Bluescreen "system thread exception not handled" nur beim Herunterfahren

Hallo MS Community,


nach Installation und späterer Deinstallation des Western Digital Acronis Festplattentools AcronisTrueImageWD_28080.exe bringt mein Windows 10 Pro System 1904 aber auch nach upgrade die Version 20H2 Build 19042.662 beim Herunterfahren einen Bluescreen "system thread exception not handled" inkl. memory dump. Ein Runterfahren mit "Neu Starten" oder "Energie sparen" verursacht keinen solchen Bluescreen.


Die Integrität aller geschützten Systemdateien habe ich mit SFC /SCANNOW schon durchgeführt, das tool hat einige systemfiles repariert, aber das half letzendlich auch nix.


Hier die mit dem MS tool WinDbg durchgeführte Analyse der Datei memory.dmp , für Euch Spezialisten.


wer kann helfen ????


Vielen Dank im Voraus, Matthias


Microsoft R Windows Debugger Version 10.0.20153.1000 AMD64Copyright c Microsoft Corporation. All rights reserved.Loading Dump File [C:\Users\XXXXX\Documents\MEMORY.DMP]Kernel Bitmap Dump File: Kernel address space is available, User address space may not be available.************* Path validation summary **************Response Time ms LocationDeferred srv*Symbol search path is: srv*Executable search path is: Windows 10 Kernel Version 19041 MP 4 procs Free x64Product: WinNt, suite: TerminalServer SingleUserTSEdition build lab: 19041.1.amd64fre.vb_release.191206-1406Machine Name:Kernel base = 0xfffff806`37800000 PsLoadedModuleList = 0xfffff806`3842a2b0Debug session time: Sat Dec 5 18:07:17.223 2020 UTC + 1:00System Uptime: 0 days 0:02:23.902Loading Kernel Symbols.........................................................................Page 82922 not present in the dump file. Type ".hh dbgerr004" for details......................................................................................................................................Loading User SymbolsLoading unloaded module list.............For analysis of this file, run !analyze -vnt!KeBugCheckEx:fffff806`37bf5780 48894c2408 mov qword ptr [rsp+8],rcx ss:0018:fffff98c`d3519050=000000000000007e0: kd> !analyze -v******************************************************************************** ** Bugcheck Analysis ** ********************************************************************************SYSTEM_THREAD_EXCEPTION_NOT_HANDLED 7eThis is a very common bugcheck. Usually the exception address pinpointsthe driver/function that caused the problem. Always note this addressas well as the link date of the driver/image that contains this address.Arguments:Arg1: ffffffffc0000005, The exception code that was not handledArg2: fffff80637dbdeac, The address that the exception occurred atArg3: fffff98cd351a048, Exception Record AddressArg4: fffff98cd3519880, Context Record AddressDebugging Details:------------------KEY_VALUES_STRING: 1 Key : AV.Dereference Value: NullPtr Key : AV.Fault Value: Read Key : Analysis.CPU.mSec Value: 2499 Key : Analysis.DebugAnalysisProvider.CPP Value: Create: 8007007e on MHP-SH170R6 Key : Analysis.DebugData Value: CreateObject Key : Analysis.DebugModel Value: CreateObject Key : Analysis.Elapsed.mSec Value: 2555 Key : Analysis.Memory.CommitPeak.Mb Value: 78 Key : Analysis.System Value: CreateObject Key : WER.OS.Branch Value: vb_release Key : WER.OS.Timestamp Value: 2019-12-06T14:06:00Z Key : WER.OS.Version Value: 10.0.19041.1ADDITIONAL_XML: 1OS_BUILD_LAYERS: 1BUGCHECK_CODE: 7eBUGCHECK_P1: ffffffffc0000005BUGCHECK_P2: fffff80637dbdeacBUGCHECK_P3: fffff98cd351a048BUGCHECK_P4: fffff98cd3519880EXCEPTION_RECORD: fffff98cd351a048 -- .exr 0xfffff98cd351a048ExceptionAddress: fffff80637dbdeac nt!BiSpacesUpdatePhysicalDevicePath+0x0000000000000030 ExceptionCode: c0000005 Access violation ExceptionFlags: 00000000NumberParameters: 2 Parameter[0]: 0000000000000000 Parameter[1]: 0000000000000000Attempt to read from address 0000000000000000CONTEXT: fffff98cd3519880 -- .cxr 0xfffff98cd3519880rax=fffff98cd351a2d8 