Bluescreen-ntkrnlmp.exe

[Raigeki]

Hallo, seit ein paar Tagen ist mir meine PC manachmal abgestüzt. Nun wollt ich fragen was das Problem genau ist, denn mit "caused by ntkrnlmp.exe" kann ich wenig anfangen.
Mein PC:
CPU: Intel Xeon E3-1231 v3, 4x 3.40GHz
Mainboard: Gigabyte GA-H97-D3H
RAM: Crucial Ballistix Sport DIMM Kit 8GB
Netzteil: be quiet! Straight Power 10 500W
Grafikkarte: Gigabyte GeForce GTX 970

Ich hoff ihr könnt mir helfen, gruß
Lukas

Microsoft (R) Windows Debugger Version 6.3.9600.17200 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Windows\MEMORY.DMP]
Kernel Summary Dump File: Only kernel address space is available

Symbol search path is: *** Invalid ***
****************************************************************************
* Symbol loading may be unreliable without a symbol search path.           *
* Use .symfix to have the debugger choose a symbol path.                   *
* After setting your symbol path, use .reload to refresh symbol locations. *
****************************************************************************
Executable search path is: 
*********************************************************************
* Symbols can not be loaded because symbol path is not initialized. *
*                                                                   *
* The Symbol Path can be set by:                                    *
*   using the _NT_SYMBOL_PATH environment variable.                 *
*   using the -y <symbol_path> argument when starting the debugger. *
*   using .sympath and .sympath+                                    *
*********************************************************************
*** ERROR: Symbol file could not be found.  Defaulted to export symbols for ntkrnlmp.exe - 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (8 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7601.18409.amd64fre.win7sp1_gdr.140303-2144
Machine Name:
Kernel base = 0xfffff800`02e09000 PsLoadedModuleList = 0xfffff800`0304c890
Debug session time: Thu Dec  4 20:45:26.500 2014 (UTC + 1:00)
System Uptime: 0 days 2:34:10.170
*********************************************************************
* Symbols can not be loaded because symbol path is not initialized. *
*                                                                   *
* The Symbol Path can be set by:                                    *
*   using the _NT_SYMBOL_PATH environment variable.                 *
*   using the -y <symbol_path> argument when starting the debugger. *
*   using .sympath and .sympath+                                    *
*********************************************************************
*** ERROR: Symbol file could not be found.  Defaulted to export symbols for ntkrnlmp.exe - 
Loading Kernel Symbols
...............................................................
................................................................
........................
Loading User Symbols

Loading unloaded module list
.....

************* Symbol Loading Error Summary **************
Module name            Error
ntkrnlmp               The system cannot find the file specified

You can troubleshoot most symbol related issues by turning on symbol loading diagnostics (!sym noisy) and repeating the command that caused symbols to be loaded.
You should also verify that your symbol search path (.sympath) is correct.
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1E, {0, 0, 0, 0}

***** Kernel symbols are WRONG. Please fix symbols to do analysis.

*************************************************************************
***                                                                   ***
***                                                                   ***
***    Either you specified an unqualified symbol, or your debugger   ***
***    doesn't have full symbol information.  Unqualified symbol      ***
***    resolution is turned off by default. Please either specify a   ***
***    fully qualified symbol module!symbolname, or enable resolution ***
***    of unqualified symbols by typing ".symopt- 100". Note that   ***
***    enabling unqualified symbol resolution with network symbol     ***
***    server shares in the symbol path may cause the debugger to     ***
***    appear to hang for long periods of time when an incorrect      ***
***    symbol name is typed or the network symbol server is down.     ***
***                                                                   ***
***    For some commands to work properly, your symbol path           ***
***    must point to .pdb files that have full type information.      ***
***                                                                   ***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                          ***
***                                                                   ***
***    Type referenced: nt!_KPRCB                                     ***
***                                                                   ***
*************************************************************************
*************************************************************************
***                                                                   ***
***                                                                   ***
***    Either you specified an unqualified symbol, or your debugger   ***
***    doesn't have full symbol information.  Unqualified symbol      ***
***    resolution is turned off by default. Please either specify a   ***
***    fully qualified symbol module!symbolname, or enable resolution ***
***    of unqualified symbols by typing ".symopt- 100". Note that   ***
***    enabling unqualified symbol resolution with network symbol     ***
***    server shares in the symbol path may cause the debugger to     ***
***    appear to hang for long periods of time when an incorrect      ***
***    symbol name is typed or the network symbol server is down.     ***
***                                                                   ***
***    For some commands to work properly, your symbol path           ***
***    must point to .pdb files that have full type information.      ***
***                                                                   ***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                          ***
***                                                                   ***
***    Type referenced: nt!KPRCB                                      ***
***                                                                   ***

