M
Mii
Gast
Hallo!
Ich habe ein Problem mit meinem Notebook (ASUS, mit Windows Vista) und hoffe hier kann mir jemand helfen!
Folgendes:
Er läuft immer ca 20 Minuten (aber auch langsamer als sonst) und dann kommt entweder ein Bluescreen und er geht aus, oder er friert ein und nichts geht mehr.
Im abgesicherten Modus das gleiche!
Irgendwo hier im Forum hab ich letztens gelesen, dass ich diese Absturz-Dokumentation (.dmp) suchen soll, letztes Mal hab ichs geschafft die neuesten 3 zu speichern bevor er abgestürzt ist, und mittlerweile hab ich den inhalt auch als word-datei. kann mir damit jemand weiterhelfen?
(offensichtlich hab ich leider überhaupt keine ahnung von computern. ich wär deshalb echt dankbar für antworten, die ich auch ohne das ganze know-how verstehen kann!)
hier der inhalt von 2 der .dmp-dateien (3 überschreiten die erlaubte zeichenanzal):
1.
Microsoft (R) Windows Debugger Version 6.2.8229.0 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*C:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows Vista Kernel Version 6000 MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 6000.17021.x86fre.vista_gdr.100218-0019
Machine Name:
Kernel base = 0x82800000 PsLoadedModuleList = 0x82911e10
Debug session time: Thu Feb 23 22:50:42.222 2012 (UTC + 1:00)
System Uptime: 0 days 0:20:47.738
Loading Kernel Symbols
...............................................................
...................
Loading User Symbols
Loading unloaded module list
.....
TRIAGER: Could not open triage file : C:\Program Files (x86)\Windows Kits\8.0\Debuggers\x64\triage\oca.ini, error 2
TRIAGER: Could not open triage file : C:\Program Files (x86)\Windows Kits\8.0\Debuggers\x64\winxp\triage.ini, error 2
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 1000008E, {c0000005, 828e752b, 989e3884, 0}
TRIAGER: Could not open triage file : C:\Program Files (x86)\Windows Kits\8.0\Debuggers\x64\triage\modclass.ini, error 2
Probably caused by : ntkrpamp.exe ( nt!ExAllocatePoolWithTag+520 )
Followup: MachineOwner
---------
0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
KERNEL_MODE_EXCEPTION_NOT_HANDLED_M (1000008e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003. This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG. This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG. This will let us see why this breakpoint is
happening.
Arguments:
Arg1: c0000005, The exception code that was not handled
Arg2: 828e752b, The address that the exception occurred at
Arg3: 989e3884, Trap Frame
Arg4: 00000000
Debugging Details:
------------------
TRIAGER: Could not open triage file : C:\Program Files (x86)\Windows Kits\8.0\Debuggers\x64\triage\modclass.ini, error 2
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - Die Anweisung in 0x%08lx verweist auf Speicher 0x%08lx. Der Vorgang %s konnte nicht im Speicher durchgef hrt werden.
FAULTING_IP:
nt!ExAllocatePoolWithTag+520
828e752b 894804 mov dword ptr [eax+4],ecx
TRAP_FRAME: 989e3884 -- (.trap 0xffffffff989e3884)
ErrCode = 00000002
eax=0043005c ebx=84941144 ecx=8493e2f4 edx=00000001 esi=8493e068 edi=a4acf438
eip=828e752b esp=989e38f8 ebp=989e3944 iopl=0 nv up ei pl nz na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010206
nt!ExAllocatePoolWithTag+0x520:
828e752b 894804 mov dword ptr [eax+4],ecx ds:0023:00430060=????????
