Computer has reboot from a bugcheck causes by Hal.dll


Recommended Posts

  On 10/09/2016 at 08:32, Renz_Lyle said:

Hi,

I'm a newbie here. I have experience series of reboot that causes by hal.dll. I haven't done any changes lately but I continue to get bluescreens on an XP  virtual machine running on RHEV. By the way, here's the result in Bluescreen view. Thanks!

BSOD.JPG

Expand  

Use windbg to give more info, or if that program can, use it. 

 

I had hal.dll blue screens a couple weeks ago and drilling down in each debug result was memory_corruption. Turns out a 16GB stick of ram went bad. 

Hi adrynalyne,

Thank you for looking into my concern. Attached is the screenshot from Bluescreen View.

 

Here's from Windbg:

1: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 30000008, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000000, bitfield :
    bit 0 : value 0 = read operation, 1 = write operation
    bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: 804ff7f6, address which referenced memory

Debugging Details:
------------------

***** Kernel symbols are WRONG. Please fix symbols to do analysis.

*************************************************************************
***                                                                   ***
***                                                                   ***
***    Your debugger is not using the correct symbols                 ***
***                                                                   ***
***    In order for this command to work properly, your symbol path   ***
***    must point to .pdb files that have full type information.      ***
***                                                                   ***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                          ***
***                                                                   ***
***    Type referenced: nt!_KPRCB                                     ***
***                                                                   ***
*************************************************************************
*************************************************************************
***                                                                   ***
***                                                                   ***
***    Your debugger is not using the correct symbols                 ***
***                                                                   ***
***    In order for this command to work properly, your symbol path   ***
***    must point to .pdb files that have full type information.      ***
***                                                                   ***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                          ***
***                                                                   ***
***    Type referenced: nt!KPRCB                                      ***
***                                                                   ***
*************************************************************************
*************************************************************************
***                                                                   ***
***                                                                   ***
***    Your debugger is not using the correct symbols                 ***
***                                                                   ***
***    In order for this command to work properly, your symbol path   ***
***    must point to .pdb files that have full type information.      ***
***                                                                   ***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                          ***
***                                                                   ***
***    Type referenced: nt!_KPRCB                                     ***
***                                                                   ***
*************************************************************************
*************************************************************************
***                                                                   ***
***                                                                   ***
***    Your debugger is not using the correct symbols                 ***
***                                                                   ***
***    In order for this command to work properly, your symbol path   ***
***    must point to .pdb files that have full type information.      ***
***                                                                   ***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                          ***
***                                                                   ***
***    Type referenced: nt!KPRCB                                      ***
***                                                                   ***
*************************************************************************
*************************************************************************
***                                                                   ***
***                                                                   ***
***    Your debugger is not using the correct symbols                 ***
***                                                                   ***
***    In order for this command to work properly, your symbol path   ***
***    must point to .pdb files that have full type information.      ***
***                                                                   ***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                          ***
***                                                                   ***
***    Type referenced: nt!_KPRCB                                     ***
***                                                                   ***
*************************************************************************
*************************************************************************
***                                                                   ***
***                                                                   ***
***    Your debugger is not using the correct symbols                 ***
***                                                                   ***
***    In order for this command to work properly, your symbol path   ***
***    must point to .pdb files that have full type information.      ***
***                                                                   ***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                          ***
***                                                                   ***
***    Type referenced: nt!_KPRCB                                     ***
***                                                                   ***
*************************************************************************
*************************************************************************
***                                                                   ***
***                                                                   ***
***    Your debugger is not using the correct symbols                 ***
***                                                                   ***
***    In order for this command to work properly, your symbol path   ***
***    must point to .pdb files that have full type information.      ***
***                                                                   ***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                          ***
***                                                                   ***
***    Type referenced: nt!_KPRCB                                     ***
***                                                                   ***
*************************************************************************
*********************************************************************
* Symbols can not be loaded because symbol path is not initialized. *
*                                                                   *
* The Symbol Path can be set by:                                    *
*   using the _NT_SYMBOL_PATH environment variable.                 *
*   using the -y <symbol_path> argument when starting the debugger. *
*   using .sympath and .sympath+                                    *
*********************************************************************
*********************************************************************
* Symbols can not be loaded because symbol path is not initialized. *
*                                                                   *
* The Symbol Path can be set by:                                    *
*   using the _NT_SYMBOL_PATH environment variable.                 *
*   using the -y <symbol_path> argument when starting the debugger. *
*   using .sympath and .sympath+                                    *
*********************************************************************

ADDITIONAL_DEBUG_TEXT:  
Use '!findthebuild' command to search for the target build information.
If the build information is available, run '!findthebuild -s ; .reload' to set symbol path and load symbols.

