Minidump Analizi Yapabilenler Bu Konuya Lütfen Baksın

Emirhandkee

80+ Titanium
Katılım
25 Mart 2020
Mesajlar
22,710
En İyi Cevap
45
Reaksiyon skoru
20,609
Bir üyenin minidumpına bakarken FLTMGR.SYS kaynaklı bir sorun çıktı. Paylaştığım siteye göre de %22 şansla virüs olduğunu söylüyor. Dosya konumu başka bir yerdeydi.
Bu sorun neyden kaynaklı sizce?
.

PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced. This cannot be protected by try-except.
Typically the address is just plain bad or it is pointing at freed memory.
Arguments:
Arg1: ffffffffffffffe8, memory referenced.
Arg2: 0000000000000000, value 0 = read operation, 1 = write operation.
Arg3: fffff8050c516128, If non-zero, the instruction address which referenced the bad memory
address.
Arg4: 0000000000000002, (reserved)

Debugging Details:
------------------

KEY_VALUES_STRING: 1

Key : Analysis.CPU.mSec
Value: 6499

Key : Analysis.DebugAnalysisProvider.CPP
Value: Create: 8007007e on DESKTOP-I3EKBK0

Key : Analysis.DebugData
Value: CreateObject

Key : Analysis.DebugModel
Value: CreateObject

Key : Analysis.Elapsed.mSec
Value: 29650

Key : Analysis.Memory.CommitPeak.Mb
Value: 82

Key : Analysis.System
Value: CreateObject

Key : WER.OS.Branch
Value: vb_release

Key : WER.OS.Timestamp
Value: 2019-12-06T14:06:00Z

Key : WER.OS.Version
Value: 10.0.19041.1


ADDITIONAL_XML: 1

OS_BUILD_LAYERS: 1

BUGCHECK_CODE: 50

BUGCHECK_P1: ffffffffffffffe8

BUGCHECK_P2: 0

BUGCHECK_P3: fffff8050c516128

BUGCHECK_P4: 2

READ_ADDRESS: fffff805114fa390: Unable to get MiVisibleState
Unable to get NonPagedPoolStart
Unable to get NonPagedPoolEnd
Unable to get PagedPoolStart
Unable to get PagedPoolEnd
fffff8051140f2e0: Unable to get Flags value from nt!KdVersionBlock
fffff8051140f2e0: Unable to get Flags value from nt!KdVersionBlock
unable to get nt!MmSpecialPagesInUse
ffffffffffffffe8

MM_INTERNAL_CODE: 2

BLACKBOXBSD: 1 (!blackboxbsd)


BLACKBOXNTFS: 1 (!blackboxntfs)


BLACKBOXWINLOGON: 1

CUSTOMER_CRASH_COUNT: 1

PROCESS_NAME: steam.exe

TRAP_FRAME: ffff9184330f3c80 -- (.trap 0xffff9184330f3c80)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=ffffe688587d2d60 rbx=0000000000000000 rcx=ffffe688587d2eb0
rdx=fffff80512515d60 rsi=0000000000000000 rdi=0000000000000000
rip=fffff8050c516128 rsp=ffff9184330f3e10 rbp=ffff9184330f3ec9
r8=ffffffffffffffb8 r9=ffffe6886c67e4e0 r10=0000000000000001
r11=ffff837dd7c00001 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl zr na po nc
FLTMGR!FltpPerformPreCallbacksWorker+0x408:
fffff805`0c516128 418b5030 mov edx,dword ptr [r8+30h] ds:ffffffff`ffffffe8=????????
Resetting default scope

