Na razie ostatnio wygenerowany bsod.
SYSTEM_THREAD_EXCEPTION_NOT_HANDLED_M (1000007e)
Oznacza to mniej więcej tyle iż wątek systemowy wygenerował wyjątek, który nie został dalej przechwycony.
Jest to błąd związany z tematem tzw page fault. Czyli tutaj sterownik igdkmd64.sys w trybie jądra (km w nazwie to kernel mode) naruszył dostęp do pamięci wirtualnej. Informuje pierwszy parametr o tym
ffffffffc0000005 -> NTSTATUS
Żeby ktoś nie myślał iż jest to błąd sterownika i trzeba go aktualizować.....nie
Sterownik ten odwołał się w pewnym momencie do fragmentu pamięci wirtualnej (pamięć stronicowana -> paged memory) poprzez dowiązanie (referencja) czyli wskaźnik na ten obiekt.
Wyjątek ten po przeanalizowaniu powstał przez wspomniany igdkmd64.sys (Intel Graphics driver) odwołując się do nieprawidłowego adresu pamięci. Nawiązując do adresu wyjątku (argument nr 3) oraz adresu kontekstu (argument nr 4) sprawa wywaliła się kiedy nastąpiło wywołanie wskaźnika adresu w rejestrze RAX patrząc po wartościach rejestrów procesora. Ta wartość wynosiła rax=00000000c0000001 i jest nieprawidłowa. Całe to zamieszanie sprawiło iż nastąpiła próba zapisu do nieznanej wartości ?
1: kd> .exr 0xfffff88007de72b8
ExceptionAddress: fffff88004fb5db9 (igdkmd64+0x000000000018edb9)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 0000000000000000
Parameter[1]: 0000000000000048
Attempt to read from address 0000000000000048
1: kd> .cxr 0xfffff88007de6b10
rax=00000000c0000001 rbx=00000000c0000001 rcx=0000000000000000
rdx=0000000000000000 rsi=fffffa800b477150 rdi=fffff88007de75e4
rip=fffff88004fb5db9 rsp=fffff88007de74f0 rbp=0000000000000003
r8=0000000000000000 r9=0000000000000000 r10=fffffa800b7089e0
r11=fffff88007de7380 r12=0000000000000001 r13=0000000000000000
r14=fffffa800b7063a0 r15=0000000000000057
iopl=0 nv up ei pl zr na po nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010246
igdkmd64+0x18edb9:
fffff880`04fb5db9 41ff5148 call qword ptr [r9+48h] ds:002b:
00000000`00000048=?
W takim przypadku trzeba zrobić dwie rzeczy.
Wykonać weryfikację sterowników - verifier -> opis sobie znajdziesz w wyszukiwarce.
Druga rzecz to puszczenie memtest'a na kilka godzin.
Musimy się dowiedzieć skąd te zmiany w strukturze pamięci czy to jest problem rycia przez inny soft czy tez uszkodzenie pamięci lub jej nieprawidłowy setup.
Kod:
Microsoft (R) Windows Debugger Version 6.12.0002.633 X86
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [C: \Users\user\Desktop\bsody\103\081014-40170-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: symsrv*symsrv.dll*c: \symb*http: //msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.18409.amd64fre.win7sp1_gdr.140303-2144
Machine Name:
Kernel base = 0xfffff800`02c4c000 PsLoadedModuleList = 0xfffff800`02e8f890
Debug session time: Sun Aug 10 01: 35: 38.378 2014 (UTC + 2: 00)
System Uptime: 0 days 0: 08: 05.643
Loading Kernel Symbols
...............................................................
................................................................
...............................
Loading User Symbols
Loading unloaded module list
.......
Unable to load image \SystemRoot\system32\DRIVERS\igdkmd64.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for igdkmd64.sys
*** ERROR: Module load completed but symbols could not be loaded for igdkmd64.sys
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 1000007E, {ffffffffc0000005, fffff88004fb5db9, fffff88007de72b8, fffff88007de6b10}
Probably caused by : igdkmd64.sys ( igdkmd64+18edb9 )
Followup: MachineOwner
---------
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
SYSTEM_THREAD_EXCEPTION_NOT_HANDLED_M (1000007e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003. This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG. This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG. This will let us see why this breakpoint is
happening.
Arguments:
Arg1: ffffffffc0000005, The exception code that was not handled
Arg2: fffff88004fb5db9, The address that the exception occurred at
Arg3: fffff88007de72b8, Exception Record Address
Arg4: fffff88007de6b10, Context Record Address
Debugging Details:
------------------
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - Instrukcja spod 0x%08lx odwo
FAULTING_IP:
igdkmd64+18edb9
fffff880`04fb5db9 41ff5148 call qword ptr [r9+48h]
EXCEPTION_RECORD: fffff88007de72b8 -- (.exr 0xfffff88007de72b8)
ExceptionAddress: fffff88004fb5db9 (igdkmd64+0x000000000018edb9)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 0000000000000000
Parameter[1]: 0000000000000048
Attempt to read from address 0000000000000048
CONTEXT: fffff88007de6b10 -- (.cxr 0xfffff88007de6b10)
rax=00000000c0000001 rbx=00000000c0000001 rcx=0000000000000000
rdx=0000000000000000 rsi=fffffa800b477150 rdi=fffff88007de75e4
rip=fffff88004fb5db9 rsp=fffff88007de74f0 rbp=0000000000000003
r8=0000000000000000 r9=0000000000000000 r10=fffffa800b7089e0
r11=fffff88007de7380 r12=0000000000000001 r13=0000000000000000
r14=fffffa800b7063a0 r15=0000000000000057
iopl=0 nv up ei pl zr na po nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010246
igdkmd64+0x18edb9:
fffff880`04fb5db9 41ff5148 call qword ptr [r9+48h] ds: 002b: 00000000`00000048=?
