Przywracałem już kilka razy system do stanu fabrycznego i zawsze za którymś razem po wyłączeniu komputera i po włączeniu pojawia się ten błąd. Ten problem normalnie nie występuję tylko przy włączeniu, natomiast sam błąd chyba powstaje przy wyłączaniu komputera co wskazuje na to data o której wyłączałem komputer. Co ciekawe jak powoli zamykam system tzn. zanim "zamkne komputer" chwile odczekam, az nie bedzie migala dioda oznaczajaca prace dysku to ten problem nie wystepowal wiec moze jakis proces za to odpowiada? Aktualizacje, sterowniki najnowsze zainstalowane, dysk i pamiec rowniez sprawdzana i wszystko jest ok. Jeżeli chodzi o dziennik zdarzen to wyglada to tak:
Szybkie uruchomienie systemu Windows nie powiodło się z powodu błędu o stanie 0xC0000001.
Poprzednie zamknięcie systemu przy 11:23:04 na 2013-01-24 było nieoczekiwane.
Nastąpił ponowny rozruch komputera po operacji wykrywania błędów. Wyniki tej operacji były następujące: 0x0000001e (0xffffffffc0000005, 0xffffffffff48f92c, 0x0000000000000000, 0x00000000fed1f410). Zrzut zapisano w: C:\windows\MEMORY.DMP. Identyfikator raportu: 012413-11312-01.
System został uruchomiony ponownie bez uprzedniego czystego zamknięcia. Przyczyną tego błędu może być fakt, że system przestał odpowiadać, uległ awarii lub nastąpiła nieoczekiwana utrata zasilania.
...
Po ponownym uruchomieniu pojawia się informacja o tych plikach:
C:\WINDOWS\MINIDUMP\011313-12937-01.dmp
C:\USER\NAZWA\APPDATA\LOCAL\TEMP\WER-35875-0.sysdata.xml
C:\WINDOWS\MEMORY.DMP
Widok z programu "BlueScreenView"
==================================================
Dump File : 011313-12937-01.dmp
Crash Time : 2013-01-13 18:36:40
Bug Check String : KMODE_EXCEPTION_NOT_HANDLED
Bug Check Code : 0x0000001e
Parameter 1 : ffffffff`c0000005
Parameter 2 : ffffffff`ff48f92c
Parameter 3 : 00000000`00000000
Parameter 4 : 00000000`fed1f410
Caused By Driver : hal.dll
Caused By Address : hal.dll+42201
File Description :
Product Name :
Company :
File Version :
Processor : x64
Crash Address : ntoskrnl.exe+7b340
Stack Address 1 :
Stack Address 2 :
Stack Address 3 :
Computer Name :
Full Path : C:\windows\Minidump\011313-12937-01.dmp
Processors Count : 4
Major Version : 15
Minor Version : 9200
Dump File Size : 288 648
==================================================
Widok z programu "BlueScreenView", normalnie się to nie pokazuje.
A problem has been detected and Windows has been shut down to prevent damage
to your computer.
The problem seems to be caused by the following file: hal.dll
KMODE_EXCEPTION_NOT_HANDLED
If this is the first time you've seen this stop error screen,
restart your computer. If this screen appears again, follow
these steps:
Check to make sure any new hardware or software is properly installed.
If this is a new installation, ask your hardware or software manufacturer
for any Windows updates you might need.
If problems continue, disable or remove any newly installed hardware
or software. Disable BIOS memory options such as caching or shadowing.
If you need to use safe mode to remove or disable components, restart
your computer, press F8 to select Advanced Startup Options, and then
select Safe Mode.
