Bluescreen, ruckelndes System, Memtest zeigt komische Angaben

freerider

Newbie
Registriert
Jan. 2013
Beiträge
7
Hallo,

vor Kurzem habe ich mein Win XP durch Win XP 64bit ersetzt. Beim Installieren der Hardware + Treiber, Software usw. hab ich dann irgendwann einen Bluescreen erhalten. Seither habe ich ihn alle 2-3 Startvorgänge, meistens kurz vor oder nach der Benutzeranmeldung, gelegentlich auch, wenn das System gerade komplett hochgefahren ist.
Es handelt sich immer wieder um einen der folgenden Fehler:

0x24 irgendwas mit ntfs.sys
0x19 BAD_POOL_HEADER
0xC2 BAD_POOL_CALLER
0x3B SYSTEM_SERVICE_EXEPTION
0x0A IRQL_NOT_LESS_OR_EQUAL
0xD6 cmdguard.sys The driver is attemting to access memory beyond the end of the allocation

Während des Betriebes ruckelt das System manchmal etwas, nicht mal unbedingt bei großen Anwendungen. Z.B. Firefox sorgt hin und wieder für 100% CPU Auslastung bei einen der beiden Prozessorkerne. Z.B. wenn ich ein neues Lesezeichen hinzufügen möchte, dann geht fast nix mehr.
Systemdaten:
Athlon 64 X2 Dual Core 6000+
Asus M2N SLI-Deluxe
4x 1GB OCZ PC6400

Ich habe viel im Netz gesucht, doch man findet zu jeder Fehlermeldung nahezu jede mögliche Fehlerursache als Erklärung, was im Endeffekt leider nicht weiter führt. Irgendwann bin ich dann über das Debugging Tool und die Crash Dumps gestolpert und habe versucht, mich da einzuarbeiten. Leider ist das aber so komplex, dass ich da nicht weiter komme.
Jedenfalls klang es für mich immer wieder so, als würde Information im Arbeitsspeicher verloren gehen, nicht zuletzt wegen dem zuletzt aufgelisteten Fehler 0xD6.

Ich habe dann Memtest laufen lassen. Komischerweise prüft Memtest zunächst 0 - 2048 MB, dann aber 2048 - 3583 MB und anschließend noch 4096 - 4608 MB? Da kann doch was nicht stimmen?
Es werden aber keine Fehler gefunden, auch nach Stunden nicht.
Wenn ich unter configuration den Arbeitsspeicher erkennen lasse, dann zeigt Memtest nur 3838 MB an und hängt sich nach wenigen Sekunden komplett auf.
Ich habe dann jeden Speicher einzeln getestet, keine Fehler, das System läuft auch.
Bestätigt wird das Ganze durch diesen Arbeitsspeichertest von Microsoft auf der Ultimate Boot Disk. Da bekam ich eine Meldung die in etwa so lautete: Ein Teil des Arbeitsspeichers kann nicht überprüft werden, da er außerhalb des gültigen Bereiches liegt (müsste ich nochmal genau nachschauen).
(Erwähnenswert in dem Zusammenhang sei noch, dass unter dem alten Win XP eine Festplatte mit 500GB zuletzt mit 2048GB angezeigt wurde. Eine zweite 500GB Platte wurde teilweise richtig angezeigt, teilweise aber auch mit 2048GB. Beide Platten sind aktuell NICHT verbaut.)
Mein Gedanke ist aktuell, dass vllt das Board einen Fehler hat? Worüber läuft denn die Ansteuerung der RAMs?

Dann habe ich gelesen, dass man über Start -Ausführen - sfc /scannow die Systemdateien überprüfen kann. Das habe ich gemacht, seither sind die Bluescreens etwas seltener geworden (alle 10-15 Startvorgänge), aber das hängende System bleibt.

Als nächstes habe ich mir den Verifier angeschaut. Hier habe ich mal alle möglichen Überprüfungen laufen lassen, werde aber aus den Ergebnissen nicht wirklich schlau.
Jedenfalls kamen mir 3 Dinge komisch vor:
1. Bei "Erfolgreiche Poolzuweisung ohne Kennung" steht 1
2. Wenn ich die Datenträger-Integritätüberprüfung aktiviere, bekomme ich beim Hochfahren immer folgenden Bluescreen: IO system verification error in crcdisk.sys (WDM Driver Error 226) [crcdisk.sys+1a70 at FFFFFADF90CSCA70]
3. Wenn ich die erweiterte E/A Prüfung aktiviere, bekomme ich immer einen der folgenden beiden Bluescreens:
- 0x35 no_more_IRP_stack_locations
- 0x50 page_fault_in_nonpaged_area
Kann mir jemand sagen, was das alles bedeuten könnte?

Schließlich habe ich noch WhoCrashed laufen lassen. Da steht allerdings überall nur, dass es ein Treiberfehler ist. Auch bei dem Debugging Tool von MS erhalte ich immer wieder Hinweise auf Treiber. Jedoch sind es immer wieder andere Treiber. Und es sind ja vermutlich nicht mehrere beschädigt.

