for this command to work properly, your symbol path   *** ***    must point to .pdb files that have full type information.      *** ***                                                                   *** ***    Certain .pdb files (such as the public OS symbols) do not      *** ***    contain the required information.  Contact the group that      *** ***    provided you with these symbols if you need this command to    *** ***    work.                                                          *** ***                                                                   *** ***    Type referenced: nt!_KPRCB                                     *** ***                                                                   *** ************************************************************************* ************************************************************************* ***                                                                   *** ***                                                                   *** ***    Your debugger is not using the correct symbols                 *** ***                                                                   *** ***    In order for this command to work properly, your symbol path   *** ***    must point to .pdb files that have full type information.      *** ***                                                                   *** ***    Certain .pdb files (such as the public OS symbols) do not      *** ***    contain the required information.  Contact the group that      *** ***    provided you with these symbols if you need this command to    *** ***    work.                                                          *** ***                                                                   *** ***    Type referenced: nt!_KPRCB                                     *** ***                                                                   *** ************************************************************************* ************************************************************************* ***                                                                   *** ***                                                                   *** ***    Your debugger is not using the correct symbols                 *** ***                                                                   *** ***    In order for this command to work properly, your symbol path   *** ***    must point to .pdb files that have full type information.      *** ***                                                                   *** ***    Certain .pdb files (such as the public OS symbols) do not      *** ***    contain the required information.  Contact the group that      *** ***    provided you with these symbols if you need this command to    *** ***    work.                                                          *** ***                                                                   *** ***    Type referenced: nt!_KPRCB                                     *** ***                                                                   *** ************************************************************************* Probably caused by : csrss.exe Followup: MachineOwner --------- 5: kd> .reload Loading Kernel Symbols ............................................................... ................................................................ ... Loading User Symbols Loading unloaded module list ...... 5: kd> .restart /f Loading Dump File [C:\Windows\Minidump\061410-11668-01.dmp] Mini Kernel Dump File: Only registers and stack trace are available Symbol search path is: SRV*DownstreamStore*http://msdl.microsoft.com/download/symbols Executable search path is: Windows 7 Kernel Version 7600 MP (8 procs) Free x64 Product: Server, suite: TerminalServer SingleUserTS Built by: 7600.16539.amd64fre.win7_gdr.100226-1909 Machine Name: Kernel base = 0xfffff800`01665000 PsLoadedModuleList = 0xfffff800`018a2e50 Debug session time: Mon Jun 14 16:38:17.771 2010 (UTC + 3:00) System Uptime: 0 days 2:16:55.349 Loading Kernel Symbols ............................................................... ................................................................ ... Loading User Symbols Loading unloaded module list ...... ******************************************************************************* *                                                                             * *                        Bugcheck Analysis                                    * *                                                                             * ******************************************************************************* Use !analyze -v to get detailed debugging information. BugCheck F4, {3, fffffa800d10cb30, fffffa800d10ce10, fffff800019e1540} Probably caused by : _ Followup: MachineOwner --------- 5: kd> !analyze -v ******************************************************************************* *                                                                             * *                        Bugcheck Analysis                                    * *                                                                             * ******************************************************************************* CRITICAL_OBJECT_TERMINATION (f4) A process or thread crucial to system operation has unexpectedly exited or been terminated. Several processes and threads are necessary for the operation of the system; when they are terminated (for any reason), the system can no longer function. Arguments: Arg1: 0000000000000003, Process Arg2: fffffa800d10cb30, Terminating object Arg3: fffffa800d10ce10, Process image file name Arg4: fffff800019e1540, Explanatory message (ascii) Debugging Details: ------------------ PROCESS_OBJECT: fffffa800d10cb30 IMAGE_NAME:  _ DEBUG_FLR_IMAGE_TIMESTAMP:  0 MODULE_NAME: _ FAULTING_MODULE: 0000000000000000 PROCESS_NAME:  TCAdminService BUGCHECK_STR:  0xF4_TCAdminService CUSTOMER_CRASH_COUNT:  1 DEFAULT_BUCKET_ID:  DRIVER_FAULT_SERVER_MINIDUMP CURRENT_IRQL:  0 LAST_CONTROL_TRANSFER:  from fffff80001a61c72 to fffff800016d5600 STACK_TEXT:  fffff880`066aeb08 fffff800`01a61c72 : 00000000`000000f4 00000000`00000003 fffffa80`0d10cb30 fffffa80`0d10ce10 : nt!KeBugCheckEx fffff880`066aeb10 fffff800`01a0f0a3 : ffffffff`ffffffff fffffa80`0d57eb60 fffffa80`0d10cb30 fffffa80`0dd86490 : nt!PspCatchCriticalBreak+0x92 fffff880`066aeb50 fffff800`0199369c : ffffffff`ffffffff 00000000`00000001 fffffa80`0d10cb30 00000000`00000008 : nt! ?? ::NNGAKEGL::`string'+0x17936 fffff880`066aeba0 fffff800`016d4853 : fffffa80`0d10cb30 00000000`ffffffff 00000000`7efa4001 fffffa80`0d57eb60 : nt!NtTerminateProcess+0x20c fffff880`066aec20 00000000`7784017a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13 00000000`0332e808 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x7784017a STACK_COMMAND:  kb FOLLOWUP_NAME:  MachineOwner FAILURE_BUCKET_ID:  X64_0xF4_TCAdminService_IMAGE__ BUCKET_ID:  X64_0xF4_TCAdminService_IMAGE__ Followup: MachineOwner --------- 5: kd> !analyze -v ******************************************************************************* *                                                                             * *                        Bugcheck Analysis                                    * *                                                                             * ******************************************************************************* CRITICAL_OBJECT_TERMINATION (f4) A process or thread crucial to system operation has unexpectedly exited or been terminated. Several processes and threads are necessary for the operation of the system; when they are terminated (for any reason), the system can no longer function. Arguments: Arg1: 0000000000000003, Process Arg2: fffffa800d10cb30, Terminating object Arg3: fffffa800d10ce10, Process image file name Arg4: fffff800019e1540, Explanatory message (ascii) Debugging Details: ------------------ PROCESS_OBJECT: fffffa800d10cb30 IMAGE_NAME:  _ DEBUG_FLR_IMAGE_TIMESTAMP:  0 MODULE_NAME: _ FAULTING_MODULE: 0000000000000000 PROCESS_NAME:  TCAdminService BUGCHECK_STR:  0xF4_TCAdminService CUSTOMER_CRASH_COUNT:  1 DEFAULT_BUCKET_ID:  DRIVER_FAULT_SERVER_MINIDUMP CURRENT_IRQL:  0 LAST_CONTROL_TRANSFER:  from fffff80001a61c72 to fffff800016d5600 STACK_TEXT:  fffff880`066aeb08 fffff800`01a61c72 : 00000000`000000f4 00000000`00000003 fffffa80`0d10cb30 fffffa80`0d10ce10 : nt!KeBugCheckEx fffff880`066aeb10 fffff800`01a0f0a3 : ffffffff`ffffffff fffffa80`0d57eb60 fffffa80`0d10cb30 fffffa80`0dd86490 : nt!PspCatchCriticalBreak+0x92 fffff880`066aeb50 fffff800`0199369c : ffffffff`ffffffff 00000000`00000001 fffffa80`0d10cb30 00000000`00000008 : nt! ?? ::NNGAKEGL::`string'+0x17936 fffff880`066aeba0 fffff800`016d4853 : fffffa80`0d10cb30 00000000`ffffffff 00000000`7efa4001 fffffa80`0d57eb60 : nt!NtTerminateProcess+0x20c fffff880`066aec20 00000000`7784017a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13 00000000`0332e808 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x7784017a STACK_COMMAND:  kb FOLLOWUP_NAME:  MachineOwner FAILURE_BUCKET_ID:  X64_0xF4_TCAdminService_IMAGE__ BUCKET_ID:  X64_0xF4_TCAdminService_IMAGE__ Followup: MachineOwner --------- 5: kd> !analyze -v ******************************************************************************* *                                                                             * *                        Bugcheck Analysis                                    * *                                                                             * ******************************************************************************* CRITICAL_OBJECT_TERMINATION (f4) A process or thread crucial to system operation has unexpectedly exited or been terminated. Several processes and threads are necessary for the operation of the system; when they are terminated (for any reason), the system can no longer function. Arguments: Arg1: 0000000000000003, Process Arg2: fffffa800d10cb30, Terminating object Arg3: fffffa800d10ce10, Process image file name Arg4: fffff800019e1540, Explanatory message (ascii) Debugging Details: ------------------ PROCESS_OBJECT: fffffa800d10cb30 IMAGE_NAME:  _ DEBUG_FLR_IMAGE_TIMESTAMP:  0 MODULE_NAME: _ FAULTING_MODULE: 0000000000000000 PROCESS_NAME:  TCAdminService BUGCHECK_STR:  0xF4_TCAdminService CUSTOMER_CRASH_COUNT:  1 DEFAULT_BUCKET_ID:  DRIVER_FAULT_SERVER_MINIDUMP CURRENT_IRQL:  0 LAST_CONTROL_TRANSFER:  from fffff80001a61c72 to fffff800016d5600 STACK_TEXT:  fffff880`066aeb08 fffff800`01a61c72 : 00000000`000000f4 00000000`00000003 fffffa80`0d10cb30 fffffa80`0d10ce10 : nt!KeBugCheckEx fffff880`066aeb10 fffff800`01a0f0a3 : ffffffff`ffffffff fffffa80`0d57eb60 fffffa80`0d10cb30 fffffa80`0dd86490 : nt!PspCatchCriticalBreak+0x92 fffff880`066aeb50 fffff800`0199369c : ffffffff`ffffffff 00000000`00000001 fffffa80`0d10cb30 00000000`00000008 : nt! ?? ::NNGAKEGL::`string'+0x17936 fffff880`066aeba0 fffff800`016d4853 : fffffa80`0d10cb30 00000000`ffffffff 00000000`7efa4001 fffffa80`0d57eb60 : nt!NtTerminateProcess+0x20c fffff880`066aec20 00000000`7784017a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13 00000000`0332e808 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x7784017a STACK_COMMAND:  kb FOLLOWUP_NAME:  MachineOwner FAILURE_BUCKET_ID:  X64_0xF4_TCAdminService_IMAGE__ BUCKET_ID:  X64_0xF4_TCAdminService_IMAGE__ Followup: MachineOwner --------- 5: kd> !analyze -v ******************************************************************************* *                                                                             * *                        Bugcheck Analysis                                    * *                                                                             * ******************************************************************************* CRITICAL_OBJECT_TERMINATION (f4) A process or thread crucial to system operation has unexpectedly exited or been terminated. Several processes and threads are necessary for the operation of the system; when they are terminated (for any reason), the system can no longer function. Arguments: Arg1: 0000000000000003, Process Arg2: fffffa800d10cb30, Terminating object Arg3: fffffa800d10ce10, Process image file name Arg4: fffff800019e1540, Explanatory message (ascii) Debugging Details: ------------------ PROCESS_OBJECT: fffffa800d10cb30 IMAGE_NAME:  _ DEBUG_FLR_IMAGE_TIMESTAMP:  0 MODULE_NAME: _ FAULTING_MODULE: 0000000000000000 PROCESS_NAME:  TCAdminService BUGCHECK_STR:  0xF4_TCAdminService CUSTOMER_CRASH_COUNT:  1 DEFAULT_BUCKET_ID:  DRIVER_FAULT_SERVER_MINIDUMP CURRENT_IRQL:  0 LAST_CONTROL_TRANSFER:  