Hi,
ich habe ein etwas komisches Problem.
Habe mir vor etwa einer Woche einen neuen Rechner zusammengebaut (PII 955, Gigabyte MA790XT-UD4P, 4096 A-Data DDR3 RAM, Enermax 525W Modu82+, nvidia GTX260). Anschließend Win7 x64 Home Premium installiert. Keine Hardware Komponente ist übertaktet.
Ich bekomme jetzt meistens (~80%) beim ersten Computer Start am Tag einen BSOD. Etwa 5-10min nach dem erreichen des Desktops.
IRQ_Not_Less_Or_Equal
Beim anschließenden Reset drücken, passiert es meist wieder das ich einen BSOD kriege. Wenn ich dann ein Memory Diagnostic Tool laufen lasse, schlagen alle Tests fehl. Mache ich den Computer einmal komplett aus und schalte ihn wieder an sind alle RAM Tests ok (2-3h testen lassen). Ich kriege dann an dem Tag auch keine weiteren BSOD.
Ich habe dann mal die minidump File ausgewertet. Jedoch habe ich mit der Interpretation keine Erfahrung.
Microsoft (R) Windows Debugger Version 6.11.0001.404 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [C:\Windows\Minidump\100709-18751-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*d:\websymbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7600 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7600.16385.amd64fre.win7_rtm.090713-1255
Machine Name:
Kernel base = 0xfffff800`0281a000 PsLoadedModuleList = 0xfffff800`02a57e50
Debug session time: Wed Oct 7 18:17:13.094 2009 (GMT+2)
System Uptime: 0 days 0:24:57.842
Loading Kernel Symbols
...............................................................
................................................................
..................
Loading User Symbols
Loading unloaded module list
....
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck A, {fffffa800d47f010, 2, 1, fffff80002948a57}
Probably caused by : memory_corruption ( nt!MiReleaseConfirmedPageFileSpace+87 )
Followup: MachineOwner
---------
0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: fffffa800d47f010, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000001, bitfield :
bit 0 : value 0 = read operation, 1 = write operation
bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: fffff80002948a57, address which referenced memory
Debugging Details:
------------------
WRITE_ADDRESS: GetPointerFromAddress: unable to read from fffff80002ac20e0
fffffa800d47f010
CURRENT_IRQL: 2
FAULTING_IP:
nt!MiReleaseConfirmedPageFileSpace+87
fffff800`02948a57 480fb328 btr qword ptr [rax],rbp
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
BUGCHECK_STR: 0xA
PROCESS_NAME: MsMpEng.exe
TRAP_FRAME: fffff88006fcd620 -- (.trap 0xfffff88006fcd620)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=fffffa800547f010 rbx=0000000000000000 rcx=0000000000000000
rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80002948a57 rsp=fffff88006fcd7b0 rbp=0000000040000000
r8=fffff88006fcd7e0 r9=fffffa8005962930 r10=0000000fffffffff
r11=0000000000000000 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl zr na po nc
nt!MiReleaseConfirmedPageFileSpace+0x87:
fffff800`02948a57 480fb328 btr qword ptr [rax],rbp ds:fffffa80`0547f010=????????????????
