Windows Bluescreen MEMORY.DMP datei Diagnose mit WinDbg!

Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [H:\MEMORY.DMP]
Kernel Complete Dump File: Full address space is available


WARNING: Dump file has been truncated. Data may be missing.

WARNING: Whitespace at end of path element
Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols

Executable search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Windows XP Kernel Version 2600 (Service Pack 3) MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 2600.xpsp_sp3_gdr.090206-1234
Machine Name:
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055d720
Debug session time: Mon Apr 27 19:25:41.671 2009 (GMT+2)
System Uptime: 0 days 1:13:31.397
Loading Kernel Symbols
Loading User Symbols

Loading unloaded module list
*

• *
• Bugcheck Analysis *
• *

*

Use !analyze -v to get detailed debugging information.

BugCheck C5, {4, 2, 1, 8054b1fa}

Probably caused by : Pool_Corruption ( nt!ExDeferredFreePool+1f4 )

Followup: Pool_corruption

1: kd> !analyze -v
*

• *
• Bugcheck Analysis *
• *

*

DRIVER_CORRUPTED_EXPOOL (c5)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is
caused by drivers that have corrupted the system pool. Run the driver
verifier against any new (or suspect) drivers, and if that doesn't turn up
the culprit, then use gflags to enable special pool.
Arguments:
Arg1: 00000004, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000001, value 0 = read operation, 1 = write operation
Arg4: 8054b1fa, address which referenced memory

Debugging Details:


BUGCHECK_STR: 0xC5_2

CURRENT_IRQL: 2

FAULTING_IP:
nt!ExDeferredFreePool+1f4
8054b1fa 894704 mov dword ptr [edi+4],eax

DEFAULT_BUCKET_ID: DRIVER_FAULT

PROCESS_NAME: System

TRAP_FRAME: bad17c28 -- (.trap 0xffffffffbad17c28)
ErrCode = 00000002
eax=89162008 ebx=00000066 ecx=000001ff edx=80565078 esi=80564d20 edi=00000000
eip=8054b1fa esp=bad17c9c ebp=bad17cdc iopl=0 nv up ei ng nz na po nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010282
nt!ExDeferredFreePool+0x1f4:
8054b1fa 894704 mov dword ptr [edi+4],eax ds:0023:00000004=????????
Resetting default scope

LAST_CONTROL_TRANSFER: from 8054b1fa to 805446f0

STACK_TEXT:
bad17c28 8054b1fa badb0d00 80565078 00000000 nt!KiTrap0E+0x238
bad17cdc 8054b75f 00000001 00000000 890f0d90 nt!ExDeferredFreePool+0x1f4
bad17d1c 805c106b 890f0d90 e5726854 8a3fead0 nt!ExFreePoolWithTag+0x47f
bad17d3c 805bb47a 00000000 890f0d90 890f0da8 nt!ObpFreeObject+0x18d
bad17d54 805266da 890f0da8 00000000 806e7a3c nt!ObpRemoveObjectRoutine+0xe8
bad17d6c 8052b3a2 8a3fbb30 805638f0 80564898 nt!ObfDereferenceObject+0x4c
bad17d7c 8053877d 00000000 00000000 8a3fbb30 nt!PspReaper+0x5c
bad17dac 805cff70 00000000 00000000 00000000 nt!ExpWorkerThread+0xef
bad17ddc 805460ee 8053868e 00000002 00000000 nt!PspSystemThreadStartup+0x34
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16


