Hallo leute habe bei meiner freundin das windows neu gemacht und alle treiber vom hersteller acer drauf gemacht , nun sollt ich das game Hexenkönig (heer der ringe II Adon) drauf machen . Das broblem ist wen das game beginnt kommt so fort ein blue screem Stop:0x00000008(00000005)......... und so weiter es steht nichts weiter da . habe schon alls autostart programme aus gemacht dieverse geräte deaktevirt . ich hoffe ihr könnt mir helfen danke schon mal.


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:56:55, on 16.12.2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16762)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Programme\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Programme\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Programme\Alcohol Soft\Alcohol 52\StarWind\StarWindServiceAE.exe
C:\Programme\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\Programme\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\WINDOWS\AGRSMMSG.exe
C:\PROGRA~1\LAUNCH~1\QtZpAcer.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\Programme\ICQ6.5\ICQ.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programme\REALTEK Semiconductor Corp\REALTEK RTL8180 Wireless LAN Driver and Utility\RtlWake.exe
C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe
C:\WINDOWS\winhlp32.exe
C:\Programme\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [avgnt] "C:\Programme\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [ATIPTA] C:\Programme\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [LManager] C:\PROGRA~1\LAUNCH~1\QtZpAcer.EXE
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKCU\..\Run: [ICQ] "C:\Programme\ICQ6.5\ICQ.exe" silent
O4 - HKCU\..\Run: [AlcoholAutomount] "C:\Programme\Alcohol Soft\Alcohol 52\axcmd.exe" /automount
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [DriverUpdaterPro] C:\Programme\iXi Tools\Driver Updater Pro\DriverUpdaterPro.exe -t
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETZWERKDIENST')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: RocketDock.lnk = C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe
O4 - Global Startup: RtlWake.lnk = ?
O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Programme\ICQ6.5\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Programme\ICQ6.5\ICQ.exe
O9 - Extra button: @C:\Programme\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: @C:\Programme\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/res...scbase6662.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/wind...?1229343150485
O23 - Service: Avira AntiVir Personal - Free Antivirus Planer (AntiVirScheduler) - Avira GmbH - C:\Programme\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Programme\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - C:\Programme\Alcohol Soft\Alcohol 52\StarWind\StarWindServiceAE.exe
O23 - Service: TuneUp Drive Defrag-Dienst (TuneUp.Defrag) - TuneUp Software GmbH - C:\WINDOWS\System32\TuneUpDefragService.exe

--
End of file - 4593 bytes
Mit Zitat antworten

Einfach mal in mehreren Boards posten ist kein guter Stil. Doppelte Arbeit, mehr Konfusion. Zudem hast Du Dich in dem anderen Forum schon nicht mit Ruhm bekleckert.
Blue Screem - Forum - CHIP Online

Ich dacht hier kann mir jemand helfen will doch nur versuchen das ding wieder hin zu bekommen das mit den dopleten posten ist nicht böse gemeint . wirklich helfen konnte bis jetzt mir keiner. habe alles nach guten wiesen reingeschrieben
.

Hai....

Aktualisiere alle Treiber(keine Betas), wenn das nicht hilft weiterlesen...

1. Lade dir mal WinDbg und installier es. Und installier die Symbole auch gleich noch mit.

2. Start>Systemsteuerung>System>Erweitert und bei "Starten und Wiederherstellen" auf Einstellungen. "Debuginformationen speichern" das erste Feld danach "Vollständiges Speicherabbild" wählen beim zweiten Feld sollte das drin stehen: "%SystemRoot%\MEMORY.DMP"

3. Auf Bluescreen warten, und wenns kommt Speicherabbild erstellen lassen.

4. WinDbg starten dann auf "File>Open Crash Dump" dann einfach "%SystemRoot%\MEMORY.DMP" eingeben und Öffnen. Das kann etwas dauern nicht denken das Prog hat sich aufgehängt oder so...nachdem die Datei ausgewertet wurde sollte irgendwo ein wort namens analyze stehen und zwar in Form eines Linkes einfach drauf klicken.

