Jump to content
arleetel

SASKUTIL.sys

Recommended Posts

Hello,

Last week the computer crashed with a BSOD, reason was SASKUTIL.sys.

The action that triggered it was trying to print a PDF with PDF Factory/and or Fine Print (both new updated versions)

and I also contacted those people. Uninstalled those versions in the meantime and reinstalled the old ones and so far it does not give me a problem.

Since it seems to be superantispyware related I thought I'll post it here too because I really have no idea for what reason this happened.

Hereunder a copy of a bugcheck analysis, I know everything can be the reason but anyway I would like your opinion about this as well.

Thank you.

1: kd> !analyze -v

*******************************************************************************

* *

* Bugcheck Analysis *

* *

*******************************************************************************

KERNEL_MODE_EXCEPTION_NOT_HANDLED_M (1000008e)

This is a very common bugcheck. Usually the exception address pinpoints

the driver/function that caused the problem. Always note this address

as well as the link date of the driver/image that contains this address.

Some common problems are exception code 0x80000003. This means a hard

coded breakpoint or assertion was hit, but this system was booted

/NODEBUG. This is not supposed to happen as developers should never have

hardcoded breakpoints in retail code, but ...

If this happens, make sure a debugger gets connected, and the

system is booted /DEBUG. This will let us see why this breakpoint is

happening.

Arguments:

Arg1: c0000005, The exception code that was not handled

Arg2: 82e2888f, The address that the exception occurred at

Arg3: cb29fb7c, Trap Frame

Arg4: 00000000

Debugging Details:

