Hi,
Ich bekomme bei der Installation von Nero 8.3.6.0 einen Bluescreen
Ich habe deshalb ein Speicherabbild angefertigt!
Könnt ihr mich bei der Analyse unterstützten da ich darin nicht besonders bewandert bin.
Nach meinem Verständnis ist die Klif.sys der Verursacher???
Diese Datei gehört zu KIS 8. Habe deshalb schon deinstalliert aber immer noch den gleichen Bluescreen. Bitte um Hilfe diesbezüglich.
Gruß
dk1000
Microsoft (R) Windows Debugger Version 6.9.0003.113 X86
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [C:\WINDOWS\MEMORY.DMP]
Kernel Complete Dump File: Full address space is available
Symbol search path is: SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows XP Kernel Version 2600 (Service Pack 3) UP Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 2600.xpsp.080413-2111
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055b1c0
Debug session time: Tue Nov 18 13:07:28.191 2008 (GMT+1)
System Uptime: 0 days 1:05:23.769
Loading Kernel Symbols
......................................................................................................................................
Loading User Symbols
....................................................................................................................................................................
Loading unloaded module list
............................
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 8E, {c0000005, 8057019e, b9844b74, 0}
*** ERROR: Module load completed but symbols could not be loaded for klif.sys
*** ERROR: Symbol file could not be found. Defaulted to export symbols for NMHDirServices.dll -
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: kernel32!pNlsUserInfo ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: kernel32!pNlsUserInfo ***
*** ***
*************************************************************************
Probably caused by : klif.sys ( klif+e480 )
Followup: MachineOwner
---------
kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
KERNEL_MODE_EXCEPTION_NOT_HANDLED (8e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003. This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG. This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG. This will let us see why this breakpoint is
happening.
Arguments:
Arg1: c0000005, The exception code that was not handled
Arg2: 8057019e, The address that the exception occurred at
Arg3: b9844b74, Trap Frame
Arg4: 00000000
Debugging Details:
------------------
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: kernel32!pNlsUserInfo ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: kernel32!pNlsUserInfo ***
*** ***
*************************************************************************
OVERLAPPED_MODULE: Address regions for 'Fastfat' and 'kmixer.sys' overlap
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - Die Anweisung in "0x%08lx" verweist auf Speicher in "0x%08lx". Der Vorgang "%s" konnte nicht auf dem Speicher durchgef hrt werden.
FAULTING_IP:
nt!HvpGetCellMapped+5f
8057019e 8b4304 mov eax,dword ptr [ebx+4]
TRAP_FRAME: b9844b74 -- (.trap 0xffffffffb9844b74)
ErrCode = 00000000
eax=00001000 ebx=00001000 ecx=89e1a240 edx=00000190 esi=e1946008 edi=00000000
eip=8057019e esp=b9844be8 ebp=b9844c30 iopl=0 nv up ei pl zr na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010246
nt!HvpGetCellMapped+0x5f:
8057019e 8b4304 mov eax,dword ptr [ebx+4] ds:0023:00001004=????????
Resetting default scope
DEFAULT_BUCKET_ID: DRIVER_FAULT
BUGCHECK_STR: 0x8E
PROCESS_NAME: msiexec.exe
LAST_CONTROL_TRANSFER: from 8051d8ad to 8053380e
STACK_TEXT:
b984473c 8051d8ad 0000008e c0000005 8057019e nt!KeBugCheckEx+0x1b
b9844b04 804df235 b9844b20 00000000 b9844b74 nt!KiDispatchException+0x3b1
b9844b6c 804df1e6 b9844c30 8057019e badb0d00 nt!CommonDispatchException+0x4d
b9844b74 8057019e badb0d00 00000190 ffffffff nt!KiExceptionExit+0x18a
b9844c30 80579543 e1946008 32100000 e1946008 nt!HvpGetCellMapped+0x5f
b9844c44 805793be e1946008 32100000 c7c5ebe4 nt!HvpGetHCell+0x10
b9844c60 8059e0f1 e1946008 32100000 e1946008 nt!HvMarkCellDirty+0x30
b9844c80 80594fd3 e1946008 00b5dbe0 e1214e18 nt!CmpMarkKeyDirty+0x68
b9844c98 805950f3 e1946008 00b5dbe0 00000001 nt!CmpFreeKeyByCell+0x14
b9844cc8 8059536b e41e6240 b9844d64 00f8bcac nt!CmDeleteKey+0x8c
b9844d28 b85dd480 000005fe b9844d64 b85dd3d2 nt!NtDeleteKey+0x138
WARNING: Stack unwind information not available. Following frames may be wrong.
