Without having to do all the other tool running, are you able to determine the cause from my dmp files? Running the other tools will be much harder for me.
My Computer
System One
-
- OS
- Windows 8
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 5, {ffffe0012f786900, ffffe00135177900, 0, 1}
*** WARNING: Unable to verify timestamp for SynTP.sys
*** ERROR: Module load completed but symbols could not be loaded for SynTP.sys
Probably caused by : SynTP.sys ( SynTP+3b9fb )
Followup: MachineOwner
---------
0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
INVALID_PROCESS_ATTACH_ATTEMPT (5)
Arguments:
Arg1: ffffe0012f786900
Arg2: ffffe00135177900
Arg3: 0000000000000000
Arg4: 0000000000000001
Debugging Details:
------------------
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: WIN8_DRIVER_FAULT
BUGCHECK_STR: 0x5
PROCESS_NAME: svchost.exe
CURRENT_IRQL: 2
ANALYSIS_VERSION: 6.3.9600.17237 (debuggers(dbg).140716-0327) amd64fre
DPC_STACK_BASE: FFFFF8017A7D5FB0
LAST_CONTROL_TRANSFER: from fffff80178b76060 to fffff80178b55ca0
STACK_TEXT:
fffff801`7a7d5488 fffff801`78b76060 : 00000000`00000005 ffffe001`2f786900 ffffe001`35177900 00000000`00000000 : nt!KeBugCheckEx
fffff801`7a7d5490 fffff801`78dd6d5e : 00000000`00000cb8 ffffc000`76c9d5a0 fffff801`7a7d5599 00000000`00000000 : nt! ?? ::FNODOBFM::`string'+0xfeb0
fffff801`7a7d54e0 fffff801`78b614b3 : 00000000`00000030 fffff801`7a7d5938 00000000`00000086 00000000`00000000 : nt!NtClose+0x3ae
fffff801`7a7d5600 fffff801`78b59900 : fffff801`78db5794 00000000`00000000 fffff801`7a7d5829 fffff801`7a7d5900 : nt!KiSystemServiceCopyEnd+0x13
fffff801`7a7d5798 fffff801`78db5794 : 00000000`00000000 fffff801`7a7d5829 fffff801`7a7d5900 00000000`00000000 : nt!KiServiceLinkage
fffff801`7a7d57a0 fffff801`78db557a : 00000000`00000001 00000000`00000000 ffffe001`3520909c 00000000`00000000 : nt!RtlpQueryRegistryValues+0x214
fffff801`7a7d5880 fffff801`3c5459fb : ffffe001`338438a0 fffff801`7a7d5940 ffffe001`3520909c fffff801`3a51418c : nt!RtlQueryRegistryValues+0xe
fffff801`7a7d58c0 ffffe001`338438a0 : fffff801`7a7d5940 ffffe001`3520909c fffff801`3a51418c 00000000`00000000 : SynTP+0x3b9fb
fffff801`7a7d58c8 fffff801`7a7d5940 : ffffe001`3520909c fffff801`3a51418c 00000000`00000000 fffff801`3c517d73 : 0xffffe001`338438a0
fffff801`7a7d58d0 ffffe001`3520909c : fffff801`3a51418c 00000000`00000000 fffff801`3c517d73 00000000`00080006 : 0xfffff801`7a7d5940
fffff801`7a7d58d8 fffff801`3a51418c : 00000000`00000000 fffff801`3c517d73 00000000`00080006 ffffc000`74fdb080 : 0xffffe001`3520909c
fffff801`7a7d58e0 ffffe001`33842158 : 00000000`00000001 00000000`00000000 00000000`00000000 00000000`00000001 : storport!RaidUnitCompleteRequest+0x5bc
fffff801`7a7d5ad0 00000000`00000001 : 00000000`00000000 00000000`00000000 00000000`00000001 fffff801`78ce8180 : 0xffffe001`33842158
fffff801`7a7d5ad8 00000000`00000000 : 00000000`00000000 00000000`00000001 fffff801`78ce8180 fffff801`3c55c5a7 : 0x1
STACK_COMMAND: kb
FOLLOWUP_IP:
SynTP+3b9fb
fffff801`3c5459fb ?? ???
SYMBOL_STACK_INDEX: 7
SYMBOL_NAME: SynTP+3b9fb
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: SynTP
IMAGE_NAME: SynTP.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 52173873
FAILURE_BUCKET_ID: 0x5_SynTP+3b9fb
BUCKET_ID: 0x5_SynTP+3b9fb
ANALYSIS_SOURCE: KM
FAILURE_ID_HASH_STRING: km:0x5_syntp+3b9fb
FAILURE_ID_HASH: {9ed73577-0e9c-a818-f013-9d6634ebda64}
Followup: MachineOwner
---------
Please do the following:
- open Event Viewer (run eventvwr.msc from the "Run" dialog))
- expand the Custom Views category (left click on the > next to the words "Custom Views")
- right click on Administrative Events
- select "Save all Events in Custom View as..."
- save the file as Admin.evtx
- zip up the file (right click on it, select "Send to", select "Compressed (zipped) folder")
- upload it with your next post (if it's too big, then upload it to a free file-hosting service and post a link here).