Bluescreen und weis nicht weiter (MemoryDump-Details vorhanden)

iamhermes · 14. Dezember 2011

Auf einem Rechner eines bekannten trat bei einem Multiboot System ein Bluescreen auf (Windows Updates???)
Memtest habe ich dort schon laufen lassen, aber das ist negativ ausgefallen. Was kommt hier noch alles in Frage? Bzw wie behebt man das Problem ohne eine großartige Neuinstallation zu machen?

Das System2 davon ist nicht mehr Bootbar (auch der abgesicherte Modus fährt nur teilweise hoch) da dort ein Bluescreen auftritt. Über WinDBG habe ich folgende Infos aus dem memory.dmp entlockt.

Vielen Dank schonmal

(system 2)

Code:

Windows 7 Kernel Version 7601 (Service Pack 1) MP (8 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.17592.amd64fre.win7sp1_gdr.110408-1631
Machine Name:
Kernel base = 0xfffff800`03862000 PsLoadedModuleList = 0xfffff800`03aa7650
Debug session time: Sun Dec 11 12:32:15.385 2011 (UTC + 1:00)
System Uptime: 0 days 0:00:14.353
Loading Kernel Symbols
.........................................................
Loading User Symbols

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 7E, {ffffffffc0000005, fffff80003a0d617, fffff880009a8db8, fffff880009a8610}

Probably caused by : ntkrnlmp.exe ( nt!ExAllocatePoolWithTag+537 )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

SYSTEM_THREAD_EXCEPTION_NOT_HANDLED (7e)
This is a very common bugcheck.  Usually the exception address pinpoints
the driver/function that caused the problem.  Always note this address
as well as the link date of the driver/image that contains this address.
Arguments:
Arg1: ffffffffc0000005, The exception code that was not handled
Arg2: fffff80003a0d617, The address that the exception occurred at
Arg3: fffff880009a8db8, Exception Record Address
Arg4: fffff880009a8610, Context Record Address

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - Die Anweisung in 0x%08lx verweist auf Speicher 0x%08lx. Der Vorgang %s konnte nicht im Speicher durchgef hrt werden.

FAULTING_IP: 
nt!ExAllocatePoolWithTag+537
fffff800`03a0d617 48895808        mov     qword ptr [rax+8],rbx

EXCEPTION_RECORD:  fffff880009a8db8 -- (.exr 0xfffff880009a8db8)
ExceptionAddress: fffff80003a0d617 (nt!ExAllocatePoolWithTag+0x0000000000000537)
   ExceptionCode: c0000005 (Access violation)
  ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 0000000000000001
   Parameter[1]: 0000000000000008
Attempt to write to address 0000000000000008

CONTEXT:  fffff880009a8610 -- (.cxr 0xfffff880009a8610)
rax=0000000000000000 rbx=fffffa8006c982e0 rcx=fffff8a000758e90
rdx=0000000000000028 rsi=0000000000000004 rdi=0000000000000001
rip=fffff80003a0d617 rsp=fffff880009a8ff0 rbp=0000000000001000
 r8=0000000000000001  r9=fffffa8006c982e0 r10=fffffa8006c98148
r11=0000000000000001 r12=fffffa8006c98140 r13=0000000000000000
r14=fffffa8006d51ac0 r15=0000000069634d43
iopl=0         nv up ei pl zr na po nc
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010246
nt!ExAllocatePoolWithTag+0x537:
fffff800`03a0d617 48895808        mov     qword ptr [rax+8],rbx ds:002b:00000000`00000008=????????????????
Resetting default scope

PROCESS_NAME:  System

CURRENT_IRQL:  0

ERROR_CODE: (NTSTATUS) 0xc0000005 - Die Anweisung in 0x%08lx verweist auf Speicher 0x%08lx. Der Vorgang %s konnte nicht im Speicher durchgef hrt werden.