Resetting default scope
LAST_CONTROL_TRANSFER: from fffff8000288b469 to fffff8000288bf00
STACK_TEXT:
fffff880`06fcd4d8 fffff800`0288b469 : 00000000`0000000a fffffa80`0d47f010 00000000`00000002 00000000`00000001 : nt!KeBugCheckEx
fffff880`06fcd4e0 fffff800`0288a0e0 : 00000000`00000000 fffffa80`05e1e060 fffff880`06fcd6a0 00000000`00000801 : nt!KiBugCheckDispatch+0x69
fffff880`06fcd620 fffff800`02948a57 : fffff880`06fcd7f0 fffffa80`05e1e060 fffffa80`05447ab0 fffffa80`0038c640 : nt!KiPageFault+0x260
fffff880`06fcd7b0 fffff800`028fe108 : 40000000`00000000 00000000`0000096b 00000000`00000388 00000000`0e34d000 : nt!MiReleaseConfirmedPageFileSpace+0x87
fffff880`06fcd830 fffff800`028bf5d9 : fffff880`00000000 00000000`0e37bfff 00000000`00000000 00000001`05e1e001 : nt! ?? ::FNODOBFM::`string'+0x33868
fffff880`06fcd9f0 fffff800`02ba1e50 : fffffa80`05a4da50 0007ffff`00000000 fffffa80`043b1f00 fffffa80`043b1f00 : nt!MiRemoveMappedView+0xd9
fffff880`06fcdb10 fffff800`02ba225b : 00000980`00000000 00000000`0e110000 fffffa80`00000001 00000000`00001001 : nt!MiUnmapViewOfSection+0x1b0
fffff880`06fcdbd0 fffff800`0288b153 : 00000000`00000001 00000000`ffff0201 fffffa80`05962930 00000000`00295160 : nt!NtUnmapViewOfSection+0x5f
fffff880`06fcdc20 00000000`774f015a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`0241e748 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x774f015a
STACK_COMMAND: kb
FOLLOWUP_IP:
nt!MiReleaseConfirmedPageFileSpace+87
fffff800`02948a57 480fb328 btr qword ptr [rax],rbp
SYMBOL_STACK_INDEX: 3
SYMBOL_NAME: nt!MiReleaseConfirmedPageFileSpace+87
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
DEBUG_FLR_IMAGE_TIMESTAMP: 4a5bc600
IMAGE_NAME: memory_corruption
FAILURE_BUCKET_ID: X64_0xA_nt!MiReleaseConfirmedPageFileSpace+87
BUCKET_ID: X64_0xA_nt!MiReleaseConfirmedPageFileSpace+87
Followup: MachineOwner
---------
0: kd> !thread
GetPointerFromAddress: unable to read from fffff80002ac2000
THREAD fffffa8005e1e060 Cid 0334.077c Teb: 000007fffff88000 Win32Thread: 0000000000000000 RUNNING on processor 0
Not impersonating
GetUlongFromAddress: unable to read from fffff80002a00b74
Owning Process fffffa8005962930 Image: MsMpEng.exe
Attached Process N/A Image: N/A
fffff78000000000: Unable to get shared data
Wait Start TickCount 96014
Context Switch Count 3006
ReadMemory error: Cannot get nt!KeMaximumIncrement value.
UserTime 00:00:00.000
KernelTime 00:00:00.000
Win32 Start Address 0x000007feff7173fc
Stack Init fffff88006fcddb0 Current fffff88006fcd7b0
Base fffff88006fce000 Limit fffff88006fc8000 Call 0
Priority 8 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5
Child-SP RetAddr : Args to Child : Call Site
fffff880`06fcd4d8 fffff800`0288b469 : 00000000`0000000a fffffa80`0d47f010 00000000`00000002 00000000`00000001 : nt!KeBugCheckEx
fffff880`06fcd4e0 fffff800`0288a0e0 : 00000000`00000000 fffffa80`05e1e060 fffff880`06fcd6a0 00000000`00000801 : nt!KiBugCheckDispatch+0x69
fffff880`06fcd620 fffff800`02948a57 : fffff880`06fcd7f0 fffffa80`05e1e060 fffffa80`05447ab0 fffffa80`0038c640 : nt!KiPageFault+0x260 (TrapFrame @ fffff880`06fcd620)
fffff880`06fcd7b0 fffff800`028fe108 : 40000000`00000000 00000000`0000096b 00000000`00000388 00000000`0e34d000 : nt!MiReleaseConfirmedPageFileSpace+0x87
fffff880`06fcd830 fffff800`028bf5d9 : fffff880`00000000 00000000`0e37bfff 00000000`00000000 00000001`05e1e001 : nt! ?? ::FNODOBFM::`string'+0x33868
fffff880`06fcd9f0 fffff800`02ba1e50 : fffffa80`05a4da50 0007ffff`00000000 fffffa80`043b1f00 fffffa80`043b1f00 : nt!MiRemoveMappedView+0xd9
fffff880`06fcdb10 fffff800`02ba225b : 00000980`00000000 00000000`0e110000 fffffa80`00000001 00000000`00001001 : nt!MiUnmapViewOfSection+0x1b0
fffff880`06fcdbd0 fffff800`0288b153 : 00000000`00000001 00000000`ffff0201 fffffa80`05962930 00000000`00295160 : nt!NtUnmapViewOfSection+0x5f
fffff880`06fcdc20 00000000`774f015a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`06fcdc20)
00000000`0241e748 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x774f015a
0: kd> !irp fffff80002ac2000
fffff80002ac2000: Could not read Irp
ich habe ein etwas komisches Problem.
