Minidump vs Memtest

[EsAmo]

Pewien komputer co kilka dni wyrzuca blue screena, zazwyczaj wystarczy restart bez żadnych napraw instalką OS itd.

Skan memtestem (2 pass, 0 błędów):



Minidump z 21 października:

Kod: Zaznacz cały

Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Documents and Settings\Administrator\Desktop\Mini102111-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows XP Kernel Version 2600 (Service Pack 3) UP Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 2600.xpsp_sp3_gdr.101209-1647
Machine Name:
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055b240
Debug session time: Fri Oct 21 09:26:12.350 2011 (GMT+2)
System Uptime: 0 days 0:00:27.930
Loading Kernel Symbols
...............................................................
.....................................
Loading User Symbols
Loading unloaded module list
....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 24, {1902fe, f7d22580, f7d2227c, f76d8f04}

Probably caused by : memory_corruption

Followup: memory_corruption
---------

kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

NTFS_FILE_SYSTEM (24)
    If you see NtfsExceptionFilter on the stack then the 2nd and 3rd
    parameters are the exception record and context record. Do a .cxr
    on the 3rd parameter and then kb to obtain a more informative stack
    trace.
Arguments:
Arg1: 001902fe
Arg2: f7d22580
Arg3: f7d2227c
Arg4: f76d8f04

Debugging Details:
------------------


EXCEPTION_RECORD:  f7d22580 -- (.exr 0xfffffffff7d22580)
ExceptionAddress: f76d8f04 (Ntfs!NtfsSetRenameInfo+0x00000b1f)
   ExceptionCode: c000001d (Illegal instruction)
  ExceptionFlags: 00000000
NumberParameters: 0

CONTEXT:  f7d2227c -- (.cxr 0xfffffffff7d2227c)
eax=f7d22684 ebx=00000000 ecx=f76d9469 edx=861a8190 esi=861a5d58 edi=e1e5a008
eip=f76d8f04 esp=f7d22648 ebp=f7d22821 iopl=0         nv up ei pl zr na pe nc
cs=0008  ss=0010  ds=0023  es=0023  fs=0030  gs=0000             efl=00010246
Ntfs!NtfsSetRenameInfo+0xb1f:
f76d8f04 ff              ???
Resetting default scope

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  CODE_CORRUPTION

BUGCHECK_STR:  0x24

PROCESS_NAME:  winlogon.exe

ERROR_CODE: (NTSTATUS) 0xc000001d - {EXCEPTION}  Illegal Instruction  An attempt was made to execute an illegal instruction.

EXCEPTION_CODE: (NTSTATUS) 0xc000001d - {EXCEPTION}  Illegal Instruction  An attempt was made to execute an illegal instruction.

LAST_CONTROL_TRANSFER:  from 58f76d86 to f76d8f04

STACK_TEXT: 
f7d22821 58f76d86 70861a5d b88615ae 508618d4 Ntfs!NtfsSetRenameInfo+0xb1f
WARNING: Frame IP not in any known module. Following frames may be wrong.
f7d22841 b0000000 b8f7d228 408618d4 0ae1000d 0x58f76d86
f7d22845 b8f7d228 408618d4 0ae1000d 02000000 0xb0000000
f7d22849 408618d4 0ae1000d 02000000 d0000000 0xb8f7d228
f7d2284d 0ae1000d 02000000 d0000000 70e1e5a0 0x408618d4
f7d22851 02000000 d0000000 70e1e5a0 288615ae 0xae1000d
f7d22855 d0000000 70e1e5a0 288615ae 08e1e5a2 0x2000000
f7d22859 70e1e5a0 288615ae 08e1e5a2 01e1e5a0 0xd0000000
f7d2285d 288615ae 08e1e5a2 01e1e5a0 50f7d228 0x70e1e5a0
f7d22861 08e1e5a2 01e1e5a0 50f7d228 00863738 0x288615ae
f7d22865 01e1e5a0 50f7d228 00863738 44000000 0x8e1e5a2
f7d22869 50f7d228 00863738 44000000 44000000 0x1e1e5a0
f7d2286d 00863738 44000000 44000000 ccf7d228 0x50f7d228
f7d22871 44000000 44000000 ccf7d228 ecf7d220 0x863738
f7d22875 44000000 ccf7d228 ecf7d220 5bf7d228 0x44000000
f7d22879 ccf7d228 ecf7d220 5bf7d228 10f76a07 0x44000000
f7d2287d ecf7d220 5bf7d228 10f76a07 00f76b3c 0xccf7d228
f7d22881 5bf7d228 10f76a07 00f76b3c fc000000 0xecf7d220
f7d22885 10f76a07 00f76b3c fc000000 3bf7d228 0x5bf7d228
f7d22889 00f76b3c fc000000 3bf7d228 58f769eb 0x10f76a07
f7d2288d fc000000 3bf7d228 58f769eb b8861a5d 0xf76b3c
f7d22891 3bf7d228 58f769eb b8861a5d 708618d4 0xfc000000
f7d22895 58f769eb b8861a5d 708618d4 088615ae 0x3bf7d228
f7d22899 b8861a5d 708618d4 088615ae b8863916 0x58f769eb
f7d2289d 708618d4 088615ae b8863916 018618d4 0xb8861a5d
f7d228a1 088615ae b8863916 018618d4 4ee60000 0x708618d4
f7d228a5 b8863916 018618d4 4ee60000 00534654 0x88615ae
f7d228a9 018618d4 4ee60000 00534654 00000000 0xb8863916
f7d228ad 4ee60000 00534654 00000000 00000000 0x18618d4
f7d228b1 00534654 00000000 00000000 00000000 0x4ee60000
f7d228b5 00000000 00000000 00000000 58000000 0x534654


