Home / Software / Computer viruses and spyware / Got a minidump log file for someone to take a look at
0 Members and 1 Guest are viewing this topic. « previous next »
Pages: [1] - (Bottom) Print
Author Topic: Got a minidump log file for someone to take a look at  (Read 664 times)
Computer CPR
Topic Starter
Beginner



Thanked: 2
Posts: 56


Computer CPR
« on: November 30, 2007, 02:43:03 PM »

I'm getting a blue screen on boot.  It occurs about 5 seconds after I have actually clicked to log into someone's profile on the computer.  While I'm pretty sure this computer did have Rustock.B Rootkit there is no trace of it now, but I'm getting this BSOD and the following log file.  Any ideas what needs to be done?  I'd like to save the OS build and not have to start at ground zero.

Symbol search path is: *** Invalid ***
****************************************************************************
* Symbol loading may be unreliable without a symbol search path.           *
* Use .symfix to have the debugger choose a symbol path.                   *
* After setting your symbol path, use .reload to refresh symbol locations. *
****************************************************************************
Executable search path is:
*********************************************************************
* Symbols can not be loaded because symbol path is not initialized. *
*                                                                   *
* The Symbol Path can be set by:                                    *
*   using the _NT_SYMBOL_PATH environment variable.                 *
*   using the -y <symbol_path> argument when starting the debugger. *
*   using .sympath and .sympath+                                    *
*********************************************************************
Unable to load image ntoskrnl.exe, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
*** ERROR: Module load completed but symbols could not be loaded for ntoskrnl.exe
Windows XP Kernel Version 2600 (Service Pack 2) UP Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055a620
Debug session time: Fri Nov 30 14:41:22.296 2007 (GMT-6)
System Uptime: 0 days 0:01:28.859
*********************************************************************
* Symbols can not be loaded because symbol path is not initialized. *
*                                                                   *
* The Symbol Path can be set by:                                    *
*   using the _NT_SYMBOL_PATH environment variable.                 *
*   using the -y <symbol_path> argument when starting the debugger. *
*   using .sympath and .sympath+                                    *
*********************************************************************
Unable to load image ntoskrnl.exe, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
*** ERROR: Module load completed but symbols could not be loaded for ntoskrnl.exe
Loading Kernel Symbols
...
Loading User Symbols
Loading unloaded module list
.....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1000008E, {c0000005, 827ef1e5, eefa8254, 0}

***** Kernel symbols are WRONG. Please fix symbols to do analysis.

*** WARNING: Unable to verify timestamp for smwdm.sys
*** ERROR: Module load completed but symbols could not be loaded for smwdm.sys
*** WARNING: Unable to verify timestamp for portcls.sys
*** ERROR: Module load completed but symbols could not be loaded for portcls.sys
*** WARNING: Unable to verify timestamp for ks.sys
*** ERROR: Module load completed but symbols could not be loaded for ks.sys
*** WARNING: Unable to verify timestamp for senfilt.sys
*** ERROR: Module load completed but symbols could not be loaded for senfilt.sys
*************************************************************************
***                                                                   ***
***                                                                   ***
***    Your debugger is not using the correct symbols                 ***
***                                                                   ***
***    In order for this command to work properly, your symbol path   ***
***    must point to .pdb files that have full type information.      ***
***                                                                   ***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                          ***
***                                                                   ***
***    Type referenced: nt!_KPRCB                                     ***
***                                                                   ***
*************************************************************************
*********************************************************************
* Symbols can not be loaded because symbol path is not initialized. *
*                                                                   *
* The Symbol Path can be set by:                                    *
*   using the _NT_SYMBOL_PATH environment variable.                 *
*   using the -y <symbol_path> argument when starting the debugger. *
*   using .sympath and .sympath+                                    *
*********************************************************************
*********************************************************************
* Symbols can not be loaded because symbol path is not initialized. *
*                                                                   *
* The Symbol Path can be set by:                                    *
*   using the _NT_SYMBOL_PATH environment variable.                 *
*   using the -y <symbol_path> argument when starting the debugger. *
*   using .sympath and .sympath+                                    *
*********************************************************************
Probably caused by : smwdm.sys ( smwdm+8f88 )

Followup: MachineOwner
---------

IP logged

Broni
Mastermind


Thanked: 610
Posts: 28,751

Computer: Specs
Experience: Experienced
OS: Windows Vista


Kraków my love :)

Computer Help Forum
« Reply #1 on: November 30, 2007, 03:49:52 PM »

Did you try to run CHKDSK?
IP logged

Computer CPR
Topic Starter
Beginner



Thanked: 2
Posts: 56


Computer CPR
« Reply #2 on: November 30, 2007, 05:42:19 PM »

yes, multiple times.  That was my first thought, but to no avail.
IP logged

Broni
Mastermind


Thanked: 610
Posts: 28,751

Computer: Specs
Experience: Experienced
OS: Windows Vista


Kraków my love :)

Computer Help Forum
« Reply #3 on: November 30, 2007, 05:45:00 PM »

Well, then let's start here:
http://www.computerhope.com/forum/index.php/topic,46313.0.html
IP logged

Pages: [1] - (Top) Print 
Home / Software / Computer viruses and spyware / Got a minidump log file for someone to take a look at « previous next »
 


Login with username, password and session length

Old Forum Search | Forum Rules
Copyright © 2010 Computer Hope ® All rights reserved.
Powered by SMF 2.0 RC3 | SMF © 2006–2010, Simple Machines LLC
Page created in 0.125 seconds with 20 queries.