Emirhandkee
80+ Titanium
- Katılım
- 25 Mart 2020
- Mesajlar
- 22,710
- En İyi Cevap
- 45
- Reaksiyon skoru
- 20,609
Bir üyenin minidumpına bakarken FLTMGR.SYS kaynaklı bir sorun çıktı. Paylaştığım siteye göre de %22 şansla virüs olduğunu söylüyor. Dosya konumu başka bir yerdeydi.
Bu sorun neyden kaynaklı sizce?
www.file.net
.
drive.google.com
Bu sorun neyden kaynaklı sizce?
fltmgr.sys Windows process - What is it?
fltmgr.sys is important for Windows 10/8/7/XP. Click here to know what fltmgr.sys is doing, its safeness and how to avoid problems.
PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced. This cannot be protected by try-except.
Typically the address is just plain bad or it is pointing at freed memory.
Arguments:
Arg1: ffffffffffffffe8, memory referenced.
Arg2: 0000000000000000, value 0 = read operation, 1 = write operation.
Arg3: fffff8050c516128, If non-zero, the instruction address which referenced the bad memory
address.
Arg4: 0000000000000002, (reserved)
Debugging Details:
------------------
KEY_VALUES_STRING: 1
Key : Analysis.CPU.mSec
Value: 6499
Key : Analysis.DebugAnalysisProvider.CPP
Value: Create: 8007007e on DESKTOP-I3EKBK0
Key : Analysis.DebugData
Value: CreateObject
Key : Analysis.DebugModel
Value: CreateObject
Key : Analysis.Elapsed.mSec
Value: 29650
Key : Analysis.Memory.CommitPeak.Mb
Value: 82
Key : Analysis.System
Value: CreateObject
Key : WER.OS.Branch
Value: vb_release
Key : WER.OS.Timestamp
Value: 2019-12-06T14:06:00Z
Key : WER.OS.Version
Value: 10.0.19041.1
ADDITIONAL_XML: 1
OS_BUILD_LAYERS: 1
BUGCHECK_CODE: 50
BUGCHECK_P1: ffffffffffffffe8
BUGCHECK_P2: 0
BUGCHECK_P3: fffff8050c516128
BUGCHECK_P4: 2
READ_ADDRESS: fffff805114fa390: Unable to get MiVisibleState
Unable to get NonPagedPoolStart
Unable to get NonPagedPoolEnd
Unable to get PagedPoolStart
Unable to get PagedPoolEnd
fffff8051140f2e0: Unable to get Flags value from nt!KdVersionBlock
fffff8051140f2e0: Unable to get Flags value from nt!KdVersionBlock
unable to get nt!MmSpecialPagesInUse
ffffffffffffffe8
MM_INTERNAL_CODE: 2
BLACKBOXBSD: 1 (!blackboxbsd)
BLACKBOXNTFS: 1 (!blackboxntfs)
BLACKBOXWINLOGON: 1
CUSTOMER_CRASH_COUNT: 1
PROCESS_NAME: steam.exe
TRAP_FRAME: ffff9184330f3c80 -- (.trap 0xffff9184330f3c80)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=ffffe688587d2d60 rbx=0000000000000000 rcx=ffffe688587d2eb0
rdx=fffff80512515d60 rsi=0000000000000000 rdi=0000000000000000
rip=fffff8050c516128 rsp=ffff9184330f3e10 rbp=ffff9184330f3ec9
r8=ffffffffffffffb8 r9=ffffe6886c67e4e0 r10=0000000000000001
r11=ffff837dd7c00001 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl zr na po nc
FLTMGR!FltpPerformPreCallbacksWorker+0x408:
fffff805`0c516128 418b5030 mov edx,dword ptr [r8+30h] ds:ffffffff`ffffffe8=????????