Poste hier mal das Ergebnis ich hoffe ich habe alles richtig erklärt und du verstehst es.

Bitte schön ich hoffe ich habs richtig gemacht .wen nicht versuche ich es noch mal mit hilfe .








*************************************************************************
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: kernel32!pNlsUserInfo ***
*** ***
*************************************************************************

FAULTING_MODULE: 804d7000 nt

DEBUG_FLR_IMAGE_TIMESTAMP: 3f205a02

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - Die Anweisung in "0x%08lx" verweist auf Speicher in "0x%08lx". Der Vorgang "%s" konnte nicht auf dem Speicher durchgef hrt werden.

FAULTING_IP:
+f
0000000f ?? ???

TRAP_FRAME: b20a9b34 -- (.trap 0xffffffffb20a9b34)
ErrCode = 00000000
eax=00000003 ebx=e1eb1f20 ecx=000000c0 edx=00007031 esi=0022b928 edi=e1ec1000
eip=0000000f esp=b20a9ba8 ebp=e14b9010 iopl=0 nv up ei ng nz ac po nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010292
0000000f ?? ???
Resetting default scope

DEFAULT_BUCKET_ID: WRONG_SYMBOLS

BUGCHECK_STR: 0x8E

LAST_CONTROL_TRANSFER: from 8051d8cd to 805337a6

STACK_TEXT:
WARNING: Stack unwind information not available. Following frames may be wrong.
b20a96fc 8051d8cd 0000008e c0000005 0000000f nt!KeBugCheckEx+0x1b
b20a9ac4 804df235 b20a9ae0 00000000 b20a9b34 nt!IoSetFileOrigin+0x58e9
b20a9bbc bfabbe61 e14b9010 00000004 00000858 nt!Kei386EoiHelper+0x1d9
b20a9c10 80568c8c c0300020 e14a1010 bfab94c3 ati3d2ag+0x88e61
b20a9c1c bfab94c3 b20a9ce4 e1719430 00000000 nt!NtAllocateVirtualMemory+0x30f
b20a9c2c bf961843 b20a9ce4 00000020 0000000d ati3d2ag+0x864c3
00000000 00000000 00000000 00000000 00000000 win32k!XLATEOBJ_hGetColorTransform+0x1a440


STACK_COMMAND: kb

FOLLOWUP_IP:
ati3d2ag+88e61
bfabbe61 8bd8 mov ebx,eax

SYMBOL_STACK_INDEX: 3

SYMBOL_NAME: ati3d2ag+88e61

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: ati3d2ag

IMAGE_NAME: ati3d2ag.dll

BUCKET_ID: WRONG_SYMBOLS

Followup: MachineOwner
---------

Mhh sieht sehr danach aus, dass dein Grafikkartentreiber Probleme macht.

1. Grafikkartentreiber deinstallieren

2. Neusten Grafikkartentreiber installieren.

Falls du nicht weisst was für eine Graka du hast lade dir Everest runter dort kannst du gut nachsehen was für eine du verbaut hast.

Lg Enrib

das troblem ist ich findte keine treiber bei ati für die mobily Randeom 9200. den ich da downloaden kann .Der omega treiber der im internet rum schiwrt geht auch nicht.

Zitat von DPBLandser88

mobily Randeom 9200

Mobility Radeon 9200 klingt doch verdächtig nach Acer Aspire 1350 (Danke für diese Info)

Alten Treiber deinstallieren und es dann mal mit dem hier erhältlichen versuchen.

mit diesen geht es ja nicht vom hersteller .:-(

Zitat von DPBLandser88

mit diesen geht es ja nicht vom hersteller .:-(

Was geht da nicht genau?

