Hallo zusammen,
ich habe ein Problem, bei dem ich einfach nicht mehr weiter komme:
Ich habe eine relativ neue Installation von 2012 R2 und bekomme mehrmals Täglich eine BSOD. In der Blue Screen wird auf tcpip.sys verwiesen.
Bisher habe ich leider noch nichts gefunden, wie sich das Problem beheben ließe und mir gehen die Ideen aus.
Vielleicht hat ja hier jemand eine Idee ... :-/
BlueScreenView meint folgendes:
==================================================
Dump File : 081215-20888-01.dmp
Crash Time : 12.08.2015 16:09:56
Bug Check String : DRIVER_IRQL_NOT_LESS_OR_EQUAL
Bug Check Code : 0x000000d1
Parameter 1 : 00000000`00000008
Parameter 2 : 00000000`00000002
Parameter 3 : 00000000`00000000
Parameter 4 : fffff880`01b6247d
Caused By Driver : tcpip.sys
Caused By Address : tcpip.sys+7547d
File Description : TCP/IP-Treiber
Product Name : Betriebssystem Microsoft® Windows®
Company : Microsoft Corporation
File Version : 6.2.9200.16384 (win8_rtm.120725-1247)
Processor : x64
Crash Address : ntoskrnl.exe+5a440
Stack Address 1 :
Stack Address 2 :
Stack Address 3 :
Computer Name :
Full Path : C:\Windows\Minidump\081215-20888-01.dmp
Processors Count : 2
Major Version : 15
Minor Version : 9200
Dump File Size : 130.248
Dump File Time : 12.08.2015 16:10:27
==================================================
und WinDbg dies:
0: kd> !analyze -v
*******************************************************************************
*
*
* Bugcheck Analysis
*
*
*
*******************************************************************************
DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: 0000000000000008, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000000, value 0 = read operation, 1 = write operation
Arg4: fffff88001b6247d, address which referenced memory
Debugging Details:
------------------
VIRTUAL_MACHINE: VMware
SYSTEM_VERSION: None
BIOS_DATE: 04/14/2014
BASEBOARD_PRODUCT: 440BX Desktop Reference Platform
BASEBOARD_VERSION: None
DUMP_FILE_ATTRIBUTES: 0x8
Kernel Generated Triage Dump
BUGCHECK_P1: 8
BUGCHECK_P2: 2
BUGCHECK_P3: 0
BUGCHECK_P4: fffff88001b6247d
READ_ADDRESS: GetPointerFromAddress: unable to read from fffff801437c7168
GetUlongPtrFromAddress: unable to read from fffff801437c7370
GetUlongPtrFromAddress: unable to read from fffff801437c7488
0000000000000008 Nonpaged pool
CURRENT_IRQL: 2
FAULTING_IP:
tcpip!TcpIndicateData+193
fffff880`01b6247d 488b4208 mov rax,qword ptr [rdx+8]
CPU_COUNT: 2
CPU_MHZ: a64
CPU_VENDOR: GenuineIntel
CPU_FAMILY: 6
CPU_MODEL: 2c
CPU_STEPPING: 2
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: WIN8_DRIVER_FAULT_SERVER
BUGCHECK_STR: AV
PROCESS_NAME: svchost.exe
ANALYSIS_VERSION: 10.0.10240.9 x86fre
TRAP_FRAME: fffff88002ec6f50 -- (.trap 0xfffff88002ec6f50)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=fffffa800a00cd50 rbx=0000000000000000 rcx=fffffa80075f1b80
rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000
rip=fffff88001b6247d rsp=fffff88002ec70e0 rbp=fffff88002ec71a9
r8=0000000000000000 r9=0000000000000000 r10=fffffa8006a35020
r11=fffff88002ec6e10 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei ng nz ac po cy
tcpip!TcpIndicateData+0x193:
fffff880`01b6247d 488b4208 mov rax,qword ptr [rdx+8] ds:00000000`00000008=????????????????