Technical Information:
*** STOP: 0x0000001e (0xffffffffc0000005, 0xffffffffff48f92c, 0x0000000000000000,
0x00000000fed1f410)
*** hal.dll - Address 0xfffff802de060201 base at 0xfffff802de01e000 DateStamp
0x50875a79
Informacje z programu WinDbg
Loading Dump File [C:\Windows\Minidump\012413-11312-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 8 Kernel Version 9200 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 9200.16461.amd64fre.win8_gdr.121119-1606
Machine Name:
Kernel base = 0xfffff802`7ba7d000 PsLoadedModuleList = 0xfffff802`7bd47a80
Debug session time: Thu Jan 24 11:53:58.778 2013 (UTC + 1:00)
System Uptime: 2 days 21:23:11.085
Loading Kernel Symbols
...............................................................
................................................................
...................
Loading User Symbols
Loading unloaded module list
.................................................
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 1E, {ffffffffc0000005, ffffffffff48f92c, 0, fed1f410}
Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+13f6b )
Followup: MachineOwner
---------
0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
KMODE_EXCEPTION_NOT_HANDLED (1e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Arguments:
Arg1: ffffffffc0000005, The exception code that was not handled
Arg2: ffffffffff48f92c, The address that the exception occurred at
Arg3: 0000000000000000, Parameter 0 of the exception
Arg4: 00000000fed1f410, Parameter 1 of the exception
Debugging Details:
------------------
READ_ADDRESS: GetPointerFromAddress: unable to read from fffff8027bdd3168
GetUlongFromAddress: unable to read from fffff8027bdd31f8
00000000fed1f410 Nonpaged pool
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - Instrukcja spod 0x%08lx odwo
FAULTING_IP:
+0
ffffffff`ff48f92c ?? ???
EXCEPTION_PARAMETER2: 00000000fed1f410
BUGCHECK_STR: 0x1E_c0000005_R
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: WIN8_DRIVER_FAULT
PROCESS_NAME: System
CURRENT_IRQL: 0
TRAP_FRAME: fffff8800a1be3a0 -- (.trap 0xfffff8800a1be3a0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=fffff8027ba50201 rbx=0000000000000000 rcx=00000000fed1f410
rdx=0000000000000010 rsi=0000000000000000 rdi=0000000000000000
rip=ffffffffff48f92c rsp=fffff8800a1be538 rbp=fffff8800a1be650
r8=0000000000000000 r9=000000000000000d r10=0000000000000000
r11=0000000000000018 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up di pl nz na pe nc
ffffffff`ff48f92c ?? ???
Resetting default scope
LAST_CONTROL_TRANSFER: from fffff8027bc51465 to fffff8027baf8340
STACK_TEXT:
fffff880`0a1bdaf8 fffff802`7bc51465 : 00000000`0000001e ffffffff`c0000005 ffffffff`ff48f92c 00000000`00000000 : nt!KeBugCheckEx
fffff880`0a1bdb00 fffff802`7baf7742 : fffffa80`06688d40 00000000`fed1f410 fffff880`0a1be328 00000000`00000000 : nt! ?? ::FNODOBFM::`string'+0x13f6b
fffff880`0a1be1c0 fffff802`7baf5eba : 00000000`00000000 fffff880`0a1be60b fffffa80`06a1f000 fffff880`0a1be3a0 : nt!KiExceptionDispatch+0xc2
fffff880`0a1be3a0 ffffffff`ff48f92c : ffffffff`ff48e30c 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiPageFault+0x23a
fffff880`0a1be538 ffffffff`ff48e30c : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0xffffffff`ff48f92c
fffff880`0a1be540 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000005 : 0xffffffff`ff48e30c
STACK_COMMAND: kb
FOLLOWUP_IP:
nt! ?? ::FNODOBFM::`string'+13f6b
fffff802`7bc51465 cc int 3
SYMBOL_STACK_INDEX: 1
SYMBOL_NAME: nt! ?? ::FNODOBFM::`string'+13f6b
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 50ab0e64
BUCKET_ID_FUNC_OFFSET: 13f6b
FAILURE_BUCKET_ID: 0x1E_c0000005_R_nt!_??_::FNODOBFM::_string_
BUCKET_ID: 0x1E_c0000005_R_nt!_??_::FNODOBFM::_string_
Followup: MachineOwner
---------
Pozdrawiam.
