Jedziemy po kolei od najnowszego
NTFS_FILE_SYSTEM (24)
Sterownik systemowy ntfs.sys zgłosił wyjątek w dostępie do danych na dysku twardym - nie jest przyczyną żeby była jasność.
Najczęstsze usterki to zaczynając od najbardziej prawdopodobnych, oczywiście najpierw należy przeprowadzić analizę bsoda a dopiero potem powziąć kolejne odpowiednie środki
- uszkodzenie dysku twardego (bad sectory), błędne odczyty smart
Diagnostyka np
http://traxter-online.net/mhdd-victoria-...styka-hdd/
Jeśli faktycznie jest uszkodzony to także takie informacje znajdą się w systemowym dzienniku zdarzeń (eventvwr.msc) przy wpisach oznaczonych nagłówkiem Disk.
Minimum to także uruchomienie polecenia chkdsk /f /r
- uszkodzona struktura NTFS, uszkodzona tablica partycji
- niewystarczająca ilość pamięci fizycznej
- sterownik urządzenia np sterownik ahci kontrolera dysków
- indeksacja
- program antywirusowy (usunąć)
- aplikacja do defragmentacji lub backupu
Kod:
Microsoft (R) Windows Debugger Version 6.12.0002.633 X86
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [C: \Users\user\Desktop\bsody\134\042515-35583-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: symsrv*symsrv.dll*c: \symb*http: //msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7601.18798.amd64fre.win7sp1_gdr.150316-1654
Machine Name:
Kernel base = 0xfffff800`03010000 PsLoadedModuleList = 0xfffff800`03255890
Debug session time: Sat Apr 25 16: 14: 27.736 2015 (UTC + 2: 00)
System Uptime: 0 days 2: 20: 09.922
Loading Kernel Symbols
...............................................................
................................................................
..........................
Loading User Symbols
Loading unloaded module list
..........
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 24, {1904fb, fffff8800ab45da8, fffff8800ab45600, fffff880010fc6f5}
Probably caused by : Ntfs.sys ( Ntfs!NtfsFindPrefixHashEntry+22c )
Followup: MachineOwner
---------
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
NTFS_FILE_SYSTEM (24)
If you see NtfsExceptionFilter on the stack then the 2nd and 3rd
parameters are the exception record and context record. Do a .cxr
on the 3rd parameter and then kb to obtain a more informative stack
trace.
Arguments:
Arg1: 00000000001904fb
Arg2: fffff8800ab45da8
Arg3: fffff8800ab45600
Arg4: fffff880010fc6f5
Debugging Details:
------------------
EXCEPTION_RECORD: fffff8800ab45da8 -- (.exr 0xfffff8800ab45da8)
ExceptionAddress: fffff880010fc6f5 (Ntfs!NtfsFindPrefixHashEntry+0x000000000000022c)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 0000000000000000
Parameter[1]: ffffffffffffffff
Attempt to read from address ffffffffffffffff
CONTEXT: fffff8800ab45600 -- (.cxr 0xfffff8800ab45600)
rax=0000000000000064 rbx=fffff8a00de89e60 rcx=00000000000005e4
rdx=0000000000000001 rsi=fffff8a00020d990 rdi=f9806faf8f880460
rip=fffff880010fc6f5 rsp=fffff8800ab45fe0 rbp=00000000000062b0
r8=000000000b6586f2 r9=0000000000000000 r10=0000000000000001
r11=fffff8800ab46028 r12=fffff8a00cb783a8 r13=fffff8800ab46580
r14=00000000000002f2 r15=00000000000006f2
iopl=0 nv up ei pl zr na po nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010246
Ntfs!NtfsFindPrefixHashEntry+0x22c:
fffff880`010fc6f5 0fb78718020000 movzx eax,word ptr [rdi+218h] ds: 002b: f9806faf`8f880678=?
