atikmdag.sys-HP ELITEBOOK 745 G2-Tela azul

Análise do problema

O notebook, um HP ELITEBOOK 745 G2, apresentava tela azul e em seguida desligava. Verificamos que antes de desligar era gerado despejo de memória, DUMP, um arquivo gerado automaticamente pelo SO com uma cópia parcial da memória no momento do erro.

Utilizamos a ferramenta WinDbg (Windows Debugging) para analisarmos o arquivo de DUMP, afim  de descobrirmos o que estava causando a tela azul. 
Depois de uma breve análise, descobrimos que o problema estava sendo causado por uma falha no arquivo atikmdag.sys. Esse arquivo é utilizado pelo drive da placa de vídeo ATI Radeon Kernel Mode Driver, renomeamos o arquivo atikmdag.sys para  atikmdag.old e realizamos alguns testes, funcionou normalmente. Porém, as opções de resolução e propriedades do vídeo foram afetadas; já que o arquivo atikmdag.sys tinha sido renomeado. 

O problema foi resolvido atualizando o drive da placa de vídeo.

Causa

A causa raiz do problema foi o arquivo atikmdag.sys, provavelmente corrompido por uma queda de energia ou um desligamento abrupto da máquina.

Local do arquivo: %SystemRoot%\system32\DRIVERS\atikmdag.sys
Descrição do Arquivo: ATI Radeon Kernel Mode Driver


Solução

1. Abrir o "Gerenciador de Dispositivos" pressionando as teclas "Bandeira do windows + R" escrever: devmgmt.msc; 

2. No gerenciador de dispositivos, vá para "Adaptadores de Vídeo"; 

3. Selecionar o dispositivo e clicar com o lado direito do mouse e "Desinstalar"; 

4. Reinicializar o computador; 

5. Baixar o drive no site do fabricante, aqui, realizar a instalação do drive de vídeo; 

6. Aguardar o final da instalação e em seguida reinicializar a máquina;

7. Realizar os testar e ok.

Resumo do arquivo de DUMP, convertido em texto:

Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
Copyright (c) Microsoft Corporation. All rights reserved.

Loading Dump File [P:\DicasQueFunfa\Homologacao\dump\MEMORY.DMP]
Kernel Summary Dump File: Only kernel address space is available

