Laptop i niebieskie ekrany, analiza minidumpów

Witam

posiadam laptopa Compaq Presario 2227us. Od połowy listopada pojawiło mi się 4 niebieskie ekrany.

  1. 15.11.2007

  2. 21.11.2007

  3. 25.11.2007

  4. 10.12.2007

wykonałem analizę minidumpów programem WinDbg

to ostatni zrzut:

*******************************************************************************

* *

* Bugcheck Analysis *

* *

*******************************************************************************


Use !analyze -v to get detailed debugging information.


BugCheck 1000007E, {c0000005, 8675a06f, f7cd6a94, f7cd6790}




Probably caused by : tcpip.sys ( tcpip!IPRcvPacket+6cb )


Followup: MachineOwner

---------


kd> !analyze -v

*******************************************************************************

* *

* Bugcheck Analysis *

* *

*******************************************************************************


SYSTEM_THREAD_EXCEPTION_NOT_HANDLED_M (1000007e)

This is a very common bugcheck. Usually the exception address pinpoints

the driver/function that caused the problem. Always note this address

as well as the link date of the driver/image that contains this address.

Some common problems are exception code 0x80000003. This means a hard

coded breakpoint or assertion was hit, but this system was booted

/NODEBUG. This is not supposed to happen as developers should never have

hardcoded breakpoints in retail code, but ...

If this happens, make sure a debugger gets connected, and the

system is booted /DEBUG. This will let us see why this breakpoint is

happening.

Arguments:

Arg1: c0000005, The exception code that was not handled

Arg2: 8675a06f, The address that the exception occurred at

Arg3: f7cd6a94, Exception Record Address

Arg4: f7cd6790, Context Record Address


Debugging Details:

------------------





EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx". The memory could not be "%s".


FAULTING_IP:

+ffffffff8675a06f

8675a06f 8908 mov dword ptr [eax],ecx


EXCEPTION_RECORD: f7cd6a94 -- (.exr 0xfffffffff7cd6a94)

ExceptionAddress: 8675a06f

ExceptionCode: c0000005 (Access violation)

ExceptionFlags: 00000000

NumberParameters: 2

Parameter[0]: 00000001

Parameter[1]: 00000080

Attempt to write to address 00000080


CONTEXT: f7cd6790 -- (.cxr 0xfffffffff7cd6790)

eax=00000080 ebx=86bc28b8 ecx=007f4a12 edx=00000100 esi=85ef9a00 edi=00000000

eip=8675a06f esp=f7cd6b5c ebp=862f2008 iopl=0 nv up ei pl zr na pe nc

cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00210246

8675a06f 8908 mov dword ptr [eax],ecx ds:0023:00000080=????????

Resetting default scope


CUSTOMER_CRASH_COUNT: 1


PROCESS_NAME: System


ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx". The memory could not be "%s".


WRITE_ADDRESS: 00000080


FAILED_INSTRUCTION_ADDRESS:

+ffffffff8675a06f

8675a06f 8908 mov dword ptr [eax],ecx


BUGCHECK_STR: 0x7E


DEFAULT_BUCKET_ID: NULL_CLASS_PTR_DEREFERENCE


LAST_CONTROL_TRANSFER: from eef76836 to 8675a06f


STACK_TEXT:

WARNING: Frame IP not in any known module. Following frames may be wrong.

f7cd6bf4 eef76836 eefb63f0 86a93d98 f7cd6c20 0x8675a06f

f7cd6cac 00000000 00000000 000608a2 00000000 tcpip!IPRcvPacket+0x6cb



FOLLOWUP_IP:

tcpip!IPRcvPacket+6cb

eef76836 8b5dcc mov ebx,dword ptr [ebp-34h]


SYMBOL_STACK_INDEX: 1


SYMBOL_NAME: tcpip!IPRcvPacket+6cb


FOLLOWUP_NAME: MachineOwner


MODULE_NAME: tcpip


IMAGE_NAME: tcpip.sys


DEBUG_FLR_IMAGE_TIMESTAMP: 444775d3


STACK_COMMAND: .cxr 0xfffffffff7cd6790 ; kb


FAILURE_BUCKET_ID: 0x7E_BAD_IP_tcpip!IPRcvPacket+6cb


BUCKET_ID: 0x7E_BAD_IP_tcpip!IPRcvPacket+6cb


Followup: MachineOwner

---------

wcześniejszy:

*******************************************************************************

* *

* Bugcheck Analysis *

* *

*******************************************************************************


Use !analyze -v to get detailed debugging information.


