Pozwól, że dam logi z pierwszego i ostatniego. pliku. Będzie je musiał ktoś taki jak Quake przeczytać lub sam kombinuj w necie
Microsoft ® Windows Debugger Version 6.11.0001.404 X86
Copyright © Microsoft Corporation. All rights reserved.
Loading Dump File [C:\Users\Masters\Desktop\090213-30326-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Executable search path is:
Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.18113.amd64fre.win7sp1_gdr.130318-1533
Machine Name:
Kernel base = 0xfffff800`02e4e000 PsLoadedModuleList = 0xfffff800`03091670
Debug session time: Mon Sep 2 07:07:48.595 2013 (GMT+2)
System Uptime: 0 days 0:02:00.000
Loading Kernel Symbols
...............................................................
................................................................
...................
Loading User Symbols
Loading unloaded module list
....
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 109, {a3a039d8953e653e, b3b7465ee7bb3494, fffff80002e76b80, 1}
*** WARNING: Unable to verify timestamp for win32k.sys
*** ERROR: Module load completed but symbols could not be loaded for win32k.sys
Probably caused by : memory_corruption
Followup: memory_corruption
---------
2: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
CRITICAL_STRUCTURE_CORRUPTION (109)
This bugcheck is generated when the kernel detects that critical kernel code or
data have been corrupted. There are generally three causes for a corruption:
1) A driver has inadvertently or deliberately modified critical kernel code
2) A developer attempted to set a normal kernel breakpoint using a kernel
debugger that was not attached when the system was booted. Normal breakpoints,
"bp", can only be set if the debugger is attached at boot time. Hardware
breakpoints, "ba", can be set at any time.
3) A hardware corruption occurred, e.g. failing RAM holding kernel code or data.
Arguments:
Arg1: a3a039d8953e653e, Reserved
Arg2: b3b7465ee7bb3494, Reserved
Arg3: fffff80002e76b80, Failure type dependent information
Arg4: 0000000000000001, Type of corrupted region, can be
0 : A generic data region
1 : Modification of a function or .pdata
2 : A processor IDT
3 : A processor GDT
4 : Type 1 process list corruption
5 : Type 2 process list corruption
6 : Debug routine modification
7 : Critical MSR modification
Debugging Details:
------------------
BUGCHECK_STR: 0x109
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: CODE_CORRUPTION
PROCESS_NAME: System
CURRENT_IRQL: 0
LAST_CONTROL_TRANSFER: from 0000000000000000 to fffff80002ec3c00
STACK_TEXT:
fffff880`031a1498 00000000`00000000 : 00000000`00000109 a3a039d8`953e653e b3b7465e`e7bb3494 fffff800`02e76b80 : nt!KeBugCheckEx
STACK_COMMAND: kb
CHKIMG_EXTENSION: !chkimg -lo 50 -db !nt
2 errors : !nt (fffff80002e76be2-fffff80002e76f32)
fffff80002e76be0 88 48 *3c 33 db 4c 3b fb 0f 84 af 01 00 00 4c 89 .H<3.L;.......L.
...
fffff80002e76f30 8b 44 *2c 34 4c 8d 5c 24 70 49 8b 5b 28 49 8b 73 .D,4L.\$pI.[(I.s
MODULE_NAME: memory_corruption
IMAGE_NAME: memory_corruption
FOLLOWUP_NAME: memory_corruption
DEBUG_FLR_IMAGE_TIMESTAMP: 0
MEMORY_CORRUPTOR: STRIDE
FAILURE_BUCKET_ID: X64_MEMORY_CORRUPTION_STRIDE
BUCKET_ID: X64_MEMORY_CORRUPTION_STRIDE
Followup: memory_corruption
---------
Ten kod błędu jest generowany, gdy wykryje, że krytyczny kernel kod jądra, lub
dane zostały uszkodzone. Istnieją trzy przyczyny dla korupcji:
1) Użytkownik przypadkowo lub celowo zmodyfikował kod jądra
2) deweloper próbował ustawić normalne przerwania jądra za pomocą jądra
debugger, który nie został dołączony, gdy system został uruchomiony. Normalne wartości graniczne,
"bp", można ustawić tylko jeśli debugger jest załączony w czasie startu systemu. sprzęt komputerowy
wartości graniczne, "ba", można ustawić w dowolnym momencie.
3) uszkodzenie sprzętu nastąpiło, np. w przypadku braku pamięci RAM jądra kod gospodarstwa lub danych.
argumenty:
Arg1: a3a039d8953e653e, Reserved
Arg2: b3b7465ee7bb3494, Reserved
Arg3: fffff80002e76b80, zależne od typu Brak informacji
Arg4: 0000000000000001, Rodzaj uszkodzenia regionu, mogą być
0: generic obszar danych
1: Zmiana funkcji lub pdata.
2: Procesor IDT
3: GDT procesor
4: Typ 1 korupcja lista proces
5: Typ 2 korupcja lista proces
6: Debug modyfikacji rutynowych
7: Krytyczna zmiana MSR
Myślę tłumacząc sobie plik, że nastąpiło uszkodzenie fizyczne ramu przez zmodyfikowanie jakiegoś pliku jądra. Ale raczej bym się tym nie sugerował ponieważ na tyle się nie znam.
Microsoft ® Windows Debugger Version 6.11.0001.404 X86
Copyright © Microsoft Corporation. All rights reserved.
