DRIVER_OVERRAN_STACK_BUFFER hatası

Xochix

Yoctopat
Katılım
25 Eylül 2022
Mesajlar
3
Daha fazla  
Cinsiyet
Erkek
RAM
Corsair Vengeance RGB PRO CL18 3600 MHZ
SSD veya HDD modeli
FORCE MP510
Ekran kartı
ASUS STRİX RTX 3080 OC
Anakart
ASUS Z490-F
İşlemci
INTEL 10700-K
Merhaba. 2 gün içerisinde 4 kere mavi ekran hatası ile karşılaştım. Sebebi büyük ihtimalle RAM. RAM olduğunu düşünmemin sebebi ise, 1-2 ay önce yine bilgisayarımı sorunsuz bir şekilde kullanırken bilgisayarım açıldığında saniyelik donup kendini resetleyip güvenli modda yeniden başlatıyordu. Birçok deneme yanılma yaparak 2 yıldır sorunsuz çalışan RAM'lerimin artık 3600 MHz de çalışmadığını bilgisayarımın donmasının bu sebepten olduğunu fark ettim. XMP 3600'de açılmadığı için tek tek deneyip BIOS'tan MHz'i düşürerek değeri bilgisayarımın sorunsuz çalıştığı 3000 MHz değerinde bıraktım. Dün yaşadığım mavi ekranlara kadar 2 aydır sorun yaşamıyordum. Mavi ekranların hepsini oyun oynarken yedim. Memtest rehberinden bakıp, programı çalıştırdığımda ise test sonunu göremedi bile. Merak ettiğim şey bilgisayarımda 4x8 olmak üzere 3600 MHz Corsair Vengeance RGB Pro var. Bu sticklerin hepsi mi bozuk? Eğer öyleyse yeni RAM almaktan başka çarem yok fakat 1,2 si bozuksa kalan 16 ile kullanımıma devam edebilirim. Dünkü mavi ekranlardan sonra oyun oynamaya devam edebildim fakat yine ara ara yemekten korkuyorum. Ayrıca sorunun kaynağının RAM olduğunundan emin olmak istiyorum.

Minidump:

Mini.rar

Memtest sonucunu bilgisayar donduğu için dosya olarak alamadım bu yüzden fotoğraf olarak yüklüyorum.

Yediğim mavi ekran kodları sırasıyla; ırql_not_less_equal, DRIVER_OVERRAN_STACK_BUFFER, REFERENCE_BY_POINTER, kernel panıc upload mode.

Memtest'i bir de XMP'yi kapatıp deneyeceğim.
 

Dosya Ekleri

  • 20220925_152004.jpg
    20220925_152004.jpg
    265,8 KB · Görüntüleme: 16
Evet dediğiniz gibi XMP açık olduğu için problem yaşanıyor.

Belki de XMP'yi kapatsanız bile testten geçemeyecekler; birinde veya birden fazla bellekte arıza olabilir stok hâlde olsalar bile.

XMP kapalıyken de test yapın, sonuçları paylaşırsınız. Belleklerde herhangi bir overclock olmasın, stok değerlerinde bırakın.

Gerekirse her bir belleği tek başınayken teste sokun. Daha sonra çift hâlinde de yapabilirsiniz.
 
Evet dediğiniz gibi XMP açık olduğu için problem yaşanıyor.

Belki de XMP'yi kapatsanız bile testten geçemeyecekler; birinde veya birden fazla bellekte arıza olabilir stok hâlde olsalar bile.

XMP kapalıyken de test yapın, sonuçları paylaşırsınız. Belleklerde herhangi bir overclock olmasın, stok değerlerinde bırakın.

Gerekirse her bir belleği tek başınayken teste sokun. Daha sonra çift hâlinde de yapabilirsiniz.
Teşekkür ederim. Dediğiniz gibi tek tek denemekten başka şansım yok sanırım. Bu arada mini dump dosyasına bakabildiniz mi veya bakabilen var mı ? Mavi ekranların sebebinin RAM olduğundan emin miyiz?
 
Şimdi baktım dördüne de. Hatalar farklı farklı zaten siz de belirtmişsiniz. Sizin dediğiniz üçlüye ek olarak KERNEL_THREAD_PRIORITY_FLOOR_VIOLATION (157) hatası da var.

Rich (BB code):
KERNEL_THREAD_PRIORITY_FLOOR_VIOLATION (157)
REFERENCE_BY_POINTER (18)
DRIVER_OVERRAN_STACK_BUFFER (f7)
IRQL_NOT_LESS_OR_EQUAL(a)

Hatalar farklı farklı olmaya başlayınca genelde RAM'e yorumlanıyor ki siz de kendiniz fark edip test yapmışsınız zaten. Bu üsttekiler direk RAM ile alakalı olmasa da bu dökümlerin analizlerinde hataya düşen sürücüler RAM'deki belli noktalara erişmeye çalıştıklarında RAM arızası olduğundan dolayı problem yaşanıyor olabilir.

Direk veya yüksek ihtimalle RAM diyebileceğimiz:
  • MEMORY_MANAGEMENT (1a)
  • CRITICAL_STRUCTURE_CORRUPTION (109)
  • memory_corruption
  • hardware RAM
  • Pool Corruption
gibi ibareler/indikatörler şimdilik yok ama her zaman olmayabiliyor.

O yüzden RAM'leri tek tek, çiftler halinde ve XMP kapalı/açık şekillerde test edip sonuçları paylaşabilirsiniz.

Hatalardan biri cdd.dll = Canonical Display Driver tarafından kaynaklanmış. Ama bu sürücü, RAM'deki bir nokta ile iletişime geçtiğinde bu süreçte RAM'de bir arıza olduğundan dolayı sorun yaşanmışsa bu sürücüye atamayız suçu. İlk başta yazdığım gibi yani.

  • Corsair yazılımları
  • Kaspersky Anti-Virüs
  • Samsung Magician
Bu yazılımlarını şimdilik kaldırın. Yüklenemeyen/geç yüklenen sürücüler listesinde mevcutlar, hata kaynağı direk bunlar olmayabilir ama ihtimalleri var. Hâlâ hata alırsanız geri yüklersiniz.

REFERENCE_BY_POINTER (18) hatası için daha önce Windows hızlı başlatma özelliğini kapatmak önerilmiş. Ne kadar faydalı olur bilmiyorum, uygulayabilirsiniz. :)

Hızlı başlatma nasıl kapatılır?


Dökümler:
Kod:
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

DRIVER_OVERRAN_STACK_BUFFER (f7)
A driver has overrun a stack-based buffer.  This overrun could potentially
allow a malicious user to gain control of this machine.
DESCRIPTION
A driver overran a stack-based buffer (or local variable) in a way that would
have overwritten the function's return address and jumped back to an arbitrary
address when the function returned.  This is the classic "buffer overrun"
hacking attack and the system has been brought down to prevent a malicious user
from gaining complete control of it.
Do a kb to get a stack backtrace -- the last routine on the stack before the
buffer overrun handlers and BugCheck call is the one that overran its local
variable(s).
Arguments:
Arg1: 00003cd6b071d878, Actual security check cookie from the stack
Arg2: 00003cd6b0719978, Expected security check cookie
Arg3: ffffc3294f8e6687, Complement of the expected security check cookie
Arg4: 0000000000000000, zero

Debugging Details:
------------------


KEY_VALUES_STRING: 1

    Key  : Analysis.CPU.mSec
    Value: 1250

    Key  : Analysis.DebugAnalysisManager
    Value: Create

    Key  : Analysis.Elapsed.mSec
    Value: 2151

    Key  : Analysis.Init.CPU.mSec
    Value: 92

    Key  : Analysis.Init.Elapsed.mSec
    Value: 13238

    Key  : Analysis.Memory.CommitPeak.Mb
    Value: 148

    Key  : Bugcheck.Code.DumpHeader
    Value: 0xf7

    Key  : Bugcheck.Code.Register
    Value: 0xf7

    Key  : WER.OS.Branch
    Value: vb_release

    Key  : WER.OS.Timestamp
    Value: 2019-12-06T14:06:00Z

    Key  : WER.OS.Version
    Value: 10.0.19041.1


FILE_IN_CAB:  092522-6187-01.dmp

BUGCHECK_CODE:  f7

BUGCHECK_P1: 3cd6b071d878

BUGCHECK_P2: 3cd6b0719978

BUGCHECK_P3: ffffc3294f8e6687

BUGCHECK_P4: 0

SECURITY_COOKIE:  Expected 00003cd6b0719978 found 00003cd6b071d878

BLACKBOXBSD: 1 (!blackboxbsd)