Resetting default scope
STACK_TEXT:
ffff9184`330f39d8 fffff805`10c86729 : 00000000`00000050 ffffffff`ffffffe8 00000000`00000000 ffff9184`330f3c80 : nt!KeBugCheckEx
ffff9184`330f39e0 fffff805`10aeeb80 : ffffe688`6cec8010 00000000`00000000 ffff9184`330f3d00 00000000`00000000 : nt!MiSystemFault+0x13faf9
ffff9184`330f3ae0 fffff805`10c0205e : 00000000`00000000 ffffe688`6e70cea8 ffffe688`5892e0a0 00000000`00000000 : nt!MmAccessFault+0x400
ffff9184`330f3c80 fffff805`0c516128 : ffffe688`6c67e460 00000000`00000001 ffffe688`6c67e5e8 ffffd086`79e18930 : nt!KiPageFault+0x35e
ffff9184`330f3e10 fffff805`0c515b37 : ffff9184`330f4000 ffff56a5`47571d04 ffff9184`330f4100 00000000`00000000 : FLTMGR!FltpPerformPreCallbacksWorker+0x408
ffff9184`330f3f30 fffff805`0c514b46 : ffff9184`330f5000 ffff9184`330ef000 00000000`00000000 ffff9184`330f4050 : FLTMGR!FltpPassThroughInternal+0xc7
ffff9184`330f3f80 fffff805`0c5148bb : ffff9184`330f4040 00000000`00000000 00000000`00000103 00000000`00000000 : FLTMGR!FltpPassThrough+0x1d6
ffff9184`330f4020 fffff805`10ad1f35 : ffffe688`6cec8010 fffff805`10ad1f77 00000000`0000000c 00000000`00000004 : FLTMGR!FltpDispatch+0x8b
ffff9184`330f4080 fffff805`10b39d33 : ffff9184`330f4190 ffffe688`6cec8010 ffffe688`6e603950 ffff9184`330f4150 : nt!IofCallDriver+0x55
ffff9184`330f40c0 fffff805`10a5fb6f : ffff9184`330f4190 ffff9184`330f4200 00000000`00000010 00000000`00000000 : nt!IoSynchronousPageWriteEx+0x13b
ffff9184`330f4100 fffff805`10a5f9c0 : 00040000`00000000 00000000`00200000 00000000`00000000 00000000`00000000 : nt!MiZeroPageWrite+0x177
ffff9184`330f42a0 fffff805`10a5f928 : 00000000`00200000 ffff9184`330f4700 ffffe688`6e603950 00000000`fffffe00 : nt!MmZeroPageWrite+0x48
ffff9184`330f42d0 fffff805`10a097f6 : 00000000`00200000 00000000`00e00000 00000002`e43a0000 fffff805`10b4b250 : nt!CcZeroDataOnDisk+0x38
ffff9184`330f4300 fffff805`126d5d63 : 00000000`00000000 00000002`e4200000 ffff9184`330f4420 00000000`00000001 : nt!CcZeroData+0x1f6
ffff9184`330f43c0 fffff805`12594890 : ffffe688`68975a78 ffffd086`78e816c0 ffffe688`6e603950 00000000`00000700 : Ntfs!NtfsZeroData+0x14b
ffff9184`330f44a0 fffff805`12592de3 : ffffe688`68975a78 ffffe688`6c2ac010 ffff9184`330f4740 00000000`00000000 : Ntfs!NtfsCommonWrite+0x1830
ffff9184`330f46d0 fffff805`10ad1f35 : ffffe688`6c452a20 ffffe688`6c2ac010 ffffe688`6c2ac010 ffffe688`587d2d60 : Ntfs!NtfsFsdWrite+0x1d3
ffff9184`330f47a0 fffff805`0c516ccf : ffffe688`586d6a20 ffffe688`5892e0a0 ffffe688`587858a0 ffffe688`6e603950 : nt!IofCallDriver+0x55
ffff9184`330f47e0 fffff805`0c5148d3 : ffff9184`330f4870 00000000`00000000 ffff9184`330f4900 ffff9184`330f4800 : FLTMGR!FltpLegacyProcessingAfterPreCallbacksCompleted+0x28f
ffff9184`330f4850 fffff805`10ad1f35 : ffffe688`6c2ac010 ffff9184`330f4a20 ffff9184`330f49e8 ffffe688`6e603950 : FLTMGR!FltpDispatch+0xa3
ffff9184`330f48b0 fffff805`10ea6fb8 : 00000000`00000001 ffffe688`6e603950 00000000`00000001 ffffe688`6c2ac3f8 : nt!IofCallDriver+0x55
ffff9184`330f48f0 fffff805`10e96def : ffffe688`00000000 ffff9184`330f4b80 00000000`00000000 ffff9184`330f4b80 : nt!IopSynchronousServiceTail+0x1a8
ffff9184`330f4990 fffff805`10c058b8 : 00000000`00000f8c 00000000`00000000 00000000`00000000 00000000`00000000 : nt!NtWriteFile+0x66f
ffff9184`330f4a90 00000000`77491cfc : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x28
00000000`083dee88 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x77491cfc
SYMBOL_NAME: FLTMGR!FltpPerformPreCallbacksWorker+408
MODULE_NAME: FLTMGR
IMAGE_NAME: FLTMGR.SYS
IMAGE_VERSION: 10.0.19041.264
STACK_COMMAND: .thread ; .cxr ; kb
BUCKET_ID_FUNC_OFFSET: 408
