A fatal system error has occurred. *** ERROR: Symbol file could not be found. Defaulted to export symbols for ntoskrnl.exe - Connected to Windows Server 2003 3790 x86 compatible target at (Sat Oct 13 16:34:19.578 2018 (UTC - 4:00)), ptr64 FALSE *** ERROR: Symbol file could not be found. Defaulted to export symbols for ntoskrnl.exe - Loading Kernel Symbols ....................................................... Loading User Symbols ............. *** ERROR: Symbol file could not be found. Defaulted to export symbols for ntdll.dll - ************* Symbol Loading Error Summary ************** Module name Error ntoskrnl The system cannot find the file specified ntdll PDB not found : cache* The system cannot find the file specified : SRV*https://msdl.microsoft.com/download/symbols You can troubleshoot most symbol related issues by turning on symbol loading diagnostics (!sym noisy) and repeating the command that caused symbols to be loaded. You should also verify that your symbol search path (.sympath) is correct. ERROR: FindPlugIns 8007007b ERROR: Some plugins may not be available [8007007b] ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* Use !analyze -v to get detailed debugging information. BugCheck E2, {0, 0, 0, 0} ***** Kernel symbols are WRONG. Please fix symbols to do analysis. *** ERROR: Module load completed but symbols could not be loaded for i8042prt.sys *** ERROR: Symbol file could not be found. Defaulted to export symbols for kdcom.dll - *** ERROR: Symbol file could not be found. Defaulted to export symbols for halacpi.dll - *** ERROR: Module load completed but symbols could not be loaded for fastfat.sys ************************************************************************* *** *** *** *** *** Either you specified an unqualified symbol, or your debugger *** *** doesn't have full symbol information. Unqualified symbol *** *** resolution is turned off by default. Please either specify a *** *** fully qualified symbol module!symbolname, or enable resolution *** *** of unqualified symbols by typing ".symopt- 100". Note that *** *** enabling unqualified symbol resolution with network symbol *** *** server shares in the symbol path may cause the debugger to *** *** appear to hang for long periods of time when an incorrect *** *** symbol name is typed or the network symbol server is down. *** *** *** *** For some commands to work properly, your symbol path *** *** must point to .pdb files that have full type information. *** *** *** *** Certain .pdb files (such as the public OS symbols) do not *** *** contain the required information. Contact the group that *** *** provided you with these symbols if you need this command to *** *** work. *** *** *** *** Type referenced: nt!_EPROCESS *** *** *** ************************************************************************* ************************************************************************* *** *** *** *** *** Either you specified an unqualified symbol, or your debugger *** *** doesn't have full symbol information. Unqualified symbol *** *** resolution is turned off by default. Please either specify a *** *** fully qualified symbol module!symbolname, or enable resolution *** *** of unqualified symbols by typing ".symopt- 100". Note that *** *** enabling unqualified symbol resolution with network symbol *** *** server shares in the symbol path may cause the debugger to *** *** appear to hang for long periods of time when an incorrect *** *** symbol name is typed or the network symbol server is down. *** *** *** *** For some commands to work properly, your symbol path *** *** must point to .pdb files that have full type information. *** *** *** *** Certain .pdb files (such as the public OS symbols) do not *** *** contain the required information. Contact the group that *** *** provided you with these symbols if you need this command to *** *** work. *** *** *** *** Type referenced: nt!