EXCEPTION_PARAMETER1:  0000000000000001

EXCEPTION_PARAMETER2:  0000000000000008

WRITE_ADDRESS:  0000000000000008 

FOLLOWUP_IP: 
nt!ExAllocatePoolWithTag+537
fffff800`03a0d617 48895808        mov     qword ptr [rax+8],rbx

BUGCHECK_STR:  0x7E

DEFAULT_BUCKET_ID:  NULL_CLASS_PTR_DEREFERENCE

LAST_CONTROL_TRANSFER:  from fffff80003c86dde to fffff80003a0d617

STACK_TEXT:  
fffff880`009a8ff0 fffff800`03c86dde : 00000000`00000001 00000000`00000000 fffff8a0`002c04e4 00000000`00000000 : nt!ExAllocatePoolWithTag+0x537
fffff880`009a90e0 fffff800`03b2f1d6 : fffff8a0`0000000e fffff880`009a9200 fffff8a0`007c5601 fffff880`00000019 : nt!CmpCallCallBacks+0xbe
fffff880`009a91b0 fffff800`038ebb14 : 00000000`00000000 fffffa80`06d51040 fffffa80`06d85080 fffff8a0`007c5620 : nt! ?? ::NNGAKEGL::`string'+0x36d7f
fffff880`009a9280 fffff800`03bd8614 : fffffa80`06d51040 00000000`00000000 fffffa80`06d51ac0 00000000`00000000 : nt!ObfDereferenceObject+0xd4
fffff880`009a92e0 fffff800`03bd8bc4 : 00000000`0000027c fffffa80`06d51040 fffff8a0`000016d0 00000000`0000027c : nt!ObpCloseHandleTableEntry+0xc4
fffff880`009a9370 fffff800`038e0f93 : fffffa80`06d51ac0 fffff880`009a9440 fffff880`009a9748 00000000`00000000 : nt!ObpCloseHandle+0x94
fffff880`009a93c0 fffff800`038dd530 : fffff800`03cc45cd 00000000`00000000 fffff880`009a9748 ffffffff`20206f49 : nt!KiSystemServiceCopyEnd+0x13
fffff880`009a9558 fffff800`03cc45cd : 00000000`00000000 fffff880`009a9748 ffffffff`20206f49 00000000`00000000 : nt!KiServiceLinkage
fffff880`009a9560 fffff800`03cc47ff : 00000000`00000000 fffff8a0`00763650 fffff8a0`0074a37a ffffffff`8000027c : nt!PnpIsAnyDeviceInstanceEnabled+0xed
fffff880`009a9600 fffff800`03cc5e17 : fffff880`009a9738 fffff880`0498d0e0 fffffa80`0924a900 fffffa80`0924a900 : nt!PnpPrepareDriverLoading+0x8f
fffff880`009a96e0 fffff800`03e0c296 : fffffa80`0924a970 fffffa80`0924a970 fffffa80`0924a970 fffff8a0`0000001a : nt!IopLoadDriver+0x5d7
fffff880`009a99b0 fffff800`03e0d452 : fffff800`00000000 fffff8a0`00763630 ffffffff`80000278 fffff8a0`001943b0 : nt!IopInitializeSystemDrivers+0x1d6
fffff880`009a9a40 fffff800`03e104aa : 00000000`00000000 00000000`00000010 ffffffff`8000002c fffff800`00812d50 : nt!IoInitSystem+0x9b2
fffff880`009a9b40 fffff800`03d60b79 : c7b60f40`020a41f6 fffffa80`06d51ac0 00000000`00000080 fffffa80`06d51040 : nt!Phase1InitializationDiscard+0x129a
fffff880`009a9d10 fffff800`03b7e32e : 90909090`90909090 00000000`00000080 504d8bea`8b4858ec fffff800`038d3659 : nt!Phase1Initialization+0x9
fffff880`009a9d40 fffff800`038d3666 : fffff800`03a54e80 fffffa80`06d51ac0 fffff800`03a62cc0 bd8b4807`eb081c48 : nt!PspSystemThreadStartup+0x5a
fffff880`009a9d80 00000000`00000000 : fffff880`009aa000 fffff880`009a4000 fffff880`009a7720 00000000`00000000 : nt!KiStartSystemThread+0x16


SYMBOL_STACK_INDEX:  0

SYMBOL_NAME:  nt!ExAllocatePoolWithTag+537

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  4d9fdd5b

STACK_COMMAND:  .cxr 0xfffff880009a8610 ; kb

FAILURE_BUCKET_ID:  X64_0x7E_nt!ExAllocatePoolWithTag+537

BUCKET_ID:  X64_0x7E_nt!ExAllocatePoolWithTag+537

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

SYSTEM_THREAD_EXCEPTION_NOT_HANDLED (7e)
This is a very common bugcheck.  Usually the exception address pinpoints
the driver/function that caused the problem.  Always note this address
as well as the link date of the driver/image that contains this address.
Arguments:
Arg1: ffffffffc0000005, The exception code that was not handled
Arg2: fffff80003a0d617, The address that the exception occurred at
Arg3: fffff880009a8db8, Exception Record Address
Arg4: fffff880009a8610, Context Record Address

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - Die Anweisung in 0x%08lx verweist auf Speicher 0x%08lx. Der Vorgang %s konnte nicht im Speicher durchgef hrt werden.

