none
Partmgr.sys und Bluescreen RRS feed

  • Frage

  • Hallo,

    ich habe ein Problem bei meinem Kunde. Er setzt ein Windows SBS 2003 ein. Er möchte die Sicherung auf eine USB-HDD machen. Immer wenn er eine USB-HDD anschließt bekommt er ein Bluescreen mit Hinweis auf Partmgr.sys. Auch wenn ich die DMP-Datei analysiere, heißt es das Partmgr.sys den Fehler verursacht.

    Ich habe bisher die Chipsatztreiber aktualisiert, Virenscanner und Sicherungsprogramme entfernt. Druckertreiber etc. entfernt. Leider bisher ohne Erfolg.

    Der Bluescreen kommt bei bisher allen USB-HDDs die ich probiert habe.

    Hat jemand noch eine Idee?

    Nachfolgend die Ausgabe von Windbg:


    Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
    Copyright (c) Microsoft Corporation. All rights reserved.


    Loading Dump File [G:\Minidump\Mini123011-02.dmp]
    Mini Kernel Dump File: Only registers and stack trace are available

    Symbol search path is: SRV*c:\localsymbols*http://msdl.microsoft.com/download/symbols
    Executable search path is:
    Windows Server 2003 Kernel Version 3790 (Service Pack 2) MP (4 procs) Free x86 compatible
    Product: LanManNt, suite: SmallBusiness TerminalServer SmallBusinessRestricted SingleUserTS
    Built by: 3790.srv03_sp2_gdr.111025-0634
    Machine Name:
    Kernel base = 0x80800000 PsLoadedModuleList = 0x808a6ea8
    Debug session time: Fri Dec 30 13:20:24.828 2011 (UTC + 1:00)
    System Uptime: 0 days 0:02:21.843
    Loading Kernel Symbols
    ...............................................................
    .....................................
    Loading User Symbols
    Loading unloaded module list
    ..
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************

    Use !analyze -v to get detailed debugging information.

    BugCheck 1000007E, {c0000005, f74cc8f3, f79065d8, f79062d4}

    Unable to load image volsnap.sys, Win32 error 0n2
    *** WARNING: Unable to verify timestamp for volsnap.sys
    *** ERROR: Module load completed but symbols could not be loaded for volsnap.sys
    Probably caused by : PartMgr.sys ( PartMgr!PmAddSignatures+31 )

    Followup: MachineOwner
    ---------

    3: kd> !analyze -v
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************

    SYSTEM_THREAD_EXCEPTION_NOT_HANDLED_M (1000007e)
    This is a very common bugcheck.  Usually the exception address pinpoints
    the driver/function that caused the problem.  Always note this address
    as well as the link date of the driver/image that contains this address.
    Some common problems are exception code 0x80000003.  This means a hard
    coded breakpoint or assertion was hit, but this system was booted
    /NODEBUG.  This is not supposed to happen as developers should never have
    hardcoded breakpoints in retail code, but ...
    If this happens, make sure a debugger gets connected, and the
    system is booted /DEBUG.  This will let us see why this breakpoint is
    happening.
    Arguments:
    Arg1: c0000005, The exception code that was not handled
    Arg2: f74cc8f3, The address that the exception occurred at
    Arg3: f79065d8, Exception Record Address
    Arg4: f79062d4, Context Record Address

    Debugging Details:
    ------------------


    EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - Die Anweisung in 0x%08lx verweist auf Speicher 0x%08lx. Der Vorgang %s konnte nicht im Speicher durchgef hrt werden.

    FAULTING_IP:
    PartMgr!PmAddSignatures+31
    f74cc8f3 897004          mov     dword ptr [eax+4],esi

    EXCEPTION_RECORD:  f79065d8 -- (.exr 0xfffffffff79065d8)
    ExceptionAddress: f74cc8f3 (PartMgr!PmAddSignatures+0x00000031)
       ExceptionCode: c0000005 (Access violation)
      ExceptionFlags: 00000000
    NumberParameters: 2
       Parameter[0]: 00000001
       Parameter[1]: 00790067
    Attempt to write to address 00790067

    CONTEXT:  f79062d4 -- (.cxr 0xfffffffff79062d4)
    eax=00790063 ebx=8b38a938 ecx=e1614cc0 edx=14f8000e esi=8b38a978 edi=8a038000
    eip=f74cc8f3 esp=f79066a0 ebp=f7906710 iopl=0         nv up ei pl nz ac pe nc
    cs=0008  ss=0010  ds=0023  es=0023  fs=0030  gs=0000             efl=00010216
    PartMgr!PmAddSignatures+0x31:
    f74cc8f3 897004          mov     dword ptr [eax+4],esi ds:0023:00790067=????????
    Resetting default scope

    CUSTOMER_CRASH_COUNT:  2

    DEFAULT_BUCKET_ID:  STRING_DEREFERENCE

    CURRENT_IRQL:  0

    ERROR_CODE: (NTSTATUS) 0xc0000005 - Die Anweisung in 0x%08lx verweist auf Speicher 0x%08lx. Der Vorgang %s konnte nicht im Speicher durchgef hrt werden.

    EXCEPTION_PARAMETER1:  00000001

    EXCEPTION_PARAMETER2:  00790067

    WRITE_ADDRESS:  00790067

    FOLLOWUP_IP:
    PartMgr!PmAddSignatures+31
    f74cc8f3 897004          mov     dword ptr [eax+4],esi

    BUGCHECK_STR:  0x7E

    EXCEPTION_STR:  0x0

    LOCK_ADDRESS:  808a5920 -- (!locks 808a5920)

    Resource @ nt!PiEngineLock (0x808a5920)    Available

    WARNING: SystemResourcesList->Flink chain invalid. Resource may be corrupted, or already deleted.


