Hey ,
ich habe erneut ein Problem mit meinem Windows Vista (SP2).
Schon im Dezember letzen Jahres hatte ich Probleme mit Bluescreens, die ich aber mit Installation von einigen Treibern lösen konnte.
Jetzt tritt das Problem Bluescreen immer wieder auf, meistens direkt nach dem Einloggen. Beim Abgesicherten Modus gibt es keine Probleme.
Heute ist mein Pc drei Mal hintereinander im Abstand von 2 Minuten abgestürzt und die Ursache war laut Debugging Manager immer eine andere.
Hier als erstes mal die Debugging-Berichte:
Debugging Details:
------------------
WRITE_ADDRESS: GetPointerFromAddress: unable to read from 81f81868
Unable to read MiSystemVaType memory at 81f61420
00000010
CURRENT_IRQL: 2
FAULTING_IP:
hal!KeAcquireInStackQueuedSpinLockRaiseToSynch+29
81e1aff9 8902 mov dword ptr [edx],eax
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
BUGCHECK_STR: 0xA
PROCESS_NAME: System
TRAP_FRAME: 8b19bc38 -- (.trap 0xffffffff8b19bc38)
ErrCode = 00000002
eax=8b19bcdc ebx=84b138f8 ecx=84b139b0 edx=00000010 esi=00010000 edi=00000000
eip=81e1aff9 esp=8b19bcac ebp=8b19bcec iopl=0 nv up ei ng nz na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010286
hal!KeAcquireInStackQueuedSpinLockRaiseToSynch+0x29:
81e1aff9 8902 mov dword ptr [edx],eax ds:0023:00000010=????????
Resetting default scope
LAST_CONTROL_TRANSFER: from 81e1aff9 to 81e97fb9
STACK_TEXT:
8b19bc38 81e1aff9 badb0d00 00000010 84b41e00 nt!KiTrap0E+0x2e1
8b19bca8 81e823fd 81f80148 84ae6aa0 00000000 hal!KeAcquireInStackQueuedSpinLockRaiseToSynch+0x29
8b19bcec 81e7f645 84b138f8 8b19bd10 00000000 nt!CcWriteBehind+0x47
8b19bd44 81eefe22 84407258 00000000 843a0020 nt!CcWorkerThread+0x11e
8b19bd7c 8201fc42 84407258 b59759b7 00000000 nt!ExpWorkerThread+0xfd
8b19bdc0 81e88efe 81eefd25 00000000 00000000 nt!PspSystemThreadStartup+0x9d
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16
STACK_COMMAND: kb
FOLLOWUP_IP:
nt!KiTrap0E+2e1
81e97fb9 833d848cf78100 cmp dword ptr [nt!KiFreezeFlag (81f78c84)],0
SYMBOL_STACK_INDEX: 0
SYMBOL_NAME: nt!KiTrap0E+2e1
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrpamp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 49e0199e
FAILURE_BUCKET_ID: 0xA_nt!KiTrap0E+2e1
BUCKET_ID: 0xA_nt!KiTrap0E+2e1
Followup: MachineOwner
---------
3: kd> lmvm nt
start end module name
81e4a000 82203000 nt (pdb symbols) C:\Symbols\ntkrpamp.pdb\109FACEC7E244C8FAC6D191457B5C7022\ntkrpamp.pdb
Loaded symbol image file: ntkrpamp.exe
Mapped memory image file: C:\Symbols\ntkrpamp.exe\49E0199E3b9000\ntkrpamp.exe
Image path: ntkrpamp.exe
Image name: ntkrpamp.exe
Timestamp: Sat Apr 11 06:16:30 2009 (49E0199E)
CheckSum: 00373B2E
ImageSize: 003B9000
File version: 6.0.6002.18005
Product version: 6.0.6002.18005
File flags: 0 (Mask 3F)
File OS: 40004 NT Win32
File type: 1.0 App
File date: 00000000.00000000
Translations: 0409.04b0
CompanyName: Microsoft Corporation
ProductName: Microsoft® Windows® Operating System
InternalName: ntkrpamp.exe
OriginalFilename: ntkrpamp.exe
ProductVersion: 6.0.6002.18005
FileVersion: 6.0.6002.18005 (lh_sp2rtm.090410-1830)
FileDescription: NT Kernel & System
LegalCopyright: © Microsoft Corporation. All rights reserved.