b9844d58 804de7ec 000005fe 00f8bcd4 7c91e4f4 klif+0xe480
b9844d58 7c91e4f4 000005fe 00f8bcd4 7c91e4f4 nt!KiFastCallEntry+0xf8
00f8bc9c 7c91d23c 77db424b 000005fe 00f8bf5c ntdll!KiFastSystemCallRet
00f8bca0 77db424b 000005fe 00f8bf5c 77da7bc9 ntdll!NtDeleteKey+0xc
00f8bcd4 77db55df 0000068e 000005fe 77da7bc9 ADVAPI32!LocalBaseRegDeleteKey+0xd7
00f8bcf8 081b1e40 0000068e 00f8bf5c 00f8ca44 ADVAPI32!RegDeleteKeyW+0x76
00f8bf44 00000000 0000068e 00f8ca44 05947970 NMHDirServices!DllCanUnloadNow+0x180
STACK_COMMAND: kb
FOLLOWUP_IP:
klif+e480
b85dd480 8bf8 mov edi,eax
SYMBOL_STACK_INDEX: b
SYMBOL_NAME: klif+e480
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: klif
IMAGE_NAME: klif.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 48809c64
FAILURE_BUCKET_ID: 0x8E_klif+e480
BUCKET_ID: 0x8E_klif+e480
Followup: MachineOwner
---------
Ich bekomme bei der Installation von Nero 8.3.6.0 einen Bluescreen
Ich habe deshalb ein Speicherabbild angefertigt!
Könnt ihr mich bei der Analyse unterstützten da ich darin nicht besonders bewandert bin.
Nach meinem Verständnis ist die Klif.sys der Verursacher???
Diese Datei gehört zu KIS 8. Habe deshalb schon deinstalliert aber immer noch den gleichen Bluescreen. Bitte um Hilfe diesbezüglich.
Gruß
dk1000
Microsoft (R) Windows Debugger Version 6.9.0003.113 X86
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [C:\WINDOWS\MEMORY.DMP]
Kernel Complete Dump File: Full address space is available
Symbol search path is: SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows XP Kernel Version 2600 (Service Pack 3) UP Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 2600.xpsp.080413-2111
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055b1c0
Debug session time: Tue Nov 18 13:07:28.191 2008 (GMT+1)
System Uptime: 0 days 1:05:23.769
Loading Kernel Symbols
......................................................................................................................................
Loading User Symbols
....................................................................................................................................................................
Loading unloaded module list
............................
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 8E, {c0000005, 8057019e, b9844b74, 0}
*** ERROR: Module load completed but symbols could not be loaded for klif.sys
*** ERROR: Symbol file could not be found. Defaulted to export symbols for NMHDirServices.dll -
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: kernel32!pNlsUserInfo ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: kernel32!pNlsUserInfo ***
*** ***
*************************************************************************
Probably caused by : klif.sys ( klif+e480 )
Followup: MachineOwner
---------
kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
KERNEL_MODE_EXCEPTION_NOT_HANDLED (8e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003. This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG. This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG. This will let us see why this breakpoint is
happening.