Resetting default scope
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VERIFIER_ENABLED_VISTA_MINIDUMP
PROCESS_NAME: Steam.exe
CURRENT_IRQL: 0
ERROR_CODE: (NTSTATUS) 0xc0000005 - Instrukcja spod 0x%08lx odwo
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - Instrukcja spod 0x%08lx odwo
EXCEPTION_PARAMETER1: 0000000000000000
EXCEPTION_PARAMETER2: ffffffffffffffff
READ_ADDRESS: GetPointerFromAddress: unable to read from fffff800032bf100
ffffffffffffffff
FOLLOWUP_IP:
Ntfs!NtfsFindPrefixHashEntry+22c
fffff880`010fc6f5 0fb78718020000 movzx eax,word ptr [rdi+218h]
FAULTING_IP:
Ntfs!NtfsFindPrefixHashEntry+22c
fffff880`010fc6f5 0fb78718020000 movzx eax,word ptr [rdi+218h]
BUGCHECK_STR: 0x24
LAST_CONTROL_TRANSFER: from 0000000000000000 to fffff880010fc6f5
STACK_TEXT:
fffff880`0ab45fe0 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : Ntfs!NtfsFindPrefixHashEntry+0x22c
SYMBOL_STACK_INDEX: 0
SYMBOL_NAME: Ntfs!NtfsFindPrefixHashEntry+22c
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: Ntfs
IMAGE_NAME: Ntfs.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 52e1be8a
STACK_COMMAND: .cxr 0xfffff8800ab45600 ; kb
FAILURE_BUCKET_ID: X64_0x24_VRFK_Ntfs!NtfsFindPrefixHashEntry+22c
BUCKET_ID: X64_0x24_VRFK_Ntfs!NtfsFindPrefixHashEntry+22c
Followup: MachineOwner
---------
rax=fffff880010fc6f5 rbx=fffffa8007e106c0 rcx=0000000000000024
rdx=00000000001904fb rsi=fffff8800ab44e80 rdi=00000000c0000005
rip=fffff80003082a40 rsp=fffff8800ab44dd8 rbp=00000000c00000d8
r8=fffff8800ab45da8 r9=fffff8800ab45600 r10=fffffa8007493000
r11=fffffa8007493bac r12=fffff880010a0034 r13=000000000000f3ad
r14=fffff88001054000 r15=fffff8800ab45da8
iopl=0 nv up ei ng nz na po nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00000286
nt!KeBugCheckEx:
fffff800`03082a40 48894c2408 mov qword ptr [rsp+8],rcx ss: 0018: fffff880`0ab44de0=0000000000000024
Child-SP RetAddr : Args to Child : Call Site
fffff880`0ab44dd8 fffff880`01058211 : 00000000`00000024 00000000`001904fb fffff880`0ab45da8 fffff880`0ab45600 : nt!KeBugCheckEx
fffff880`0ab44de0 fffff880`0105eb8b : fffff880`010a0040 fffff880`0ab463b0 fffff880`0ab463b0 00000000`00000018 : Ntfs! ? : FNODOBFM: `string'+0x299d
fffff880`0ab44e20 fffff800`030ae89c : 00000000`00073e18 fffff800`0308d267 fffff980`afc74000 fffff980`91c42000 : Ntfs! ? : FNODOBFM: `string'+0xee8
fffff880`0ab44e50 fffff800`030ae31d : fffff880`010a0034 fffff880`0ab463b0 00000000`00000000 fffff880`01054000 : nt!_C_specific_handler+0x8c
fffff880`0ab44ec0 fffff800`030ad0f5 : fffff880`010a0034 fffff880`0ab44f38 fffff880`0ab45da8 fffff880`01054000 : nt!RtlpExecuteHandlerForException+0xd
fffff880`0ab44ef0 fffff800`030be081 : fffff880`0ab45da8 fffff880`0ab45600 fffff880`00000000 f9806faf`8f880460 : nt!RtlDispatchException+0x415
fffff880`0ab455d0 fffff800`030820c2 : fffff880`0ab45da8 fffff8a0`0de89e60 fffff880`0ab45e50 fffff8a0`0020d990 : nt!KiDispatchException+0x135
fffff880`0ab45c70 fffff800`030809ca : 00000000`00000000 fffff8a0`0cb783c0 00000000`80000000 fffff8a0`0de89e60 : nt!KiExceptionDispatch+0xc2