FAULTING_IP: 
nt!ExAllocatePoolWithTag+537
fffff800`03a0d617 48895808        mov     qword ptr [rax+8],rbx

EXCEPTION_RECORD:  fffff880009a8db8 -- (.exr 0xfffff880009a8db8)
ExceptionAddress: fffff80003a0d617 (nt!ExAllocatePoolWithTag+0x0000000000000537)
   ExceptionCode: c0000005 (Access violation)
  ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 0000000000000001
   Parameter[1]: 0000000000000008
Attempt to write to address 0000000000000008

CONTEXT:  fffff880009a8610 -- (.cxr 0xfffff880009a8610)
rax=0000000000000000 rbx=fffffa8006c982e0 rcx=fffff8a000758e90
rdx=0000000000000028 rsi=0000000000000004 rdi=0000000000000001
rip=fffff80003a0d617 rsp=fffff880009a8ff0 rbp=0000000000001000
 r8=0000000000000001  r9=fffffa8006c982e0 r10=fffffa8006c98148
r11=0000000000000001 r12=fffffa8006c98140 r13=0000000000000000
r14=fffffa8006d51ac0 r15=0000000069634d43
iopl=0         nv up ei pl zr na po nc
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010246
nt!ExAllocatePoolWithTag+0x537:
fffff800`03a0d617 48895808        mov     qword ptr [rax+8],rbx ds:002b:00000000`00000008=????????????????
Resetting default scope

PROCESS_NAME:  System

CURRENT_IRQL:  0

ERROR_CODE: (NTSTATUS) 0xc0000005 - Die Anweisung in 0x%08lx verweist auf Speicher 0x%08lx. Der Vorgang %s konnte nicht im Speicher durchgef hrt werden.

EXCEPTION_PARAMETER1:  0000000000000001

EXCEPTION_PARAMETER2:  0000000000000008

WRITE_ADDRESS:  0000000000000008 

FOLLOWUP_IP: 
nt!ExAllocatePoolWithTag+537
fffff800`03a0d617 48895808        mov     qword ptr [rax+8],rbx

