Windows 10 15063上安装偷跑的卡巴斯基全方位安全软件2018，klbackupdisk.sys导致SYSTEM_SERVICE_EXCEPTION。
Dump分析如下：
Use !analyze -v to get detailed debugging information.
BugCheck 3B, {c0000005, fffff802d0109270, ffffd88024efc270, 0}
*** WARNING: Unable to verify timestamp for klbackupdisk.sys
*** ERROR: Module load completed but symbols could not be loaded for klbackupdisk.sys
Probably caused by : memory_corruption
Followup: memory_corruption
---------
4: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
SYSTEM_SERVICE_EXCEPTION (3b)
An exception happened while executing a system service routine.
Arguments:
Arg1: 00000000c0000005, Exception code that caused the bugcheck
Arg2: fffff802d0109270, Address of the instruction which caused the bugcheck
Arg3: ffffd88024efc270, Address of the context record for the exception that caused the bugcheck
Arg4: 0000000000000000, zero.
Debugging Details:
------------------
DUMP_CLASS: 1
DUMP_QUALIFIER: 400
SYSTEM_MANUFACTURER: System manufacturer
SYSTEM_PRODUCT_NAME: System Product Name
SYSTEM_SKU: SKU
SYSTEM_VERSION: System Version
BIOS_VENDOR: American Megatrends Inc.
BIOS_VERSION: 3401
BIOS_DATE: 01/25/2017
BASEBOARD_MANUFACTURER: ASUSTeK COMPUTER INC.
BASEBOARD_PRODUCT: MAXIMUS VIII HERO
BASEBOARD_VERSION: Rev 1.xx
DUMP_TYPE: 2
DUMP_FILE_ATTRIBUTES: 0x8
Kernel Generated Triage Dump
BUGCHECK_P1: c0000005
BUGCHECK_P2: fffff802d0109270
BUGCHECK_P3: ffffd88024efc270
BUGCHECK_P4: 0
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - 0x%p
FAULTING_IP:
nt!IoGetSiloParameters+0
fffff802`d0109270 488b81d0000000 mov rax,qword ptr [rcx+0D0h]
CONTEXT: ffffd88024efc270 -- (.cxr 0xffffd88024efc270)
rax=0000000000000001 rbx=ffff9980cd5240f0 rcx=0000000000000000
rdx=ffffd88024efcd60 rsi=ffff9980cd524010 rdi=ffffd88024efcd60
rip=fffff802d0109270 rsp=ffffd88024efcc68 rbp=ffffd88024efce09
r8=ffff9980cd524148 r9=000000000000003e r10=ffff9980b30de010
r11=ffff9980b58757c0 r12=ffff9980cd524090 r13=ffff9980d08cfb30
r14=ffff9980cd524190 r15=0000000010000004
iopl=0 nv up ei ng nz na pe nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010282
nt!IoGetSiloParameters:
fffff802`d0109270 488b81d0000000 mov rax,qword ptr [rcx+0D0h] ds:002b:00000000`000000d0=????????????????
Resetting default scope
CPU_COUNT: 8
CPU_MHZ: fa8
CPU_VENDOR: GenuineIntel
CPU_FAMILY: 6
CPU_MODEL: 5e
CPU_STEPPING: 3
CPU_MICROCODE: 6,5e,3,0 (F,M,S,R) SIG: 9E'00000000 (cache) 9E'00000000 (init)
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: CODE_CORRUPTION
BUGCHECK_STR: 0x3B
PROCESS_NAME: NvProfileUpdat
CURRENT_IRQL: 0
ANALYSIS_SESSION_HOST: *********
ANALYSIS_SESSION_TIME: 08-20-2017 13:17:59.0264
ANALYSIS_VERSION: 10.0.14321.1024 amd64fre
LAST_CONTROL_TRANSFER: from fffff802cf73323a to fffff802d0109270
STACK_TEXT:
ffffd880`24efcc68 fffff802`cf73323a : ffffd880`24efcc80 ffff9980`cdd69650 00000000`00000001 00000000`00000000 : nt!IoGetSiloParameters
ffffd880`24efcc70 fffff802`cf742926 : 00000000`00000003 fffff802`d0392bc0 ffff9980`20206f49 00000000`00000030 : wcnfs!WcnGetSiloFromFileObject+0xa
ffffd880`24efcca0 fffff802`cf73c52f : ffff9980`b5875ae0 ffffd880`24efcde0 ffff9980`cd524010 ffff9980`ae6d5b30 : wcnfs!WcnGetFltCallbackSiloDetails+0x22
ffffd880`24efcd00 fffff803`3eb84b4c : 00000000`00000000 ffffd880`24efce09 ffff9980`00000000 ffff9980`cd524010 : wcnfs!WcnFsctlDefaultFilter+0x1f