fffff880`0ab45e50 fffff880`010fc6f5 : fffff880`0ab46580 fffff8a0`0020d990 fffffa80`08704180 00000000`00000000 : nt!KiGeneralProtectionFault+0x10a (TrapFrame @ fffff880`0ab45e50)
fffff880`0ab45fe0 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : Ntfs!NtfsFindPrefixHashEntry+0x22c
start end module name
fffff800`00bc0000 fffff800`00bca000 kdcom kdcom.dll Sat Feb 05 17: 52: 49 2011 (4D4D8061)
fffff800`03010000 fffff800`035f8000 nt ntkrnlmp.exe Tue Mar 17 05: 02: 04 2015 (5507A73C)
fffff800`035f8000 fffff800`03641000 hal hal.dll Sat Nov 20 14: 00: 25 2010 (4CE7C669)
fffff880`00c00000 fffff880`00c4c000 fltmgr fltmgr.sys Sat Nov 20 10: 19: 24 2010 (4CE7929C)
fffff880`00c4c000 fffff880`00c60000 fileinfo fileinfo.sys Tue Jul 14 01: 34: 25 2009 (4A5BC481)
fffff880`00c7e000 fffff880`00c8b000 mcupdate_AuthenticAMD mcupdate_AuthenticAMD.dll Tue Jul 14 03: 29: 09 2009 (4A5BDF65)
fffff880`00c8b000 fffff880`00c9f000 PSHED PSHED.dll Tue Jul 14 03: 32: 23 2009 (4A5BE027)
fffff880`00c9f000 fffff880`00cfd000 CLFS CLFS.SYS Wed Mar 04 04: 21: 12 2015 (54F67A28)
fffff880`00cfd000 fffff880`00d72000 CI CI.dll Fri Jun 27 04: 04: 21 2014 (53ACD125)
fffff880`00d72000 fffff880`00dce000 volmgrx volmgrx.sys Sat Nov 20 10: 20: 43 2010 (4CE792EB)
fffff880`00dce000 fffff880`00df8000 ataport ataport.SYS Mon Aug 05 03: 02: 45 2013 (51FEF9B5)
fffff880`00e00000 fffff880`00e33000 pci pci.sys Sat Nov 20 10: 19: 11 2010 (4CE7928F)
fffff880`00e33000 fffff880`00e40000 vdrvroot vdrvroot.sys Tue Jul 14 02: 01: 31 2009 (4A5BCADB)
fffff880`00e40000 fffff880`00e55000 partmgr partmgr.sys Sat Mar 17 06: 06: 09 2012 (4F641BC1)
fffff880`00e55000 fffff880`00e6a000 volmgr volmgr.sys Sat Nov 20 10: 19: 28 2010 (4CE792A0)
fffff880`00e6a000 fffff880`00e71000 pciide pciide.sys Tue Jul 14 01: 19: 49 2009 (4A5BC115)
fffff880`00e71000 fffff880`00e81000 PCIIDEX PCIIDEX.SYS Tue Jul 14 01: 19: 48 2009 (4A5BC114)
fffff880`00e81000 fffff880`00e9b000 mountmgr mountmgr.sys Tue Feb 03 03: 14: 35 2015 (54D02F0B)
fffff880`00e9f000 fffff880`00f61000 Wdf01000 Wdf01000.sys Sat Jun 22 05: 13: 05 2013 (51C51641)
fffff880`00f61000 fffff880`00f71000 WDFLDR WDFLDR.SYS Thu Jul 26 04: 29: 04 2012 (5010AB70)
fffff880`00f71000 fffff880`00fc8000 ACPI ACPI.sys Sat Nov 20 10: 19: 16 2010 (4CE79294)
fffff880`00fc8000 fffff880`00fd1000 WMILIB WMILIB.SYS Tue Jul 14 01: 19: 51 2009 (4A5BC117)
fffff880`00fd1000 fffff880`00fdb000 msisadrv msisadrv.sys Tue Jul 14 01: 19: 26 2009 (4A5BC0FE)
fffff880`00fdb000 fffff880`00fe4000 atapi atapi.sys Tue Jul 14 01: 19: 47 2009 (4A5BC113)
fffff880`00fe4000 fffff880`00fef000 amdxata amdxata.sys Fri Mar 19 17: 18: 18 2010 (4BA3A3CA)
fffff880`01000000 fffff880`01030000 CLASSPNP CLASSPNP.SYS Sat Nov 20 10: 19: 23 2010 (4CE7929B)
fffff880`01054000 fffff880`011fd000 Ntfs Ntfs.sys Fri Jan 24 02: 14: 50 2014 (52E1BE8A)
fffff880`01200000 fffff880`01209000 hwpolicy hwpolicy.sys Sat Nov 20 10: 18: 54 2010 (4CE7927E)
fffff880`01209000 fffff880`01243000 fvevol fvevol.sys Thu Jan 24 04: 11: 24 2013 (5100A65C)
