360蓝屏？有日志。求分析……我只是一个普通的用户！

显示全部楼层 · 发表于 2012-4-30 22:04:22

本帖最后由 ___低调于 2012-4-30 23:06 编辑

Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
Copyright (c) Microsoft Corporation. All rights reserved.

Loading Dump File [C:\Windows\Minidump\043012-19703-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: *** Invalid ***
****************************************************************************
* Symbol loading may be unreliable without a symbol search path.          *
* Use .symfix to have the debugger choose a symbol path.                *
* After setting your symbol path, use .reload to refresh symbol locations. *
****************************************************************************
Executable search path is:
*********************************************************************
* Symbols can not be loaded because symbol path is not initialized. *
*                                                                *
* The Symbol Path can be set by:                                  *
* using the _NT_SYMBOL_PATH environment variable.                *
* using the -y <symbol_path> argument when starting the debugger. *
* using .sympath and .sympath+                                  *
*********************************************************************
Unable to load image \SystemRoot\system32\ntkrnlpa.exe, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntkrnlpa.exe
*** ERROR: Module load completed but symbols could not be loaded for ntkrnlpa.exe
Windows 7 Kernel Version 7600 MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7600.16905.x86fre.win7_gdr.111025-1503
Machine Name:
Kernel base = 0x84017000 PsLoadedModuleList = 0x8415f810
Debug session time: Mon Apr 30 21:51:48.904 2012 (GMT+8)
System Uptime: 0 days 2:28:01.341
*********************************************************************
* Symbols can not be loaded because symbol path is not initialized. *
*                                                                *
* The Symbol Path can be set by:                                  *
* using the _NT_SYMBOL_PATH environment variable.                *
* using the -y <symbol_path> argument when starting the debugger. *
* using .sympath and .sympath+                                  *
*********************************************************************
Unable to load image \SystemRoot\system32\ntkrnlpa.exe, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntkrnlpa.exe
*** ERROR: Module load completed but symbols could not be loaded for ntkrnlpa.exe
Loading Kernel Symbols
...............................................................
................................................................
.........
Loading User Symbols
Loading unloaded module list
.........
*******************************************************************************
*                                                                            *
*                      Bugcheck Analysis                                  *
*                                                                            *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck A, {8baaf95c, 2, 0, 840d1ca4}

*** WARNING: Unable to verify timestamp for 360netmon.sys
*** ERROR: Module load completed but symbols could not be loaded for 360netmon.sys
*** WARNING: Unable to verify timestamp for afd.sys
*** ERROR: Module load completed but symbols could not be loaded for afd.sys
*** WARNING: Unable to verify timestamp for 360AntiHacker.sys
*** ERROR: Module load completed but symbols could not be loaded for 360AntiHacker.sys
*** WARNING: Unable to verify timestamp for FsWriteBack.sys
*** ERROR: Module load completed but symbols could not be loaded for FsWriteBack.sys
*** WARNING: Unable to verify timestamp for Hookport.sys
*** ERROR: Module load completed but symbols could not be loaded for Hookport.sys
***** Kernel symbols are WRONG. Please fix symbols to do analysis.

*************************************************************************
***                                                                ***
***                                                                ***
*** Your debugger is not using the correct symbols                ***
***                                                                ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information.    ***
***                                                                ***
*** Certain .pdb files (such as the public OS symbols) do not    ***
*** contain the required information.  Contact the group that    ***
*** provided you with these symbols if you need this command to ***
*** work.                                                       ***
***                                                                ***
*** Type referenced: nt!_KPRCB                                  ***
***                                                                ***
*************************************************************************
*************************************************************************
***                                                                ***
***                                                                ***
*** Your debugger is not using the correct symbols                ***
***                                                                ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information.    ***
***                                                                ***
*** Certain .pdb files (such as the public OS symbols) do not    ***
*** contain the required information.  Contact the group that    ***
*** provided you with these symbols if you need this command to ***
*** work.                                                       ***
***                                                                ***
*** Type referenced: nt!_KPRCB                                  ***
***                                                                ***
*************************************************************************
*************************************************************************
***                                                                ***
***                                                                ***
*** Your debugger is not using the correct symbols                ***
***                                                                ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information.    ***
***                                                                ***
*** Certain .pdb files (such as the public OS symbols) do not    ***
*** contain the required information.  Contact the group that    ***
*** provided you with these symbols if you need this command to ***
*** work.                                                       ***
***                                                                ***
*** Type referenced: nt!_KPRCB                                  ***
***                                                                ***
*************************************************************************
*********************************************************************
* Symbols can not be loaded because symbol path is not initialized. *
*                                                                *
* The Symbol Path can be set by:                                  *
* using the _NT_SYMBOL_PATH environment variable.                *
* using the -y <symbol_path> argument when starting the debugger. *
* using .sympath and .sympath+                                  *
*********************************************************************
*********************************************************************
* Symbols can not be loaded because symbol path is not initialized. *
*                                                                *
* The Symbol Path can be set by:                                  *
* using the _NT_SYMBOL_PATH environment variable.                *
* using the -y <symbol_path> argument when starting the debugger. *
* using .sympath and .sympath+                                  *
*********************************************************************
Probably caused by : 360netmon.sys ( 360netmon+3591 )

Followup: MachineOwner
---------

显示全部楼层 · 发表于 2012-4-30 22:06:07

电脑安装的是360套餐

显示全部楼层 · 发表于 2012-4-30 22:40:08

貌似某些无法加载卸载试试用别的杀软

显示全部楼层 · 发表于 2012-4-30 22:45:22

msi123456 发表于 2012-4-30 22:40
貌似某些无法加载卸载试试用别的杀软

目前卸载了。看看怎么样

显示全部楼层 · 发表于 2012-4-30 22:45:42

楼主把idump文件打包发上来吧, 让官方技术人员分析一下原因

显示全部楼层 · 发表于 2012-4-30 22:50:39

怎么样了发表于 2012-4-30 22:45
楼主把idump文件打包发上来吧, 让官方技术人员分析一下原因

= =那个是什么。。。

显示全部楼层 · 发表于 2012-4-30 22:52:38

___低调发表于 2012-4-30 22:50
= =那个是什么。。。

不好意思 . 是 dump 蓝屏文件 . 前面多打了一个字母

就在C:\Windows\Minidump这个路径下

显示全部楼层 · 发表于 2012-4-30 22:54:10

怎么样了发表于 2012-4-30 22:52
不好意思 . 是 dump 蓝屏文件 . 前面多打了一个字母

就在C:\Windows\Minidump这个路径下

我复制的这个就是呀……

显示全部楼层 · 发表于 2012-4-30 22:55:37

BugCheck A：
警告：无法验证360netmon.sys（360流量防火墙的驱动）的时间戳
错误：模块加载完成，但是360netmon.sys的符号未能加载
下面都是如上文，只是依次是afd.sys、360AntiHacker.sys（360安全卫士网络防黑模块）、FsWriteBack.sys、Hookport.sys（360安全卫士对系统进行挂钩操作的核心模块），另外两个不清楚

建议将dump 上传至官方，同时考虑使用正式版360

显示全部楼层 · 发表于 2012-4-30 22:57:41

___低调发表于 2012-4-30 22:54
我复制的这个就是呀……

技术人员有专业软件分析蓝屏 , 所以有文件最好

不过你已经卸载了, 发不发也无所谓了

安装其他一款杀软吧

[求助] 360蓝屏？有日志。求分析……我只是一个普通的用户！

本帖子中包含更多资源

本帖子中包含更多资源