W7 sporadischer BlueScreen

GizmoBoy

Lieutenant
Dabei seit
Okt. 2006
Beiträge
927
Moin,

habe den Dump vom Kumpel und bin mir nicht mehr ganz sicher was der Fehler ist... Habe schon lange keine Dumps mehr durchforstet.

Code:
Microsoft (R) Windows Debugger Version 6.11.0001.404 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\tj\Desktop\110210-18938-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\Windows\Symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7600 MP (2 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16617.amd64fre.win7_gdr.100618-1621
Machine Name:
Kernel base = 0xfffff800`02a13000 PsLoadedModuleList = 0xfffff800`02c50e50
Debug session time: Tue Nov  2 08:07:10.414 2010 (GMT+1)
System Uptime: 0 days 22:42:15.381
Loading Kernel Symbols
...............................................................
................................................................
..................................
Loading User Symbols
Loading unloaded module list
..................
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck D1, {9, 2, 0, fffff88002d38680}

*** WARNING: Unable to verify timestamp for win32k.sys
*** ERROR: Module load completed but symbols could not be loaded for win32k.sys
Probably caused by : memory_corruption

Followup: memory_corruption
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: 0000000000000009, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000000, value 0 = read operation, 1 = write operation
Arg4: fffff88002d38680, address which referenced memory

Debugging Details:
------------------


READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80002cbb0e0
 0000000000000009 

CURRENT_IRQL:  2

FAULTING_IP: 
afd!AfdDerefPollInfoFileObjects+30
fffff880`02d38680 ff14d2          call    qword ptr [rdx+rdx*8]

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  CODE_CORRUPTION

BUGCHECK_STR:  0xD1

PROCESS_NAME:  System

TRAP_FRAME:  fffff88002fd9420 -- (.trap 0xfffff88002fd9420)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=00000000bfffff01 rbx=0000000000000000 rcx=fffffa8007845ba0
rdx=0000000000000001 rsi=0000000000000000 rdi=0000000000000000
rip=fffff88002d38680 rsp=fffff88002fd95b0 rbp=ffffffffffffffff
 r8=fffff80002a13000  r9=0000000000000000 r10=fffffa800646afa0
r11=0000000000000002 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl nz na pe nc
afd!AfdDerefPollInfoFileObjects+0x30:
fffff880`02d38680 ff14d2          call    qword ptr [rdx+rdx*8] ds:8100:00000000`00000009=????????????????
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff80002a82ca9 to fffff80002a83740