Habe mir vor etwa einer Woche einen neuen Rechner zusammengebaut (PII 955, Gigabyte MA790XT-UD4P, 4096 A-Data DDR3 RAM, Enermax 525W Modu82+, nvidia GTX260). Anschließend Win7 x64 Home Premium installiert. Keine Hardware Komponente ist übertaktet.
Ich bekomme jetzt meistens (~80%) beim ersten Computer Start am Tag einen BSOD. Etwa 5-10min nach dem erreichen des Desktops.
IRQ_Not_Less_Or_Equal
Beim anschließenden Reset drücken, passiert es meist wieder das ich einen BSOD kriege. Wenn ich dann ein Memory Diagnostic Tool laufen lasse, schlagen alle Tests fehl. Mache ich den Computer einmal komplett aus und schalte ihn wieder an sind alle RAM Tests ok (2-3h testen lassen). Ich kriege dann an dem Tag auch keine weiteren BSOD.
Ich habe dann mal die minidump File ausgewertet. Jedoch habe ich mit der Interpretation keine Erfahrung.
Microsoft (R) Windows Debugger Version 6.11.0001.404 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [C:\Windows\Minidump\100709-18751-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*d:\websymbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7600 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7600.16385.amd64fre.win7_rtm.090713-1255
Machine Name:
Kernel base = 0xfffff800`0281a000 PsLoadedModuleList = 0xfffff800`02a57e50
Debug session time: Wed Oct 7 18:17:13.094 2009 (GMT+2)
System Uptime: 0 days 0:24:57.842
Loading Kernel Symbols
...............................................................
................................................................
..................
Loading User Symbols
Loading unloaded module list
....
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck A, {fffffa800d47f010, 2, 1, fffff80002948a57}
Probably caused by : memory_corruption ( nt!MiReleaseConfirmedPageFileSpace+87 )
Followup: MachineOwner
---------
0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: fffffa800d47f010, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000001, bitfield :
bit 0 : value 0 = read operation, 1 = write operation
bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: fffff80002948a57, address which referenced memory
Debugging Details:
------------------
WRITE_ADDRESS: GetPointerFromAddress: unable to read from fffff80002ac20e0
fffffa800d47f010
CURRENT_IRQL: 2
FAULTING_IP:
nt!MiReleaseConfirmedPageFileSpace+87
fffff800`02948a57 480fb328 btr qword ptr [rax],rbp
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
BUGCHECK_STR: 0xA
PROCESS_NAME: MsMpEng.exe
TRAP_FRAME: fffff88006fcd620 -- (.trap 0xfffff88006fcd620)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=fffffa800547f010 rbx=0000000000000000 rcx=0000000000000000
rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80002948a57 rsp=fffff88006fcd7b0 rbp=0000000040000000
r8=fffff88006fcd7e0 r9=fffffa8005962930 r10=0000000fffffffff
r11=0000000000000000 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl zr na po nc
nt!MiReleaseConfirmedPageFileSpace+0x87:
fffff800`02948a57 480fb328 btr qword ptr [rax],rbp ds:fffffa80`0547f010=????????????????