BLACKBOXNTFS: 1 (!blackboxntfs)


BLACKBOXPNP: 1 (!blackboxpnp)


BLACKBOXWINLOGON: 1

CUSTOMER_CRASH_COUNT:  1

PROCESS_NAME:  NVIDIA Share.exe

STACK_TEXT:
fffffc85`3f1c6a28 fffff804`6f4b1725     : 00000000`000000f7 00003cd6`b071d878 00003cd6`b0719978 ffffc329`4f8e6687 : nt!KeBugCheckEx
fffffc85`3f1c6a30 fffff804`6f60e94a     : fffffc85`3f1c6d20 00000000`00000001 00000000`00000000 00000000`00000003 : nt!_report_gsfailure+0x25
fffffc85`3f1c6a70 ffffb516`ee817ae1     : 00000000`000186a0 00000000`00030d40 ffffb541`0808d390 ffffd288`9ed61df0 : nt!ObWaitForMultipleObjects+0x35a
fffffc85`3f1c6f70 ffffb516`ee70ed6e     : 00000000`00000000 ffffb541`0808d390 00000000`00000004 00000000`00001cff : win32kfull!xxxMsgWaitForMultipleObjectsEx+0xd9
fffffc85`3f1c7020 ffffb516`ee176fd0     : fffffc85`3f1c79a8 00000000`00000000 00000076`00000004 fffffc85`00001cff : win32kfull!NtUserMsgWaitForMultipleObjectsEx+0x3fe
fffffc85`3f1c7950 fffff804`6f40a9b5     : 00000076`bc61f700 00000000`00000108 00000000`00000040 00000076`bc61ef00 : win32k!NtUserMsgWaitForMultipleObjectsEx+0x20
fffffc85`3f1c7990 00007ffd`aca7a104     : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x25
00000076`bc61f588 00000000`00000000     : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x00007ffd`aca7a104


SYMBOL_NAME:  win32kfull!xxxMsgWaitForMultipleObjectsEx+d9

MODULE_NAME: win32kfull

IMAGE_NAME:  win32kfull.sys

IMAGE_VERSION:  10.0.19041.2006

STACK_COMMAND:  .cxr; .ecxr ; kb

BUCKET_ID_FUNC_OFFSET:  d9

FAILURE_BUCKET_ID:  0xF7_TWO_BIT_MISSING_GSFRAME_win32kfull!xxxMsgWaitForMultipleObjectsEx

OS_VERSION:  10.0.19041.1

BUILDLAB_STR:  vb_release

OSPLATFORM_TYPE:  x64

OSNAME:  Windows 10

FAILURE_ID_HASH:  {4f8dc0d4-c5f7-8f6e-6d41-f7b780595b1b}

Followup:     MachineOwner
---------

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 0000000000004460, memory referenced
Arg2: 00000000000000ff, IRQL
Arg3: 0000000000000000, bitfield :
    bit 0 : value 0 = read operation, 1 = write operation
    bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: fffff8042acd4ebd, address which referenced memory

Debugging Details:
------------------

*** WARNING: Unable to verify timestamp for win32k.sys

KEY_VALUES_STRING: 1

    Key  : Analysis.CPU.mSec
    Value: 1749

    Key  : Analysis.DebugAnalysisManager
    Value: Create

    Key  : Analysis.Elapsed.mSec
    Value: 6974

    Key  : Analysis.Init.CPU.mSec
    Value: 93

    Key  : Analysis.Init.Elapsed.mSec
    Value: 9860

    Key  : Analysis.Memory.CommitPeak.Mb
    Value: 129

    Key  : Bugcheck.Code.DumpHeader
    Value: 0xa

    Key  : Bugcheck.Code.Register
    Value: 0xa

    Key  : WER.OS.Branch
    Value: vb_release

    Key  : WER.OS.Timestamp
    Value: 2019-12-06T14:06:00Z

    Key  : WER.OS.Version
    Value: 10.0.19041.1


FILE_IN_CAB:  092522-5640-01.dmp

BUGCHECK_CODE:  a

BUGCHECK_P1: 4460

BUGCHECK_P2: ff

BUGCHECK_P3: 0

BUGCHECK_P4: fffff8042acd4ebd

READ_ADDRESS: fffff8042b6fb390: Unable to get MiVisibleState
Unable to get NonPagedPoolStart
Unable to get NonPagedPoolEnd
Unable to get PagedPoolStart
Unable to get PagedPoolEnd
unable to get nt!MmSpecialPagesInUse
 0000000000004460

BLACKBOXBSD: 1 (!blackboxbsd)


BLACKBOXNTFS: 1 (!blackboxntfs)


BLACKBOXPNP: 1 (!blackboxpnp)


BLACKBOXWINLOGON: 1

CUSTOMER_CRASH_COUNT:  1

PROCESS_NAME:  System

TRAP_FRAME:  fffffa0f7087f3b0 -- (.trap 0xfffffa0f7087f3b0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000000 rbx=0000000000000000 rcx=ffff8b01b87c81e0
rdx=0000000000004440 rsi=0000000000000000 rdi=0000000000000000
rip=fffff8042acd4ebd rsp=fffffa0f7087f540 rbp=0000000000000001
 r8=0000000000000000  r9=0000000000000001 r10=0000000000000002
r11=0000000000000000 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up di pl nz na pe nc
nt!PpmUpdatePerformanceFeedback+0x8d:
fffff804`2acd4ebd 440fb64a20      movzx   r9d,byte ptr [rdx+20h] ds:00000000`00004460=??
Resetting default scope

STACK_TEXT:
fffffa0f`7087f268 fffff804`2ae0af69     : 00000000`0000000a 00000000`00004460 00000000`000000ff 00000000`00000000 : nt!KeBugCheckEx
fffffa0f`7087f270 fffff804`2ae07269     : ffff4a2a`24d77c66 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiBugCheckDispatch+0x69
fffffa0f`7087f3b0 fffff804`2acd4ebd     : 00000000`00000000 ffff8b01`b87c81c8 00001fde`7c8a1cc9 ffff4a2a`24d77bb6 : nt!KiPageFault+0x469
fffffa0f`7087f540 fffff804`2acd3e33     : 00000000`00000000 00000000`00000000 00000000`00000000 00000093`aae50013 : nt!PpmUpdatePerformanceFeedback+0x8d
fffffa0f`7087f5f0 fffff804`2acd3124     : ffff8b01`b87c0104 00001f80`0000000a 00000000`00000003 00000000`00000002 : nt!PpmIdleExecuteTransition+0xb93
fffffa0f`7087f9f0 fffff804`2adfcaf4     : ffffffff`00000000 ffff8b01`b87cb440 ffffaf8e`b9af50c0 00000000`00000326 : nt!PoIdle+0x374
fffffa0f`7087fb60 00000000`00000000     : fffffa0f`70880000 fffffa0f`70879000 00000000`00000000 00000000`00000000 : nt!KiIdleLoop+0x54


SYMBOL_NAME:  nt!PpmUpdatePerformanceFeedback+8d

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

IMAGE_VERSION:  10.0.19041.2006

STACK_COMMAND:  .cxr; .ecxr ; kb

BUCKET_ID_FUNC_OFFSET:  8d

FAILURE_BUCKET_ID:  AV_nt!PpmUpdatePerformanceFeedback

OS_VERSION:  10.0.19041.1

BUILDLAB_STR:  vb_release

OSPLATFORM_TYPE:  x64

OSNAME:  Windows 10

FAILURE_ID_HASH:  {2cff52de-5a3f-765a-d6a1-cf4ebe07fdc5}

Followup:     MachineOwner
---------

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

REFERENCE_BY_POINTER (18)
Arguments:
Arg1: 0000000000000000, Object type of the object whose reference count is being lowered
Arg2: ffff90037be54200, Object whose reference count is being lowered
Arg3: 0000000000000002, Reserved
Arg4: ffffffffffffffff, Reserved
    The reference count of an object is illegal for the current state of the object.
    Each time a driver uses a pointer to an object the driver calls a kernel routine
    to increment the reference count of the object. When the driver is done with the
    pointer the driver calls another kernel routine to decrement the reference count.
    Drivers must match calls to the increment and decrement routines. This BugCheck
    can occur because an object's reference count goes to zero while there are still
    open handles to the object, in which case the fourth parameter indicates the number
    of opened handles. It may also occur when the object's reference count drops below zero
    whether or not there are open handles to the object, and in that case the fourth parameter
    contains the actual value of the pointer references count.