_KPRCB *** *** *** ************************************************************************* ************************************************************************* *** *** *** *** *** Either you specified an unqualified symbol, or your debugger *** *** doesn't have full symbol information. Unqualified symbol *** *** resolution is turned off by default. Please either specify a *** *** fully qualified symbol module!symbolname, or enable resolution *** *** of unqualified symbols by typing ".symopt- 100". Note that *** *** enabling unqualified symbol resolution with network symbol *** *** server shares in the symbol path may cause the debugger to *** *** appear to hang for long periods of time when an incorrect *** *** symbol name is typed or the network symbol server is down. *** *** *** *** For some commands to work properly, your symbol path *** *** must point to .pdb files that have full type information. *** *** *** *** Certain .pdb files (such as the public OS symbols) do not *** *** contain the required information. Contact the group that *** *** provided you with these symbols if you need this command to *** *** work. *** *** *** *** Type referenced: nt!_KPRCB *** *** *** ************************************************************************* ************************************************************************* *** *** *** *** *** Either you specified an unqualified symbol, or your debugger *** *** doesn't have full symbol information. Unqualified symbol *** *** resolution is turned off by default. Please either specify a *** *** fully qualified symbol module!symbolname, or enable resolution *** *** of unqualified symbols by typing ".symopt- 100". Note that *** *** enabling unqualified symbol resolution with network symbol *** *** server shares in the symbol path may cause the debugger to *** *** appear to hang for long periods of time when an incorrect *** *** symbol name is typed or the network symbol server is down. *** *** *** *** For some commands to work properly, your symbol path *** *** must point to .pdb files that have full type information. *** *** *** *** Certain .pdb files (such as the public OS symbols) do not *** *** contain the required information. Contact the group that *** *** provided you with these symbols if you need this command to *** *** work. *** *** *** *** Type referenced: nt!_KPRCB *** *** *** ************************************************************************* ************************************************************************* *** *** *** *** *** Either you specified an unqualified symbol, or your debugger *** *** doesn't have full symbol information. Unqualified symbol *** *** resolution is turned off by default. Please either specify a *** *** fully qualified symbol module!symbolname, or enable resolution *** *** of unqualified symbols by typing ".symopt- 100". Note that *** *** enabling unqualified symbol resolution with network symbol *** *** server shares in the symbol path may cause the debugger to *** *** appear to hang for long periods of time when an incorrect *** *** symbol name is typed or the network symbol server is down. *** *** *** *** For some commands to work properly, your symbol path *** *** must point to .pdb files that have full type information. *** *** *** *** Certain .pdb files (such as the public OS symbols) do not *** *** contain the required information. Contact the group that *** *** provided you with these symbols if you need this command to *** *** work. *** *** *** *** Type referenced: nt!