Na der treiber von acer geht nicht also es kommt immer noch ein blue screm beim game starten

Lad bitte Deine komplette Memory.dmp irgendwo hoch und poste mir den Link

Gruß cad

Da bitte schön ich hoffe es ist richtig



Microsoft (R) Windows Debugger Version 6.10.0003.233 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\WINDOWS\MEMORY.DMP]
Kernel Complete Dump File: Full address space is available

Symbol search path is: C:\WINDOWS\Symbols
Executable search path is:
*** ERROR: Symbol file could not be found. Defaulted to export symbols for ntoskrnl.exe -
Windows XP Kernel Version 2600 (Service Pack 2) UP Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 2600.xpsp_sp2_qfe.080814-1242
Machine Name:
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055b0c0
Debug session time: Mon Dec 22 11:27:32.536 2008 (GMT+1)
System Uptime: 0 days 0:05:45.107
*** ERROR: Symbol file could not be found. Defaulted to export symbols for ntoskrnl.exe -
Loading Kernel Symbols
...............................................................
................................................................
......
Loading User Symbols
................................................................
.....
Loading unloaded module list
..........*** ERROR: Symbol file could not be found. Defaulted to export symbols for ntdll.dll -

*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck D1, {0, 2, 1, 804d132b}

*** ERROR: Module load completed but symbols could not be loaded for mssmbios.sys
***** Kernel symbols are WRONG. Please fix symbols to do analysis.

*** ERROR: Symbol file could not be found. Defaulted to export symbols for RocketDock.dll -
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
*************************************************************************
*** ERROR: Symbol file could not be found. Defaulted to export symbols for kernel32.dll -
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: kernel32!pNlsUserInfo ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: kernel32!pNlsUserInfo ***
*** ***
*************************************************************************
Probably caused by : ntoskrnl.exe ( nt!Kei386EoiHelper+2823 )

Followup: MachineOwner
---------

kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: 00000000, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000001, value 0 = read operation, 1 = write operation
Arg4: 804d132b, address which referenced memory

Debugging Details:
------------------

***** Kernel symbols are WRONG. Please fix symbols to do analysis.

*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: kernel32!pNlsUserInfo ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: kernel32!pNlsUserInfo ***
*** ***
*************************************************************************

MODULE_NAME: nt

FAULTING_MODULE: 804d7000 nt

DEBUG_FLR_IMAGE_TIMESTAMP: 48a4016e

WRITE_ADDRESS: unable to get nt!MmSpecialPoolStart
unable to get nt!MmSpecialPoolEnd
unable to get nt!MmPoolCodeStart
unable to get nt!MmPoolCodeEnd
00000000