Debugging Details:
------------------


KEY_VALUES_STRING: 1

    Key  : Analysis.CPU.mSec
    Value: 1530

    Key  : Analysis.DebugAnalysisManager
    Value: Create

    Key  : Analysis.Elapsed.mSec
    Value: 3334

    Key  : Analysis.Init.CPU.mSec
    Value: 109

    Key  : Analysis.Init.Elapsed.mSec
    Value: 11552

    Key  : Analysis.Memory.CommitPeak.Mb
    Value: 144

    Key  : Bugcheck.Code.DumpHeader
    Value: 0x18

    Key  : Bugcheck.Code.Register
    Value: 0x18

    Key  : WER.OS.Branch
    Value: vb_release

    Key  : WER.OS.Timestamp
    Value: 2019-12-06T14:06:00Z

    Key  : WER.OS.Version
    Value: 10.0.19041.1


FILE_IN_CAB:  092522-6484-01.dmp

BUGCHECK_CODE:  18

BUGCHECK_P1: 0

BUGCHECK_P2: ffff90037be54200

BUGCHECK_P3: 2

BUGCHECK_P4: ffffffffffffffff

BLACKBOXBSD: 1 (!blackboxbsd)


BLACKBOXNTFS: 1 (!blackboxntfs)


BLACKBOXPNP: 1 (!blackboxpnp)


BLACKBOXWINLOGON: 1

CUSTOMER_CRASH_COUNT:  1

PROCESS_NAME:  iCUE.exe

STACK_TEXT:
ffff8507`6eff6a28 fffff805`1301aeb3     : 00000000`00000018 00000000`00000000 ffff9003`7be54200 00000000`00000002 : nt!KeBugCheckEx
ffff8507`6eff6a30 fffff805`1320e926     : ffff8507`6eff6d20 00000000`00000001 ffff9003`00000080 ffff9003`6e0c08e0 : nt!ObfDereferenceObjectWithTag+0x20c373
ffff8507`6eff6a70 fffffee8`e1757ae1     : 00000000`000186a0 00000000`00030d40 fffffeb3`c73079d0 ffff9003`71d0fcf0 : nt!ObWaitForMultipleObjects+0x336
ffff8507`6eff6f70 fffffee8`e164ed6e     : 00000000`00000000 fffffeb3`c73079d0 00000000`ffffffff 00000000`00001cff : win32kfull!xxxMsgWaitForMultipleObjectsEx+0xd9
ffff8507`6eff7020 fffffee8`e0ce6fd0     : 00000000`00000000 00000000`00000000 00000000`ffffffff ffff8507`00001cff : win32kfull!NtUserMsgWaitForMultipleObjectsEx+0x3fe
ffff8507`6eff7950 fffff805`1300a9b5     : ffff9003`7bea4080 ffff8507`6eff7a80 00000032`b78f8848 00000000`00000001 : win32k!NtUserMsgWaitForMultipleObjectsEx+0x20
ffff8507`6eff7990 00007ffe`d5e4a104     : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x25
00000032`b78f8c38 00000000`00000000     : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x00007ffe`d5e4a104


SYMBOL_NAME:  win32kfull!xxxMsgWaitForMultipleObjectsEx+d9

MODULE_NAME: win32kfull

IMAGE_NAME:  win32kfull.sys

IMAGE_VERSION:  10.0.19041.2006

STACK_COMMAND:  .cxr; .ecxr ; kb

BUCKET_ID_FUNC_OFFSET:  d9

FAILURE_BUCKET_ID:  0x18_OVER_DEREFERENCE_win32kfull!xxxMsgWaitForMultipleObjectsEx

OS_VERSION:  10.0.19041.1

BUILDLAB_STR:  vb_release

OSPLATFORM_TYPE:  x64

OSNAME:  Windows 10

FAILURE_ID_HASH:  {b976f356-6e94-f044-5856-f0d064a6916e}

Followup:     MachineOwner
---------

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

KERNEL_THREAD_PRIORITY_FLOOR_VIOLATION (157)
An illegal operation was attempted on the priority floor of a particular
thread.
Arguments:
Arg1: ffffad8a9e5b1080, The address of the thread
Arg2: 0000000000000001, The target priority value
Arg3: 0000000000000002, The priority counter for the target priority underflowed
Arg4: 0000000000000000, Reserved

Debugging Details:
------------------


KEY_VALUES_STRING: 1

    Key  : Analysis.CPU.mSec
    Value: 1781

    Key  : Analysis.DebugAnalysisManager
    Value: Create

    Key  : Analysis.Elapsed.mSec
    Value: 4092

    Key  : Analysis.Init.CPU.mSec
    Value: 125

    Key  : Analysis.Init.Elapsed.mSec
    Value: 8123

    Key  : Analysis.Memory.CommitPeak.Mb
    Value: 134

    Key  : Bugcheck.Code.DumpHeader
    Value: 0x157

    Key  : Bugcheck.Code.Register
    Value: 0x157

    Key  : WER.OS.Branch
    Value: vb_release

    Key  : WER.OS.Timestamp
    Value: 2019-12-06T14:06:00Z

    Key  : WER.OS.Version
    Value: 10.0.19041.1


FILE_IN_CAB:  092522-5828-01.dmp

BUGCHECK_CODE:  157

BUGCHECK_P1: ffffad8a9e5b1080

BUGCHECK_P2: 1

BUGCHECK_P3: 2

BUGCHECK_P4: 0

BLACKBOXBSD: 1 (!blackboxbsd)


BLACKBOXNTFS: 1 (!blackboxntfs)


BLACKBOXPNP: 1 (!blackboxpnp)


BLACKBOXWINLOGON: 1

CUSTOMER_CRASH_COUNT:  1

PROCESS_NAME:  csrss.exe

STACK_TEXT:
ffffe380`fb46f7b8 fffff803`30c7bb40     : 00000000`00000157 ffffad8a`9e5b1080 00000000`00000001 00000000`00000002 : nt!KeBugCheckEx
ffffe380`fb46f7c0 fffff803`30a117c0     : 00000000`00005309 ffffad8a`a55803e0 ffffad8a`00000000 ffffad8a`00000000 : nt!KiAbThreadUnboostCpuPriority+0x13ab1c
ffffe380`fb46f830 fffff803`30b30436     : 00000000`00000000 ffffe380`0000d309 ffffad8a`a55803e0 00000000`00000000 : nt!KeAbPostRelease+0x220
ffffe380`fb46f890 fffff8b0`06aa2b84     : 00000000`00010f44 ffffad8a`a55803e0 ffffad8a`a55807a0 fffff8d1`c7274020 : nt!ExReleaseFastMutexUnsafeAndLeaveCriticalRegion+0x26
ffffe380`fb46f8c0 fffff803`30a71d25     : ffffad8a`9e5b1080 ffffad8a`9e5b1080 fffff8b0`06aa20d0 fffff8d1`c7274020 : cdd!PresentWorkerThread+0xab4
ffffe380`fb46fb10 fffff803`30c00628     : fffff803`2ed84180 ffffad8a`9e5b1080 fffff803`30a71cd0 00000000`00000246 : nt!PspSystemThreadStartup+0x55
ffffe380`fb46fb60 00000000`00000000     : ffffe380`fb470000 ffffe380`fb469000 00000000`00000000 00000000`00000000 : nt!KiStartSystemThread+0x28


SYMBOL_NAME:  cdd!PresentWorkerThread+ab4

MODULE_NAME: cdd

IMAGE_NAME:  cdd.dll

IMAGE_VERSION:  10.0.19041.1940

STACK_COMMAND:  .cxr; .ecxr ; kb

BUCKET_ID_FUNC_OFFSET:  ab4

FAILURE_BUCKET_ID:  0x157_cdd!PresentWorkerThread

OS_VERSION:  10.0.19041.1

BUILDLAB_STR:  vb_release

OSPLATFORM_TYPE:  x64

OSNAME:  Windows 10

FAILURE_ID_HASH:  {13502bf9-f3da-2e81-afb4-1bb4d28da6f1}

Followup:     MachineOwner
---------
 
Son düzenleme:
Şimdi baktım dördüne de. Hatalar farklı farklı zaten siz de belirtmişsiniz. Sizin dediğiniz üçlüye ek olarak KERNEL_THREAD_PRIORITY_FLOOR_VIOLATION (157) hatası da var.