STACK_TEXT:
ffff9184`330f39d8 fffff805`10c86729 : 00000000`00000050 ffffffff`ffffffe8 00000000`00000000 ffff9184`330f3c80 : nt!KeBugCheckEx
ffff9184`330f39e0 fffff805`10aeeb80 : ffffe688`6cec8010 00000000`00000000 ffff9184`330f3d00 00000000`00000000 : nt!MiSystemFault+0x13faf9
ffff9184`330f3ae0 fffff805`10c0205e : 00000000`00000000 ffffe688`6e70cea8 ffffe688`5892e0a0 00000000`00000000 : nt!MmAccessFault+0x400
ffff9184`330f3c80 fffff805`0c516128 : ffffe688`6c67e460 00000000`00000001 ffffe688`6c67e5e8 ffffd086`79e18930 : nt!KiPageFault+0x35e
ffff9184`330f3e10 fffff805`0c515b37 : ffff9184`330f4000 ffff56a5`47571d04 ffff9184`330f4100 00000000`00000000 : FLTMGR!FltpPerformPreCallbacksWorker+0x408
ffff9184`330f3f30 fffff805`0c514b46 : ffff9184`330f5000 ffff9184`330ef000 00000000`00000000 ffff9184`330f4050 : FLTMGR!FltpPassThroughInternal+0xc7
ffff9184`330f3f80 fffff805`0c5148bb : ffff9184`330f4040 00000000`00000000 00000000`00000103 00000000`00000000 : FLTMGR!FltpPassThrough+0x1d6
ffff9184`330f4020 fffff805`10ad1f35 : ffffe688`6cec8010 fffff805`10ad1f77 00000000`0000000c 00000000`00000004 : FLTMGR!FltpDispatch+0x8b
ffff9184`330f4080 fffff805`10b39d33 : ffff9184`330f4190 ffffe688`6cec8010 ffffe688`6e603950 ffff9184`330f4150 : nt!IofCallDriver+0x55
ffff9184`330f40c0 fffff805`10a5fb6f : ffff9184`330f4190 ffff9184`330f4200 00000000`00000010 00000000`00000000 : nt!IoSynchronousPageWriteEx+0x13b
ffff9184`330f4100 fffff805`10a5f9c0 : 00040000`00000000 00000000`00200000 00000000`00000000 00000000`00000000 : nt!MiZeroPageWrite+0x177
ffff9184`330f42a0 fffff805`10a5f928 : 00000000`00200000 ffff9184`330f4700 ffffe688`6e603950 00000000`fffffe00 : nt!MmZeroPageWrite+0x48
ffff9184`330f42d0 fffff805`10a097f6 : 00000000`00200000 00000000`00e00000 00000002`e43a0000 fffff805`10b4b250 : nt!CcZeroDataOnDisk+0x38
ffff9184`330f4300 fffff805`126d5d63 : 00000000`00000000 00000002`e4200000 ffff9184`330f4420 00000000`00000001 : nt!CcZeroData+0x1f6
ffff9184`330f43c0 fffff805`12594890 : ffffe688`68975a78 ffffd086`78e816c0 ffffe688`6e603950 00000000`00000700 : Ntfs!NtfsZeroData+0x14b
ffff9184`330f44a0 fffff805`12592de3 : ffffe688`68975a78 ffffe688`6c2ac010 ffff9184`330f4740 00000000`00000000 : Ntfs!NtfsCommonWrite+0x1830
ffff9184`330f46d0 fffff805`10ad1f35 : ffffe688`6c452a20 ffffe688`6c2ac010 ffffe688`6c2ac010 ffffe688`587d2d60 : Ntfs!NtfsFsdWrite+0x1d3
ffff9184`330f47a0 fffff805`0c516ccf : ffffe688`586d6a20 ffffe688`5892e0a0 ffffe688`587858a0 ffffe688`6e603950 : nt!IofCallDriver+0x55
ffff9184`330f47e0 fffff805`0c5148d3 : ffff9184`330f4870 00000000`00000000 ffff9184`330f4900 ffff9184`330f4800 : FLTMGR!FltpLegacyProcessingAfterPreCallbacksCompleted+0x28f
ffff9184`330f4850 fffff805`10ad1f35 : ffffe688`6c2ac010 ffff9184`330f4a20 ffff9184`330f49e8 ffffe688`6e603950 : FLTMGR!FltpDispatch+0xa3
ffff9184`330f48b0 fffff805`10ea6fb8 : 00000000`00000001 ffffe688`6e603950 00000000`00000001 ffffe688`6c2ac3f8 : nt!IofCallDriver+0x55
ffff9184`330f48f0 fffff805`10e96def : ffffe688`00000000 ffff9184`330f4b80 00000000`00000000 ffff9184`330f4b80 : nt!IopSynchronousServiceTail+0x1a8
ffff9184`330f4990 fffff805`10c058b8 : 00000000`00000f8c 00000000`00000000 00000000`00000000 00000000`00000000 : nt!NtWriteFile+0x66f
ffff9184`330f4a90 00000000`77491cfc : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x28
00000000`083dee88 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x77491cfc