from fffff80001a61c72 to fffff800016d5600 STACK_TEXT:  fffff880`066aeb08 fffff800`01a61c72 : 00000000`000000f4 00000000`00000003 fffffa80`0d10cb30 fffffa80`0d10ce10 : nt!KeBugCheckEx fffff880`066aeb10 fffff800`01a0f0a3 : ffffffff`ffffffff fffffa80`0d57eb60 fffffa80`0d10cb30 fffffa80`0dd86490 : nt!PspCatchCriticalBreak+0x92 fffff880`066aeb50 fffff800`0199369c : ffffffff`ffffffff 00000000`00000001 fffffa80`0d10cb30 00000000`00000008 : nt! ?? ::NNGAKEGL::`string'+0x17936 fffff880`066aeba0 fffff800`016d4853 : fffffa80`0d10cb30 00000000`ffffffff 00000000`7efa4001 fffffa80`0d57eb60 : nt!NtTerminateProcess+0x20c fffff880`066aec20 00000000`7784017a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13 00000000`0332e808 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x7784017a STACK_COMMAND:  kb FOLLOWUP_NAME:  MachineOwner FAILURE_BUCKET_ID:  X64_0xF4_TCAdminService_IMAGE__ BUCKET_ID:  X64_0xF4_TCAdminService_IMAGE__ Followup: MachineOwner --------- 5: kd> !analyze -v ******************************************************************************* *                                                                             * *                        Bugcheck Analysis                                    * *                                                                             * ******************************************************************************* CRITICAL_OBJECT_TERMINATION (f4) A process or thread crucial to system operation has unexpectedly exited or been terminated. Several processes and threads are necessary for the operation of the system; when they are terminated (for any reason), the system can no longer function. Arguments: Arg1: 0000000000000003, Process Arg2: fffffa800d10cb30, Terminating object Arg3: fffffa800d10ce10, Process image file name Arg4: fffff800019e1540, Explanatory message (ascii) Debugging Details: ------------------ PROCESS_OBJECT: fffffa800d10cb30 IMAGE_NAME:  _ DEBUG_FLR_IMAGE_TIMESTAMP:  0 MODULE_NAME: _ FAULTING_MODULE: 0000000000000000 PROCESS_NAME:  TCAdminService BUGCHECK_STR:  0xF4_TCAdminService CUSTOMER_CRASH_COUNT:  1 DEFAULT_BUCKET_ID:  DRIVER_FAULT_SERVER_MINIDUMP CURRENT_IRQL:  0 LAST_CONTROL_TRANSFER:  from fffff80001a61c72 to fffff800016d5600 STACK_TEXT:  fffff880`066aeb08 fffff800`01a61c72 : 00000000`000000f4 00000000`00000003 fffffa80`0d10cb30 fffffa80`0d10ce10 : nt!KeBugCheckEx fffff880`066aeb10 fffff800`01a0f0a3 : ffffffff`ffffffff fffffa80`0d57eb60 fffffa80`0d10cb30 fffffa80`0dd86490 : nt!PspCatchCriticalBreak+0x92 fffff880`066aeb50 fffff800`0199369c : ffffffff`ffffffff 00000000`00000001 fffffa80`0d10cb30 00000000`00000008 : nt! ?? ::NNGAKEGL::`string'+0x17936 fffff880`066aeba0 fffff800`016d4853 : fffffa80`0d10cb30 00000000`ffffffff 00000000`7efa4001 fffffa80`0d57eb60 : nt!NtTerminateProcess+0x20c fffff880`066aec20 00000000`7784017a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13 00000000`0332e808 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x7784017a STACK_COMMAND:  kb FOLLOWUP_NAME:  MachineOwner FAILURE_BUCKET_ID:  X64_0xF4_TCAdminService_IMAGE__ BUCKET_ID:  X64_0xF4_TCAdminService_IMAGE__ Followup: MachineOwner --------- 5: kd> !analyze -v ******************************************************************************* *                                                                             * *                        Bugcheck Analysis                                    * *                                                                             * ******************************************************************************* CRITICAL_OBJECT_TERMINATION (f4) A process or thread crucial to system operation has unexpectedly exited or been terminated. Several processes and threads are necessary for the operation of the system; when they are terminated (for any reason), the system can no longer function. Arguments: Arg1: 0000000000000003, Process Arg2: fffffa800d10cb30, Terminating object Arg3: fffffa800d10ce10, Process image file name Arg4: fffff800019e1540, Explanatory message (ascii) Debugging Details: ------------------ PROCESS_OBJECT: fffffa800d10cb30 IMAGE_NAME:  _ DEBUG_FLR_IMAGE_TIMESTAMP:  0 MODULE_NAME: _ FAULTING_MODULE: 0000000000000000 