Rich (BB code):
KERNEL_THREAD_PRIORITY_FLOOR_VIOLATION (157)
REFERENCE_BY_POINTER (18)
DRIVER_OVERRAN_STACK_BUFFER (f7)
IRQL_NOT_LESS_OR_EQUAL(a)

Hatalar farklı farklı olmaya başlayınca genelde RAM'e yorumlanıyor ki siz de kendiniz fark edip test yapmışsınız zaten. Bu üsttekiler direk RAM ile alakalı olmasa da bu dökümlerin analizlerinde hataya düşen sürücüler RAM'deki belli noktalara erişmeye çalıştıklarında RAM arızası olduğundan dolayı problem yaşanıyor olabilir.

Direk veya yüksek ihtimalle RAM diyebileceğimiz:
  • MEMORY_MANAGEMENT (1a)
  • CRITICAL_STRUCTURE_CORRUPTION (109)
  • Memory_corruption
  • Hardware RAM.
  • Pool corruption.
Gibi ibareler/indikatörler şimdilik yok ama her zaman olmayabiliyor.

O yüzden RAM'leri tek tek, çiftler halinde ve XMP kapalı/açık şekillerde test edip sonuçları paylaşabilirsiniz.

Hatalardan biri cdd.dll = canonical display driver tarafından kaynaklanmış. Ama bu sürücü, RAM'deki bir nokta ile iletişime geçtiğinde bu süreçte RAM'de bir arıza olduğundan dolayı sorun yaşanmışsa bu sürücüye atamayız suçu. İlk başta yazdığım gibi yani.

  • Corsair yazılımları.
  • Kaspersky Anti-Virüs
  • Samsung Magician.
Bu yazılımlarını şimdilik kaldırın. Yüklenemeyen/geç yüklenen sürücüler listesinde mevcutlar, hata kaynağı direk bunlar olmayabilir ama ihtimalleri var. Hâlâ hata alırsanız geri yüklersiniz.

REFERENCE_BY_POINTER (18) hatası için daha önce Windows hızlı başlatma özelliğini kapatmak önerilmiş. Ne kadar faydalı olur bilmiyorum, uygulayabilirsiniz. :)

Hızlı başlatma nasıl kapatılır?

Dökümler:
Kod:
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

DRIVER_OVERRAN_STACK_BUFFER (f7)
A driver has overrun a stack-based buffer. This overrun could potentially.
allow a malicious user to gain control of this machine.
DESCRIPTION.
A driver overran a stack-based buffer (or local variable) in a way that would.
have overwritten the function's return address and jumped back to an arbitrary.
address when the function returned. This is the classic "buffer overrun"
hacking attack and the system has been brought down to prevent a malicious user.
from gaining complete control of it.
Do a kb to get a stack backtrace -- the last routine on the stack before the.
buffer overrun handlers and BugCheck call is the one that overran its local.
variable(s).
Arguments:
Arg1: 00003cd6b071d878, Actual security check cookie from the stack.
Arg2: 00003cd6b0719978, Expected security check cookie.
Arg3: ffffc3294f8e6687, Complement of the expected security check cookie.
Arg4: 0000000000000000, zero.

Debugging Details:
------------------

KEY_VALUES_STRING: 1

 Key : Analysis.CPU.mSec
 Value: 1250.

 Key : Analysis.DebugAnalysisManager
 Value: Create.

 Key : Analysis.Elapsed.mSec
 Value: 2151.

 Key : Analysis.Init.CPU.mSec
 Value: 92.

 Key : Analysis.Init.Elapsed.mSec
 Value: 13238.

 Key : Analysis.Memory.CommitPeak.Mb
 Value: 148.

 Key : Bugcheck.Code.DumpHeader
 Value: 0xf7.

 Key : Bugcheck.Code.Register
 Value: 0xf7.

 Key : WER.OS.Branch
 Value: vb_release.

 Key : WER.OS.Timestamp
 Value: 2019-12-06T14:06:00Z

 Key : WER.OS.Version
 Value: 10.0.19041.1

FILE_IN_CAB: 092522-6187-01.dmp

BUGCHECK_CODE: f7.

BUGCHECK_P1: 3cd6b071d878.

BUGCHECK_P2: 3cd6b0719978.

BUGCHECK_P3: ffffc3294f8e6687.

BUGCHECK_P4: 0

SECURITY_COOKIE: Expected 00003cd6b0719978 found 00003cd6b071d878.

BLACKBOXBSD: 1 (!blackboxbsd)

BLACKBOXNTFS: 1 (!blackboxntfs)

BLACKBOXPNP: 1 (!blackboxpnp)

BLACKBOXWINLOGON: 1

CUSTOMER_CRASH_COUNT: 1

PROCESS_NAME: NVIDIA Share.exe

STACK_TEXT:
fffffc85`3f1c6a28 fffff804`6f4b1725 : 00000000`000000f7 00003cd6`b071d878 00003cd6`b0719978 ffffc329`4f8e6687 : nt!KeBugCheckEx
fffffc85`3f1c6a30 fffff804`6f60e94a : fffffc85`3f1c6d20 00000000`00000001 00000000`00000000 00000000`00000003 : nt!_report_gsfailure+0x25
fffffc85`3f1c6a70 ffffb516`ee817ae1 : 00000000`000186a0 00000000`00030d40 ffffb541`0808d390 ffffd288`9ed61df0 : nt!ObWaitForMultipleObjects+0x35a
fffffc85`3f1c6f70 ffffb516`ee70ed6e : 00000000`00000000 ffffb541`0808d390 00000000`00000004 00000000`00001cff : win32kfull!xxxMsgWaitForMultipleObjectsEx+0xd9
fffffc85`3f1c7020 ffffb516`ee176fd0 : fffffc85`3f1c79a8 00000000`00000000 00000076`00000004 fffffc85`00001cff : win32kfull!NtUserMsgWaitForMultipleObjectsEx+0x3fe
fffffc85`3f1c7950 fffff804`6f40a9b5 : 00000076`bc61f700 00000000`00000108 00000000`00000040 00000076`bc61ef00 : win32k!NtUserMsgWaitForMultipleObjectsEx+0x20
fffffc85`3f1c7990 00007ffd`aca7a104 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x25
00000076`bc61f588 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x00007ffd`aca7a104

SYMBOL_NAME: win32kfull!xxxMsgWaitForMultipleObjectsEx+d9

MODULE_NAME: win32kfull.

IMAGE_NAME: win32kfull.sys

IMAGE_VERSION: 10.0.19041.2006

STACK_COMMAND: .cxr; .ecxr ; kb.

BUCKET_ID_FUNC_OFFSET: d9.

FAILURE_BUCKET_ID: 0xF7_TWO_BIT_MISSING_GSFRAME_win32kfull!xxxMsgWaitForMultipleObjectsEx

OS_VERSION: 10.0.19041.1

BUILDLAB_STR: vb_release.

OSPLATFORM_TYPE: x64.

OSNAME: Windows 10.

FAILURE_ID_HASH: {4f8dc0d4-c5f7-8f6e-6d41-f7b780595b1b}

Followup: MachineOwner.
---------

*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an.
interrupt request level (IRQL) that is too high. This is usually.
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 0000000000004460, memory referenced.
Arg2: 00000000000000ff, IRQL.
Arg3: 0000000000000000, bitfield :
 bit 0 : value 0 = read operation, 1 = write operation.
 bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: fffff8042acd4ebd, address which referenced memory.

Debugging Details:
------------------

*** WARNING: Unable to verify timestamp for win32k.sys

KEY_VALUES_STRING: 1

 Key : Analysis.CPU.mSec
 Value: 1749.