Ich hoffe, dass mir hier jemand weiterhelfen kann. So langsam weiß ich nicht mehr, was ich machen soll...

Im folgenden Beitrag noch ein paar Ergebnisse vom Debugging Tool und WhoCrashed, vllt kann jemand was damit anfangen.
 
An schnellsten du installierst Windows XP 64 einfach neu (vorher festplatte formatieren). und dann schritt für schritt neustarten und einen treiber nach dem anderen installieren.
 
Ich frage mich nur, ob es nun an der Hardware oder Software liegt. Wenn es an der hardware liegt, nützt mir die Neuinstallation ja auch nichts.

Hier noch die Ergebnisse vom Debugging Tool:

Crash Dump 1:

*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 19, {20, fffffa80033c90b0, fffffa80033c93b0, 6300030}

*** WARNING: Unable to verify checksum for Ntfs.sys
*** WARNING: Unable to verify checksum for fltmgr.sys
*** WARNING: Unable to verify checksum for sr.sys
GetUlongFromAddress: unable to read from fffff800011cf218
Probably caused by : ntkrnlmp.exe ( nt!ExFreePoolWithTag+45e )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

BAD_POOL_HEADER (19)
The pool is already corrupt at the time of the current request.
This may or may not be due to the caller.
The internal pool links must be walked to figure out a possible cause of
the problem, and then special pool applied to the suspect tags or the driver
verifier to a suspect driver.
Arguments:
Arg1: 0000000000000020, a pool block header size is corrupt.
Arg2: fffffa80033c90b0, The pool entry we were looking for within the page.
Arg3: fffffa80033c93b0, The next pool entry.
Arg4: 0000000006300030, (reserved)

Debugging Details:
------------------

GetUlongFromAddress: unable to read from fffff800011cf218

BUGCHECK_STR: 0x19_20

POOL_ADDRESS: fffffa80033c90b0

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: DRIVER_FAULT

PROCESS_NAME: lsass.exe

CURRENT_IRQL: 0

LAST_CONTROL_TRANSFER: from fffff800011ab36c to fffff8000102e890

STACK_TEXT:
fffffadf`8e45cbf8 fffff800`011ab36c : 00000000`00000019 00000000`00000020 fffffa80`033c90b0 fffffa80`033c93b0 : nt!KeBugCheckEx
fffffadf`8e45cc00 fffffadf`904cff25 : 00000000`c0000035 fffffadf`9be65930 00000000`c0000035 fffffadf`9be65930 : nt!ExFreePoolWithTag+0x45e
fffffadf`8e45ccc0 fffffadf`904ce2c6 : fffffadf`9ba2e250 fffffadf`9aa6bc10 fffffadf`8e45d130 fffffadf`9ba2e250 : Ntfs!NtfsCommonCreate+0x21d1
fffffadf`8e45d0a0 fffffadf`905c2db3 : fffffadf`9b906040 fffffadf`9aa6bc10 fffffadf`9aa6bc10 fffffadf`9c71dcb0 : Ntfs!NtfsFsdCreate+0x218
fffffadf`8e45d230 fffffadf`9058a3b4 : fffffadf`9c5f45d0 fffffadf`9c4257d0 00000000`00000002 fffffadf`9aa6bc10 : fltmgr!FltpCreate+0x353
fffffadf`8e45d2c0 fffffadf`905a7542 : fffffadf`9aa6bc10 fffffadf`8e45d408 fffffadf`9b4a7e00 fffffadf`9aa8acb0 : sr!SrCreate+0x2f4
fffffadf`8e45d360 fffffadf`905c2e1d : fffffadf`9b4a7e00 fffffadf`9aa6bc10 fffffadf`9b4a7e00 fffffadf`9aa6bc10 : fltmgr!FltpLegacyProcessingAfterPreCallbacksCompleted+0x3f2
fffffadf`8e45d3d0 fffff800`01282789 : fffffadf`9b924060 fffff800`01282130 fffffadf`8e45d950 fffffadf`9c4257d0 : fltmgr!FltpCreate+0x3bd
fffffadf`8e45d460 fffff800`01280124 : fffffadf`9b924060 fffffadf`9b924010 fffffadf`8e45d790 00000000`00000001 : nt!IopParseDevice+0x1088
fffffadf`8e45d610 fffff800`01284847 : 00000000`00000000 fffffadf`8e45d780 00000006`00000040 00000000`00000000 : nt!ObpLookupObjectName+0x931
fffffadf`8e45d720 fffff800`01291e0d : fffffadf`8e45daf8 fffff800`01284b6a fffffadf`9b8c4c20 fffff800`0105167b : nt!ObOpenObjectByName+0x180
fffffadf`8e45d910 fffff800`01298eb7 : 00000000`00000000 fffff800`00000005 fffffa80`03633420 00000000`00000070 : nt!IopCreateFile+0x630
fffffadf`8e45daa0 fffff800`01298cf9 : 00000000`0000000b 00000000`8000001a 00000000`0000062c fffffadf`9b2cdbf0 : nt!IoCreateFile+0x12f
fffffadf`8e45db80 fffff800`0102e33d : fffffadf`9b8c4c20 fffffadf`9b2cdbf0 00000000`00000000 00000000`00000000 : nt!NtCreateFile+0x69
fffffadf`8e45dc00 00000000`77ef098a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x3
00000000`0194ec68 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x77ef098a