SYMBOL_NAME: FLTMGR!FltpPerformPreCallbacksWorker+408

MODULE_NAME: FLTMGR

IMAGE_NAME: FLTMGR.SYS

IMAGE_VERSION: 10.0.19041.264

STACK_COMMAND: .thread ; .cxr ; kb

BUCKET_ID_FUNC_OFFSET: 408

FAILURE_BUCKET_ID: AV_R_INVALID_FLTMGR!FltpPerformPreCallbacksWorker

OS_VERSION: 10.0.19041.1

BUILDLAB_STR: vb_release

OSPLATFORM_TYPE: x64

OSNAME: Windows 10

FAILURE_ID_HASH: {dd10325a-c5bd-1cef-a36e-f0d4a059fb42}

Followup: MachineOwner
---------

11: kd> lmvm FLTMGR
Browse full module list
start end module name
fffff805`0c510000 fffff805`0c57f000 FLTMGR (pdb symbols) C:\ProgramData\Dbg\sym\fltMgr.pdb\C3CA0BC721B145FE4F45FF7F65B7C5AD1\fltMgr.pdb
Loaded symbol image file: FLTMGR.SYS
Mapped memory image file: C:\ProgramData\Dbg\sym\FLTMGR.SYS\02839B666f000\FLTMGR.SYS
Image path: \SystemRoot\System32\drivers\FLTMGR.SYS
Image name: FLTMGR.SYS
Browse all global symbols functions data
Image was built with /Brepro flag.
Timestamp: 02839B66 (This is a reproducible build file hash, not a timestamp)
CheckSum: 00072E12
ImageSize: 0006F000
File version: 10.0.19041.264
Product version: 10.0.19041.264
File flags: 0 (Mask 3F)
File OS: 40004 NT Win32
File type: 3.7 Driver
File date: 00000000.00000000
Translations: 0409.04b0
Information from resource tables:
CompanyName: Microsoft Corporation
ProductName: Microsoft® Windows® Operating System
InternalName: fltMgr.sys
OriginalFilename: fltMgr.sys
ProductVersion: 10.0.19041.264
FileVersion: 10.0.19041.264 (WinBuild.160101.0800)
FileDescription: Microsoft Filesystem Filter Manager
LegalCopyright: © Microsoft Corporation. All rights reserved.
 
Dosya sistemi hatası olabilir.
CMD'yi yönetici olarak çalıştır ve chkdsk yaz.
Mesajlar otomatik olarak birleştirildi:

Çıkanı buraya at.
 
Türkçesine baktıgımda
Invalid system memory was referenced. This cannot be protected by try-except.
Typically the address is just plain bad or it is pointing at freed memory.
geçersız belleğe diyor dosya hatası olabilir @RTX3070 'in dediğini gibi cmd yi çalıştır chkdsk yaz
Mesajlar otomatik olarak birleştirildi:

Sorun bende değil.
Mesajlar otomatik olarak birleştirildi:


??
senın değilse ne bu anlat o zaman ?
 
senın değilse ne bu anlat o zaman ?
Konuda da bahsettiğim gibi analiz yaparken bununla karşılaştım. Neyden kaynaklandığını öğrenmek istiyorum ve çözümünü.
 