Resetting default scope
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
BUGCHECK_STR: 0x8E
PROCESS_NAME: svchost.exe
CURRENT_IRQL: 0
LAST_CONTROL_TRANSFER: from 829791bb to 828e752b
STACK_TEXT:
989e3944 829791bb 00000001 00000250 65536f49 nt!ExAllocatePoolWithTag+0x520
989e3968 8297910c 82ab02d8 0000021c 00000000 nt!FsRtlAllocateExtraCreateParameter+0x38
989e39a0 8298cfc8 82ab02d8 00000002 00000000 nt!FsRtlAllocateExtraCreateParameterFromLookasideList+0x4b
989e39d0 8298d205 85f138d0 00000204 00000000 nt!IopSymlinkAllocateAndAddECP+0x3d
989e39f0 8299706f 85f138d0 861410e0 0000002e nt!IopSymlinkCreateECP+0x4d
989e3ab8 829ef0b1 857b4b98 00000000 85e3d450 nt!IopParseDevice+0xc6a
989e3b48 829ec85d 00000000 989e3ba0 00000040 nt!ObpLookupObjectName+0x615
989e3ba8 8298c94a 016de54c 00000000 ffffff01 nt!ObOpenObjectByName+0x13c
989e3d54 8288cb1a 016de54c 016de514 016de57c nt!NtQueryFullAttributesFile+0x138
989e3d54 77d60f34 016de54c 016de514 016de57c nt!KiFastCallEntry+0x12a
WARNING: Frame IP not in any known module. Following frames may be wrong.
016de57c 00000000 00000000 00000000 00000000 0x77d60f34
STACK_COMMAND: kb
FOLLOWUP_IP:
nt!ExAllocatePoolWithTag+520
828e752b 894804 mov dword ptr [eax+4],ecx
SYMBOL_STACK_INDEX: 0
SYMBOL_NAME: nt!ExAllocatePoolWithTag+520
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrpamp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 4b7d25c9
FAILURE_BUCKET_ID: 0x8E_nt!ExAllocatePoolWithTag+520
BUCKET_ID: 0x8E_nt!ExAllocatePoolWithTag+520
Followup: MachineOwner
---------
2.
Microsoft (R) Windows Debugger Version 6.2.8229.0 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Mini Kernel Dump File: Only registers and stack trace are available
WARNING: Whitespace at start of path element
Symbol search path is:
SRV*C:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows Vista Kernel Version 6000 MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 6000.17021.x86fre.vista_gdr.100218-0019
Machine Name:
Kernel base = 0x82800000 PsLoadedModuleList = 0x82911e10
Debug session time: Mon Feb 27 00:19:36.442 2012 (UTC + 1:00)
System Uptime: 0 days 0:21:09.337
Loading Kernel Symbols
...............................................................
................................................................
......................
Loading User Symbols
Loading unloaded module list
......
TRIAGER: Could not open triage file : C:\Program Files (x86)\Windows Kits\8.0\Debuggers\x64\triage\oca.ini, error 2
TRIAGER: Could not open triage file : C:\Program Files (x86)\Windows Kits\8.0\Debuggers\x64\winxp\triage.ini, error 2
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 1000008E, {c0000005, 82968d45, ab0562c4, 0}
TRIAGER: Could not open triage file : C:\Program Files (x86)\Windows Kits\8.0\Debuggers\x64\triage\modclass.ini, error 2
Probably caused by : ksecdd.sys ( ksecdd!KeRegOpenKey+61 )
Followup: MachineOwner
---------
0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
KERNEL_MODE_EXCEPTION_NOT_HANDLED_M (1000008e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003. This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG. This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG. This will let us see why this breakpoint is
happening.
Arguments:
Arg1: c0000005, The exception code that was not handled
Arg2: 82968d45, The address that the exception occurred at
Arg3: ab0562c4, Trap Frame
Arg4: 00000000
Debugging Details:
------------------
TRIAGER: Could not open triage file : C:\Program Files (x86)\Windows Kits\8.0\Debuggers\x64\triage\modclass.ini, error 2
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - Die Anweisung in 0x%08lx verweist auf Speicher 0x%08lx. Der Vorgang %s konnte nicht im Speicher durchgef hrt werden.
FAULTING_IP:
nt!CmpCacheLookup+9f
82968d45 8b48fc mov ecx,dword ptr [eax-4]
TRAP_FRAME: ab0562c4 -- (.trap 0xffffffffab0562c4)
ErrCode = 00000000
eax=02d3cfe9 ebx=3b9aca07 ecx=0000000b edx=00002aa8 esi=ab0565b4 edi=000007ff
eip=82968d45 esp=ab056338 ebp=ab056384 iopl=0 nv up ei pl nz na po nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010202
nt!CmpCacheLookup+0x9f:
82968d45 8b48fc mov ecx,dword ptr [eax-4] ds:0023:02d3cfe5=????????
