电脑3次蓝屏,求分析下是什么原因

显示全部楼层 · 发表于 2013-8-16 14:07:04

求分析下dmp文件是什么原因

081513-20030-01.dmp 2013/8/15 14:02:18 SYSTEM_SERVICE_EXCEPTION 0x0000003b 00000000`c0000005 fffff960`00175a5f fffff880`0a4af950 00000000`00000000 win32k.sys win32k.sys+c5a5f x64 ntoskrnl.exe+7f1c0 C:\Windows\Minidump\081513-20030-01.dmp 3 15 7601 280,552 2013/8/15 14:03:16

081513-28470-01.dmp 2013/8/15 22:34:59 UNEXPECTED_KERNEL_MODE_TRAP 0x0000007f 00000000`00000008 00000000`80050031 00000000`000006f8 00000000`00000000 ntoskrnl.exe ntoskrnl.exe+7f1c0 NT Kernel & System Microsoft® Windows® Operating System Microsoft Corporation 6.1.7601.17803 (win7sp1_gdr.120330-1504) x64 ntoskrnl.exe+7f1c0 C:\Windows\Minidump\081513-28470-01.dmp 3 15 7601 294,973 2013/8/15 22:36:55

081613-22620-01.dmp 2013/8/16 12:43:59 UNEXPECTED_KERNEL_MODE_TRAP 0x0000007f 00000000`00000008 00000000`80050031 00000000`000006f8 00000000`00000000 ntoskrnl.exe ntoskrnl.exe+7f1c0 NT Kernel & System Microsoft® Windows® Operating System Microsoft Corporation 6.1.7601.17803 (win7sp1_gdr.120330-1504) x64 ntoskrnl.exe+7f1c0 C:\Windows\Minidump\081613-22620-01.dmp 3 15 7601 288,813 2013/8/16 12:44:50

显示全部楼层 · 发表于 2013-8-16 18:41:00

本帖最后由 soul~天于 2013-8-16 19:02 编辑

用windbg分析了下
原文如下：probably caused by: ntkrnlmp.exe（可能是别的程序触发引起）
意思就是说是可能是由某程序触发ntkrnlmp.exe导致在内核态引起错误进而导致蓝屏

显示全部楼层 · 发表于 2013-8-16 18:48:41

本帖最后由 soul~天于 2013-8-16 18:54 编辑

这意味着一个陷阱发生在内核模式下，这是一个陷阱，一种内核不允许有/捕捉（结合的陷阱），或者说是始终瞬间死亡（双重故障）。检测错误PARAMS的第一个数字是多少的陷阱（8 =双重故障等），请咨询英特尔x86系列手册，以了解更多有关这些陷阱是什么

分析得，此次蓝屏由QQ.exe触发ntkrnlmp.exe导致，楼主不妨重装下QQ试试能否有效

显示全部楼层 · 发表于 2013-8-16 18:57:35

本帖最后由 soul~天于 2013-8-16 19:51 编辑

附上windbg报告
Microsoft (R) Windows Debugger Version 6.12.0002.633 X86
Copyright (c) Microsoft Corporation. All rights reserved.

Loading Dump File [C:\Documents and Settings\Administrator\桌面\081513-28470-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*C:\Symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7601 (Service Pack 1) MP (3 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.17803.amd64fre.win7sp1_gdr.120330-1504
Machine Name:
Kernel base = 0xfffff800`0440f000 PsLoadedModuleList = 0xfffff800`04653670
Debug session time: Thu Aug 15 22:34:59.427 2013 (UTC + 8:00)
System Uptime: 0 days 1:49:47.597
（开机多久后蓝屏）

Loading Kernel Symbols
...............................................................
................................................................
.............................
Loading User Symbols
Loading unloaded module list
..........
*******************************************************************************
*                                                                            *
*                      Bugcheck Analysis                                  *
*                                                                            *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 7F, {8, 80050031, 6f8, 0}

Probably caused by : ntkrnlmp.exe ( nt!KiDoubleFaultAbort+b2 )
（造成蓝屏的可能原因）

Followup: MachineOwner
---------

2: kd> !analyze -v
*******************************************************************************
*                                                                            *
*                      Bugcheck Analysis                                  *
*                                                                            *
*******************************************************************************

UNEXPECTED_KERNEL_MODE_TRAP (7f)
This means a trap occurred in kernel mode, and it's a trap of a kind
that the kernel isn't allowed to have/catch (bound trap) or that
is always instant death (double fault).  The first number in the
bugcheck params is the number of the trap (8 = double fault, etc)
Consult an Intel x86 family manual to learn more about what these
traps are. Here is a *portion* of those codes:
（这是windbg分析出的一些建议，建议用google或者有道桌面翻议下，就是上一楼我打的那段话）