MODULE_NAME: win32k

FAULTING_MODULE: 804d7000 nt

DEBUG_FLR_IMAGE_TIMESTAMP:  48025f2a

READ_ADDRESS: unable to get nt!MmSpecialPoolStart
unable to get nt!MmSpecialPoolEnd
unable to get nt!MmPoolCodeStart
unable to get nt!MmPoolCodeEnd
 30000008

CURRENT_IRQL:  2

FAULTING_IP:
nt+287f6
804ff7f6 8b4f14          mov     ecx,dword ptr [edi+14h]

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  DRIVER_FAULT

BUGCHECK_STR:  0xA

LAST_CONTROL_TRANSFER:  from 806e6ef2 to 804ff7f6

STACK_TEXT:  
WARNING: Stack unwind information not available. Following frames may be wrong.
bab17a4c 806e6ef2 00000000 00000000 bab17a64 nt+0x287f6
bab17a64 806e6ba4 badb0d00 00000000 00000000 hal+0x2ef2
bab17d30 bf884705 bab07490 00000002 bab17d54 hal+0x2ba4
bab17d40 bf80110a bab07490 bab17d64 0070fff4 win32k+0x84705
bab17d54 8054161c 00000000 00000022 00000000 win32k+0x110a
bab17d64 7c90e506 badb0d00 0070ffec 00000000 nt+0x6a61c
00000000 00000000 00000000 00000000 00000000 0x7c90e506


STACK_COMMAND:  kb

FOLLOWUP_IP:
win32k+84705
bf884705 ??              ???

SYMBOL_STACK_INDEX:  3

SYMBOL_NAME:  win32k+84705

FOLLOWUP_NAME:  MachineOwner

IMAGE_NAME:  win32k.sys

BUCKET_ID:  WRONG_SYMBOLS

Followup: MachineOwner

BSOD-09022016.JPG

BSOD-09092016.JPG

Reseat  your hardware, RAM, graphics card, etc.

 

Update BIOS

 

Update all drivers that you can

 

Check cables for tightness

 

Sometimes cables go bad

 

Could be that hal.dll is corrupt -- only a Reinstall might repair it.

  On 12/09/2016 at 03:08, Renz_Lyle said:

Can't attached it directly but you can download it here:

 

https://www.dropbox.com/s/whaglreollnbnqf/Desktop.zip?dl=0

 

Expand  

I'll take a look tomorrow. :)

 

  On 12/09/2016 at 03:15, Hum said:

Reseat  your hardware, RAM, graphics card, etc.

 

Update BIOS

 

Update all drivers that you can

 

Check cables for tightness

 

Sometimes cables go bad

 

Could be that hal.dll is corrupt -- only a Reinstall might repair it.

Expand  

If Hal.dll was corrupt he wouldn't even be booting. I know you are trying to help, but the approach of throw poo at the wall and see what sticks rarely works. 

Looks like some of the files on this hdd are out of date. Dameware is from 2008.  This file viostor.sys is from 2012. Looks like this is a linux file. I dont know why it's on your hdd. I think this is also part of a VM program

 

Wouldnt be surprised if one of these Symantec programs are causing it

 

 