Arguments:
Arg1: c0000005, The exception code that was not handled
Arg2: 8057019e, The address that the exception occurred at
Arg3: b9844b74, Trap Frame
Arg4: 00000000
Debugging Details:
------------------
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: kernel32!pNlsUserInfo ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: kernel32!pNlsUserInfo ***
*** ***
*************************************************************************
OVERLAPPED_MODULE: Address regions for 'Fastfat' and 'kmixer.sys' overlap
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - Die Anweisung in "0x%08lx" verweist auf Speicher in "0x%08lx". Der Vorgang "%s" konnte nicht auf dem Speicher durchgef hrt werden.
FAULTING_IP:
nt!HvpGetCellMapped+5f
8057019e 8b4304 mov eax,dword ptr [ebx+4]
TRAP_FRAME: b9844b74 -- (.trap 0xffffffffb9844b74)
ErrCode = 00000000
eax=00001000 ebx=00001000 ecx=89e1a240 edx=00000190 esi=e1946008 edi=00000000
eip=8057019e esp=b9844be8 ebp=b9844c30 iopl=0 nv up ei pl zr na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010246
nt!HvpGetCellMapped+0x5f:
8057019e 8b4304 mov eax,dword ptr [ebx+4] ds:0023:00001004=????????
Resetting default scope
DEFAULT_BUCKET_ID: DRIVER_FAULT
BUGCHECK_STR: 0x8E
PROCESS_NAME: msiexec.exe
LAST_CONTROL_TRANSFER: from 8051d8ad to 8053380e
STACK_TEXT:
b984473c 8051d8ad 0000008e c0000005 8057019e nt!KeBugCheckEx+0x1b
b9844b04 804df235 b9844b20 00000000 b9844b74 nt!KiDispatchException+0x3b1
b9844b6c 804df1e6 b9844c30 8057019e badb0d00 nt!CommonDispatchException+0x4d
b9844b74 8057019e badb0d00 00000190 ffffffff nt!KiExceptionExit+0x18a
b9844c30 80579543 e1946008 32100000 e1946008 nt!HvpGetCellMapped+0x5f
b9844c44 805793be e1946008 32100000 c7c5ebe4 nt!HvpGetHCell+0x10
b9844c60 8059e0f1 e1946008 32100000 e1946008 nt!HvMarkCellDirty+0x30
b9844c80 80594fd3 e1946008 00b5dbe0 e1214e18 nt!CmpMarkKeyDirty+0x68
b9844c98 805950f3 e1946008 00b5dbe0 00000001 nt!CmpFreeKeyByCell+0x14
b9844cc8 8059536b e41e6240 b9844d64 00f8bcac nt!CmDeleteKey+0x8c
b9844d28 b85dd480 000005fe b9844d64 b85dd3d2 nt!NtDeleteKey+0x138
WARNING: Stack unwind information not available. Following frames may be wrong.
b9844d58 804de7ec 000005fe 00f8bcd4 7c91e4f4 klif+0xe480
b9844d58 7c91e4f4 000005fe 00f8bcd4 7c91e4f4 nt!KiFastCallEntry+0xf8
00f8bc9c 7c91d23c 77db424b 000005fe 00f8bf5c ntdll!KiFastSystemCallRet
00f8bca0 77db424b 000005fe 00f8bf5c 77da7bc9 ntdll!NtDeleteKey+0xc
00f8bcd4 77db55df 0000068e 000005fe 77da7bc9 ADVAPI32!LocalBaseRegDeleteKey+0xd7
00f8bcf8 081b1e40 0000068e 00f8bf5c 00f8ca44 ADVAPI32!RegDeleteKeyW+0x76
00f8bf44 00000000 0000068e 00f8ca44 05947970 NMHDirServices!DllCanUnloadNow+0x180
STACK_COMMAND: kb
FOLLOWUP_IP:
klif+e480
b85dd480 8bf8 mov edi,eax
SYMBOL_STACK_INDEX: b
SYMBOL_NAME: klif+e480
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: klif
IMAGE_NAME: klif.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 48809c64
FAILURE_BUCKET_ID: 0x8E_klif+e480
BUCKET_ID: 0x8E_klif+e480
Followup: MachineOwner
---------
