BSOD ntoskrnl

I got the blue screen with the message IRQL_NOT_EQUAL_OR_LESS issued by ntoskrnl as it seems. Can you help me, please? The computer only restarts and then I get this message. I can only work in safe mode. Thank you!
Lucian

 

memory dump - I hope it helps

Loading Dump File [E:\Mini010307-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: *** Invalid ***
****************************************************************************
* Symbol loading may be unreliable without a symbol search path. *
* Use .symfix to have the debugger choose a symbol path. *
* After setting your symbol path, use .reload to refresh symbol locations. *
****************************************************************************
Executable search path is:
*********************************************************************
* Symbols can not be loaded because symbol path is not initialized. *
* *
* The Symbol Path can be set by: *
* using the _NT_SYMBOL_PATH environment variable. *
* using the -y <symbol_path> argument when starting the debugger. *
* using .sympath and .sympath+ *
*********************************************************************
Unable to load image ntoskrnl.exe, Win32 error 2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
*** ERROR: Module load completed but symbols could not be loaded for ntoskrnl.exe
Windows XP Kernel Version 2600 (Service Pack 2) UP Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Kernel base = 0x804d7000 PsLoadedModuleList = 0x805531a0
Debug session time: Wed Jan 3 11:50:47.968 2007 (GMT+2)
System Uptime: 0 days 0:02:18.546
*********************************************************************
* Symbols can not be loaded because symbol path is not initialized. *
* *
* The Symbol Path can be set by: *
* using the _NT_SYMBOL_PATH environment variable. *
* using the -y <symbol_path> argument when starting the debugger. *
* using .sympath and .sympath+ *
*********************************************************************
Unable to load image ntoskrnl.exe, Win32 error 2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
*** ERROR: Module load completed but symbols could not be loaded for ntoskrnl.exe
Loading Kernel Symbols
...................................................................................................................................................
Loading User Symbols
Loading unloaded module list
..........
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck C9, {20e, babaf52f, 845dd1e0, 0}

***** Kernel symbols are WRONG. Please fix symbols to do analysis.

***** Kernel symbols are WRONG. Please fix symbols to do analysis.

*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_IRP ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_IRP ***
*** ***
*************************************************************************
*** WARNING: Unable to verify timestamp for wmiacpi.sys
*** ERROR: Module load completed but symbols could not be loaded for wmiacpi.sys
*** WARNING: Unable to verify timestamp for WMILIB.SYS
*** ERROR: Module load completed but symbols could not be loaded for WMILIB.SYS
*** WARNING: Unable to verify timestamp for Ntfs.sys
*** ERROR: Module load completed but symbols could not be loaded for Ntfs.sys
Probably caused by : wmiacpi.sys ( wmiacpi+152f )

Followup: MachineOwner
---------

kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

DRIVER_VERIFIER_IOMANAGER_VIOLATION (c9)
The IO manager has caught a misbehaving driver.
Arguments:
Arg1: 0000020e, (Non-fatal error) A PNP IRP has an invalid status. (Any PNP IRP must
have its status initialized to STATUS_NOT_SUPPORTED.) (IRP specified.)
Arg2: babaf52f
Arg3: 845dd1e0
Arg4: 00000000

Debugging Details:
------------------

***** Kernel symbols are WRONG. Please fix symbols to do analysis.

***** Kernel symbols are WRONG. Please fix symbols to do analysis.

*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_IRP ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_IRP ***
*** ***
*************************************************************************