Resetting default scope
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
BUGCHECK_STR: 0x8E
PROCESS_NAME: lsass.exe
CURRENT_IRQL: 0
LAST_CONTROL_TRANSFER: from 82966b67 to 82968d45
STACK_TEXT:
ab056384 82966b67 ab0563c0 00000006 ab0565bc nt!CmpCacheLookup+0x9f
ab056548 82966e46 ab0565a8 ab0565b4 ab0565d4 nt!CmpBuildHashStackAndLookupCache+0x13c
ab0566c0 829ef0b1 8b40ff48 8498e1c8 854d3350 nt!CmpParseKey+0x284
ab056750 829ec85d 00000000 ab0567a8 00000640 nt!ObpLookupObjectName+0x615
ab0567b4 8293949f ab05694c 8498e1c8 82ba7000 nt!ObOpenObjectByName+0x13c
ab056888 8293925c ab056998 00020019 ab05694c nt!CmOpenKey+0x1b1
ab0568ac 8288cb1a ab056998 00020019 ab05694c nt!NtOpenKey+0x39
ab0568ac 8287eba5 ab056998 00020019 ab05694c nt!KiFastCallEntry+0x12a
ab056930 8269b8c0 ab056998 00020019 ab05694c nt!ZwOpenKey+0x11
ab05696c 8269bc5f 80000002 82677a28 00020019 ksecdd!KeRegOpenKey+0x61
ab056988 82699d31 80000002 ab0569a0 00020019 ksecdd!VerifyRegistryAccess+0x1a
ab0569d0 826925aa 82683a80 00000000 00020019 ksecdd!CfgReg_Acquire+0x74
ab056adc 82692b45 00000000 00000003 85477628 ksecdd!BCryptResolveProviders+0x185
ab056b28 82692b98 00020000 85477608 00000064 ksecdd!_ResolutionFunctionIoHandler+0x86
ab056b44 82692c2c 00020000 85477608 00000064 ksecdd!_ConfigFunctionIoHandler+0x31
ab056b6c 826932b5 85477608 00000064 00000000 ksecdd!ConfigIoHandler+0x63
ab056b84 8268820d 00390402 85477608 00000064 ksecdd!CryptDeviceIoHandler+0x26
ab056c00 826883b0 85477608 00000064 b4cd3528 ksecdd!KsecDeviceControl+0x2c5
ab056c2c 82827f9f 8573bd48 00000000 89521e68 ksecdd!KsecDispatch+0xa6
ab056c44 8298911b 88b95f08 89521e68 89521ed8 nt!IofCallDriver+0x63
ab056c64 8298a0df 8573bd48 88b95f08 00000000 nt!IopSynchronousServiceTail+0x1e0
ab056d00 8298f039 8573bd48 89521e68 00000000 nt!IopXxxControlFile+0x6b7
ab056d34 8288cb1a 000000c4 00000000 00000000 nt!NtDeviceIoControlFile+0x2a
ab056d34 77980f34 000000c4 00000000 00000000 nt!KiFastCallEntry+0x12a
WARNING: Frame IP not in any known module. Following frames may be wrong.
01d0f310 00000000 00000000 00000000 00000000 0x77980f34
STACK_COMMAND: kb
FOLLOWUP_IP:
ksecdd!KeRegOpenKey+61
8269b8c0 85f6 test esi,esi
SYMBOL_STACK_INDEX: 9
SYMBOL_NAME: ksecdd!KeRegOpenKey+61
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: ksecdd
IMAGE_NAME: ksecdd.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 4a364836
FAILURE_BUCKET_ID: 0x8E_ksecdd!KeRegOpenKey+61
BUCKET_ID: 0x8E_ksecdd!KeRegOpenKey+61
Followup: MachineOwner
---------
0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
KERNEL_MODE_EXCEPTION_NOT_HANDLED_M (1000008e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003. This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG. This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG. This will let us see why this breakpoint is
happening.
Arguments:
Arg1: c0000005, The exception code that was not handled
Arg2: 82968d45, The address that the exception occurred at
Arg3: ab0562c4, Trap Frame
Arg4: 00000000
Debugging Details:
------------------
TRIAGER: Could not open triage file : C:\Program Files (x86)\Windows Kits\8.0\Debuggers\x64\triage\modclass.ini, error 2
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - Die Anweisung in 0x%08lx verweist auf Speicher 0x%08lx. Der Vorgang %s konnte nicht im Speicher durchgef hrt werden.