Loading Dump File [C:\Users\Masters\Downloads\090913-21231-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Executable search path is:
Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.18205.amd64fre.win7sp1_gdr.130708-1532
Machine Name:
Kernel base = 0xfffff800`02e57000 PsLoadedModuleList = 0xfffff800`0309a6d0
Debug session time: Mon Sep 9 00:46:29.465 2013 (GMT+2)
System Uptime: 0 days 0:01:59.870
Loading Kernel Symbols
...............................................................
................................................................
................
Loading User Symbols
Loading unloaded module list
....
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck C4, {0, 0, 0, 0}
Probably caused by : tcpipreg.sys ( tcpipreg!InterfaceAddressRegKeyChangeHandler+109 )
Followup: MachineOwner
---------
1: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
DRIVER_VERIFIER_DETECTED_VIOLATION (c4)
A device driver attempting to corrupt the system has been caught. This is
because the driver was specified in the registry as being suspect (by the
administrator) and the kernel has enabled substantial checking of this driver.
If the driver attempts to corrupt the system, bugchecks 0xC4, 0xC1 and 0xA will
be among the most commonly seen crashes.
Arguments:
Arg1: 0000000000000000, caller is trying to allocate zero bytes
Arg2: 0000000000000000, current IRQL
Arg3: 0000000000000000, pool type
Arg4: 0000000000000000, number of bytes
Debugging Details:
------------------
BUGCHECK_STR: 0xc4_0
CURRENT_IRQL: 0
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
PROCESS_NAME: System
LAST_CONTROL_TRANSFER: from fffff8000335a4ec to fffff80002eccb80
STACK_TEXT:
fffff880`031b6488 fffff800`0335a4ec : 00000000`000000c4 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KeBugCheckEx
fffff880`031b6490 fffff800`0335af2b : fffffa80`0039d600 fffff800`02ef784c ffffffff`ffffffff fffff800`02fd4d1b : nt!VerifierBugCheckIfAppropriate+0x3c
fffff880`031b64d0 fffff800`0336bba8 : 00000000`6547654c 00000000`00000080 00000000`00000010 fffff800`0000003f : nt!ExAllocatePoolSanityChecks+0xcb
fffff880`031b6510 fffff800`0336be17 : 00000000`00000000 00000000`00000000 fffff980`6547654c fffff980`3aefefec : nt!VeAllocatePoolWithTagPriority+0x88
fffff880`031b6580 fffff880`085be5a1 : 00000000`00000000 00000000`00000000 fffff980`3aefefd0 fffff800`0336713c : nt!VerifierExAllocatePoolWithTagPriority+0x17
fffff880`031b65c0 fffff880`085bd7bb : fffff880`085c4c20 fffff980`3aefefd0 fffff980`39976f90 fffff980`3aefefd0 : tcpipreg!InterfaceAddressRegKeyChangeHandler+0x109
fffff880`031b66f0 fffff880`085bca59 : fffff880`00000001 00000000`00000103 fffff980`39976f70 00000000`00000001 : tcpipreg!TcpipRegQueryAndUpdateKeyValue+0x363
fffff880`031b6780 fffff880`015e2754 : fffff880`085c2a60 00000000`00000004 00000000`00000000 00000000`00010202 : tcpipreg!TcpipRegStartRegistryKeyNotification+0xbd
fffff880`031b67d0 fffff880`085bd293 : 00000000`00000000 00000000`00000000 00000000`00000000 fffff880`085c8073 : NETIO!RtlInvokeStartRoutines+0x34
fffff880`031b6810 fffff800`032b7787 : 00000000`00000006 fffffa80`07bf0b30 fffffa80`0724c000 00000000`00000001 : tcpipreg!DriverEntry+0x257
fffff880`031b6860 fffff800`032b7b85 : 00000000`00000010 00000000`00000000 00000000`00000010 00000000`00010202 : nt!IopLoadDriver+0xa07
fffff880`031b6b30 fffff800`02ed6261 : fffff800`00000000 ffffffff`80000734 fffff800`032b7b30 fffffa80`00000000 : nt!IopLoadUnloadDriver+0x55
fffff880`031b6b70 fffff800`0316abae : d8ceab55`b19ba25f fffffa80`036fc170 00000000`00000080 fffffa80`036779e0 : nt!ExpWorkerThread+0x111
fffff880`031b6c00 fffff800`02ebd8c6 : fffff880`02fd7180 fffffa80`036fc170 fffff880`02fe1fc0 716a244e`bae6bae6 : nt!PspSystemThreadStartup+0x5a
fffff880`031b6c40 00000000`00000000 : fffff880`031b7000 fffff880`031b1000 fffff880`031b4df0 00000000`00000000 : nt!KiStartSystemThread+0x16
STACK_COMMAND: kb
FOLLOWUP_IP:
tcpipreg!InterfaceAddressRegKeyChangeHandler+109
fffff880`085be5a1 4c8be0 mov r12,rax
SYMBOL_STACK_INDEX: 5
SYMBOL_NAME: tcpipreg!InterfaceAddressRegKeyChangeHandler+109
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: tcpipreg
IMAGE_NAME: tcpipreg.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 506c62be
FAILURE_BUCKET_ID: X64_0xc4_0_tcpipreg!InterfaceAddressRegKeyChangeHandler+109
BUCKET_ID: X64_0xc4_0_tcpipreg!InterfaceAddressRegKeyChangeHandler+109
Followup: MachineOwner
---------