FAILURE_BUCKET_ID: AV_R_INVALID_FLTMGR!FltpPerformPreCallbacksWorker
OS_VERSION: 10.0.19041.1
BUILDLAB_STR: vb_release
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
FAILURE_ID_HASH: {dd10325a-c5bd-1cef-a36e-f0d4a059fb42}
Followup: MachineOwner
---------
11: kd> lmvm FLTMGR
Browse full module list
start end module name
fffff805`0c510000 fffff805`0c57f000 FLTMGR (pdb symbols) C:\ProgramData\Dbg\sym\fltMgr.pdb\C3CA0BC721B145FE4F45FF7F65B7C5AD1\fltMgr.pdb
Loaded symbol image file: FLTMGR.SYS
Mapped memory image file: C:\ProgramData\Dbg\sym\FLTMGR.SYS\02839B666f000\FLTMGR.SYS
Image path: \SystemRoot\System32\drivers\FLTMGR.SYS
Image name: FLTMGR.SYS
Browse all global symbols functions data
Image was built with /Brepro flag.
Timestamp: 02839B66 (This is a reproducible build file hash, not a timestamp)
CheckSum: 00072E12
ImageSize: 0006F000
File version: 10.0.19041.264
Product version: 10.0.19041.264
File flags: 0 (Mask 3F)
File OS: 40004 NT Win32
File type: 3.7 Driver
File date: 00000000.00000000
Translations: 0409.04b0
Information from resource tables:
CompanyName: Microsoft Corporation
ProductName: Microsoft® Windows® Operating System
InternalName: fltMgr.sys
OriginalFilename: fltMgr.sys
ProductVersion: 10.0.19041.264
FileVersion: 10.0.19041.264 (WinBuild.160101.0800)
FileDescription: Microsoft Filesystem Filter Manager
LegalCopyright: © Microsoft Corporation. All rights reserved.
Invalid system memory was referenced. This cannot be protected by try-except.
Typically the address is just plain bad or it is pointing at freed memory.
Arguments:
Arg1: ffffffffffffffe8, memory referenced.
Arg2: 0000000000000000, value 0 = read operation, 1 = write operation.
Arg3: fffff8050c516128, If non-zero, the instruction address which referenced the bad memory
address.
Arg4: 0000000000000002, (reserved)
Debugging Details:
------------------
KEY_VALUES_STRING: 1
Key : Analysis.CPU.mSec
Value: 6499
Key : Analysis.DebugAnalysisProvider.CPP
Value: Create: 8007007e on DESKTOP-I3EKBK0
Key : Analysis.DebugData
Value: CreateObject
Key : Analysis.DebugModel
Value: CreateObject
Key : Analysis.Elapsed.mSec
Value: 29650
Key : Analysis.Memory.CommitPeak.Mb
Value: 82
Key : Analysis.System
Value: CreateObject
Key : WER.OS.Branch
Value: vb_release
Key : WER.OS.Timestamp
Value: 2019-12-06T14:06:00Z
Key : WER.OS.Version
Value: 10.0.19041.1
ADDITIONAL_XML: 1
OS_BUILD_LAYERS: 1
BUGCHECK_CODE: 50
BUGCHECK_P1: ffffffffffffffe8
BUGCHECK_P2: 0
BUGCHECK_P3: fffff8050c516128
BUGCHECK_P4: 2
READ_ADDRESS: fffff805114fa390: Unable to get MiVisibleState
Unable to get NonPagedPoolStart
Unable to get NonPagedPoolEnd
Unable to get PagedPoolStart
Unable to get PagedPoolEnd
fffff8051140f2e0: Unable to get Flags value from nt!KdVersionBlock
fffff8051140f2e0: Unable to get Flags value from nt!KdVersionBlock
unable to get nt!MmSpecialPagesInUse
ffffffffffffffe8
MM_INTERNAL_CODE: 2
BLACKBOXBSD: 1 (!blackboxbsd)
BLACKBOXNTFS: 1 (!blackboxntfs)
BLACKBOXWINLOGON: 1
CUSTOMER_CRASH_COUNT: 1
PROCESS_NAME: steam.exe
TRAP_FRAME: ffff9184330f3c80 -- (.trap 0xffff9184330f3c80)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=ffffe688587d2d60 rbx=0000000000000000 rcx=ffffe688587d2eb0
rdx=fffff80512515d60 rsi=0000000000000000 rdi=0000000000000000
rip=fffff8050c516128 rsp=ffff9184330f3e10 rbp=ffff9184330f3ec9
r8=ffffffffffffffb8 r9=ffffe6886c67e4e0 r10=0000000000000001
r11=ffff837dd7c00001 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl zr na po nc
FLTMGR!FltpPerformPreCallbacksWorker+0x408:
fffff805`0c516128 418b5030 mov edx,dword ptr [r8+30h] ds:ffffffff`ffffffe8=????????