FAULTING_IP:
nt!CmpCacheLookup+9f
82968d45 8b48fc mov ecx,dword ptr [eax-4]
TRAP_FRAME: ab0562c4 -- (.trap 0xffffffffab0562c4)
ErrCode = 00000000
eax=02d3cfe9 ebx=3b9aca07 ecx=0000000b edx=00002aa8 esi=ab0565b4 edi=000007ff
eip=82968d45 esp=ab056338 ebp=ab056384 iopl=0 nv up ei pl nz na po nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010202
nt!CmpCacheLookup+0x9f:
82968d45 8b48fc mov ecx,dword ptr [eax-4] ds:0023:02d3cfe5=????????
Resetting default scope
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
BUGCHECK_STR: 0x8E
PROCESS_NAME: lsass.exe
CURRENT_IRQL: 0
LAST_CONTROL_TRANSFER: from 82966b67 to 82968d45
STACK_TEXT:
ab056384 82966b67 ab0563c0 00000006 ab0565bc nt!CmpCacheLookup+0x9f
ab056548 82966e46 ab0565a8 ab0565b4 ab0565d4 nt!CmpBuildHashStackAndLookupCache+0x13c
ab0566c0 829ef0b1 8b40ff48 8498e1c8 854d3350 nt!CmpParseKey+0x284
ab056750 829ec85d 00000000 ab0567a8 00000640 nt!ObpLookupObjectName+0x615
ab0567b4 8293949f ab05694c 8498e1c8 82ba7000 nt!ObOpenObjectByName+0x13c
ab056888 8293925c ab056998 00020019 ab05694c nt!CmOpenKey+0x1b1
ab0568ac 8288cb1a ab056998 00020019 ab05694c nt!NtOpenKey+0x39
ab0568ac 8287eba5 ab056998 00020019 ab05694c nt!KiFastCallEntry+0x12a
ab056930 8269b8c0 ab056998 00020019 ab05694c nt!ZwOpenKey+0x11
ab05696c 8269bc5f 80000002 82677a28 00020019 ksecdd!KeRegOpenKey+0x61
ab056988 82699d31 80000002 ab0569a0 00020019 ksecdd!VerifyRegistryAccess+0x1a
ab0569d0 826925aa 82683a80 00000000 00020019 ksecdd!CfgReg_Acquire+0x74
ab056adc 82692b45 00000000 00000003 85477628 ksecdd!BCryptResolveProviders+0x185
ab056b28 82692b98 00020000 85477608 00000064 ksecdd!_ResolutionFunctionIoHandler+0x86
ab056b44 82692c2c 00020000 85477608 00000064 ksecdd!_ConfigFunctionIoHandler+0x31
ab056b6c 826932b5 85477608 00000064 00000000 ksecdd!ConfigIoHandler+0x63
ab056b84 8268820d 00390402 85477608 00000064 ksecdd!CryptDeviceIoHandler+0x26
ab056c00 826883b0 85477608 00000064 b4cd3528 ksecdd!KsecDeviceControl+0x2c5
ab056c2c 82827f9f 8573bd48 00000000 89521e68 ksecdd!KsecDispatch+0xa6
ab056c44 8298911b 88b95f08 89521e68 89521ed8 nt!IofCallDriver+0x63
ab056c64 8298a0df 8573bd48 88b95f08 00000000 nt!IopSynchronousServiceTail+0x1e0
ab056d00 8298f039 8573bd48 89521e68 00000000 nt!IopXxxControlFile+0x6b7
ab056d34 8288cb1a 000000c4 00000000 00000000 nt!NtDeviceIoControlFile+0x2a
ab056d34 77980f34 000000c4 00000000 00000000 nt!KiFastCallEntry+0x12a
WARNING: Frame IP not in any known module. Following frames may be wrong.
01d0f310 00000000 00000000 00000000 00000000 0x77980f34
STACK_COMMAND: kb
FOLLOWUP_IP:
ksecdd!KeRegOpenKey+61
8269b8c0 85f6 test esi,esi
SYMBOL_STACK_INDEX: 9
SYMBOL_NAME: ksecdd!KeRegOpenKey+61
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: ksecdd
IMAGE_NAME: ksecdd.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 4a364836
FAILURE_BUCKET_ID: 0x8E_ksecdd!KeRegOpenKey+61
BUCKET_ID: 0x8E_ksecdd!KeRegOpenKey+61
Followup: MachineOwner
Ich habe ein Problem mit meinem Notebook (ASUS, mit Windows Vista) und hoffe hier kann mir jemand helfen!
