Bsod

[the_hofers]

Hi, das neue Dimotion Strongbook (Win7HPx64) meines Sohnes (Samstag gekauft) produziert regelmäßig Bluescreens. Ich hab das Huawei E173 in Verdacht. Könnte sich, bitte, ein (Aus-)Kenner die Dump-Files ansehen?

[enjoy2]

die Dump-Files zeigen, dass die Datei Wdf01000.sys die Probleme macht
Laut Google soll die Datei zum Touchpad oder Logitech Maus gehören

Treiberupdate dafür würde ich mal versuchen

[Inzersdorfer]

Der Wdf01000.sys gehört zur WDF Dynamic - Kernel Mode Driver Framework Runtime, eine Systemkomponente von Windows, daher ist der als eigentliche Ursache unwahrscheinlich.

Ohne .dmp läßt sich dazu nichts weiter sagen.
Übrigens darf im WCM Forum .zip bis 2 MB als Anhang hochladen.

[the_hofers]

Zitat von Inzersdorfer

Ohne .dmp läßt sich dazu nichts weiter sagen.

Drum ist ja der Link in meinem Post.

[enjoy2]

Zitat von the_hofers

Könnte sich, bitte, ein (Aus-)Kenner die Dump-Files ansehen?

http://www.file-upload.net/download-...3/dmp.zip.html
vielleicht so leichter ersichtlich

[enjoy2]

Crash List
Created by using BlueScreenView
Dump File            120511-21652-01.dmp   120511-22557-01.dmp
Crash Time           05.12.2011 14:43      05.12.2011 09:05
Bug Check String
Bug Check Code       0x0000010d            0x0000010d
Parameter 1          00000000`00000005     00000000`00000005
Parameter 2          00000000`00000000     00000000`00000000
Parameter 3          00000000`00001401     00000000`00001401
Parameter 4          fffffa80`07dfd840     fffffa80`08feb960
Caused By Driver     Wdf01000.sys          Wdf01000.sys
Caused By Address    Wdf01000.sys+3808     Wdf01000.sys+3808

das sagt BlueScreenView dazu

[Inzersdorfer]

Den Link sah ich wohl, prinzipiell verweigere ich mich Werbespammer a'la file-upload.
Jemand möchte Hilfe und erwartet das dieser sich von Pop-ups, Pop-unders u.dergl. dafür zuspülen läßt ?

@enjoy2: Bluescreenview ist zur Analyse ungeeignet, verwende einen Debugger, z.Bsp. WinDbg. Der "Schuldige" ist ein Treiber, der auf das WDF Framework aufsetzt.
bug check 0x0000010D WDF_VIOLATION Parameter 1: 0x5
A framework object handle of the incorrect type was passed to a framework object method.

[enjoy2]

hmm, komisch, ich sah keine Popups, oder dergleichen, als ich die Datei heruntergeladen habe, liegt vielleicht an noscript

xhcdrv.sys dieser könnte es noch sein, Infos dazu http://systemexplorer.net/db/xhcdrv.sys.html

was mir noch einfällt, versucht mal das Modem NICHT an einem USB 3.0 Anschluss an zu schließen, sondern an einem USB 2.0, gibt es dann auch Bluescreens?

[enjoy2]

Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [B:\120511-22557-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: *** Invalid ***
****************************************************************************
* Symbol loading may be unreliable without a symbol search path.           *
* Use .symfix to have the debugger choose a symbol path.                   *
* After setting your symbol path, use .reload to refresh symbol locations. *
****************************************************************************
Executable search path is: 
*********************************************************************
* Symbols can not be loaded because symbol path is not initialized. *
*                                                                   *
* The Symbol Path can be set by:                                    *
*   using the _NT_SYMBOL_PATH environment variable.                 *
*   using the -y <symbol_path> argument when starting the debugger. *
*   using .sympath and .sympath+                                    *
*********************************************************************
Unable to load image \SystemRoot\system32\ntoskrnl.exe, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
*** ERROR: Module load completed but symbols could not be loaded for ntoskrnl.exe
Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0xfffff800`02e60000 PsLoadedModuleList = 0xfffff800`030a5670
Debug session time: Mon Dec  5 09:04:25.795 2011 (UTC + 1:00)
System Uptime: 0 days 0:14:35.059
*********************************************************************
* Symbols can not be loaded because symbol path is not initialized. *
*                                                                   *
* The Symbol Path can be set by:                                    *
*   using the _NT_SYMBOL_PATH environment variable.                 *
*   using the -y <symbol_path> argument when starting the debugger. *
*   using .sympath and .sympath+                                    *
*********************************************************************
Unable to load image \SystemRoot\system32\ntoskrnl.exe, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
*** ERROR: Module load completed but symbols could not be loaded for ntoskrnl.exe
Loading Kernel Symbols
...............................................................
................................................................
.............................................
Loading User Symbols
Loading unloaded module list
.......
Unable to load image \SystemRoot\system32\drivers\Wdf01000.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for Wdf01000.sys
*** ERROR: Module load completed but symbols could not be loaded for Wdf01000.sys
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 10D, {5, 0, 1401, fffffa8008feb960}

*** WARNING: Unable to verify timestamp for mssmbios.sys
*** ERROR: Module load completed but symbols could not be loaded for mssmbios.sys
***** Kernel symbols are WRONG. Please fix symbols to do analysis.