BUGCHECK_STR:  0x7E

DEFAULT_BUCKET_ID:  NULL_CLASS_PTR_DEREFERENCE

LAST_CONTROL_TRANSFER:  from fffff80003c86dde to fffff80003a0d617

STACK_TEXT:  
fffff880`009a8ff0 fffff800`03c86dde : 00000000`00000001 00000000`00000000 fffff8a0`002c04e4 00000000`00000000 : nt!ExAllocatePoolWithTag+0x537
fffff880`009a90e0 fffff800`03b2f1d6 : fffff8a0`0000000e fffff880`009a9200 fffff8a0`007c5601 fffff880`00000019 : nt!CmpCallCallBacks+0xbe
fffff880`009a91b0 fffff800`038ebb14 : 00000000`00000000 fffffa80`06d51040 fffffa80`06d85080 fffff8a0`007c5620 : nt! ?? ::NNGAKEGL::`string'+0x36d7f
fffff880`009a9280 fffff800`03bd8614 : fffffa80`06d51040 00000000`00000000 fffffa80`06d51ac0 00000000`00000000 : nt!ObfDereferenceObject+0xd4
fffff880`009a92e0 fffff800`03bd8bc4 : 00000000`0000027c fffffa80`06d51040 fffff8a0`000016d0 00000000`0000027c : nt!ObpCloseHandleTableEntry+0xc4
fffff880`009a9370 fffff800`038e0f93 : fffffa80`06d51ac0 fffff880`009a9440 fffff880`009a9748 00000000`00000000 : nt!ObpCloseHandle+0x94
fffff880`009a93c0 fffff800`038dd530 : fffff800`03cc45cd 00000000`00000000 fffff880`009a9748 ffffffff`20206f49 : nt!KiSystemServiceCopyEnd+0x13
fffff880`009a9558 fffff800`03cc45cd : 00000000`00000000 fffff880`009a9748 ffffffff`20206f49 00000000`00000000 : nt!KiServiceLinkage
fffff880`009a9560 fffff800`03cc47ff : 00000000`00000000 fffff8a0`00763650 fffff8a0`0074a37a ffffffff`8000027c : nt!PnpIsAnyDeviceInstanceEnabled+0xed
fffff880`009a9600 fffff800`03cc5e17 : fffff880`009a9738 fffff880`0498d0e0 fffffa80`0924a900 fffffa80`0924a900 : nt!PnpPrepareDriverLoading+0x8f
fffff880`009a96e0 fffff800`03e0c296 : fffffa80`0924a970 fffffa80`0924a970 fffffa80`0924a970 fffff8a0`0000001a : nt!IopLoadDriver+0x5d7
fffff880`009a99b0 fffff800`03e0d452 : fffff800`00000000 fffff8a0`00763630 ffffffff`80000278 fffff8a0`001943b0 : nt!IopInitializeSystemDrivers+0x1d6
fffff880`009a9a40 fffff800`03e104aa : 00000000`00000000 00000000`00000010 ffffffff`8000002c fffff800`00812d50 : nt!IoInitSystem+0x9b2
fffff880`009a9b40 fffff800`03d60b79 : c7b60f40`020a41f6 fffffa80`06d51ac0 00000000`00000080 fffffa80`06d51040 : nt!Phase1InitializationDiscard+0x129a
fffff880`009a9d10 fffff800`03b7e32e : 90909090`90909090 00000000`00000080 504d8bea`8b4858ec fffff800`038d3659 : nt!Phase1Initialization+0x9
fffff880`009a9d40 fffff800`038d3666 : fffff800`03a54e80 fffffa80`06d51ac0 fffff800`03a62cc0 bd8b4807`eb081c48 : nt!PspSystemThreadStartup+0x5a
fffff880`009a9d80 00000000`00000000 : fffff880`009aa000 fffff880`009a4000 fffff880`009a7720 00000000`00000000 : nt!KiStartSystemThread+0x16


SYMBOL_STACK_INDEX:  0

SYMBOL_NAME:  nt!ExAllocatePoolWithTag+537

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  4d9fdd5b

STACK_COMMAND:  .cxr 0xfffff880009a8610 ; kb

FAILURE_BUCKET_ID:  X64_0x7E_nt!ExAllocatePoolWithTag+537

BUCKET_ID:  X64_0x7E_nt!ExAllocatePoolWithTag+537

Followup: MachineOwner
---------

Details zur besagten EXE:

Code:

fffff800`03862000 fffff800`03e4b000   nt         (pdb symbols)          c:\symbols\ntkrnlmp.pdb\962458112DE04DEBBFB6761B710924452\ntkrnlmp.pdb
    Loaded symbol image file: ntkrnlmp.exe
    Image path: ntkrnlmp.exe
    Image name: ntkrnlmp.exe
    Timestamp:        Sat Apr 09 06:15:23 2011 (4D9FDD5B)
    CheckSum:         0054E319
    ImageSize:        005E9000
    File version:     6.1.7601.17592
    Product version:  6.1.7601.17592
    File flags:       0 (Mask 3F)
    File OS:          40004 NT Win32
    File type:        1.0 App
    File date:        00000000.00000000
    Translations:     0409.04b0
    CompanyName:      Microsoft Corporation
    ProductName:      Microsoft® Windows® Operating System
    InternalName:     ntkrnlmp.exe
    OriginalFilename: ntkrnlmp.exe
    ProductVersion:   6.1.7601.17592
    FileVersion:      6.1.7601.17592 (win7sp1_gdr.110408-1631)
    FileDescription:  NT Kernel & System
    LegalCopyright:   © Microsoft Corporation. All rights reserved.