STACK_COMMAND: kb

FOLLOWUP_IP:
nt!ExFreePoolWithTag+45e
fffff800`011ab36c cc int 3

SYMBOL_STACK_INDEX: 1

SYMBOL_NAME: nt!ExFreePoolWithTag+45e

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nt

IMAGE_NAME: ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP: 50339ea0

FAILURE_BUCKET_ID: X64_0x19_20_nt!ExFreePoolWithTag+45e

BUCKET_ID: X64_0x19_20_nt!ExFreePoolWithTag+45e

Followup: MachineOwner
---------

0: kd> !analyze -hang
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 19, {20, fffffa80033c90b0, fffffa80033c93b0, 6300030}

Scanning for threads blocked on locks ...
fffff800011cf4b0: Unable to get value of ExpSystemResourcesList
GetUlongFromAddress: unable to read from fffff800011cf218
Probably caused by : ntkrnlmp.exe ( nt!ExFreePoolWithTag+45e )

Followup: MachineOwner




Crash Dump 2:

*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 3B, {c0000005, fffff800011a9f93, fffffadf90b651e0, 0}

Probably caused by : Pool_Corruption ( nt!ExDeferredFreePool+303 )

Followup: Pool_corruption
---------

0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

SYSTEM_SERVICE_EXCEPTION (3b)
An exception happened while executing a system service routine.
Arguments:
Arg1: 00000000c0000005, Exception code that caused the bugcheck
Arg2: fffff800011a9f93, Address of the exception record for the exception that caused the bugcheck
Arg3: fffffadf90b651e0, Address of the context record for the exception that caused the bugcheck
Arg4: 0000000000000000, zero.

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - Die Anweisung in "0x%08lx" verweist auf Speicher in "0x%08lx". Der Vorgang "%s" konnte nicht auf dem Speicher durchgef hrt werden.

FAULTING_IP:
nt!ExDeferredFreePool+303
fffff800`011a9f93 488908 mov qword ptr [rax],rcx

CONTEXT: fffffadf90b651e0 -- (.cxr 0xfffffadf90b651e0)
rax=0000000000000000 rbx=0000000000000001 rcx=0000000000000000
rdx=fffffa8001e76950 rsi=0000000000000000 rdi=fffffadf9cab8048
rip=fffff800011a9f93 rsp=fffffadf90b659f0 rbp=fffffadf9cab8048
r8=fffffa8001e76640 r9=0000000000000001 r10=0031004500310038
r11=0000000000000000 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000008
iopl=0 nv up ei ng nz ac po cy
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010297
nt!ExDeferredFreePool+0x303:
fffff800`011a9f93 488908 mov qword ptr [rax],rcx ds:002b:00000000`00000000=????????????????
Resetting default scope

CUSTOMER_CRASH_COUNT: 3

DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: 0x3B

PROCESS_NAME: svchost.exe

CURRENT_IRQL: 0

LAST_CONTROL_TRANSFER: from fffff800011aa03d to fffff800011a9f93

STACK_TEXT:
fffffadf`90b659f0 fffff800`011aa03d : fffffa80`0338c010 00000000`00000691 fffffa80`0338c000 fffffadf`9cab8048 : nt!ExDeferredFreePool+0x303
fffffadf`90b65a60 fffff800`0103c2ae : fffffa80`0338c030 00000000`00000f54 fffffa80`0338c030 00000000`00000f54 : nt!ExFreePoolWithTag+0x759
fffffadf`90b65b20 fffff800`01287ed7 : fffffa80`032eed50 fffffa80`032eed50 fffffa80`02472010 00000000`00000000 : nt!ObfDereferenceObject+0x83
fffffadf`90b65b50 fffff800`01284a94 : fffffadf`9b207bf0 00000000`00000f54 fffffadf`9b30fc20 fffffadf`9b207bf0 : nt!ObpCloseHandleTableEntry+0x24b
fffffadf`90b65bf0 fffff800`0102e33d : fffffadf`9b207bf0 fffffadf`90b65cf0 00000000`0017b7f0 00000000`00000000 : nt!ObpCloseHandle+0xb0
fffffadf`90b65c70 00000000`77ef052a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x3
00000000`0208e8c8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x77ef052a


FOLLOWUP_IP:
nt!ExDeferredFreePool+303
fffff800`011a9f93 488908 mov qword ptr [rax],rcx