Resetting default scope
CUSTOMER_CRASH_COUNT: 1
PROCESS_NAME: csrss.exe
CURRENT_IRQL: 0
ERROR_CODE: (NTSTATUS) 0xc0000005 - Instrukcja spod 0x%08lx odwo
EXCEPTION_PARAMETER1: 0000000000000000
EXCEPTION_PARAMETER2: 0000000000000048
READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80002ef9100
0000000000000048
FOLLOWUP_IP:
igdkmd64+18edb9
fffff880`04fb5db9 41ff5148 call qword ptr [r9+48h]
BUGCHECK_STR: 0x7E
DEFAULT_BUCKET_ID: NULL_CLASS_PTR_DEREFERENCE
LAST_CONTROL_TRANSFER: from fffff88007de75b0 to fffff88004fb5db9
STACK_TEXT:
fffff880`07de74f0 fffff880`07de75b0 : 00000000`c0000001 00000000`00000000 00000000`00000003 00000000`00000000 : igdkmd64+0x18edb9
fffff880`07de74f8 00000000`c0000001 : 00000000`00000000 00000000`00000003 00000000`00000000 00000000`00000000 : 0xfffff880`07de75b0
fffff880`07de7500 00000000`00000000 : 00000000`00000003 00000000`00000000 00000000`00000000 00000000`00000003 : 0xc0000001
SYMBOL_STACK_INDEX: 0
SYMBOL_NAME: igdkmd64+18edb9
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: igdkmd64
IMAGE_NAME: igdkmd64.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 5376e2df
STACK_COMMAND: .cxr 0xfffff88007de6b10 ; kb
FAILURE_BUCKET_ID: X64_0x7E_igdkmd64+18edb9
BUCKET_ID: X64_0x7E_igdkmd64+18edb9
Followup: MachineOwner
---------
rax=00000000c0000001 rbx=00000000c0000001 rcx=0000000000000000
rdx=0000000000000000 rsi=fffffa800b477150 rdi=fffff88007de75e4
rip=fffff88004fb5db9 rsp=fffff88007de74f0 rbp=0000000000000003
r8=0000000000000000 r9=0000000000000000 r10=fffffa800b7089e0
r11=fffff88007de7380 r12=0000000000000001 r13=0000000000000000
r14=fffffa800b7063a0 r15=0000000000000057
iopl=0 nv up ei pl zr na po nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010246
igdkmd64+0x18edb9:
fffff880`04fb5db9 41ff5148 call qword ptr [r9+48h] ds: 002b: 00000000`00000048=?
Child-SP RetAddr : Args to Child : Call Site
fffff880`07de74f0 fffff880`07de75b0 : 00000000`c0000001 00000000`00000000 00000000`00000003 00000000`00000000 : igdkmd64+0x18edb9
fffff880`07de74f8 00000000`c0000001 : 00000000`00000000 00000000`00000003 00000000`00000000 00000000`00000000 : 0xfffff880`07de75b0
fffff880`07de7500 00000000`00000000 : 00000000`00000003 00000000`00000000 00000000`00000000 00000000`00000003 : 0xc0000001
start end module name
fffff800`00bc8000 fffff800`00bd2000 kdcom kdcom.dll Sat Feb 05 17: 52: 49 2011 (4D4D8061)
fffff800`02c03000 fffff800`02c4c000 hal hal.dll Sat Nov 20 14: 00: 25 2010 (4CE7C669)
fffff800`02c4c000 fffff800`03231000 nt ntkrnlmp.exe Tue Mar 04 09: 38: 19 2014 (531590FB)
fffff880`00c00000 fffff880`00c5e000 msrpc msrpc.sys Sat Nov 20 10: 21: 56 2010 (4CE79334)
fffff880`00c5e000 fffff880`00ca7000 fwpkclnt fwpkclnt.sys Sat Apr 05 03: 23: 21 2014 (533F5B09)
fffff880`00ca7000 fffff880`00cf6000 mcupdate_GenuineIntel mcupdate_GenuineIntel.dll Sat Nov 20 14: 03: 51 2010 (4CE7C737)
fffff880`00cf6000 fffff880`00d0a000 PSHED PSHED.dll Tue Jul 14 03: 32: 23 2009 (4A5BE027)
fffff880`00d0a000 fffff880`00d68000 CLFS CLFS.SYS Tue Jul 14 01: 19: 57 2009 (4A5BC11D)
fffff880`00d68000 fffff880`00db4000 fltmgr fltmgr.sys Sat Nov 20 10: 19: 24 2010 (4CE7929C)
fffff880`00db4000 fffff880`00e00000 volsnap volsnap.sys Sat Nov 20 10: 20: 08 2010 (4CE792C8)
fffff880`00e00000 fffff880`00e3c000 vmbus vmbus.sys Sat Nov 20 10: 57: 29 2010 (4CE79B89)
fffff880`00e3c000 fffff880`00e50000 winhv winhv.sys Sat Nov 20 10: 20: 02 2010 (4CE792C2)
fffff880`00e50000 fffff880`00e7a000 ataport ataport.SYS Sat Nov 20 10: 19: 15 2010 (4CE79293)
fffff880`00e7a000 fffff880`00e85000 amdxata amdxata.sys Fri Mar 19 17: 18: 18 2010 (4BA3A3CA)
fffff880`00e85000 fffff880`00e99000 fileinfo fileinfo.sys Tue Jul 14 01: 34: 25 2009 (4A5BC481)