CHKIMG_EXTENSION: !chkimg -lo 50 -d !Ntfs
    f76d8ef8 - Ntfs!NtfsSetRenameInfo+b13
   [ 50:10 ]
1 error : !Ntfs (f76d8ef8)

MODULE_NAME: memory_corruption

IMAGE_NAME:  memory_corruption

FOLLOWUP_NAME:  memory_corruption

DEBUG_FLR_IMAGE_TIMESTAMP:  0

MEMORY_CORRUPTOR:  ONE_BIT

STACK_COMMAND:  .cxr 0xfffffffff7d2227c ; kb

FAILURE_BUCKET_ID:  MEMORY_CORRUPTION_ONE_BIT

BUCKET_ID:  MEMORY_CORRUPTION_ONE_BIT

Followup: memory_corruption
---------

Minidump z 22 października:

Kod: Zaznacz cały

Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Documents and Settings\Administrator\Desktop\Mini102211-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows XP Kernel Version 2600 (Service Pack 3) UP Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 2600.xpsp_sp3_gdr.101209-1647
Machine Name:
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055b240
Debug session time: Sat Oct 22 10:57:52.101 2011 (GMT+2)
System Uptime: 0 days 0:00:35.691
Loading Kernel Symbols
...............................................................
.................................................
Loading User Symbols
Loading unloaded module list
....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1000000A, {7ffd4004, ff, 0, 804f4916}

Probably caused by : ntoskrnl.exe ( nt!ExpFindCurrentThread+68 )

Followup: MachineOwner
---------

kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 7ffd4004, memory referenced
Arg2: 000000ff, IRQL
Arg3: 00000000, bitfield :
   bit 0 : value 0 = read operation, 1 = write operation
   bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: 804f4916, address which referenced memory

Debugging Details:
------------------


READ_ADDRESS:  7ffd4004

CURRENT_IRQL:  ff

FAULTING_IP:
nt!ExpFindCurrentThread+68
804f4916 8b4104          mov     eax,dword ptr [ecx+4]

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  DRIVER_FAULT

BUGCHECK_STR:  0xA

PROCESS_NAME:  GoogleUpdate.ex

LAST_CONTROL_TRANSFER:  from 804f0c44 to 804f4916

STACK_TEXT: 
f3bc9a84 804f0c44 f3bc9aab 863eb238 f3bc9c64 nt!ExpFindCurrentThread+0x68
f3bc9a9c 80564abf 86282720 00000001 f3bc9c48 nt!ExAcquireResourceSharedLite+0x30
f3bc9ab0 80565d16 f3bc9c64 863eb238 e15206b0 nt!SeLockSubjectContext+0x22
f3bc9ad8 80564edd e15206c8 f3bc9c48 00000001 nt!ObCheckObjectAccess+0x54
f3bc9ba4 80564fc4 00000001 862e0be8 e15206c8 nt!ObpIncrementHandleCount+0x305
f3bc9c0c 80570c11 00000001 e15206c8 863eb238 nt!ObpCreateHandle+0x17d
f3bc9cdc 8057127e e15206c8 00000000 00000000 nt!ObOpenObjectByPointer+0xa4
f3bc9d38 8057101e ffffffff 00000008 00000000 nt!NtOpenProcessTokenEx+0x94
f3bc9d50 804de7ec ffffffff 00000008 0012f2a8 nt!NtOpenProcessToken+0x15
f3bc9d50 7c90e514 ffffffff 00000008 0012f2a8 nt!KiFastCallEntry+0xf8
WARNING: Frame IP not in any known module. Following frames may be wrong.
0012f294 00000000 00000000 00000000 00000000 0x7c90e514


STACK_COMMAND:  kb

FOLLOWUP_IP:
nt!ExpFindCurrentThread+68
804f4916 8b4104          mov     eax,dword ptr [ecx+4]

SYMBOL_STACK_INDEX:  0

SYMBOL_NAME:  nt!ExpFindCurrentThread+68

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntoskrnl.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  4d00dbda

FAILURE_BUCKET_ID:  0xA_nt!ExpFindCurrentThread+68

BUCKET_ID:  0xA_nt!ExpFindCurrentThread+68

Followup: MachineOwner
---------

Minidump z 23 października:

Kod: Zaznacz cały

Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Documents and Settings\Administrator\Desktop\Mini102311-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows XP Kernel Version 2600 (Service Pack 3) UP Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 2600.xpsp_sp3_gdr.101209-1647
Machine Name:
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055b240
Debug session time: Sun Oct 23 10:01:38.809 2011 (GMT+2)
System Uptime: 0 days 0:00:27.399
Loading Kernel Symbols
...............................................................
.....................................
Loading User Symbols
Loading unloaded module list
....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 24, {1902fe, f5bae580, f5bae27c, f76d8f04}

Probably caused by : memory_corruption

Followup: memory_corruption
---------

kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

NTFS_FILE_SYSTEM (24)
    If you see NtfsExceptionFilter on the stack then the 2nd and 3rd
    parameters are the exception record and context record. Do a .cxr
    on the 3rd parameter and then kb to obtain a more informative stack
    trace.
Arguments:
Arg1: 001902fe
Arg2: f5bae580
Arg3: f5bae27c
Arg4: f76d8f04

