Windows 11 "faceit.sys" Kaynaklı Yeşil Ekran

gvgod · 29 Haziran 2021

Selamlar dostlar, Windows Update aracılığı ile bu sabah Windows 11'e geçiş yaptım. FACEIT AC açıkken, CS:GO oynarken yaklaşık 20 dakikada bir yeşil ekran hatası alıyorum. Minidump dosyalarından 2 tanesini aşağıya bırakıyorum. Teşekkürler.

Dropbox

www.dropbox.com

Enes3078 · 30 Haziran 2021

Belirttiğiniz gibi sorunun kaynağı tamamen FACEIT. Sorunun çözümü ise kaldırıp tekrar kurmak. Sorun çözülürse bildirmeyi unutmayınız.

[CODE title="Dökümler"]*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: 0000000000000010, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000000, value 0 = read operation, 1 = write operation
Arg4: fffff8044b3177f4, address which referenced memory

Debugging Details:
------------------

*** WARNING: Unable to verify timestamp for FACEIT.sys
*** WARNING: Unable to verify timestamp for win32k.sys

KEY_VALUES_STRING: 1

Key : Analysis.CPU.mSec
Value: 8281

Key : Analysis.DebugAnalysisManager
Value: Create

Key : Analysis.Elapsed.mSec
Value: 59285

Key : Analysis.Init.CPU.mSec
Value: 2061

Key : Analysis.Init.Elapsed.mSec
Value: 55381

Key : Analysis.Memory.CommitPeak.Mb
Value: 77

Key : WER.OS.Branch
Value: co_release

Key : WER.OS.Timestamp
Value: 2021-06-04T16:28:00Z

Key : WER.OS.Version
Value: 10.0.22000.1

BUGCHECK_CODE: d1

BUGCHECK_P1: 10

BUGCHECK_P2: 2

BUGCHECK_P3: 0

BUGCHECK_P4: fffff8044b3177f4

READ_ADDRESS: fffff80446f05450: Unable to get MiVisibleState
Unable to get NonPagedPoolStart
Unable to get NonPagedPoolEnd
Unable to get PagedPoolStart
Unable to get PagedPoolEnd
unable to get nt!MmSpecialPagesInUse
0000000000000010

BLACKBOXBSD: 1 (!blackboxbsd)

BLACKBOXNTFS: 1 (!blackboxntfs)

BLACKBOXPNP: 1 (!blackboxpnp)

BLACKBOXWINLOGON: 1

CUSTOMER_CRASH_COUNT: 1

PROCESS_NAME: System

TRAP_FRAME: ffffd10ae23b21e0 -- (.trap 0xffffd10ae23b21e0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=fffff80444193cc8 rbx=0000000000000000 rcx=000000000000005e
rdx=7bbabc56013e2f5e rsi=0000000000000000 rdi=0000000000000000
rip=fffff8044b3177f4 rsp=ffffd10ae23b2370 rbp=ffffd10ae23b23e9
r8=0000000000000007 r9=0000000000000006 r10=0000000000000002
r11=0000000000030000 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl nz ac pe nc
FACEIT+0xab77f4:
fffff804`4b3177f4 49335f30 xor rbx,qword ptr [r15+30h] ds:00000000`00000030=????????????????
Resetting default scope

STACK_TEXT:
ffffd10a`e23b2098 fffff804`46623da9 : 00000000`0000000a 00000000`00000010 00000000`00000002 00000000`00000000 : nt!KeBugCheckEx
ffffd10a`e23b20a0 fffff804`4661ff00 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiBugCheckDispatch+0x69
ffffd10a`e23b21e0 fffff804`4b3177f4 : fffff804`44193cc0 ffffd10a`e23b23e9 00000000`00000000 00000000`001e001c : nt!KiPageFault+0x440
ffffd10a`e23b2370 fffff804`44193cc0 : ffffd10a`e23b23e9 00000000`00000000 00000000`001e001c fffff804`44193cc8 : FACEIT+0xab77f4
ffffd10a`e23b2378 ffffd10a`e23b23e9 : 00000000`00000000 00000000`001e001c fffff804`44193cc8 ffffd10a`e23b2398 : 0xfffff804`44193cc0
ffffd10a`e23b2380 00000000`00000000 : 00000000`001e001c fffff804`44193cc8 ffffd10a`e23b2398 ffffd10a`e23b2398 : 0xffffd10a`e23b23e9

