Hallöle!
Hatte heute schon 3x einen Bluescreen mit folgendem STOP-Error:
STOP: 0x0000008E (0xC0000005, 0x00BEAEDB, 0xB6F31CEC, 0x00000000)
Das Windbg Crashdump sieht folgendermaßen aus (falls sich jemand auskennt):
Microsoft (R) Windows Debugger Version 6.9.0003.113 X86
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [C:\WINDOWS\Minidump\Mini070108-03.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: C:\WINDOWS\Symbols
Executable search path is:
Unable to load image ntoskrnl.exe, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
Windows XP Kernel Version 2600 (Service Pack 3) MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055d720
Debug session time: Tue Jul 1 12:33:22.625 2008 (GMT+2)
System Uptime: 0 days 0:09:19.400
Unable to load image ntoskrnl.exe, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
Loading Kernel Symbols
..................................................................................................................
Loading User Symbols
Loading unloaded module list
............
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 1000008E, {c0000005, beaedb, b6f31cec, 0}
*** WARNING: Unable to verify timestamp for NDIS.sys
Probably caused by : Unknown_Image ( ANALYSIS_INCONCLUSIVE )
Followup: MachineOwner
---------
Und nach "!analyze -v" kommt:
KERNEL_MODE_EXCEPTION_NOT_HANDLED_M (1000008e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003. This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG. This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG. This will let us see why this breakpoint is
happening.
Arguments:
Arg1: c0000005, The exception code that was not handled
Arg2: 00beaedb, The address that the exception occurred at
Arg3: b6f31cec, Trap Frame
Arg4: 00000000
Debugging Details:
------------------
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - Die Anweisung in "0x%08lx" verweist auf Speicher in "0x%08lx". Der Vorgang "%s" konnte nicht auf dem Speicher durchgeführt werden.
FAULTING_IP:
+beaedb
00beaedb 0174bfbe add dword ptr [edi+edi*4-42h],esi
TRAP_FRAME: b6f31cec -- (.trap 0xffffffffb6f31cec)
ErrCode = 00000002
eax=bab38000 ebx=00000000 ecx=00000000 edx=ffffffff esi=cf900600 edi=6e543015
eip=00beaedb esp=b6f31d60 ebp=b6f31d64 iopl=0 nv up ei ng nz ac pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010296
00beaedb 0174bfbe add dword ptr [edi+edi*4-42h],esi ds:0023:27a4f027=????????
Resetting default scope
CUSTOMER_CRASH_COUNT: 3
DEFAULT_BUCKET_ID: DRIVER_FAULT
BUGCHECK_STR: 0x8E
PROCESS_NAME: FahCore_11.exe
LAST_CONTROL_TRANSFER: from 00d00804 to 00beaedb
STACK_TEXT:
WARNING: Frame IP not in any known module. Following frames may be wrong.
b6f31d64 00d00804 badb0d00 01420000 b6791d98 0xbeaedb
b6f31d68 badb0d00 01420000 b6791d98 b6791dcc 0xd00804
b6f31d6c 01420000 b6791d98 b6791dcc 00000000 0xbadb0d00
b6f31d70 b6791d98 b6791dcc 00000000 00000000 0x1420000
b6f31d74 b6791dcc 00000000 00000000 00000000 0xb6791d98
b6f31d78 00000000 00000000 00000000 00000000 0xb6791dcc
STACK_COMMAND: .trap 0xffffffffb6f31cec ; kb
SYMBOL_NAME: ANALYSIS_INCONCLUSIVE
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: Unknown_Module
IMAGE_NAME: Unknown_Image
DEBUG_FLR_IMAGE_TIMESTAMP: 0
FAILURE_BUCKET_ID: 0x8E_ANALYSIS_INCONCLUSIVE
BUCKET_ID: 0x8E_ANALYSIS_INCONCLUSIVE
Followup: MachineOwner
---------
Weiß jemand wie ich das in den Griff bekommen kann?