Too often when I use programs like cooledit pro, winamp windows crashes and says like this Now the windebugger (windbg) says this:
Microsoft (R) Windows Debugger Version 6.1.0017.1
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [C:\memory.dmp]
Kernel Summary Dump File: Only kernel address space is available
Symbol search path is: *** Invalid *** : Verify _NT_SYMBOL_PATH setting
Executable search path is:
*********************************************************************
* Symbols can not be loaded because symbol path is not initialized. *
* *
* The Symbol Path can be set by: *
* using the _NT_SYMBOL_PATH environment variable. *
* using the -y <symbol_path> argument when starting the debugger. *
* using .sympath and .sympath+ *
*********************************************************************
*** ERROR: Symbol file could not be found. Defaulted to export symbols for ntoskrnl.exe -
Windows XP Kernel Version 2600 UP Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 2600.xpclient.010817-1148
Kernel base = 0x804d0000 PsLoadedModuleList = 0x80545b28
Debug session time: Sun Jan 26 17:47:07 2003
System Uptime: 0 days 0:15:09.788
*********************************************************************
* Symbols can not be loaded because symbol path is not initialized. *
* *
* The Symbol Path can be set by: *
* using the _NT_SYMBOL_PATH environment variable. *
* using the -y <symbol_path> argument when starting the debugger. *
* using .sympath and .sympath+ *
*********************************************************************
*** ERROR: Symbol file could not be found. Defaulted to export symbols for ntoskrnl.exe -
Loading Kernel Symbols
......................................................................................................................
Loading unloaded module list
.........
Loading User Symbols
PEB is paged out (Peb = 7ffdf00c). Type ".hh dbgerr001" for details
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck D1, {f82847f4, 2, 0, f82847f4}
***** Kernel symbols are WRONG. Please fix symbols to do analysis.
*** ERROR: Module load completed but symbols could not be loaded for ews88wdm.sys
*** ERROR: Symbol file could not be found. Defaulted to export symbols for tcpip.sys -
Probably caused by : ews88wdm.sys ( ews88wdm+127f4 )
Followup: MachineOwner
AND AFTER COMMAND:!analyze -v IT SAYS LIKE THIS:
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
An attempt was made to access a pagable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: f82847f4, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000000, value 0 = read operation, 1 = write operation
Arg4: f82847f4, address which referenced memory
Debugging Details:
------------------
***** Kernel symbols are WRONG. Please fix symbols to do analysis.
READ_ADDRESS: unable to get nt!MmPoolCodeEnd
unable to get nt!MmSpecialPoolEnd
unable to get nt!MmPagedPoolEnd
unable to get nt!MmNonPagedPoolEnd
unable to get nt!MmNonPagedPoolStart
unable to get nt!MmSpecialPoolStart
unable to get nt!MmPagedPoolStart
unable to get nt!MiSessionPoolStart
unable to get nt!MiSessionPoolEnd
unable to get nt!MmNonPagedPoolExpansionStart
unable to get nt!MmPoolCodeStart
f82847f4
CURRENT_IRQL: 2
FAULTING_IP:
ews88wdm+127f4
f82847f4 56 push esi
DEFAULT_BUCKET_ID: DRIVER_FAULT
BUGCHECK_STR: 0xD1
LAST_CONTROL_TRANSFER: from 804d7c50 to 804fc1bb
STACK_TEXT:
WARNING: Stack unwind information not available. Following frames may be wrong.