SYMBOL_STACK_INDEX: 0

SYMBOL_NAME: nt!ExDeferredFreePool+303

FOLLOWUP_NAME: Pool_corruption

IMAGE_NAME: Pool_Corruption

DEBUG_FLR_IMAGE_TIMESTAMP: 0

MODULE_NAME: Pool_Corruption

STACK_COMMAND: .cxr 0xfffffadf90b651e0 ; kb

FAILURE_BUCKET_ID: X64_0x3B_nt!ExDeferredFreePool+303

BUCKET_ID: X64_0x3B_nt!ExDeferredFreePool+303

Followup: Pool_corruption
---------

0: kd> .cxr 0xfffffadf90b651e0
rax=0000000000000000 rbx=0000000000000001 rcx=0000000000000000
rdx=fffffa8001e76950 rsi=0000000000000000 rdi=fffffadf9cab8048
rip=fffff800011a9f93 rsp=fffffadf90b659f0 rbp=fffffadf9cab8048
r8=fffffa8001e76640 r9=0000000000000001 r10=0031004500310038
r11=0000000000000000 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000008
iopl=0 nv up ei ng nz ac po cy
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010297
nt!ExDeferredFreePool+0x303:
fffff800`011a9f93 488908 mov qword ptr [rax],rcx ds:002b:00000000`00000000=????????????????
0: kd> !analyze -hang
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 3B, {c0000005, fffff800011a9f93, fffffadf90b651e0, 0}

Scanning for threads blocked on locks ...
fffff800011cf4b0: Unable to get value of ExpSystemResourcesList
Probably caused by : Pool_Corruption ( nt!ExDeferredFreePool+303 )

Followup: Pool_corruption




Crash Dump 3:

*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck A, {fffffae0cc615c1a, 2, 0, fffff80001019fa7}

*** WARNING: Unable to verify checksum for Ntfs.sys
*** WARNING: Unable to verify checksum for fltmgr.sys
Probably caused by : memory_corruption ( nt!MmCheckCachedPageState+226 )

Followup: MachineOwner
---------


1: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: fffffae0cc615c1a, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000000, bitfield :
bit 0 : value 0 = read operation, 1 = write operation
bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: fffff80001019fa7, address which referenced memory

Debugging Details:
------------------


READ_ADDRESS: fffffae0cc615c1a

CURRENT_IRQL: 2

FAULTING_IP:
nt!MmCheckCachedPageState+226
fffff800`01019fa7 41f644241a02 test byte ptr [r12+1Ah],2

CUSTOMER_CRASH_COUNT: 2

DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: 0xA

PROCESS_NAME: svchost.exe

TRAP_FRAME: fffffadf725572e0 -- (.trap 0xfffffadf725572e0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=fffff8000123d940 rbx=0000000000000000 rcx=fffffadf90c6b810
rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80001019fa7 rsp=fffffadf72557470 rbp=0000000000000000
r8=fffff6fd400196d0 r9=0000000000000000 r10=fffffadf9037bd10
r11=fffffadf72557558 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei ng nz na po nc
nt!MmCheckCachedPageState+0x226:
fffff800`01019fa7 41f644241a02 test byte ptr [r12+1Ah],2 ds:46b0:00000000`0000001a=??
Resetting default scope

LAST_CONTROL_TRANSFER: from fffff8000102e5b4 to fffff8000102e890

STACK_TEXT:
fffffadf`72557158 fffff800`0102e5b4 : 00000000`0000000a fffffae0`cc615c1a 00000000`00000002 00000000`00000000 : nt!KeBugCheckEx
fffffadf`72557160 fffff800`0102d547 : fffffadf`99fd5500 fffffadf`905ca16b fffffadf`9bd0f900 fffffadf`9cab42c0 : nt!KiBugCheckDispatch+0x74
fffffadf`725572e0 fffff800`01019fa7 : 00000000`00000000 00000000`00040000 fffffadf`9c7fa4b8 fffff800`0127e64c : nt!KiPageFault+0x207
fffffadf`72557470 fffff800`0103e614 : fffff980`9d800000 00000000`00000000 fffff980`9d800000 fffffadf`72557930 : nt!MmCheckCachedPageState+0x226
fffffadf`725574f0 fffff800`0106badd : fffffadf`725576a0 fffffadf`72557930 00000000`00000000 00000000`00000000 : nt!CcMapAndRead+0xba
fffffadf`72557560 fffff800`0129f126 : fffffadf`00000000 fffffadf`725576a0 00000000`00000200 fffffadf`9bcc4601 : nt!CcPinFileData+0x465
fffffadf`72557640 fffffadf`904482cf : fffffadf`9b96bf40 fffffadf`725577a0 fffffadf`00000200 fffffa80`01817400 : nt!CcCopyRead+0x46a
fffffadf`72557760 fffffadf`90447e2e : fffffadf`725578f0 fffffadf`99f57010 fffffadf`9a060901 fffffadf`9a060990 : Ntfs!NtfsCommonRead+0x13ff
fffffadf`725578f0 fffffadf`905a7922 : ffffffff`ffffffff fffffadf`99f57010 fffffadf`99f57010 00000000`00000000 : Ntfs!NtfsFsdRead+0x262
fffffadf`72557a20 fffffadf`905a7922 : 00000000`00000000 fffffadf`99f57010 fffffadf`99f57010 fffffadf`9beeae00 : fltmgr!FltpDispatch+0x1c2
fffffadf`72557a80 fffff800`01261abf : fffffadf`9b96bf40 fffffadf`72557cf0 fffffadf`9b96bf40 fffffadf`99f57010 : fltmgr!FltpDispatch+0x1c2
fffffadf`72557ae0 fffff800`0102e33d : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!NtReadFile+0x8fd
fffffadf`72557c00 00000000`77ef049a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x3
00000000`028fed28 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x77ef049a