Debugging Details:
------------------


EXCEPTION_RECORD:  f5bae580 -- (.exr 0xfffffffff5bae580)
ExceptionAddress: f76d8f04 (Ntfs!NtfsSetRenameInfo+0x00000b1f)
   ExceptionCode: c000001d (Illegal instruction)
  ExceptionFlags: 00000000
NumberParameters: 0

CONTEXT:  f5bae27c -- (.cxr 0xfffffffff5bae27c)
eax=f5bae684 ebx=00000000 ecx=f76d9469 edx=861a6d28 esi=8617d810 edi=e1ee7008
eip=f76d8f04 esp=f5bae648 ebp=f5bae821 iopl=0         nv up ei pl zr na pe nc
cs=0008  ss=0010  ds=0023  es=0023  fs=0030  gs=0000             efl=00010246
Ntfs!NtfsSetRenameInfo+0xb1f:
f76d8f04 ff              ???
Resetting default scope

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  CODE_CORRUPTION

BUGCHECK_STR:  0x24

PROCESS_NAME:  winlogon.exe

ERROR_CODE: (NTSTATUS) 0xc000001d - {EXCEPTION}  Illegal Instruction  An attempt was made to execute an illegal instruction.

EXCEPTION_CODE: (NTSTATUS) 0xc000001d - {EXCEPTION}  Illegal Instruction  An attempt was made to execute an illegal instruction.

LAST_CONTROL_TRANSFER:  from 10f76d86 to f76d8f04

STACK_TEXT: 
f5bae821 10f76d86 b88617d8 08861ee5 508616a0 Ntfs!NtfsSetRenameInfo+0xb1f
WARNING: Frame IP not in any known module. Following frames may be wrong.
f5bae841 b0000000 08f5bae8 408616a0 0ae1000d 0x10f76d86
f5bae845 08f5bae8 408616a0 0ae1000d 02000000 0xb0000000
f5bae849 408616a0 0ae1000d 02000000 d0000000 0x8f5bae8
f5bae84d 0ae1000d 02000000 d0000000 b8e1ee70 0x408616a0
f5bae851 02000000 d0000000 b8e1ee70 28861ee5 0xae1000d
f5bae855 d0000000 b8e1ee70 28861ee5 08e1ee72 0x2000000
f5bae859 b8e1ee70 28861ee5 08e1ee72 01e1ee70 0xd0000000
f5bae85d 28861ee5 08e1ee72 01e1ee70 50f5bae8 0xb8e1ee70
f5bae861 08e1ee72 01e1ee70 50f5bae8 00863738 0x28861ee5
f5bae865 01e1ee70 50f5bae8 00863738 44000000 0x8e1ee72
f5bae869 50f5bae8 00863738 44000000 44000000 0x1e1ee70
f5bae86d 00863738 44000000 44000000 ccf5bae8 0x50f5bae8
f5bae871 44000000 44000000 ccf5bae8 ecf5bae0 0x863738
f5bae875 44000000 ccf5bae8 ecf5bae0 5bf5bae8 0x44000000
f5bae879 ccf5bae8 ecf5bae0 5bf5bae8 10f76a07 0x44000000
f5bae87d ecf5bae0 5bf5bae8 10f76a07 00f76b3c 0xccf5bae8
f5bae881 5bf5bae8 10f76a07 00f76b3c fc000000 0xecf5bae0
f5bae885 10f76a07 00f76b3c fc000000 3bf5bae8 0x5bf5bae8
f5bae889 00f76b3c fc000000 3bf5bae8 10f769eb 0x10f76a07
f5bae88d fc000000 3bf5bae8 10f769eb 088617d8 0xf76b3c
f5bae891 3bf5bae8 10f769eb 088617d8 b88616a0 0xfc000000
f5bae895 10f769eb 088617d8 b88616a0 08861ee5 0x3bf5bae8
f5bae899 088617d8 b88616a0 08861ee5 08863916 0x10f769eb
f5bae89d b88616a0 08861ee5 08863916 018616a0 0x88617d8
f5bae8a1 08861ee5 08863916 018616a0 4e950000 0xb88616a0
f5bae8a5 08863916 018616a0 4e950000 00534654 0x8861ee5
f5bae8a9 018616a0 4e950000 00534654 00000000 0x8863916
f5bae8ad 4e950000 00534654 00000000 00000000 0x18616a0
f5bae8b1 00534654 00000000 00000000 00000000 0x4e950000
f5bae8b5 00000000 00000000 00000000 10000000 0x534654


CHKIMG_EXTENSION: !chkimg -lo 50 -d !Ntfs
    f76d8ef8 - Ntfs!NtfsSetRenameInfo+b13
   [ 50:10 ]
1 error : !Ntfs (f76d8ef8)

MODULE_NAME: memory_corruption

IMAGE_NAME:  memory_corruption

FOLLOWUP_NAME:  memory_corruption

DEBUG_FLR_IMAGE_TIMESTAMP:  0

MEMORY_CORRUPTOR:  ONE_BIT

STACK_COMMAND:  .cxr 0xfffffffff5bae27c ; kb

FAILURE_BUCKET_ID:  MEMORY_CORRUPTION_ONE_BIT

BUCKET_ID:  MEMORY_CORRUPTION_ONE_BIT

Followup: memory_corruption
---------

Mam rozumieć, że Memtest nie wykrywa błędu pamięci, który faktycznie jest ?