Folgendes:
Er läuft immer ca 20 Minuten (aber auch langsamer als sonst) und dann kommt entweder ein Bluescreen und er geht aus, oder er friert ein und nichts geht mehr.
Im abgesicherten Modus das gleiche!
Irgendwo hier im Forum hab ich letztens gelesen, dass ich diese Absturz-Dokumentation (.dmp) suchen soll, letztes Mal hab ichs geschafft die neuesten 3 zu speichern bevor er abgestürzt ist, und mittlerweile hab ich den inhalt auch als word-datei. kann mir damit jemand weiterhelfen?
(offensichtlich hab ich leider überhaupt keine ahnung von computern. ich wär deshalb echt dankbar für antworten, die ich auch ohne das ganze know-how verstehen kann!)
hier der inhalt von 2 der .dmp-dateien (3 überschreiten die erlaubte zeichenanzal):
1.
Microsoft (R) Windows Debugger Version 6.2.8229.0 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*C:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows Vista Kernel Version 6000 MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 6000.17021.x86fre.vista_gdr.100218-0019
Machine Name:
Kernel base = 0x82800000 PsLoadedModuleList = 0x82911e10
Debug session time: Thu Feb 23 22:50:42.222 2012 (UTC + 1:00)
System Uptime: 0 days 0:20:47.738
Loading Kernel Symbols
...............................................................
...................
Loading User Symbols
Loading unloaded module list
.....
TRIAGER: Could not open triage file : C:\Program Files (x86)\Windows Kits\8.0\Debuggers\x64\triage\oca.ini, error 2
TRIAGER: Could not open triage file : C:\Program Files (x86)\Windows Kits\8.0\Debuggers\x64\winxp\triage.ini, error 2
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 1000008E, {c0000005, 828e752b, 989e3884, 0}
TRIAGER: Could not open triage file : C:\Program Files (x86)\Windows Kits\8.0\Debuggers\x64\triage\modclass.ini, error 2
Probably caused by : ntkrpamp.exe ( nt!ExAllocatePoolWithTag+520 )
Followup: MachineOwner
---------
0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
KERNEL_MODE_EXCEPTION_NOT_HANDLED_M (1000008e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003. This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG. This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG. This will let us see why this breakpoint is
happening.
Arguments:
Arg1: c0000005, The exception code that was not handled
Arg2: 828e752b, The address that the exception occurred at
Arg3: 989e3884, Trap Frame
Arg4: 00000000
Debugging Details:
------------------
TRIAGER: Could not open triage file : C:\Program Files (x86)\Windows Kits\8.0\Debuggers\x64\triage\modclass.ini, error 2
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - Die Anweisung in 0x%08lx verweist auf Speicher 0x%08lx. Der Vorgang %s konnte nicht im Speicher durchgef hrt werden.
FAULTING_IP:
nt!ExAllocatePoolWithTag+520
828e752b 894804 mov dword ptr [eax+4],ecx
TRAP_FRAME: 989e3884 -- (.trap 0xffffffff989e3884)
ErrCode = 00000002
eax=0043005c ebx=84941144 ecx=8493e2f4 edx=00000001 esi=8493e068 edi=a4acf438
eip=828e752b esp=989e38f8 ebp=989e3944 iopl=0 nv up ei pl nz na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010206
nt!ExAllocatePoolWithTag+0x520:
828e752b 894804 mov dword ptr [eax+4],ecx ds:0023:00430060=????????