STACK_TEXT:  
fffff880`02fd92d8 fffff800`02a82ca9 : 00000000`0000000a 00000000`00000009 00000000`00000002 00000000`00000000 : nt!KeBugCheckEx
fffff880`02fd92e0 fffff800`02a81920 : 00000000`00000000 fffffa80`0738c2a0 00000000`00000000 00000000`00000000 : nt!KiBugCheckDispatch+0x69
fffff880`02fd9420 fffff880`02d38680 : 00000000`00000002 00000000`00000000 fffffa80`0738c2a0 fffffa80`0450dcc0 : nt!KiPageFault+0x260
fffff880`02fd95b0 fffff880`02d3860a : 00000000`00000000 fffffa80`0738c2a0 fffffa80`03e0d220 fffff880`02d386e5 : afd!AfdDerefPollInfoFileObjects+0x30
fffff880`02fd95e0 fffff880`02d2d448 : 00000000`00000000 00000000`00000000 fffffa80`0450dcc0 00000000`00000001 : afd!AfdCompletePollIrp+0x9a
fffff880`02fd9630 fffff880`02cf188c : fffffa80`0738c3d0 00000000`00000000 00000000`00001000 fffffa80`0431bde0 : afd!AfdIndicatePollEvent+0x138
fffff880`02fd9680 fffff880`02d380f9 : 00000000`00000000 00000000`00000001 fffffa80`04c44080 00000000`00000000 : afd!AfdReceiveDatagramEventCommonHandler+0x35c
fffff880`02fd9720 fffff880`0183f395 : fffffa80`04ecdb70 fffffa80`04c01830 00000000`00000000 fffffa80`04ecdb70 : afd!AfdTLDgramReceiveEventHandler+0xe9
fffff880`02fd97b0 fffff880`0183f76d : fffffa80`00000028 fffffa80`04ecdb70 fffffa80`00000000 fffffa80`0501af68 : tcpip!UdpDeliverDatagrams+0x155
fffff880`02fd9940 fffff880`0185d727 : fffffa80`04c039c0 fffffa80`0640c000 00000000`00000017 fffff880`049c1080 : tcpip!UdpReceiveDatagrams+0x1ed
fffff880`02fd9a30 fffff880`0185d799 : fffff880`02fd9bb0 fffff880`01966800 fffff880`02fd9bc0 00000000`00000000 : tcpip!IppDeliverListToProtocol+0xf7
fffff880`02fd9af0 fffff880`0185dc90 : 00000000`00000000 fffff800`02a8a992 00000000`0000001d fffff880`02fd9bb0 : tcpip!IppProcessDeliverList+0x59
fffff880`02fd9b60 fffff880`018347c2 : fffffa80`03d01b60 fffff880`049b8ab1 00000000`00000000 fffffa80`04bcc800 : tcpip!IppReceiveHeaderBatch+0x231
fffff880`02fd9c40 fffff800`02d7fc43 : fffffa80`04bcc800 fffff800`02c285f8 fffffa80`03d01b60 fffffa80`04c00cd0 : tcpip!IppLoopbackTransmit+0x72
fffff880`02fd9c80 fffff800`02a90961 : fffff800`02c28500 fffff800`02d7fc20 fffffa80`03d01b60 00000000`00000000 : nt!IopProcessWorkItem+0x23
fffff880`02fd9cb0 fffff800`02d27c06 : 30303031`30302e30 fffffa80`03d01b60 00000000`00000080 fffffa80`03cedb30 : nt!ExpWorkerThread+0x111
fffff880`02fd9d40 fffff800`02a61c26 : fffff880`009e7180 fffffa80`03d01b60 fffff880`009f1f40 4230312e`2a7b2020 : nt!PspSystemThreadStartup+0x5a
fffff880`02fd9d80 00000000`00000000 : fffff880`02fda000 fffff880`02fd4000 fffff880`02fd99f0 00000000`00000000 : nt!KxStartSystemThread+0x16


STACK_COMMAND:  kb

CHKIMG_EXTENSION: !chkimg -lo 50 -db !afd
2 errors : !afd (fffff88002d38481-fffff88002d38681)
fffff88002d38480  44 *2e  28  41  8b  44  24  08  89  44  24  20  41  b9  01  00 D.(A.D$..D$ A...
...
fffff88002d38680  ff *14  d2  8e  fc  ff  48  c7  07  00  00  00  00  ff  c6  48 ......H........H

MODULE_NAME: memory_corruption

IMAGE_NAME:  memory_corruption

FOLLOWUP_NAME:  memory_corruption

DEBUG_FLR_IMAGE_TIMESTAMP:  0

MEMORY_CORRUPTOR:  STRIDE

FAILURE_BUCKET_ID:  X64_MEMORY_CORRUPTION_STRIDE

BUCKET_ID:  X64_MEMORY_CORRUPTION_STRIDE

Followup: memory_corruption
---------

0: kd> .trap 0xfffff88002fd9420
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=00000000bfffff01 rbx=0000000000000000 rcx=fffffa8007845ba0
rdx=0000000000000001 rsi=0000000000000000 rdi=0000000000000000
rip=fffff88002d38680 rsp=fffff88002fd95b0 rbp=ffffffffffffffff
 r8=fffff80002a13000  r9=0000000000000000 r10=fffffa800646afa0
r11=0000000000000002 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl nz na pe nc
afd!AfdDerefPollInfoFileObjects+0x30:
fffff880`02d38680 ff14d2          call    qword ptr [rdx+rdx*8] ds:8100:00000000`00000009=????????????????
Danke für jede Hilfe.
 

nitech

Lt. Commander
Dabei seit
Mai 2009
Beiträge
1.659
Schaut für mich nach Ram Probleme aus. Flasches Timing, falsche Volt oder auch ein Modul kaputt.
 

Whistler_US

Ensign
Dabei seit
Okt. 2010
Beiträge
235
Guten Morgen,

in den letzten Zeilen steht doch memory Corruption. Also entweder is en Riegel verraucht oder die RAM-Einstellungen stimmen nich. Hast im Bios mal alles auf default bzw. auto gesetzt?

Edit: Hast du in den letzten Tagen oder so Hardware gewechselt? Wenn ja, dann diese wieder ausbauen, neustarten und testen.
 