Bir üyenin minidumpına bakarken FLTMGR.SYS kaynaklı bir sorun çıktı. Paylaştığım siteye göre de %22 şansla virüs olduğunu söylüyor. Dosya konumu başka bir yerdeydi.
Bu sorun neyden kaynaklı sizce?
.

PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced. This cannot be protected by try-except.
Typically the address is just plain bad or it is pointing at freed memory.
Arguments:
Arg1: ffffffffffffffe8, memory referenced.
Arg2: 0000000000000000, value 0 = read operation, 1 = write operation.
Arg3: fffff8050c516128, If non-zero, the instruction address which referenced the bad memory
address.
Arg4: 0000000000000002, (reserved)

Debugging Details:
------------------

KEY_VALUES_STRING: 1

Key : Analysis.CPU.mSec
Value: 6499

Key : Analysis.DebugAnalysisProvider.CPP
Value: Create: 8007007e on DESKTOP-I3EKBK0

Key : Analysis.DebugData
Value: CreateObject

Key : Analysis.DebugModel
Value: CreateObject

Key : Analysis.Elapsed.mSec
Value: 29650

Key : Analysis.Memory.CommitPeak.Mb
Value: 82

Key : Analysis.System
Value: CreateObject

Key : WER.OS.Branch
Value: vb_release

Key : WER.OS.Timestamp
Value: 2019-12-06T14:06:00Z

Key : WER.OS.Version
Value: 10.0.19041.1


ADDITIONAL_XML: 1

OS_BUILD_LAYERS: 1

BUGCHECK_CODE: 50

BUGCHECK_P1: ffffffffffffffe8

BUGCHECK_P2: 0

BUGCHECK_P3: fffff8050c516128

BUGCHECK_P4: 2

READ_ADDRESS: fffff805114fa390: Unable to get MiVisibleState
Unable to get NonPagedPoolStart
Unable to get NonPagedPoolEnd
Unable to get PagedPoolStart
Unable to get PagedPoolEnd
fffff8051140f2e0: Unable to get Flags value from nt!KdVersionBlock
fffff8051140f2e0: Unable to get Flags value from nt!KdVersionBlock
unable to get nt!MmSpecialPagesInUse
ffffffffffffffe8

MM_INTERNAL_CODE: 2

BLACKBOXBSD: 1 (!blackboxbsd)


BLACKBOXNTFS: 1 (!blackboxntfs)


BLACKBOXWINLOGON: 1

CUSTOMER_CRASH_COUNT: 1

PROCESS_NAME: steam.exe

TRAP_FRAME: ffff9184330f3c80 -- (.trap 0xffff9184330f3c80)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=ffffe688587d2d60 rbx=0000000000000000 rcx=ffffe688587d2eb0
rdx=fffff80512515d60 rsi=0000000000000000 rdi=0000000000000000
rip=fffff8050c516128 rsp=ffff9184330f3e10 rbp=ffff9184330f3ec9
r8=ffffffffffffffb8 r9=ffffe6886c67e4e0 r10=0000000000000001
r11=ffff837dd7c00001 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl zr na po nc
FLTMGR!FltpPerformPreCallbacksWorker+0x408:
fffff805`0c516128 418b5030 mov edx,dword ptr [r8+30h] ds:ffffffff`ffffffe8=????????
Resetting default scope