    WARNING: SystemResourcesList->Blink chain invalid. Resource may be corrupted, or already deleted.

    1 total locks

    PNP_TRIAGE:
        Lock address  : 0x808a5920
        Thread Count  : 0
        Thread address: 0x00000000
        Thread wait   : 0x0

    LAST_CONTROL_TRANSFER:  from f74cd5d1 to f74cc8f3

    STACK_TEXT: 
    f7906710 f74cd5d1 8b38a938 8a038000 00000000 PartMgr!PmAddSignatures+0x31
    f7906738 f74ce114 8a038000 8b38a801 00000001 PartMgr!PmCheckAndUpdateSignature+0x9f
    f790676c 8081df85 8b38a801 88d99f44 88d99f84 PartMgr!PmDeviceControl+0x295
    f7906780 f74d86d6 88d99e68 8b3938a0 8b393958 nt!IofCallDriver+0x45
    f7906830 f729023a 8b3938a0 88d99e68 88d99f84 disk!DiskDeviceControl+0x37a
    f790684c 8081df85 8b3938a0 88d99e68 88d99fa8 CLASSPNP!ClassDeviceControlDispatch+0x48
    f7906860 f73267aa 88d99e68 8b3eef38 8b3920d8 nt!IofCallDriver+0x45
    f7906894 8081df85 8b3e9cc8 88d99f8c 88d99fb0 ftdisk!FtDiskDeviceControl+0x84a
    f79068a8 f72dff26 00000000 8b398a10 8a031000 nt!IofCallDriver+0x45
    WARNING: Stack unwind information not available. Following frames may be wrong.
    f79068cc 8081df85 8b392020 88d99e68 00000270 volsnap+0x21f26
    f79068e0 f74cc7c5 8a031000 00000000 8b392eb0 nt!IofCallDriver+0x45
    f790690c f74ccade 8b392020 8a031000 00000000 PartMgr!PmWritePartitionTableEx+0x59
    f790698c f74cd5d1 8b392eb0 8a031000 8b392eb0 PartMgr!PmAddSignatures+0x21c
    f79069b4 f74cd68a 8a031000 00000001 00000001 PartMgr!PmCheckAndUpdateSignature+0x9f
    f79069f0 f74cdd14 8b392eb0 88d9eae0 88d9ec4c PartMgr!PmQueryDeviceRelations+0x7d
    f7906a2c 8081df85 8b392df8 88d9eae0 f7906ab0 PartMgr!PmPnp+0x207
    f7906a40 8090d804 00000000 8b3e99d0 8b3e9ab0 nt!IofCallDriver+0x45
    f7906a6c 8082386d 8b392df8 f7906a8c 8b3e9ab0 nt!IopSynchronousCall+0xb8
    f7906ab4 80909bd5 00000000 8b3e9cc8 00000001 nt!IopQueryDeviceRelations+0x45
    f7906acc 8090ceb9 8b3e99d0 00000001 8a5e7f98 nt!PipEnumerateDevice+0x23
    f7906d24 8090d2f8 89105228 00000001 00000000 nt!PipProcessDevNodeTree+0x21b
    f7906d58 80823345 00000003 8b37f3f0 808ae5fc nt!PiProcessReenumeration+0x60
    f7906d80 80880499 00000000 00000000 8b37f3f0 nt!PipDeviceActionWorker+0x16b
    f7906dac 80949c88 00000000 00000000 00000000 nt!ExpWorkerThread+0xeb
    f7906ddc 8088e0e2 808803ae 00000001 00000000 nt!PspSystemThreadStartup+0x2e
    00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16


    SYMBOL_STACK_INDEX:  0

    SYMBOL_NAME:  PartMgr!PmAddSignatures+31

    FOLLOWUP_NAME:  MachineOwner

    MODULE_NAME: PartMgr

    IMAGE_NAME:  PartMgr.sys

    DEBUG_FLR_IMAGE_TIMESTAMP:  45d6a0c5

    STACK_COMMAND:  .cxr 0xfffffffff79062d4 ; kb

    FAILURE_BUCKET_ID:  0x7E_PartMgr!PmAddSignatures+31

    BUCKET_ID:  0x7E_PartMgr!PmAddSignatures+31

    Followup: MachineOwner
    ---------



    Grüße aus Wachenheim - Martin Schäfer
    Freitag, 30. Dezember 2011 13:11

Alle Antworten

  • Hintergrundwissen:

    Partition manager:
    Partmgr.sys

    A filter driver that sits on top of the disk driver. All disk driver requests pass through the partition manager driver. This driver creates partition devices and notifies the volume managers of partition arrivals and removals. Exposes IOCTLs that return information about partitions to other components, and allow partition configuration.

    Source: http://technet.microsoft.com/en-us/library/cc739412(WS.10).aspx

    Um welche (zertifizierte) Server-Hardware handelt es sich in diesem Fall?

    Tritt das Verhalten auch für eine für die zugrundeliegene Server-Hardware feigegebene und für Windows Server 2003 SP2 zertifizierte USB-Karte auf? Wenn nein, ist die aktuelle (onboard) USB-Lösung (Hardware/Treiber) fehlerhaft und muss bei jeweilien Hersteller ausgetauscht bzw. auf eine Alternativlösung hin erfragt werden.

    --
    Tobias Redelberger
    System & Support Engineer

    StarNET Services
    (HomeOffice Berlin)

    Frankfurter Allee 193
    D-10365 Berlin
    Germany

    Mobil: +49 (163) 84 74 421
    Email: T.Redelberger@starnet-services.net
    Web: http://www.starnet-services.net

    Freitag, 30. Dezember 2011 13:55
    Moderator