Petya V4sechkin, при выполнении !analyze -v получаю вот это
Скрытый текст
0:028> !analyze -v
*******************************************************************************
* *
* Exception Analysis *
* *
*******************************************************************************
*************************************************************************
*** ***
*** ***
*** Either you specified an unqualified symbol, or your debugger ***
*** doesn't have full symbol information. Unqualified symbol ***
*** resolution is turned off by default. Please either specify a ***
*** fully qualified symbol module!symbolname, or enable resolution ***
*** of unqualified symbols by typing ".symopt- 100". Note that ***
*** enabling unqualified symbol resolution with network symbol ***
*** server shares in the symbol path may cause the debugger to ***
*** appear to hang for long periods of time when an incorrect ***
*** symbol name is typed or the network symbol server is down. ***
*** ***
*** For some commands to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: $ntdllsym!_CONTEXT ***
*** ***
*************************************************************************
***** OS symbols are WRONG. Please fix symbols to do analysis.
*************************************************************************
*** ***
*** ***
*** Either you specified an unqualified symbol, or your debugger ***
*** doesn't have full symbol information. Unqualified symbol ***
*** resolution is turned off by default. Please either specify a ***
*** fully qualified symbol module!symbolname, or enable resolution ***
*** of unqualified symbols by typing ".symopt- 100". Note that ***
*** enabling unqualified symbol resolution with network symbol ***
*** server shares in the symbol path may cause the debugger to ***
*** appear to hang for long periods of time when an incorrect ***
*** symbol name is typed or the network symbol server is down. ***
*** ***
*** For some commands to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_CONTEXT ***
*** ***
*************************************************************************
DUMP_CLASS: 2
DUMP_QUALIFIER: 400
CONTEXT: (.ecxr)
rax=000000000000e6a0 rbx=000000eff62ce930 rcx=000000000000001c
rdx=000000000000a230 rsi=0000000000000000 rdi=0000000000000000
rip=00007ff93e050f20 rsp=000000eff62ceb40 rbp=0000000000000000
r8=0000000000000001 r9=00007ff93d4a13d2 r10=000000eff62ce6a8
r11=00007ff93e08dda8 r12=0000000000000001 r13=0000000000000001
r14=0000000000000008 r15=0000000000000000
iopl=0 nv up ei pl nz na pe nc
cs=0033 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00000200
ntdll+0xf0f20:
00007ff9`3e050f20 eb00 jmp ntdll+0xf0f22 (00007ff9`3e050f22)
Resetting default scope
FAULTING_IP:
ntdll+f0f20
00007ff9`3e050f20 eb00 jmp ntdll+0xf0f22 (00007ff9`3e050f22)
EXCEPTION_RECORD: (.exr -1)
ExceptionAddress: 00007ff93e050f20 (ntdll+0x00000000000f0f20)
ExceptionCode: c0000374
ExceptionFlags: 00000001
NumberParameters: 1
Parameter[0]: 00007ff93e08dd40
BUGCHECK_STR: 550F4336