 Key : Analysis.DebugAnalysisManager
 Value: Create.

 Key : Analysis.Elapsed.mSec
 Value: 6974.

 Key : Analysis.Init.CPU.mSec
 Value: 93.

 Key : Analysis.Init.Elapsed.mSec
 Value: 9860.

 Key : Analysis.Memory.CommitPeak.Mb
 Value: 129.

 Key : Bugcheck.Code.DumpHeader
 Value: 0xa.

 Key : Bugcheck.Code.Register
 Value: 0xa.

 Key : WER.OS.Branch
 Value: vb_release.

 Key : WER.OS.Timestamp
 Value: 2019-12-06T14:06:00Z

 Key : WER.OS.Version
 Value: 10.0.19041.1

FILE_IN_CAB: 092522-5640-01.dmp

BUGCHECK_CODE: a

BUGCHECK_P1: 4460.

BUGCHECK_P2: ff.

BUGCHECK_P3: 0

BUGCHECK_P4: fffff8042acd4ebd.

READ_ADDRESS: fffff8042b6fb390: Unable to get MiVisibleState.
Unable to get NonPagedPoolStart.
Unable to get NonPagedPoolEnd.
Unable to get PagedPoolStart.
Unable to get PagedPoolEnd.
unable to get nt!MmSpecialPagesInUse
 0000000000004460.

BLACKBOXBSD: 1 (!blackboxbsd)

BLACKBOXNTFS: 1 (!blackboxntfs)

BLACKBOXPNP: 1 (!blackboxpnp)

BLACKBOXWINLOGON: 1

CUSTOMER_CRASH_COUNT: 1

PROCESS_NAME: System.

TRAP_FRAME: fffffa0f7087f3b0 -- (.trap 0xfffffa0f7087f3b0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000000 rbx=0000000000000000 rcx=ffff8b01b87c81e0
rdx=0000000000004440 rsi=0000000000000000 rdi=0000000000000000
rip=fffff8042acd4ebd rsp=fffffa0f7087f540 rbp=0000000000000001
 r8=0000000000000000 r9=0000000000000001 r10=0000000000000002
r11=0000000000000000 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up di pl nz na pe nc.
nt!PpmUpdatePerformanceFeedback+0x8d:
fffff804`2acd4ebd 440fb64a20 movzx r9d,byte ptr [rdx+20h] ds:00000000`00004460=??
Resetting default scope.

STACK_TEXT:
fffffa0f`7087f268 fffff804`2ae0af69 : 00000000`0000000a 00000000`00004460 00000000`000000ff 00000000`00000000 : nt!KeBugCheckEx
fffffa0f`7087f270 fffff804`2ae07269 : ffff4a2a`24d77c66 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiBugCheckDispatch+0x69
fffffa0f`7087f3b0 fffff804`2acd4ebd : 00000000`00000000 ffff8b01`b87c81c8 00001fde`7c8a1cc9 ffff4a2a`24d77bb6 : nt!KiPageFault+0x469
fffffa0f`7087f540 fffff804`2acd3e33 : 00000000`00000000 00000000`00000000 00000000`00000000 00000093`aae50013 : nt!PpmUpdatePerformanceFeedback+0x8d
fffffa0f`7087f5f0 fffff804`2acd3124 : ffff8b01`b87c0104 00001f80`0000000a 00000000`00000003 00000000`00000002 : nt!PpmIdleExecuteTransition+0xb93
fffffa0f`7087f9f0 fffff804`2adfcaf4 : ffffffff`00000000 ffff8b01`b87cb440 ffffaf8e`b9af50c0 00000000`00000326 : nt!PoIdle+0x374
fffffa0f`7087fb60 00000000`00000000 : fffffa0f`70880000 fffffa0f`70879000 00000000`00000000 00000000`00000000 : nt!KiIdleLoop+0x54

SYMBOL_NAME: nt!PpmUpdatePerformanceFeedback+8d

MODULE_NAME: nt.

IMAGE_NAME: ntkrnlmp.exe

IMAGE_VERSION: 10.0.19041.2006

STACK_COMMAND: .cxr; .ecxr ; kb.

BUCKET_ID_FUNC_OFFSET: 8d.

FAILURE_BUCKET_ID: AV_nt!PpmUpdatePerformanceFeedback

OS_VERSION: 10.0.19041.1

BUILDLAB_STR: vb_release.

OSPLATFORM_TYPE: x64.

OSNAME: Windows 10.

FAILURE_ID_HASH: {2cff52de-5a3f-765a-d6a1-cf4ebe07fdc5}

Followup: MachineOwner.
---------

*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

REFERENCE_BY_POINTER (18)
Arguments:
Arg1: 0000000000000000, Object type of the object whose reference count is being lowered.
Arg2: ffff90037be54200, Object whose reference count is being lowered.
Arg3: 0000000000000002, Reserved.
Arg4: ffffffffffffffff, Reserved.
 The reference count of an object is illegal for the current state of the object.
 Each time a driver uses a pointer to an object the driver calls a kernel routine.
 to increment the reference count of the object. When the driver is done with the.
 pointer the driver calls another kernel routine to decrement the reference count.
 Drivers must match calls to the increment and decrement routines. This BugCheck.
 can occur because an object's reference count goes to zero while there are still.
 open handles to the object, in which case the fourth parameter indicates the number.
 of opened handles. It may also occur when the object's reference count drops below zero.
 whether or not there are open handles to the object, and in that case the fourth parameter.
 contains the actual value of the pointer references count.

Debugging Details:
------------------

KEY_VALUES_STRING: 1

 Key : Analysis.CPU.mSec
 Value: 1530.

 Key : Analysis.DebugAnalysisManager
 Value: Create.

 Key : Analysis.Elapsed.mSec
 Value: 3334.

 Key : Analysis.Init.CPU.mSec
 Value: 109.

 Key : Analysis.Init.Elapsed.mSec
 Value: 11552.

 Key : Analysis.Memory.CommitPeak.Mb
 Value: 144.

 Key : Bugcheck.Code.DumpHeader
 Value: 0x18.

 Key : Bugcheck.Code.Register
 Value: 0x18.

 Key : WER.OS.Branch
 Value: vb_release.

 Key : WER.OS.Timestamp
 Value: 2019-12-06T14:06:00Z

 Key : WER.OS.Version
 Value: 10.0.19041.1

FILE_IN_CAB: 092522-6484-01.dmp

BUGCHECK_CODE: 18.

BUGCHECK_P1: 0

BUGCHECK_P2: ffff90037be54200.

BUGCHECK_P3: 2

BUGCHECK_P4: ffffffffffffffff.

BLACKBOXBSD: 1 (!blackboxbsd)

BLACKBOXNTFS: 1 (!blackboxntfs)

BLACKBOXPNP: 1 (!blackboxpnp)

BLACKBOXWINLOGON: 1

CUSTOMER_CRASH_COUNT: 1

PROCESS_NAME: iCUE.exe

STACK_TEXT:
ffff8507`6eff6a28 fffff805`1301aeb3 : 00000000`00000018 00000000`00000000 ffff9003`7be54200 00000000`00000002 : nt!KeBugCheckEx
ffff8507`6eff6a30 fffff805`1320e926 : ffff8507`6eff6d20 00000000`00000001 ffff9003`00000080 ffff9003`6e0c08e0 : nt!ObfDereferenceObjectWithTag+0x20c373
ffff8507`6eff6a70 fffffee8`e1757ae1 : 00000000`000186a0 00000000`00030d40 fffffeb3`c73079d0 ffff9003`71d0fcf0 : nt!ObWaitForMultipleObjects+0x336
ffff8507`6eff6f70 fffffee8`e164ed6e : 00000000`00000000 fffffeb3`c73079d0 00000000`ffffffff 00000000`00001cff : win32kfull!xxxMsgWaitForMultipleObjectsEx+0xd9
ffff8507`6eff7020 fffffee8`e0ce6fd0 : 00000000`00000000 00000000`00000000 00000000`ffffffff ffff8507`00001cff : win32kfull!NtUserMsgWaitForMultipleObjectsEx+0x3fe
ffff8507`6eff7950 fffff805`1300a9b5 : ffff9003`7bea4080 ffff8507`6eff7a80 00000032`b78f8848 00000000`00000001 : win32k!NtUserMsgWaitForMultipleObjectsEx+0x20
ffff8507`6eff7990 00007ffe`d5e4a104 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x25
00000032`b78f8c38 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x00007ffe`d5e4a104

SYMBOL_NAME: win32kfull!xxxMsgWaitForMultipleObjectsEx+d9

MODULE_NAME: win32kfull.