*************************************************************************
***                                                                   ***
***                                                                   ***
***    Your debugger is not using the correct symbols                 ***
***                                                                   ***
***    In order for this command to work properly, your symbol path   ***
***    must point to .pdb files that have full type information.      ***
***                                                                   ***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                          ***
***                                                                   ***
***    Type referenced: nt!_KPRCB                                     ***
***                                                                   ***
*************************************************************************
*************************************************************************
***                                                                   ***
***                                                                   ***
***    Your debugger is not using the correct symbols                 ***
***                                                                   ***
***    In order for this command to work properly, your symbol path   ***
***    must point to .pdb files that have full type information.      ***
***                                                                   ***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                          ***
***                                                                   ***
***    Type referenced: nt!_KPRCB                                     ***
***                                                                   ***
*************************************************************************
*************************************************************************
***                                                                   ***
***                                                                   ***
***    Your debugger is not using the correct symbols                 ***
***                                                                   ***
***    In order for this command to work properly, your symbol path   ***
***    must point to .pdb files that have full type information.      ***
***                                                                   ***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                          ***
***                                                                   ***
***    Type referenced: nt!_KPRCB                                     ***
***                                                                   ***
*************************************************************************
Probably caused by : Wdf01000.sys ( Wdf01000+3808 )

Followup: MachineOwner
---------

imho müsste es Hofer auf dem Rechner selbst durchlaufen lassen, damit die korrekten Symbole verwendet werden

[enjoy2]

3: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

WDF_VIOLATION (10d)
The Kernel-Mode Driver Framework was notified that Windows detected an error
in a framework-based driver. In general, the dump file will yield additional
information about the driver that caused this bug check.
Arguments:
Arg1: 0000000000000005, A framework object handle of the incorrect type was passed to
	a framework object method.
Arg2: 0000000000000000, The handle value passed in.
Arg3: 0000000000001401, Reserved.
Arg4: fffffa8008feb960, Reserved.

Debugging Details:
------------------

***** Kernel symbols are WRONG. Please fix symbols to do analysis.

*************************************************************************
***                                                                   ***
***                                                                   ***
***    Your debugger is not using the correct symbols                 ***
***                                                                   ***
***    In order for this command to work properly, your symbol path   ***
***    must point to .pdb files that have full type information.      ***
***                                                                   ***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                          ***
***                                                                   ***
***    Type referenced: nt!_KPRCB                                     ***
***                                                                   ***
*************************************************************************
*************************************************************************
***                                                                   ***
***                                                                   ***
***    Your debugger is not using the correct symbols                 ***
***                                                                   ***
***    In order for this command to work properly, your symbol path   ***
***    must point to .pdb files that have full type information.      ***
***                                                                   ***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                          ***
***                                                                   ***
***    Type referenced: nt!_KPRCB                                     ***
***                                                                   ***
*************************************************************************
*************************************************************************
***                                                                   ***
***                                                                   ***
***    Your debugger is not using the correct symbols                 ***
***                                                                   ***
***    In order for this command to work properly, your symbol path   ***
***    must point to .pdb files that have full type information.      ***
***                                                                   ***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                          ***
***                                                                   ***
***    Type referenced: nt!_KPRCB                                     ***
***                                                                   ***
*************************************************************************

ADDITIONAL_DEBUG_TEXT:  
Use '!findthebuild' command to search for the target build information.
If the build information is available, run '!findthebuild -s ; .reload' to set symbol path and load symbols.

FAULTING_MODULE: fffff80002e60000 nt

DEBUG_FLR_IMAGE_TIMESTAMP:  4a5bc19f

BUGCHECK_STR:  0x10D_5

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

CURRENT_IRQL:  0

LAST_CONTROL_TRANSFER:  from fffff88000f0c808 to fffff80002edcc40

STACK_TEXT:  
fffff880`073c8cc8 fffff880`00f0c808 : 00000000`0000010d 00000000`00000005 00000000`00000000 00000000`00001401 : nt+0x7cc40
fffff880`073c8cd0 00000000`0000010d : 00000000`00000005 00000000`00000000 00000000`00001401 fffffa80`08feb960 : Wdf01000+0x3808
fffff880`073c8cd8 00000000`00000005 : 00000000`00000000 00000000`00001401 fffffa80`08feb960 fffffa80`0a129e70 : 0x10d
fffff880`073c8ce0 00000000`00000000 : 00000000`00001401 fffffa80`08feb960 fffffa80`0a129e70 0000057f`f502e788 : 0x5


STACK_COMMAND:  kb

FOLLOWUP_IP: 
Wdf01000+3808
fffff880`00f0c808 ??              ???

SYMBOL_STACK_INDEX:  1

SYMBOL_NAME:  Wdf01000+3808

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: Wdf01000

IMAGE_NAME:  Wdf01000.sys

BUCKET_ID:  WRONG_SYMBOLS

Followup: MachineOwner
---------

3: kd> lmvm Wdf01000
start             end                 module name
fffff880`00f09000 fffff880`00fad000   Wdf01000 T (no symbols)           
    Loaded symbol image file: Wdf01000.sys
    Image path: \SystemRoot\system32\drivers\Wdf01000.sys
    Image name: Wdf01000.sys
    Timestamp:        Tue Jul 14 01:22:07 2009 (4A5BC19F)
    CheckSum:         000A2E74
    ImageSize:        000A4000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4
3: kd> lmvm nt
start             end                 module name
fffff800`02e60000 fffff800`03449000   nt       T (no symbols)           
    Loaded symbol image file: ntoskrnl.exe
    Image path: \SystemRoot\system32\ntoskrnl.exe
    Image name: ntoskrnl.exe
    Timestamp:        Thu Jun 23 04:53:23 2011 (4E02AAA3)
    CheckSum:         0055C228
    ImageSize:        005E9000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4

zweiter Teil