ffffd880`24efcd50 fffff803`3eb846ec : ffffd880`24efcf40 ffff9980`b317f000 00000000`00000000 ffff9980`cdcc600d : FLTMGR!FltpPerformPreCallbacks+0x2ec
ffffd880`24efce70 fffff803`3eb836d8 : 00000000`00000000 ffffd880`24efcf40 ffff9980`cdcc6010 ffffd880`24efcf50 : FLTMGR!FltpPassThroughInternal+0x8c
ffffd880`24efcea0 fffff803`3ebb55fb : ffff9980`b2ffe4c0 ffff9980`00000000 00000000`0000000f 00000000`00000001 : FLTMGR!FltpPassThrough+0x168
ffffd880`24efcf20 fffff803`3f47640c : ffff9980`b306c801 ffffd880`24efd259 ffff9980`b3080101 fffff803`3eb8addf : FLTMGR!FltpFsControl+0xcb
ffffd880`24efcf80 ffff9980`b306c801 : ffffd880`24efd259 ffff9980`b3080101 fffff803`3eb8addf 00000000`00000010 : klbackupdisk+0x640c
ffffd880`24efcf88 ffffd880`24efd259 : ffff9980`b3080101 fffff803`3eb8addf 00000000`00000010 00000000`00000086 : 0xffff9980`b306c801
ffffd880`24efcf90 ffff9980`b3080101 : fffff803`3eb8addf 00000000`00000010 00000000`00000086 00000000`24060000 : 0xffffd880`24efd259
ffffd880`24efcf98 fffff803`3eb8addf : 00000000`00000010 00000000`00000086 00000000`24060000 ffffd880`24efcfb8 : 0xffff9980`b3080101
ffffd880`24efcfa0 fffff803`3eb8ad4f : ffff9980`b307ab00 00000000`00000000 ffff9980`b3080101 ffffd880`24efd259 : FLTMGR!FltReleasePushLock+0xf
ffffd880`24efcfd0 fffff803`3f47185b : ffff9980`b307ab00 00ffc2b1`8320005b ffffd880`24efd030 ffff9980`00000010 : FLTMGR!FltAcquirePushLockExclusive+0xf
ffffd880`24efd000 ffff9980`b307ab00 : 00ffc2b1`8320005b ffffd880`24efd030 ffff9980`00000010 00000000`00000000 : klbackupdisk+0x185b
ffffd880`24efd008 00ffc2b1`8320005b : ffffd880`24efd030 ffff9980`00000010 00000000`00000000 00007fff`00000000 : 0xffff9980`b307ab00
ffffd880`24efd010 ffffd880`24efd030 : ffff9980`00000010 00000000`00000000 00007fff`00000000 00000000`00000001 : 0x00ffc2b1`8320005b
ffffd880`24efd018 ffff9980`00000010 : 00000000`00000000 00007fff`00000000 00000000`00000001 00000000`06400000 : 0xffffd880`24efd030
ffffd880`24efd020 00000000`00000000 : 00007fff`00000000 00000000`00000001 00000000`06400000 fffff653`3d1a5119 : 0xffff9980`00000010
CHKIMG_EXTENSION: !chkimg -lo 50 -d !nt
fffff802d01091b0 - nt!MiProcessWsInSwapFault+60
[ fa:e8 ]
fffff802d01092f3-fffff802d01092f4 2 bytes - nt!MiClearNonPagedPtes+53 (+0x143)
[ 80 f6:00 d4 ]
fffff802d01093d4-fffff802d01093d5 2 bytes - nt!MiClearNonPagedPtes+134 (+0xe1)
[ 80 f6:00 d4 ]
fffff802d01094e6 - nt!MiLockNonPagedPoolPte+26 (+0x112)
[ fa:e8 ]
6 errors : !nt (fffff802d01091b0-fffff802d01094e6)
MODULE_NAME: memory_corruption
IMAGE_NAME: memory_corruption
FOLLOWUP_NAME: memory_corruption
DEBUG_FLR_IMAGE_TIMESTAMP: 0
MEMORY_CORRUPTOR: LARGE
STACK_COMMAND: .cxr 0xffffd88024efc270 ; kb
FAILURE_BUCKET_ID: MEMORY_CORRUPTION_LARGE
BUCKET_ID: MEMORY_CORRUPTION_LARGE
PRIMARY_PROBLEM_CLASS: MEMORY_CORRUPTION_LARGE
TARGET_TIME: 2017-08-20T04:56:56.000Z
OSBUILD: 15063
OSSERVICEPACK: 540
SERVICEPACK_NUMBER: 0
OS_REVISION: 0
SUITE_MASK: 272
PRODUCT_TYPE: 1
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
OSEDITION: Windows 10 WinNt TerminalServer SingleUserTS
OS_LOCALE:
USER_LCID: 0
OSBUILD_TIMESTAMP: 2017-08-01 09:23:25
ANALYSIS_SESSION_ELAPSED_TIME: ef2
ANALYSIS_SOURCE: KM
FAILURE_ID_HASH_STRING: km:memory_corruption_large
FAILURE_ID_HASH: {e29154ac-69a4-0eb8-172a-a860f73c0a3c}
Followup: memory_corruption
|
发表于 2017-8-20 13:29:28
楼主