Sygnatura błędu - pomóżcie

[boa-666]

coś mi się złego dzieje w XP, restartuje sam po parę razy,
a potem pisze, że odzyskał sprawność po poważnym błędzie i to:

C:\WINDOWS\Minidump\Mini070405-02.dmp
C:\DOCUME~1\bees\USTAWI~1\Temp\WER1.tmp.dir00\sysdata.xml

Mam rezydentnego avasta więc czy to moze być wirus?
Z góry dzięki.

[Gość: Kolobos]

Co masz w logach systemowych? (panel sterowania->narzedzia administracyjne)

Skoro masz juz minidump to zrob z nim to co jest napisane tutaj:
forum.tweak.pl/index.php?showtopic=104416
Wynik wklej tutaj na forum to zobaczymy czy cos sie wyjasni.

[boa-666]

O Dżizes! To mam teraz ściągnąć te 13 MB debbuga przez modem?
To potrwa pare godzin i dopiero pod wieczór dam Ci odpowiedź.
W każdym razie dzięki serdeczne za pomoc!

[Gość: Kolobos]

Moze sciagnij u kogos kto ma stale lacze o ile masz mozliwosc.

[boa-666]

Ufff! jeżeli to co poniżej jest tym o co Ci chodziło,
to mogę się uznać z geniusza.
Wklejam i proszę o interpretację. Z góry baaaaaaaaaardzo dziękuję!


Microsoft (R) Windows Debugger Version 6.5.0003.7
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\WINDOWS\Minidump\Mini070705-02.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: *** Invalid ***
****************************************************************************
* Symbol loading may be unreliable without a symbol search path. *
* Use .symfix to have the debugger choose a symbol path. *
* After setting your symbol path, use .reload to refresh symbol locations. *
****************************************************************************
Executable search path is:
*********************************************************************
* Symbols can not be loaded because symbol path is not initialized. *
* *
* The Symbol Path can be set by: *
* using the _NT_SYMBOL_PATH environment variable. *
* using the -y <symbol_path> argument when starting the debugger. *
* using .sympath and .sympath+ *
*********************************************************************
Unable to load image ntoskrnl.exe, Win32 error 2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
*** ERROR: Module load completed but symbols could not be loaded for
ntoskrnl.exe
Windows XP Kernel Version 2600 UP Free x86 compatible
Product: WinNt
Kernel base = 0x804d0000 PsLoadedModuleList = 0x80545b28
Debug session time: Thu Jul 7 09:39:24.847 2005 (GMT+2)
System Uptime: 0 days 0:02:03.467
*********************************************************************
* Symbols can not be loaded because symbol path is not initialized. *
* *
* The Symbol Path can be set by: *
* using the _NT_SYMBOL_PATH environment variable. *
* using the -y <symbol_path> argument when starting the debugger. *
* using .sympath and .sympath+ *
*********************************************************************
Unable to load image ntoskrnl.exe, Win32 error 2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
*** ERROR: Module load completed but symbols could not be loaded for
ntoskrnl.exe
Loading Kernel Symbols
................................................................................
..................
Loading unloaded module list
..
Loading User Symbols
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 50, {f05c371c, 0, 804edb3d, 0}

***** Kernel symbols are WRONG. Please fix symbols to do analysis.


Followup: MachineOwner
---------

kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced. This cannot be protected by try-except,
it must be protected by a Probe. Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: f05c371c, memory referenced.
Arg2: 00000000, value 0 = read operation, 1 = write operation.
Arg3: 804edb3d, If non-zero, the instruction address which referenced the bad
memory
address.
Arg4: 00000000, (reserved)

Debugging Details:
------------------

***** Kernel symbols are WRONG. Please fix symbols to do analysis.


MODULE_NAME: nt

FAULTING_MODULE: 804d0000 nt

DEBUG_FLR_IMAGE_TIMESTAMP: 3b7de38f

READ_ADDRESS: unable to get nt!MmSpecialPoolStart
unable to get nt!MmSpecialPoolEnd
unable to get nt!MmPoolCodeStart
unable to get nt!MmPoolCodeEnd
f05c371c

FAULTING_IP:
nt+1db3d
804edb3d ?? ???

MM_INTERNAL_CODE: 0

CUSTOMER_CRASH_COUNT: 2

DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: 0x50

LAST_CONTROL_TRANSFER: from 00000000 to 804fc1bb

STACK_TEXT:
f55c8b1c 00000000 f05c371c 00000000 804edb3d nt+0x2c1bb


STACK_COMMAND: .bugcheck ; kb

FOLLOWUP_NAME: MachineOwner

BUCKET_ID: WRONG_SYMBOLS

Followup: MachineOwner
---------

[Gość: Kolobos]

Poczytaj tutaj:
www.microsoft.com/resources/documentation/Windows/XP/all/reskit/en-us/Default.asp?url=/resources/documentation/Windows/XP/all/reskit/en-
us/prmd_stp_ccgm.asp
kadaitcha.cx/0x50_error.html
www.osronline.com/article.cfm?id=335
I zrob to co jest napisane na tych stronach.

Przetestuj tez ram:
www.memtest.org sciagnij obraz dyskietki i testuj z 2-3 godziny jak nie
znajdzie bledow to ram jest ok.

[boa-666]

Dzięki za poświęcony mi czas, ale niestety,
to co napisałeś, to dla mnie więcej niż czarna magia.
Zwłaszcza, że nie posiadam angielskiego :(
Jeszcze raz dzięki.