Zuletzt bearbeitet:

GizmoBoy

Lieutenant
Ersteller dieses Themas
Dabei seit
Okt. 2006
Beiträge
927
Hallo Jungs,

da es ein Lappi vom Kumpel ist und ich weiß das er nicht viel Ahnung hat, wurden keine Einstellungen im Bios vorgenommen.
Ich schaue mir das trotzdem noch an.

Danke euch schon mal für die Hilfe. Werde hier alles auf dem laufenden halten.

Viele Grüße,
Gizmo
 

simpel1970

Fleet Admiral
Dabei seit
Apr. 2009
Beiträge
16.261
Sieht zunächst nach RAM Problemen aus. Überprüfe die RAM mit Memtest86+ auf Fehler.

Ist es immer der gleiche Stopfehler?

Wenn ja, könnte das Problem auch durch einen Treiber oder Firewallsoftware verursacht werden.
Der Auswertung nach gibt es Probleme mit dem Netzwerk bzw. den -Treibern. Evtl. aktuellere LAN- /WLAN Treiber installieren.

Was für eine Firewall hat dein Kumpel installiert?
 

pitu

Commodore
Dabei seit
Dez. 2005
Beiträge
4.099
hi,

mein pc macht auch probleme, was könnt ihr dazu sagen ?


Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Windows\Minidump\010211-85593-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*C:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7600 MP (2 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16617.amd64fre.win7_gdr.100618-1621
Machine Name:
Kernel base = 0xfffff800`02a5e000 PsLoadedModuleList = 0xfffff800`02c9be50
Debug session time: Sun Jan 2 21:12:11.613 2011 (UTC + 1:00)
System Uptime: 0 days 0:22:28.519
Loading Kernel Symbols
...............................................................
................................................................
......................
Loading User Symbols
Loading unloaded module list
....
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 18, {0, fffff80002bcdd30, 2, 83fff08289e8283f}

*** WARNING: Unable to verify timestamp for win32k.sys
*** ERROR: Module load completed but symbols could not be loaded for win32k.sys
Probably caused by : memory_corruption

Followup: memory_corruption
---------

1: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

REFERENCE_BY_POINTER (18)
Arguments:
Arg1: 0000000000000000, Object type of the object whose reference count is being lowered
Arg2: fffff80002bcdd30, Object whose reference count is being lowered
Arg3: 0000000000000002, Reserved
Arg4: 83fff08289e8283f, Reserved
The reference count of an object is illegal for the current state of the object.
Each time a driver uses a pointer to an object the driver calls a kernel routine
to increment the reference count of the object. When the driver is done with the
pointer the driver calls another kernel routine to decrement the reference count.
Drivers must match calls to the increment and decrement routines. This bugcheck
can occur because an object's reference count goes to zero while there are still
open handles to the object, in which case the fourth parameter indicates the number
of opened handles. It may also occur when the object’s reference count drops below zero
whether or not there are open handles to the object, and in that case the fourth parameter
contains the actual value of the pointer references count.

Debugging Details:
------------------


CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: CODE_CORRUPTION

BUGCHECK_STR: 0x18

PROCESS_NAME: System

CURRENT_IRQL: 0

LOCK_ADDRESS: fffff80002cd2400 -- (!locks fffff80002cd2400)

Resource @ nt!PiEngineLock (0xfffff80002cd2400) Available

WARNING: SystemResourcesList->Flink chain invalid. Resource may be corrupted, or already deleted.


WARNING: SystemResourcesList->Blink chain invalid. Resource may be corrupted, or already deleted.

1 total locks

PNP_TRIAGE:
Lock address : 0xfffff80002cd2400
Thread Count : 0
Thread address: 0x0000000000000000
Thread wait : 0x0