Resetting default scope
STACK_TEXT:
ffff9184`330f39d8 fffff805`10c86729 : 00000000`00000050 ffffffff`ffffffe8 00000000`00000000 ffff9184`330f3c80 : nt!KeBugCheckEx
ffff9184`330f39e0 fffff805`10aeeb80 : ffffe688`6cec8010 00000000`00000000 ffff9184`330f3d00 00000000`00000000 : nt!MiSystemFault+0x13faf9
ffff9184`330f3ae0 fffff805`10c0205e : 00000000`00000000 ffffe688`6e70cea8 ffffe688`5892e0a0 00000000`00000000 : nt!MmAccessFault+0x400
ffff9184`330f3c80 fffff805`0c516128 : ffffe688`6c67e460 00000000`00000001 ffffe688`6c67e5e8 ffffd086`79e18930 : nt!KiPageFault+0x35e
ffff9184`330f3e10 fffff805`0c515b37 : ffff9184`330f4000 ffff56a5`47571d04 ffff9184`330f4100 00000000`00000000 : FLTMGR!FltpPerformPreCallbacksWorker+0x408
ffff9184`330f3f30 fffff805`0c514b46 : ffff9184`330f5000 ffff9184`330ef000 00000000`00000000 ffff9184`330f4050 : FLTMGR!FltpPassThroughInternal+0xc7
ffff9184`330f3f80 fffff805`0c5148bb : ffff9184`330f4040 00000000`00000000 00000000`00000103 00000000`00000000 : FLTMGR!FltpPassThrough+0x1d6
ffff9184`330f4020 fffff805`10ad1f35 : ffffe688`6cec8010 fffff805`10ad1f77 00000000`0000000c 00000000`00000004 : FLTMGR!FltpDispatch+0x8b
ffff9184`330f4080 fffff805`10b39d33 : ffff9184`330f4190 ffffe688`6cec8010 ffffe688`6e603950 ffff9184`330f4150 : nt!IofCallDriver+0x55
ffff9184`330f40c0 fffff805`10a5fb6f : ffff9184`330f4190 ffff9184`330f4200 00000000`00000010 00000000`00000000 : nt!IoSynchronousPageWriteEx+0x13b
ffff9184`330f4100 fffff805`10a5f9c0 : 00040000`00000000 00000000`00200000 00000000`00000000 00000000`00000000 : nt!MiZeroPageWrite+0x177
ffff9184`330f42a0 fffff805`10a5f928 : 00000000`00200000 ffff9184`330f4700 ffffe688`6e603950 00000000`fffffe00 : nt!MmZeroPageWrite+0x48
ffff9184`330f42d0 fffff805`10a097f6 : 00000000`00200000 00000000`00e00000 00000002`e43a0000 fffff805`10b4b250 : nt!CcZeroDataOnDisk+0x38
ffff9184`330f4300 fffff805`126d5d63 : 00000000`00000000 00000002`e4200000 ffff9184`330f4420 00000000`00000001 : nt!CcZeroData+0x1f6
ffff9184`330f43c0 fffff805`12594890 : ffffe688`68975a78 ffffd086`78e816c0 ffffe688`6e603950 00000000`00000700 : Ntfs!NtfsZeroData+0x14b
ffff9184`330f44a0 fffff805`12592de3 : ffffe688`68975a78 ffffe688`6c2ac010 ffff9184`330f4740 00000000`00000000 : Ntfs!NtfsCommonWrite+0x1830
ffff9184`330f46d0 fffff805`10ad1f35 : ffffe688`6c452a20 ffffe688`6c2ac010 ffffe688`6c2ac010 ffffe688`587d2d60 : Ntfs!NtfsFsdWrite+0x1d3
ffff9184`330f47a0 fffff805`0c516ccf : ffffe688`586d6a20 ffffe688`5892e0a0 ffffe688`587858a0 ffffe688`6e603950 : nt!IofCallDriver+0x55