CURRENT_IRQL: 2

FAULTING_IP:
+ffffffff804d132b
804d132b 0000 add byte ptr [eax],al

DEFAULT_BUCKET_ID: WRONG_SYMBOLS

BUGCHECK_STR: 0xD1

LAST_CONTROL_TRANSFER: from 6e2f127b to 804e187f

STACK_TEXT:
WARNING: Stack unwind information not available. Following frames may be wrong.
ba7b9c4c 6e2f127b 565f68b5 b8a4af03 d2c6d79a nt!Kei386EoiHelper+0x2823
ba7b9c50 565f68b5 b8a4af03 d2c6d79a 764e3af9 0x6e2f127b
ba7b9c54 b8a4af03 d2c6d79a 764e3af9 81e5ea36 0x565f68b5
ba7b9c58 d2c6d79a 764e3af9 81e5ea36 99c5638b 0xb8a4af03
ba7b9c5c 764e3af9 81e5ea36 99c5638b 0449d34c 0xd2c6d79a
ba7b9c60 81e5ea36 99c5638b 0449d34c 9c3a546b 0x764e3af9
ba7b9c64 99c5638b 0449d34c 9c3a546b 6b04f316 0x81e5ea36
ba7b9c68 0449d34c 9c3a546b 6b04f316 de384096 0x99c5638b
ba7b9c6c 9c3a546b 6b04f316 de384096 e32217c3 0x449d34c
ba7b9c70 6b04f316 de384096 e32217c3 ab8f1d73 0x9c3a546b
ba7b9c74 de384096 e32217c3 ab8f1d73 204ba63b 0x6b04f316
ba7b9c78 e32217c3 ab8f1d73 204ba63b 37059ace 0xde384096
ba7b9c7c ab8f1d73 204ba63b 37059ace bdf2f9ea 0xe32217c3
ba7b9c80 204ba63b 37059ace bdf2f9ea 9c7e3dc1 0xab8f1d73
ba7b9c84 37059ace bdf2f9ea 9c7e3dc1 f4f2ce27 0x204ba63b
ba7b9c88 bdf2f9ea 9c7e3dc1 f4f2ce27 7a1c5dfa 0x37059ace
ba7b9c8c 9c7e3dc1 f4f2ce27 7a1c5dfa 81a9ad85 0xbdf2f9ea
ba7b9c90 f4f2ce27 7a1c5dfa 81a9ad85 32d73eea 0x9c7e3dc1
ba7b9c94 7a1c5dfa 81a9ad85 32d73eea b5410367 0xf4f2ce27
ba7b9c98 81a9ad85 32d73eea b5410367 47fd6983 0x7a1c5dfa
ba7b9c9c 32d73eea b5410367 47fd6983 7baf87f8 0x81a9ad85
ba7b9ca0 b5410367 47fd6983 7baf87f8 d2b454b7 0x32d73eea
ba7b9ca4 47fd6983 7baf87f8 d2b454b7 918180b9 0xb5410367
ba7b9ca8 7baf87f8 d2b454b7 918180b9 adeff5c3 0x47fd6983
ba7b9cac d2b454b7 918180b9 adeff5c3 150aa9a6 0x7baf87f8
ba7b9cb0 918180b9 adeff5c3 150aa9a6 86f3aabc 0xd2b454b7
ba7b9cb4 adeff5c3 150aa9a6 86f3aabc cf60296b 0x918180b9
ba7b9cb8 150aa9a6 86f3aabc cf60296b 6865f7a2 0xadeff5c3
ba7b9cbc 86f3aabc cf60296b 6865f7a2 700bc768 0x150aa9a6
ba7b9cc0 cf60296b 6865f7a2 700bc768 a9b83d1a 0x86f3aabc
ba7b9cc4 6865f7a2 700bc768 a9b83d1a f9c4f0f8 0xcf60296b
ba7b9cc8 700bc768 a9b83d1a f9c4f0f8 426373e8 0x6865f7a2
ba7b9ccc a9b83d1a f9c4f0f8 426373e8 d9ed3c47 0x700bc768
ba7b9cd0 f9c4f0f8 426373e8 d9ed3c47 cdb3fee1 0xa9b83d1a
ba7b9cd4 426373e8 d9ed3c47 cdb3fee1 f4e3c788 0xf9c4f0f8
ba7b9cd8 d9ed3c47 cdb3fee1 f4e3c788 b50ae12d 0x426373e8
ba7b9cdc cdb3fee1 f4e3c788 b50ae12d dbd35baa 0xd9ed3c47
ba7b9ce0 f4e3c788 b50ae12d dbd35baa c79a6791 0xcdb3fee1
ba7b9ce4 b50ae12d dbd35baa c79a6791 e1a12bb8 0xf4e3c788