LAST_CONTROL_TRANSFER: from fffff80002a65fdc to fffff80002ace740

STACK_TEXT:
fffff880`02fd2788 fffff800`02a65fdc : 00000000`00000018 00000000`00000000 fffff800`02bcdd30 00000000`00000002 : nt!KeBugCheckEx
fffff880`02fd2790 fffff800`02e8d07f : fffff880`02fd2880 00000000`00000000 fffff800`02bcdd30 fffff800`02c48e80 : nt! ?? ::FNODOBFM::`string'+0x46411
fffff880`02fd27f0 fffff800`02e8d3da : 00000000`00000000 fffffa80`0621c5b0 fffff800`02bcdd30 00000000`00000000 : nt!PnpAsynchronousCall+0xdf
fffff880`02fd2830 fffff800`02e8f6c7 : fffff800`02cd21c0 fffffa80`04483010 00000000`00000002 00000000`00000548 : nt!PnpQueryDeviceRelations+0xfa
fffff880`02fd28f0 fffff800`02ebb2cc : fffffa80`04483010 fffffa80`04480020 fffffa80`04483010 00000000`00000002 : nt!PipEnumerateDevice+0x117
fffff880`02fd2950 fffff800`02ebb8d8 : fffff800`02ccfd80 00000000`00000000 00000000`00000001 fffff800`02d3b840 : nt!PipProcessDevNodeTree+0x21c
fffff880`02fd2bc0 fffff800`02bd03a7 : 00000001`00000003 00000000`00000000 00000000`00000001 00000000`00000000 : nt!PiProcessReenumeration+0x98
fffff880`02fd2c10 fffff800`02adb961 : fffff800`02bd0080 fffff800`02dcac01 fffffa80`039e0b00 00000000`00000000 : nt!PnpDeviceActionWorker+0x327
fffff880`02fd2cb0 fffff800`02d72c06 : fffff880`034bbdf0 fffffa80`039e0b60 00000000`00000080 fffffa80`039cc040 : nt!ExpWorkerThread+0x111
fffff880`02fd2d40 fffff800`02aacc26 : fffff880`009e7180 fffffa80`039e0b60 fffff880`009f1f40 04000000`0000000c : nt!PspSystemThreadStartup+0x5a
fffff880`02fd2d80 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KxStartSystemThread+0x16


STACK_COMMAND: kb

CHKIMG_EXTENSION: !chkimg -lo 50 -d !nt
fffff80002bcdd00 - nt!IopDeviceEjectComplete+30
[ 40:3f ]
1 error : !nt (fffff80002bcdd00)

MODULE_NAME: memory_corruption

IMAGE_NAME: memory_corruption

FOLLOWUP_NAME: memory_corruption

DEBUG_FLR_IMAGE_TIMESTAMP: 0

MEMORY_CORRUPTOR: ONE_BYTE

FAILURE_BUCKET_ID: X64_MEMORY_CORRUPTION_ONE_BYTE

BUCKET_ID: X64_MEMORY_CORRUPTION_ONE_BYTE

Followup: memory_corruption
---------

1: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

REFERENCE_BY_POINTER (18)
Arguments:
Arg1: 0000000000000000, Object type of the object whose reference count is being lowered
Arg2: fffff80002bcdd30, Object whose reference count is being lowered
Arg3: 0000000000000002, Reserved
Arg4: 83fff08289e8283f, Reserved
The reference count of an object is illegal for the current state of the object.
Each time a driver uses a pointer to an object the driver calls a kernel routine
to increment the reference count of the object. When the driver is done with the
pointer the driver calls another kernel routine to decrement the reference count.
Drivers must match calls to the increment and decrement routines. This bugcheck
can occur because an object's reference count goes to zero while there are still
open handles to the object, in which case the fourth parameter indicates the number
of opened handles. It may also occur when the object’s reference count drops below zero
whether or not there are open handles to the object, and in that case the fourth parameter
contains the actual value of the pointer references count.

Debugging Details:
------------------


CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: CODE_CORRUPTION

BUGCHECK_STR: 0x18

PROCESS_NAME: System

CURRENT_IRQL: 0

LOCK_ADDRESS: fffff80002cd2400 -- (!locks fffff80002cd2400)

Resource @ nt!PiEngineLock (0xfffff80002cd2400) Available

WARNING: SystemResourcesList->Flink chain invalid. Resource may be corrupted, or already deleted.


WARNING: SystemResourcesList->Blink chain invalid. Resource may be corrupted, or already deleted.

1 total locks

PNP_TRIAGE:
Lock address : 0xfffff80002cd2400
Thread Count : 0
Thread address: 0x0000000000000000
Thread wait : 0x0

