Archief - BSOD probleempje

Gisteren een paar keer een BSOD gehad, momenteel runt ie weer goed, maar je weet maar nooit.

Stop code was 0x000000D1

vermelde file was steeds ecache.sys

Iemand een idee wat dit kan veroorzaken?

OS is vista ultimate x64 btw

doe eens een checkdisk. zou kunnen slaan op corrupte files.

The type of the file system is NTFS.

WARNING! F parameter not specified.
Running CHKDSK in read-only mode.

CHKDSK is verifying files (stage 1 of 3)...
192192 file records processed.
File verification completed.
665 large file records processed.
0 bad file records processed.
2 EA records processed.
60 reparse records processed.
CHKDSK is verifying indexes (stage 2 of 3)...
242650 index entries processed.
Index verification completed.
0 unindexed files processed.
CHKDSK is verifying security descriptors (stage 3 of 3)...
192192 security descriptors processed.
Security descriptor verification completed.
25230 data files processed.
CHKDSK is verifying Usn Journal...
37338816 USN bytes processed.
Usn Journal verification completed.
Windows has checked the file system and found no problems.

146512768 KB total disk space.
68833620 KB in 152791 files.
81288 KB in 25231 indexes.
0 KB in bad sectors.
301920 KB in use by the system.
65536 KB occupied by the log file.
77295940 KB available on disk.

4096 bytes in each allocation unit.
36628192 total allocation units on disk.
19323985 allocation units available on disk.

indien schijf dus ok, zou het ook een driver of een virus kunnen zijn. drivers updaten en eventuele virussen removen dus

Momenteel een scan aan het runnen met NOD32.
Alvast bedankt.

EDIT: hij blijft steeds crashen tijdens de scan. Zelfde code, hoogstwaarschijnlijk zelfde file (kan ik niet checken over remote dekstop)

aha das dus interessant. bedoel je met 'dezelfde file' die sys-file, of een andere?

Steeds die ecache.sys file.

debug eens je dumpfile.

Hoe die ik dit, en wat heb ik hiervoor nodig?

eerst het prog windbg x64 downen en installeren
tis deze:
http://msdl.microsoft.com/download/symbols/debuggers/dbg_amd64_6.11.1.402.msi

dan nog een symbols path invoegen
dit is:
SRV*c:\symbols*"http://msdl.microsoft.com/download/symbols"
zonder de double quotes

en dan gewoon de dmp file erin openen en de instructies volgen in het programma

Microsoft (R) Windows Debugger Version 6.11.0001.402 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Windows\Minidump\Mini021309-07.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*Symbol information
Executable search path is:
Windows Server 2008/Windows Vista Kernel Version 6001 (Service Pack 1) MP (2 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 6001.18145.amd64fre.vistasp1_gdr.080917-1612
Machine Name:
Kernel base = 0xfffff800`02263000 PsLoadedModuleList = 0xfffff800`02428db0
Debug session time: Fri Feb 13 20:57:30.883 2009 (GMT+1)
System Uptime: 0 days 0:24:08.523
Loading Kernel Symbols
...............................................................
................................................................
............................
Loading User Symbols
Loading unloaded module list
....
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck D1, {19, 2, 0, fffffa60011b2d64}

Unable to load image \SystemRoot\System32\Drivers\sptd.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for sptd.sys
*** ERROR: Module load completed but symbols could not be loaded for sptd.sys
Probably caused by : ecache.sys ( ecache!EcPerfTraceLogIo+ec )

Followup: MachineOwner
---------

heb je ook een process name / module name? volgens mij is dit niet de volledige debug. !analyze -v ook uitvoeren.

Tsja, Ik heb gwn die .dmp file in die debugger gedrag&dropped


Microsoft (R) Windows Debugger Version 6.11.0001.402 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Windows\Minidump\Mini021309-07.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*Symbol information
Executable search path is:
Windows Server 2008/Windows Vista Kernel Version 6001 (Service Pack 1) MP (2 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 6001.18145.amd64fre.vistasp1_gdr.080917-1612
Machine Name:
Kernel base = 0xfffff800`02263000 PsLoadedModuleList = 0xfffff800`02428db0
Debug session time: Fri Feb 13 20:57:30.883 2009 (GMT+1)
System Uptime: 0 days 0:24:08.523
Loading Kernel Symbols
...............................................................
................................................................
............................
Loading User Symbols
Loading unloaded module list
....
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck D1, {19, 2, 0, fffffa60011b2d64}

Unable to load image \SystemRoot\System32\Drivers\sptd.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for sptd.sys
*** ERROR: Module load completed but symbols could not be loaded for sptd.sys
Probably caused by : ecache.sys ( ecache!EcPerfTraceLogIo+ec )

Followup: MachineOwner
---------

1: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: 0000000000000019, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000000, value 0 = read operation, 1 = write operation
Arg4: fffffa60011b2d64, address which referenced memory

Debugging Details:
------------------


READ_ADDRESS: GetPointerFromAddress: unable to read from fffff8000248c080
0000000000000019

CURRENT_IRQL: 2

FAULTING_IP:
ecache!EcPerfTraceLogIo+ec
fffffa60`011b2d64 498b6b18 mov rbp,qword ptr [r11+18h]