Resetting default scope
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
BUGCHECK_STR: 0x8E
PROCESS_NAME: svchost.exe
CURRENT_IRQL: 0
LAST_CONTROL_TRANSFER: from 829791bb to 828e752b
STACK_TEXT:
989e3944 829791bb 00000001 00000250 65536f49 nt!ExAllocatePoolWithTag+0x520
989e3968 8297910c 82ab02d8 0000021c 00000000 nt!FsRtlAllocateExtraCreateParameter+0x38
989e39a0 8298cfc8 82ab02d8 00000002 00000000 nt!FsRtlAllocateExtraCreateParameterFromLookasideList+0x4b
989e39d0 8298d205 85f138d0 00000204 00000000 nt!IopSymlinkAllocateAndAddECP+0x3d
989e39f0 8299706f 85f138d0 861410e0 0000002e nt!IopSymlinkCreateECP+0x4d
989e3ab8 829ef0b1 857b4b98 00000000 85e3d450 nt!IopParseDevice+0xc6a
989e3b48 829ec85d 00000000 989e3ba0 00000040 nt!ObpLookupObjectName+0x615
989e3ba8 8298c94a 016de54c 00000000 ffffff01 nt!ObOpenObjectByName+0x13c
989e3d54 8288cb1a 016de54c 016de514 016de57c nt!NtQueryFullAttributesFile+0x138
989e3d54 77d60f34 016de54c 016de514 016de57c nt!KiFastCallEntry+0x12a
WARNING: Frame IP not in any known module. Following frames may be wrong.
016de57c 00000000 00000000 00000000 00000000 0x77d60f34
STACK_COMMAND: kb
FOLLOWUP_IP:
nt!ExAllocatePoolWithTag+520
828e752b 894804 mov dword ptr [eax+4],ecx
SYMBOL_STACK_INDEX: 0
SYMBOL_NAME: nt!ExAllocatePoolWithTag+520
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrpamp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 4b7d25c9
FAILURE_BUCKET_ID: 0x8E_nt!ExAllocatePoolWithTag+520
BUCKET_ID: 0x8E_nt!ExAllocatePoolWithTag+520
Followup: MachineOwner
---------
2.
Microsoft (R) Windows Debugger Version 6.2.8229.0 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Mini Kernel Dump File: Only registers and stack trace are available
WARNING: Whitespace at start of path element
Symbol search path is:
SRV*C:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows Vista Kernel Version 6000 MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 6000.17021.x86fre.vista_gdr.100218-0019
Machine Name:
Kernel base = 0x82800000 PsLoadedModuleList = 0x82911e10
Debug session time: Mon Feb 27 00:19:36.442 2012 (UTC + 1:00)
System Uptime: 0 days 0:21:09.337
Loading Kernel Symbols
...............................................................
................................................................
......................
Loading User Symbols
Loading unloaded module list
......
TRIAGER: Could not open triage file : C:\Program Files (x86)\Windows Kits\8.0\Debuggers\x64\triage\oca.ini, error 2
TRIAGER: Could not open triage file : C:\Program Files (x86)\Windows Kits\8.0\Debuggers\x64\winxp\triage.ini, error 2
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 1000008E, {c0000005, 82968d45, ab0562c4, 0}
TRIAGER: Could not open triage file : C:\Program Files (x86)\Windows Kits\8.0\Debuggers\x64\triage\modclass.ini, error 2
Probably caused by : ksecdd.sys ( ksecdd!KeRegOpenKey+61 )
Followup: MachineOwner
---------
0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
KERNEL_MODE_EXCEPTION_NOT_HANDLED_M (1000008e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003. This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG. This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG. This will let us see why this breakpoint is
happening.
Arguments:
Arg1: c0000005, The exception code that was not handled
Arg2: 82968d45, The address that the exception occurred at
Arg3: ab0562c4, Trap Frame
Arg4: 00000000
Debugging Details:
------------------
TRIAGER: Could not open triage file : C:\Program Files (x86)\Windows Kits\8.0\Debuggers\x64\triage\modclass.ini, error 2
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - Die Anweisung in 0x%08lx verweist auf Speicher 0x%08lx. Der Vorgang %s konnte nicht im Speicher durchgef hrt werden.
FAULTING_IP:
nt!CmpCacheLookup+9f
82968d45 8b48fc mov ecx,dword ptr [eax-4]
TRAP_FRAME: ab0562c4 -- (.trap 0xffffffffab0562c4)
ErrCode = 00000000
eax=02d3cfe9 ebx=3b9aca07 ecx=0000000b edx=00002aa8 esi=ab0565b4 edi=000007ff
eip=82968d45 esp=ab056338 ebp=ab056384 iopl=0 nv up ei pl nz na po nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010202
nt!CmpCacheLookup+0x9f:
82968d45 8b48fc mov ecx,dword ptr [eax-4] ds:0023:02d3cfe5=????????
