# luafv.sys ?



## mathias_norman (Nov 23, 2008)

I recently got contacted by a friend that needed some help
with his laptop. For some reason it has started to give him
bluescreens and crashes, from working just fine.

Now, I did the standard stuff, uninstalling recent programs
and system restore (wich for some reason doesnt work)
and after reading 1 dump, it pointed towards mcafee being
the culprit, so I removed that. Few seconds later, new
crash, and here are the results


```
Microsoft (R) Windows Debugger Version 6.8.0004.0 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Windows\Minidump\Mini112308-04.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: *** Invalid ***
****************************************************************************
* Symbol loading may be unreliable without a symbol search path.           *
* Use .symfix to have the debugger choose a symbol path.                   *
* After setting your symbol path, use .reload to refresh symbol locations. *
****************************************************************************
Executable search path is: 
*********************************************************************
* Symbols can not be loaded because symbol path is not initialized. *
*                                                                   *
* The Symbol Path can be set by:                                    *
*   using the _NT_SYMBOL_PATH environment variable.                 *
*   using the -y <symbol_path> argument when starting the debugger. *
*   using .sympath and .sympath+                                    *
*********************************************************************
Unable to load image \SystemRoot\system32\ntkrnlpa.exe, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntkrnlpa.exe
*** ERROR: Module load completed but symbols could not be loaded for ntkrnlpa.exe
Windows Kernel Version 6001 (Service Pack 1) MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Kernel base = 0x81e00000 PsLoadedModuleList = 0x81f17c70
Debug session time: Sun Nov 23 11:44:57.884 2008 (GMT+1)
System Uptime: 0 days 0:05:36.602
*********************************************************************
* Symbols can not be loaded because symbol path is not initialized. *
*                                                                   *
* The Symbol Path can be set by:                                    *
*   using the _NT_SYMBOL_PATH environment variable.                 *
*   using the -y <symbol_path> argument when starting the debugger. *
*   using .sympath and .sympath+                                    *
*********************************************************************
Unable to load image \SystemRoot\system32\ntkrnlpa.exe, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntkrnlpa.exe
*** ERROR: Module load completed but symbols could not be loaded for ntkrnlpa.exe
Loading Kernel Symbols
..............................................................................................................................................................
Loading User Symbols
Loading unloaded module list
.....
Unable to load image \SystemRoot\system32\drivers\luafv.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for luafv.sys
*** ERROR: Module load completed but symbols could not be loaded for luafv.sys
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1000007E, {c0000005, 81e456e3, 8896bbdc, 8896b8d8}

***** Kernel symbols are WRONG. Please fix symbols to do analysis.

*************************************************************************
***                                                                   ***
***                                                                   ***
***    Your debugger is not using the correct symbols                 ***
***                                                                   ***
***    In order for this command to work properly, your symbol path   ***
***    must point to .pdb files that have full type information.      ***
***                                                                   ***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                          ***
***                                                                   ***
***    Type referenced: nt!_KPRCB                                     ***
***                                                                   ***
*************************************************************************
*************************************************************************
***                                                                   ***
***                                                                   ***
***    Your debugger is not using the correct symbols                 ***
***                                                                   ***
***    In order for this command to work properly, your symbol path   ***
***    must point to .pdb files that have full type information.      ***
***                                                                   ***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                          ***
***                                                                   ***
***    Type referenced: nt!KPRCB                                      ***
***                                                                   ***
*************************************************************************
*************************************************************************
***                                                                   ***
***                                                                   ***
***    Your debugger is not using the correct symbols                 ***
***                                                                   ***
***    In order for this command to work properly, your symbol path   ***
***    must point to .pdb files that have full type information.      ***
***                                                                   ***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                          ***
***                                                                   ***
***    Type referenced: nt!_KPRCB                                     ***
***                                                                   ***
*************************************************************************
*************************************************************************
***                                                                   ***
***                                                                   ***
***    Your debugger is not using the correct symbols                 ***
***                                                                   ***
***    In order for this command to work properly, your symbol path   ***
***    must point to .pdb files that have full type information.      ***
***                                                                   ***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                          ***
***                                                                   ***
***    Type referenced: nt!KPRCB                                      ***
***                                                                   ***
*************************************************************************
*************************************************************************
***                                                                   ***
***                                                                   ***
***    Your debugger is not using the correct symbols                 ***
***                                                                   ***
***    In order for this command to work properly, your symbol path   ***
***    must point to .pdb files that have full type information.      ***
***                                                                   ***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                          ***
***                                                                   ***
***    Type referenced: nt!