fffff880`01243000 fffff880`01259000 disk disk.sys Tue Jul 14 01: 19: 57 2009 (4A5BC11D)
fffff880`0126c000 fffff880`012ca000 msrpc msrpc.sys Sat Nov 20 10: 21: 56 2010 (4CE79334)
fffff880`012ca000 fffff880`012e5000 ksecdd ksecdd.sys Tue Mar 17 04: 51: 03 2015 (5507A4A7)
fffff880`012e5000 fffff880`01357000 cng cng.sys Fri Jan 30 04: 17: 08 2015 (54CAF7B4)
fffff880`01357000 fffff880`01368000 pcw pcw.sys Tue Jul 14 01: 19: 27 2009 (4A5BC0FF)
fffff880`01368000 fffff880`01372000 Fs_Rec Fs_Rec.sys Thu Mar 01 04: 41: 06 2012 (4F4EEFD2)
fffff880`01372000 fffff880`013be000 volsnap volsnap.sys Sat Nov 20 10: 20: 08 2010 (4CE792C8)
fffff880`013be000 fffff880`013f8000 rdyboost rdyboost.sys Sat Nov 20 10: 43: 10 2010 (4CE7982E)
fffff880`01400000 fffff880`0142c000 ksecpkg ksecpkg.sys Tue Mar 17 05: 07: 58 2015 (5507A89E)
fffff880`0142c000 fffff880`01475000 fwpkclnt fwpkclnt.sys Sat Apr 05 03: 23: 21 2014 (533F5B09)
fffff880`01475000 fffff880`0148b000 epfwwfp epfwwfp.sys Wed Jan 28 14: 02: 37 2015 (54C8DDED)
fffff880`0148b000 fffff880`01493000 spldr spldr.sys Mon May 11 18: 56: 27 2009 (4A0858BB)
fffff880`01493000 fffff880`014a5000 mup mup.sys Tue Jul 14 01: 23: 45 2009 (4A5BC201)
fffff880`014a6000 fffff880`01598000 ndis ndis.sys Wed Aug 22 17: 11: 46 2012 (5034F6B2)
fffff880`01598000 fffff880`015f8000 NETIO NETIO.SYS Tue Nov 26 11: 21: 01 2013 (5294760D)
fffff880`01601000 fffff880`01800000 tcpip tcpip.sys Sat Apr 05 03: 26: 44 2014 (533F5BD4)
fffff880`03c00000 fffff880`03c14000 termdd termdd.sys Sat Nov 20 12: 03: 40 2010 (4CE7AB0C)
fffff880`03c14000 fffff880`03c65000 rdbss rdbss.sys Sat Nov 20 10: 27: 51 2010 (4CE79497)
fffff880`03c65000 fffff880`03c71000 nsiproxy nsiproxy.sys Tue Jul 14 01: 21: 02 2009 (4A5BC15E)
fffff880`03c71000 fffff880`03c7c000 mssmbios mssmbios.sys Tue Jul 14 01: 31: 10 2009 (4A5BC3BE)
fffff880`03c7c000 fffff880`03c8b000 discache discache.sys Tue Jul 14 01: 37: 18 2009 (4A5BC52E)
fffff880`03c8b000 fffff880`03c9c000 blbdrive blbdrive.sys Tue Jul 14 01: 35: 59 2009 (4A5BC4DF)
fffff880`03c9f000 fffff880`03d28000 afd afd.sys Fri May 30 08: 45: 48 2014 (5388291C)
fffff880`03d28000 fffff880`03d6d000 netbt netbt.sys Sat Nov 20 10: 23: 18 2010 (4CE79386)
fffff880`03d6d000 fffff880`03d76000 wfplwf wfplwf.sys Tue Jul 14 02: 09: 26 2009 (4A5BCCB6)
fffff880`03d76000 fffff880`03d9c000 pacer pacer.sys Sat Nov 20 11: 52: 18 2010 (4CE7A862)
fffff880`03d9c000 fffff880`03daa000 EpfwLWF EpfwLWF.sys Tue Jan 20 11: 41: 00 2015 (54BE30BC)
fffff880`03daa000 fffff880`03db9000 netbios netbios.sys Tue Jul 14 02: 09: 26 2009 (4A5BCCB6)
fffff880`03db9000 fffff880`03dd6000 serial serial.sys Tue Jul 14 02: 00: 40 2009 (4A5BCAA8)
fffff880`03dd6000 fffff880`03df1000 wanarp wanarp.sys Sat Nov 20 11: 52: 36 2010 (4CE7A874)
fffff880`03df1000 fffff880`03df9000 AppleCharger AppleCharger.sys Mon Jan 10 10: 57: 29 2011 (4D2AD809)
fffff880`03e00000 fffff880`03e25000 VIDEOPRT VIDEOPRT.SYS Tue Jul 14 01: 38: 51 2009 (4A5BC58B)
