Ich habe bei einem PC, der machmal aus unerfindlichen Gründen einen Bluescreen bringt, mal ein komplettes Speicherabbild erstellen lassen und dieses mit "WinDbg" versucht, auszuwerten.
Dabei kam das Untenstehende raus - ich guck da ziemlich dumm.
kann man dem überhaupt etwas entnehmen, könnt Ihr mir da helfen?
Jürgen
*******************************************************************************
* Bugcheck Analysis *
*******************************************************************************
IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 00330014, memory referenced
Arg2: 000000ff, IRQL
Arg3: 00000000, value 0 = read operation, 1 = write operation
Arg4: 804db65c, address which referenced memory
Debugging Details:
------------------
READ_ADDRESS: 00330014
CURRENT_IRQL: ff
FAULTING_IP:
nt!ExReleaseResourceLite+c
804db65c 668b510e mov dx,word ptr [ecx+0Eh]
DEFAULT_BUCKET_ID: DRIVER_FAULT
BUGCHECK_STR: 0xA
PROCESS_NAME: System
TRAP_FRAME: b20ae408 -- (.trap ffffffffb20ae408)
ErrCode = 00000000
eax=892748c8 ebx=00000000 ecx=00330006 edx=87ed0080 esi=87ed3410 edi=87ed7e00
eip=804db65c esp=b20ae47c ebp=b20ae490 iopl=0 nv up di pl nz ac po nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010012
nt!ExReleaseResourceLite+0xc:
804db65c 668b510e mov dx,word ptr [ecx+0Eh] ds:0023:00330014=????
Resetting default scope
LAST_CONTROL_TRANSFER: from 804db65c to 804e187f
STACK_TEXT:
b20ae408 804db65c badb0d00 87ed0080 f7b528c9 nt!KiTrap0E+0x233
b20ae484 f7b5289b 87ed7dd0 b20ae4a8 f7b543a9 nt!ExReleaseResourceLite+0xc
b20ae490 f7b543a9 87ed7dd0 87ed3410 00000000 Ntfs!NtfsReleaseFcb+0x4e
b20ae4a8 f7b52497 87ed7dd0 00000000 87ed7dd0 Ntfs!NtfsReleaseAllResources+0x62
b20ae4c0 f7b526e6 87ed7dd0 00000001 00000000 Ntfs!NtfsCleanupIrpContext+0x23
b20ae4d8 f7b7fe44 87ed7dd0 00000000 00000000 Ntfs!NtfsCompleteRequest+0x35
b20ae558 f7b97cfe 89844100 00000001 87d46540 Ntfs!NtfsFspClose+0x1a5
b20ae5d0 f7b97dc9 87d46540 89844100 00000001 Ntfs!NtfsFlushVolume+0x48
b20ae670 f7b8b385 87d46540 87e9f370 00000000 Ntfs!NtfsCommonVolumeOpen+0x341
b20ae748 804e37f7 89844020 87e9f370 87e9f370 Ntfs!NtfsFsdCreate+0x154
b20ae758 f7952e9b 00000000 87e9f370 87e9f548 nt!IopfCallDriver+0x31
b20ae77c f795f448 b20ae79c 89587e30 00000000 fltMgr!FltpLegacyProcessingAfterPreCallbacksCompleted+0x20b
b20ae7b8 804e37f7 89587e30 87e9f370 87e9f370 fltMgr!FltpCreate+0x26a
b20ae7c8 80570a29 8986ee18 89527aa4 b20ae970 nt!IopfCallDriver+0x31
b20ae8a8 8056356c 8986ee30 00000000 89527a00 nt!IopParseDevice+0xa12
b20ae930 8056769a 00000000 b20ae970 00000240 nt!ObpLookupObjectName+0x56a
b20ae984 80570f03 00000000 00000000 0aecf000 nt!ObOpenObjectByName+0xeb
b20aea00 80570fd2 b20aeba4 00100003 b20aeb8c nt!IopCreateFile+0x407
b20aea5c 80571108 b20aeba4 00100003 b20aeb8c nt!IoCreateFile+0x8e
b20aea9c 804de7ec b20aeba4 00100003 b20aeb8c nt!NtCreateFile+0x30
b20aea9c 804dc9b1 b20aeba4 00100003 b20aeb8c nt!KiFastCallEntry+0xf8
b20aeb40 8062a8be b20aeba4 00100003 b20aeb8c nt!ZwCreateFile+0x11
b20aedac 8057cfce ba7e1ab4 00000000 00000000 nt!PopFlushVolumeWorker+0xe3
b20aeddc 804f88fa 8062a7db ba7e1ab4 00000000 nt!PspSystemThreadStartup+0x34
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16
STACK_COMMAND: kb
FOLLOWUP_IP:
nt!ExReleaseResourceLite+c
804db65c 668b510e mov dx,word ptr [ecx+0Eh]
SYMBOL_STACK_INDEX: 1
SYMBOL_NAME: nt!ExReleaseResourceLite+c
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntoskrnl.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 45881870
FAILURE_BUCKET_ID: 0xA_nt!ExReleaseResourceLite+c
BUCKET_ID: 0xA_nt!ExReleaseResourceLite+c
Followup: MachineOwner
---------
apollo4
jueki