Der Zweite
Debugging Details:
------------------
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - Die Anweisung in 0x%08lx verweist auf Speicher 0x%08lx. Der Vorgang %s konnte nicht im Speicher durchgef hrt werden.
FAULTING_IP:
fltmgr!FltpGetFileNameInformation+69
8a249f2b 8b4008 mov eax,dword ptr [eax+8]
TRAP_FRAME: a53c4580 -- (.trap 0xffffffffa53c4580)
ErrCode = 00000000
eax=00000010 ebx=00000000 ecx=877dc708 edx=00000000 esi=884af418 edi=00000000
eip=8a249f2b esp=a53c45f4 ebp=a53c4618 iopl=0 nv up ei pl nz na po nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010202
fltmgr!FltpGetFileNameInformation+0x69:
8a249f2b 8b4008 mov eax,dword ptr [eax+8] ds:0023:00000018=????????
Resetting default scope
CUSTOMER_CRASH_COUNT: 2
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
BUGCHECK_STR: 0x8E
PROCESS_NAME: winlogon.exe
CURRENT_IRQL: 0
LAST_CONTROL_TRANSFER: from 8a25f717 to 8a249f2b
STACK_TEXT:
a53c4618 8a25f717 884af418 a53c466c 879e72d0 fltmgr!FltpGetFileNameInformation+0x69
a53c462c 8a34681c 87c09b30 00000000 884af418 fltmgr!FltGetFileNameInformationUnsafe+0x59
a53c464c 8a3466bd 87c09b30 a53c466c a53c4668 tcpip!WfpAleQueryNormalizedImageFileName+0x26
a53c4670 8a346917 87c09b30 a53c46b0 a53c46c0 tcpip!WfpAleCaptureImageFileName+0x21
a53c46c4 8205db32 879e72d0 00000a98 a53c46e8 tcpip!WfpCreateProcessNotifyRoutine+0xe2
a53c4768 820102e5 00c7d810 019e72d0 a53c47a8 nt!PspInsertThread+0x4e3
a53c4d30 81e90c7a 008ef534 008ef514 02000000 nt!NtCreateUserProcess+0x762
a53c4d30 77ce5e74 008ef534 008ef514 02000000 nt!KiFastCallEntry+0x12a
WARNING: Frame IP not in any known module. Following frames may be wrong.
008ef718 00000000 00000000 00000000 00000000 0x77ce5e74
STACK_COMMAND: kb
FOLLOWUP_IP:
tcpip!WfpAleQueryNormalizedImageFileName+26
8a34681c 85c0 test eax,eax
SYMBOL_STACK_INDEX: 2
SYMBOL_NAME: tcpip!WfpAleQueryNormalizedImageFileName+26
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: tcpip
IMAGE_NAME: tcpip.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 49e020b2
FAILURE_BUCKET_ID: 0x8E_tcpip!WfpAleQueryNormalizedImageFileName+26
BUCKET_ID: 0x8E_tcpip!WfpAleQueryNormalizedImageFileName+26
Followup: MachineOwner
---------
2: kd> lmvm tcpip
start end module name
8a314000 8a3fc000 tcpip (pdb symbols) C:\Symbols\tcpip.pdb\399215E7796941A1A779904A52E5C3A22\tcpip.pdb
Loaded symbol image file: tcpip.sys
Mapped memory image file: C:\Symbols\tcpip.sys\49E020B2e8000\tcpip.sys
Image path: \SystemRoot\System32\drivers\tcpip.sys
Image name: tcpip.sys
Timestamp: Sat Apr 11 06:46:42 2009 (49E020B2)
CheckSum: 000DF384
ImageSize: 000E8000
File version: 6.0.6002.18005
Product version: 6.0.6002.18005
File flags: 0 (Mask 3F)
File OS: 40004 NT Win32
File type: 3.6 Driver
File date: 00000000.00000000
Translations: 0409.04b0
CompanyName: Microsoft Corporation
ProductName: Microsoft® Windows® Operating System
InternalName: tcpip.sys
OriginalFilename: tcpip.sys
ProductVersion: 6.0.6002.18005
FileVersion: 6.0.6002.18005 (lh_sp2rtm.090410-1830)
FileDescription: TCP/IP Driver
LegalCopyright: © Microsoft Corporation. All rights reserved.
