Hallo
Seit einigen Tagen stürzt mein computer imma wieder aba mit der Fehler Meldung IRQL_LESS_OR_EQUAL
Dabei handelt es sich wahrscheinlich um ein Treiberproblem und deshalb habe ich mir das Windows Debugging Tool geholt um die CRASH DUMPS auszuwerten leida finde ich weder bei MODULE_NAME noch bei IMAGE_MODULE unter !analyze hilfreiche Hinweise. Deshalb hoffe ich das mir hier jemand helfen kann.
Hier die Logfile
Microsoft (R) Windows Debugger Version 6.8.0004.0 X86
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [C:\WINDOWS\MEMORY.DMP]
Kernel Summary Dump File: Only kernel address space is available
Symbol search path is: .sympath SRV*<DownstreamStore>*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows XP Kernel Version 2600 (Service Pack 2) MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 2600.xpsp_sp2_gdr.070227-2254
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055c700
Debug session time: Tue Jul 15 09:41:55.838 2008 (GMT+2)
System Uptime: 0 days 1:30:36.814
Loading Kernel Symbols
..................................................................... ..........................................................
Loading User Symbols
PEB is paged out (Peb.Ldr = 7ffdf00c). Type ".hh dbgerr001" for details
Loading unloaded module list
............
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck A, {86643008, 2, 1, 80522bd9}
VirtualToOffset: 802984df not properly sign extended
PEB is paged out (Peb.Ldr = 7ffdf00c). Type ".hh dbgerr001" for details
PEB is paged out (Peb.Ldr = 7ffdf00c). Type ".hh dbgerr001" for details
Probably caused by : memory_corruption ( nt!MiReleasePageFileSpace+55 )
Followup: MachineOwner
---------
0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 86643008, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000001, bitfield :
bit 0 : value 0 = read operation, 1 = write operation
bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: 80522bd9, address which referenced memory
Debugging Details:
------------------
VirtualToOffset: 802984df not properly sign extended
PEB is paged out (Peb.Ldr = 7ffdf00c). Type ".hh dbgerr001" for details
PEB is paged out (Peb.Ldr = 7ffdf00c). Type ".hh dbgerr001" for details
WRITE_ADDRESS: 86643008
CURRENT_IRQL: 2
FAULTING_IP:
nt!MiReleasePageFileSpace+55
80522bd9 213e and dword ptr [esi],edi
DEFAULT_BUCKET_ID: DRIVER_FAULT
BUGCHECK_STR: 0xA
PROCESS_NAME: rundll32.exe
TRAP_FRAME: bafcfac0 -- (.trap 0xffffffffbafcfac0)
ErrCode = 00000002
eax=86277180 ebx=c0222590 ecx=00000000 edx=00000000 esi=86643008 edi=fffffffe
eip=80522bd9 esp=bafcfb34 ebp=bafcfb44 iopl=0 nv up ei pl zr na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010246
nt!MiReleasePageFileSpace+0x55:
80522bd9 213e and dword ptr [esi],edi ds:0023:86643008=????????
Resetting default scope
LAST_CONTROL_TRANSFER: from 80522bd9 to 80543930
STACK_TEXT:
bafcfac0 80522bd9 badb0d00 00000000 29311825 nt!KiTrap0E+0x238
bafcfb44 80523110 00000000 02000000 444b2000 nt!MiReleasePageFileSpace+0x55
bafcfb7c 80523284 c0222590 444b2000 00000000 nt!MiDeletePte+0x4a2
bafcfc44 80519509 e37d2f70 444bdfff 00000000 nt!MiDeleteVirtualAddresses+0x164
bafcfcf4 805b17f1 85c85ab0 85bfa318 bafcfd64 nt!MiRemoveMappedView+0x237
bafcfd38 805b18e0 8612cf68 85dea608 00000000 nt!MiUnmapViewOfSection+0x12b
bafcfd54 8054086c ffffffff 85c85ab0 0007f2cc nt!NtUnmapViewOfSection+0x54
bafcfd54 7c91eb94 ffffffff 85c85ab0 0007f2cc nt!KiFastCallEntry+0xfc
WARNING: Frame IP not in any known module. Following frames may be wrong.
0007f2cc 00000000 00000000 00000000 00000000 0x7c91eb94
STACK_COMMAND: kb
FOLLOWUP_IP:
nt!MiReleasePageFileSpace+55
80522bd9 213e and dword ptr [esi],edi
SYMBOL_STACK_INDEX: 1
SYMBOL_NAME: nt!MiReleasePageFileSpace+55
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
DEBUG_FLR_IMAGE_TIMESTAMP: 45e53f9d
IMAGE_NAME: memory_corruption
FAILURE_BUCKET_ID: 0xA_W_nt!MiReleasePageFileSpace+55
BUCKET_ID: 0xA_W_nt!MiReleasePageFileSpace+55
Followup: MachineOwner
---------
0: kd> !thread
THREAD 85a643a8 Cid 095c.01e8 Teb: 7ffde000 Win32Thread: e42b8ca8 RUNNING on processor 0
Not impersonating
DeviceMap e225d160
Owning Process 85c85ab0 Image: rundll32.exe
Wait Start TickCount 347956 Ticks: 0
Context Switch Count 63 LargeStack
UserTime 00:00:00.015
KernelTime 00:00:00.031
Win32 Start Address 0x01001bdc
Start Address 0x7c810665
Stack Init bafd0000 Current bafcf708 Base bafd0000 Limit bafcc000 Call 0
Priority 13 BasePriority 8 PriorityDecrement 5 DecrementCount 16
ChildEBP RetAddr Args to Child
bafcfac0 80522bd9 badb0d00 00000000 29311825 nt!KiTrap0E+0x238 (FPO: [0,0] TrapFrame @ bafcfac0)
bafcfb44 80523110 00000000 02000000 444b2000 nt!MiReleasePageFileSpace+0x55 (FPO: [Non-Fpo])
bafcfb7c 80523284 c0222590 444b2000 00000000 nt!MiDeletePte+0x4a2 (FPO: [Non-Fpo])
bafcfc44 80519509 e37d2f70 444bdfff 00000000 nt!MiDeleteVirtualAddresses+0x164 (FPO: [Non-Fpo])
bafcfcf4 805b17f1 85c85ab0 85bfa318 bafcfd64 nt!MiRemoveMappedView+0x237 (FPO: [Non-Fpo])
bafcfd38 805b18e0 8612cf68 85dea608 00000000 nt!MiUnmapViewOfSection+0x12b (FPO: [Non-Fpo])
bafcfd54 8054086c ffffffff 85c85ab0 0007f2cc nt!NtUnmapViewOfSection+0x54 (FPO: [Non-Fpo])
bafcfd54 7c91eb94 ffffffff 85c85ab0 0007f2cc nt!KiFastCallEntry+0xfc (FPO: [0,0] TrapFrame @ bafcfd64)
WARNING: Frame IP not in any known module. Following frames may be wrong.
0007f2cc 00000000 00000000 00000000 00000000 0x7c91eb94
Danke schon mal im Voraus
luggas Gast |