SYMBOL_NAME: FACEIT+ab77f4

MODULE_NAME: FACEIT

IMAGE_NAME: FACEIT.sys

STACK_COMMAND: .thread ; .cxr ; kb

BUCKET_ID_FUNC_OFFSET: ab77f4

FAILURE_BUCKET_ID: AV_FACEIT!unknown_function

OS_VERSION: 10.0.22000.1

BUILDLAB_STR: co_release

OSPLATFORM_TYPE: x64

OSNAME: Windows 10

FAILURE_ID_HASH: {44e6f20c-7ace-d9ee-735b-d9e711e96ad0}

Followup: MachineOwner
---------

*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: 0000000000000010, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000000, value 0 = read operation, 1 = write operation
Arg4: fffff801702477f4, address which referenced memory

Debugging Details:
------------------

*** WARNING: Unable to verify timestamp for FACEIT.sys
*** WARNING: Unable to verify timestamp for win32k.sys

KEY_VALUES_STRING: 1

Key : Analysis.CPU.mSec
Value: 8718

Key : Analysis.DebugAnalysisManager
Value: Create

Key : Analysis.Elapsed.mSec
Value: 50306

Key : Analysis.Init.CPU.mSec
Value: 2218

Key : Analysis.Init.Elapsed.mSec
Value: 61195

Key : Analysis.Memory.CommitPeak.Mb
Value: 78

Key : WER.OS.Branch
Value: co_release

Key : WER.OS.Timestamp
Value: 2021-06-04T16:28:00Z

Key : WER.OS.Version
Value: 10.0.22000.1

BUGCHECK_CODE: d1

BUGCHECK_P1: 10

BUGCHECK_P2: 2

BUGCHECK_P3: 0

BUGCHECK_P4: fffff801702477f4

READ_ADDRESS: fffff8016e305450: Unable to get MiVisibleState
Unable to get NonPagedPoolStart
Unable to get NonPagedPoolEnd
Unable to get PagedPoolStart
Unable to get PagedPoolEnd
unable to get nt!MmSpecialPagesInUse
0000000000000010

BLACKBOXBSD: 1 (!blackboxbsd)

BLACKBOXNTFS: 1 (!blackboxntfs)

BLACKBOXPNP: 1 (!blackboxpnp)

BLACKBOXWINLOGON: 1

CUSTOMER_CRASH_COUNT: 1

PROCESS_NAME: System

TRAP_FRAME: ffffdd08807b91e0 -- (.trap 0xffffdd08807b91e0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=fffff801690b6cc8 rbx=0000000000000000 rcx=0000000000000070
rdx=d663cfde0125b470 rsi=0000000000000000 rdi=0000000000000000
rip=fffff801702477f4 rsp=ffffdd08807b9370 rbp=ffffdd08807b93e9
r8=0000000000000007 r9=0000000000000006 r10=0000000000000002
r11=0000000000030000 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl nz ac pe nc
FACEIT+0xab77f4:
fffff801`702477f4 49335f30 xor rbx,qword ptr [r15+30h] ds:00000000`00000030=????????????????
Resetting default scope