***                                                                   ***
***                                                                   ****************************************************************************
*************************************************************************
***                                                                   ***
***                                                                   ***
***    Either you specified an unqualified symbol, or your debugger   ***
***    doesn't have full symbol information.  Unqualified symbol      ***
***    resolution is turned off by default. Please either specify a   ***
***    fully qualified symbol module!symbolname, or enable resolution ***
***    of unqualified symbols by typing ".symopt- 100". Note that   ***
***    enabling unqualified symbol resolution with network symbol     ***
***    server shares in the symbol path may cause the debugger to     ***
***    appear to hang for long periods of time when an incorrect      ***
***    symbol name is typed or the network symbol server is down.     ***
***                                                                   ***
***    For some commands to work properly, your symbol path           ***
***    must point to .pdb files that have full type information.      ***
***                                                                   ***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                          ***
***                                                                   ***
***    Type referenced: nt!_KPRCB                                     ***
***                                                                   ***
*************************************************************************
Probably caused by : ntkrnlmp.exe ( nt!KiCpuId+3ee )

Followup: MachineOwner
---------

2: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

KMODE_EXCEPTION_NOT_HANDLED (1e)
This is a very common bugcheck.  Usually the exception address pinpoints
the driver/function that caused the problem.  Always note this address
as well as the link date of the driver/image that contains this address.
Arguments:
Arg1: 0000000000000000, The exception code that was not handled
Arg2: 0000000000000000, The address that the exception occurred at
Arg3: 0000000000000000, Parameter 0 of the exception
Arg4: 0000000000000000, Parameter 1 of the exception