_KPRCB                                     ***
***                                                                   ***
*************************************************************************
*************************************************************************
***                                                                   ***
***                                                                   ***
***    Your debugger is not using the correct symbols                 ***
***                                                                   ***
***    In order for this command to work properly, your symbol path   ***
***    must point to .pdb files that have full type information.      ***
***                                                                   ***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                          ***
***                                                                   ***
***    Type referenced: nt!_KPRCB                                     ***
***                                                                   ***
*************************************************************************
*************************************************************************
***                                                                   ***
***                                                                   ***
***    Your debugger is not using the correct symbols                 ***
***                                                                   ***
***    In order for this command to work properly, your symbol path   ***
***    must point to .pdb files that have full type information.      ***
***                                                                   ***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                          ***
***                                                                   ***
***    Type referenced: nt!_KPRCB                                     ***
***                                                                   ***
*************************************************************************
*************************************************************************
***                                                                   ***
***                                                                   ***
***    Your debugger is not using the correct symbols                 ***
***                                                                   ***
***    In order for this command to work properly, your symbol path   ***
***    must point to .pdb files that have full type information.      ***
***                                                                   ***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                          ***
***                                                                   ***
***    Type referenced: nt!_KPRCB                                     ***
***                                                                   ***
*************************************************************************
*********************************************************************
* Symbols can not be loaded because symbol path is not initialized. *
*                                                                   *
* The Symbol Path can be set by:                                    *
*   using the _NT_SYMBOL_PATH environment variable.                 *
*   using the -y <symbol_path> argument when starting the debugger. *
*   using .sympath and .sympath+                                    *
*********************************************************************
*********************************************************************
* Symbols can not be loaded because symbol path is not initialized. *
*                                                                   *
* The Symbol Path can be set by:                                    *
*   using the _NT_SYMBOL_PATH environment variable.                 *
*   using the -y <symbol_path> argument when starting the debugger. *
*   using .sympath and .sympath+                                    *
*********************************************************************
Probably caused by : luafv.sys ( luafv+9b6a )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

SYSTEM_THREAD_EXCEPTION_NOT_HANDLED_M (1000007e)
This is a very common bugcheck.  Usually the exception address pinpoints
the driver/function that caused the problem.  Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003.  This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG.  This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG.  This will let us see why this breakpoint is
happening.
Arguments:
Arg1: c0000005, The exception code that was not handled
Arg2: 81e456e3, The address that the exception occurred at
Arg3: 8896bbdc, Exception Record Address
Arg4: 8896b8d8, Context Record Address

Debugging Details:
------------------

***** Kernel symbols are WRONG. Please fix symbols to do analysis.

*************************************************************************
***                                                                   ***
***                                                                   ***
***    Your debugger is not using the correct symbols                 ***
***                                                                   ***
***    In order for this command to work properly, your symbol path   ***
***    must point to .pdb files that have full type information.      ***
***                                                                   ***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                          ***
***                                                                   ***
***    Type referenced: nt!_KPRCB                                     ***
***                                                                   ***
*************************************************************************
*************************************************************************
***                                                                   ***
***                                                                   ***
***    Your debugger is not using the correct symbols                 ***
***                                                                   ***
***    In order for this command to work properly, your symbol path   ***
***    must point to .pdb files that have full type information.      ***
***                                                                   ***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                          ***
***                                                                   ***
***    Type referenced: nt!KPRCB                                      ***
***                                                                   ***
*************************************************************************
*************************************************************************
***                                                                   ***
***                                                                   ***
***    Your debugger is not using the correct symbols                 ***
***                                                                   ***
***    In order for this command to work properly, your symbol path   ***
***    must point to .pdb files that have full type information.      ***
***                                                                   ***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                          ***
***                                                                   ***
***    Type referenced: nt!