_KTHREAD *** *** *** ************************************************************************* ************************************************************************* *** *** *** *** *** Either you specified an unqualified symbol, or your debugger *** *** doesn't have full symbol information. Unqualified symbol *** *** resolution is turned off by default. Please either specify a *** *** fully qualified symbol module!symbolname, or enable resolution *** *** of unqualified symbols by typing ".symopt- 100". Note that *** *** enabling unqualified symbol resolution with network symbol *** *** server shares in the symbol path may cause the debugger to *** *** appear to hang for long periods of time when an incorrect *** *** symbol name is typed or the network symbol server is down. *** *** *** *** For some commands to work properly, your symbol path *** *** must point to .pdb files that have full type information. *** *** *** *** Certain .pdb files (such as the public OS symbols) do not *** *** contain the required information. Contact the group that *** *** provided you with these symbols if you need this command to *** *** work. *** *** *** *** Type referenced: nt!_KPRCB *** *** *** ************************************************************************* ************************************************************************* *** *** *** *** *** Either you specified an unqualified symbol, or your debugger *** *** doesn't have full symbol information. Unqualified symbol *** *** resolution is turned off by default. Please either specify a *** *** fully qualified symbol module!symbolname, or enable resolution *** *** of unqualified symbols by typing ".symopt- 100". Note that *** *** enabling unqualified symbol resolution with network symbol *** *** server shares in the symbol path may cause the debugger to *** *** appear to hang for long periods of time when an incorrect *** *** symbol name is typed or the network symbol server is down. *** *** *** *** For some commands to work properly, your symbol path *** *** must point to .pdb files that have full type information. *** *** *** *** Certain .pdb files (such as the public OS symbols) do not *** *** contain the required information. Contact the group that *** *** provided you with these symbols if you need this command to *** *** work. *** *** *** *** Type referenced: nt!_KPRCB *** *** *** ************************************************************************* *** ERROR: Symbol file could not be found. Defaulted to export symbols for kernel32.dll - Probably caused by : ntoskrnl.wrong.symbols.exe ( nt_wrong_symbols!5BC23CF9204000 ) Followup: MachineOwner --------- nt!DbgBreakPointWithStatus+0x4: 805345b8 cc int 3 kd> bt ^ Operation not supported in current debug session 'bt' kd> o ^ Syntax error in 'o' kd> !analyze -v ERROR: FindPlugIns 8007007b ERROR: Some plugins may not be available [8007007b] ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* MANUALLY_INITIATED_CRASH (e2) The user manually initiated this crash dump. Arguments: Arg1: 00000000 Arg2: 00000000 Arg3: 00000000 Arg4: 00000000 Debugging Details: ------------------ ***** Kernel symbols are WRONG. Please fix symbols to do analysis. ************************************************************************* *** *** *** *** *** Either you specified an unqualified symbol, or your debugger *** *** doesn't have full symbol information. Unqualified symbol *** *** resolution is turned off by default. Please either specify a *** *** fully qualified symbol module!symbolname, or enable resolution *** *** of unqualified symbols by typing ".symopt- 100". Note that *** *** enabling unqualified symbol resolution with network symbol *** *** server shares in the symbol path may cause the debugger to *** *** appear to hang for long periods of time when an incorrect *** *** symbol name is typed or the network symbol server is down. *** *** *** *** For some commands to work properly, your symbol path *** *** must point to .pdb files that have full type information. *** *** *** *** Certain .pdb files (such as the public OS symbols) do not *** *** contain the required information. Contact the group that *** *** provided you with these symbols if you need this command to *** *** work. *** *** *** *** Type referenced: nt!