Resetting default scope
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
BUGCHECK_STR: 0x8E
PROCESS_NAME: lsass.exe
CURRENT_IRQL: 0
LAST_CONTROL_TRANSFER: from 82966b67 to 82968d45
STACK_TEXT:
ab056384 82966b67 ab0563c0 00000006 ab0565bc nt!CmpCacheLookup+0x9f
ab056548 82966e46 ab0565a8 ab0565b4 ab0565d4 nt!CmpBuildHashStackAndLookupCache+0x13c
ab0566c0 829ef0b1 8b40ff48 8498e1c8 854d3350 nt!CmpParseKey+0x284
ab056750 829ec85d 00000000 ab0567a8 00000640 nt!ObpLookupObjectName+0x615
ab0567b4 8293949f ab05694c 8498e1c8 82ba7000 nt!ObOpenObjectByName+0x13c
ab056888 8293925c ab056998 00020019 ab05694c nt!CmOpenKey+0x1b1
ab0568ac 8288cb1a ab056998 00020019 ab05694c nt!NtOpenKey+0x39
ab0568ac 8287eba5 ab056998 00020019 ab05694c nt!KiFastCallEntry+0x12a
ab056930 8269b8c0 ab056998 00020019 ab05694c nt!ZwOpenKey+0x11
ab05696c 8269bc5f 80000002 82677a28 00020019 ksecdd!KeRegOpenKey+0x61
ab056988 82699d31 80000002 ab0569a0 00020019 ksecdd!VerifyRegistryAccess+0x1a
ab0569d0 826925aa 82683a80 00000000 00020019 ksecdd!CfgReg_Acquire+0x74
ab056adc 82692b45 00000000 00000003 85477628 ksecdd!BCryptResolveProviders+0x185
ab056b28 82692b98 00020000 85477608 00000064 ksecdd!_ResolutionFunctionIoHandler+0x86
ab056b44 82692c2c 00020000 85477608 00000064 ksecdd!_ConfigFunctionIoHandler+0x31
ab056b6c 826932b5 85477608 00000064 00000000 ksecdd!ConfigIoHandler+0x63
ab056b84 8268820d 00390402 85477608 00000064 ksecdd!CryptDeviceIoHandler+0x26
ab056c00 826883b0 85477608 00000064 b4cd3528 ksecdd!KsecDeviceControl+0x2c5
ab056c2c 82827f9f 8573bd48 00000000 89521e68 ksecdd!KsecDispatch+0xa6
ab056c44 8298911b 88b95f08 89521e68 89521ed8 nt!IofCallDriver+0x63
ab056c64 8298a0df 8573bd48 88b95f08 00000000 nt!IopSynchronousServiceTail+0x1e0
ab056d00 8298f039 8573bd48 89521e68 00000000 nt!IopXxxControlFile+0x6b7
ab056d34 8288cb1a 000000c4 00000000 00000000 nt!NtDeviceIoControlFile+0x2a
ab056d34 77980f34 000000c4 00000000 00000000 nt!KiFastCallEntry+0x12a
WARNING: Frame IP not in any known module. Following frames may be wrong.
01d0f310 00000000 00000000 00000000 00000000 0x77980f34
STACK_COMMAND: kb
FOLLOWUP_IP:
ksecdd!KeRegOpenKey+61
8269b8c0 85f6 test esi,esi
SYMBOL_STACK_INDEX: 9
SYMBOL_NAME: ksecdd!KeRegOpenKey+61
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: ksecdd
IMAGE_NAME: ksecdd.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 4a364836
FAILURE_BUCKET_ID: 0x8E_ksecdd!KeRegOpenKey+61
BUCKET_ID: 0x8E_ksecdd!KeRegOpenKey+61
Followup: MachineOwner
---------
0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
KERNEL_MODE_EXCEPTION_NOT_HANDLED_M (1000008e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003. This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG. This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG. This will let us see why this breakpoint is
happening.
Arguments:
Arg1: c0000005, The exception code that was not handled
Arg2: 82968d45, The address that the exception occurred at
Arg3: ab0562c4, Trap Frame
Arg4: 00000000
Debugging Details:
------------------
TRIAGER: Could not open triage file : C:\Program Files (x86)\Windows Kits\8.0\Debuggers\x64\triage\modclass.ini, error 2
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - Die Anweisung in 0x%08lx verweist auf Speicher 0x%08lx. Der Vorgang %s konnte nicht im Speicher durchgef hrt werden.