If kv shows a taskGate
      use .tss on the part before the colon, then kv.
Else if kv shows a trapframe
      use .trap on that value
Else
      .trap on the appropriate frame will show where the trap was taken
      (on x86, this will be the ebp that goes with the procedure KiTrap)
Endif
kb will then show the corrected stack.
Arguments:
Arg1: 0000000000000008, EXCEPTION_DOUBLE_FAULT
Arg2: 0000000080050031
Arg3: 00000000000006f8
Arg4: 0000000000000000

Debugging Details:
------------------

BUGCHECK_STR:  0x7f_8

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

PROCESS_NAME:  QQ.exe
（触发蓝屏的主要程序，但这不是触发蓝屏的真正程序）

CURRENT_IRQL:  2

LAST_CONTROL_TRANSFER:  from fffff8000448d769 to fffff8000448e1c0

STACK_TEXT:
fffff880`0456aca8 fffff800`0448d769 : 00000000`0000007f 00000000`00000008 00000000`80050031 00000000`000006f8 : nt!KeBugCheckEx
fffff880`0456acb0 fffff800`0448bc32 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiBugCheckDispatch+0x69
fffff880`0456adf0 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiDoubleFaultAbort+0xb2（此函数应该是内核态错误部分）

STACK_COMMAND:  kb

FOLLOWUP_IP:
nt!KiDoubleFaultAbort+b2
fffff800`0448bc32 90             nop

SYMBOL_STACK_INDEX:  2

SYMBOL_NAME:  nt!KiDoubleFaultAbort+b2

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  4f76721c

FAILURE_BUCKET_ID:  X64_0x7f_8_nt!KiDoubleFaultAbort+b2

BUCKET_ID:  X64_0x7f_8_nt!KiDoubleFaultAbort+b2

Followup: MachineOwner
---------

2: kd> ！process
   ^ Syntax error in '！process'
2: kd> !process（使用！process命令）
GetPointerFromAddress: unable to read from fffff800046bd000
PROCESS fffffa8007667730
SessionId: none  Cid: 19ac Peb: 7efdf000  ParentCid: 0a84
DirBase: 739ac000  ObjectTable: fffff8a009a075a0  HandleCount: <Data Not Accessible>
Image: QQ.exe（再次确认下触发蓝屏的程序）
VadRoot fffffa8008a89aa0 Vads 694 Clone 0 Private 12682. Modified 88117. Locked 0.
DeviceMap fffff8a002956320
Token                            fffff8a009e39a90
ReadMemory error: Cannot get nt!KeMaximumIncrement value.
fffff78000000000: Unable to get shared data
ElapsedTime                      00:00:00.000
UserTime                         00:00:00.000
KernelTime                      00:00:00.000
QuotaPoolUsage[PagedPool]       0
QuotaPoolUsage[NonPagedPool]    0
Working Set Sizes (now,min,max)  (12279, 2407, 4815) (49116KB, 9628KB, 19260KB)
PeakWorkingSetSize             18036
VirtualSize                      370 Mb
PeakVirtualSize                376 Mb
PageFaultCount                   181855
MemoryPriority                   BACKGROUND
BasePriority                   8
CommitCharge                   16198

      THREAD fffffa800766b750  Cid 19ac.1980  Teb: 000000007efdb000 Win32Thread: fffff900c2282c20 RUNNING on processor 2
      *** Error in reading nt!_ETHREAD @ fffffa8007667060

显示全部楼层 · 发表于 2013-8-16 19:19:42

清理加固一下内存条硬件，，

显示全部楼层 · 发表于 2013-8-16 19:26:53

soul~天发表于 2013-8-16 18:57
附上windbg报告
Microsoft (R) Windows Debugger Version 6.12.0002.633 X86
Copyright (c) Microsoft Co ...

谢谢您详细的分析啊,我试下删了QQ和QQ影音试下

显示全部楼层 · 发表于 2013-8-16 19:27:52

伊川书院发表于 2013-8-16 19:19
清理加固一下内存条硬件，，

我在安全模式下,不会蓝屏,这个和内存有关系吗?

显示全部楼层 · 发表于 2013-8-16 19:29:31

xiaork 发表于 2013-8-16 19:27
我在安全模式下,不会蓝屏,这个和内存有关系吗?

不太清楚，我是32位的XP系统，，

大至我判断是内存条硬件有问题

显示全部楼层 · 发表于 2013-8-16 19:52:33

xiaork 发表于 2013-8-16 19:26
谢谢您详细的分析啊,我试下删了QQ和QQ影音试下

希望能解决你的问题

显示全部楼层 · 发表于 2014-1-8 12:49:35

我一晚上蓝屏5次这个要人命啊。大庭广众之下，你说多郁闷。http://sdrv.ms/1gfmt35大家去这个地址看看的转存文件，帮忙分析一下吧

[系统] 电脑3次蓝屏,求分析下是什么原因

本帖子中包含更多资源

评分