STACK_TEXT:
ffff9184`330f39d8 fffff805`10c86729 : 00000000`00000050 ffffffff`ffffffe8 00000000`00000000 ffff9184`330f3c80 : nt!KeBugCheckEx
ffff9184`330f39e0 fffff805`10aeeb80 : ffffe688`6cec8010 00000000`00000000 ffff9184`330f3d00 00000000`00000000 : nt!MiSystemFault+0x13faf9
ffff9184`330f3ae0 fffff805`10c0205e : 00000000`00000000 ffffe688`6e70cea8 ffffe688`5892e0a0 00000000`00000000 : nt!MmAccessFault+0x400
ffff9184`330f3c80 fffff805`0c516128 : ffffe688`6c67e460 00000000`00000001 ffffe688`6c67e5e8 ffffd086`79e18930 : nt!KiPageFault+0x35e
ffff9184`330f3e10 fffff805`0c515b37 : ffff9184`330f4000 ffff56a5`47571d04 ffff9184`330f4100 00000000`00000000 : FLTMGR!FltpPerformPreCallbacksWorker+0x408
ffff9184`330f3f30 fffff805`0c514b46 : ffff9184`330f5000 ffff9184`330ef000 00000000`00000000 ffff9184`330f4050 : FLTMGR!FltpPassThroughInternal+0xc7
ffff9184`330f3f80 fffff805`0c5148bb : ffff9184`330f4040 00000000`00000000 00000000`00000103 00000000`00000000 : FLTMGR!FltpPassThrough+0x1d6
ffff9184`330f4020 fffff805`10ad1f35 : ffffe688`6cec8010 fffff805`10ad1f77 00000000`0000000c 00000000`00000004 : FLTMGR!FltpDispatch+0x8b
ffff9184`330f4080 fffff805`10b39d33 : ffff9184`330f4190 ffffe688`6cec8010 ffffe688`6e603950 ffff9184`330f4150 : nt!IofCallDriver+0x55
ffff9184`330f40c0 fffff805`10a5fb6f : ffff9184`330f4190 ffff9184`330f4200 00000000`00000010 00000000`00000000 : nt!IoSynchronousPageWriteEx+0x13b
ffff9184`330f4100 fffff805`10a5f9c0 : 00040000`00000000 00000000`00200000 00000000`00000000 00000000`00000000 : nt!MiZeroPageWrite+0x177
ffff9184`330f42a0 fffff805`10a5f928 : 00000000`00200000 ffff9184`330f4700 ffffe688`6e603950 00000000`fffffe00 : nt!MmZeroPageWrite+0x48
ffff9184`330f42d0 fffff805`10a097f6 : 00000000`00200000 00000000`00e00000 00000002`e43a0000 fffff805`10b4b250 : nt!CcZeroDataOnDisk+0x38
ffff9184`330f4300 fffff805`126d5d63 : 00000000`00000000 00000002`e4200000 ffff9184`330f4420 00000000`00000001 : nt!CcZeroData+0x1f6
ffff9184`330f43c0 fffff805`12594890 : ffffe688`68975a78 ffffd086`78e816c0 ffffe688`6e603950 00000000`00000700 : Ntfs!NtfsZeroData+0x14b
ffff9184`330f44a0 fffff805`12592de3 : ffffe688`68975a78 ffffe688`6c2ac010 ffff9184`330f4740 00000000`00000000 : Ntfs!NtfsCommonWrite+0x1830
ffff9184`330f46d0 fffff805`10ad1f35 : ffffe688`6c452a20 ffffe688`6c2ac010 ffffe688`6c2ac010 ffffe688`587d2d60 : Ntfs!NtfsFsdWrite+0x1d3
ffff9184`330f47a0 fffff805`0c516ccf : ffffe688`586d6a20 ffffe688`5892e0a0 ffffe688`587858a0 ffffe688`6e603950 : nt!IofCallDriver+0x55
ffff9184`330f47e0 fffff805`0c5148d3 : ffff9184`330f4870 00000000`00000000 ffff9184`330f4900 ffff9184`330f4800 : FLTMGR!FltpLegacyProcessingAfterPreCallbacksCompleted+0x28f
ffff9184`330f4850 fffff805`10ad1f35 : ffffe688`6c2ac010 ffff9184`330f4a20 ffff9184`330f49e8 ffffe688`6e603950 : FLTMGR!FltpDispatch+0xa3
ffff9184`330f48b0 fffff805`10ea6fb8 : 00000000`00000001 ffffe688`6e603950 00000000`00000001 ffffe688`6c2ac3f8 : nt!IofCallDriver+0x55
ffff9184`330f48f0 fffff805`10e96def : ffffe688`00000000 ffff9184`330f4b80 00000000`00000000 ffff9184`330f4b80 : nt!IopSynchronousServiceTail+0x1a8
ffff9184`330f4990 fffff805`10c058b8 : 00000000`00000f8c 00000000`00000000 00000000`00000000 00000000`00000000 : nt!NtWriteFile+0x66f
ffff9184`330f4a90 00000000`77491cfc : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x28
00000000`083dee88 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x77491cfc