STACK_COMMAND: kb

FOLLOWUP_IP:
nt!MmCheckCachedPageState+226
fffff800`01019fa7 41f644241a02 test byte ptr [r12+1Ah],2

SYMBOL_STACK_INDEX: 3

SYMBOL_NAME: nt!MmCheckCachedPageState+226

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nt

DEBUG_FLR_IMAGE_TIMESTAMP: 50339ea0

IMAGE_NAME: memory_corruption

FAILURE_BUCKET_ID: X64_0xA_nt!MmCheckCachedPageState+226

BUCKET_ID: X64_0xA_nt!MmCheckCachedPageState+226

Followup: MachineOwner
---------

1: kd> .trap 0xfffffadf725572e0
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=fffff8000123d940 rbx=0000000000000000 rcx=fffffadf90c6b810
rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80001019fa7 rsp=fffffadf72557470 rbp=0000000000000000
r8=fffff6fd400196d0 r9=0000000000000000 r10=fffffadf9037bd10
r11=fffffadf72557558 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei ng nz na po nc
nt!MmCheckCachedPageState+0x226:
fffff800`01019fa7 41f644241a02 test byte ptr [r12+1Ah],2 ds:46b0:00000000`0000001a=??
1: kd> !analyze -hang
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck A, {fffffae0cc615c1a, 2, 0, fffff80001019fa7}

Scanning for threads blocked on locks ...
fffff800011cf4b0: Unable to get value of ExpSystemResourcesList
Probably caused by : memory_corruption ( nt!MmCheckCachedPageState+226 )
 
Eindeutig 2x Treiber Fehler - ist natürlich immer eine Gefahr für Win XP 64 obs da treiber gibt ;)
 
Hier noch die Ergebnisse von WhoCrashed:

On Wed 16.01.2013 22:48:06 GMT your computer crashed
crash dump file: F:\WINDOWS\Minidump\Mini011613-09.dmp
This was probably caused by the following module: win32k.sys (win32k+0x1D720)
Bugcheck code: 0x3B (0xC0000005, 0xFFFFF97FFF01D720, 0xFFFFFADF78E41E70, 0x0)
Error: SYSTEM_SERVICE_EXCEPTION
file path: F:\WINDOWS\system32\win32k.sys
product: Microsoft® Windows® Operating System
company: Microsoft Corporation
description: Multi-User Win32 Driver
Bug check description: This indicates that an exception happened while executing a routine that transitions from non-privileged code to privileged code.
This appears to be a typical software driver bug and is not likely to be caused by a hardware problem.
The crash took place in a standard Microsoft module. Your system configuration may be incorrect. Possibly this problem is caused by another driver on your system that cannot be identified at this time.
Google query: Microsoft Corporation SYSTEM_SERVICE_EXCEPTION



On Wed 16.01.2013 22:48:06 GMT your computer crashed
crash dump file: F:\WINDOWS\memory.dmp
This was probably caused by the following module: win32k.sys (win32k!EngFntCacheLookUp+0x5960)
Bugcheck code: 0x3B (0xC0000005, 0xFFFFF97FFF01D720, 0xFFFFFADF78E41E70, 0x0)
Error: SYSTEM_SERVICE_EXCEPTION
file path: F:\WINDOWS\system32\win32k.sys
product: Microsoft® Windows® Operating System
company: Microsoft Corporation
description: Multi-User Win32 Driver
Bug check description: This indicates that an exception happened while executing a routine that transitions from non-privileged code to privileged code.
This appears to be a typical software driver bug and is not likely to be caused by a hardware problem.
The crash took place in a standard Microsoft module. Your system configuration may be incorrect. Possibly this problem is caused by another driver on your system that cannot be identified at this time.
Google query: Microsoft Corporation SYSTEM_SERVICE_EXCEPTION



On Wed 16.01.2013 17:21:50 GMT your computer crashed
crash dump file: F:\WINDOWS\Minidump\Mini011613-08.dmp
This was probably caused by the following module: ntoskrnl.exe (nt+0x2E890)
Bugcheck code: 0x3B (0xC0000005, 0xFFFFF800011A9EBA, 0xFFFFFADF78758F60, 0x0)
Error: SYSTEM_SERVICE_EXCEPTION
file path: F:\WINDOWS\system32\ntoskrnl.exe
product: Microsoft® Windows® Operating System
company: Microsoft Corporation
description: NT Kernel & System
Bug check description: This indicates that an exception happened while executing a routine that transitions from non-privileged code to privileged code.
This appears to be a typical software driver bug and is not likely to be caused by a hardware problem.
The crash took place in the Windows kernel. Possibly this problem is caused by another driver that cannot be identified at this time.