rbx=0000000000000000 rcx=0000000000000000rdx=fffff98cd351a700 rsi=ffffffff80001f00 rdi=ffff870ad87aa260rip=fffff80637dbdeac rsp=fffff98cd351a280 rbp=000000000000006c r8=0000000000000001 r9=0000000000000001 r10=0000000000000000r11=ffffaf824bfeb040 r12=0000000000000000 r13=fffff98cd351a6a8r14=fffff98cd351a320 r15=0000000000000000iopl=0 nv up ei pl zr na po nccs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00050246nt!BiSpacesUpdatePhysicalDevicePath+0x30:fffff806`37dbdeac 833902 cmp dword ptr [rcx],2 ds:002b:00000000`00000000=????????Resetting default scopeBLACKBOXBSD: 1 !blackboxbsdBLACKBOXNTFS: 1 !blackboxntfsBLACKBOXPNP: 1 !blackboxpnpBLACKBOXWINLOGON: 1PROCESS_NAME: SystemREAD_ADDRESS: 0000000000000000 ERROR_CODE: NTSTATUS 0xc0000005 - Die Anweisung in 0x%p verwies auf Arbeitsspeicher bei 0x%p. Der Vorgang %s konnte im Arbeitsspeicher nicht durchgef hrt werden.EXCEPTION_CODE_STR: c0000005EXCEPTION_PARAMETER1: 0000000000000000EXCEPTION_PARAMETER2: 0000000000000000EXCEPTION_STR: 0xc0000005STACK_TEXT: fffff98c`d351a280 fffff806`3816e8ea : 00000000`00000000 00000000`00000000 fffff98c`d351a340 ffffffff`80001f00 : nt!BiSpacesUpdatePhysicalDevicePath+0x30fffff98c`d351a2e0 fffff806`3816d250 : ffffaf82`4f5f6598 ffff870a`d87aa260 fffff98c`0000002a fffff98c`00000000 : nt!BiUpdateEfiEntry+0x96fffff98c`d351a380 fffff806`3816d66a : 00000000`00000000 fffff98c`d351a498 ffffffff`80001f00 00000000`00000002 : nt!BiExportBcdObjects+0xd0fffff98c`d351a3c0 fffff806`3803eb0c : ffffffff`80001f04 00000000`d351a498 ffffffff`80001f04 ffffffff`80001f00 : nt!BiExportStoreAlterationsToEfi+0x52fffff98c`d351a400 fffff806`37f640f1 : ffffffff`80001f04 00000000`00000004 ffff870a`ce6f40b2 00000000`00000002 : nt!BiExportStoreAlterationsToFirmware+0xda844fffff98c`d351a430 fffff806`37f62bd0 : ffffaf82`4f5f64f0 ffffffff`80001f04 ffffaf82`4f5f64f0 ffffa243`85640150 : nt!BcdForciblyUnloadStore+0x5dfffff98c`d351a460 fffff806`3818df9d : fffff98c`d3510000 ffffffff`80001f14 ffffffff`80001f04 00000000`00000000 : nt!PopAllocateHiberContext+0x23cfffff98c`d351a4e0 fffff806`381947ec : ffffaf82`51c9f000 ffffaf82`00000006 00000000`00000002 00000000`00000070 : nt!PopTransitionSystemPowerStateEx+0x4b5fffff98c`d351a5a0 fffff806`37c071b5 : 7ffff806`38424fb0 00000000`ffffffff 00000000`00000000 ffffaf82`4bfeb6e0 : nt!NtSetSystemPowerState+0x4cfffff98c`d351a780 fffff806`37bf95e0 : fffff806`37f614ce 00000000`00000008 fffff98c`d351a978 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x25fffff98c`d351a918 fffff806`37f614ce : 00000000`00000008 fffff98c`d351a978 00000000`00000000 00000000`00000000 : nt!KiServiceLinkagefffff98c`d351a920 fffff806`37f61199 : 00000000`00000000 ffffaf82`4bea06b0 00000000`00000000 00000000`00000000 : nt!PopIssueActionRequest+0x216fffff98c`d351a9c0 fffff806`37b15964 : 00000000`00000001 00000000`00000000 ffffffff`ffffffff fffff806`38423c00 : nt!PopPolicyWorkerAction+0x79fffff98c`d351aa30 fffff806`37a25975 : ffffaf82`00000001 ffffaf82`4bfeb040 fffff806`37b158d0 ffffaf82`00000000 : nt!PopPolicyWorkerThread+0x94fffff98c`d351aa70 fffff806`37b17e25 : ffffaf82`4bfeb040 00000000`00000080 ffffaf82`4bebd040 00000000`00000000 : nt!ExpWorkerThread+0x105fffff98c`d351ab10 fffff806`37bfcdd8 : ffffc200`08f65180 ffffaf82`4bfeb040 fffff806`37b17dd0 00000000`00000000 : nt!PspSystemThreadStartup+0x55fffff98c`d351ab60 00000000`00000000 : fffff98c`d351b000 fffff98c`d3514000 00000000`00000000 00000000`00000000 : nt!KiStartSystemThread+0x28SYMBOL_NAME: nt!BiSpacesUpdatePhysicalDevicePath+30MODULE_NAME: ntIMAGE_NAME: ntkrnlmp.exeSTACK_COMMAND: .cxr 0xfffff98cd3519880 ; kbBUCKET_ID_FUNC_OFFSET: 30FAILURE_BUCKET_ID: AV_nt!BiSpacesUpdatePhysicalDevicePathOS_VERSION: 10.0.19041.1BUILDLAB_STR: vb_releaseOSPLATFORM_TYPE: x64OSNAME: Windows 10FAILURE_ID_HASH: {6d4762d0-0b62-2809-b8cb-00a1b9f470c4}Followup: MachineOwner---------

Weiterlesen...

 

hi, i am woo from Sweden and i want to explain any thing about "pandemic". Please ask me