f8950ef4 804d7c50 0000000a f82847f4 00000002 nt!KeBugCheckEx+0x19
f8950f10 82037de0 00000000 0000002e 82026c14 nt!Kei386EoiHelper+0x2596
8213aa10 f25f2318 8213ff40 820e78e8 82173810 0x82037de0
f25f2318 8213aa10 00000001 00000000 82173450 tcpip!IPRegisterARP+0x13b20
8213aa10 f25f2318 8213ff40 820e78e8 82173810 0x8213aa10
f25f2318 8213aa10 00000001 00000000 82173450 tcpip!IPRegisterARP+0x13b20
8213aa10 f25f2318 8213ff40 820e78e8 82173810 0x8213aa10
f25f2318 8213aa10 00000001 00000000 82173450 tcpip!IPRegisterARP+0x13b20
8213aa10 f25f2318 8213ff40 820e78e8 82173810 0x8213aa10
f25f2318 8213aa10 00000001 00000000 82173450 tcpip!IPRegisterARP+0x13b20
8213aa10 f25f2318 8213ff40 820e78e8 82173810 0x8213aa10
f25f2318 8213aa10 00000001 00000000 82173450 tcpip!IPRegisterARP+0x13b20
8213aa10 f25f2318 8213ff40 820e78e8 82173810 0x8213aa10
f25f2318 8213aa10 00000001 00000000 82173450 tcpip!IPRegisterARP+0x13b20
8213aa10 f25f2318 8213ff40 820e78e8 82173810 0x8213aa10
f25f2318 8213aa10 00000001 00000000 82173450 tcpip!IPRegisterARP+0x13b20
8213aa10 f25f2318 8213ff40 820e78e8 82173810 0x8213aa10
f25f2318 8213aa10 00000001 00000000 82173450 tcpip!IPRegisterARP+0x13b20
8213aa10 f25f2318 8213ff40 820e78e8 82173810 0x8213aa10
f25f2318 8213aa10 00000001 00000000 82173450 tcpip!IPRegisterARP+0x13b20
8213aa10 f25f2318 8213ff40 820e78e8 82173810 0x8213aa10
f25f2318 8213aa10 00000001 00000000 82173450 tcpip!IPRegisterARP+0x13b20
8213aa10 f25f2318 8213ff40 820e78e8 82173810 0x8213aa10
f25f2318 8213aa10 00000001 00000000 82173450 tcpip!IPRegisterARP+0x13b20
8213aa10 f25f2318 8213ff40 820e78e8 82173810 0x8213aa10
f25f2318 8213aa10 00000001 00000000 82173450 tcpip!IPRegisterARP+0x13b20
8213aa10 f25f2318 8213ff40 820e78e8 82173810 0x8213aa10
f25f2318 8213aa10 00000001 00000000 82173450 tcpip!IPRegisterARP+0x13b20
8213aa10 f25f2318 8213ff40 820e78e8 82173810 0x8213aa10
f25f2318 8213aa10 00000001 00000000 82173450 tcpip!IPRegisterARP+0x13b20
8213aa10 f25f2318 8213ff40 820e78e8 82173810 0x8213aa10
f25f2318 8213aa10 00000001 00000000 82173450 tcpip!IPRegisterARP+0x13b20
8213aa10 f25f2318 8213ff40 820e78e8 82173810 0x8213aa10
f25f2318 8213aa10 00000001 00000000 82173450 tcpip!IPRegisterARP+0x13b20
8213aa10 f25f2318 8213ff40 820e78e8 82173810 0x8213aa10
f25f2318 8213aa10 00000001 00000000 82173450 tcpip!IPRegisterARP+0x13b20
8213aa10 f25f2318 8213ff40 820e78e8 82173810 0x8213aa10
f25f2318 8213aa10 00000001 00000000 82173450 tcpip!IPRegisterARP+0x13b20
8213aa10 f25f2318 8213ff40 820e78e8 82173810 0x8213aa10
f25f2318 8213aa10 00000001 00000000 82173450 tcpip!IPRegisterARP+0x13b20
8213aa10 f25f2318 8213ff40 820e78e8 82173810 0x8213aa10
f25f2318 8213aa10 00000001 00000000 82173450 tcpip!IPRegisterARP+0x13b20
8213aa10 f25f2318 8213ff40 820e78e8 82173810 0x8213aa10
f25f2318 8213aa10 00000001 00000000 82173450 tcpip!IPRegisterARP+0x13b20
8213aa10 f25f2318 8213ff40 820e78e8 82173810 0x8213aa10
f25f2318 8213aa10 00000001 00000000 82173450 tcpip!IPRegisterARP+0x13b20
8213aa10 f25f2318 8213ff40 820e78e8 82173810 0x8213aa10
f25f2318 8213aa10 00000001 00000000 82173450 tcpip!IPRegisterARP+0x13b20
8213aa10 f25f2318 8213ff40 820e78e8 82173810 0x8213aa10
f25f2318 8213aa10 00000001 00000000 82173450 tcpip!IPRegisterARP+0x13b20
FAILED_INSTRUCTION_ADDRESS:
ews88wdm+127f4
f82847f4 56 push esi
FOLLOWUP_IP:
ews88wdm+127f4
f82847f4 56 push esi
FOLLOWUP_NAME: MachineOwner
SYMBOL_NAME: ews88wdm+127f4
MODULE_NAME: ews88wdm
IMAGE_NAME: ews88wdm.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 3da2fd69
STACK_COMMAND: kb
BUCKET_ID: WRONG_SYMBOLS
Followup: MachineOwner
---------
What's wrong?!?