[konto_usuniete]

Kod: Zaznacz cały

MODULE_NAME: memory_corruption
IMAGE_NAME:  ntoskrnl.exe
PROCESS_NAME:  GoogleUpdate.ex
PROCESS_NAME:  winlogon.exe

Przy pierwszym to pamięć, ale po tym screenie nie ma błędów, jeśli masz dwie kostki pamięci to przeskanuj osobno.
GoogleUpdate.ex może to być coś z produktów Google, a nawet na pewno. Hmm, znalazłem rozwiązane [odinstalowanie] tego problemu tutaj, ale nie wiem czy działa:

Kod: Zaznacz cały

Aby odinstalować GoogleUpdate.exe: (jak ja; modyfikowany powyżej instrution)
Zatrzymaj GoogleUpdate.exe w Menedżerze zadań Windows
Uruchom msconfig i wyłączyć GoogleUpdate.exe pod Autostart (bez konieczności ponownego uruchamiania)
Usuń GoogleUpdate zadanie w C: \ WINDOWS \ Tasks
Usuń "Update" folder w katalogu C: \ Documents and Settings \ Twoja nazwa \ Ustawienia lokalne \ Dane aplikacji \ Google
Clean up któregokolwiek z "GoogleUpdate" w pliku rejestru przez regedit (Uwaga!). Jeśli nie jesteś pewien w ten sposób, to po prostu użyć CCleaner do czyszczenia rejestru.

Po drugie, także na innych forach mówią, że może być to wirus.
Proces winlogon działa w tle, jest częścią podsystemu logowania Windows i jest niezbędne do autoryzacji użytkownika, sprawdza aktywacje systemu Windows. Plik ten powinien znajdować się tutaj: C: \ Windows \ System32 - sprawdź ?

Na wszelki wypadek przeskanuj system Malwarebytes Anti-Malware.

[EsAmo]

Dzięki za odpowiedź!
Pamiętam, że cały system już skanowałem Malwarebytes' .
Kość jest tylko jedna 1GB, tak więc była skanowana osobno .

Tak więc pozostaje tylko GoogleUpdate, jutro przegonię to ustrojstwo.

[konto_usuniete]

Pamiętam, że cały system już skanowałem Malwarebytes' .

Kiedy, jak dawno to przeskanuj jeszcze raz [Pełne skanowanie].

Tak więc pozostaje tylko GoogleUpdate, jutro przegonię to ustrojstwo.

Tak więc przed pogonieniem zrób nowy punkt przywracania systemu.

Jeśli wyskoczy jakiś bluescreen daj raporcik.

[EsAmo]

Wyłączenie GoogleUpdate nic nie dało. Po kilku dniach znowu wyskakują niebieskie ekrany śmierci, wirusów MalwareByte's nie wykrył, a minidump'y są zróżnicowane:

Kod: Zaznacz cały

Malwarebytes' Anti-Malware 1.51.2.1300
www.malwarebytes.org

Wersja bazy: 8152

Windows 5.1.2600 Dodatek Service Pack 3
Internet Explorer 6.0.2900.5512

2011-11-13 16:04:58
mbam-log-2011-11-13 (16-04-58).txt

Typ skanowania: Pełne skanowanie (C:\|)
Przeskanowano obiektów: 162081
Upłynęło: 26 minut(y), 50 sekund(y)

Zainfekowanych procesów w pamięci: 0
Zainfekowanych modułów w pamięci: 0
Zainfekowanych kluczy rejestru: 0
Zainfekowanych wartości rejestru: 0
Zainfekowane informacje rejestru systemowego: 0
Zainfekowanych folderów: 0
Zainfekowanych plików: 0

Zainfekowanych procesów w pamięci:
(Nie znaleziono zagrożeń)

Zainfekowanych modułów w pamięci:
(Nie znaleziono zagrożeń)

Zainfekowanych kluczy rejestru:
(Nie znaleziono zagrożeń)

Zainfekowanych wartości rejestru:
(Nie znaleziono zagrożeń)

Zainfekowane informacje rejestru systemowego:
(Nie znaleziono zagrożeń)

Zainfekowanych folderów:
(Nie znaleziono zagrożeń)

Zainfekowanych plików:
(Nie znaleziono zagrożeń)

Kod: Zaznacz cały

Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Documents and Settings\admin\Pulpit\Mini110811-02.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows XP Kernel Version 2600 (Service Pack 3) UP Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 2600.xpsp_sp3_gdr.101209-1647
Machine Name:
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055b240
Debug session time: Tue Nov  8 19:41:51.783 2011 (GMT+1)
System Uptime: 0 days 0:00:37.373
Loading Kernel Symbols
...............................................................
.................................................
Loading User Symbols
Loading unloaded module list
....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1000008E, {c0000005, f3e31fd1, f3dde8c0, 0}

Probably caused by : sysaudio.sys ( sysaudio!CTopologyConnection::IsTopologyConnectionOnGraphNode+74 )

Followup: MachineOwner
---------

kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

KERNEL_MODE_EXCEPTION_NOT_HANDLED_M (1000008e)
This is a very common bugcheck.  Usually the exception address pinpoints
the driver/function that caused the problem.  Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003.  This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG.  This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG.  This will let us see why this breakpoint is
happening.
Arguments:
Arg1: c0000005, The exception code that was not handled
Arg2: f3e31fd1, The address that the exception occurred at
Arg3: f3dde8c0, Trap Frame
Arg4: 00000000

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - Instrukcja spod "0x%08lx" odwo

FAULTING_IP:
sysaudio!CTopologyConnection::IsTopologyConnectionOnGraphNode+74
f3e31fd1 3b4b10          cmp     ecx,dword ptr [ebx+10h]

