Ein paar Analysen der Minidumps:
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
NO_MORE_IRP_STACK_LOCATIONS (35)
A higher level driver has attempted to call a lower level driver through
the IoCallDriver() interface, but there are no more stack locations in the
packet, hence, the lower level driver would not be able to access its
parameters, as there are no parameters for it. This is a disasterous
situation, since the higher level driver "thinks" it has filled in the
parameters for the lower level driver (something it MUST do before it calls
it), but since there is no stack location for the latter driver, the former
has written off of the end of the packet. This means that some other memory
has probably been trashed at this point.
Arguments:
Arg1: 8815c188, Address of the IRP
Arg2: 00000000
Arg3: 00000000
Arg4: 00000000
Debugging Details:
------------------
***** Kernel symbols are WRONG. Please fix symbols to do analysis.
MODULE_NAME: nt
FAULTING_MODULE: 804d7000 nt
DEBUG_FLR_IMAGE_TIMESTAMP: 42250a1e
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: DRIVER_FAULT
BUGCHECK_STR: 0x35
LAST_CONTROL_TRANSFER: from 804eee98 to 804f9c37
-----------------------------
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
KERNEL_MODE_EXCEPTION_NOT_HANDLED_M (1000008e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003. This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG. This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG. This will let us see why this breakpoint is
happening.
Arguments:
Arg1: c0000005, The exception code that was not handled
Arg2: a7038c0f, The address that the exception occurred at
Arg3: a4266938, Trap Frame
Arg4: 00000000
Debugging Details:
------------------
***** Kernel symbols are WRONG. Please fix symbols to do analysis.
FAULTING_MODULE: 804d7000 nt
DEBUG_FLR_IMAGE_TIMESTAMP: 43cbf672
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - Die Anweisung in "0x%08lx" verweist auf Speicher in "0x%08lx". Der Vorgang "%s" konnte nicht auf dem Speicher durchgef hrt werden.
FAULTING_IP:
SYMEVENT+5c0f
a7038c0f 57 push edi
TRAP_FRAME: a4266938 -- (.trap ffffffffa4266938)
ErrCode = 00000002
eax=89b39b00 ebx=884cb910 ecx=e17ddfa0 edx=00000000 esi=e17ddfa0 edi=87bbd1d8
eip=a7038c0f esp=a42669ac ebp=a4266a1c iopl=0 nv up ei pl zr na po nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010246
SYMEVENT+0x5c0f:
a7038c0f 57 push edi
Resetting default scope
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: DRIVER_FAULT
BUGCHECK_STR: 0x8E
LAST_CONTROL_TRANSFER: from a4bf54d9 to a7038c0f
STACK_TEXT:
WARNING: Stack unwind information not available. Following frames may be wrong.
a4266a1c a4bf54d9 87bbd008 00000001 882a0348 SYMEVENT+0x5c0f
a4266a48 a4bf9dc7 87bbd008 897ef598 a4bf5d9f interceptor+0x44d9
a4266b4c 805bdd08 89b39b00 00000000 87d38840 interceptor+0x8dc7
a4266bc4 805ba390 00000000 a4266c04 00000040 nt+0xe6d08
a4266c18 80574e37 00000000 00000000 c9e84801 nt+0xe3390
a4266c94 805757ae 00c06268 80100080 00c06208 nt+0x9de37
a4266cf0 80577e78 00c06268 80100080 00c06208 nt+0x9e7ae
a4266d30 8054060c 00c06268 80100080 00c06208 nt+0xa0e78
a4266d64 7c91eb94 badb0d00 00c061d0 a4d32d98 nt+0x6960c
a4266d68 badb0d00 00c061d0 a4d32d98 a4d32dcc 0x7c91eb94
a4266d6c 00c061d0 a4d32d98 a4d32dcc 00000000 0xbadb0d00
a4266d70 a4d32d98 a4d32dcc 00000000 00000000 0xc061d0
a4266d74 a4d32dcc 00000000 00000000 00000000 0xa4d32d98
a4266d78 00000000 00000000 00000000 00000000 0xa4d32dcc
STACK_COMMAND: .bugcheck ; kb
FOLLOWUP_IP:
SYMEVENT+5c0f
a7038c0f 57 push edi
FAULTING_SOURCE_CODE:
SYMBOL_STACK_INDEX: 0
FOLLOWUP_NAME: MachineOwner
SYMBOL_NAME: SYMEVENT+5c0f
MODULE_NAME: SYMEVENT
IMAGE_NAME: SYMEVENT.SYS
-----------------
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: 89cec884, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000000, value 0 = read operation, 1 = write operation
Arg4: a40c580e, address which referenced memory
Debugging Details:
------------------
***** Kernel symbols are WRONG. Please fix symbols to do analysis.
FAULTING_MODULE: 804d7000 nt
DEBUG_FLR_IMAGE_TIMESTAMP: 41a321cc
READ_ADDRESS: unable to get nt!MmSpecialPoolStart
unable to get nt!MmSpecialPoolEnd
unable to get nt!MmPoolCodeStart
unable to get nt!MmPoolCodeEnd
89cec884
CURRENT_IRQL: 2
FAULTING_IP:
interceptor+380e
a40c580e 8b4808 mov ecx,[eax+0x8]
CUSTOMER_CRASH_COUNT: 2
DEFAULT_BUCKET_ID: DRIVER_FAULT
BUGCHECK_STR: 0xD1
LAST_CONTROL_TRANSFER: from a40c4af5 to a40c580e
STACK_TEXT:
WARNING: Stack unwind information not available. Following frames may be wrong.
a3d48a10 a40c4af5 88271960 00000001 89b6f9e8 interceptor+0x380e
a3d48a30 a40c6575 88470278 00000001 00000001 interceptor+0x2af5
a3d48a5c a40cadc7 88470278 886af5a8 a40c6d9f interceptor+0x4575
a3d48b60 805bdd08 89b494a0 00000000 881ed950 interceptor+0x8dc7
a3d48bd8 805ba390 00000000 a3d48c18 00000040 nt+0xe6d08
a3d48c2c 80574e37 00000000 00000000 00000001 nt+0xe3390
a3d48ca8 805757ae 00d1db4c 00100001 00d1daf0 nt+0x9de37
a3d48d04 80578f6d 00d1db4c 00100001 00d1daf0 nt+0x9e7ae
a3d48d44 8054060c 00d1db4c 00100001 00d1daf0 nt+0xa1f6d
a3d48d64 7c91eb94 badb0d00 00d1dacc a8343d98 nt+0x6960c
a3d48d68 badb0d00 00d1dacc a8343d98 a8343dcc 0x7c91eb94
a3d48d6c 00d1dacc a8343d98 a8343dcc 00000000 0xbadb0d00
a3d48d70 a8343d98 a8343dcc 00000000 00000000 0xd1dacc
a3d48d74 a8343dcc 00000000 00000000 00000000 0xa8343d98
a3d48d78 00000000 00000000 00000000 00000000 0xa8343dcc
STACK_COMMAND: .bugcheck ; kb
FOLLOWUP_IP:
interceptor+380e
a40c580e 8b4808 mov ecx,[eax+0x8]
FAULTING_SOURCE_CODE:
SYMBOL_STACK_INDEX: 0
FOLLOWUP_NAME: MachineOwner
SYMBOL_NAME: interceptor+380e
MODULE_NAME: interceptor
IMAGE_NAME: interceptor.sys
---------
NTFS_FILE_SYSTEM (24)
If you see NtfsExceptionFilter on the stack then the 2nd and 3rd
parameters are the exception record and context record. Do a .cxr
on the 3rd parameter and then kb to obtain a more informative stack
trace.