Microsoft (R) Windows Debugger Version 6.1.0017.1
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [C:\memory.dmp]
Kernel Summary Dump File: Only kernel address space is available
Symbol search path is: *** Invalid *** : Verify _NT_SYMBOL_PATH setting
Executable search path is:
*********************************************************************
* Symbols can not be loaded because symbol path is not initialized. *
* *
* The Symbol Path can be set by: *
* using the _NT_SYMBOL_PATH environment variable. *
* using the -y <symbol_path> argument when starting the debugger. *
* using .sympath and .sympath+ *
*********************************************************************
*** ERROR: Symbol file could not be found. Defaulted to export symbols for ntoskrnl.exe -
Windows XP Kernel Version 2600 UP Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 2600.xpclient.010817-1148
Kernel base = 0x804d0000 PsLoadedModuleList = 0x80545b28
Debug session time: Sun Jan 26 17:47:07 2003
System Uptime: 0 days 0:15:09.788
*********************************************************************
* Symbols can not be loaded because symbol path is not initialized. *
* *
* The Symbol Path can be set by: *
* using the _NT_SYMBOL_PATH environment variable. *
* using the -y <symbol_path> argument when starting the debugger. *
* using .sympath and .sympath+ *
*********************************************************************
*** ERROR: Symbol file could not be found. Defaulted to export symbols for ntoskrnl.exe -
Loading Kernel Symbols
......................................................................................................................
Loading unloaded module list
.........
Loading User Symbols
PEB is paged out (Peb = 7ffdf00c). Type ".hh dbgerr001" for details
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck D1, {f82847f4, 2, 0, f82847f4}
***** Kernel symbols are WRONG. Please fix symbols to do analysis.
*** ERROR: Module load completed but symbols could not be loaded for ews88wdm.sys
*** ERROR: Symbol file could not be found. Defaulted to export symbols for tcpip.sys -
Probably caused by : ews88wdm.sys ( ews88wdm+127f4 )
Followup: MachineOwner
AND AFTER COMMAND:!analyze -v IT SAYS LIKE THIS:
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
An attempt was made to access a pagable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: f82847f4, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000000, value 0 = read operation, 1 = write operation
Arg4: f82847f4, address which referenced memory
Debugging Details:
------------------
***** Kernel symbols are WRONG. Please fix symbols to do analysis.
READ_ADDRESS: unable to get nt!MmPoolCodeEnd
unable to get nt!MmSpecialPoolEnd
unable to get nt!MmPagedPoolEnd
unable to get nt!MmNonPagedPoolEnd
unable to get nt!MmNonPagedPoolStart
unable to get nt!MmSpecialPoolStart
unable to get nt!MmPagedPoolStart
unable to get nt!MiSessionPoolStart
unable to get nt!MiSessionPoolEnd
unable to get nt!MmNonPagedPoolExpansionStart
unable to get nt!MmPoolCodeStart
f82847f4
CURRENT_IRQL: 2
FAULTING_IP:
ews88wdm+127f4
f82847f4 56 push esi
DEFAULT_BUCKET_ID: DRIVER_FAULT
BUGCHECK_STR: 0xD1
LAST_CONTROL_TRANSFER: from 804d7c50 to 804fc1bb
STACK_TEXT:
WARNING: Stack unwind information not available. Following frames may be wrong.