FAULTING_IP:
nt!CmpCacheLookup+9f
82968d45 8b48fc mov ecx,dword ptr [eax-4]
TRAP_FRAME: ab0562c4 -- (.trap 0xffffffffab0562c4)
ErrCode = 00000000
eax=02d3cfe9 ebx=3b9aca07 ecx=0000000b edx=00002aa8 esi=ab0565b4 edi=000007ff
eip=82968d45 esp=ab056338 ebp=ab056384 iopl=0 nv up ei pl nz na po nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010202
nt!CmpCacheLookup+0x9f:
82968d45 8b48fc mov ecx,dword ptr [eax-4] ds:0023:02d3cfe5=????????
Resetting default scope
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
BUGCHECK_STR: 0x8E
PROCESS_NAME: lsass.exe
CURRENT_IRQL: 0
LAST_CONTROL_TRANSFER: from 82966b67 to 82968d45
STACK_TEXT:
ab056384 82966b67 ab0563c0 00000006 ab0565bc nt!CmpCacheLookup+0x9f
ab056548 82966e46 ab0565a8 ab0565b4 ab0565d4 nt!CmpBuildHashStackAndLookupCache+0x13c
ab0566c0 829ef0b1 8b40ff48 8498e1c8 854d3350 nt!CmpParseKey+0x284
ab056750 829ec85d 00000000 ab0567a8 00000640 nt!ObpLookupObjectName+0x615
ab0567b4 8293949f ab05694c 8498e1c8 82ba7000 nt!ObOpenObjectByName+0x13c
ab056888 8293925c ab056998 00020019 ab05694c nt!CmOpenKey+0x1b1
ab0568ac 8288cb1a ab056998 00020019 ab05694c nt!NtOpenKey+0x39
ab0568ac 8287eba5 ab056998 00020019 ab05694c nt!KiFastCallEntry+0x12a
ab056930 8269b8c0 ab056998 00020019 ab05694c nt!ZwOpenKey+0x11
ab05696c 8269bc5f 80000002 82677a28 00020019 ksecdd!KeRegOpenKey+0x61
ab056988 82699d31 80000002 ab0569a0 00020019 ksecdd!VerifyRegistryAccess+0x1a
ab0569d0 826925aa 82683a80 00000000 00020019 ksecdd!CfgReg_Acquire+0x74
ab056adc 82692b45 00000000 00000003 85477628 ksecdd!BCryptResolveProviders+0x185
ab056b28 82692b98 00020000 85477608 00000064 ksecdd!_ResolutionFunctionIoHandler+0x86
ab056b44 82692c2c 00020000 85477608 00000064 ksecdd!_ConfigFunctionIoHandler+0x31
ab056b6c 826932b5 85477608 00000064 00000000 ksecdd!ConfigIoHandler+0x63
ab056b84 8268820d 00390402 85477608 00000064 ksecdd!CryptDeviceIoHandler+0x26
ab056c00 826883b0 85477608 00000064 b4cd3528 ksecdd!KsecDeviceControl+0x2c5
ab056c2c 82827f9f 8573bd48 00000000 89521e68 ksecdd!KsecDispatch+0xa6
ab056c44 8298911b 88b95f08 89521e68 89521ed8 nt!IofCallDriver+0x63
ab056c64 8298a0df 8573bd48 88b95f08 00000000 nt!IopSynchronousServiceTail+0x1e0
ab056d00 8298f039 8573bd48 89521e68 00000000 nt!IopXxxControlFile+0x6b7
ab056d34 8288cb1a 000000c4 00000000 00000000 nt!NtDeviceIoControlFile+0x2a
ab056d34 77980f34 000000c4 00000000 00000000 nt!KiFastCallEntry+0x12a
WARNING: Frame IP not in any known module. Following frames may be wrong.
01d0f310 00000000 00000000 00000000 00000000 0x77980f34
STACK_COMMAND: kb
FOLLOWUP_IP:
ksecdd!KeRegOpenKey+61
8269b8c0 85f6 test esi,esi
SYMBOL_STACK_INDEX: 9
SYMBOL_NAME: ksecdd!KeRegOpenKey+61
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: ksecdd
IMAGE_NAME: ksecdd.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 4a364836
FAILURE_BUCKET_ID: 0x8E_ksecdd!KeRegOpenKey+61
BUCKET_ID: 0x8E_ksecdd!KeRegOpenKey+61
Followup: MachineOwner