Und noch der Dritte:
Debugging Details:
------------------
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - Die Anweisung in 0x%08lx verweist auf Speicher 0x%08lx. Der Vorgang %s konnte nicht im Speicher durchgef hrt werden.
FAULTING_IP:
win32k!StoreQMessage+8f
970d8f92 300a xor byte ptr [edx],cl
TRAP_FRAME: 9ddb5be0 -- (.trap 0xffffffff9ddb5be0)
ErrCode = 00000002
eax=ff9d0570 ebx=ffffff13 ecx=fe7e0cd0 edx=00000000 esi=00000000 edi=fdc4719c
eip=970d8f92 esp=9ddb5c54 ebp=9ddb5c60 iopl=0 nv up ei ng nz ac pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010296
win32k!StoreQMessage+0x8f:
970d8f92 300a xor byte ptr [edx],cl ds:0023:00000000=??
Resetting default scope
CUSTOMER_CRASH_COUNT: 3
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
BUGCHECK_STR: 0x8E
PROCESS_NAME: explorer.exe
CURRENT_IRQL: 0
MISALIGNED_IP:
win32k!StoreQMessage+8f
970d8f92 300a xor byte ptr [edx],cl
LAST_CONTROL_TRANSFER: from 970d93be to 970d8f92
STACK_TEXT:
9ddb5c60 970d93be fe7e0cd0 fe80e240 00000113 win32k!StoreQMessage+0x8f
9ddb5c98 970d81c1 00000000 0ac68a8b 0711fb40 win32k!DoTimer+0x78
9ddb5ce8 970d8d17 9ddb5d18 000025ff 00000000 win32k!xxxRealInternalGetMessage+0x467
9ddb5d4c 81e4dc7a 0711fb40 00000000 00000000 win32k!NtUserGetMessage+0x3f
9ddb5d4c 773f5e74 0711fb40 00000000 00000000 nt!KiFastCallEntry+0x12a
WARNING: Frame IP not in any known module. Following frames may be wrong.
0711fb18 00000000 00000000 00000000 00000000 0x773f5e74
STACK_COMMAND: kb
FOLLOWUP_IP:
win32k!StoreQMessage+8f
970d8f92 300a xor byte ptr [edx],cl
SYMBOL_STACK_INDEX: 0
SYMBOL_NAME: win32k!StoreQMessage+8f
FOLLOWUP_NAME: MachineOwner
IMAGE_NAME: hardware
DEBUG_FLR_IMAGE_TIMESTAMP: 0
MODULE_NAME: hardware
FAILURE_BUCKET_ID: IP_MISALIGNED
BUCKET_ID: IP_MISALIGNED
Followup: MachineOwner
Ich hoffe, das hilft euch weiter 
Mein System:
Windows Vista Home Premium 32-bit
Prozessor: Intel(R) Core(TM)2 Quad CPU Q8200 @ 2.33GHz
Mainboard: MS-7504VP-PV
Grafik: NVIDIA GeForce 9500 GS
RAM: 3GB
Festplatte: ST3500620AS ATA Device mit 500GB
Mein PC ist etwa 3-4 Jahre alt.
Vielen Dank im Voraus und ein Schönes Wochenende!
Armin Bu
Armin Bu Gast |