fffff880`03e25000 fffff880`03e35000 watchdog watchdog.sys Tue Jul 14 01: 37: 35 2009 (4A5BC53F)
fffff880`03e35000 fffff880`03e3e000 RDPCDD RDPCDD.sys Tue Jul 14 02: 16: 34 2009 (4A5BCE62)
fffff880`03e3e000 fffff880`03e47000 rdpencdd rdpencdd.sys Tue Jul 14 02: 16: 34 2009 (4A5BCE62)
fffff880`03e47000 fffff880`03e50000 rdprefmp rdprefmp.sys Tue Jul 14 02: 16: 35 2009 (4A5BCE63)
fffff880`03e50000 fffff880`03e5b000 Msfs Msfs.SYS Tue Jul 14 01: 19: 47 2009 (4A5BC113)
fffff880`03e5b000 fffff880`03e6c000 Npfs Npfs.SYS Tue Jul 14 01: 19: 48 2009 (4A5BC114)
fffff880`03e6c000 fffff880`03e8e000 tdx tdx.sys Tue Nov 11 02: 46: 26 2014 (54616A72)
fffff880`03e8e000 fffff880`03e9b000 TDI TDI.SYS Sat Nov 20 10: 22: 06 2010 (4CE7933E)
fffff880`03e9b000 fffff880`03eb9000 dfsc dfsc.sys Sat Nov 20 10: 26: 31 2010 (4CE79447)
fffff880`03ed7000 fffff880`03fa6000 eamonm eamonm.sys Tue Jan 20 11: 39: 35 2015 (54BE3067)
fffff880`03fa6000 fffff880`03faf000 Null Null.SYS Tue Jul 14 01: 19: 37 2009 (4A5BC109)
fffff880`03faf000 fffff880`03fb6000 Beep Beep.SYS Tue Jul 14 02: 00: 13 2009 (4A5BCA8D)
fffff880`03fb6000 fffff880`03fe3000 ehdrv ehdrv.sys Tue Jan 20 11: 39: 52 2015 (54BE3078)
fffff880`03fe3000 fffff880`03ff1000 vga vga.sys Tue Jul 14 01: 38: 47 2009 (4A5BC587)
fffff880`04000000 fffff880`0401a000 rassstp rassstp.sys Tue Jul 14 02: 10: 25 2009 (4A5BCCF1)
fffff880`0401a000 fffff880`04029000 mouclass mouclass.sys Tue Jul 14 01: 19: 50 2009 (4A5BC116)
fffff880`0402a000 fffff880`04050000 tunnel tunnel.sys Sat Nov 20 11: 51: 50 2010 (4CE7A846)
fffff880`04050000 fffff880`04065000 amdppm amdppm.sys Tue Jul 14 01: 19: 25 2009 (4A5BC0FD)
fffff880`04065000 fffff880`0406e000 wmiacpi wmiacpi.sys Tue Jul 14 01: 31: 02 2009 (4A5BC3B6)
fffff880`0406e000 fffff880`04163000 dxgkrnl dxgkrnl.sys Mon Jun 16 02: 58: 04 2014 (539E411C)
fffff880`04163000 fffff880`04187000 rasl2tp rasl2tp.sys Sat Nov 20 11: 52: 34 2010 (4CE7A872)
fffff880`04187000 fffff880`041b6000 ndiswan ndiswan.sys Sat Nov 20 11: 52: 32 2010 (4CE7A870)
fffff880`041b6000 fffff880`041d1000 raspppoe raspppoe.sys Tue Jul 14 02: 10: 17 2009 (4A5BCCE9)
fffff880`041d1000 fffff880`041f2000 raspptp raspptp.sys Sat Nov 20 11: 52: 31 2010 (4CE7A86F)
fffff880`04600000 fffff880`04656000 USBPORT USBPORT.SYS Wed Nov 27 02: 41: 11 2013 (52954DB7)
fffff880`04656000 fffff880`04668000 usbehci usbehci.sys Wed Nov 27 02: 41: 11 2013 (52954DB7)
fffff880`04668000 fffff880`04675000 fdc fdc.sys Tue Jul 14 02: 00: 54 2009 (4A5BCAB6)
fffff880`04675000 fffff880`04681000 serenum serenum.sys Tue Jul 14 02: 00: 33 2009 (4A5BCAA1)
fffff880`04681000 fffff880`0469e000 parport parport.sys Tue Jul 14 02: 00: 40 2009 (4A5BCAA8)
fffff880`0469e000 fffff880`046ae000 CompositeBus CompositeBus.sys Sat Nov 20 11: 33: 17 2010 (4CE7A3ED)
fffff880`046ae000 fffff880`046c4000 AgileVpn AgileVpn.sys Tue Jul 14 02: 10: 24 2009 (4A5BCCF0)
fffff880`046c4000 fffff880`046d0000 ndistapi ndistapi.sys Tue Jul 14 02: 10: 00 2009 (4A5BCCD8)
fffff880`046d9000 fffff880`05111000 nvlddmkm nvlddmkm.sys Wed Apr 08 22: 32: 37 2015 (55259065)