STACK_TEXT:
ffffdd08`807b9098 fffff801`6da23da9 : 00000000`0000000a 00000000`00000010 00000000`00000002 00000000`00000000 : nt!KeBugCheckEx
ffffdd08`807b90a0 fffff801`6da1ff00 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiBugCheckDispatch+0x69
ffffdd08`807b91e0 fffff801`702477f4 : fffff801`690b6cc0 ffffdd08`807b93e9 00000000`00000000 00000000`001e001c : nt!KiPageFault+0x440
ffffdd08`807b9370 fffff801`690b6cc0 : ffffdd08`807b93e9 00000000`00000000 00000000`001e001c fffff801`690b6cc8 : FACEIT+0xab77f4
ffffdd08`807b9378 ffffdd08`807b93e9 : 00000000`00000000 00000000`001e001c fffff801`690b6cc8 ffffdd08`807b9398 : 0xfffff801`690b6cc0
ffffdd08`807b9380 00000000`00000000 : 00000000`001e001c fffff801`690b6cc8 ffffdd08`807b9398 ffffdd08`807b9398 : 0xffffdd08`807b93e9

SYMBOL_NAME: FACEIT+ab77f4

MODULE_NAME: FACEIT

IMAGE_NAME: FACEIT.sys

STACK_COMMAND: .thread ; .cxr ; kb

BUCKET_ID_FUNC_OFFSET: ab77f4

FAILURE_BUCKET_ID: AV_FACEIT!unknown_function

OS_VERSION: 10.0.22000.1

BUILDLAB_STR: co_release

OSPLATFORM_TYPE: x64

OSNAME: Windows 10

FAILURE_ID_HASH: {44e6f20c-7ace-d9ee-735b-d9e711e96ad0}

Followup: MachineOwner
---------[/CODE]

gvgod · 30 Haziran 2021

Enes3078 dedi:
Belirttiğiniz gibi sorunun kaynağı tamamen FACEIT. Sorunun çözümü ise kaldırıp tekrar kurmak. Sorun çözülürse bildirmeyi unutmayınız.

[CODE title="Dökümler"]*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: 0000000000000010, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000000, value 0 = read operation, 1 = write operation
Arg4: fffff8044b3177f4, address which referenced memory

Debugging Details:
------------------

*** WARNING: Unable to verify timestamp for FACEIT.sys
*** WARNING: Unable to verify timestamp for win32k.sys

KEY_VALUES_STRING: 1

Key : Analysis.CPU.mSec
Value: 8281

Key : Analysis.DebugAnalysisManager
Value: Create

Key : Analysis.Elapsed.mSec
Value: 59285

Key : Analysis.Init.CPU.mSec
Value: 2061

Key : Analysis.Init.Elapsed.mSec
Value: 55381

Key : Analysis.Memory.CommitPeak.Mb
Value: 77

Key : WER.OS.Branch
Value: co_release

Key : WER.OS.Timestamp
Value: 2021-06-04T16:28:00Z

Key : WER.OS.Version
Value: 10.0.22000.1

BUGCHECK_CODE: d1

BUGCHECK_P1: 10

BUGCHECK_P2: 2

BUGCHECK_P3: 0

BUGCHECK_P4: fffff8044b3177f4

READ_ADDRESS: fffff80446f05450: Unable to get MiVisibleState
Unable to get NonPagedPoolStart
Unable to get NonPagedPoolEnd
Unable to get PagedPoolStart
Unable to get PagedPoolEnd
unable to get nt!MmSpecialPagesInUse
0000000000000010

BLACKBOXBSD: 1 (!blackboxbsd)

BLACKBOXNTFS: 1 (!blackboxntfs)

BLACKBOXPNP: 1 (!blackboxpnp)

BLACKBOXWINLOGON: 1

CUSTOMER_CRASH_COUNT: 1

PROCESS_NAME: System

TRAP_FRAME: ffffd10ae23b21e0 -- (.trap 0xffffd10ae23b21e0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=fffff80444193cc8 rbx=0000000000000000 rcx=000000000000005e
rdx=7bbabc56013e2f5e rsi=0000000000000000 rdi=0000000000000000
rip=fffff8044b3177f4 rsp=ffffd10ae23b2370 rbp=ffffd10ae23b23e9
r8=0000000000000007 r9=0000000000000006 r10=0000000000000002
r11=0000000000030000 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl nz ac pe nc
FACEIT+0xab77f4:
fffff804`4b3177f4 49335f30 xor rbx,qword ptr [r15+30h] ds:00000000`00000030=????????????????
Resetting default scope