ffff9184`330f47e0 fffff805`0c5148d3 : ffff9184`330f4870 00000000`00000000 ffff9184`330f4900 ffff9184`330f4800 : FLTMGR!FltpLegacyProcessingAfterPreCallbacksCompleted+0x28f
ffff9184`330f4850 fffff805`10ad1f35 : ffffe688`6c2ac010 ffff9184`330f4a20 ffff9184`330f49e8 ffffe688`6e603950 : FLTMGR!FltpDispatch+0xa3
ffff9184`330f48b0 fffff805`10ea6fb8 : 00000000`00000001 ffffe688`6e603950 00000000`00000001 ffffe688`6c2ac3f8 : nt!IofCallDriver+0x55
ffff9184`330f48f0 fffff805`10e96def : ffffe688`00000000 ffff9184`330f4b80 00000000`00000000 ffff9184`330f4b80 : nt!IopSynchronousServiceTail+0x1a8
ffff9184`330f4990 fffff805`10c058b8 : 00000000`00000f8c 00000000`00000000 00000000`00000000 00000000`00000000 : nt!NtWriteFile+0x66f
ffff9184`330f4a90 00000000`77491cfc : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x28
00000000`083dee88 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x77491cfc
SYMBOL_NAME: FLTMGR!FltpPerformPreCallbacksWorker+408
MODULE_NAME: FLTMGR
IMAGE_NAME: FLTMGR.SYS
IMAGE_VERSION: 10.0.19041.264
STACK_COMMAND: .thread ; .cxr ; kb
BUCKET_ID_FUNC_OFFSET: 408
FAILURE_BUCKET_ID: AV_R_INVALID_FLTMGR!FltpPerformPreCallbacksWorker
OS_VERSION: 10.0.19041.1
BUILDLAB_STR: vb_release
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
FAILURE_ID_HASH: {dd10325a-c5bd-1cef-a36e-f0d4a059fb42}
Followup: MachineOwner
---------
11: kd> lmvm FLTMGR
Browse full module list
start end module name
fffff805`0c510000 fffff805`0c57f000 FLTMGR (pdb symbols) C:\ProgramData\Dbg\sym\fltMgr.pdb\C3CA0BC721B145FE4F45FF7F65B7C5AD1\fltMgr.pdb
Loaded symbol image file: FLTMGR.SYS
Mapped memory image file: C:\ProgramData\Dbg\sym\FLTMGR.SYS\02839B666f000\FLTMGR.SYS
Image path: \SystemRoot\System32\drivers\FLTMGR.SYS
Image name: FLTMGR.SYS
Browse all global symbols functions data
Image was built with /Brepro flag.
Timestamp: 02839B66 (This is a reproducible build file hash, not a timestamp)
CheckSum: 00072E12
ImageSize: 0006F000
File version: 10.0.19041.264
Product version: 10.0.19041.264
File flags: 0 (Mask 3F)
File OS: 40004 NT Win32
File type: 3.7 Driver
File date: 00000000.00000000
Translations: 0409.04b0
Information from resource tables:
CompanyName: Microsoft Corporation
ProductName: Microsoft® Windows® Operating System
InternalName: fltMgr.sys
OriginalFilename: fltMgr.sys
ProductVersion: 10.0.19041.264
FileVersion: 10.0.19041.264 (WinBuild.160101.0800)
FileDescription: Microsoft Filesystem Filter Manager
LegalCopyright: © Microsoft Corporation. All rights reserved.
Minidump.rar
drive.google.com