fffff880`05111000 fffff880`05157000 dxgmms1 dxgmms1.sys Wed Apr 10 05: 27: 15 2013 (5164DC13)
fffff880`05157000 fffff880`0517b000 HDAudBus HDAudBus.sys Sat Nov 20 11: 43: 42 2010 (4CE7A65E)
fffff880`0517b000 fffff880`051e2000 Rt64win7 Rt64win7.sys Thu Jan 13 12: 57: 19 2011 (4D2EE89F)
fffff880`051e2000 fffff880`051ed000 usbohci usbohci.sys Wed Nov 27 02: 41: 09 2013 (52954DB5)
fffff880`051ed000 fffff880`051fc000 kbdclass kbdclass.sys Tue Jul 14 01: 19: 50 2009 (4A5BC116)
fffff880`051fc000 fffff880`051fd480 swenum swenum.sys Tue Jul 14 02: 00: 18 2009 (4A5BCA92)
fffff880`05200000 fffff880`0524e000 mrxsmb10 mrxsmb10.sys Sat Jul 09 04: 46: 28 2011 (4E17C104)
fffff880`0524e000 fffff880`05272000 mrxsmb20 mrxsmb20.sys Wed Apr 27 04: 39: 37 2011 (4DB781E9)
fffff880`05272000 fffff880`0527b000 gdrv gdrv.sys Fri Mar 13 04: 22: 29 2009 (49B9D175)
fffff880`0527b000 fffff880`0528e000 ndisuio ndisuio.sys Sat Nov 20 11: 50: 08 2010 (4CE7A7E0)
fffff880`05298000 fffff880`052b1000 WudfPf WudfPf.sys Thu Jul 26 04: 26: 45 2012 (5010AAE5)
fffff880`052b7000 fffff880`05380000 HTTP HTTP.sys Wed Feb 25 04: 17: 55 2015 (54ED3EE3)
fffff880`05380000 fffff880`0539e000 bowser bowser.sys Wed Feb 23 05: 55: 04 2011 (4D649328)
fffff880`0539e000 fffff880`053b6000 mpsdrv mpsdrv.sys Tue Jul 14 02: 08: 25 2009 (4A5BCC79)
fffff880`053b6000 fffff880`053e3000 mrxsmb mrxsmb.sys Wed Apr 27 04: 40: 38 2011 (4DB78226)
fffff880`05400000 fffff880`05453000 nwifi nwifi.sys Tue Jul 14 02: 07: 23 2009 (4A5BCC3B)
fffff880`05463000 fffff880`054a6000 ks ks.sys Sat Nov 20 11: 33: 23 2010 (4CE7A3F3)
fffff880`054a6000 fffff880`054b8000 umbus umbus.sys Sat Nov 20 11: 44: 37 2010 (4CE7A695)
fffff880`054b8000 fffff880`054c5000 nvvad64v nvvad64v.sys Thu Nov 20 16: 33: 54 2014 (546E09E2)
fffff880`054c5000 fffff880`05502000 portcls portcls.sys Fri Oct 04 03: 36: 02 2013 (524E1B82)
fffff880`05502000 fffff880`05524000 drmk drmk.sys Fri Oct 04 04: 16: 30 2013 (524E24FE)
fffff880`05524000 fffff880`05529200 ksthunk ksthunk.sys Tue Jul 14 02: 00: 19 2009 (4A5BCA93)
fffff880`0552a000 fffff880`05584000 usbhub usbhub.sys Wed Nov 27 02: 41: 36 2013 (52954DD0)
fffff880`05584000 fffff880`0558f000 flpydisk flpydisk.sys Tue Jul 14 02: 00: 54 2009 (4A5BCAB6)
fffff880`0558f000 fffff880`055a4000 NDProxy NDProxy.SYS Sat Nov 20 11: 52: 20 2010 (4CE7A864)
fffff880`055a4000 fffff880`055d8000 nvhda64v nvhda64v.sys Thu Oct 09 19: 02: 27 2014 (5436BFA3)
fffff880`06800000 fffff880`06818000 rspndr rspndr.sys Tue Jul 14 02: 08: 50 2009 (4A5BCC92)
fffff880`06818000 fffff880`0684e000 fastfat fastfat.SYS Tue Jul 14 01: 23: 28 2009 (4A5BC1F0)
fffff880`0684e000 fffff880`06ab7800 RTKVHD64 RTKVHD64.sys Tue Nov 02 12: 25: 59 2010 (4CCFF547)
fffff880`06ab8000 fffff880`06ac4000 Dxapi Dxapi.sys Tue Jul 14 01: 38: 28 2009 (4A5BC574)
fffff880`06adf000 fffff880`06ae0e80 USBD USBD.SYS Wed Nov 27 02: 41: 03 2013 (52954DAF)
fffff880`06ae1000 fffff880`06aef000 monitor monitor.sys Tue Jul 14 01: 38: 52 2009 (4A5BC58C)