_EPROCESS *** *** *** ************************************************************************* ************************************************************************* *** *** *** *** *** Either you specified an unqualified symbol, or your debugger *** *** doesn't have full symbol information. Unqualified symbol *** *** resolution is turned off by default. Please either specify a *** *** fully qualified symbol module!symbolname, or enable resolution *** *** of unqualified symbols by typing ".symopt- 100". Note that *** *** enabling unqualified symbol resolution with network symbol *** *** server shares in the symbol path may cause the debugger to *** *** appear to hang for long periods of time when an incorrect *** *** symbol name is typed or the network symbol server is down. *** *** *** *** For some commands to work properly, your symbol path *** *** must point to .pdb files that have full type information. *** *** *** *** Certain .pdb files (such as the public OS symbols) do not *** *** contain the required information. Contact the group that *** *** provided you with these symbols if you need this command to *** *** work. *** *** *** *** Type referenced: nt!_KPRCB *** *** *** ************************************************************************* ************************************************************************* *** *** *** *** *** Either you specified an unqualified symbol, or your debugger *** *** doesn't have full symbol information. Unqualified symbol *** *** resolution is turned off by default. Please either specify a *** *** fully qualified symbol module!symbolname, or enable resolution *** *** of unqualified symbols by typing ".symopt- 100". Note that *** *** enabling unqualified symbol resolution with network symbol *** *** server shares in the symbol path may cause the debugger to *** *** appear to hang for long periods of time when an incorrect *** *** symbol name is typed or the network symbol server is down. *** *** *** *** For some commands to work properly, your symbol path *** *** must point to .pdb files that have full type information. *** *** *** *** Certain .pdb files (such as the public OS symbols) do not *** *** contain the required information. Contact the group that *** *** provided you with these symbols if you need this command to *** *** work. *** *** *** *** Type referenced: nt!_KPRCB *** *** *** ************************************************************************* ************************************************************************* *** *** *** *** *** Either you specified an unqualified symbol, or your debugger *** *** doesn't have full symbol information. Unqualified symbol *** *** resolution is turned off by default. Please either specify a *** *** fully qualified symbol module!symbolname, or enable resolution *** *** of unqualified symbols by typing ".symopt- 100". Note that *** *** enabling unqualified symbol resolution with network symbol *** *** server shares in the symbol path may cause the debugger to *** *** appear to hang for long periods of time when an incorrect *** *** symbol name is typed or the network symbol server is down. *** *** *** *** For some commands to work properly, your symbol path *** *** must point to .pdb files that have full type information. *** *** *** *** Certain .pdb files (such as the public OS symbols) do not *** *** contain the required information. Contact the group that *** *** provided you with these symbols if you need this command to *** *** work. *** *** *** *** Type referenced: nt!_KPRCB *** *** *** ************************************************************************* ************************************************************************* *** *** *** *** *** Either you specified an unqualified symbol, or your debugger *** *** doesn't have full symbol information. Unqualified symbol *** *** resolution is turned off by default. Please either specify a *** *** fully qualified symbol module!symbolname, or enable resolution *** *** of unqualified symbols by typing ".symopt- 100". Note that *** *** enabling unqualified symbol resolution with network symbol *** *** server shares in the symbol path may cause the debugger to *** *** appear to hang for long periods of time when an incorrect *** *** symbol name is typed or the network symbol server is down. *** *** *** *** For some commands to work properly, your symbol path *** *** must point to .pdb files that have full type information. *** *** *** *** Certain .pdb files (such as the public OS symbols) do not *** *** contain the required information. Contact the group that *** *** provided you with these symbols if you need this command to *** *** work. *** *** *** *** Type referenced: nt!