On Wed 16.01.2013 11:28:08 GMT your computer crashed
crash dump file: F:\WINDOWS\Minidump\Mini011613-07.dmp
This was probably caused by the following module: fltmgr.sys (fltmgr+0xCFD4)
Bugcheck code: 0x3B (0xC0000005, 0xFFFFFADF905ACFD4, 0xFFFFFADF900A5EB0, 0x0)
Error: SYSTEM_SERVICE_EXCEPTION
file path: F:\WINDOWS\system32\drivers\fltmgr.sys
product: Microsoft® Windows® Operating System
company: Microsoft Corporation
description: Microsoft Filesystem Filter Manager
Bug check description: This indicates that an exception happened while executing a routine that transitions from non-privileged code to privileged code.
This appears to be a typical software driver bug and is not likely to be caused by a hardware problem.
The crash took place in a standard Microsoft module. Your system configuration may be incorrect. Possibly this problem is caused by another driver on your system that cannot be identified at this time.
Google query: Microsoft Corporation SYSTEM_SERVICE_EXCEPTION



On Wed 16.01.2013 00:42:29 GMT your computer crashed
crash dump file: F:\WINDOWS\Minidump\Mini011613-06.dmp
This was probably caused by the following module: ntoskrnl.exe (nt+0x2E890)
Bugcheck code: 0x3B (0xC0000005, 0xFFFFF8000128B93F, 0xFFFFFADF772E61F0, 0x0)
Error: SYSTEM_SERVICE_EXCEPTION
file path: F:\WINDOWS\system32\ntoskrnl.exe
product: Microsoft® Windows® Operating System
company: Microsoft Corporation
description: NT Kernel & System
Bug check description: This indicates that an exception happened while executing a routine that transitions from non-privileged code to privileged code.
This appears to be a typical software driver bug and is not likely to be caused by a hardware problem.
The crash took place in the Windows kernel. Possibly this problem is caused by another driver that cannot be identified at this time.



On Wed 16.01.2013 00:38:24 GMT your computer crashed
crash dump file: F:\WINDOWS\Minidump\Mini011613-05.dmp
This was probably caused by the following module: ntoskrnl.exe (nt+0x2E890)
Bugcheck code: 0x35 (0xFFFFFABB733E2C60, 0x0, 0x0, 0xFFFFFADF00000000)
Error: NO_MORE_IRP_STACK_LOCATIONS
file path: F:\WINDOWS\system32\ntoskrnl.exe
product: Microsoft® Windows® Operating System
company: Microsoft Corporation
description: NT Kernel & System
Bug check description: This bug check occurs when the IoCallDriver packet has no more stack locations remaining.
This appears to be a typical software driver bug and is not likely to be caused by a hardware problem.
The crash took place in the Windows kernel. Possibly this problem is caused by another driver that cannot be identified at this time.



On Wed 16.01.2013 00:08:52 GMT your computer crashed
crash dump file: F:\WINDOWS\Minidump\Mini011613-04.dmp
This was probably caused by the following module: ntoskrnl.exe (nt+0x2E890)
Bugcheck code: 0x35 (0xFFFFFABB72676C60, 0x0, 0x0, 0xFFFFFADF00000000)
Error: NO_MORE_IRP_STACK_LOCATIONS
file path: F:\WINDOWS\system32\ntoskrnl.exe
product: Microsoft® Windows® Operating System
company: Microsoft Corporation
description: NT Kernel & System
Bug check description: This bug check occurs when the IoCallDriver packet has no more stack locations remaining.
This appears to be a typical software driver bug and is not likely to be caused by a hardware problem.
The crash took place in the Windows kernel. Possibly this problem is caused by another driver that cannot be identified at this time.



On Wed 16.01.2013 00:06:48 GMT your computer crashed
crash dump file: F:\WINDOWS\Minidump\Mini011613-03.dmp
This was probably caused by the following module: ntoskrnl.exe (nt+0x2E890)
Bugcheck code: 0x50 (0xFFFFFADF46003050, 0x0, 0xFFFFF800013DF18B, 0x0)
Error: PAGE_FAULT_IN_NONPAGED_AREA
file path: F:\WINDOWS\system32\ntoskrnl.exe
product: Microsoft® Windows® Operating System
company: Microsoft Corporation
description: NT Kernel & System
Bug check description: This indicates that invalid system memory has been referenced.
This appears to be a typical software driver bug and is not likely to be caused by a hardware problem.
The crash took place in the Windows kernel. Possibly this problem is caused by another driver that cannot be identified at this time.