fffff880`06aef000 fffff880`06b0c000 usbccgp usbccgp.sys Wed Nov 27 02: 41: 15 2013 (52954DBB)
fffff880`06b0c000 fffff880`06b1a000 hidusb hidusb.sys Sat Nov 20 11: 43: 49 2010 (4CE7A665)
fffff880`06b1a000 fffff880`06b33000 HIDCLASS HIDCLASS.SYS Wed Jul 03 06: 05: 05 2013 (51D3A2F1)
fffff880`06b33000 fffff880`06b3b080 HIDPARSE HIDPARSE.SYS Wed Jul 03 06: 05: 04 2013 (51D3A2F0)
fffff880`06b3c000 fffff880`06b4a000 kbdhid kbdhid.sys Sat Nov 20 11: 33: 25 2010 (4CE7A3F5)
fffff880`06b4a000 fffff880`06b57000 mouhid mouhid.sys Tue Jul 14 02: 00: 20 2009 (4A5BCA94)
fffff880`06b57000 fffff880`06b65000 crashdmp crashdmp.sys Tue Jul 14 02: 01: 01 2009 (4A5BCABD)
fffff880`06b65000 fffff880`06b71000 dump_dumpata dump_dumpata.sys Tue Jul 14 01: 19: 47 2009 (4A5BC113)
fffff880`06b71000 fffff880`06b7a000 dump_atapi dump_atapi.sys Tue Jul 14 01: 19: 47 2009 (4A5BC113)
fffff880`06b7a000 fffff880`06b8d000 dump_dumpfve dump_dumpfve.sys Tue Jul 14 01: 21: 51 2009 (4A5BC18F)
fffff880`06b8d000 fffff880`06bb0000 luafv luafv.sys Tue Jul 14 01: 26: 13 2009 (4A5BC295)
fffff880`06bb0000 fffff880`06be9000 epfw epfw.sys Tue Jan 20 11: 41: 08 2015 (54BE30C4)
fffff880`06be9000 fffff880`06bfe000 lltdio lltdio.sys Tue Jul 14 02: 08: 50 2009 (4A5BCC92)
fffff880`08800000 fffff880`08898000 srv srv.sys Fri Apr 29 05: 06: 06 2011 (4DBA2B1E)
fffff880`0889c000 fffff880`08946000 peauth peauth.sys Tue Feb 03 04: 19: 12 2015 (54D03E30)
fffff880`08946000 fffff880`08951000 secdrv secdrv.SYS Wed Sep 13 15: 18: 38 2006 (4508052E)
fffff880`08951000 fffff880`08982000 srvnet srvnet.sys Fri Apr 29 05: 05: 35 2011 (4DBA2AFF)
fffff880`08982000 fffff880`08994000 tcpipreg tcpipreg.sys Wed Oct 03 18: 07: 26 2012 (506C62BE)
fffff880`08994000 fffff880`089fd000 srv2 srv2.sys Fri Apr 29 05: 05: 46 2011 (4DBA2B0A)
fffff880`09509000 fffff880`09513000 NvStreamKms NvStreamKms.sys Tue Mar 17 07: 19: 52 2015 (5507C788)
fffff880`09584000 fffff880`0958f000 asyncmac asyncmac.sys Tue Jul 14 02: 10: 13 2009 (4A5BCCE5)
fffff960`00040000 fffff960`00363000 win32k win32k.sys Thu Feb 26 04: 25: 22 2015 (54EE9222)
fffff960`00430000 fffff960`0043a000 TSDDD TSDDD.dll unavailable (00000000)
fffff960`00650000 fffff960`00677000 cdd cdd.dll Thu Feb 03 12: 25: 25 2011 (4D4A90A5)
fffffa80`08b31000 fffffa80`08b38000 em015_64 em015_64.dat Fri Mar 01 14: 27: 56 2013 (5130ACDC)
fffffa80`08eec000 fffffa80`08f1a000 em006_64 em006_64.dat Fri Mar 20 14: 02: 10 2015 (550C1A52)
fffffa80`08f3c000 fffffa80`08f9c000 em018_64 em018_64.dat Thu Apr 09 14: 47: 46 2015 (552674F2)
fffffa80`09e64000 fffffa80`09f79000 em008_64 em008_64.dat Fri Mar 20 14: 10: 32 2015 (550C1C48)
Unloaded modules:
fffff880`094d3000 fffff880`09509000 WUDFRd.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ImageSize: 00036000
fffff880`06ac4000 fffff880`06adf000 USBSTOR.SYS
Timestamp: unavailable (00000000)
Checksum: 00000000
ImageSize: 0001B000
fffff880`09513000 fffff880`09584000 spsys.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ImageSize: 00071000
fffff880`0528e000 fffff880`05298000 NvStreamKms.