IMAGE_NAME: win32kfull.sys

IMAGE_VERSION: 10.0.19041.2006

STACK_COMMAND: .cxr; .ecxr ; kb.

BUCKET_ID_FUNC_OFFSET: d9.

FAILURE_BUCKET_ID: 0x18_OVER_DEREFERENCE_win32kfull!xxxMsgWaitForMultipleObjectsEx

OS_VERSION: 10.0.19041.1

BUILDLAB_STR: vb_release.

OSPLATFORM_TYPE: x64.

OSNAME: Windows 10.

FAILURE_ID_HASH: {b976f356-6e94-f044-5856-f0d064a6916e}

Followup: MachineOwner.
---------

*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

KERNEL_THREAD_PRIORITY_FLOOR_VIOLATION (157)
An illegal operation was attempted on the priority floor of a particular.
thread.
Arguments:
Arg1: ffffad8a9e5b1080, The address of the thread.
Arg2: 0000000000000001, The target priority value.
Arg3: 0000000000000002, The priority counter for the target priority underflowed.
Arg4: 0000000000000000, Reserved.

Debugging Details:
------------------

KEY_VALUES_STRING: 1

 Key : Analysis.CPU.mSec
 Value: 1781.

 Key : Analysis.DebugAnalysisManager
 Value: Create.

 Key : Analysis.Elapsed.mSec
 Value: 4092.

 Key : Analysis.Init.CPU.mSec
 Value: 125.

 Key : Analysis.Init.Elapsed.mSec
 Value: 8123.

 Key : Analysis.Memory.CommitPeak.Mb
 Value: 134.

 Key : Bugcheck.Code.DumpHeader
 Value: 0x157.

 Key : Bugcheck.Code.Register
 Value: 0x157.

 Key : WER.OS.Branch
 Value: vb_release.

 Key : WER.OS.Timestamp
 Value: 2019-12-06T14:06:00Z

 Key : WER.OS.Version
 Value: 10.0.19041.1

FILE_IN_CAB: 092522-5828-01.dmp

BUGCHECK_CODE: 157.

BUGCHECK_P1: ffffad8a9e5b1080.

BUGCHECK_P2: 1

BUGCHECK_P3: 2

BUGCHECK_P4: 0

BLACKBOXBSD: 1 (!blackboxbsd)

BLACKBOXNTFS: 1 (!blackboxntfs)

BLACKBOXPNP: 1 (!blackboxpnp)

BLACKBOXWINLOGON: 1

CUSTOMER_CRASH_COUNT: 1

PROCESS_NAME: csrss.exe

STACK_TEXT:
ffffe380`fb46f7b8 fffff803`30c7bb40 : 00000000`00000157 ffffad8a`9e5b1080 00000000`00000001 00000000`00000002 : nt!KeBugCheckEx
ffffe380`fb46f7c0 fffff803`30a117c0 : 00000000`00005309 ffffad8a`a55803e0 ffffad8a`00000000 ffffad8a`00000000 : nt!KiAbThreadUnboostCpuPriority+0x13ab1c
ffffe380`fb46f830 fffff803`30b30436 : 00000000`00000000 ffffe380`0000d309 ffffad8a`a55803e0 00000000`00000000 : nt!KeAbPostRelease+0x220
ffffe380`fb46f890 fffff8b0`06aa2b84 : 00000000`00010f44 ffffad8a`a55803e0 ffffad8a`a55807a0 fffff8d1`c7274020 : nt!ExReleaseFastMutexUnsafeAndLeaveCriticalRegion+0x26
ffffe380`fb46f8c0 fffff803`30a71d25 : ffffad8a`9e5b1080 ffffad8a`9e5b1080 fffff8b0`06aa20d0 fffff8d1`c7274020 : cdd!PresentWorkerThread+0xab4
ffffe380`fb46fb10 fffff803`30c00628 : fffff803`2ed84180 ffffad8a`9e5b1080 fffff803`30a71cd0 00000000`00000246 : nt!PspSystemThreadStartup+0x55
ffffe380`fb46fb60 00000000`00000000 : ffffe380`fb470000 ffffe380`fb469000 00000000`00000000 00000000`00000000 : nt!KiStartSystemThread+0x28

SYMBOL_NAME: cdd!PresentWorkerThread+ab4

MODULE_NAME: cdd.

IMAGE_NAME: cdd.dll

IMAGE_VERSION: 10.0.19041.1940

STACK_COMMAND: .cxr; .ecxr ; kb.

BUCKET_ID_FUNC_OFFSET: ab4.

FAILURE_BUCKET_ID: 0x157_cdd!PresentWorkerThread

OS_VERSION: 10.0.19041.1

BUILDLAB_STR: vb_release.

OSPLATFORM_TYPE: x64.

OSNAME: Windows 10.

FAILURE_ID_HASH: {13502bf9-f3da-2e81-afb4-1bb4d28da6f1}

Followup: MachineOwner.
---------

Teşekkür ederim. Bu önerilerinizi deneyeceğim bu arada XMP kapalıyken testi 3 saat civarı çalıştırdım. Bu süreçte bir adet bile error bulamadı, testi tamamlamasına izin vermedim fakat önceki test 16 dakikada fail verdiği için bu bile yeterli gibi duruyor. Bu durumda XMP açıkken bu hataları almamın sebebi RAM midir? Yoksa anakart vb. gibi bir sıkıntı da gösterir mi?

Teşekkür ederim. Bu önerilerinizi deneyeceğim bu arada XMP kapalıyken testi 3 saat civarı çalıştırdım. Bu süreçte bir adet bile error bulamadı, testi tamamlamasına izin vermedim fakat önceki test 16 dakikada fail verdiği için bu bile yeterli gibi duruyor. Bu durumda XMP açıkken bu hataları almamın sebebi RAM midir? Yoksa anakart vb. gibi bir sıkıntı da gösterir mi?
2-3 gündür XMP kapalı mavi ekran yemedim. Memtest de sorunsuz çalışıyor. Acaba problem RAM mi MB mi bilemiyorum. 3600 yerine 2133 mhz'de çok performans kaybı yaşar mıyım ?

Tekrardan selamlar. XMP hala kapalı fakat bugün yine art arda 4 kere mavi ekran yedim. Yeni minidump dosyalarımı paylaşıyorum. XMP kapalıyken memtestten geçmesine rağmen ramleri mi değiştirmeliyim ?

 

Dosya Ekleri

  • 20220925_225257.jpg
    20220925_225257.jpg
    217,1 KB · Görüntüleme: 18
Son düzenleme:
Merhaba, belli ki XMP kapalıyken bellekler testten geçiyor ama XMP açıkken geçemiyorlar. Buna direk bellek arızası diyemeyiz; farklı RAM'lerin farklı XMP profilleri işlemci ve anakartlara göre değişkenlik gösterdiklerinden dolayı bazıları hataya düşerken bazıları sorunsuz ve belki de stabil bir şekilde XMP'yi çalıştırabilir. Belki başka marka model 2x8 kit şeklinde RAM alıp taksanız problemsiz çalışacak ama bunu bilemiyoruz maalesef. Gerçi bunu başta da açıklamışım. :)

Kaspersky'ı kaldırabilir misiniz? Hataların üçünde de Kaspersky "benim yüzümden oldu" demese de bir göz kırpıyor sanki. Kaspersky sürücüleri güncel olmayabilir veya başka bir sürücüyle çakışıyor olabilir.

Tam kaynağını bulmak için daha detaylı ustaca bir analiz yapılması lazım. Bir süre öyle deneyin bakalım o zaman mavi ekran alıyor musunuz?

Kaspersky'ı kaldırdığınızda mavi ekran almazsanız problemi çözdük diyebiliriz. Daha sonra güncel bir şekilde tekrar yüklersiniz isterseniz. Tabii mavi ekranlar gelirse kaldırırsınız.