SYMBOL_NAME: FLTMGR!FltpPerformPreCallbacksWorker+408

MODULE_NAME: FLTMGR

IMAGE_NAME: FLTMGR.SYS

IMAGE_VERSION: 10.0.19041.264

STACK_COMMAND: .thread ; .cxr ; kb

BUCKET_ID_FUNC_OFFSET: 408

FAILURE_BUCKET_ID: AV_R_INVALID_FLTMGR!FltpPerformPreCallbacksWorker

OS_VERSION: 10.0.19041.1

BUILDLAB_STR: vb_release

OSPLATFORM_TYPE: x64

OSNAME: Windows 10

FAILURE_ID_HASH: {dd10325a-c5bd-1cef-a36e-f0d4a059fb42}

Followup: MachineOwner
---------

11: kd> lmvm FLTMGR
Browse full module list
start end module name
fffff805`0c510000 fffff805`0c57f000 FLTMGR (pdb symbols) C:\ProgramData\Dbg\sym\fltMgr.pdb\C3CA0BC721B145FE4F45FF7F65B7C5AD1\fltMgr.pdb
Loaded symbol image file: FLTMGR.SYS
Mapped memory image file: C:\ProgramData\Dbg\sym\FLTMGR.SYS\02839B666f000\FLTMGR.SYS
Image path: \SystemRoot\System32\drivers\FLTMGR.SYS
Image name: FLTMGR.SYS
Browse all global symbols functions data
Image was built with /Brepro flag.
Timestamp: 02839B66 (This is a reproducible build file hash, not a timestamp)
CheckSum: 00072E12
ImageSize: 0006F000
File version: 10.0.19041.264
Product version: 10.0.19041.264
File flags: 0 (Mask 3F)
File OS: 40004 NT Win32
File type: 3.7 Driver
File date: 00000000.00000000
Translations: 0409.04b0
Information from resource tables:
CompanyName: Microsoft Corporation
ProductName: Microsoft® Windows® Operating System
InternalName: fltMgr.sys
OriginalFilename: fltMgr.sys
ProductVersion: 10.0.19041.264
FileVersion: 10.0.19041.264 (WinBuild.160101.0800)
FileDescription: Microsoft Filesystem Filter Manager
LegalCopyright: © Microsoft Corporation. All rights reserved.
hocam geçen günde bir arkadaşın mavi ekran hatasını çözdüğümüzde hata kodu farklıydı ama procces_Name steam.exe idi önce steamı kaldırdı sonra virüs taraması yaptırdı sisteme sonra driverleri yüklemişti anakartın sitesinden ekran kartı driverini güncellemişti düzelmişti hatası belki windows bu hatada zararlı yazılım olarak algılamış olabilir steam ı arkadaşın eran kartı amd ise whql driveri yüklü değil ise whql driveri kursun bu hata bazen ekran kartı sürücü hatasıda olabiliyor
 
hocam geçen günde bir arkadaşın mavi ekran hatasını çözdüğümüzde hata kodu farklıydı ama procces_Name steam.exe idi önce steamı kaldırdı sonra virüs taraması yaptırdı sisteme sonra driverleri yüklemişti anakartın sitesinden ekran kartı driverini güncellemişti düzelmişti hatası belki windows bu hatada zararlı yazılım olarak algılamış olabilir steam ı arkadaşın eran kartı amd ise whql driveri yüklü değil ise whql driveri kursun bu hata bazen ekran kartı sürücü hatasıda olabiliyor
Sürücü bozulmuş olabilir ama bu güncellenmiyor bile...
Mesajlar otomatik olarak birleştirildi:

Ne ara baktınız?
 
Geri
Top