SYSTEM_THREAD_EXCEPTION_NOT_HANDLED_M (1000007e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003. This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG. This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG. This will let us see why this breakpoint is
happening.
Arguments:
Arg1: ffffffffc0000005, The exception code that was not handled
Arg2: fffff880083f5879, The address that the exception occurred at
Arg3: fffff8800ce5c708, Exception Record Address
Arg4: fffff8800ce5bf60, Context Record Address
STACK_TEXT:
fffff880`0ce5c940 00000000`00000000 : 00000000`00000000 fffffa80`0966aa00 fffffa80`0966a030 00000000`00000075 : athrx+0x1d3879
Все показывает на виновника BSOD athrx.sys
athrx+0x1d3879:
fffff880`083f5879 4883b8002b000000 cmp qword ptr [rax+2B00h],0
fffff880`083f5881 7507 jne athrx+0x1d388a (fffff880`083f588a)
fffff880`083f5883 33c0 xor eax,eax
fffff880`083f5885 e93b010000 jmp athrx+0x1d39c5 (fffff880`083f59c5)
fffff880`083f588a 488b442438 mov rax,qword ptr [rsp+38h]
fffff880`083f588f 488b80002b0000 mov rax,qword ptr [rax+2B00h]
fffff880`083f5896 4889442430 mov qword ptr [rsp+30h],rax
fffff880`083f589b 48837c243000 cmp qword ptr [rsp+30h],0
athrx+0x1d388a:
fffff880`083f588a 488b442438 mov rax,qword ptr [rsp+38h]
fffff880`083f588f 488b80002b0000 mov rax,qword ptr [rax+2B00h]
fffff880`083f5896 4889442430 mov qword ptr [rsp+30h],rax
fffff880`083f589b 48837c243000 cmp qword ptr [rsp+30h],0
fffff880`083f58a1 740f je athrx+0x1d38b2 (fffff880`083f58b2)
fffff880`083f58a3 488b442430 mov rax,qword ptr [rsp+30h]
fffff880`083f58a8 4883b8b801000000 cmp qword ptr [rax+1B8h],0
fffff880`083f58b0 752c jne athrx+0x1d38de (fffff880`083f58de)
Посмотрим более подробно стек
fffff880`0ce5b6f8 fffff800`03882cc4 nt!KeBugCheckEx+0x104
fffff880`0ce5b700 00000000`00000000
fffff880`0ce5b708 fffff880`01659a36 Ntfs!NtfsCorruptionBreakPointTest+0x36
fffff880`0ce5b710 00000000`00000000
fffff880`0ce5b718 00000000`00000000
fffff880`0ce5b720 fffff880`0ce5bf60
fffff880`0ce5b728 00000000`00000000
fffff880`0ce5b730 00000000`00000282
fffff880`0ce5b738 fffff800`03bf32b4 nt!PspUnhandledExceptionInSystemThread+0x24
fffff880`0ce5b740 00000000`0000007e <--- Код ошибки
fffff880`0ce5b748 ffffffff`c0000005 <--- 1 аргумент
fffff880`0ce5b750 fffff880`083f5879 athrx+0x1d3879 <--- 2 аргумент - указан подозреваемый виновник
fffff880`0ce5b758 fffff880`0ce5c708
<--- 3 аргумент
fffff880`0ce5b760 fffff880`0ce5bf60
<--- 4 аргумент
fffff880`0ce5b768 00000000`00000000
fffff880`0ce5b770 00000000`00000000
fffff880`0ce5b778 fffff800`03bac3a5 nt! ?? ::NNGAKEGL::`string'+0x223d
fffff880`0ce5b780 00000000`00000000
.
.
.
fffff880`0ce5bdf8 00000004`00000001
fffff880`0ce5be00 00000000`00000009
fffff880`0ce5be08 fffff800`0388c150 nt!ExpWorkerThread
fffff880`0ce5be10 fffff880`083fbc0b athrx+0x1d9c0b
fffff880`0ce5be18 fffff880`08222000 athrx
fffff880`0ce5be20 fffff880`0861de4c athrx+0x3fbe4c
fffff880`0ce5be28 fffff880`08222000 athrx
fffff880`0ce5be30 fffff880`0861d4bc athrx+0x3fb4bc
fffff880`0ce5be38 fffff880`08222000 athrx
fffff880`0ce5be40 fffff880`0861e194 athrx+0x3fc194
fffff880`0ce5be48 fffff880`08222000 athrx
fffff880`0ce5be50 fffff880`0861df0c athrx+0x3fbf0c
fffff880`0ce5be58 fffff880`08222000 athrx
fffff880`0ce5be60 fffff880`0861dedc athrx+0x3fbedc
fffff880`0ce5be68 fffff880`08222000 athrx
fffff880`0ce5be70 fffff880`08612908 athrx+0x3f0908
fffff880`0ce5be78 fffff800`0380d000 nt!KiSelectNextThread <PERF> (nt+0x0)
fffff880`0ce5be80 fffff800`03aa51bc nt!BBTBuffer <PERF> (nt+0x2981bc)
fffff880`0ce5be88 fffff800`0380d000 nt!KiSelectNextThread <PERF> (nt+0x0)
fffff880`0ce5be90 fffff800`03a9129c nt!BBTBuffer <PERF> (nt+0x28429c)
fffff880`0ce5be98 fffff800`0380d000 nt!KiSelectNextThread <PERF> (nt+0x0)
fffff880`0ce5bea0 fffff800`03aa1f7c nt!BBTBuffer <PERF> (nt+0x294f7c)
fffff880`0ce5bea8 00000000`00000000
fffff880`0ce5beb0 00000000`00000083
fffff880`0ce5beb8 fffff880`00f047d6 Wdf01000!FxRequest::CompleteInternal+0x6aa
fffff880`0ce5bec0 fffff880`083f5879 athrx+0x1d3879
fffff880`0ce5bec8 fffff880`083f587b athrx+0x1d387b
fffff880`0ce5bed0 fffff880`0ce5bf60
fffff880`0ce5bed8 fffff880`0ce5c708
fffff880`0ce5bee0 fffff880`083f587a athrx+0x1d387a
fffff880`0ce5bee8 00000000`00000000
Но есть и такая запись
Unable to load image C:\Program Files\ESET\ESET Smart Security\em008_64.dat, Win32 error 0n2
*** WARNING: Unable to verify timestamp for em008_64.dat
*** ERROR: Module load completed but symbols could not be loaded for em008_64.dat
em008_64+0xf0010
И такая, которые произошли раньше
fffff880`0ce5c7a8 fffff800`03880dba nt!KiPageFault+0x23a