Debugging Details:
------------------

***** Kernel symbols are WRONG. Please fix symbols to do analysis.

*************************************************************************
***                                                                   ***
***                                                                   ***
***    Either you specified an unqualified symbol, or your debugger   ***
***    doesn't have full symbol information.  Unqualified symbol      ***
***    resolution is turned off by default. Please either specify a   ***
***    fully qualified symbol module!symbolname, or enable resolution ***
***    of unqualified symbols by typing ".symopt- 100". Note that   ***
***    enabling unqualified symbol resolution with network symbol     ***
***    server shares in the symbol path may cause the debugger to     ***
***    appear to hang for long periods of time when an incorrect      ***
***    symbol name is typed or the network symbol server is down.     ***
***                                                                   ***
***    For some commands to work properly, your symbol path           ***
***    must point to .pdb files that have full type information.      ***
***                                                                   ***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                          ***
***                                                                   ***
***    Type referenced: nt!_KPRCB                                     ***
***                                                                   ***
*************************************************************************
*************************************************************************
***                                                                   ***
***                                                                   ***
***    Either you specified an unqualified symbol, or your debugger   ***
***    doesn't have full symbol information.  Unqualified symbol      ***
***    resolution is turned off by default. Please either specify a   ***
***    fully qualified symbol module!symbolname, or enable resolution ***
***    of unqualified symbols by typing ".symopt- 100". Note that   ***
***    enabling unqualified symbol resolution with network symbol     ***
***    server shares in the symbol path may cause the debugger to     ***
***    appear to hang for long periods of time when an incorrect      ***
***    symbol name is typed or the network symbol server is down.     ***
***                                                                   ***
***    For some commands to work properly, your symbol path           ***
***    must point to .pdb files that have full type information.      ***
***                                                                   ***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                          ***
***                                                                   ***
***    Type referenced: nt!KPRCB                                      ***
***                                                                   ***
*************************************************************************
*************************************************************************
***                                                                   ***
***                                                                   ***
***    Either you specified an unqualified symbol, or your debugger   ***
***    doesn't have full symbol information.  Unqualified symbol      ***
***    resolution is turned off by default. Please either specify a   ***
***    fully qualified symbol module!symbolname, or enable resolution ***
***    of unqualified symbols by typing ".symopt- 100". Note that   ***
***    enabling unqualified symbol resolution with network symbol     ***
***    server shares in the symbol path may cause the debugger to     ***
***    appear to hang for long periods of time when an incorrect      ***
***    symbol name is typed or the network symbol server is down.     ***
***                                                                   ***
***    For some commands to work properly, your symbol path           ***
***    must point to .pdb files that have full type information.      ***
***                                                                   ***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                          ***
***                                                                   ***
***    Type referenced: nt!_KPRCB                                     ***
***                                                                   ***
*************************************************************************
*************************************************************************
***                                                                   ***
***                                                                   ***
***    Either you specified an unqualified symbol, or your debugger   ***
***    doesn't have full symbol information.  Unqualified symbol      ***
***    resolution is turned off by default. Please either specify a   ***
***    fully qualified symbol module!symbolname, or enable resolution ***
***    of unqualified symbols by typing ".symopt- 100". Note that   ***
***    enabling unqualified symbol resolution with network symbol     ***
***    server shares in the symbol path may cause the debugger to     ***
***    appear to hang for long periods of time when an incorrect      ***
***    symbol name is typed or the network symbol server is down.     ***
***                                                                   ***
***    For some commands to work properly, your symbol path           ***
***    must point to .pdb files that have full type information.      ***
***                                                                   ***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                          ***
***                                                                   ***
***    Type referenced: nt!KPRCB                                      ***
***                                                                   ***
*************************************************************************
*************************************************************************
***                                                                   ***
***                                                                   ***
***    Either you specified an unqualified symbol, or your debugger   ***
***    doesn't have full symbol information.  Unqualified symbol      ***
***    resolution is turned off by default. Please either specify a   ***
***    fully qualified symbol module!symbolname, or enable resolution ***
***    of unqualified symbols by typing ".symopt- 100". Note that   ***
***    enabling unqualified symbol resolution with network symbol     ***
***    server shares in the symbol path may cause the debugger to     ***
***    appear to hang for long periods of time when an incorrect      ***
***    symbol name is typed or the network symbol server is down.     ***
***                                                                   ***
***    For some commands to work properly, your symbol path           ***
***    must point to .pdb files that have full type information.      ***
***                                                                   ***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                          ***
***                                                                   ***
***    Type referenced: nt!_KPRCB                                     ***
***                                                                   ***
*************************************************************************
*************************************************************************
***                                                                   ***
***                                                                   ***
***    Either you specified an unqualified symbol, or your debugger   ***
***    doesn't have full symbol information.  Unqualified symbol      ***
***    resolution is turned off by default. Please either specify a   ***
***    fully qualified symbol module!symbolname, or enable resolution ***
***    of unqualified symbols by typing ".symopt- 100". Note that   ***
***    enabling unqualified symbol resolution with network symbol     ***
***    server shares in the symbol path may cause the debugger to     ***
***    appear to hang for long periods of time when an incorrect      ***
***    symbol name is typed or the network symbol server is down.     ***
***                                                                   ***
***    For some commands to work properly, your symbol path           ***
***    must point to .pdb files that have full type information.      ***
***                                                                   ***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                          ***
***                                                                   ***
***    Type referenced: nt!_KPRCB                                     ***
***                                                                   ***
*************************************************************************
*************************************************************************
***                                                                   ***
***                                                                   ***
***    Either you specified an unqualified symbol, or your debugger   ***
***    doesn't have full symbol information.  Unqualified symbol      ***
***    resolution is turned off by default. Please either specify a   ***
***    fully qualified symbol module!symbolname, or enable resolution ***
***    of unqualified symbols by typing ".symopt- 100". Note that   ***
***    enabling unqualified symbol resolution with network symbol     ***
***    server shares in the symbol path may cause the debugger to     ***
***    appear to hang for long periods of time when an incorrect      ***
***    symbol name is typed or the network symbol server is down.     ***
***                                                                   ***
***    For some commands to work properly, your symbol path           ***
***    must point to .pdb files that have full type information.      ***
***                                                                   ***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                          ***
***                                                                   ***
***    Type referenced: nt!_KPRCB                                     ***
***                                                                   ***
*************************************************************************
*************************************************************************
***                                                                   ***
***                                                                   ***
***    Either you specified an unqualified symbol, or your debugger   ***
***    doesn't have full symbol information.  Unqualified symbol      ***
***    resolution is turned off by default. Please either specify a   ***
***    fully qualified symbol module!symbolname, or enable resolution ***
***    of unqualified symbols by typing ".symopt- 100". Note that   ***
***    enabling unqualified symbol resolution with network symbol     ***
***    server shares in the symbol path may cause the debugger to     ***
***    appear to hang for long periods of time when an incorrect      ***
***    symbol name is typed or the network symbol server is down.     ***
***                                                                   ***
***    For some commands to work properly, your symbol path           ***
***    must point to .pdb files that have full type information.      ***
***                                                                   ***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                          ***
***                                                                   ***
***    Type referenced: nt!_KPRCB                                     ***
***                                                                   ***
*************************************************************************

ADDITIONAL_DEBUG_TEXT:  
You can run '.symfix; .reload' to try to fix the symbol path and load symbols.