TRAP_FRAME:  f3dde8c0 -- (.trap 0xfffffffff3dde8c0)
ErrCode = 00000000
eax=e208ac10 ebx=0000ff00 ecx=e206fab0 edx=e1fdd348 esi=e2081ef0 edi=e20681d8
eip=f3e31fd1 esp=f3dde934 ebp=f3dde954 iopl=0         nv up ei pl nz ac po nc
cs=0008  ss=0010  ds=0023  es=0023  fs=0030  gs=0000             efl=00010212
sysaudio!CTopologyConnection::IsTopologyConnectionOnGraphNode+0x74:
f3e31fd1 3b4b10          cmp     ecx,dword ptr [ebx+10h] ds:0023:0000ff10=????????
Resetting default scope

CUSTOMER_CRASH_COUNT:  2

DEFAULT_BUCKET_ID:  DRIVER_FAULT

BUGCHECK_STR:  0x8E

PROCESS_NAME:  winlogon.exe

LAST_CONTROL_TRANSFER:  from f3e32cf4 to f3e31fd1

STACK_TEXT: 
f3dde954 f3e32cf4 e15fefa8 e206fac4 e2081590 sysaudio!CTopologyConnection::IsTopologyConnectionOnGraphNode+0x74
f3dde978 f3e318d9 e20697c0 e208ac10 e20681d8 sysaudio!CTopologyConnection::ProcessTopologyConnection+0x1f
f3dde98c f3e32db8 f3e32cd5 e20697c0 f3e32cd5 sysaudio!CListMulti::EnumerateList+0x1d
f3dde9a8 f3e32eda e20681d8 f3e32cd5 00000000 sysaudio!CGraphNodeInstance::ProcessLogicalFilterNodeTopologyConnection+0x20
f3dde9bc f3e32b1e e15fefa8 e20697c0 f3e337c4 sysaudio!CGraphNodeInstance::CreateTopologyTables+0x6f
f3dde9c8 f3e337c4 e20951d0 00000000 f3e31021 sysaudio!CGraphNodeInstance::CreateSysAudioTopology+0x1b
f3dde9d4 f3e31021 e20951d0 e20951e4 859c8008 sysaudio!CGraphNodeInstance::Create+0x25
f3dde9e4 f3e31427 00000004 e20951d0 f3ddea04 sysaudio!CFilterInstance::CreateGraph+0x6f
f3dde9f4 f3e31976 e20681b8 862b0a08 f3ddea68 sysaudio!CFilterInstance::SetDeviceNode+0x41
f3ddea04 f73f5f5c e20681b8 862b0a08 862b0a00 sysaudio!SetInstanceDevice+0x3c
f3ddea68 f73f5ed9 859c8008 00000004 f3e305e0 ks!KspPropertyHandler+0x616
f3ddea8c f3e30fb2 859c8008 00000004 f3e305b8 ks!KsPropertyHandler+0x19
f3ddeadc f73f5f95 85995608 859c8008 f3ddeb28 sysaudio!CFilterInstance::FilterDispatchIoControl+0x18e
f3ddeaec 804e3807 85995608 859c8008 859c8008 ks!DispatchDeviceIoControl+0x28
f3ddeafc f73f6ba8 f3b97850 f3ddeb68 00000000 nt!IopfCallDriver+0x31
f3ddeb28 f3b8852e 862aedb0 00000000 002f0003 ks!KsSynchronousIoControlDevice+0xbd
f3ddeb70 f3b8938e 862aedb0 00000003 00000004 wdmaud!SetSysAudioProperty+0x4e
f3ddeba4 f3b89813 00000001 0000000d 00000001 wdmaud!OpenSysAudioPin+0x3e
f3ddebe0 f3b88a83 00000092 0000000d 86100248 wdmaud!OpenWavePin+0x3e2
f3ddec0c f3b88382 859929d0 86100248 00000000 wdmaud!Dispatch_OpenPin+0xb7
f3ddec34 804e3807 00000010 85977000 806f0070 wdmaud!SoundDispatch+0x430
f3ddec44 80568191 85992a64 85988028 859929d0 nt!IopfCallDriver+0x31
f3ddec58 805770ca 85980d50 859929d0 85988028 nt!IopSynchronousServiceTail+0x70
f3dded00 805795e3 00000768 0000067c 00000000 nt!IopXxxControlFile+0x611
f3dded34 804de7ec 00000768 0000067c 00000000 nt!NtDeviceIoControlFile+0x2a
f3dded34 7c90e514 00000768 0000067c 00000000 nt!KiFastCallEntry+0xf8
WARNING: Frame IP not in any known module. Following frames may be wrong.
01a7fab8 00000000 00000000 00000000 00000000 0x7c90e514


STACK_COMMAND:  kb

FOLLOWUP_IP:
sysaudio!CTopologyConnection::IsTopologyConnectionOnGraphNode+74
f3e31fd1 3b4b10          cmp     ecx,dword ptr [ebx+10h]

SYMBOL_STACK_INDEX:  0

SYMBOL_NAME:  sysaudio!CTopologyConnection::IsTopologyConnectionOnGraphNode+74

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: sysaudio

IMAGE_NAME:  sysaudio.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  48025beb

FAILURE_BUCKET_ID:  0x8E_sysaudio!CTopologyConnection::IsTopologyConnectionOnGraphNode+74

BUCKET_ID:  0x8E_sysaudio!CTopologyConnection::IsTopologyConnectionOnGraphNode+74