Timestamp: unavailable (00000000)
Checksum: 00000000
ImageSize: 0000A000
fffff880`094d8000 fffff880`0950e000 WUDFRd.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ImageSize: 00036000
fffff880`01259000 fffff880`01267000 crashdmp.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ImageSize: 0000E000
fffff880`01030000 fffff880`0103c000 dump_ataport
Timestamp: unavailable (00000000)
Checksum: 00000000
ImageSize: 0000C000
fffff880`0103c000 fffff880`01045000 dump_atapi.s
Timestamp: unavailable (00000000)
Checksum: 00000000
ImageSize: 00009000
fffff880`00c60000 fffff880`00c73000 dump_dumpfve
Timestamp: unavailable (00000000)
Checksum: 00000000
ImageSize: 00013000
fffff880`03c00000 fffff880`03c2a000 cdrom.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ImageSize: 0002A000
Bugcheck code 00000024
Arguments 00000000`001904fb fffff880`0ab45da8 fffff880`0ab45600 fffff880`010fc6f5
sysinfo: could not find necessary interfaces.
sysinfo: note that mssmbios.sys must be loaded (XPSP2+).
sysinfo: could not find necessary interfaces.
sysinfo: note that mssmbios.sys must be loaded (XPSP2+).
sysinfo: could not find necessary interfaces.
sysinfo: note that mssmbios.sys must be loaded (XPSP2+).
sysinfo: could not find necessary interfaces.
sysinfo: note that mssmbios.sys must be loaded (XPSP2+).
Bardziej wnikliwa analiza dostarcza nam informację z rekordu wyjątku (exr) iż nastąpiło naruszenie w dostępie do danych w adresie fffff880010fc6f5 a konkretniej funkcja sterownika ntfs.sys NtfsFindPrefixHashEntry wygenerowała błąd.
Potwierdza to pierwszy argument bsoda 1904fb -> c0000005 (Access violation)
Cytat:EXCEPTION_RECORD: fffff8800ab45da8 -- (.exr 0xfffff8800ab45da8)
ExceptionAddress: fffff880010fc6f5 (Ntfs!NtfsFindPrefixHashEntry+0x000000000000022c)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 0000000000000000
Parameter[1]: ffffffffffffffff
Attempt to read from address ffffffffffffffff
W drugim kroku po sprawdzeniu rekordu kontekstu (cxr)
Cytat:CONTEXT: fffff8800ab45600 -- (.cxr 0xfffff8800ab45600)
rax=0000000000000064 rbx=fffff8a00de89e60 rcx=00000000000005e4
rdx=0000000000000001 rsi=fffff8a00020d990 rdi=f9806faf8f880460
rip=fffff880010fc6f5 rsp=fffff8800ab45fe0 rbp=00000000000062b0
r8=000000000b6586f2 r9=0000000000000000 r10=0000000000000001
r11=fffff8800ab46028 r12=fffff8a00cb783a8 r13=fffff8800ab46580
r14=00000000000002f2 r15=00000000000006f2
iopl=0 nv up ei pl zr na po nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010246
Ntfs!NtfsFindPrefixHashEntry+0x22c:
fffff880`010fc6f5 0fb78718020000 movzx eax,word ptr [rdi+218h] ds:002b:f9806faf`8f880678=?
Mała przestroga dla tych którzy używają lewych antywirusów - pliki sterowników aplikacji antywirusowej w takim przypadku są starsze. Dlaczego ? Ponieważ są modyfikowane. Dzięki temu błąd 0x24 jak najbardziej może mieć miejsce. Tutaj jest to ESET Smart Security ale nie mogę tego zweryfikować.
Widzę włączoną weryfikację sterowników (DEFAULT_BUCKET_ID: VERIFIER_ENABLED_VISTA_MINIDUMP ), można już ją wyłączyć. Ponadto musi wylecieć Gigabyte Easy Saver -> gdrv.sys
Post: #9![[Obrazek: 2089620800_1406976151.png]](http://obrazki.elektroda.pl/2089620800_1406976151.png)