Loading unloaded module list
................
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 7E, {ffffffffc0000005, fffff8801f4fa13b, fffff8800691b228, fffff8800691aa80}
*** ERROR: Module load completed but symbols could not be loaded for atikmdag.sys
*** ERROR: Module load completed but symbols could not be loaded for atikmpag.sys
*** ERROR: Symbol file could not be found.  Defaulted to export symbols for dxgkrnl.sys -
*** ERROR: Symbol file could not be found.  Defaulted to export symbols for dxgmms1.sys -
***** Kernel symbols are WRONG. Please fix symbols to do analysis.
Probably caused by : atikmdag.sys ( atikmdag+c513b )
Followup: MachineOwner
---------
1: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************
SYSTEM_THREAD_EXCEPTION_NOT_HANDLED (7e)
This is a very common bugcheck.  Usually the exception address pinpoints
the driver/function that caused the problem.  Always note this address
as well as the link date of the driver/image that contains this address.
Arguments:
Arg1: ffffffffc0000005, The exception code that was not handled
Arg2: fffff8801f4fa13b, The address that the exception occurred at
Arg3: fffff8800691b228, Exception Record Address
Arg4: fffff8800691aa80, Context Record Address
Debugging Details:
------------------
***** Kernel symbols are WRONG. Please fix symbols to do analysis.
ADDITIONAL_DEBUG_TEXT:
Use '!findthebuild' command to search for the target build information.
If the build information is available, run '!findthebuild -s ; .reload' to set symbol path and load symbols.
FAULTING_MODULE: fffff80002e5b000 nt
DEBUG_FLR_IMAGE_TIMESTAMP:  5354965e
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - A instru  o no 0x%p referenciou a mem ria no 0x%p. A mem ria n o p de ser %s.
FAULTING_IP:
atikmdag+c513b
fffff880`1f4fa13b 488b83a8060000  mov     rax,qword ptr [rbx+6A8h]
EXCEPTION_RECORD:  fffff8800691b228 -- (.exr 0xfffff8800691b228)
ExceptionAddress: fffff8801f4fa13b (atikmdag+0x00000000000c513b)
   ExceptionCode: c0000005 (Access violation)
  ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 0000000000000000
   Parameter[1]: 00000000000006a8
Attempt to read from address 00000000000006a8
CONTEXT:  fffff8800691aa80 -- (.cxr 0xfffff8800691aa80)
rax=0000000000000000 rbx=0000000000000000 rcx=0000000000000000
rdx=0000000000000000 rsi=0000000000001800 rdi=0000000000000002
rip=fffff8801f4fa13b rsp=fffff8800691b460 rbp=fffffa800ac4a060
 r8=0000000000000002  r9=000000f4100d4000 r10=0000000000000000
r11=fffff8800691b690 r12=fffffa800ac13480 r13=fffffa8008f16cc0
r14=fffffa800f0f7010 r15=fffff8801f435000
iopl=0         nv up ei pl zr na po nc
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010246
atikmdag+0xc513b:
fffff880`1f4fa13b 488b83a8060000  mov     rax,qword ptr [rbx+6A8h] ds:002b:00000000`000006a8=????????????????
Resetting default scope
DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT
BUGCHECK_STR:  0x7E
CURRENT_IRQL:  0
LAST_CONTROL_TRANSFER:  from fffff8801f55946f to fffff8801f4fa13b
STACK_TEXT:
fffff880`0691b460 fffff880`1f55946f : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : atikmdag+0xc513b
fffff880`0691b490 fffff880`1f447e13 : 00000000`00000001 fffffa80`0ac4a060 fffff880`1f435000 000000f4`100d4000 : atikmdag+0x12446f
fffff880`0691b4e0 fffff880`04c0b6d5 : 00000000`00000000 00000000`00000000 fffff880`0691b730 00000000`00000000 : atikmdag+0x12e13
fffff880`0691b640 fffff880`0525f9ac : fffffa80`00000000 00000000`00000000 fffff880`c0000001 fffffa80`00000001 : atikmpag+0xb6d5
fffff880`0691b6d0 fffff880`05373f62 : 00000000`00000000 00000000`00000000 00000000`00000000 fffff8a0`249c4e10 : dxgkrnl+0x39ac
fffff880`0691b700 fffff880`05380e84 : 00000000`00000000 fffffa80`0ac3f000 fffff8a0`249c4e10 fffff800`02e19b7f : dxgmms1!VidMmInterface+0x116a2
fffff880`0691b880 fffff880`053713d1 : fffffa80`0ab4bc60 fffff8a0`249c4e10 fffffa80`0ac3f000 fffffa80`0c2d3400 : dxgmms1!VidMmInterface+0x1e5c4
fffff880`0691b9f0 fffff880`0536c4d4 : fffffa80`0e7b7480 fffffa80`0ac0d010 00000000`00000000 fffff880`ffffdf10 : dxgmms1!VidMmInterface+0xeb11
fffff880`0691bb10 fffff880`0538a33d : fffffa80`00000000 fffffa80`0ac0d010 00000000`0000000f fffff880`0538c0d9 : dxgmms1!VidMmInterface+0x9c14
fffff880`0691bb60 fffff880`053895c8 : fffff800`00b94080 fffffa80`11f7c140 00000000`00000000 fffffa80`0ac0d010 : dxgmms1!VidMmInterface+0x27a7d
fffff880`0691bb90 fffff880`05389066 : 00000000`0001804c fffffa80`1196b010 00000000`00000080 fffffa80`0ac0d010 : dxgmms1!VidMmInterface+0x26d08
fffff880`0691bbc0 fffff800`03165e66 : 00000000`0443bb7f fffffa80`0ac3d060 fffffa80`06cde6d0 fffffa80`0ac3d060 : dxgmms1!VidMmInterface+0x267a6
fffff880`0691bc00 fffff800`02ebc6e6 : fffff800`03049e80 fffffa80`0ac3d060 fffffa80`0a5dab50 fffff8a0`00165101 : nt!PsCreateSystemThread+0x1da
fffff880`0691bc40 00000000`00000000 : fffff880`0691c000 fffff880`06916000 fffff880`0691b590 00000000`00000000 : nt!KeInitializeSemaphore+0x242

FOLLOWUP_IP:
atikmdag+c513b
fffff880`1f4fa13b 488b83a8060000  mov     rax,qword ptr [rbx+6A8h]
SYMBOL_STACK_INDEX:  0
SYMBOL_NAME:  atikmdag+c513b
FOLLOWUP_NAME:  MachineOwner
MODULE_NAME: atikmdag
IMAGE_NAME:  atikmdag.sys
STACK_COMMAND:  .cxr 0xfffff8800691aa80 ; kb
BUCKET_ID:  WRONG_SYMBOLS
Followup: MachineOwner
---------
1: kd> lmvm atikmdag
start             end                 module name
fffff880`1f435000 fffff880`201d8000   atikmdag   (no symbols)        
    Loaded symbol image file: atikmdag.sys
    Image path: \SystemRoot\system32\DRIVERS\atikmdag.sys
    Image name: atikmdag.sys
    Timestamp:        Mon Apr 21 00:54:06 2014 (5354965E)
    CheckSum:         00D4D300
    ImageSize:        00DA3000
    File version:     8.1.1.1379
    Product version:  8.1.1.1379
    File flags:       8 (Mask 3F) Private
    File OS:          40004 NT Win32
    File type:        3.4 Driver
    File date:        00000000.00000000
    Translations:     0409.04b0
    CompanyName:      Advanced Micro Devices, Inc.
    ProductName:      ATI Radeon Family
    InternalName:     atikmdag.sys
    OriginalFilename: atikmdag.sys
    ProductVersion:   8.01.01.1379
    FileVersion:      8.01.01.1379
    FileDescription:  ATI Radeon Kernel Mode Driver
    LegalCopyright:   Copyright (C) 1998-2012 Advanced Micro Devices, Inc.