STACK_COMMAND: kb

FOLLOWUP_IP:
nt!ExDeferredFreePool+1f4
8054b1fa 894704 mov dword ptr [edi+4],eax

SYMBOL_STACK_INDEX: 1

SYMBOL_NAME: nt!ExDeferredFreePool+1f4

FOLLOWUP_NAME: Pool_corruption

IMAGE_NAME: Pool_Corruption

DEBUG_FLR_IMAGE_TIMESTAMP: 0

MODULE_NAME: Pool_Corruption

FAILURE_BUCKET_ID: 0xC5_2_nt!ExDeferredFreePool+1f4

BUCKET_ID: 0xC5_2_nt!ExDeferredFreePool+1f4

Followup: Pool_corruption


1: kd> analyze -v
* ERROR: Module load completed but symbols could not be loaded for Gt51Ip.sys
* ERROR: Module load completed but symbols could not be loaded for gt72ubus.sys
* ERROR: Module load completed but symbols could not be loaded for aswRdr.SYS
* ERROR: Module load completed but symbols could not be loaded for vstor2-ws60.sys
* ERROR: Module load completed but symbols could not be loaded for vstor2.sys
* ERROR: Module load completed but symbols could not be loaded for vmx86.sys
* ERROR: Module load completed but symbols could not be loaded for mdmxsdk.sys
* ERROR: Module load completed but symbols could not be loaded for aswMon2.SYS
* ERROR: Module load completed but symbols could not be loaded for s24trans.sys
* ERROR: Module load completed but symbols could not be loaded for aswSP.SYS
* ERROR: Module load completed but symbols could not be loaded for ISODrive.sys
* ERROR: Module load completed but symbols could not be loaded for cdudf_xp.SYS
* ERROR: Module load completed but symbols could not be loaded for RxFilter.sys
* ERROR: Module load completed but symbols could not be loaded for gtptser.sys
* ERROR: Symbol file could not be found. Defaulted to export symbols for Aavmker4.SYS -
* ERROR: Module load completed but symbols could not be loaded for aswTdi.SYS
* ERROR: Module load completed but symbols could not be loaded for ElbyCDIO.sys
* ERROR: Module load completed but symbols could not be loaded for vmnetuserif.sys
* ERROR: Module load completed but symbols could not be loaded for HSX_CNXT.sys
* ERROR: Module load completed but symbols could not be loaded for HSX_DPV.sys
* ERROR: Module load completed but symbols could not be loaded for HSXHWAZL.sys
* ERROR: Module load completed but symbols could not be loaded for CHDAud.sys
* ERROR: Symbol file could not be found. Defaulted to export symbols for pwd_2k.SYS -
* ERROR: Module load completed but symbols could not be loaded for tifm21.sys
* ERROR: Module load completed but symbols could not be loaded for yk51x86.sys
* ERROR: Module load completed but symbols could not be loaded for w39n51.sys
* ERROR: Module load completed but symbols could not be loaded for nv4_mini.sys
* ERROR: Module load completed but symbols could not be loaded for tosporte.sys
* ERROR: Module load completed but symbols could not be loaded for pcouffin.sys
* ERROR: Module load completed but symbols could not be loaded for hcmon.sys
* ERROR: Symbol file could not be found. Defaulted to export symbols for drmk.sys -
* ERROR: Module load completed but symbols could not be loaded for vmnetadapter.sys
* ERROR: Module load completed but symbols could not be loaded for VMkbd.sys
* ERROR: Symbol file could not be found. Defaulted to export symbols for VMNET.SYS -
* ERROR: Module load completed but symbols could not be loaded for snman378.sys
* ERROR: Module load completed but symbols could not be loaded for tdrpm124.sys
* ERROR: Module load completed but symbols could not be loaded for timntr.sys
* ERROR: Module load completed but symbols could not be loaded for drvmcdb.sys
* ERROR: Module load completed but symbols could not be loaded for PxHelp20.sys
* ERROR: Module load completed but symbols could not be loaded for tifsfilt.sys
* ERROR: Symbol file could not be found. Defaulted to export symbols for qkbfiltr.sys -
* ERROR: Module load completed but symbols could not be loaded for tosrfcom.sys
* ERROR: Module load completed but symbols could not be loaded for aswFsBlk.sys
* ERROR: Module load completed but symbols could not be loaded for AegisP.sys
* ERROR: Module load completed but symbols could not be loaded for ElbyCDFL.sys
* ERROR: Module load completed but symbols could not be loaded for vmnetbridge.sys
* ERROR: Module load completed but symbols could not be loaded for dvd_2K.SYS
* WARNING: Unable to verify timestamp for nv4_disp.dll
* ERROR: Module load completed but symbols could not be loaded for nv4_disp.dll
* WARNING: Unable to verify timestamp for ATMFD.DLL
*** ERROR: Module load completed but symbols could not be loaded for ATMFD.DLL
Couldn't resolve error at 'nalyze -v'
1: kd> lmvm Pool_Corruption