Resetting default scope
LAST_CONTROL_TRANSFER: from fffff8000288b469 to fffff8000288bf00
STACK_TEXT:
fffff880`06fcd4d8 fffff800`0288b469 : 00000000`0000000a fffffa80`0d47f010 00000000`00000002 00000000`00000001 : nt!KeBugCheckEx
fffff880`06fcd4e0 fffff800`0288a0e0 : 00000000`00000000 fffffa80`05e1e060 fffff880`06fcd6a0 00000000`00000801 : nt!KiBugCheckDispatch+0x69
fffff880`06fcd620 fffff800`02948a57 : fffff880`06fcd7f0 fffffa80`05e1e060 fffffa80`05447ab0 fffffa80`0038c640 : nt!KiPageFault+0x260
fffff880`06fcd7b0 fffff800`028fe108 : 40000000`00000000 00000000`0000096b 00000000`00000388 00000000`0e34d000 : nt!MiReleaseConfirmedPageFileSpace+0x87
fffff880`06fcd830 fffff800`028bf5d9 : fffff880`00000000 00000000`0e37bfff 00000000`00000000 00000001`05e1e001 : nt! ?? ::FNODOBFM::`string'+0x33868
fffff880`06fcd9f0 fffff800`02ba1e50 : fffffa80`05a4da50 0007ffff`00000000 fffffa80`043b1f00 fffffa80`043b1f00 : nt!MiRemoveMappedView+0xd9
fffff880`06fcdb10 fffff800`02ba225b : 00000980`00000000 00000000`0e110000 fffffa80`00000001 00000000`00001001 : nt!MiUnmapViewOfSection+0x1b0
fffff880`06fcdbd0 fffff800`0288b153 : 00000000`00000001 00000000`ffff0201 fffffa80`05962930 00000000`00295160 : nt!NtUnmapViewOfSection+0x5f
fffff880`06fcdc20 00000000`774f015a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`0241e748 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x774f015a
STACK_COMMAND: kb
FOLLOWUP_IP:
nt!MiReleaseConfirmedPageFileSpace+87
fffff800`02948a57 480fb328 btr qword ptr [rax],rbp
SYMBOL_STACK_INDEX: 3
SYMBOL_NAME: nt!MiReleaseConfirmedPageFileSpace+87
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
DEBUG_FLR_IMAGE_TIMESTAMP: 4a5bc600
IMAGE_NAME: memory_corruption
FAILURE_BUCKET_ID: X64_0xA_nt!MiReleaseConfirmedPageFileSpace+87
BUCKET_ID: X64_0xA_nt!MiReleaseConfirmedPageFileSpace+87
Followup: MachineOwner
---------
0: kd> !thread
GetPointerFromAddress: unable to read from fffff80002ac2000
THREAD fffffa8005e1e060 Cid 0334.077c Teb: 000007fffff88000 Win32Thread: 0000000000000000 RUNNING on processor 0
Not impersonating
GetUlongFromAddress: unable to read from fffff80002a00b74
Owning Process fffffa8005962930 Image: MsMpEng.exe
Attached Process N/A Image: N/A
fffff78000000000: Unable to get shared data
Wait Start TickCount 96014
Context Switch Count 3006
ReadMemory error: Cannot get nt!KeMaximumIncrement value.
UserTime 00:00:00.000
KernelTime 00:00:00.000
Win32 Start Address 0x000007feff7173fc
Stack Init fffff88006fcddb0 Current fffff88006fcd7b0
Base fffff88006fce000 Limit fffff88006fc8000 Call 0
Priority 8 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5
Child-SP RetAddr : Args to Child : Call Site
fffff880`06fcd4d8 fffff800`0288b469 : 00000000`0000000a fffffa80`0d47f010 00000000`00000002 00000000`00000001 : nt!KeBugCheckEx
fffff880`06fcd4e0 fffff800`0288a0e0 : 00000000`00000000 fffffa80`05e1e060 fffff880`06fcd6a0 00000000`00000801 : nt!KiBugCheckDispatch+0x69
fffff880`06fcd620 fffff800`02948a57 : fffff880`06fcd7f0 fffffa80`05e1e060 fffffa80`05447ab0 fffffa80`0038c640 : nt!KiPageFault+0x260 (TrapFrame @ fffff880`06fcd620)
fffff880`06fcd7b0 fffff800`028fe108 : 40000000`00000000 00000000`0000096b 00000000`00000388 00000000`0e34d000 : nt!MiReleaseConfirmedPageFileSpace+0x87
fffff880`06fcd830 fffff800`028bf5d9 : fffff880`00000000 00000000`0e37bfff 00000000`00000000 00000001`05e1e001 : nt! ?? ::FNODOBFM::`string'+0x33868
fffff880`06fcd9f0 fffff800`02ba1e50 : fffffa80`05a4da50 0007ffff`00000000 fffffa80`043b1f00 fffffa80`043b1f00 : nt!MiRemoveMappedView+0xd9
fffff880`06fcdb10 fffff800`02ba225b : 00000980`00000000 00000000`0e110000 fffffa80`00000001 00000000`00001001 : nt!MiUnmapViewOfSection+0x1b0
fffff880`06fcdbd0 fffff800`0288b153 : 00000000`00000001 00000000`ffff0201 fffffa80`05962930 00000000`00295160 : nt!NtUnmapViewOfSection+0x5f
fffff880`06fcdc20 00000000`774f015a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`06fcdc20)
00000000`0241e748 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x774f015a
0: kd> !irp fffff80002ac2000
fffff80002ac2000: Could not read Irp