ba7b9ce8 dbd35baa c79a6791 e1a12bb8 ebc16b23 0xb50ae12d
ba7b9cec c79a6791 e1a12bb8 ebc16b23 0be8c135 0xdbd35baa
ba7b9cf0 e1a12bb8 ebc16b23 0be8c135 b9ffd4ed 0xc79a6791
ba7b9cf4 ebc16b23 0be8c135 b9ffd4ed 1e444b20 0xe1a12bb8
ba7b9cf8 0be8c135 b9ffd4ed 1e444b20 21e54720 0xebc16b23
ba7b9cfc b9ffd4ed 1e444b20 21e54720 e34a5e5d 0xbe8c135
ba7b9d00 1e444b20 21e54720 e34a5e5d e93b93d1 0xb9ffd4ed
ba7b9d04 21e54720 e34a5e5d e93b93d1 b801d3d6 0x1e444b20
ba7b9d08 e34a5e5d e93b93d1 b801d3d6 4a7e0c20 0x21e54720
ba7b9d0c e93b93d1 b801d3d6 4a7e0c20 77389e0f 0xe34a5e5d
ba7b9d10 b801d3d6 4a7e0c20 77389e0f b06ae360 0xe93b93d1
ba7b9d14 4a7e0c20 77389e0f b06ae360 6c7d474b 0xb801d3d6
ba7b9d18 77389e0f b06ae360 6c7d474b eb36f233 0x4a7e0c20
ba7b9d1c b06ae360 6c7d474b eb36f233 2693fa5e 0x77389e0f
ba7b9d20 6c7d474b eb36f233 2693fa5e cf32b6b6 0xb06ae360
ba7b9d24 eb36f233 2693fa5e cf32b6b6 3e4d52c4 0x6c7d474b
ba7b9d28 2693fa5e cf32b6b6 3e4d52c4 8eacdf31 0xeb36f233
ba7b9d2c cf32b6b6 3e4d52c4 8eacdf31 4b960c14 0x2693fa5e
ba7b9d30 3e4d52c4 8eacdf31 4b960c14 8285c6d1 0xcf32b6b6
ba7b9d34 8eacdf31 4b960c14 8285c6d1 c8485a70 0x3e4d52c4
ba7b9d38 4b960c14 8285c6d1 c8485a70 5ebbc963 0x8eacdf31
ba7b9d3c 8285c6d1 c8485a70 5ebbc963 f0edc29d 0x4b960c14
ba7b9d40 c8485a70 5ebbc963 f0edc29d 0fbfa076 0x8285c6d1
ba7b9d44 5ebbc963 f0edc29d 0fbfa076 6a79e31d 0xc8485a70
ba7b9d48 f0edc29d 0fbfa076 6a79e31d ec458912 0x5ebbc963
ba7b9d4c 0fbfa076 6a79e31d ec458912 022f064d 0xf0edc29d
ba7b9d50 6a79e31d ec458912 022f064d bcc9b644 0xfbfa076
ba7b9d54 ec458912 022f064d bcc9b644 e5ca139a 0x6a79e31d
ba7b9d58 022f064d bcc9b644 e5ca139a a85c291f 0xec458912
ba7b9d5c bcc9b644 e5ca139a a85c291f fb20e7f5 0x22f064d
ba7b9d60 e5ca139a a85c291f fb20e7f5 c54e4d31 0xbcc9b644
ba7b9d64 a85c291f fb20e7f5 c54e4d31 64a71344 0xe5ca139a
ba7b9d68 fb20e7f5 c54e4d31 64a71344 bc5f3224 0xa85c291f
ba7b9d6c c54e4d31 64a71344 bc5f3224 2ba65756 0xfb20e7f5
ba7b9d70 64a71344 bc5f3224 2ba65756 fb3da12a 0xc54e4d31
ba7b9d74 bc5f3224 2ba65756 fb3da12a 04746090 0x64a71344


STACK_COMMAND: kb

FOLLOWUP_IP:
nt!Kei386EoiHelper+2823
804e187f f7457000000200 test dword ptr [ebp+70h],20000h

SYMBOL_STACK_INDEX: 0

SYMBOL_NAME: nt!Kei386EoiHelper+2823

FOLLOWUP_NAME: MachineOwner

IMAGE_NAME: ntoskrnl.exe

BUCKET_ID: WRONG_SYMBOLS

Followup: MachineOwner
---------

Nö

Ich hätte gerne die komplette Memory.dmp und nicht Deine verunglückte Auswertung mit WinDbg

Findest Du unter C:\WINDOWS

mit was öffne ich die