BugCheck 1000007E, {c0000005, f7339364, f78f6c28, f78f6924}




Probably caused by : Ntfs.sys ( Ntfs!NtfsRemoveClose+b7 )


Followup: MachineOwner

---------


kd> !analyze -v

*******************************************************************************

* *

* Bugcheck Analysis *

* *

*******************************************************************************


SYSTEM_THREAD_EXCEPTION_NOT_HANDLED_M (1000007e)

This is a very common bugcheck. Usually the exception address pinpoints

the driver/function that caused the problem. Always note this address

as well as the link date of the driver/image that contains this address.

Some common problems are exception code 0x80000003. This means a hard

coded breakpoint or assertion was hit, but this system was booted

/NODEBUG. This is not supposed to happen as developers should never have

hardcoded breakpoints in retail code, but ...

If this happens, make sure a debugger gets connected, and the

system is booted /DEBUG. This will let us see why this breakpoint is

happening.

Arguments:

Arg1: c0000005, The exception code that was not handled

Arg2: f7339364, The address that the exception occurred at

Arg3: f78f6c28, Exception Record Address

Arg4: f78f6924, Context Record Address


Debugging Details:

------------------





EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx". The memory could not be "%s".


FAULTING_IP:

Ntfs!NtfsRemoveClose+b7

f7339364 8b4048 mov eax,dword ptr [eax+48h]


EXCEPTION_RECORD: f78f6c28 -- (.exr 0xfffffffff78f6c28)

ExceptionAddress: f7339364 (Ntfs!NtfsRemoveClose+0x000000b7)

ExceptionCode: c0000005 (Access violation)

ExceptionFlags: 00000000

NumberParameters: 2

Parameter[0]: 00000000

Parameter[1]: 00000048

Attempt to read from address 00000048


CONTEXT: f78f6924 -- (.cxr 0xfffffffff78f6924)

eax=00000000 ebx=00000000 ecx=00000000 edx=865eb000 esi=85e08678 edi=f7356fc8

eip=f7339364 esp=f78f6cf0 ebp=f78f6cf8 iopl=0 nv up ei pl nz na pe nc

cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010206

Ntfs!NtfsRemoveClose+0xb7:

f7339364 8b4048 mov eax,dword ptr [eax+48h] ds:0023:00000048=????????

Resetting default scope


CUSTOMER_CRASH_COUNT: 1


PROCESS_NAME: System


ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx". The memory could not be "%s".


READ_ADDRESS: 00000048


BUGCHECK_STR: 0x7E


DEFAULT_BUCKET_ID: NULL_CLASS_PTR_DEREFERENCE


LAST_CONTROL_TRANSFER: from f736134a to f7339364


STACK_TEXT:

f78f6cf8 f736134a 00000000 86000500 f7356fe8 Ntfs!NtfsRemoveClose+0xb7

f78f6d74 804e426b 00000000 00000000 867c3da8 Ntfs!NtfsFspClose+0x3e

f78f6dac 8057d0f1 00000000 00000000 00000000 nt!ExpWorkerThread+0x100

f78f6ddc 804f827a 804e4196 00000000 00000000 nt!PspSystemThreadStartup+0x34

00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16



FOLLOWUP_IP:

Ntfs!NtfsRemoveClose+b7

f7339364 8b4048 mov eax,dword ptr [eax+48h]


SYMBOL_STACK_INDEX: 0


SYMBOL_NAME: Ntfs!NtfsRemoveClose+b7


FOLLOWUP_NAME: MachineOwner


MODULE_NAME: Ntfs


IMAGE_NAME: Ntfs.sys


DEBUG_FLR_IMAGE_TIMESTAMP: 45cc56a7


STACK_COMMAND: .cxr 0xfffffffff78f6924 ; kb


FAILURE_BUCKET_ID: 0x7E_Ntfs!NtfsRemoveClose+b7


BUCKET_ID: 0x7E_Ntfs!NtfsRemoveClose+b7


Followup: MachineOwner

---------

i jeszcze wcześniejszy:

*******************************************************************************

* *

* Bugcheck Analysis *

* *

*******************************************************************************


Use !analyze -v to get detailed debugging information.