On Wed 16.01.2013 00:04:55 GMT your computer crashed
crash dump file: F:\WINDOWS\Minidump\Mini011613-02.dmp
This was probably caused by the following module: ntoskrnl.exe (nt+0x2E890)
Bugcheck code: 0x35 (0xFFFFFABB72DD0C60, 0x0, 0x0, 0xFFFFFADF00000000)
Error: NO_MORE_IRP_STACK_LOCATIONS
file path: F:\WINDOWS\system32\ntoskrnl.exe
product: Microsoft® Windows® Operating System
company: Microsoft Corporation
description: NT Kernel & System
Bug check description: This bug check occurs when the IoCallDriver packet has no more stack locations remaining.
This appears to be a typical software driver bug and is not likely to be caused by a hardware problem.
The crash took place in the Windows kernel. Possibly this problem is caused by another driver that cannot be identified at this time.



On Wed 16.01.2013 00:01:59 GMT your computer crashed
crash dump file: F:\WINDOWS\Minidump\Mini011613-01.dmp
This was probably caused by the following module: ntoskrnl.exe (nt+0x2E890)
Bugcheck code: 0x35 (0xFFFFFABB71D1AC60, 0x0, 0x0, 0xFFFFFADF00000000)
Error: NO_MORE_IRP_STACK_LOCATIONS
file path: F:\WINDOWS\system32\ntoskrnl.exe
product: Microsoft® Windows® Operating System
company: Microsoft Corporation
description: NT Kernel & System
Bug check description: This bug check occurs when the IoCallDriver packet has no more stack locations remaining.
This appears to be a typical software driver bug and is not likely to be caused by a hardware problem.
The crash took place in the Windows kernel. Possibly this problem is caused by another driver that cannot be identified at this time.



On Sun 13.01.2013 10:14:38 GMT your computer crashed
crash dump file: F:\WINDOWS\Minidump\Mini011313-01.dmp
This was probably caused by the following module: ntoskrnl.exe (nt+0x2E890)
Bugcheck code: 0x1E (0xFFFFFFFFC0000005, 0xFFFFF80001263F90, 0x0, 0xFFFFFFFFFFFFFFFF)
Error: KMODE_EXCEPTION_NOT_HANDLED
file path: F:\WINDOWS\system32\ntoskrnl.exe
product: Microsoft® Windows® Operating System
company: Microsoft Corporation
description: NT Kernel & System
Bug check description: This indicates that a kernel-mode program generated an exception which the error handler did not catch.
This appears to be a typical software driver bug and is not likely to be caused by a hardware problem.
The crash took place in the Windows kernel. Possibly this problem is caused by another driver that cannot be identified at this time.



On Fri 11.01.2013 16:11:26 GMT your computer crashed
crash dump file: F:\WINDOWS\Minidump\Mini011113-03.dmp
This was probably caused by the following module: ntoskrnl.exe (nt+0x2E890)
Bugcheck code: 0x3B (0xC0000005, 0xFFFFF800011A9F93, 0xFFFFFADF90B651E0, 0x0)
Error: SYSTEM_SERVICE_EXCEPTION
file path: F:\WINDOWS\system32\ntoskrnl.exe
product: Microsoft® Windows® Operating System
company: Microsoft Corporation
description: NT Kernel & System
Bug check description: This indicates that an exception happened while executing a routine that transitions from non-privileged code to privileged code.
This appears to be a typical software driver bug and is not likely to be caused by a hardware problem.
The crash took place in the Windows kernel. Possibly this problem is caused by another driver that cannot be identified at this time.



On Fri 11.01.2013 16:07:27 GMT your computer crashed
crash dump file: F:\WINDOWS\Minidump\Mini011113-02.dmp
This was probably caused by the following module: ntoskrnl.exe (nt+0x2E890)
Bugcheck code: 0xA (0xFFFFFAE0CC615C1A, 0x2, 0x0, 0xFFFFF80001019FA7)
Error: IRQL_NOT_LESS_OR_EQUAL
file path: F:\WINDOWS\system32\ntoskrnl.exe
product: Microsoft® Windows® Operating System
company: Microsoft Corporation
description: NT Kernel & System
Bug check description: This indicates that Microsoft Windows or a kernel-mode driver accessed paged memory at DISPATCH_LEVEL or above.
This appears to be a typical software driver bug and is not likely to be caused by a hardware problem.
The crash took place in the Windows kernel. Possibly this problem is caused by another driver that cannot be identified at this time.