fffff880`00e99000 fffff880`00ea6000 TDI TDI.SYS Sat Nov 20 10: 22: 06 2010 (4CE7933E)
fffff880`00eb6000 fffff880`00f76000 CI CI.dll Sat Nov 20 14: 12: 36 2010 (4CE7C944)
fffff880`00f76000 fffff880`00fd2000 volmgrx volmgrx.sys Sat Nov 20 10: 20: 43 2010 (4CE792EB)
fffff880`00fd2000 fffff880`00ff4000 tdx tdx.sys Sat Nov 20 10: 21: 54 2010 (4CE79332)
fffff880`01000000 fffff880`0100a000 msisadrv msisadrv.sys Tue Jul 14 01: 19: 26 2009 (4A5BC0FE)
fffff880`0100a000 fffff880`0103d000 pci pci.sys Sat Nov 20 10: 19: 11 2010 (4CE7928F)
fffff880`0103d000 fffff880`0104a000 vdrvroot vdrvroot.sys Tue Jul 14 02: 01: 31 2009 (4A5BCADB)
fffff880`0104a000 fffff880`01061000 CSCrySec CSCrySec.sys Mon Dec 07 09: 34: 23 2009 (4B1CBE0F)
fffff880`01061000 fffff880`01076000 partmgr partmgr.sys Sat Mar 17 06: 06: 09 2012 (4F641BC1)
fffff880`01076000 fffff880`0108b000 volmgr volmgr.sys Sat Nov 20 10: 19: 28 2010 (4CE792A0)
fffff880`0108b000 fffff880`01092000 pciide pciide.sys Tue Jul 14 01: 19: 49 2009 (4A5BC115)
fffff880`01092000 fffff880`010a2000 PCIIDEX PCIIDEX.SYS Tue Jul 14 01: 19: 48 2009 (4A5BC114)
fffff880`010a2000 fffff880`010bc000 mountmgr mountmgr.sys Sat Nov 20 10: 19: 21 2010 (4CE79299)
fffff880`010bc000 fffff880`010c5000 atapi atapi.sys Tue Jul 14 01: 19: 47 2009 (4A5BC113)
fffff880`010cd000 fffff880`0118f000 Wdf01000 Wdf01000.sys Sat Jun 22 05: 13: 05 2013 (51C51641)
fffff880`0118f000 fffff880`0119f000 WDFLDR WDFLDR.SYS Thu Jul 26 04: 29: 04 2012 (5010AB70)
fffff880`0119f000 fffff880`011f6000 ACPI ACPI.sys Sat Nov 20 10: 19: 16 2010 (4CE79294)
fffff880`011f6000 fffff880`011ff000 WMILIB WMILIB.SYS Tue Jul 14 01: 19: 51 2009 (4A5BC117)
fffff880`01200000 fffff880`0121b000 ksecdd ksecdd.sys Sat Apr 12 03: 08: 30 2014 (5348920E)
fffff880`0121b000 fffff880`01247000 ksecpkg ksecpkg.sys Sat Apr 12 03: 24: 10 2014 (534895BA)
fffff880`0124c000 fffff880`013ee000 Ntfs Ntfs.sys Fri Apr 12 13: 54: 36 2013 (5167F5FC)
fffff880`013ee000 fffff880`013f8000 speedfan speedfan.sys Sat Dec 29 21: 59: 35 2012 (50DF59B7)
fffff880`01400000 fffff880`01408000 spldr spldr.sys Mon May 11 18: 56: 27 2009 (4A0858BB)
fffff880`0140a000 fffff880`0147c000 cng cng.sys Wed Aug 01 17: 48: 07 2012 (50194FB7)
fffff880`0147c000 fffff880`0148d000 pcw pcw.sys Tue Jul 14 01: 19: 27 2009 (4A5BC0FF)
fffff880`0148d000 fffff880`01497000 Fs_Rec Fs_Rec.sys Thu Mar 01 04: 41: 06 2012 (4F4EEFD2)
fffff880`01497000 fffff880`0158a000 ndis ndis.sys Sat Nov 20 10: 23: 30 2010 (4CE79392)
fffff880`0158a000 fffff880`015ea000 NETIO NETIO.SYS Tue Nov 26 11: 21: 01 2013 (5294760D)
fffff880`015ea000 fffff880`015fa000 vmstorfl vmstorfl.sys Sat Nov 20 10: 57: 30 2010 (4CE79B8A)
fffff880`01601000 fffff880`01800000 tcpip tcpip.sys Sat Apr 05 03: 26: 44 2014 (533F5BD4)
fffff880`01800000 fffff880`0185d000 klif klif.sys Thu Nov 26 10: 07: 11 2009 (4B0E453F)
fffff880`0185d000 fffff880`01866000 Null Null.SYS Tue Jul 14 01: 19: 37 2009 (4A5BC109)
fffff880`01866000 fffff880`0186d000 Beep Beep.SYS Tue Jul 14 02: 00: 13 2009 (4A5BCA8D)
fffff880`0186d000 fffff880`018a7000 rdyboost rdyboost.sys Sat Nov 20 10: 43: 10 2010 (4CE7982E)
fffff880`018a7000 fffff880`018b9000 mup mup.sys Tue Jul 14 01: 23: 45 2009 (4A5BC201)
fffff880`018b9000 fffff880`018c7000 klbg klbg.sys Wed Oct 14 19: 18: 13 2009 (4AD607D5)
fffff880`018c7000 fffff880`018d0000 hwpolicy hwpolicy.sys Sat Nov 20 10: 18: 54 2010 (4CE7927E)
fffff880`018d0000 fffff880`0190a000 fvevol fvevol.sys Sat Nov 20 10: 24: 06 2010 (4CE793B6)
fffff880`0190a000 fffff880`01920000 disk disk.sys Tue Jul 14 01: 19: 57 2009 (4A5BC11D)
fffff880`01920000 fffff880`01950000 CLASSPNP CLASSPNP.SYS Sat Nov 20 10: 19: 23 2010 (4CE7929B)
fffff880`01986000 fffff880`01994000 vga vga.sys Tue Jul 14 01: 38: 47 2009 (4A5BC587)