Resetting default scope
LAST_CONTROL_TRANSFER: from fffff801434c8769 to fffff801434c9440
STACK_TEXT:
fffff880`02ec6e08 fffff801`434c8769 : 00000000`0000000a 00000000`00000008 00000000`00000002 00000000`00000000 : nt!KeBugCheckEx
fffff880`02ec6e10 fffff801`434c6fe0 : 00000000`00000000 00000000`00000000 fffff880`02ec7000 fffff880`02ec6f50 : nt!KiBugCheckDispatch+0x69
fffff880`02ec6f50 fffff880`01b6247d : 00000000`00000000 00000000`00000000 fffffa80`076b30e0 fffff880`02ec7810 : nt!KiPageFault+0x260
fffff880`02ec70e0 fffff880`01b60d90 : fffff880`0200ff02 fffffa80`08ce1de8 fffff880`02ec72a0 fffff880`02ec7250 : tcpip!TcpIndicateData+0x193
fffff880`02ec7200 fffff880`01b62870 : fffffa80`07008501 fffff880`02ec3fef fffffa80`075ef4d0 00000000`00000000 : tcpip!TcpDeliverDataToClient+0x290
fffff880`02ec7370 fffff880`01b5b0b6 : 00000000`00000000 fffff880`02ec7810 00000000`00000001 fffffa80`05a11850 : tcpip!TcpDeliverReceive+0xa0
fffff880`02ec7460 fffff880`01b59737 : fffffa80`09a9f890 fffff880`02ec7710 fffff880`02ec7ad0 00000000`00000000 : tcpip!TcpTcbFastDatagram+0x246
fffff880`02ec7640 fffff880`01b587c0 : fffff880`02ec7bb8 fffff880`02ec7ba8 fffff880`02ec77b0 00000000`00000000 : tcpip!TcpTcbReceive+0x207
fffff880`02ec77a0 fffff880`01b59eb1 : fffffa80`08590fcc fffffa80`05b6e000 00000000`00000000 fffffa80`05b6e000 : tcpip!TcpMatchReceive+0x1f0
fffff880`02ec7910 fffff880`01b6be83 : fffffa80`05b27880 00000000`00008501 fffffa80`05b63fef fffffa80`05b27880 : tcpip!TcpPreValidatedReceive+0x381
fffff880`02ec79f0 fffff880`01b6c198 : fffff880`02ec7c19 00000000`0000000c 00000000`00000000 00000000`00000000 : tcpip!IppDeliverListToProtocol+0x93
fffff880`02ec7aa0 fffff880`01b7021b : fffff880`01c7eb90 fffffa80`079c2040 fffff880`02ec7b88 fffff880`02ec7bb8 : tcpip!IppProcessDeliverList+0x68
fffff880`02ec7b50 fffff880`01b6dc71 : fffff880`01c7eb90 fffffa80`05b6e000 00000000`00000000 fffff880`01c7eb90 : tcpip!IppReceiveHeaderBatch+0x21b
fffff880`02ec7c80 fffff880`01be85b4 : fffffa80`07996a80 00000000`00000000 00000000`00000001 fffff880`02ec8001 : tcpip!IpFlcReceivePackets+0x641
fffff880`02ec7eb0 fffff880`01d288e5 : fffff880`02ec7f02 fffff880`02ec7fd0 fffff880`02d310c9 00000000`00000000 : tcpip!IppInspectInjectReceive+0x108
fffff880`02ec7ef0 fffff801`434c3ae7 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : fwpkclnt!FwppInjectionStackCallout+0xe5
fffff880`02ec7f80 fffff801`434c3aad : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KxSwitchKernelStackCallout+0x27
fffff880`02d30e80 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSwitchKernelStackContinue
STACK_COMMAND: kb
FOLLOWUP_IP:
fwpkclnt!FwppInjectionStackCallout+e5
fffff880`01d288e5 4881c488000000 add rsp,88h
SYMBOL_STACK_INDEX: f
SYMBOL_NAME: fwpkclnt!FwppInjectionStackCallout+e5
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: fwpkclnt
IMAGE_NAME: fwpkclnt.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 513034da
IMAGE_VERSION: 6.2.9200.16547
BUCKET_ID_FUNC_OFFSET: e5
FAILURE_BUCKET_ID: AV_fwpkclnt!FwppInjectionStackCallout
BUCKET_ID: AV_fwpkclnt!FwppInjectionStackCallout
PRIMARY_PROBLEM_CLASS: AV_fwpkclnt!FwppInjectionStackCallout
ANALYSIS_SOURCE: KM
FAILURE_ID_HASH_STRING: km:av_fwpkclnt!fwppinjectionstackcallout
FAILURE_ID_HASH: {4b31b1d7-9ee0-b8a2-65c2-e4ff83df76e2}
Followup: MachineOwner
========================================================
Kann mir irgendjemand einen Tip geben, wie ich hier weiter komme, oder woran ich drehen kann?
Viele Grüße
Todie