On Fri 11.01.2013 11:08:52 GMT your computer crashed
crash dump file: F:\WINDOWS\Minidump\Mini011113-01.dmp
This was probably caused by the following module: win32k.sys (win32k+0x24944)
Bugcheck code: 0x3B (0xC0000005, 0xFFFFF97FFF024944, 0xFFFFFADF71169C40, 0x0)
Error: SYSTEM_SERVICE_EXCEPTION
file path: F:\WINDOWS\system32\win32k.sys
product: Microsoft® Windows® Operating System
company: Microsoft Corporation
description: Multi-User Win32 Driver
Bug check description: This indicates that an exception happened while executing a routine that transitions from non-privileged code to privileged code.
This appears to be a typical software driver bug and is not likely to be caused by a hardware problem.
The crash took place in a standard Microsoft module. Your system configuration may be incorrect. Possibly this problem is caused by another driver on your system that cannot be identified at this time.
Google query: Microsoft Corporation SYSTEM_SERVICE_EXCEPTION



On Wed 09.01.2013 00:19:02 GMT your computer crashed
crash dump file: F:\WINDOWS\Minidump\Mini010913-01.dmp
This was probably caused by the following module: ntoskrnl.exe (nt+0x2E890)
Bugcheck code: 0x3B (0xC0000005, 0xFFFFF80001263F90, 0xFFFFFADF72CDF1B0, 0x0)
Error: SYSTEM_SERVICE_EXCEPTION
file path: F:\WINDOWS\system32\ntoskrnl.exe
product: Microsoft® Windows® Operating System
company: Microsoft Corporation
description: NT Kernel & System
Bug check description: This indicates that an exception happened while executing a routine that transitions from non-privileged code to privileged code.
This appears to be a typical software driver bug and is not likely to be caused by a hardware problem.
The crash took place in the Windows kernel. Possibly this problem is caused by another driver that cannot be identified at this time.
 
Zum Memtest: Dass Etappenweise getestet wird ist normal. Dass nur 3583MB erkannt werden liegt vermutlich daran, dass Memory Remapping im BIOS deaktiviert ist. Wenn du das einschaltest, sollte der Memtest alles finden und anzeigen, ansonsten krallt sich die Grafikkarte Speicher.

Der RAM wird bei dir direkt von der CPU angesteuert, läuft aber natürlich über das Board.
 
Du hast deswegen "memory Fehler" weil ein Treiber außerhalb seines Adressbereichs (64bit und 32bit unterschied) zuzugreifen versucht
 
h00bi schrieb:
Memory Remapping im BIOS deaktiviert ist
Diese Einstellung habe ich scheinbar nicht.
Hat vielleicht folgendes etwas damit zu tun:
- DRAM Bank Interleaving
- Bank Swizzle Mode
Beides ist aktiviert.

Chrisibär schrieb:
Du hast deswegen "memory Fehler" weil ein Treiber außerhalb seines Adressbereichs (64bit und 32bit unterschied) zuzugreifen versucht
Woran erkennst du das? Und was kann ich dagegen tun? ;)

Ich habe gerade mal mit HWiNFO64 alles angeschaut, komischerweise laufen die RAMs nur mit 400Mhz, obwohl im BIOS 800 eingestellt ist.
Bei der Info zum Prozessor ist mir folgendes aufgefallen:
hwinfo.jpg
Die Angaben bei MTRR klingen irgendwie nach Arbeitsspeicher. Hat das was mit dem Problem zu tun?
 
Also nimm mal CPU-Z und guck dort beim Rreiter Memory was eingestellt ist (mach ein foto und poste es). Danach guckst bei Reiter SPD ob alle 4 module selbe einstellung haben.

Zu DRAM Bank Interleaving und Bank Swizzle Mode. Bank Interleaving tu mal deaktivieren ( gerade bei vollbestückung kann es probleme geben). Bank Swizzle Mode kenne ich nicht (aber tu es auch mal deaktivieren)
 
Ok, hier die Screenshots. Bei SPD sind die rot markierten Felder bei Slot#1 und #2 leer, bei Slot#4 steht das Selbe drin, wie bei dem Screenshot von Slot#3. Alle anderen Werte sind bei allen Slots gleich.

cpuz1.jpgcpuz2.jpg
 
Okay das sind ja eh 6400 also stimmt das schon mit den 400 Mhz, als Bus Clock, du hast nur 800 MT/s Datenrate.
Timings sehen auch gut aus (TRAS könntest auf 15 stellen statt auf 12). Command Rate T2 passt auch.
Hast Bank Interleaving & Bank Swizzle ausgestellt?
Was du schauen kannst ob die Stromversorgung mit 1,8 Volt gegeben ist im BIOS für die Rambänke. Zur not auf 1,825 oder 1,85 mehr nicht stellen.
Danach memtest machen mit 2 modulen auf bank 1-2 und gleiches mit 2 modulen auf bank 3-4 und danach auf allen 4 bänken drinnen lassen die rammodule.
15 Minuten pro Memtest sollte erstmal reichen. => ca 50 minuten gesamt.
Wenn keine fehler melden :)
 
Bank Interleaving und Bank Swizzle hatte ich vor längerer Zeit schon mal abgestellt und gleich wieder nen Bluescreen gehabt.

Leider hat auch die erneute Memtest-Geschichte nix gebracht :(
Hast du vielleicht noch ne Idee?
 
Was bedeutet nix gebracht? - Fehler oder keine Fehler?
 
Haha, sorry, war etwas ungeschickt formuliert. Es gab keine Fehlermeldung, aber das Grundproblem mit Ruckeln und Bluescren besteht weiterhin.
 
Zurück
Oben