fffff880`01994000 fffff880`019b9000 VIDEOPRT VIDEOPRT.SYS Tue Jul 14 01: 38: 51 2009 (4A5BC58B)
fffff880`019b9000 fffff880`019c9000 watchdog watchdog.sys Tue Jul 14 01: 37: 35 2009 (4A5BC53F)
fffff880`019c9000 fffff880`019d2000 RDPCDD RDPCDD.sys Tue Jul 14 02: 16: 34 2009 (4A5BCE62)
fffff880`019d2000 fffff880`019db000 rdpencdd rdpencdd.sys Tue Jul 14 02: 16: 34 2009 (4A5BCE62)
fffff880`019db000 fffff880`019e4000 rdprefmp rdprefmp.sys Tue Jul 14 02: 16: 35 2009 (4A5BCE63)
fffff880`019e4000 fffff880`019ef000 Msfs Msfs.SYS Tue Jul 14 01: 19: 47 2009 (4A5BC113)
fffff880`019ef000 fffff880`01a00000 Npfs Npfs.SYS Tue Jul 14 01: 19: 48 2009 (4A5BC114)
fffff880`03e00000 fffff880`03e3d000 portcls portcls.sys Fri Oct 04 03: 36: 02 2013 (524E1B82)
fffff880`03e3d000 fffff880`03e5f000 drmk drmk.sys Fri Oct 04 04: 16: 30 2013 (524E24FE)
fffff880`03e5f000 fffff880`03e74000 NDProxy NDProxy.SYS Sat Nov 20 11: 52: 20 2010 (4CE7A864)
fffff880`03e94000 fffff880`03f17000 csc csc.sys Sat Nov 20 10: 27: 12 2010 (4CE79470)
fffff880`03f17000 fffff880`03f28000 blbdrive blbdrive.sys Tue Jul 14 01: 35: 59 2009 (4A5BC4DF)
fffff880`03f28000 fffff880`03f4e000 tunnel tunnel.sys Sat Nov 20 11: 51: 50 2010 (4CE7A846)
fffff880`03f4e000 fffff880`03f64000 intelppm intelppm.sys Tue Jul 14 01: 19: 25 2009 (4A5BC0FD)
fffff880`03f64000 fffff880`03fa7000 ks ks.sys Sat Nov 20 11: 33: 23 2010 (4CE7A3F3)
fffff880`03fa7000 fffff880`03fef000 dtsoftbus01 dtsoftbus01.sys Fri Feb 21 10: 49: 36 2014 (53072130)
fffff880`04023000 fffff880`0454c000 kl1 kl1.sys Tue Sep 01 13: 29: 21 2009 (4A9D0591)
fffff880`0454c000 fffff880`045d5000 afd afd.sys Fri May 30 08: 45: 48 2014 (5388291C)
fffff880`04800000 fffff880`0480c000 nsiproxy nsiproxy.sys Tue Jul 14 01: 21: 02 2009 (4A5BC15E)
fffff880`0480c000 fffff880`04817000 mssmbios mssmbios.sys Tue Jul 14 01: 31: 10 2009 (4A5BC3BE)
fffff880`04817000 fffff880`04826000 discache discache.sys Tue Jul 14 01: 37: 18 2009 (4A5BC52E)
fffff880`04826000 fffff880`04844000 dfsc dfsc.sys Sat Nov 20 10: 26: 31 2010 (4CE79447)
fffff880`04844000 fffff880`04857000 CSVirtualDiskDrv CSVirtualDiskDrv.sys Mon Dec 07 09: 34: 27 2009 (4B1CBE13)
fffff880`04857000 fffff880`048b1000 usbhub usbhub.sys Wed Nov 27 02: 41: 36 2013 (52954DD0)
fffff880`048cc000 fffff880`04911000 netbt netbt.sys Sat Nov 20 10: 23: 18 2010 (4CE79386)
fffff880`04911000 fffff880`0491a000 wfplwf wfplwf.sys Tue Jul 14 02: 09: 26 2009 (4A5BCCB6)
fffff880`0491a000 fffff880`04940000 pacer pacer.sys Sat Nov 20 11: 52: 18 2010 (4CE7A862)
fffff880`04940000 fffff880`0494a000 klim6 klim6.sys Mon Sep 14 12: 46: 26 2009 (4AAE1F02)
fffff880`0494a000 fffff880`04959000 netbios netbios.sys Tue Jul 14 02: 09: 26 2009 (4A5BCCB6)
fffff880`04959000 fffff880`04976000 serial serial.sys Tue Jul 14 02: 00: 40 2009 (4A5BCAA8)
fffff880`04976000 fffff880`04991000 wanarp wanarp.sys Sat Nov 20 11: 52: 36 2010 (4CE7A874)
fffff880`04991000 fffff880`049a5000 termdd termdd.sys Sat Nov 20 12: 03: 40 2010 (4CE7AB0C)
fffff880`049a5000 fffff880`049f6000 rdbss rdbss.sys Sat Nov 20 10: 27: 51 2010 (4CE79497)
fffff880`04c00000 fffff880`04c56000 USBPORT USBPORT.SYS Wed Nov 27 02: 41: 11 2013 (52954DB7)
fffff880`04c56000 fffff880`04c73000 parport parport.sys Tue Jul 14 02: 00: 40 2009 (4A5BCAA8)
fffff880`04c73000 fffff880`04c7e000 rdpbus rdpbus.sys Tue Jul 14 02: 17: 46 2009 (4A5BCEAA)
fffff880`04c7e000 fffff880`04c7fe80 USBD USBD.SYS Wed Nov 27 02: 41: 03 2013 (52954DAF)
fffff880`04c82000 fffff880`04d76000 dxgkrnl dxgkrnl.sys Thu Aug 01 09: 58: 53 2013 (51FA153D)
fffff880`04d76000 fffff880`04dbc000 dxgmms1 dxgmms1.sys Wed Apr 10 05: 27: 15 2013 (5164DC13)