CUSTOMER_CRASH_COUNT: 7

DEFAULT_BUCKET_ID: COMMON_SYSTEM_FAULT

BUGCHECK_STR: 0xD1

PROCESS_NAME: System

TRAP_FRAME: fffffa600191b5a0 -- (.trap 0xfffffa600191b5a0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=fffffa600191b7b8 rbx=0000000000000000 rcx=0000000000000002
rdx=000000198de8a000 rsi=0000000000000000 rdi=0000000000000000
rip=fffffa60011b2d64 rsp=fffffa600191b730 rbp=0000000000000002
r8=0000000000040000 r9=fffffa800bfe5af0 r10=000000198de91e00
r11=fffffa600191b7b0 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl zr na po nc
ecache!EcPerfTraceLogIo+0xec:
fffffa60`011b2d64 498b6b18 mov rbp,qword ptr [r11+18h] ds:b6f8:fffffa60`0191b7c8=0000000000000000
Resetting default scope

LAST_CONTROL_TRANSFER: from fffff800022b80ee to fffff800022b8350

STACK_TEXT:
fffffa60`0191b458 fffff800`022b80ee : 00000000`0000000a 00000000`00000019 00000000`00000002 00000000`00000000 : nt!KeBugCheckEx
fffffa60`0191b460 fffff800`022b6fcb : 00000000`00000000 fffffa60`0368f346 fffffa80`58416500 fffffa80`0a5def18 : nt!KiBugCheckDispatch+0x6e
fffffa60`0191b5a0 fffffa60`011b2d64 : 00000000`00000000 00000000`00000419 00000000`0000010b 00000000`00000001 : nt!KiPageFault+0x20b
fffffa60`0191b730 fffffa60`011a7801 : fffffa80`0a5def18 00000000`00000000 fffffa80`0bfe5af0 fffffa80`0bfe5e02 : ecache!EcPerfTraceLogIo+0xec
fffffa60`0191b7c0 fffff800`022ba6c5 : fffffa80`0a5de590 fffffa80`0a399501 fffffa80`0bfe5e4b fffffa80`0bfe5e03 : ecache!EcDispatchReadWriteCompletion+0x265
fffffa60`0191b880 fffffa60`00d91730 : fffffa80`0a5f9c60 00000000`00000001 fffffa80`0a399560 fffffa60`06b62f4f : nt!IopfCompleteRequest+0x315
fffffa60`0191b940 fffff800`022ba6c5 : 00000000`00000000 fffffa80`0a5f9c60 fffffa80`0ab8f1c0 00000000`00000000 : CLASSPNP!TransferPktComplete+0x1a0
fffffa60`0191b9c0 fffffa60`0365ad68 : fffffa80`08161050 fffffa80`08161000 fffffa80`081611a0 fffffa80`08161050 : nt!IopfCompleteRequest+0x315
fffffa60`0191ba80 fffffa60`0365b420 : fffffa80`54546b63 fffffa80`0a5f9c60 fffff800`32466d64 fffffa80`00000000 : USBPORT!USBPORT_Core_iCompleteDoneTransfer+0x898
fffffa60`0191bb60 fffffa60`03658872 : fffffa80`39585043 fffffa80`081611a0 fffffa80`08162088 fffffa80`081611a0 : USBPORT!USBPORT_Core_iIrpCsqCompleteDoneTransfer+0x514
fffffa60`0191bbd0 fffffa60`0364518b : fffffa80`31636f49 fffffa80`08162088 00000000`00000002 fffffa80`081611a0 : USBPORT!USBPORT_Core_UsbIocDpc_Worker+0x13a
fffffa60`0191bc20 fffffa60`00a4586c : fffffa80`08127000 00000000`34776478 00000000`00000000 fffffa80`08161d78 : USBPORT!USBPORT_Xdpc_Worker+0x26f
fffffa60`0191bc70 fffffa80`08127000 : 00000000`34776478 00000000`00000000 fffffa80`08161d78 00000000`00000f44 : sptd+0x4386c
fffffa60`0191bc78 00000000`34776478 : 00000000`00000000 fffffa80`08161d78 00000000`00000f44 fffffa60`0191bd40 : 0xfffffa80`08127000
fffffa60`0191bc80 00000000`00000000 : fffffa80`08161d78 00000000`00000f44 fffffa60`0191bd40 fffffa60`005efc01 : 0x34776478


STACK_COMMAND: kb

FOLLOWUP_IP:
ecache!EcPerfTraceLogIo+ec
fffffa60`011b2d64 498b6b18 mov rbp,qword ptr [r11+18h]

SYMBOL_STACK_INDEX: 3

SYMBOL_NAME: ecache!EcPerfTraceLogIo+ec

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: ecache

IMAGE_NAME: ecache.sys

DEBUG_FLR_IMAGE_TIMESTAMP: 4791990f

FAILURE_BUCKET_ID: X64_0xD1_ecache!EcPerfTraceLogIo+ec

BUCKET_ID: X64_0xD1_ecache!EcPerfTraceLogIo+ec

Followup: MachineOwner
---------

update eens al je drivers naar de nieuwste versies, dan kunnen we dat al tenminste uitsluiten mocht het nog voorvallen. en draai ondertussen ook eens combofix, dat kan geen kwaad mocht je geen virussen hebben, en kijk goed of hij al dan niet wat gevonden heeft.

Volgens de site van ASUS (heb een M2N-SLi deluxe bordje) zijn de laatste drivers van ergens 2007, en deze zijn al geinstalleerd (heb die toen meteen gehaald in plaats van de CD te gebruiken). Hbe combofix proberen te runnen, maar deze zegt dat ie alleen runt op win2k en XP. Heb wel een HJT gepaste HIER en heb MBAM ook al eens laten lopen, zonder resultaat.