Followup: MachineOwner
---------

Kod: Zaznacz cały

Loading Dump File [C:\Documents and Settings\admin\Pulpit\Mini111311-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows XP Kernel Version 2600 (Service Pack 3) UP Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 2600.xpsp_sp3_gdr.101209-1647
Machine Name:
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055b240
Debug session time: Sun Nov 13 09:29:20.589 2011 (GMT+1)
System Uptime: 0 days 0:00:48.169
Loading Kernel Symbols
...............................................................
.................................................
Loading User Symbols
Loading unloaded module list
....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1000007F, {d, 0, 0, 0}

Probably caused by : ntoskrnl.exe ( nt!ExFreePoolWithTag+265 )

Followup: MachineOwner
---------

kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

UNEXPECTED_KERNEL_MODE_TRAP_M (1000007f)
This means a trap occurred in kernel mode, and it's a trap of a kind
that the kernel isn't allowed to have/catch (bound trap) or that
is always instant death (double fault).  The first number in the
bugcheck params is the number of the trap (8 = double fault, etc)
Consult an Intel x86 family manual to learn more about what these
traps are. Here is a *portion* of those codes:
If kv shows a taskGate
        use .tss on the part before the colon, then kv.
Else if kv shows a trapframe
        use .trap on that value
Else
        .trap on the appropriate frame will show where the trap was taken
        (on x86, this will be the ebp that goes with the procedure KiTrap)
Endif
kb will then show the corrected stack.
Arguments:
Arg1: 0000000d, EXCEPTION_GP_FAULT
Arg2: 00000000
Arg3: 00000000
Arg4: 00000000

Debugging Details:
------------------


BUGCHECK_STR:  0x7f_d

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  DRIVER_FAULT

PROCESS_NAME:  csrss.exe

LAST_CONTROL_TRANSFER:  from 804f1c52 to 8054c528

STACK_TEXT: 
f5d4bbf8 804f1c52 00000007 00000000 00000000 nt!ExFreePoolWithTag+0x265
f5d4bc10 8056d6f7 860b8900 e21a3d30 f5d4bc3c nt!ExDeleteResourceLite+0x32
f5d4bc20 805647f7 e21a3d48 e21a3d30 00000000 nt!SepTokenDeleteMethod+0x6b
f5d4bc3c 804e36e5 e21a3d48 00000000 85928ed8 nt!ObpRemoveObjectRoutine+0xe0
f5d4bc60 80583b1c f5d4bc74 80583972 85928da0 nt!ObfDereferenceObject+0x5f
f5d4bc68 80583972 85928da0 f5d4bca4 80583532 nt!SeDeassignPrimaryToken+0x23
f5d4bc74 80583532 85928da0 00000000 85928d88 nt!PspDeleteProcessSecurity+0x17
f5d4bca4 805647f7 85928da0 85928d88 00000000 nt!PspProcessDelete+0x153
f5d4bcc0 804e36e5 85928da0 00000000 00000494 nt!ObpRemoveObjectRoutine+0xe0
f5d4bce4 80567a57 8623e020 e14af920 86248020 nt!ObfDereferenceObject+0x5f
f5d4bcfc 80567ac0 e14af920 85928da0 00000494 nt!ObpCloseHandleTableEntry+0x155
f5d4bd44 80567b0a 00000494 00000001 00000000 nt!ObpCloseHandle+0x87
f5d4bd58 804de7ec 00000494 0058fec8 7c90e514 nt!NtClose+0x1d
f5d4bd58 7c90e514 00000494 0058fec8 7c90e514 nt!KiFastCallEntry+0xf8
WARNING: Frame IP not in any known module. Following frames may be wrong.
0058fec8 00000000 00000000 00000000 00000000 0x7c90e514


STACK_COMMAND:  kb

FOLLOWUP_IP:
nt!ExFreePoolWithTag+265
8054c528 ff36            push    dword ptr [esi]

SYMBOL_STACK_INDEX:  0

SYMBOL_NAME:  nt!ExFreePoolWithTag+265

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntoskrnl.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  4d00dbda

FAILURE_BUCKET_ID:  0x7f_d_nt!ExFreePoolWithTag+265

BUCKET_ID:  0x7f_d_nt!ExFreePoolWithTag+265

Followup: MachineOwner
---------

Kod: Zaznacz cały

Loading Dump File [C:\Documents and Settings\admin\Pulpit\Mini110811-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows XP Kernel Version 2600 (Service Pack 3) UP Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 2600.xpsp_sp3_gdr.101209-1647
Machine Name:
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055b240
Debug session time: Tue Nov  8 08:45:45.616 2011 (GMT+1)
System Uptime: 0 days 0:01:00.209
Loading Kernel Symbols
...............................................................
..................................................
Loading User Symbols
Loading unloaded module list
....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck C2, {7, cd4, 80561480, 862ed718}

Probably caused by : win32k.sys ( win32k!HeavyFreePool+bb )

Followup: MachineOwner
---------

kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

BAD_POOL_CALLER (c2)
The current thread is making a bad pool request.  Typically this is at a bad IRQL level or double freeing the same allocation, etc.
Arguments:
Arg1: 00000007, Attempt to free pool which was already freed
Arg2: 00000cd4, (reserved)
Arg3: 80561480, Memory contents of the pool block
Arg4: 862ed718, Address of the block of pool being deallocated