This topic is now closed to further replies.
  • Posts

    • Malwarebytes 5.3.6.205 by Razvan Serea Malwarebytes is a high performance anti-malware application that thoroughly removes even the most advanced malware and spyware. Malwarebytes version 5.xx brings comprehensive protection against today’s threat landscape so that you can finally replace your traditional antivirus. You can finally replace your traditional antivirus, thanks to a innovative and layered approach to prevent malware infections using a healthy combination of proactive and signature-less technologies. While signatures are still effective against threats like potentially unwanted programs, the majority of malware detection events already come from signature-less technologies like Malwarebytes Anti-Exploit and Malwarebytes Anti-Ransomware; that trend will only continue to grow. For many of you, this is something you already know, since over 50% of the users already run Malwarebytes as their sole security software, without any third-party antivirus. What's new in Malwarebytes 5.xx: Unified user experience - For the first time, Malwarebytes now provides a consistent experience across all of our desktop and mobile products courtesy of an all new and reimagined user experience powered by a faster and more responsive UI all managed through an intuitive dashboard. Modern security and privacy integrations - Antivirus and ultra-fast VPN come together seamlessly in one easy-to-use solution. Whether you’re looking for a next-gen VPN to secure your online activity, or harnessing the power of Browser Guard to block ad trackers and scam sites, taking charge of your privacy is simple. Trusted Advisor - Empowers you with real-time insights, easy-to-read protection score and expert guidance that puts you in control over your security and privacy. Malwarebytes 5.3.6.205 changelog: Improved the onboarding experience with minor usability enhancements. Updated My subscription page design for better clarity. Added text explaining Scan notifications settings in Notifications page. Updated firewall filtering profile colors in Windows Firewall Control feature for Windows 11 users. Fixed minor UI issues with Windows Firewall Control feature for Windows 11 users. Fixed various localization and usability glitches. Download: Malwarebytes 5.3.6.205 | 403.0 MB (Free, paid upgrade available) Links: Malwarebytes Website | Screenshot Get alerted to all of our Software updates on Twitter at @NeowinSoftware
    • https://shop.royalmail.com/special-stamp-issues/monty-python
    • Microsoft disables a key graphics feature in Edge by Paul Hill Microsoft has released its new security baseline for its Edge browser version 139, it includes the addition of one setting and the removal of one other. For those that are unaware, these security baselines allow admins to set an organization’s Edge browser settings to the default that Microsoft recommends at any one time. You can download the new package from the Security Compliance Toolkit. With this update, the company is enforcing the default to disable the EnableUnsafeSwiftShader policy. This will help to mitigate potential risks as malicious web content could exploit vulnerabilities in the renderer. SwiftShader is a software-based renderer that serves as a fallback for WebGL in environments without GPU acceleration, such as virtual machines. With Microsoft’s disabling of it, it seems as though this compatibility tool is now seen as a liability. The disabled SwiftShader was the most relevant in virtual machines which are widely used in enterprises, so this change poses the risk of causing a bit of disruption. While the move is a good one for security, those who it affects may want to deviate away from Microsoft’s security baselines. The security baseline announcement also mentions a new Edge for Business security connectors feature which is designed to integrate the browser with security software for DLP and authentication. Microsoft said that these connectors can close critical gaps in enterprise security. You can learn more on the feature’s landing page. Microsoft doesn’t seem to have made the change to SwiftShader due to existing vulnerabilities, instead the move seems to be a proactive security improvement. If you rely on it with your virtual machines, feel free to deviate away from Microsoft’s security baseline, but understand you’re no longer following the company’s security advice.
    • Edge 139 is out with big performance boost, password improvements, and more by Taras Buria Microsoft has released Edge 139 to all users in the Stable Channel. The latest version (139.0.3405.86) introduces some notable changes to the browser, performance improvements, and bug fixes. It also removes some of the existing features, as Microsoft strives to streamline the browser and its features. Microsoft Edge 139 brings a reworked Settings section, which is now built with WebUI2. This enables significant improvements in performance and responsiveness, which Microsoft recently detailed in a blog post. Additionally, Microsoft optimized Settings for a more cohesive user experience by simplifying the number of pages and reorganizing various options. Though it also disables an important graphics feature with this update. Wallet in Settings is discontinued. It now redirects users to the new "Passwords, Payment, and Personal Information" experience in settings. Speaking of passwords, the built-in password manager now has real-time notifications for compromised passwords. If one of your passwords is found in a known data breach, Edge will prompt you to take immediate action and create a new password. Other changes in Edge 139 include the following: Open external links in another profile when recommended by external applications. When Microsoft Edge is set as the default browser to open external links from applications, Microsoft Edge must determine which profile to open the links. Introducing a new policy that can enable/disable Microsoft 365 Copilot Chat in Edge for Business from showing in the toolbar. Edge for Business now has a dedicated policy, Microsoft365CopilotChatIconEnabled, to enable and disable Copilot in Edge from showing in the Edge toolbar. New Autofill Personal Information Settings Configuration. A web form field collection consent toggle will be available in Autofill settings (edge://settings/autofill/personalInfo). This allows users to consent to Microsoft Edge collecting web form field labels (e.g., "First Name," "Email") to improve Autofill suggestion accuracy. Web AI APIs for prompt and writing assistance. Microsoft Edge now implements the Writing Assistance APIs and the Prompt API (for Edge extensions) with a local language model, Phi-4-mini, that is built into the browser. These easy-to-use JavaScript APIs are made available via Edge flags (set to Enabled, by default only for the Summarizer and Prompt API for extensions) so that sites and extensions can apply AI capabilities on the web. Enhancements to Performance and Secure network. Browser essentials is now separated into two distinct experiences (Performance and Secure Network) - both available from the Settings and more menu (“…” on the menu bar). Reset Microsoft Edge enterprise sync. For users having problems syncing browsing data across other signed-in devices, they can reset sync data from the Microsoft servers via Edge Settings edge://settings/profiles/sync/reset. Update to Microsoft AutoUpdate policy. The MAUEnabled policy allowed admins to continue using Microsoft AutoUpdate on macOS. Finally, Edge 139 contains eight security fixes for vulnerabilities originating from Chromium. Microsoft also published a security guideline with details about a key graphics feature, which is now disabled. You can update to Microsoft Edge 139 by heading to edge://settings/help. By the way, if you uninstalled the browser and do not know how to get it back, check out this guide.
  • Recent Achievements

    • One Month Later
      chiptuning earned a badge
      One Month Later
    • Week One Done
      harveycoleman123 earned a badge
      Week One Done
    • First Post
      EzraNougat earned a badge
      First Post
    • One Month Later
      westDvina earned a badge
      One Month Later
    • Community Regular
      Bern@rd went up a rank
      Community Regular
  • Popular Contributors

    1. 1
      +primortal
      667
    2. 2
      +FloatingFatMan
      196
    3. 3
      ATLien_0
      154
    4. 4
      Xenon
      132
    5. 5
      wakjak
      102
  • Tell a friend

    Love Neowin? Tell a friend!