fffff880`04dbc000 fffff880`04de0000 HDAudBus HDAudBus.sys Sat Nov 20 11: 43: 42 2010 (4CE7A65E)
fffff880`04de0000 fffff880`04df0000 CompositeBus CompositeBus.sys Sat Nov 20 11: 33: 17 2010 (4CE7A3ED)
fffff880`04df0000 fffff880`04dfc000 ndistapi ndistapi.sys Tue Jul 14 02: 10: 00 2009 (4A5BCCD8)
fffff880`04e00000 fffff880`04e12000 usbehci usbehci.sys Wed Nov 27 02: 41: 11 2013 (52954DB7)
fffff880`04e12000 fffff880`04e25500 EtronXHCI EtronXHCI.sys Mon Jul 25 23: 30: 56 2011 (4E2DE090)
fffff880`04e27000 fffff880`051e0000 igdkmd64 igdkmd64.sys Sat May 17 06: 17: 35 2014 (5376E2DF)
fffff880`051e0000 fffff880`051f1000 HECIx64 HECIx64.sys Wed Oct 20 01: 33: 43 2010 (4CBE2AD7)
fffff880`051f1000 fffff880`051fd000 serenum serenum.sys Tue Jul 14 02: 00: 33 2009 (4A5BCAA1)
fffff880`051fd000 fffff880`051fe480 swenum swenum.sys Tue Jul 14 02: 00: 18 2009 (4A5BCA92)
fffff880`08881000 fffff880`088b5000 nvhda64v nvhda64v.sys Thu Nov 28 14: 38: 09 2013 (52974741)
fffff880`088b5000 fffff880`08911000 HdAudio HdAudio.sys Sat Nov 20 11: 44: 23 2010 (4CE7A687)
fffff880`08911000 fffff880`0892e000 usbccgp usbccgp.sys Wed Nov 27 02: 41: 15 2013 (52954DBB)
fffff880`0892e000 fffff880`08948d00 usbaudio usbaudio.sys Fri Jul 12 12: 40: 58 2013 (51DFDD3A)
fffff880`08949000 fffff880`0899ca80 lvrs64 lvrs64.sys Wed Jan 18 07: 40: 36 2012 (4F166964)
fffff880`08a00000 fffff880`08a2d000 mrxsmb mrxsmb.sys Wed Apr 27 04: 40: 38 2011 (4DB78226)
fffff880`08a2d000 fffff880`08a7b000 mrxsmb10 mrxsmb10.sys Sat Jul 09 04: 46: 28 2011 (4E17C104)
fffff880`08a7b000 fffff880`08a9f000 mrxsmb20 mrxsmb20.sys Wed Apr 27 04: 39: 37 2011 (4DB781E9)
fffff880`08afa000 fffff880`08bc3000 HTTP HTTP.sys Sat Nov 20 10: 24: 30 2010 (4CE793CE)
fffff880`08bc3000 fffff880`08be1000 bowser bowser.sys Wed Feb 23 05: 55: 04 2011 (4D649328)
fffff880`08be1000 fffff880`08bf9000 mpsdrv mpsdrv.sys Tue Jul 14 02: 08: 25 2009 (4A5BCC79)
fffff880`08e0e000 fffff880`08e31000 luafv luafv.sys Tue Jul 14 01: 26: 13 2009 (4A5BC295)
fffff880`08e31000 fffff880`08e52000 WudfPf WudfPf.sys Sat Nov 20 11: 42: 44 2010 (4CE7A624)
fffff880`08e52000 fffff880`08e67000 lltdio lltdio.sys Tue Jul 14 02: 08: 50 2009 (4A5BCC92)
fffff880`08e67000 fffff880`08e7f000 rspndr rspndr.sys Tue Jul 14 02: 08: 50 2009 (4A5BCC92)
fffff880`08ead000 fffff880`0934ed00 lvuvc64 lvuvc64.sys Wed Jan 18 07: 41: 08 2012 (4F166984)
fffff880`0934f000 fffff880`0935d000 hidusb hidusb.sys Sat Nov 20 11: 43: 49 2010 (4CE7A665)
fffff880`0935d000 fffff880`09376000 HIDCLASS HIDCLASS.SYS Wed Jul 03 06: 05: 05 2013 (51D3A2F1)
fffff880`09376000 fffff880`0937e080 HIDPARSE HIDPARSE.SYS Wed Jul 03 06: 05: 04 2013 (51D3A2F0)
fffff880`0937f000 fffff880`0938d000 sshid sshid.sys Tue Feb 25 22: 50: 04 2014 (530D100C)
fffff880`0938d000 fffff880`0939a000 mouhid mouhid.sys Tue Jul 14 02: 00: 20 2009 (4A5BCA94)
fffff880`0939a000 fffff880`093a4000 klmouflt klmouflt.sys Fri Oct 02 17: 38: 29 2009 (4AC61E75)
fffff880`093a4000 fffff880`093b2000 kbdhid kbdhid.sys Sat Nov 20 11: 33: 25 2010 (4CE7A3F5)
fffff880`093b2000 fffff880`093c0000 crashdmp crashdmp.sys Tue Jul 14 02: 01: 01 2009 (4A5BCABD)
fffff880`093c0000 fffff880`093cc000 dump_dumpata dump_dumpata.sys Tue Jul 14 01: 19: 47 2009 (4A5BC113)
fffff880`093cc000 fffff880`093d5000 dump_atapi dump_atapi.sys Tue Jul 14 01: 19: 47 2009 (4A5BC113)
fffff880`093d5000 fffff880`093e8000 dump_dumpfve dump_dumpfve.sys Tue Jul 14 01: 21: 51 2009 (4A5BC18F)
fffff880`093e8000 fffff880`093f4000 Dxapi Dxapi.sys Tue Jul 14 01: 38: 28 2009 (4A5BC574)
fffff880`0963d000 fffff880`096e3000 peauth peauth.sys Tue Jul 14 03: 01: 19 2009 (4A5BD8DF)
fffff880`096e3000 fffff880`096ee000 secdrv secdrv.SYS Wed Sep 13 15: 18: 38 2006 (4508052E)