_KPRCB                                     ***
***                                                                   ***
*************************************************************************
*************************************************************************
***                                                                   ***
***                                                                   ***
***    Your debugger is not using the correct symbols                 ***
***                                                                   ***
***    In order for this command to work properly, your symbol path   ***
***    must point to .pdb files that have full type information.      ***
***                                                                   ***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                          ***
***                                                                   ***
***    Type referenced: nt!KPRCB                                      ***
***                                                                   ***
*************************************************************************
*************************************************************************
***                                                                   ***
***                                                                   ***
***    Your debugger is not using the correct symbols                 ***
***                                                                   ***
***    In order for this command to work properly, your symbol path   ***
***    must point to .pdb files that have full type information.      ***
***                                                                   ***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                          ***
***                                                                   ***
***    Type referenced: nt!_KPRCB                                     ***
***                                                                   ***
*************************************************************************
*************************************************************************
***                                                                   ***
***                                                                   ***
***    Your debugger is not using the correct symbols                 ***
***                                                                   ***
***    In order for this command to work properly, your symbol path   ***
***    must point to .pdb files that have full type information.      ***
***                                                                   ***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                          ***
***                                                                   ***
***    Type referenced: nt!_KPRCB                                     ***
***                                                                   ***
*************************************************************************
*************************************************************************
***                                                                   ***
***                                                                   ***
***    Your debugger is not using the correct symbols                 ***
***                                                                   ***
***    In order for this command to work properly, your symbol path   ***
***    must point to .pdb files that have full type information.      ***
***                                                                   ***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                          ***
***                                                                   ***
***    Type referenced: nt!_KPRCB                                     ***
***                                                                   ***
*************************************************************************
*************************************************************************
***                                                                   ***
***                                                                   ***
***    Your debugger is not using the correct symbols                 ***
***                                                                   ***
***    In order for this command to work properly, your symbol path   ***
***    must point to .pdb files that have full type information.      ***
***                                                                   ***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                          ***
***                                                                   ***
***    Type referenced: nt!_KPRCB                                     ***
***                                                                   ***
*************************************************************************
*********************************************************************
* Symbols can not be loaded because symbol path is not initialized. *
*                                                                   *
* The Symbol Path can be set by:                                    *
*   using the _NT_SYMBOL_PATH environment variable.                 *
*   using the -y <symbol_path> argument when starting the debugger. *
*   using .sympath and .sympath+                                    *
*********************************************************************
*********************************************************************
* Symbols can not be loaded because symbol path is not initialized. *
*                                                                   *
* The Symbol Path can be set by:                                    *
*   using the _NT_SYMBOL_PATH environment variable.                 *
*   using the -y <symbol_path> argument when starting the debugger. *
*   using .sympath and .sympath+                                    *
*********************************************************************

MODULE_NAME: luafv

FAULTING_MODULE: 81e00000 nt

DEBUG_FLR_IMAGE_TIMESTAMP:  47918afb

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - Instruktionen p  0x%08lx refererade till minnet p  0x%08lx. Det gick inte att utf ra en minnes tg rd. F ljande fel returnerades: The memory could not be %s.

FAULTING_IP: 
nt+456e3
81e456e3 3931            cmp     dword ptr [ecx],esi

EXCEPTION_RECORD:  8896bbdc -- (.exr 0xffffffff8896bbdc)
ExceptionAddress: 81e456e3 (nt+0x000456e3)
   ExceptionCode: c0000005 (Access violation)
  ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 00000000
   Parameter[1]: 00000004
Attempt to read from address 00000004

CONTEXT:  8896b8d8 -- (.cxr 0xffffffff8896b8d8)
eax=00000000 ebx=00000000 ecx=00000004 edx=97c00098 esi=967eee20 edi=95194a18
eip=81e456e3 esp=8896bca4 ebp=8896bcb0 iopl=0         nv up ei pl nz na po cy
cs=0008  ss=0010  ds=0023  es=0023  fs=0030  gs=0000             efl=00010203
nt+0x456e3:
81e456e3 3931            cmp     dword ptr [ecx],esi  ds:0023:00000004=????????
Resetting default scope

CUSTOMER_CRASH_COUNT:  4

DEFAULT_BUCKET_ID:  WRONG_SYMBOLS

BUGCHECK_STR:  0x7E

LAST_CONTROL_TRANSFER:  from 8d91db6a to 81e456e3

STACK_TEXT:  
WARNING: Stack unwind information not available. Following frames may be wrong.
8896bcb0 8d91db6a 967eee20 95194a18 967eee98 nt+0x456e3
8896bcc8 8d91db14 95194a18 967eee20 95197588 luafv+0x9b6a
8896bce4 8d91cf6a 95194a18 00000000 81e30e90 luafv+0x9b14
8896bd24 8d915347 00000000 81f0213c 83c84828 luafv+0x8f6a
8896bd44 81e38445 00000000 00000000 83c84828 luafv+0x1347
8896bd7c 81fd5b18 00000000 d1877f89 00000000 nt+0x38445
8896bdc0 81e2ea2e 81e38348 00000001 00000000 nt+0x1d5b18
00000000 00000000 00000000 00000000 00000000 nt+0x2ea2e


FOLLOWUP_IP: 
luafv+9b6a
8d91db6a ??              ???

SYMBOL_STACK_INDEX:  1

SYMBOL_NAME:  luafv+9b6a

FOLLOWUP_NAME:  MachineOwner

IMAGE_NAME:  luafv.sys

STACK_COMMAND:  .cxr 0xffffffff8896b8d8 ; kb

BUCKET_ID:  WRONG_SYMBOLS

Followup: MachineOwner
---------
```
so im guessing there is something regarding symbols.
I have installed the symbolspack for SP1 x86 (all languages)
but is there a way to repair that luafv.sys without reinstalling
and keep bugtracking?