Arguments:
Arg1: 001902fe
Arg2: bacff5d0
Arg3: bacff2cc
Arg4: ba61c7b6
Debugging Details:
------------------
***** Kernel symbols are WRONG. Please fix symbols to do analysis.
MODULE_NAME: Ntfs
FAULTING_MODULE: 804d7000 nt
DEBUG_FLR_IMAGE_TIMESTAMP: 41107eea
EXCEPTION_RECORD: bacff5d0 -- (.exr ffffffffbacff5d0)
ExceptionAddress: ba61c7b6 (Ntfs+0x000007b6)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 00000000
Parameter[1]: 01c6a353
Attempt to read from address 01c6a353
CONTEXT: bacff2cc -- (.cxr ffffffffbacff2cc)
eax=01c6a34f ebx=bacff788 ecx=2fde9ce0 edx=bacff6d4 esi=bacff6e4 edi=bacffa72
eip=ba61c7b6 esp=bacff698 ebp=bacff69c iopl=0 nv up ei pl nz na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00210202
Ntfs+0x7b6:
ba61c7b6 8b4804 mov ecx,[eax+0x4] ds:0023:01c6a353=????????
Resetting default scope
CUSTOMER_CRASH_COUNT: 2
DEFAULT_BUCKET_ID: DRIVER_FAULT
BUGCHECK_STR: 0x24
LAST_CONTROL_TRANSFER: from ba643d60 to ba61c7b6
STACK_TEXT:
WARNING: Stack unwind information not available. Following frames may be wrong.
bacff69c ba643d60 bacff788 8888df90 bacff6d8 Ntfs+0x7b6
bacff710 ba6424b4 bacff788 88530a60 89b1d020 Ntfs+0x27d60
bacff774 ba6424ed bacff788 88530a60 00000001 Ntfs+0x264b4
bacff898 804eeeb1 89b1d020 88530a60 88530a60 Ntfs+0x264ed
bacff8d4 ba6c982c 89b1d020 8888df90 bacffa72 nt+0x17eb1
bacff900 ba6ca19a 0000002e 8888df90 bacffa60 sr+0x982c
bacffb74 ba6cd3b5 89b51ac0 000001d4 00000016 sr+0xa19a
bacffc88 ba6cdf0e 89b51ac0 885f3b28 804efd76 sr+0xd3b5
bacffca4 804eeeb1 89b51ac0 885f3b28 bacffcfc sr+0xdf0e
bacffd3c aed13513 885f3b28 00000001 88822008 nt+0x17eb1
bacffd68 aed11c61 0063a32c aed11c51 8863a32c interceptor+0x3513
bacffdac 805ce794 8863a32c 00000000 00000000 interceptor+0x1c61
bacffddc 805450ce 80537668 00000001 00000000 nt+0xf7794
00000000 00000000 00000000 00000000 00000000 nt+0x6e0ce
FOLLOWUP_IP:
Ntfs+7b6
ba61c7b6 8b4804 mov ecx,[eax+0x4]
FAULTING_SOURCE_CODE:
SYMBOL_STACK_INDEX: 0
FOLLOWUP_NAME: MachineOwner
SYMBOL_NAME: Ntfs+7b6
IMAGE_NAME: Ntfs.sys
STACK_COMMAND: .cxr 0xffffffffbacff2cc ; kb
----
Alles durcheinander gewürfelt, mal die eine dll, mal die andere.
Ich würde sämtliche Treiber checken, den Ram überprüfen (anderen mal verwenden, Timings entschärfen etc.)
<edit> die eine symevent.dll gehört zu nem Symantec (Norton) Produkt. Pfui, sowas gehört nicht auf die Platte!
und die interceptor Datei wohl zu einem AntiViren Kit. Eventuell hast du 2-3 Softwareprodukte installiert, die sich untereinander nicht vertragen. Deinstallier doch mal testweise immer eine davon.