MODULE_NAME: wmiacpi

FAULTING_MODULE: 804d7000 nt

DEBUG_FLR_IMAGE_TIMESTAMP: 41107d2b

BUGCHECK_STR: 0xc9_20e

DRIVER_VERIFIER_IO_VIOLATION_TYPE: 20e

FAULTING_IP:
wmiacpi+152f
babaf52f 8bd8 mov ebx,eax

IRP_ADDRESS: 845dd1e0

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: WRONG_SYMBOLS

LAST_CONTROL_TRANSFER: from 806552ab to 804f8925

STACK_TEXT:
WARNING: Stack unwind information not available. Following frames may be wrong.
a81761dc 806552ab 0000004c 000000c9 a81761fc nt+0x21925
a8176364 80655a11 a817663f 8067e210 00040000 nt+0x17e2ab
a8176608 80655af7 80681c30 0000020e a8176634 nt+0x17ea11
a81766f8 80656c24 0000020e 00000009 babaf52f nt+0x17eaf7
a8176724 80654b3b 00000000 845dd274 83fcb0d0 nt+0x17fc24
a8176748 80659400 00000000 845dd274 83fcb0d0 nt+0x17db3b
a81767a8 8064b596 00ece650 848bac84 845dd1e0 nt+0x182400
a81767d0 babae836 848c47dc 848bac50 00000000 nt+0x174596
a81767e8 babaf52f 848bac50 84aec030 babaf4e0 wmiacpi+0x836
a8176804 f79899a3 848bab98 845a8e00 00000001 wmiacpi+0x152f
a8176874 babaefae 00000001 848bab98 845a8e00 WMILIB+0x9a3
a8176898 804eddf9 00000000 845a8e00 806d02e8 wmiacpi+0xfae
a81768cc 805f9984 a817694c 845a8e00 a8176a90 nt+0x16df9
a81768f8 805f9a4d 845a8e00 00000004 848bab03 nt+0x122984
a8176924 805f6f1e 00000004 848bab98 a8176aa8 nt+0x122a4d
a8176954 805f7133 00000004 e15449e8 a8176a90 nt+0x11ff1e
a8176ad4 805f727a 00000004 e15713bc 00000001 nt+0x120133
a8176b00 805f74d0 e15713cc 00000004 e1571300 nt+0x12027a
a8176b30 805fb34b e1571300 00224140 83eb62e8 nt+0x1204d0
a8176b58 805fa39d 00224140 00000001 a8176b80 nt+0x12434b
a8176c10 804eddf9 84b24228 846ca008 806d02e8 nt+0x12339d
a8176c44 80573b3a 846ca1bc 83e48ae0 846ca008 nt+0x16df9
a8176c58 805749c9 84b24228 846ca008 83e48ae0 nt+0x9cb3a
a8176d00 8056d326 0000020c 00000210 00000000 nt+0x9d9c9
a8176d34 8053c808 0000020c 00000210 00000000 nt+0x96326
a8176d64 7c90eb94 badb0d00 00bef0ec 23232323 nt+0x65808
a8176d68 badb0d00 00bef0ec 23232323 23232323 0x7c90eb94
a8176d6c 00bef0ec 23232323 23232323 00000000 Ntfs+0x1fd00
a8176d70 23232323 23232323 00000000 00000000 0xbef0ec
a8176d74 23232323 00000000 00000000 00000000 0x23232323
a8176d78 00000000 00000000 00000000 00000000 0x23232323


STACK_COMMAND: kb

FOLLOWUP_IP:
wmiacpi+152f
babaf52f 8bd8 mov ebx,eax

SYMBOL_STACK_INDEX: 9

FOLLOWUP_NAME: MachineOwner

IMAGE_NAME: wmiacpi.sys

SYMBOL_NAME: wmiacpi+152f

BUCKET_ID: WRONG_SYMBOLS

Followup: MachineOwner
---------

kd> lmvm wmiacpi
start end module name
babae000 babb0280 wmiacpi T (no symbols)
Loaded symbol image file: wmiacpi.sys
Image path: wmiacpi.sys
Image name: wmiacpi.sys
Timestamp: Wed Aug 04 09:07:39 2004 (41107D2B)
CheckSum: 0000A8BD
ImageSize: 00002280
Translations: 0000.04b0 0000.04e0 0409.04b0 0409.04e0
kd> lmvm nt
start end module name
804d7000 806cd280 nt T (no symbols)
Loaded symbol image file: ntoskrnl.exe
Image path: ntoskrnl.exe
Image name: ntoskrnl.exe
Timestamp: Wed Mar 02 02:34:37 2005 (42250A1D)
CheckSum: 001F632B
ImageSize: 001F6280
Translations: 0000.04b0 0000.04e0 0409.04b0 0409.04e0
kd> generate log
^ No runnable debuggees error in 'generate log'

 

From the stack trace you can find the footprint of wmiacpi. Obvously it is the software error of wmiacpi (ie Pnp device driver of the miniport).

a81767e8 babaf52f 848bac50 84aec030 babaf4e0 wmiacpi+0x836
a8176804 f79899a3 848bab98 845a8e00 00000001 wmiacpi+0x152f