PROCESS_NAME:  TCAdminService BUGCHECK_STR:  0xF4_TCAdminService CUSTOMER_CRASH_COUNT:  1 DEFAULT_BUCKET_ID:  DRIVER_FAULT_SERVER_MINIDUMP CURRENT_IRQL:  0 LAST_CONTROL_TRANSFER:  from fffff80001a61c72 to fffff800016d5600 STACK_TEXT:  fffff880`066aeb08 fffff800`01a61c72 : 00000000`000000f4 00000000`00000003 fffffa80`0d10cb30 fffffa80`0d10ce10 : nt!KeBugCheckEx fffff880`066aeb10 fffff800`01a0f0a3 : ffffffff`ffffffff fffffa80`0d57eb60 fffffa80`0d10cb30 fffffa80`0dd86490 : nt!PspCatchCriticalBreak+0x92 fffff880`066aeb50 fffff800`0199369c : ffffffff`ffffffff 00000000`00000001 fffffa80`0d10cb30 00000000`00000008 : nt! ?? ::NNGAKEGL::`string'+0x17936 fffff880`066aeba0 fffff800`016d4853 : fffffa80`0d10cb30 00000000`ffffffff 00000000`7efa4001 fffffa80`0d57eb60 : nt!NtTerminateProcess+0x20c fffff880`066aec20 00000000`7784017a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13 00000000`0332e808 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x7784017a STACK_COMMAND:  kb FOLLOWUP_NAME:  MachineOwner FAILURE_BUCKET_ID:  X64_0xF4_TCAdminService_IMAGE__ BUCKET_ID:  X64_0xF4_TCAdminService_IMAGE__ Followup: MachineOwner --------- 5: kd> !analyze -v ******************************************************************************* *                                                                             * *                        Bugcheck Analysis                                    * *                                                                             * ******************************************************************************* CRITICAL_OBJECT_TERMINATION (f4) A process or thread crucial to system operation has unexpectedly exited or been terminated. Several processes and threads are necessary for the operation of the system; when they are terminated (for any reason), the system can no longer function. Arguments: Arg1: 0000000000000003, Process Arg2: fffffa800d10cb30, Terminating object Arg3: fffffa800d10ce10, Process image file name Arg4: fffff800019e1540, Explanatory message (ascii) Debugging Details: ------------------ PROCESS_OBJECT: fffffa800d10cb30 IMAGE_NAME:  _ DEBUG_FLR_IMAGE_TIMESTAMP:  0 MODULE_NAME: _ FAULTING_MODULE: 0000000000000000 PROCESS_NAME:  TCAdminService BUGCHECK_STR:  0xF4_TCAdminService CUSTOMER_CRASH_COUNT:  1 DEFAULT_BUCKET_ID:  DRIVER_FAULT_SERVER_MINIDUMP CURRENT_IRQL:  0 LAST_CONTROL_TRANSFER:  from fffff80001a61c72 to fffff800016d5600 STACK_TEXT:  fffff880`066aeb08 fffff800`01a61c72 : 00000000`000000f4 00000000`00000003 fffffa80`0d10cb30 fffffa80`0d10ce10 : nt!KeBugCheckEx fffff880`066aeb10 fffff800`01a0f0a3 : ffffffff`ffffffff fffffa80`0d57eb60 fffffa80`0d10cb30 fffffa80`0dd86490 : nt!PspCatchCriticalBreak+0x92 fffff880`066aeb50 fffff800`0199369c : ffffffff`ffffffff 00000000`00000001 fffffa80`0d10cb30 00000000`00000008 : nt! ?? ::NNGAKEGL::`string'+0x17936 fffff880`066aeba0 fffff800`016d4853 : fffffa80`0d10cb30 00000000`ffffffff 00000000`7efa4001 fffffa80`0d57eb60 : nt!NtTerminateProcess+0x20c fffff880`066aec20 00000000`7784017a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13 00000000`0332e808 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x7784017a STACK_COMMAND:  kb FOLLOWUP_NAME:  MachineOwner FAILURE_BUCKET_ID:  X64_0xF4_TCAdminService_IMAGE__ BUCKET_ID:  X64_0xF4_TCAdminService_IMAGE__ Followup: MachineOwner ---------

[friik1]

Tee näiteks c: juurikasse kaust symbols ja pane sümbolite path'iks "SRV*c:\symbols*http://msdl.microsoft.com/download/symbols"
Praegune tee on vale, nagu Debugger väidab.

A process or thread crucial to system operation has unexpectedly exited or been terminated. <--- miski tappis või crashis csrss.
Uuri näiteks, kas masinas pole mõnda viirust, mis seda tapaks (või rootkit, mis corruptiks stacki) või tee üks ring memtesti (kui csrss suri mingi mäluvea tõttu).

[ufo56]

[friik1]

Seadista süsteem tegema täis memory dumpi, teoreetiliselt peaks siis olema lihtsam uurida.

Õige peaks sulle olema: Windows 7 RTM x64 retail symbols, all languages (File size: 286 MB) - http://www.microsoft.com/whdc/devtools/debugging/symbolpkg.mspx#f
No määradki siis pathiks lihtsalt "c:\win\symbols"

[ufo56]

Okei eks ma vaatan, panin full memodry dumpi peale , eks näha kui bsodi viskab