LAST_CONTROL_TRANSFER: from fffff80002a65fdc to fffff80002ace740

STACK_TEXT:
fffff880`02fd2788 fffff800`02a65fdc : 00000000`00000018 00000000`00000000 fffff800`02bcdd30 00000000`00000002 : nt!KeBugCheckEx
fffff880`02fd2790 fffff800`02e8d07f : fffff880`02fd2880 00000000`00000000 fffff800`02bcdd30 fffff800`02c48e80 : nt! ?? ::FNODOBFM::`string'+0x46411
fffff880`02fd27f0 fffff800`02e8d3da : 00000000`00000000 fffffa80`0621c5b0 fffff800`02bcdd30 00000000`00000000 : nt!PnpAsynchronousCall+0xdf
fffff880`02fd2830 fffff800`02e8f6c7 : fffff800`02cd21c0 fffffa80`04483010 00000000`00000002 00000000`00000548 : nt!PnpQueryDeviceRelations+0xfa
fffff880`02fd28f0 fffff800`02ebb2cc : fffffa80`04483010 fffffa80`04480020 fffffa80`04483010 00000000`00000002 : nt!PipEnumerateDevice+0x117
fffff880`02fd2950 fffff800`02ebb8d8 : fffff800`02ccfd80 00000000`00000000 00000000`00000001 fffff800`02d3b840 : nt!PipProcessDevNodeTree+0x21c
fffff880`02fd2bc0 fffff800`02bd03a7 : 00000001`00000003 00000000`00000000 00000000`00000001 00000000`00000000 : nt!PiProcessReenumeration+0x98
fffff880`02fd2c10 fffff800`02adb961 : fffff800`02bd0080 fffff800`02dcac01 fffffa80`039e0b00 00000000`00000000 : nt!PnpDeviceActionWorker+0x327
fffff880`02fd2cb0 fffff800`02d72c06 : fffff880`034bbdf0 fffffa80`039e0b60 00000000`00000080 fffffa80`039cc040 : nt!ExpWorkerThread+0x111
fffff880`02fd2d40 fffff800`02aacc26 : fffff880`009e7180 fffffa80`039e0b60 fffff880`009f1f40 04000000`0000000c : nt!PspSystemThreadStartup+0x5a
fffff880`02fd2d80 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KxStartSystemThread+0x16


STACK_COMMAND: kb

CHKIMG_EXTENSION: !chkimg -lo 50 -d !nt
fffff80002bcdd00 - nt!IopDeviceEjectComplete+30
[ 40:3f ]
1 error : !nt (fffff80002bcdd00)

MODULE_NAME: memory_corruption

IMAGE_NAME: memory_corruption

FOLLOWUP_NAME: memory_corruption

DEBUG_FLR_IMAGE_TIMESTAMP: 0

MEMORY_CORRUPTOR: ONE_BYTE

FAILURE_BUCKET_ID: X64_MEMORY_CORRUPTION_ONE_BYTE

BUCKET_ID: X64_MEMORY_CORRUPTION_ONE_BYTE

Followup: memory_corruption
---------

1: kd> lmvm memory_corruption
start end module name


@simpel
danke schonmal für deine klasse anleitung
 

Faighter

Ensign
Dabei seit
Feb. 2009
Beiträge
162
Teste deine ram bitte mit memtest86 auf Fehler.

Was für Hardware hast du in deinem PC verbaut ?
Mit welchem Timings laufen die Ramriegel ?
Hast du bevor der Fehler das erste Mal auftrat irgendwelche Treiber oder Software installiert. ?

mfg
 

pitu

Commodore
Dabei seit
Dez. 2005
Beiträge
4.099
ja ich hatte einiges an freeware tools installiert, habe die jetzt erstmal rausgeschmissen. gestern lief er ohne mucken durch. mal abwarten.

btw: die anderen crashdumbs hatte einen fehlercode.
 

simpel1970

Fleet Admiral
Dabei seit
Apr. 2009
Beiträge
16.261
Hi pitu, waren das zwei Stop 0x18 Bluescreens, die du ausgwertet hast, oder hast du (ungelduldiger weise ;)) nur zwei mal !analyze -v hintereinander eigegeben?
Bei dem Stopfehler, insbes. wenn es zwei mal der Gleiche war, ist es möglich, dass sich ein fehlerhafter Treiber dahinter versteckt.

Du kannst den nächsten Bluescreen abwarten. Sollte dieser erneut einen Stop 0x18 Fehlercode haben, werte diesen erneut aus und gib danach noch "!object" mit der fehlerhaften Adresse ein (in dem obigen Fall wäre das <!object fffff80002cd2400>.

Wenn die Stopfehler oft wechseln, solltest du zunächst die RAM mit Memtest86+ auf Fehler prüfen.
 

pitu

Commodore
Dabei seit
Dez. 2005
Beiträge
4.099
ich habe ein paar programme deinstalliert, seit gestern ist erstmal ruhe.

aber danke für deine hilfe, ich melde mich dann nochmal.
 
Top