Debugging Details:
------------------


POOL_ADDRESS:  862ed718

FREED_POOL_TAG:  Thre

BUGCHECK_STR:  0xc2_7_Thre

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  DRIVER_FAULT

PROCESS_NAME:  csrss.exe

LAST_CONTROL_TRANSFER:  from 8054c541 to 80533846

STACK_TEXT: 
f5d0b7fc 8054c541 000000c2 00000007 00000cd4 nt!KeBugCheckEx+0x1b
f5d0b84c 804f1c79 862ed718 00000000 00000000 nt!ExFreePoolWithTag+0x2be
f5d0b864 8056d6f7 85862c08 e2220d30 f5d0b890 nt!ExDeleteResourceLite+0x40
f5d0b874 805647f7 e2220d48 e2220d30 00000000 nt!SepTokenDeleteMethod+0x6b
f5d0b890 804e36e5 e2220d48 00000000 8586c840 nt!ObpRemoveObjectRoutine+0xe0
f5d0b8b4 80583b1c f5d0b8c8 80583972 8586c708 nt!ObfDereferenceObject+0x5f
f5d0b8bc 80583972 8586c708 f5d0b8f8 80583532 nt!SeDeassignPrimaryToken+0x23
f5d0b8c8 80583532 8586c708 00000000 8586c6f0 nt!PspDeleteProcessSecurity+0x17
f5d0b8f8 805647f7 8586c708 8586c6f0 00000000 nt!PspProcessDelete+0x153
f5d0b914 804e36e5 8586c708 00000000 863ee050 nt!ObpRemoveObjectRoutine+0xe0
f5d0b938 8054b931 862df978 e161a120 e16218c8 nt!ObfDereferenceObject+0x5f
f5d0b974 bf802ab5 e161a120 8586c708 f5d0b9b4 nt!ExFreePoolWithTag+0x3b2
f5d0b984 bf85829a e161a120 00000000 00000001 win32k!HeavyFreePool+0xbb
f5d0b9b4 bf91affc 86192458 00000000 00000000 win32k!FreeView+0x84
f5d0b9d0 805816c1 00000000 00000000 862df960 win32k!FreeDesktop+0x39
f5d0b9fc 80646448 bf91afc3 f5d0ba1c 00000000 nt!ExpWin32SessionCallout+0x3c
f5d0ba14 805647f7 862df978 862df960 00000000 nt!ExpWin32DeleteProcedure+0x41
f5d0ba30 804e36e5 862df978 00000000 bf9ae080 nt!ObpRemoveObjectRoutine+0xe0
f5d0ba54 bf8038e3 f5d0ba68 bf8029c5 862df978 nt!ObfDereferenceObject+0x5f
f5d0ba5c bf8029c5 862df978 f5d0bd30 bf87ef5e win32k!UserDereferenceObject+0xe
f5d0ba68 bf87ef5e f5d0bacc 00000022 00c1fff4 win32k!PopAndFreeW32ThreadLock+0x25
f5d0bd30 bf8b9015 bf9ae080 00000001 f5d0bd54 win32k!xxxDesktopThread+0x877
f5d0bd40 bf801142 bf9ae080 f5d0bd64 00c1fff4 win32k!xxxCreateSystemThreads+0x6a
f5d0bd54 804de7ec 00000000 00000022 00000000 win32k!NtUserCallOneParam+0x23
f5d0bd54 7c90e514 00000000 00000022 00000000 nt!KiFastCallEntry+0xf8
WARNING: Frame IP not in any known module. Following frames may be wrong.
00000000 00000000 00000000 00000000 00000000 0x7c90e514


STACK_COMMAND:  kb

FOLLOWUP_IP:
win32k!HeavyFreePool+bb
bf802ab5 5d              pop     ebp

SYMBOL_STACK_INDEX:  c

SYMBOL_NAME:  win32k!HeavyFreePool+bb

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: win32k

IMAGE_NAME:  win32k.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4e661e29

FAILURE_BUCKET_ID:  0xc2_7_Thre_win32k!HeavyFreePool+bb

BUCKET_ID:  0xc2_7_Thre_win32k!HeavyFreePool+bb

Followup: MachineOwner
---------

Kod: Zaznacz cały

Loading Dump File [C:\Documents and Settings\admin\Pulpit\Mini110911-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows XP Kernel Version 2600 (Service Pack 3) UP Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 2600.xpsp_sp3_gdr.101209-1647
Machine Name:
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055b240
Debug session time: Wed Nov  9 14:28:46.955 2011 (GMT+1)
System Uptime: 0 days 0:00:38.545
Loading Kernel Symbols
...............................................................
.....................................
Loading User Symbols
Loading unloaded module list
....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 24, {1902fe, f7617580, f761727c, f76d8f04}

Probably caused by : memory_corruption

Followup: memory_corruption
---------

kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

NTFS_FILE_SYSTEM (24)
    If you see NtfsExceptionFilter on the stack then the 2nd and 3rd
    parameters are the exception record and context record. Do a .cxr
    on the 3rd parameter and then kb to obtain a more informative stack
    trace.
Arguments:
Arg1: 001902fe
Arg2: f7617580
Arg3: f761727c
Arg4: f76d8f04

Debugging Details:
------------------


EXCEPTION_RECORD:  f7617580 -- (.exr 0xfffffffff7617580)
ExceptionAddress: f76d8f04 (Ntfs!NtfsSetRenameInfo+0x00000b1f)
   ExceptionCode: c000001d (Illegal instruction)
  ExceptionFlags: 00000000
NumberParameters: 0

CONTEXT:  f761727c -- (.cxr 0xfffffffff761727c)
eax=f7617684 ebx=00000000 ecx=f76d9469 edx=861c4518 esi=8614a650 edi=e17d8610
eip=f76d8f04 esp=f7617648 ebp=f7617821 iopl=0         nv up ei pl zr na pe nc
cs=0008  ss=0010  ds=0023  es=0023  fs=0030  gs=0000             efl=00010246
Ntfs!NtfsSetRenameInfo+0xb1f:
f76d8f04 ff              ???
Resetting default scope