MODULE_NAME: nt

FAULTING_MODULE: fffff80002e09000 nt

DEBUG_FLR_IMAGE_TIMESTAMP:  531590fb

DEFAULT_BUCKET_ID:  WIN7_DRIVER_FAULT

BUGCHECK_STR:  0x1E

CURRENT_IRQL:  0

ANALYSIS_VERSION: 6.3.9600.17237 (debuggers(dbg).140716-0327) x86fre

LAST_CONTROL_TRANSFER:  from fffff80002e765be to fffff80002e7eb90

STACK_TEXT:  
fffff880`0398c2c8 fffff800`02e765be : fffff880`0398c2e0 00000000`00000001 fffff880`0398ca40 fffff800`02ea9a90 : nt!KeBugCheck
fffff880`0398c2d0 fffff800`02ea975d : fffff800`0308d380 fffff800`02fca260 fffff800`02e09000 fffff880`0398d1e8 : nt!KiCpuId+0x3ee
fffff880`0398c300 fffff800`02ea8535 : fffff800`02fce038 fffff880`0398c378 fffff880`0398d1e8 fffff800`02e09000 : nt!RtlUnwindEx+0x99d
fffff880`0398c330 fffff800`02eb94c1 : fffff880`0398d1e8 fffff880`0398ca40 fffff880`00000000 fffffa80`067deb50 : nt!FsRtlDissectName+0x6b5
fffff880`0398ca10 fffff800`02e7e242 : fffff880`0398d1e8 fffffa80`067deb58 fffff880`0398d290 00000000`00000000 : nt!IoGetPagingIoPriority+0x901
fffff880`0398d0b0 fffff800`02e7cb4a : fffffa80`0a668860 fffff880`0226ac4e 00000000`00000089 fffff880`0227a7d9 : nt!KeSynchronizeExecution+0x3e12
fffff880`0398d290 fffff800`02e868d2 : fffffa80`06a91508 fffffa80`06a91508 00000000`00000000 fffffa80`06a91500 : nt!KeSynchronizeExecution+0x271a
fffff880`0398d420 fffff800`02e8969d : fffffa80`067deb50 fffffa80`0b6f2168 fffffa80`0b6f2168 00000000`00000102 : nt!KeRemoveQueueEx+0xa12
fffff880`0398d4a0 fffff800`02f06a3a : 00000015`8987edb4 fffff880`0398db18 00000000`00090c23 fffff880`039679e8 : nt!KeReleaseMutant+0x96d
fffff880`0398daf0 fffff800`02e8930c : 00000001`680269ff 00000001`00090c3a 00000001`680269c5 00000000`00000023 : nt!wcsncat_s+0x37642
fffff880`0398db90 fffff800`02e768ca : fffff880`03965180 fffff880`039700c0 00000000`00000000 fffff800`02faae40 : nt!KeReleaseMutant+0x5dc
fffff880`0398dc40 00000000`00000000 : fffff880`0398e000 fffff880`03988000 fffff880`0398dc00 00000000`00000000 : nt!KiCpuId+0x6fa


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt!KiCpuId+3ee
fffff800`02e765be 90              nop

SYMBOL_STACK_INDEX:  1

SYMBOL_NAME:  nt!KiCpuId+3ee

FOLLOWUP_NAME:  MachineOwner

IMAGE_NAME:  ntkrnlmp.exe

IMAGE_VERSION:  6.1.7601.18409

BUCKET_ID:  WRONG_SYMBOLS

FAILURE_BUCKET_ID:  WRONG_SYMBOLS

ANALYSIS_SOURCE:  KM

FAILURE_ID_HASH_STRING:  km:wrong_symbols

FAILURE_ID_HASH:  {70b057e8-2462-896f-28e7-ac72d4d365f8}

Followup: MachineOwner
---------

Ich hab den Crash Text im Mittelteil etwas gekürzt, das sonst mein Post zu groß währe.

 

[e_Lap]

Mal memtest 86 durchlaufen lassen? Halbdefekterram ruft gerne Bluscreens hervor.
Einfach aufn fat32 usbstick ziehen und booten.

 

[Raigeki]

Hab jetzt das Programm MemTest durchlaufen lassen (ca 1 Stunde lang). Es hat keinen Error gefunden.

 

[simpel1970]

Lade bitte die Minidump(s) hier im Forum hoch.
Poste außerdem noch ein paar Screenshots von CPU-Z (Reiter Mainboard, CPU, Memory und SPD), sowie einen von GPU-Z.