Diyelim ki problem Kaspersky; öyle olsa bile RAM'leri XMP kapalı şekilde kullanmak zorunda kalacaksınız gibi gözüküyor. İşte buna net bir çözümüm yok maalesef. Bu konu biraz uyumsuz donanıma giriyor, şanssızlık.

RAM'lerin arızalı olma ihtimali de var, bunu es geçmeyelim. İsterseniz başka RAM alıp şu an elinizdekileri söküp garanti kapsamında teknik servise incelenmesi için gönderebilirsiniz. Servis size "belleklerde sorun yok" cevabıyla birlikte ürünü geri gönderse bile en kötü ihtimalle satarsınız, sizin sisteminizle uyuşmadı diye başka sistemlerde de problem çıkaracak değil.

Hataların üçünde Kaspersky, ikisinde ise Samsung Magician ve Corsair yazılımları görünüyor. Kaspersky sebebiyle olma ihtimali daha fazla. Kaspersky'ı kaldırdığınızda mavi ekran almaya devam ederseniz bu ikisini de kaldırın.

Son olarak, BEDaisy.sys yani BattlEye'ı da kaldırın, tekrar kurun.


Dökümler:
Rich (BB code):
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced.  This cannot be protected by try-except.
Typically the address is just plain bad or it is pointing at freed memory.
Arguments:
Arg1: ffffa6835e505860, memory referenced.
Arg2: 0000000000000002, X64: bit 0 set if the fault was due to a not-present PTE.
    bit 1 is set if the fault was due to a write, clear if a read.
    bit 3 is set if the processor decided the fault was due to a corrupted PTE.
    bit 4 is set if the fault was due to attempted execute of a no-execute PTE.
    - ARM64: bit 1 is set if the fault was due to a write, clear if a read.
    bit 3 is set if the fault was due to attempted execute of a no-execute PTE.
Arg3: fffff8026de0eb66, If non-zero, the instruction address which referenced the bad memory
    address.
Arg4: 0000000000000002, (reserved)

Debugging Details:
------------------


KEY_VALUES_STRING: 1

    Key  : AV.Type
    Value: Write

    Key  : Analysis.CPU.mSec
    Value: 1187

    Key  : Analysis.DebugAnalysisManager
    Value: Create

    Key  : Analysis.Elapsed.mSec
    Value: 3707

    Key  : Analysis.Init.CPU.mSec
    Value: 125

    Key  : Analysis.Init.Elapsed.mSec
    Value: 18008

    Key  : Analysis.Memory.CommitPeak.Mb
    Value: 139

    Key  : Bugcheck.Code.DumpHeader
    Value: 0x50

    Key  : Bugcheck.Code.Register
    Value: 0x50

    Key  : WER.OS.Branch
    Value: vb_release

    Key  : WER.OS.Timestamp
    Value: 2019-12-06T14:06:00Z

    Key  : WER.OS.Version
    Value: 10.0.19041.1


FILE_IN_CAB:  092922-6343-01.dmp

BUGCHECK_CODE:  50

BUGCHECK_P1: ffffa6835e505860

BUGCHECK_P2: 2

BUGCHECK_P3: fffff8026de0eb66

BUGCHECK_P4: 2

READ_ADDRESS: fffff8026e8fb390: Unable to get MiVisibleState
Unable to get NonPagedPoolStart
Unable to get NonPagedPoolEnd
Unable to get PagedPoolStart
Unable to get PagedPoolEnd
unable to get nt!MmSpecialPagesInUse
 ffffa6835e505860

MM_INTERNAL_CODE:  2

BLACKBOXBSD: 1 (!blackboxbsd)


BLACKBOXNTFS: 1 (!blackboxntfs)


BLACKBOXPNP: 1 (!blackboxpnp)


BLACKBOXWINLOGON: 1

CUSTOMER_CRASH_COUNT:  1

PROCESS_NAME:  LightingService.exe

TRAP_FRAME:  fffffd8207c0f040 -- (.trap 0xfffffd8207c0f040)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000003 rbx=0000000000000000 rcx=ffffa6835e505890
rdx=000000007457624f rsi=0000000000000000 rdi=0000000000000000
rip=fffff8026de0eb66 rsp=fffffd8207c0f1d0 rbp=fffffd8207c0f250
 r8=ffffa683172e0080  r9=0000000000000000 r10=00000000041002f7
r11=fffffd8207c0f2c0 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl zr na po nc
nt!ObfDereferenceObjectWithTag+0x26:
fffff802`6de0eb66 f0480fc15ed0    lock xadd qword ptr [rsi-30h],rbx ds:ffffffff`ffffffd0=????????????????
Resetting default scope

STACK_TEXT:
fffffd82`07c0ed98 fffff802`6e031a9d     : 00000000`00000050 ffffa683`5e505860 00000000`00000002 fffffd82`07c0f040 : nt!KeBugCheckEx
fffffd82`07c0eda0 fffff802`6de399e0     : 00000000`00000000 00000000`00000002 fffffd82`07c0f0c0 00000000`00000000 : nt!MiSystemFault+0x1da08d
fffffd82`07c0eea0 fffff802`6e00715e     : 00000000`00000000 ffffcc01`7f3c0180 ffffa683`1e19b080 fffff802`6de125df : nt!MmAccessFault+0x400
fffffd82`07c0f040 fffff802`6de0eb66     : 00000000`00000001 00000000`00000003 00000000`00000003 ffffa683`1e99b080 : nt!KiPageFault+0x35e
fffffd82`07c0f1d0 fffff802`6e20e926     : fffffd82`07c0f4d0 00000000`00000003 ffffa683`1e505860 00000000`00000000 : nt!ObfDereferenceObjectWithTag+0x26
fffffd82`07c0f210 fffff802`6e2ed1fb     : 00000000`0d000001 00000001`00000000 00000000`00000003 00000000`00000000 : nt!ObWaitForMultipleObjects+0x336
fffffd82`07c0f710 fffff802`6e00a9b5     : 00000000`000010b0 ffffa683`1e99b080 00000000`02e7ed18 fffffd82`07c0f9a8 : nt!NtWaitForMultipleObjects32+0x11b
fffffd82`07c0f990 00000000`76fa1cfc     : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x25
00000000`02e7ecf8 00000000`00000000     : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x76fa1cfc


SYMBOL_NAME:  nt!ObfDereferenceObjectWithTag+26

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

IMAGE_VERSION:  10.0.19041.2006

STACK_COMMAND:  .cxr; .ecxr ; kb

BUCKET_ID_FUNC_OFFSET:  26

FAILURE_BUCKET_ID:  AV_W_(null)_nt!ObfDereferenceObjectWithTag

OS_VERSION:  10.0.19041.1

BUILDLAB_STR:  vb_release

OSPLATFORM_TYPE:  x64

OSNAME:  Windows 10

FAILURE_ID_HASH:  {7fa2d22a-7fd5-fefb-a919-bf62d60b9d91}

Followup:     MachineOwner
---------


*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

SYSTEM_SERVICE_EXCEPTION (3b)
An exception happened while executing a system service routine.
Arguments:
Arg1: 00000000c0000005, Exception code that caused the BugCheck
Arg2: fffff80545218ae2, Address of the instruction which caused the BugCheck
Arg3: ffffa201328f7920, Address of the context record for the exception that caused the BugCheck
Arg4: 0000000000000000, zero.