fffff880`096ee000 fffff880`0971f000 srvnet srvnet.sys Fri Apr 29 05: 05: 35 2011 (4DBA2AFF)
fffff880`0971f000 fffff880`09731000 tcpipreg tcpipreg.sys Sat Nov 20 11: 51: 48 2010 (4CE7A844)
fffff880`09731000 fffff880`0979a000 srv2 srv2.sys Fri Apr 29 05: 05: 46 2011 (4DBA2B0A)
fffff880`09852000 fffff880`098ea000 srv srv.sys Fri Apr 29 05: 06: 06 2011 (4DBA2B1E)
fffff880`098ea000 fffff880`098f4000 NvStreamKms NvStreamKms.sys Fri Jul 25 13: 35: 56 2014 (53D2411C)
fffff880`098f4000 fffff880`09965000 spsys spsys.sys Mon May 11 19: 20: 58 2009 (4A085E7A)
fffff880`09965000 fffff880`09970000 asyncmac asyncmac.sys Tue Jul 14 02: 10: 13 2009 (4A5BCCE5)
fffff880`0bcfa000 fffff880`0c988000 nvlddmkm nvlddmkm.sys Wed Jul 02 19: 42: 02 2014 (53B4446A)
fffff880`0f000000 fffff880`0f01b000 raspppoe raspppoe.sys Tue Jul 14 02: 10: 17 2009 (4A5BCCE9)
fffff880`0f01b000 fffff880`0f03c000 raspptp raspptp.sys Sat Nov 20 11: 52: 31 2010 (4CE7A86F)
fffff880`0f03c000 fffff880`0f056000 rassstp rassstp.sys Tue Jul 14 02: 10: 25 2009 (4A5BCCF1)
fffff880`0f056000 fffff880`0f065000 kbdclass kbdclass.sys Tue Jul 14 01: 19: 50 2009 (4A5BC116)
fffff880`0f065000 fffff880`0f074000 mouclass mouclass.sys Tue Jul 14 01: 19: 50 2009 (4A5BC116)
fffff880`0f074000 fffff880`0f086000 umbus umbus.sys Sat Nov 20 11: 44: 37 2010 (4CE7A695)
fffff880`0f086000 fffff880`0f093000 nvvad64v nvvad64v.sys Fri Mar 28 14: 32: 06 2014 (533579D6)
fffff880`0f093000 fffff880`0f098200 ksthunk ksthunk.sys Tue Jul 14 02: 00: 19 2009 (4A5BCA93)
fffff880`0f099000 fffff880`0f0a6e80 EtronHub3 EtronHub3.sys Mon Jul 25 23: 30: 59 2011 (4E2DE093)
fffff880`0fd0f000 fffff880`0fd93000 Rt64win7 Rt64win7.sys Wed Jun 01 05: 15: 51 2011 (4DE5AEE7)
fffff880`0fd93000 fffff880`0fda9000 AgileVpn AgileVpn.sys Tue Jul 14 02: 10: 24 2009 (4A5BCCF0)
fffff880`0fda9000 fffff880`0fdcd000 rasl2tp rasl2tp.sys Sat Nov 20 11: 52: 34 2010 (4CE7A872)
fffff880`0fdcd000 fffff880`0fdfc000 ndiswan ndiswan.sys Sat Nov 20 11: 52: 32 2010 (4CE7A870)
fffff960`00000000 fffff960`00317000 win32k win32k.sys Wed Jun 18 03: 10: 16 2014 (53A0E6F8)
fffff960`00460000 fffff960`0046a000 TSDDD TSDDD.dll Tue Jul 14 02: 16: 34 2009 (4A5BCE62)
fffff960`006a0000 fffff960`006c7000 cdd cdd.dll Thu Feb 03 12: 25: 25 2011 (4D4A90A5)
fffff960`00960000 fffff960`009c1000 ATMFD ATMFD.DLL Thu Jun 06 05: 30: 53 2013 (51B0026D)
Unloaded modules:
fffff880`0f0ab000 fffff880`0fd0f000 nvlddmkm.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ImageSize: 00C64000
fffff880`08e00000 fffff880`08e0e000 monitor.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ImageSize: 0000E000
fffff880`01950000 fffff880`0195e000 crashdmp.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ImageSize: 0000E000
fffff880`0195e000 fffff880`0196a000 dump_ataport
Timestamp: unavailable (00000000)
Checksum: 00000000
ImageSize: 0000C000
fffff880`0196a000 fffff880`01973000 dump_atapi.s
Timestamp: unavailable (00000000)
Checksum: 00000000
ImageSize: 00009000
fffff880`01973000 fffff880`01986000 dump_dumpfve
Timestamp: unavailable (00000000)
Checksum: 00000000
ImageSize: 00013000
fffff880`01986000 fffff880`019b0000 cdrom.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ImageSize: 0002A000
Bugcheck code 1000007E
Arguments ffffffff`c0000005 fffff880`04fb5db9 fffff880`07de72b8 fffff880`07de6b10
sysinfo: could not find necessary interfaces.
sysinfo: note that mssmbios.sys must be loaded (XPSP2+).
sysinfo: could not find necessary interfaces.
sysinfo: note that mssmbios.sys must be loaded (XPSP2+).
sysinfo: could not find necessary interfaces.
sysinfo: note that mssmbios.sys must be loaded (XPSP2+).
sysinfo: could not find necessary interfaces.
sysinfo: note that mssmbios.sys must be loaded (XPSP2+).