------------------

***** Kernel symbols are WRONG. Please fix symbols to do analysis.

*************************************************************************

*** ***

*** ***

*** Your debugger is not using the correct symbols ***

*** ***

*** In order for this command to work properly, your symbol path ***

*** must point to .pdb files that have full type information. ***

*** ***

*** Certain .pdb files (such as the public OS symbols) do not ***

*** contain the required information. Contact the group that ***

*** provided you with these symbols if you need this command to ***

*** work. ***

*** ***

*** Type referenced: nt!_KPRCB ***

*** ***

*************************************************************************

*************************************************************************

*** ***

*** ***

*** Your debugger is not using the correct symbols ***

*** ***

*** In order for this command to work properly, your symbol path ***

*** must point to .pdb files that have full type information. ***

*** ***

*** Certain .pdb files (such as the public OS symbols) do not ***

*** contain the required information. Contact the group that ***

*** provided you with these symbols if you need this command to ***

*** work. ***

*** ***

*** Type referenced: nt!KPRCB ***

*** ***

*************************************************************************

*************************************************************************

*** ***

*** ***

*** Your debugger is not using the correct symbols ***

*** ***

*** In order for this command to work properly, your symbol path ***

*** must point to .pdb files that have full type information. ***

*** ***

*** Certain .pdb files (such as the public OS symbols) do not ***

*** contain the required information. Contact the group that ***

*** provided you with these symbols if you need this command to ***

*** work. ***

*** ***

*** Type referenced: nt!_KPRCB ***

*** ***

*************************************************************************

*************************************************************************

*** ***

*** ***

*** Your debugger is not using the correct symbols ***

*** ***

*** In order for this command to work properly, your symbol path ***

*** must point to .pdb files that have full type information. ***

*** ***

*** Certain .pdb files (such as the public OS symbols) do not ***

*** contain the required information. Contact the group that ***

*** provided you with these symbols if you need this command to ***

*** work. ***

*** ***

*** Type referenced: nt!KPRCB ***

*** ***

*************************************************************************

*************************************************************************

*** ***

*** ***

*** Your debugger is not using the correct symbols ***

*** ***

*** In order for this command to work properly, your symbol path ***

*** must point to .pdb files that have full type information. ***

*** ***

*** Certain .pdb files (such as the public OS symbols) do not ***

*** contain the required information. Contact the group that ***

*** provided you with these symbols if you need this command to ***

*** work. ***

*** ***

*** Type referenced: nt!_KPRCB ***

*** ***

*************************************************************************

*************************************************************************

*** ***

*** ***

*** Your debugger is not using the correct symbols ***

*** ***

*** In order for this command to work properly, your symbol path ***

*** must point to .pdb files that have full type information. ***

*** ***

*** Certain .pdb files (such as the public OS symbols) do not ***

*** contain the required information. Contact the group that ***

*** provided you with these symbols if you need this command to ***

*** work. ***

*** ***

*** Type referenced: nt!_KPRCB ***

*** ***

*************************************************************************

*************************************************************************

*** ***

*** ***

*** Your debugger is not using the correct symbols ***

*** ***

*** In order for this command to work properly, your symbol path ***

*** must point to .pdb files that have full type information. ***

*** ***

*** Certain .pdb files (such as the public OS symbols) do not ***

*** contain the required information. Contact the group that ***

*** provided you with these symbols if you need this command to ***

*** work. ***

*** ***

*** Type referenced: nt!_KPRCB ***

*** ***

*************************************************************************

*************************************************************************

*** ***

*** ***

*** Your debugger is not using the correct symbols ***

*** ***

*** In order for this command to work properly, your symbol path ***

*** must point to .pdb files that have full type information. ***

*** ***

*** Certain .pdb files (such as the public OS symbols) do not ***

*** contain the required information. Contact the group that ***

*** provided you with these symbols if you need this command to ***

*** work. ***

*** ***

*** Type referenced: nt!_KPRCB ***

*** ***

*************************************************************************

AUTOBUG_OS_SKU: 3

FAULTING_MODULE: 82c16000 nt

DEBUG_FLR_IMAGE_TIMESTAMP: 48163ef6

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

FAULTING_IP:

nt+21288f

82e2888f 8b01 mov eax,dword ptr [ecx]

TRAP_FRAME: cb29fb7c -- (.trap 0xffffffffcb29fb7c)

ErrCode = 00000000

eax=00000000 ebx=fe6530a8 ecx=00000020 edx=cb29fbe4 esi=86a49030 edi=00000000

eip=82e2888f esp=cb29fbf0 ebp=cb29fc04 iopl=0 nv up ei pl zr na pe nc

cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010246

nt+0x21288f:

82e2888f 8b01 mov eax,dword ptr [ecx] ds:0023:00000020=????????

Resetting default scope

CUSTOMER_CRASH_COUNT: 2

DEFAULT_BUCKET_ID: WRONG_SYMBOLS

BUGCHECK_STR: 0x8E

CURRENT_IRQL: 0

LAST_CONTROL_TRANSFER: from 973a1c69 to 82e2888f

STACK_TEXT:

WARNING: Stack unwind information not available. Following frames may be wrong.

cb29fc04 973a1c69 fe6530a8 fe33eb40 fd76d180 nt+0x21288f

cb29fc18 97349d15 fd69edd0 86a49030 00000001 win32k+0x101c69

cb29fc2c 97349c93 86a49030 00000001 86a49030 win32k+0xa9d15

cb29fc48 82e24eab 86a49030 00000001 e7acce62 win32k+0xa9c93

cb29fcb4 82e253fb c0000374 00000000 86a49030 nt+0x20eeab

cb29fcd4 82df9160 86a49030 c0000374 00000001 nt+0x20f3fb

cb29fd04 911ccfc0 ffffffff c0000374 00000000 nt+0x1e3160

cb29fd34 82c6da1a ffffffff c0000374 061ccff0 SASKUTIL+0x8fc0

cb29fd44 77819a94 badb0d00 061ccfe8 00000000 nt+0x57a1a

cb29fd48 badb0d00 061ccfe8 00000000 00000000 0x77819a94

cb29fd4c 061ccfe8 00000000 00000000 00000000 0xbadb0d00

cb29fd50 00000000 00000000 00000000 00000000 0x61ccfe8

STACK_COMMAND: kb

FOLLOWUP_IP:

SASKUTIL+8fc0

911ccfc0 ?? ???

SYMBOL_STACK_INDEX: 7

SYMBOL_NAME: SASKUTIL+8fc0

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: SASKUTIL

IMAGE_NAME: SASKUTIL.sys

BUCKET_ID: WRONG_SYMBOLS

Followup: MachineOwner

---------

Share this post


Link to post
Share on other sites

The version installed is 4.24.1004

In the meantime I uninstalled PDF Factory and Fine Print and reversed to their previous versions and this seems to work for now. Although I'm still puzzled with : why did this happen ?

Thanks for your reply.

Share this post


Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now

×