Was hängt denn noch an bzw. im PC, was Eingangs noch nicht erwähnt wurde (insbes. Zusatzkarten, WLan Adapter, etc.).

Kannst du erkennen, ob der PC bei bestimmten Situationen abstürzt (unter Last, bei Spielen, im Idle), oder treten die Abstürze willkürlich auf?

 

[Raigeki]

Hallo, hier die die Screns von CPU-Z. Ich weiß nicht was noch an meinem Pc angelossen seien sollte, was nicht wirklich standart ist. Ich habe 1 SSD und ein 2TP Festplatte, wenn du das meinst.

Ich habe bei dem Programm CPU-Z noch das Tool zur Driver überprüfung heruntergeladen. Ich habe auch davon Screns gemacht. Wiso werden mir 8 veraltete Driver angezeit, obwohl ich bei Geräte-Manager alle veralteten Treiber aktualisiert habe.

Macht es einen Unterschied ob ich mit memtest oder mit memtest86 meinen Ram geprüft habe?

Gruß Lukas

 

[simpel1970]

Die Treiberaktualisierung über den Gerätemanager kannst du dir schenken. Das Tool zur Treiberüberprüfung solltest du aber auch nicht nutzen.
Im Gerätemanager werden aber scheinbar noch zwei unbekannte Geräte aufgelistet (bei den USB Verbundgeräten). Hier mal im Gerätemanager die Eigenschaften -> HardwareID ansehen und einen Screenshot posten.

Aktiviere außerdem im Bios das XMP Profil und beobachte, ob die Probleme bleiben.

Bei Memtest macht es einen Unterschied, ob du das Tool unter Windows oder außerhalb von Windows laufen lässt. Innerhalb der Windows-Umgebung wird immer ein gewisser Speicherbereich exklusiv für das Betriebssystem gesperrt, auf den die Prüfung nicht zugreifen kann.
Deshalb wäre die Prüfung außerhalb von Windows vorzuziehen.

Lade bitte die Dump noch hier hoch.

 

[Raigeki]

Tut mir leid ich kann die Dump nicht hochladen, da sie schon von einer neuen überschrieben wurde. Das war aber ein anderes Problem (wahrscheinlich von kasperky). Wenn es einen Dateipfad gibt, wo ich alte Dumps finde, dann poste ihn doch bitte. Um noch eine Frage zu beantworten, der PC ist mir noch nie unterm Spielen abgestürtzt. Einmal, wie ich ihn hochgefahren habe und nach ca. 1 Stunde wieder gekommen bin, war er wieder im Einloggbildschirm von Windows7. Die anderen mal war es beim surven im Internet.

Nun zu den Treibern: Was muss ich machen damit sie sich am besten selbständig aktualisieren? Oder muss ich alle Treiber manauel im Internet downloaden?

Gruß Lukas

Ergänzung (11. Dezember 2014)

So, ich hab nun mit memtest86+ getestet (54 min). Das Programm konnte keinen Error finden.

 

[simpel1970]

Im Geräte Manager wird kein unbekanntes Gerät aufgeführt. Insoweit passt das von der Seite her.

Dump werden entweder im Verzeichnis C:\Windows\Minidumps (sofern das kleine Speicherabbild eingestellt ist), oder im Verzeichnis C:\Windows (als MEMORY.DMP Datei, sofern das vollständige Speicherabbild eingestellt ist) abgespeichert.
Ist in den erweiterten Systemeinstellungen eingestellt, dass die Dumps überschrieben werden (was eigentlich nur bei den vollständigen Dumps Sinn macht, da diese mehrere Hundert MB groß werden können), sind alte Dumps nicht mehr vorhanden.
In deinem Fall würde es sinn machen, in den erweiterten Systemeinstellungen die kleinen Speicherabbilder (Minidumps) einzustellen und den Haken bei "vorhandene Dumps/Dateien überschreiben" raus zu machen.
So kommst du zu der entsprechenden Einstellung: http://extreme.pcgameshardware.de/k...eme/330538-howto-bluescreenauswertung.html#a1

Bezüglich Treiberaktualisierung. Sollte das System fehlerfrei laufen, ist es grundsätzlich nicht erforderlich ständig nach den aktuellsten Treibern ausschau zu halten (Ausnahme: Grafikkartentreiber). Frei nach dem Grundsatz: "Never change a running System".
Wenn du aber nach aktuellen Treiber suchst (insbes. da veraltete Treiber als mögliche Fehlerursache in Frage kommen), musst du die Treiber manuell beim jeweiligen Chip-/Gerätehersteller abrufen.