1: kd> lmvm igdkmd64
start end module name
fffff880`04e27000 fffff880`051e0000 igdkmd64 T (no symbols)
Loaded symbol image file: igdkmd64.sys
Image path: \SystemRoot\system32\DRIVERS\igdkmd64.sys
Image name: igdkmd64.sys
Timestamp: Sat May 17 06: 17: 35 2014 (5376E2DF)
CheckSum: 0039E1ED
ImageSize: 003B9000
Translations: 0000.04b0 0000.04e4 0409.04b0 0409.04e4
1: kd> .exr 0xfffff88007de72b8
ExceptionAddress: fffff88004fb5db9 (igdkmd64+0x000000000018edb9)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 0000000000000000
Parameter[1]: 0000000000000048
Attempt to read from address 0000000000000048
1: kd> .cxr 0xfffff88007de6b10
rax=00000000c0000001 rbx=00000000c0000001 rcx=0000000000000000
rdx=0000000000000000 rsi=fffffa800b477150 rdi=fffff88007de75e4
rip=fffff88004fb5db9 rsp=fffff88007de74f0 rbp=0000000000000003
r8=0000000000000000 r9=0000000000000000 r10=fffffa800b7089e0
r11=fffff88007de7380 r12=0000000000000001 r13=0000000000000000
r14=fffffa800b7063a0 r15=0000000000000057
iopl=0 nv up ei pl zr na po nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010246
igdkmd64+0x18edb9:
fffff880`04fb5db9 41ff5148 call qword ptr [r9+48h] ds: 002b: 00000000`00000048=?
1: kd> u @rip
igdkmd64+0x18edb9:
fffff880`04fb5db9 41ff5148 call qword ptr [r9+48h]
fffff880`04fb5dbd e9c8010000 jmp igdkmd64+0x18ef8a (fffff880`04fb5f8a)
fffff880`04fb5dc2 488bce mov rcx,rsi
fffff880`04fb5dc5 ff5620 call qword ptr [rsi+20h]
fffff880`04fb5dc8 448bcd mov r9d,ebp
fffff880`04fb5dcb 4c8bc7 mov r8,rdi
fffff880`04fb5dce 8bd0 mov edx,eax
fffff880`04fb5dd0 8b8658080000 mov eax,dword ptr [rsi+858h]
Następny
PAGE_FAULT_IN_NONPAGED_AREA (50)
Plik Avasta podczas instalacji odwołał się do pamięci aby zapisać w nim informacje. Niestety został zgłoszony błąd iż takiego adresu nie odnaleziono i zapis się nie udał.
O i le weryfikacja sterowników niczego nie wykaże to jest to problem sprzętowy z pamięciami
Kod:
Microsoft (R) Windows Debugger Version 6.12.0002.633 X86
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [C: \Users\user\Desktop\bsody\103\081014-26925-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: symsrv*symsrv.dll*c: \symb*http: //msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.18409.amd64fre.win7sp1_gdr.140303-2144
Machine Name:
Kernel base = 0xfffff800`02c5f000 PsLoadedModuleList = 0xfffff800`02ea2890
Debug session time: Sun Aug 10 02: 21: 31.866 2014 (UTC + 2: 00)
System Uptime: 0 days 0: 08: 47.865
Loading Kernel Symbols
...............................................................
................................................................
......................................
Loading User Symbols
Loading unloaded module list
......
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 50, {fffff9610025ea68, 0, fffffa80045e8f36, 5}
Unable to load image \SystemRoot\system32\drivers\aswSnx.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for aswSnx.sys
*** ERROR: Module load completed but symbols could not be loaded for aswSnx.sys
Could not read faulting driver name
Probably caused by : aswSnx.sys ( aswSnx+2fd73 )
Followup: MachineOwner
---------
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced. This cannot be protected by try-except,
it must be protected by a Probe. Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: fffff9610025ea68, memory referenced.
Arg2: 0000000000000000, value 0 = read operation, 1 = write operation.
Arg3: fffffa80045e8f36, If non-zero, the instruction address which referenced the bad memory
address.
Arg4: 0000000000000005, (reserved)
Debugging Details:
------------------
Could not read faulting driver name
READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80002f0c100
fffff9610025ea68
FAULTING_IP:
+52a42faf046ddb38
fffffa80`045e8f36 ff20 jmp qword ptr [rax]
MM_INTERNAL_CODE: 5
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
BUGCHECK_STR: 0x50
PROCESS_NAME: setup.exe
CURRENT_IRQL: 0
TRAP_FRAME: fffff880071fb290 -- (.trap 0xfffff880071fb290)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=fffff9610025ea68 rbx=0000000000000000 rcx=ffffffffc5010a30
rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000
rip=fffffa80045e8f36 rsp=fffff880071fb428 rbp=0000000000cc0020
r8=0000000000000000 r9=00000000000000b4 r10=fffffa80045b1010
r11=fffff80002cd3e00 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl zr na po nc
fffffa80`045e8f36 ff20 jmp qword ptr [rax] ds: fffff961`0025ea68=?