_KTHREAD *** *** *** ************************************************************************* ************************************************************************* *** *** *** *** *** Either you specified an unqualified symbol, or your debugger *** *** doesn't have full symbol information. Unqualified symbol *** *** resolution is turned off by default. Please either specify a *** *** fully qualified symbol module!symbolname, or enable resolution *** *** of unqualified symbols by typing ".symopt- 100". Note that *** *** enabling unqualified symbol resolution with network symbol *** *** server shares in the symbol path may cause the debugger to *** *** appear to hang for long periods of time when an incorrect *** *** symbol name is typed or the network symbol server is down. *** *** *** *** For some commands to work properly, your symbol path *** *** must point to .pdb files that have full type information. *** *** *** *** Certain .pdb files (such as the public OS symbols) do not *** *** contain the required information. Contact the group that *** *** provided you with these symbols if you need this command to *** *** work. *** *** *** *** Type referenced: nt!_KPRCB *** *** *** ************************************************************************* ************************************************************************* *** *** *** *** *** Either you specified an unqualified symbol, or your debugger *** *** doesn't have full symbol information. Unqualified symbol *** *** resolution is turned off by default. Please either specify a *** *** fully qualified symbol module!symbolname, or enable resolution *** *** of unqualified symbols by typing ".symopt- 100". Note that *** *** enabling unqualified symbol resolution with network symbol *** *** server shares in the symbol path may cause the debugger to *** *** appear to hang for long periods of time when an incorrect *** *** symbol name is typed or the network symbol server is down. *** *** *** *** For some commands to work properly, your symbol path *** *** must point to .pdb files that have full type information. *** *** *** *** Certain .pdb files (such as the public OS symbols) do not *** *** contain the required information. Contact the group that *** *** provided you with these symbols if you need this command to *** *** work. *** *** *** *** Type referenced: nt!_KPRCB *** *** *** ************************************************************************* DUMP_CLASS: 1 DUMP_QUALIFIER: 0 BUILD_VERSION_STRING: 20181013-0.4.11-dev-410-g2d47c3b.MSVC_18.0.31101.0 ADDITIONAL_DEBUG_TEXT: You can run '.symfix; .reload' to try to fix the symbol path and load symbols. WRONG_SYMBOLS_TIMESTAMP: 5bc23cf9 WRONG_SYMBOLS_SIZE: 204000 FAULTING_MODULE: 80400000 nt DEBUG_FLR_IMAGE_TIMESTAMP: 5bc23cf9 DUMP_TYPE: 0 BUGCHECK_P1: 0 BUGCHECK_P2: 0 BUGCHECK_P3: 0 BUGCHECK_P4: 0 BUGCHECK_STR: 5BC23CF9 CPU_COUNT: 1 CPU_MHZ: a97 CPU_VENDOR: GenuineIntel CPU_FAMILY: 6 CPU_MODEL: e CPU_STEPPING: 3 CURRENT_IRQL: 0 ANALYSIS_SESSION_HOST: BRYAN-PC ANALYSIS_SESSION_TIME: 10-13-2018 16:36:05.0973 ANALYSIS_VERSION: 10.0.14321.1024 x86fre LAST_CONTROL_TRANSFER: from 80486c87 to 805345b8 STACK_TEXT: WARNING: Stack unwind information not available. Following frames may be wrong. f707dda4 80486c87 00000004 00000000 00128c30 nt!DbgBreakPointWithStatus+0x4 f707e144 80486538 000000e2 00000000 00000000 nt!KeBugCheckEx+0x737 f707e164 f789c42b 000000e2 00000001 f707e1b3 