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  CODE_CORRUPTION

BUGCHECK_STR:  0x24

PROCESS_NAME:  winlogon.exe

ERROR_CODE: (NTSTATUS) 0xc000001d - {WYJ

EXCEPTION_CODE: (NTSTATUS) 0xc000001d - {WYJ

LAST_CONTROL_TRANSFER:  from 50f76d86 to f76d8f04

STACK_TEXT: 
f7617821 50f76d86 408614a6 08862664 50863920 Ntfs!NtfsSetRenameInfo+0xb1f
WARNING: Frame IP not in any known module. Following frames may be wrong.
f7617841 b0000000 08f76178 40863920 0ae1000d 0x50f76d86
f7617845 08f76178 40863920 0ae1000d 02000000 0xb0000000
f7617849 40863920 0ae1000d 02000000 d8000000 0x8f76178
f761784d 0ae1000d 02000000 d8000000 40e17d86 0x40863920
f7617851 02000000 d8000000 40e17d86 30862664 0xae1000d
f7617855 d8000000 40e17d86 30862664 10e17d88 0x2000000
f7617859 40e17d86 30862664 10e17d88 01e17d86 0xd8000000
f761785d 30862664 10e17d88 01e17d86 50f76178 0x40e17d86
f7617861 10e17d88 01e17d86 50f76178 00863738 0x30862664
f7617865 01e17d86 50f76178 00863738 44000000 0x10e17d88
f7617869 50f76178 00863738 44000000 44000000 0x1e17d86
f761786d 00863738 44000000 44000000 ccf76178 0x50f76178
f7617871 44000000 44000000 ccf76178 ecf76170 0x863738
f7617875 44000000 ccf76178 ecf76170 5bf76178 0x44000000
f7617879 ccf76178 ecf76170 5bf76178 10f76a07 0x44000000
f761787d ecf76170 5bf76178 10f76a07 00f76b3c 0xccf76178
f7617881 5bf76178 10f76a07 00f76b3c fc000000 0xecf76170
f7617885 10f76a07 00f76b3c fc000000 3bf76178 0x5bf76178
f7617889 00f76b3c fc000000 3bf76178 50f769eb 0x10f76a07
f761788d fc000000 3bf76178 50f769eb 088614a6 0xf76b3c
f7617891 3bf76178 50f769eb 088614a6 40863920 0xfc000000
f7617895 50f769eb 088614a6 40863920 08862664 0x3bf76178
f7617899 088614a6 40863920 08862664 08863916 0x50f769eb
f761789d 40863920 08862664 08863916 01863920 0x88614a6
f76178a1 08862664 08863916 01863920 4ef90000 0x40863920
f76178a5 08863916 01863920 4ef90000 00534654 0x8862664
f76178a9 01863920 4ef90000 00534654 00000000 0x8863916
f76178ad 4ef90000 00534654 00000000 00000000 0x1863920
f76178b1 00534654 00000000 00000000 00000000 0x4ef90000
f76178b5 00000000 00000000 00000000 50000000 0x534654


CHKIMG_EXTENSION: !chkimg -lo 50 -d !Ntfs
    f76d8ef8 - Ntfs!NtfsSetRenameInfo+b13
   [ 50:10 ]
1 error : !Ntfs (f76d8ef8)

MODULE_NAME: memory_corruption

IMAGE_NAME:  memory_corruption

FOLLOWUP_NAME:  memory_corruption

DEBUG_FLR_IMAGE_TIMESTAMP:  0

MEMORY_CORRUPTOR:  ONE_BIT

STACK_COMMAND:  .cxr 0xfffffffff761727c ; kb

FAILURE_BUCKET_ID:  MEMORY_CORRUPTION_ONE_BIT

BUCKET_ID:  MEMORY_CORRUPTION_ONE_BIT

Followup: memory_corruption
---------

Edit: Przypominam, że MemTest niczego nie wykrył, a system jest dość świeży - jakoś 2 miesiące temu był format.

Potrafi ktoś rozwiązać tę zagadkę ?

Pzdr.

[cosik_ktosik]

0x24 to błąd dysku twardego, uszkodzenie fizyczne lub logiczne. Na początek podaj smart z programu HD Tune, zakładka Health.

[EsAmo]

SMART log dzięki Vistorii:

Kod: Zaznacz cały

-------------------------------------------------------------------------
  ID      Name                   Value  Worst  Tresh       Raw    Health
-------------------------------------------------------------------------
  1 Raw read error rate           100    100      0          291   •••••
  4 Number of spin-up times        94     94      0         6172   •••• 
  5 Reallocated sector count      253    253      9            0   •••••
  7 Seek error rate               253    253     51            0   •••••
  8 Seek time perfomance          253    253      0            0   •••••
  9 Power-on time                 100    100      0       566892   •••••
 12 Start/stop count               98     98      0         2952   •••• 
194 HDA Temperature               163    133      0    25°C/77°F   •••• 
197 Current pending sectors       253    253      9            0   •••••
198 Offline scan UNC sectors      253    253      9            0   •••••
199 Ultra DMA CRC errors          198    198      0            0   •••••
200 Write error rate              100    100     51            0   •••••
201 Off-track errors count        100    100     51            0   •••••

[cosik_ktosik]

Tu nie ma problemu, a zatem może w plikach coś. W menu start->> uruchom wpisz:
cmd

a potem
chkdsk c: /F /R
i pozwól aby system sprawdził dysk przy następnym uruchomieniu.