f8950ef4 804d7c50 0000000a f82847f4 00000002 nt!KeBugCheckEx+0x19
f8950f10 82037de0 00000000 0000002e 82026c14 nt!Kei386EoiHelper+0x2596
8213aa10 f25f2318 8213ff40 820e78e8 82173810 0x82037de0
f25f2318 8213aa10 00000001 00000000 82173450 tcpip!IPRegisterARP+0x13b20
8213aa10 f25f2318 8213ff40 820e78e8 82173810 0x8213aa10
f25f2318 8213aa10 00000001 00000000 82173450 tcpip!IPRegisterARP+0x13b20
8213aa10 f25f2318 8213ff40 820e78e8 82173810 0x8213aa10
f25f2318 8213aa10 00000001 00000000 82173450 tcpip!IPRegisterARP+0x13b20
8213aa10 f25f2318 8213ff40 820e78e8 82173810 0x8213aa10
f25f2318 8213aa10 00000001 00000000 82173450 tcpip!IPRegisterARP+0x13b20
8213aa10 f25f2318 8213ff40 820e78e8 82173810 0x8213aa10
f25f2318 8213aa10 00000001 00000000 82173450 tcpip!IPRegisterARP+0x13b20
8213aa10 f25f2318 8213ff40 820e78e8 82173810 0x8213aa10
f25f2318 8213aa10 00000001 00000000 82173450 tcpip!IPRegisterARP+0x13b20
8213aa10 f25f2318 8213ff40 820e78e8 82173810 0x8213aa10
f25f2318 8213aa10 00000001 00000000 82173450 tcpip!IPRegisterARP+0x13b20
8213aa10 f25f2318 8213ff40 820e78e8 82173810 0x8213aa10
f25f2318 8213aa10 00000001 00000000 82173450 tcpip!IPRegisterARP+0x13b20
8213aa10 f25f2318 8213ff40 820e78e8 82173810 0x8213aa10
f25f2318 8213aa10 00000001 00000000 82173450 tcpip!IPRegisterARP+0x13b20
8213aa10 f25f2318 8213ff40 820e78e8 82173810 0x8213aa10
f25f2318 8213aa10 00000001 00000000 82173450 tcpip!IPRegisterARP+0x13b20
8213aa10 f25f2318 8213ff40 820e78e8 82173810 0x8213aa10
f25f2318 8213aa10 00000001 00000000 82173450 tcpip!IPRegisterARP+0x13b20
8213aa10 f25f2318 8213ff40 820e78e8 82173810 0x8213aa10
f25f2318 8213aa10 00000001 00000000 82173450 tcpip!IPRegisterARP+0x13b20
8213aa10 f25f2318 8213ff40 820e78e8 82173810 0x8213aa10
f25f2318 8213aa10 00000001 00000000 82173450 tcpip!IPRegisterARP+0x13b20
8213aa10 f25f2318 8213ff40 820e78e8 82173810 0x8213aa10
f25f2318 8213aa10 00000001 00000000 82173450 tcpip!IPRegisterARP+0x13b20
8213aa10 f25f2318 8213ff40 820e78e8 82173810 0x8213aa10
f25f2318 8213aa10 00000001 00000000 82173450 tcpip!IPRegisterARP+0x13b20
8213aa10 f25f2318 8213ff40 820e78e8 82173810 0x8213aa10
f25f2318 8213aa10 00000001 00000000 82173450 tcpip!IPRegisterARP+0x13b20
8213aa10 f25f2318 8213ff40 820e78e8 82173810 0x8213aa10
f25f2318 8213aa10 00000001 00000000 82173450 tcpip!IPRegisterARP+0x13b20
8213aa10 f25f2318 8213ff40 820e78e8 82173810 0x8213aa10
f25f2318 8213aa10 00000001 00000000 82173450 tcpip!IPRegisterARP+0x13b20
8213aa10 f25f2318 8213ff40 820e78e8 82173810 0x8213aa10
f25f2318 8213aa10 00000001 00000000 82173450 tcpip!IPRegisterARP+0x13b20
8213aa10 f25f2318 8213ff40 820e78e8 82173810 0x8213aa10
f25f2318 8213aa10 00000001 00000000 82173450 tcpip!IPRegisterARP+0x13b20
8213aa10 f25f2318 8213ff40 820e78e8 82173810 0x8213aa10
f25f2318 8213aa10 00000001 00000000 82173450 tcpip!IPRegisterARP+0x13b20
8213aa10 f25f2318 8213ff40 820e78e8 82173810 0x8213aa10
f25f2318 8213aa10 00000001 00000000 82173450 tcpip!IPRegisterARP+0x13b20
8213aa10 f25f2318 8213ff40 820e78e8 82173810 0x8213aa10
f25f2318 8213aa10 00000001 00000000 82173450 tcpip!IPRegisterARP+0x13b20
8213aa10 f25f2318 8213ff40 820e78e8 82173810 0x8213aa10
f25f2318 8213aa10 00000001 00000000 82173450 tcpip!IPRegisterARP+0x13b20
FAILED_INSTRUCTION_ADDRESS:
ews88wdm+127f4
f82847f4 56 push esi
FOLLOWUP_IP:
ews88wdm+127f4
f82847f4 56 push esi
FOLLOWUP_NAME: MachineOwner
SYMBOL_NAME: ews88wdm+127f4
MODULE_NAME: ews88wdm
IMAGE_NAME: ews88wdm.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 3da2fd69
STACK_COMMAND: kb
BUCKET_ID: WRONG_SYMBOLS
Followup: MachineOwner
---------
What's wrong?!?