nt!KeBugCheck+0x18 f707e194 8051297a b4cb2668 b4cb0318 f707e1c8 i8042prt+0x342b f707e1b4 805129e8 f707e1c8 b4cb2668 f707e1c8 nt!KeRaiseUserException+0x100a f707e1e0 8008acb0 8008c060 00000000 00000000 nt!KeRaiseUserException+0x1078 f707e23c 802c60d0 f707e2c4 00000005 00000024 kdcom!KdSendPacket+0x670 f707e260 802c741b 804926a5 00000000 f707e2c4 hal!HalClearSoftwareInterrupt+0x110 f707e274 80492339 00000000 f707e2c4 b1e3c640 hal!HalEndSystemInterrupt+0xd f707e2a4 802c6c47 00000000 000249c0 f707e2c4 nt!KeUpdateSystemTime+0x1b9 f707e2bc 802c7350 f707e34c 80403fa6 badb0d00 hal!KeRaiseIrqlToSynchLevel+0x427 f707e34c 8052a8e2 00000001 f707e388 00000042 hal!KeFlushWriteBuffer+0x220 f707e368 8052ab3f f707e5e0 ffffffff 00000000 nt!DbgSetDebugFilterState+0x82 f707e60c 8052a756 805d0031 ffffffff 00000000 nt!vDbgPrintExWithPrefix+0x1df f707e634 f7bae293 f7bb7ae0 f7bb7abb 00000120 nt!DbgPrint+0x26 f707e744 f7baeab9 b4a4ccf0 f707e7f6 f707e768 fastfat+0x12293 f707e824 f7bad499 b4c944e0 00000001 00000001 fastfat+0x12ab9 f707e854 f7bafa9a b4c944e0 00000001 00000001 fastfat+0x11499 f707e87c f7baf983 b4c944e0 00000001 00000001 fastfat+0x13a9a f707e8a0 8046f33d b4d8f6d8 b4a36538 b4d8fa58 fastfat+0x13983 f707e8c8 804751c1 f704e800 00000000 f707e8d8 nt!IofCallDriver+0xad f707e96c 80474b44 b4a4ccf0 00000000 00000000 nt!IoVolumeDeviceToDosName+0x9b1 f707e998 804642ba b4a4a938 b4a4ccf0 f707eb30 nt!IoVolumeDeviceToDosName+0x334 f707eaf8 804e3ada b4a4ccf0 00000000 b4a68f30 nt!IoUpdateShareAccess+0x296a f707eb8c 804dc86b 00000000 f707ebc0 00000040 nt!ObQueryNameString+0x124a f707ebe4 80462ccb 00129074 00000000 00000001 nt!ObOpenObjectByName+0x15b f707ec6c 80461046 0012909c 00100080 00129074 nt!IoUpdateShareAccess+0x137b f707ecb4 804665a2 0012909c 00100080 00129074 nt!IoCreateFile+0x46 f707ecf4 8051831b 0012909c 00100080 00129074 nt!NtOpenFile+0x32 f707ed1c 805164a8 80466570 00128c18 00000018 nt!Kei386EoiHelper+0xa2b f707ed5c 80403e23 001290b8 7c92f59e badb0d00 nt!KiEoiHelper+0x808 f707ed64 7c92f59e badb0d00 00128c10 00000000 nt!WRITE_REGISTER_BUFFER_ULONG+0x15a7 f707ed68 badb0d00 00128c10 00000000 00000000 ntdll!KiFastSystemCallRet f707ed6c 00128c10 00000000 00000000 00000000 0xbadb0d00 f707ed70 00000000 00000000 00000000 00000000 0x128c10 STACK_COMMAND: kb THREAD_SHA1_HASH_MOD_FUNC: ae9acd08f64662022cf0e5b9aece8a6ccd712bd1 THREAD_SHA1_HASH_MOD_FUNC_OFFSET: 5fdda8dc96782258e3e8b16d382578fb24e95de9 THREAD_SHA1_HASH_MOD: f954891c68b719cffe5d6d56e714593a0a9f9e19 FOLLOWUP_IP: i8042prt+342b f789c42b 8d4dfd lea ecx,[ebp-3] FAULT_INSTR_CODE: 51fd4d8d SYMBOL_STACK_INDEX: 3 FOLLOWUP_NAME: MachineOwner EXCEPTION_CODE: (NTSTATUS) 0x5bc23cf9 - EXCEPTION_CODE_STR: 5BC23CF9 EXCEPTION_STR: WRONG_SYMBOLS PROCESS_NAME: ntoskrnl.wrong.symbols.exe IMAGE_NAME: ntoskrnl.wrong.symbols.exe MODULE_NAME: nt_wrong_symbols SYMBOL_NAME: nt_wrong_symbols!5BC23CF9204000 BUCKET_ID: WRONG_SYMBOLS_X86_20181013-0.4.11-dev-410-g2d47c3b.MSVC_18.0.31101.0_TIMESTAMP_181013-184409 DEFAULT_BUCKET_ID: WRONG_SYMBOLS_X86_20181013-0.4.11-dev-410-g2d47c3b.MSVC_18.0.31101.0_TIMESTAMP_181013-184409 PRIMARY_PROBLEM_CLASS: WRONG_SYMBOLS FAILURE_BUCKET_ID: WRONG_SYMBOLS_X86_20181013-0.4.11-dev-410-g2d47c3b.MSVC_18.0.31101.0_TIMESTAMP_181013-184409_5BC23CF9_nt_wrong_symbols!5BC23CF9204000 TARGET_TIME: 2018-10-13T21:34:11.000Z OSBUILD: 3790 OSSERVICEPACK: 2000 SERVICEPACK_NUMBER: 2 OS_REVISION: 0 SUITE_MASK: 0 PRODUCT_TYPE: 0 OSPLATFORM_TYPE: x86 OSNAME: Windows Server 2003 OSEDITION: Windows Server 2003 (Service Pack 2) OS_LOCALE: USER_LCID: 0 OSBUILD_TIMESTAMP: 2018-10-13 14:44:09 BUILDDATESTAMP_STR: 0 BUILDLAB_STR: MSVC_18 BUILDOSVER_STR: 5.2.20181013-0.4.11-dev-410-g2d47c3b.MSVC_18.0.31101.0 ANALYSIS_SESSION_ELAPSED_TIME: 2f4f ANALYSIS_SOURCE: KM FAILURE_ID_HASH_STRING: km:wrong_symbols_x86_20181013-0.4.11-dev-410-g2d47c3b.msvc_18.0.31101.0_timestamp_181013-184409_5bc23cf9_nt_wrong_symbols!5bc23cf9204000 FAILURE_ID_HASH: {1278c9fe-8c16-3698-b3e0-7db145592cf9} Followup: MachineOwner ---------