WRONG_SYMBOLS_TIMESTAMP: 550f4336
WRONG_SYMBOLS_SIZE: 1ac000
FAULTING_MODULE: 00007ff93df60000 ntdll
DEBUG_FLR_IMAGE_TIMESTAMP: 550f4336
ADDITIONAL_DEBUG_TEXT:
You can run '.symfix; .reload' to try to fix the symbol path and load symbols. ; Followup set based on attribute [Is_ChosenCrashFollowupThread] from Frame:[0] on thread:[PSEUDO_THREAD]
LAST_CONTROL_TRANSFER: from 0000000000000000 to 0000000000000000
ANALYSIS_SESSION_HOST: DESKTOP-B228LQI
ANALYSIS_SESSION_TIME: 11-28-2016 08:14:41.0953
ANALYSIS_VERSION: 10.0.14321.1024 amd64fre
STACK_TEXT:
00000000`00000000 00000000`00000000 WRONG_SYMBOLS!WRONG_SYMBOLS+0x0
STACK_COMMAND: .ecxr ; kb ; ** Pseudo Context ** ; kb
THREAD_SHA1_HASH_MOD_FUNC: 2a06fe893fc51638e55bcc8ee02bcdf6f10cbc26
THREAD_SHA1_HASH_MOD_FUNC_OFFSET: 214d5e958d92c59434e5414a89d1e95c2f82d12a
THREAD_SHA1_HASH_MOD: 79d1e41e8e0e291e73ec18352c568efa4ef4b5ab
SYMBOL_STACK_INDEX: 0
FOLLOWUP_NAME: MachineOwner
EXCEPTION_CODE: (NTSTATUS) 0x550f4336 - <Unable to get error code text>
EXCEPTION_CODE_STR: 550F4336
EXCEPTION_STR: PRIVATE_SYMBOLS
PROCESS_NAME: ntdll.wrong.symbols.dll
IMAGE_NAME: ntdll.wrong.symbols.dll
MODULE_NAME: ntdll_wrong_symbols
SYMBOL_NAME: ntdll_wrong_symbols!550F43361AC000
BUCKET_ID: PRIVATE_SYMBOLS_X64_6.3.9600.17031_(winblue_gdr.140221-1952)_TIMESTAMP_150322-223326
DEFAULT_BUCKET_ID: PRIVATE_SYMBOLS_X64_6.3.9600.17031_(winblue_gdr.140221-1952)_TIMESTAMP_150322-223326
PRIMARY_PROBLEM_CLASS: PRIVATE_SYMBOLS
FAILURE_BUCKET_ID: PRIVATE_SYMBOLS_X64_6.3.9600.17031_(winblue_gdr.140221-1952)_TIMESTAMP_150322-223326_550F4336_ntdll.wrong.symbols.dll!550F43361AC000
FAILURE_EXCEPTION_CODE: 550F4336
FAILURE_IMAGE_NAME: ntdll.wrong.symbols.dll
BUCKET_ID_IMAGE_STR: ntdll.wrong.symbols.dll
FAILURE_MODULE_NAME: ntdll_wrong_symbols
BUCKET_ID_MODULE_STR: ntdll_wrong_symbols
FAILURE_FUNCTION_NAME: 550F43361AC000
BUCKET_ID_FUNCTION_STR: 550F43361AC000
BUCKET_ID_OFFSET: 0
BUCKET_ID_MODTIMEDATESTAMP: 0
BUCKET_ID_MODCHECKSUM: 0
BUCKET_ID_MODVER_STR: 0.0.0.0
BUCKET_ID_PREFIX_STR: PRIVATE_SYMBOLS_X64_6.3.9600.17031_(winblue_gdr.140221-1952)_TIMESTAMP_150322-223326
FAILURE_PROBLEM_CLASS: PRIVATE_SYMBOLS_X64_6.3.9600.17031_(winblue_gdr.140221-1952)_TIMESTAMP_150322-223326
FAILURE_SYMBOL_NAME: ntdll.wrong.symbols.dll!550F43361AC000
TARGET_TIME: 2016-11-24T23:02:05.000Z
OSBUILD: 9600
OSSERVICEPACK: 17415
SERVICEPACK_NUMBER: 0
OS_REVISION: 0
SUITE_MASK: 16
PRODUCT_TYPE: 2
OSPLATFORM_TYPE: x64
OSNAME: Windows 8.1
OSEDITION: Windows 8.1 LanManNt TerminalServer
OS_LOCALE:
USER_LCID: 0
OSBUILD_TIMESTAMP: 2014-10-29 12:45:30
BUILDDATESTAMP_STR: 140221-1952
BUILDLAB_STR: winblue_gdr
BUILDOSVER_STR: 6.3.9600.17031
ANALYSIS_SESSION_ELAPSED_TIME: 209
ANALYSIS_SOURCE: UM
FAILURE_ID_HASH_STRING: um:private_symbols_x64_6.3.9600.17031_(winblue_gdr.140221-1952)_timestamp_150322-223326_550f4336_ntdll.wrong.symbols.dll!550f43361ac000
FAILURE_ID_HASH: {3273423f-2672-1930-547a-adba955934cc}
Followup: MachineOwner
---------
упоминания о "C:\Windows\System32\spool\drivers\x64\3\CNLB0MUI_DAD22.DLL" не вижу