STACK_TEXT:
ffffd10a`e23b2098 fffff804`46623da9 : 00000000`0000000a 00000000`00000010 00000000`00000002 00000000`00000000 : nt!KeBugCheckEx
ffffd10a`e23b20a0 fffff804`4661ff00 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiBugCheckDispatch+0x69
ffffd10a`e23b21e0 fffff804`4b3177f4 : fffff804`44193cc0 ffffd10a`e23b23e9 00000000`00000000 00000000`001e001c : nt!KiPageFault+0x440
ffffd10a`e23b2370 fffff804`44193cc0 : ffffd10a`e23b23e9 00000000`00000000 00000000`001e001c fffff804`44193cc8 : FACEIT+0xab77f4
ffffd10a`e23b2378 ffffd10a`e23b23e9 : 00000000`00000000 00000000`001e001c fffff804`44193cc8 ffffd10a`e23b2398 : 0xfffff804`44193cc0
ffffd10a`e23b2380 00000000`00000000 : 00000000`001e001c fffff804`44193cc8 ffffd10a`e23b2398 ffffd10a`e23b2398 : 0xffffd10a`e23b23e9

SYMBOL_NAME: FACEIT+ab77f4

MODULE_NAME: FACEIT

IMAGE_NAME: FACEIT.sys

STACK_COMMAND: .thread ; .cxr ; kb

BUCKET_ID_FUNC_OFFSET: ab77f4

FAILURE_BUCKET_ID: AV_FACEIT!unknown_function

OS_VERSION: 10.0.22000.1

BUILDLAB_STR: co_release

OSPLATFORM_TYPE: x64

OSNAME: Windows 10

FAILURE_ID_HASH: {44e6f20c-7ace-d9ee-735b-d9e711e96ad0}

Followup: MachineOwner
---------

*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: 0000000000000010, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000000, value 0 = read operation, 1 = write operation
Arg4: fffff801702477f4, address which referenced memory

Debugging Details:
------------------

*** WARNING: Unable to verify timestamp for FACEIT.sys
*** WARNING: Unable to verify timestamp for win32k.sys

KEY_VALUES_STRING: 1

Key : Analysis.CPU.mSec
Value: 8718

Key : Analysis.DebugAnalysisManager
Value: Create

Key : Analysis.Elapsed.mSec
Value: 50306

Key : Analysis.Init.CPU.mSec
Value: 2218

Key : Analysis.Init.Elapsed.mSec
Value: 61195

Key : Analysis.Memory.CommitPeak.Mb
Value: 78

Key : WER.OS.Branch
Value: co_release

Key : WER.OS.Timestamp
Value: 2021-06-04T16:28:00Z

Key : WER.OS.Version
Value: 10.0.22000.1

BUGCHECK_CODE: d1

BUGCHECK_P1: 10

BUGCHECK_P2: 2

BUGCHECK_P3: 0

BUGCHECK_P4: fffff801702477f4

READ_ADDRESS: fffff8016e305450: Unable to get MiVisibleState
Unable to get NonPagedPoolStart
Unable to get NonPagedPoolEnd
Unable to get PagedPoolStart
Unable to get PagedPoolEnd
unable to get nt!MmSpecialPagesInUse
0000000000000010

BLACKBOXBSD: 1 (!blackboxbsd)

BLACKBOXNTFS: 1 (!blackboxntfs)

BLACKBOXPNP: 1 (!blackboxpnp)

BLACKBOXWINLOGON: 1

CUSTOMER_CRASH_COUNT: 1

PROCESS_NAME: System

TRAP_FRAME: ffffdd08807b91e0 -- (.trap 0xffffdd08807b91e0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=fffff801690b6cc8 rbx=0000000000000000 rcx=0000000000000070
rdx=d663cfde0125b470 rsi=0000000000000000 rdi=0000000000000000
rip=fffff801702477f4 rsp=ffffdd08807b9370 rbp=ffffdd08807b93e9
r8=0000000000000007 r9=0000000000000006 r10=0000000000000002
r11=0000000000030000 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl nz ac pe nc
FACEIT+0xab77f4:
fffff801`702477f4 49335f30 xor rbx,qword ptr [r15+30h] ds:00000000`00000030=????????????????
Resetting default scope