Debugging Details:
------------------


KEY_VALUES_STRING: 1

    Key  : Analysis.CPU.mSec
    Value: 999

    Key  : Analysis.DebugAnalysisManager
    Value: Create

    Key  : Analysis.Elapsed.mSec
    Value: 2616

    Key  : Analysis.Init.CPU.mSec
    Value: 202

    Key  : Analysis.Init.Elapsed.mSec
    Value: 12485

    Key  : Analysis.Memory.CommitPeak.Mb
    Value: 138

    Key  : Bugcheck.Code.DumpHeader
    Value: 0x3b

    Key  : Bugcheck.Code.Register
    Value: 0x3b

    Key  : WER.OS.Branch
    Value: vb_release

    Key  : WER.OS.Timestamp
    Value: 2019-12-06T14:06:00Z

    Key  : WER.OS.Version
    Value: 10.0.19041.1


FILE_IN_CAB:  092922-6359-01.dmp

BUGCHECK_CODE:  3b

BUGCHECK_P1: c0000005

BUGCHECK_P2: fffff80545218ae2

BUGCHECK_P3: ffffa201328f7920

BUGCHECK_P4: 0

CONTEXT:  ffffa201328f7920 -- (.cxr 0xffffa201328f7920)
rax=0000000000000000 rbx=ffffec852a417830 rcx=ffffca8400219f58
rdx=0000000000000000 rsi=ffffca84a030ad60 rdi=ffffca84a0259ef0
rip=fffff80545218ae2 rsp=ffffec852a4176b0 rbp=0000000000000600
 r8=0000000000000011  r9=0000000000000001 r10=0000000000000000
r11=ffffec852a417748 r12=0000000000000000 r13=0000000000000001
r14=000000000367e7a8 r15=0000000000000000
iopl=0         nv up ei ng nz na pe nc
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00050282
nt!AlpcpSignalAndWait+0x92:
fffff805`45218ae2 488b01          mov     rax,qword ptr [rcx] ds:002b:ffffca84`00219f58=????????????????
Resetting default scope

BLACKBOXBSD: 1 (!blackboxbsd)


BLACKBOXNTFS: 1 (!blackboxntfs)


BLACKBOXWINLOGON: 1

CUSTOMER_CRASH_COUNT:  1

PROCESS_NAME:  WmiPrvSE.exe

STACK_TEXT:
ffffec85`2a4176b0 fffff805`456086b6     : 00000000`00000000 ffffca84`9f20d4c8 c84ce3a0`00000011 00000000`03bbb048 : nt!AlpcpSignalAndWait+0x92
ffffec85`2a417750 fffff805`4560831b     : ffffec85`2a417830 00000000`03bbb048 00000000`03b66d20 00000000`7e000000 : nt!AlpcpReceiveSynchronousReply+0x56
ffffec85`2a4177b0 fffff805`45608cc6     : ffffca84`9e04edc0 00000000`c0020000 00000000`03b66d20 00000000`03bbb048 : nt!AlpcpProcessSynchronousRequest+0x37b
ffffec85`2a4178d0 fffff805`4540a9b5     : ffffca84`9f20d040 ffffec85`2a417a80 00000000`0367e758 ffffec85`2a4179a8 : nt!NtAlpcSendWaitReceivePort+0x1d6
ffffec85`2a417990 00007ff8`0f6ee174     : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x25
00000000`0367e738 00000000`00000000     : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x00007ff8`0f6ee174


SYMBOL_NAME:  nt!AlpcpSignalAndWait+92

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

IMAGE_VERSION:  10.0.19041.2006

STACK_COMMAND:  .cxr 0xffffa201328f7920 ; kb

BUCKET_ID_FUNC_OFFSET:  92

FAILURE_BUCKET_ID:  AV_nt!AlpcpSignalAndWait

OS_VERSION:  10.0.19041.1

BUILDLAB_STR:  vb_release

OSPLATFORM_TYPE:  x64

OSNAME:  Windows 10

FAILURE_ID_HASH:  {5eb8f38c-333a-2c55-fea8-7e01cb6607e5}

Followup:     MachineOwner
---------


*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced.  This cannot be protected by try-except.
Typically the address is just plain bad or it is pointing at freed memory.
Arguments:
Arg1: ffffc78092160020, memory referenced.
Arg2: 0000000000000000, X64: bit 0 set if the fault was due to a not-present PTE.
    bit 1 is set if the fault was due to a write, clear if a read.
    bit 3 is set if the processor decided the fault was due to a corrupted PTE.
    bit 4 is set if the fault was due to attempted execute of a no-execute PTE.
    - ARM64: bit 1 is set if the fault was due to a write, clear if a read.
    bit 3 is set if the fault was due to attempted execute of a no-execute PTE.
Arg3: fffff80366c0e833, If non-zero, the instruction address which referenced the bad memory
    address.
Arg4: 0000000000000000, (reserved)

Debugging Details:
------------------


KEY_VALUES_STRING: 1

    Key  : AV.Type
    Value: Read

    Key  : Analysis.CPU.mSec
    Value: 1531

    Key  : Analysis.DebugAnalysisManager
    Value: Create

    Key  : Analysis.Elapsed.mSec
    Value: 10260

    Key  : Analysis.Init.CPU.mSec
    Value: 156

    Key  : Analysis.Init.Elapsed.mSec
    Value: 10731

    Key  : Analysis.Memory.CommitPeak.Mb
    Value: 133

    Key  : Bugcheck.Code.DumpHeader
    Value: 0x50

    Key  : Bugcheck.Code.Register
    Value: 0x50

    Key  : WER.OS.Branch
    Value: vb_release

    Key  : WER.OS.Timestamp
    Value: 2019-12-06T14:06:00Z

    Key  : WER.OS.Version
    Value: 10.0.19041.1


FILE_IN_CAB:  092922-6218-01.dmp

BUGCHECK_CODE:  50

BUGCHECK_P1: ffffc78092160020

BUGCHECK_P2: 0

BUGCHECK_P3: fffff80366c0e833

BUGCHECK_P4: 0

READ_ADDRESS: fffff803672fb390: Unable to get MiVisibleState
Unable to get NonPagedPoolStart
Unable to get NonPagedPoolEnd
Unable to get PagedPoolStart
Unable to get PagedPoolEnd
unable to get nt!MmSpecialPagesInUse
 ffffc78092160020

MM_INTERNAL_CODE:  0

BLACKBOXBSD: 1 (!blackboxbsd)


BLACKBOXNTFS: 1 (!blackboxntfs)


BLACKBOXPNP: 1 (!blackboxpnp)


BLACKBOXWINLOGON: 1

CUSTOMER_CRASH_COUNT:  1

PROCESS_NAME:  audiodg.exe

TRAP_FRAME:  ffffc4862857f070 -- (.trap 0xffffc4862857f070)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000016 rbx=0000000000000000 rcx=0000000000000001
rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80366c0e833 rsp=ffffc4862857f200 rbp=ffffc4862857f240
 r8=0000000000000016  r9=ffffc78092160000 r10=0000000000000001
r11=fffff80366600000 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl nz na pe nc
nt!ObWaitForMultipleObjects+0x243:
fffff803`66c0e833 4d8b4120        mov     r8,qword ptr [r9+20h] ds:ffffc780`92160020=????????????????
Resetting default scope

STACK_TEXT:
ffffc486`2857edc8 fffff803`66a31d4d     : 00000000`00000050 ffffc780`92160020 00000000`00000000 ffffc486`2857f070 : nt!KeBugCheckEx
ffffc486`2857edd0 fffff803`668399e0     : ffffc486`2857ef79 00000000`00000000 ffffc486`2857f0f0 00000000`00000000 : nt!MiSystemFault+0x1da33d
ffffc486`2857eed0 fffff803`66a0715e     : ffffa08d`6c202340 ffffa08d`6c206280 ffffa08d`6c209700 00000000`000000d0 : nt!MmAccessFault+0x400
ffffc486`2857f070 fffff803`66c0e833     : 00000000`000000c0 ffffc486`2857f240 00000000`00000000 00000000`00000000 : nt!KiPageFault+0x35e
ffffc486`2857f200 fffff803`66c0e5b9     : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!ObWaitForMultipleObjects+0x243
ffffc486`2857f700 fffff803`66a0a9b5     : 00000000`00000000 00000000`00000000 ffffa08d`94858080 fffff803`66ce1590 : nt!NtWaitForMultipleObjects+0x119
ffffc486`2857f990 00007ff9`7f72db54     : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x25
0000005a`aedff968 00000000`00000000     : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x00007ff9`7f72db54


SYMBOL_NAME:  nt!ObWaitForMultipleObjects+243

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

IMAGE_VERSION:  10.0.19041.2006

STACK_COMMAND:  .cxr; .ecxr ; kb

BUCKET_ID_FUNC_OFFSET:  243

FAILURE_BUCKET_ID:  AV_R_(null)_nt!ObWaitForMultipleObjects

OS_VERSION:  10.0.19041.1

BUILDLAB_STR:  vb_release

OSPLATFORM_TYPE:  x64

OSNAME:  Windows 10

FAILURE_ID_HASH:  {32bd02ec-a065-f435-8d24-91710f3f8b0c}

Followup:     MachineOwner
---------
 
Son düzenleme:

Geri
Yukarı