Or am I barking up the wrong tree?


----------



## jcgriff2 (Sep 30, 2007)

Hi. . .

You're in the right neighborhood, but no way really that luafv.sys is the actual cause. It was left at the scene of the crash and got blamed. The real culprit got away undetected leaving the NT Kernel (!nt) and luafv behind. 

Nice job w/debugger - 2 suggestions...

- for your symbol path use

```
SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
```
This pulls symbols as needed from MS.

- use  !analyze -v;r;kv;lmtn;lmtsmn  instead of just !analyze -v. Type or paste the commands in red into the kd> command line at bottom of windbg GUI. You'll see the difference in output. Put all output in code box like you did last post. 

The bugcheck as you saw was *0x1000007e (0xc0000005, 0x81e456e3, 0x8896bbdc, 0x8896b8d8)*, probable cause = luafv.sys, the Microsoft UAC file virtualization driver. Note "probable", not actual.

0x1000007e is the same as 0x7e bugcheck = SYSTEM_THREAD_EXCEPTION_NOT_HANDLED = sys thread threw out exception - the 1st argument 0xc0000005 is exception = memory access violation. 


```
LAST_CONTROL_TRANSFER:  from [color=red]8d91db6a[/color] to 81e456e3

STACK_TEXT:  
WARNING: Stack unwind information not available. Following frames may be wrong.
8896bcb0 [color=red]8d91db6a[/color] 967eee20 95194a18 967eee98 [color=red]nt[/color]+0x456e3
8896bcc8 8d91db14 95194a18 967eee20 95197588 [color=blue]luafv[/color]+0x9b6a
8896bce4 8d91cf6a 95194a18 00000000 81e30e90 [color=blue]luafv[/color]+0x9b14
8896bd24 8d915347 00000000 81f0213c 83c84828 [color=blue]luafv[/color]+0x8f6a
8896bd44 81e38445 00000000 00000000 83c84828 [color=blue]luafv[/color]+0x1347
8896bd7c 81fd5b18 00000000 d1877f89 00000000 nt+0x38445
8896bdc0 81e2ea2e 81e38348 00000001 00000000 nt+0x1d5b18
00000000 00000000 00000000 00000000 00000000 nt+0x2ea2e
```
NT (ntkrnlmp.exe) would have been listed as prob cause b/c mem add [color]8d91db6a[/color] is NT, but luafv within, so it gets blame. Problem here is this is stack unwind info - post BSOD. Can't be relied on, but can help point us in right direction.

I need some sys info -
START | type cmd.exe | right-click on cmd | run as admin | paste in cmd/DOS screen (to paste, right-click at top of DOS screen, Edit, Paste)


```
driverquery /v > %temp%\0.txt & start notepad %temp%\0.txt
```
Notepad will open - save as text file.

msinfo32 saved as NFO file -
START | type msinfo32 - save w/NFO file ext

Zip these 2 up and attach to next post - along with new dbug output.

Many times anti-virus/ 3rd party firewall is to blame b/c of 0xc..5 excptn.

Any ? - just ask.

Regards. . .

jcgriff2

.


----------