Resetting default scope
LAST_CONTROL_TRANSFER: from fffff80002d515b3 to fffff80002cd4bc0
STACK_TEXT:
fffff880`071fb128 fffff800`02d515b3 : 00000000`00000050 fffff961`0025ea68 00000000`00000000 fffff880`071fb290 : nt!KeBugCheckEx
fffff880`071fb130 fffff800`02cd2cee : 00000000`00000000 fffff961`0025ea68 fffff880`071fb300 ffffffff`c5010a30 : nt! ? : FNODOBFM: `string'+0x43801
fffff880`071fb290 fffffa80`045e8f36 : fffff880`0ef03d73 ffffffff`c5010a30 fffff880`071fb5c0 00000000`000000b4 : nt!KiPageFault+0x16e
fffff880`071fb428 fffff880`0ef03d73 : ffffffff`c5010a30 fffff880`071fb5c0 00000000`000000b4 fffff880`071fb4e8 : 0xfffffa80`045e8f36
fffff880`071fb430 ffffffff`c5010a30 : fffff880`071fb5c0 00000000`000000b4 fffff880`071fb4e8 fffff900`0000001c : aswSnx+0x2fd73
fffff880`071fb438 fffff880`071fb5c0 : 00000000`000000b4 fffff880`071fb4e8 fffff900`0000001c ffffffff`960114fe : 0xffffffff`c5010a30
fffff880`071fb440 00000000`000000b4 : fffff880`071fb4e8 fffff900`0000001c ffffffff`960114fe 00000000`00000000 : 0xfffff880`071fb5c0
fffff880`071fb448 fffff880`071fb4e8 : fffff900`0000001c ffffffff`960114fe 00000000`00000000 fffff960`00000000 : 0xb4
fffff880`071fb450 fffff900`0000001c : ffffffff`960114fe 00000000`00000000 fffff960`00000000 00000000`000000b4 : 0xfffff880`071fb4e8
fffff880`071fb458 ffffffff`960114fe : 00000000`00000000 fffff960`00000000 00000000`000000b4 00000000`0000001c : 0xfffff900`0000001c
fffff880`071fb460 00000000`00000000 : fffff960`00000000 00000000`000000b4 00000000`0000001c 00000000`00cc0020 : 0xffffffff`960114fe
STACK_COMMAND: kb
FOLLOWUP_IP:
aswSnx+2fd73
fffff880`0ef03d73 ? ?
SYMBOL_STACK_INDEX: 4
SYMBOL_NAME: aswSnx+2fd73
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: aswSnx
IMAGE_NAME: aswSnx.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 53ac0554
FAILURE_BUCKET_ID: X64_0x50_aswSnx+2fd73
BUCKET_ID: X64_0x50_aswSnx+2fd73
Followup: MachineOwner
---------
2: kd> lmvm aswSnx
start end module name
fffff880`0eed4000 fffff880`0efd6000 aswSnx T (no symbols)
Loaded symbol image file: aswSnx.sys
Image path: \SystemRoot\system32\drivers\aswSnx.sys
Image name: aswSnx.sys
Timestamp: Thu Jun 26 13: 34: 44 2014 (53AC0554)
CheckSum: 0010D6F6
ImageSize: 00102000
Translations: 0000.04b0 0000.04e4 0409.04b0 0409.04e4
2: kd> !pte fffff9610025ea68
VA fffff9610025ea68
PXE at FFFFF6FB7DBEDF90 PPE at FFFFF6FB7DBF2C20 PDE at FFFFF6FB7E584008 PTE at FFFFF6FCB08012F0
contains 000000007CA8F863 contains 0000000000000000
GetUlongFromAddress: unable to read from fffff80002f0c5dc
pfn 7ca8f ---DA--KWEV not valid
2: kd> kv
Child-SP RetAddr : Args to Child : Call Site
fffff880`071fb128 fffff800`02d515b3 : 00000000`00000050 fffff961`0025ea68 00000000`00000000 fffff880`071fb290 : nt!KeBugCheckEx
fffff880`071fb130 fffff800`02cd2cee : 00000000`00000000 fffff961`0025ea68 fffff880`071fb300 ffffffff`c5010a30 : nt! ? : FNODOBFM: `string'+0x43801
fffff880`071fb290 fffffa80`045e8f36 : fffff880`0ef03d73 ffffffff`c5010a30 fffff880`071fb5c0 00000000`000000b4 : nt!KiPageFault+0x16e (TrapFrame @ fffff880`071fb290)
fffff880`071fb428 fffff880`0ef03d73 : ffffffff`c5010a30 fffff880`071fb5c0 00000000`000000b4 fffff880`071fb4e8 : 0xfffffa80`045e8f36
fffff880`071fb430 ffffffff`c5010a30 : fffff880`071fb5c0 00000000`000000b4 fffff880`071fb4e8 fffff900`0000001c : aswSnx+0x2fd73
fffff880`071fb438 fffff880`071fb5c0 : 00000000`000000b4 fffff880`071fb4e8 fffff900`0000001c ffffffff`960114fe : 0xffffffff`c5010a30
fffff880`071fb440 00000000`000000b4 : fffff880`071fb4e8 fffff900`0000001c ffffffff`960114fe 00000000`00000000 : 0xfffff880`071fb5c0
fffff880`071fb448 fffff880`071fb4e8 : fffff900`0000001c ffffffff`960114fe 00000000`00000000 fffff960`00000000 : 0xb4
fffff880`071fb450 fffff900`0000001c : ffffffff`960114fe 00000000`00000000 fffff960`00000000 00000000`000000b4 : 0xfffff880`071fb4e8
fffff880`071fb458 ffffffff`960114fe : 00000000`00000000 fffff960`00000000 00000000`000000b4 00000000`0000001c : 0xfffff900`0000001c
fffff880`071fb460 00000000`00000000 : fffff960`00000000 00000000`000000b4 00000000`0000001c 00000000`00cc0020 : 0xffffffff`960114fe
2: kd> .trap fffff880`071fb290
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=fffff9610025ea68 rbx=0000000000000000 rcx=ffffffffc5010a30
rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000
rip=fffffa80045e8f36 rsp=fffff880071fb428 rbp=0000000000cc0020
r8=0000000000000000 r9=00000000000000b4 r10=fffffa80045b1010
r11=fffff80002cd3e00 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl zr na po nc
fffffa80`045e8f36 ff20 jmp qword ptr [rax] ds: fffff961`0025ea68=?