Speicherabbild nach BSOD analysieren - 0xC0000147

2554
Carlos Ferreira

Mein Computer (HP DV6 6060EP) wurde zweimal von HP zur Reparatur zurückgeschickt, hat jedoch dasselbe Problem. Ich versuche das Beste, was ich kann, um ihnen bei der Diagnose dieses Problems zu helfen.

Wenn mein Computer abstürzt (wie vor 5 Minuten), erhalte ich nach dem Öffnen des Speicherabbilds in WinDbg folgendes Ergebnis:

Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64 Copyright (c) Microsoft Corporation. All rights reserved.   Loading Dump File [C:\Users\hp\Desktop\MEMORY.DMP] Kernel Summary Dump File: Only kernel address space is available  Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols Executable search path is:  Missing image name, possible paged-out or corrupt data. *** WARNING: Unable to verify timestamp for Unknown_Module_00000000`00000000 Unable to add module at 00000000`00000000 WARNING: .reload failed, module list may be incomplete Debugger can not determine kernel base address Windows 7 Kernel Version 7600 MP (8 procs) Free x64 Product: WinNt, suite: TerminalServer SingleUserTS Personal Built by: 7600.16617.amd64fre.win7_gdr.100618-1621 Machine Name: Kernel base = 0xfffff800`02e4c000 PsLoadedModuleList = 0xfffff800`03089e50 Debug session time: Mon Jul 30 21:00:15.549 2012 (UTC + 1:00) System Uptime: 0 days 0:02:45.611 Missing image name, possible paged-out or corrupt data. *** WARNING: Unable to verify timestamp for Unknown_Module_00000000`00000000 Unable to add module at 00000000`00000000 WARNING: .reload failed, module list may be incomplete Debugger can not determine kernel base address Loading Kernel Symbols Missing image name, possible paged-out or corrupt data. .*** WARNING: Unable to verify timestamp for Unknown_Module_00000000`00000000 Unable to add module at 00000000`00000000 Unable to read KLDR_DATA_TABLE_ENTRY at 00000000`00000000 - NTSTATUS 0xC0000147  WARNING: .reload failed, module list may be incomplete ******************************************************************************* * * * Bugcheck Analysis * * * *******************************************************************************  Use !analyze -v to get detailed debugging information.  BugCheck 9C,   ***** Debugger could not find nt in module list, module list might be corrupt, error 0x80070057.  Probably caused by : Unknown_Image ( ANALYSIS_INCONCLUSIVE )  Followup: MachineOwner ---------  2: kd> !analyze -v ******************************************************************************* * * * Bugcheck Analysis * * * *******************************************************************************  MACHINE_CHECK_EXCEPTION (9c) A fatal Machine Check Exception has occurred. KeBugCheckEx parameters; x86 Processors If the processor has ONLY MCE feature available (For example Intel Pentium), the parameters are: 1 - Low 32 bits of P5_MC_TYPE MSR 2 - Address of MCA_EXCEPTION structure 3 - High 32 bits of P5_MC_ADDR MSR 4 - Low 32 bits of P5_MC_ADDR MSR If the processor also has MCA feature available (For example Intel Pentium Pro), the parameters are: 1 - Bank number 2 - Address of MCA_EXCEPTION structure 3 - High 32 bits of MCi_STATUS MSR for the MCA bank that had the error 4 - Low 32 bits of MCi_STATUS MSR for the MCA bank that had the error IA64 Processors 1 - Bugcheck Type 1 - MCA_ASSERT 2 - MCA_GET_STATEINFO SAL returned an error for SAL_GET_STATEINFO while processing MCA. 3 - MCA_CLEAR_STATEINFO SAL returned an error for SAL_CLEAR_STATEINFO while processing MCA. 4 - MCA_FATAL FW reported a fatal MCA. 5 - MCA_NONFATAL SAL reported a recoverable MCA and we don't support currently support recovery or SAL generated an MCA and then couldn't produce an error record. 0xB - INIT_ASSERT 0xC - INIT_GET_STATEINFO SAL returned an error for SAL_GET_STATEINFO while processing INIT event. 0xD - INIT_CLEAR_STATEINFO SAL returned an error for SAL_CLEAR_STATEINFO while processing INIT event. 0xE - INIT_FATAL Not used. 2 - Address of log 3 - Size of log 4 - Error code in the case of x_GET_STATEINFO or x_CLEAR_STATEINFO AMD64 Processors 1 - Bank number 2 - Address of MCA_EXCEPTION structure 3 - High 32 bits of MCi_STATUS MSR for the MCA bank that had the error 4 - Low 32 bits of MCi_STATUS MSR for the MCA bank that had the error Arguments: Arg1: 0000000000000000 Arg2: fffff8800316cc70 Arg3: 0000000000000000 Arg4: 0000000000000000  Debugging Details: ------------------  ***** Debugger could not find nt in module list, module list might be corrupt, error 0x80070057.   BUGCHECK_STR: 0x9C_GenuineIntel  DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT  CURRENT_IRQL: 0  LAST_CONTROL_TRANSFER: from fffff80002e156e0 to fffff80002ebc740  STACK_TEXT:  fffff880`0316cc38 fffff800`02e156e0 : 00000000`0000009c 00000000`00000000 fffff880`0316cc70 00000000`00000000 : 0xfffff800`02ebc740 fffff880`0316cc40 00000000`0000009c : 00000000`00000000 fffff880`0316cc70 00000000`00000000 00000000`00000000 : 0xfffff800`02e156e0 fffff880`0316cc48 00000000`00000000 : fffff880`0316cc70 00000000`00000000 00000000`00000000 00000000`00000000 : 0x9c   STACK_COMMAND: kb  SYMBOL_NAME: ANALYSIS_INCONCLUSIVE  FOLLOWUP_NAME: MachineOwner  MODULE_NAME: Unknown_Module  IMAGE_NAME: Unknown_Image  DEBUG_FLR_IMAGE_TIMESTAMP: 0  BUCKET_ID: CORRUPT_MODULELIST  Followup: MachineOwner --------- 

Hat jemand eine Vorstellung davon, was passiert? Sie haben bereits das Motherboard und die Festplatte gewechselt.

Vielen Dank!

2
Ich habe keines von ihnen verwendet, also würde ich zögern, es als Antwort zu posten, aber es gibt eine Fülle von Tools zur Analyse von Absturzdumps im Internet. Hast du eines davon probiert? EBGreen vor 11 Jahren 0

1 Antwort auf die Frage

1
Carlos Ferreira

Nun, der vollständige Kernel-Dump lieferte nicht genügend Details, daher änderte ich die Einstellungen in kleine Speicherdumps.

Nachdem ich den Dump mit WinDbg überprüft hatte, konnte ich sehen, dass intelpp.sys der Täter war, also war es klar, dass die Ursache des BSOD die CPU war.