Jetzt tritt das gleiche Problem auch auf dem System1 des Rechners auf (Windows Updates könnten hieran schuld seien da heute welche Installiert wurden)

(System1)

Code:

Windows 7 Kernel Version 7601 (Service Pack 1) MP (8 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0xfffff800`02c53000 PsLoadedModuleList = 0xfffff800`02e98670
Debug session time: Wed Dec 14 14:30:27.190 2011 (UTC + 1:00)
System Uptime: 0 days 0:00:18.690
Loading Kernel Symbols
...............................................................
.
Loading User Symbols

Loading unloaded module list
..
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 7E, {ffffffffc0000005, fffff80002dfe617, fffff880009a9658, fffff880009a8eb0}

Probably caused by : ntkrnlmp.exe ( nt!ExAllocatePoolWithTag+537 )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

SYSTEM_THREAD_EXCEPTION_NOT_HANDLED (7e)
This is a very common bugcheck.  Usually the exception address pinpoints
the driver/function that caused the problem.  Always note this address
as well as the link date of the driver/image that contains this address.
Arguments:
Arg1: ffffffffc0000005, The exception code that was not handled
Arg2: fffff80002dfe617, The address that the exception occurred at
Arg3: fffff880009a9658, Exception Record Address
Arg4: fffff880009a8eb0, Context Record Address

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - Die Anweisung in 0x%08lx verweist auf Speicher 0x%08lx. Der Vorgang %s konnte nicht im Speicher durchgef hrt werden.

FAULTING_IP: 
nt!ExAllocatePoolWithTag+537
fffff800`02dfe617 48895808        mov     qword ptr [rax+8],rbx

EXCEPTION_RECORD:  fffff880009a9658 -- (.exr 0xfffff880009a9658)
ExceptionAddress: fffff80002dfe617 (nt!ExAllocatePoolWithTag+0x0000000000000537)
   ExceptionCode: c0000005 (Access violation)
  ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 0000000000000001
   Parameter[1]: 0000000000000008
Attempt to write to address 0000000000000008

CONTEXT:  fffff880009a8eb0 -- (.cxr 0xfffff880009a8eb0)
rax=0000000000000000 rbx=fffffa8006c962a0 rcx=fffff8a0005fdfe0
rdx=0000000000000020 rsi=0000000000000003 rdi=0000000000000001
rip=fffff80002dfe617 rsp=fffff880009a9890 rbp=0000000000001000
 r8=0000000000000001  r9=fffffa8006c962a0 r10=fffffa8006c96148
r11=0000000000000001 r12=fffffa8006c96140 r13=0000000000000000
r14=fffffa8006d69040 r15=000000006b416553
iopl=0         nv up ei pl zr na po nc
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010246
nt!ExAllocatePoolWithTag+0x537:
fffff800`02dfe617 48895808        mov     qword ptr [rax+8],rbx ds:002b:00000000`00000008=????????????????
Resetting default scope

PROCESS_NAME:  System

CURRENT_IRQL:  0

ERROR_CODE: (NTSTATUS) 0xc0000005 - Die Anweisung in 0x%08lx verweist auf Speicher 0x%08lx. Der Vorgang %s konnte nicht im Speicher durchgef hrt werden.

EXCEPTION_PARAMETER1:  0000000000000001

EXCEPTION_PARAMETER2:  0000000000000008

WRITE_ADDRESS:  0000000000000008 

FOLLOWUP_IP: 
nt!ExAllocatePoolWithTag+537
fffff800`02dfe617 48895808        mov     qword ptr [rax+8],rbx

BUGCHECK_STR:  0x7E

DEFAULT_BUCKET_ID:  NULL_CLASS_PTR_DEREFERENCE

LAST_CONTROL_TRANSFER:  from fffff80002ff5bb5 to fffff80002dfe617

STACK_TEXT:  
fffff880`009a9890 fffff800`02ff5bb5 : 00000000`00000001 00000000`00000000 00000000`00000001 fffff8a0`00000000 : nt!ExAllocatePoolWithTag+0x537
fffff880`009a9980 fffff800`02ff6cc7 : fffff800`00000024 ffffffff`80000224 ffffffff`8000021c ffffffff`80000228 : nt!AdtpObjsInitialize+0x411
fffff880`009a9a50 fffff800`031edb0b : 00000000`00000010 00000000`00000082 fffff880`009a9aa8 fffff800`0081b6b1 : nt!AdtpInitializeAuditingCommon+0x27
fffff880`009a9a80 fffff800`031eeb83 : fffff800`0081b6a0 fffff800`00812b60 fffff800`0081b6b1 fffff800`031edae4 : nt!SepAdtInitializeAuditingOptions+0xb
fffff880`009a9ab0 fffff800`0320157b : fffff800`0081b6b1 fffff800`0081b6b1 fffff800`00812b60 fffff800`00812b60 : nt!SeRmInitPhase1+0x73
fffff880`009a9b40 fffff800`03151979 : 305d3800`000080bd fffffa80`06d69040 00000000`00000080 fffffa80`06d683d0 : nt!Phase1InitializationDiscard+0x134b
fffff880`009a9d10 fffff800`02f6afee : 8348f5ff`90909090 00000000`00000080 fffbe888`058b4860 fffff800`02cc15d9 : nt!Phase1Initialization+0x9
fffff880`009a9d40 fffff800`02cc15e6 : fffff800`02e45e80 fffffa80`06d69040 fffff800`02e53cc0 90c35d20`c48348ff : nt!PspSystemThreadStartup+0x5a
fffff880`009a9d80 00000000`00000000 : fffff880`009aa000 fffff880`009a4000 fffff880`009a82a0 00000000`00000000 : nt!KxStartSystemThread+0x16