STACK_TEXT:
ffffdd08`807b9098 fffff801`6da23da9 : 00000000`0000000a 00000000`00000010 00000000`00000002 00000000`00000000 : nt!KeBugCheckEx
ffffdd08`807b90a0 fffff801`6da1ff00 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiBugCheckDispatch+0x69
ffffdd08`807b91e0 fffff801`702477f4 : fffff801`690b6cc0 ffffdd08`807b93e9 00000000`00000000 00000000`001e001c : nt!KiPageFault+0x440
ffffdd08`807b9370 fffff801`690b6cc0 : ffffdd08`807b93e9 00000000`00000000 00000000`001e001c fffff801`690b6cc8 : FACEIT+0xab77f4
ffffdd08`807b9378 ffffdd08`807b93e9 : 00000000`00000000 00000000`001e001c fffff801`690b6cc8 ffffdd08`807b9398 : 0xfffff801`690b6cc0
ffffdd08`807b9380 00000000`00000000 : 00000000`001e001c fffff801`690b6cc8 ffffdd08`807b9398 ffffdd08`807b9398 : 0xffffdd08`807b93e9

SYMBOL_NAME: FACEIT+ab77f4

MODULE_NAME: FACEIT

IMAGE_NAME: FACEIT.sys

STACK_COMMAND: .thread ; .cxr ; kb

BUCKET_ID_FUNC_OFFSET: ab77f4

FAILURE_BUCKET_ID: AV_FACEIT!unknown_function

OS_VERSION: 10.0.22000.1

BUILDLAB_STR: co_release

OSPLATFORM_TYPE: x64

OSNAME: Windows 10

FAILURE_ID_HASH: {44e6f20c-7ace-d9ee-735b-d9e711e96ad0}

Followup: MachineOwner
---------[/CODE]

Sadece kaldırıp tekrar kurmadım. Sorun yaşayan arkadaşlar için izlediğim yol aşağıdaki gibi:
1- Öncelikle denetim masasından FACEIT ile ilgili AC ve normal istemciyi kaldırın.
2- "C:\Windows\System32\drivers" yolu içerisinde faceit.sys veya faceit2.sys tarzı bir dosya olmalı. Onu silin.
3- Sisteminizi yeniden başlayıp FACEIT AC'yi tekrardan kurun.
Bunlardan sonra muhtemelen çözülecek. En azından bende böyle oldu. Bunları yaptıktan sonra 40 dakika kadar test ettim ve herhangi bir hata ile karşılaşmadım.

Enes3078 · 30 Haziran 2021

Kaldırdıktan sonra kurmak zorunda değilsiniz zaten fakat kaldırdıktan sonra tekrar kurabileceğinizi belirtmek istedim. Bu dediğiniz de dediğim gibi FACEIT'i kaldırmaya giriyor

gvgod · 30 Haziran 2021

Enes3078 dedi:
Kaldırdıktan sonra kurmak zorunda değilsiniz zaten fakat kaldırdıktan sonra tekrar kurabileceğinizi belirtmek istedim. Bu dediğiniz de dediğim gibi FACEIT'i kaldırmaya giriyor

2. adım uygulanmayınca tekrar aynı şey ile karşılaşılıyordu. O sebepten belirtmek istedim. Teşekkür ederim yardımınız için.

Windows 11 "faceit.sys" Kaynaklı Yeşil Ekran

Ayrıntılı düzenleme

gvgod

Megapat

Dropbox

Enes3078

Exapat

gvgod

Megapat

Enes3078

Exapat

gvgod

Megapat

Benzer konular

Technopat Haberler

Yeni konular

Yeni mesajlar

Gizliliğinize önem veriyoruz