BugCheck 1000008E, {c000008e, 4c0aeb, f78eadac, 0}




Probably caused by : camchal.sys ( camchal+131da )


Followup: MachineOwner

---------


kd> !analyze -v

*******************************************************************************

* *

* Bugcheck Analysis *

* *

*******************************************************************************


KERNEL_MODE_EXCEPTION_NOT_HANDLED_M (1000008e)

This is a very common bugcheck. Usually the exception address pinpoints

the driver/function that caused the problem. Always note this address

as well as the link date of the driver/image that contains this address.

Some common problems are exception code 0x80000003. This means a hard

coded breakpoint or assertion was hit, but this system was booted

/NODEBUG. This is not supposed to happen as developers should never have

hardcoded breakpoints in retail code, but ...

If this happens, make sure a debugger gets connected, and the

system is booted /DEBUG. This will let us see why this breakpoint is

happening.

Arguments:

Arg1: c000008e, The exception code that was not handled

Arg2: 004c0aeb, The address that the exception occurred at

Arg3: f78eadac, Trap Frame

Arg4: 00000000


Debugging Details:

------------------





EXCEPTION_CODE: (NTSTATUS) 0xc000008e - {EXCEPTION} Floating-point division by zero.


FAULTING_IP:

+4c0aeb

004c0aeb dc70d8 fdiv qword ptr [eax-28h]


TRAP_FRAME: f78eadac -- (.trap 0xfffffffff78eadac)

ErrCode = 00000000

eax=80010031 ebx=863a2d98 ecx=00000016 edx=00000002 esi=00000000 edi=86352000

eip=f6c821da esp=f78eae20 ebp=f78eaea8 iopl=0 nv up ei ng nz ac po nc

cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010292

camchal+0x131da:

f6c821da 9b wait

Resetting default scope


CUSTOMER_CRASH_COUNT: 1


DEFAULT_BUCKET_ID: DRIVER_FAULT


BUGCHECK_STR: 0x8E


PROCESS_NAME: fdgo.exe


LAST_CONTROL_TRANSFER: from 804da6ed to f6c821da


STACK_TEXT:

WARNING: Stack unwind information not available. Following frames may be wrong.

f78eaea8 804da6ed f78eaee4 00000002 00000400 camchal+0x131da

f78eaf94 f6c7ea04 00000400 00000001 86352000 nt!KeSynchronizeExecution+0x17

f78eafb0 f6c7f2c0 00000400 00000001 863522d4 camchal+0xfa04

f78eafd0 804dbbd4 863521bc 86352000 00000000 camchal+0x102c0

f78eaff4 804db89e ee198d54 00000000 00000000 nt!KiRetireDpcList+0x46

f78eaff8 ee198d54 00000000 00000000 00000000 nt!KiDispatchInterrupt+0x2a

804db89e 00000000 00000009 bb835675 00000128 0xee198d54



STACK_COMMAND: kb


FOLLOWUP_IP:

camchal+131da

f6c821da 9b wait


SYMBOL_STACK_INDEX: 0


SYMBOL_NAME: camchal+131da


FOLLOWUP_NAME: MachineOwner


MODULE_NAME: camchal


IMAGE_NAME: camchal.sys


DEBUG_FLR_IMAGE_TIMESTAMP: 40e095bc


FAILURE_BUCKET_ID: 0x8E_camchal+131da


BUCKET_ID: 0x8E_camchal+131da


Followup: MachineOwner

---------

sprawdzałem pamięć memtestem i po przejściu 4 kompletnych testów, nie wykazało żadnych problemów.

podejrzewam jakieś problemy sprzętowe. laptop ma już 2,5 roku, wcześniej nie miałem tych problemów, na razie tylko i wyłącznie te cztery niebieskie ekrany.

możliwa jest jeszcze jakaś dalsza diagnostyka programowa? jeśli tak to jakimi programami?

jeśli nie, to co innego można zrobić.