SYMBOL_STACK_INDEX:  0

SYMBOL_NAME:  nt!ExAllocatePoolWithTag+537

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  4e02aaa3

STACK_COMMAND:  .cxr 0xfffff880009a8eb0 ; kb

FAILURE_BUCKET_ID:  X64_0x7E_nt!ExAllocatePoolWithTag+537

BUCKET_ID:  X64_0x7E_nt!ExAllocatePoolWithTag+537

Followup: MachineOwner
---------

Und hier nochmals die EXE

Code:

fffff800`02c53000 fffff800`0323c000   nt         (pdb symbols)          c:\symbols\ntkrnlmp.pdb\47F5C3BF9E0A493C9F63BB8F6413358B2\ntkrnlmp.pdb
    Loaded symbol image file: ntkrnlmp.exe
    Image path: ntkrnlmp.exe
    Image name: ntkrnlmp.exe
    Timestamp:        Thu Jun 23 04:53:23 2011 (4E02AAA3)
    CheckSum:         0055C228
    ImageSize:        005E9000
    File version:     6.1.7601.17640
    Product version:  6.1.7601.17640
    File flags:       0 (Mask 3F)
    File OS:          40004 NT Win32
    File type:        1.0 App
    File date:        00000000.00000000
    Translations:     0409.04b0
    CompanyName:      Microsoft Corporation
    ProductName:      Microsoft® Windows® Operating System
    InternalName:     ntkrnlmp.exe
    OriginalFilename: ntkrnlmp.exe
    ProductVersion:   6.1.7601.17640
    FileVersion:      6.1.7601.17640 (win7sp1_gdr.110622-1506)
    FileDescription:  NT Kernel & System
    LegalCopyright:   © Microsoft Corporation. All rights reserved

Targa 826 · 15. Dezember 2011

Gib mal die Hardware des Systems an und teste die Festplatte, da beide Betriebssysteme nicht nur den RAM gemeinsam nutzen.

simpel1970 · 15. Dezember 2011

iamhermes schrieb:
Das System2 davon ist nicht mehr Bootbar (auch der abgesicherte Modus fährt nur teilweise hoch) da dort ein Bluescreen auftritt.

Wenn das Problem durch Updates verursacht wurde, könnte es helfen, wenn du mit F8 zu den erweiterten Systemstartoptionen wechselst (wie zum abgesicherten Modus) und dort den Eintrag "mit der als zuletzt funktionierend bekannten Konfiguration starten" auswählst.

Wenn nicht...in den Bluescreens wird eine Speicherzugriffsverletzung beschrieben. Speicher i.d.S. kann insbes. RAM, VRAM, CPU-Cache oder Festplatte sein. Den RAM hast du ja schon überprüft...

iamhermes · 15. Dezember 2011

Eine Intel Core i7 870 CPU, 8GB Ram (4x2GB Corsair XMS3 9-9-9-24), Asus Maximus 3 Formula.
5 Festplatten hängen am ICH Controller. Dort sind zwei Raid0 mit jeweils zwei WD Raptor Festplatten eingerichtet und jeweils auf diesen Raids sitzt System1 bzw System2.

Ich habe dort heute das System2 neu Installiert und nebenbei noch das BIOS auf den aktuellen Stand gebracht (0603 war drauf) um auch diese Fehlerquelle auszuschließen.
Das frisch Installierte System2 läuft derzeit ohne jegliche Bluescreens.

Suche

Bluescreen und weis nicht weiter (MemoryDump-Details vorhanden)

iamhermes

Cadet 3rd Year

Targa 826

Lt. Commander

simpel1970

Fleet Admiral

iamhermes

Cadet 3rd Year

Ähnliche Themen