本帖最后由 wanjun 于 2014-11-14 09:31 编辑
有两台电脑 minidump 文件是空的 下面的 dump 为 另一台的 （Probably caused by : memory_corruption PROCESS_NAME: IEXPLORE.EXE）
[mw_shl_code=css,true]Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [C:\***\*****\Desktop\minidump\Minidump\Mini111314-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*C:\Symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows XP Kernel Version 2600 (Service Pack 3) MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 2600.xpsp_sp3_qfe.130704-0421
Machine Name:
Kernel base = 0x804d8000 PsLoadedModuleList = 0x8055e720
Debug session time: Thu Nov 13 17:18:32.125 2014 (UTC + 8:00)
System Uptime: 0 days 2:32:18.834
Loading Kernel Symbols
...............................................................
................................................................
.....
Loading User Symbols
Loading unloaded module list
........................
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 1000000A, {fffffffc, ff, 1, 80542971}
Probably caused by : memory_corruption
Followup: memory_corruption
---------
1: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: fffffffc, memory referenced
Arg2: 000000ff, IRQL
Arg3: 00000001, bitfield :
bit 0 : value 0 = read operation, 1 = write operation
bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: 80542971, address which referenced memory
Debugging Details:
------------------
WRITE_ADDRESS: fffffffc
CURRENT_IRQL: ff
FAULTING_IP:
nt!KiSystemCallExit2+84
80542971 897308 mov dword ptr [ebx+8],esi
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: CODE_CORRUPTION
BUGCHECK_STR: 0xA
PROCESS_NAME: IEXPLORE.EXE
LAST_CONTROL_TRANSFER: from 00000000 to 80542971
STACK_TEXT:
b5b02d64 00000000 00000ce8 00000810 00000000 nt!KiSystemCallExit2+0x84
WARNING: Frame IP not in any known module. Following frames may be wrong.
00000000 00000000 00000000 00000000 00000000 0x0
STACK_COMMAND: kb
CHKIMG_EXTENSION: !chkimg -lo 50 -d !nt
805427ca-805427cf 6 bytes - nt!KiSystemServiceAccessTeb+2d
[ 8b fc f6 45 72 02:90 e9 b0 99 de 76 ]
6 errors : !nt (805427ca-805427cf)
MODULE_NAME: memory_corruption
IMAGE_NAME: memory_corruption
FOLLOWUP_NAME: memory_corruption
DEBUG_FLR_IMAGE_TIMESTAMP: 0
MEMORY_CORRUPTOR: LARGE
FAILURE_BUCKET_ID: MEMORY_CORRUPTION_LARGE
BUCKET_ID: MEMORY_CORRUPTION_LARGE
Followup: memory_corruption
---------
1: kd> !process
GetPointerFromAddress: unable to read from 80563134
PROCESS 82a6b020 SessionId: none Cid: 1f2c Peb: 7ffdf000 ParentCid: 09d8
DirBase: 05129b00 ObjectTable: e21a9b10 HandleCount: <Data Not Accessible>
Image: IEXPLORE.EXE
VadRoot 830e5290 Vads 607 Clone 0 Private 13624. Modified 796. Locked 0.
DeviceMap e2907d80
Token e36d84a0
ReadMemory error: Cannot get nt!KeMaximumIncrement value.
ffdf0000: Unable to get shared data
ElapsedTime 00:00:00.000
UserTime 00:00:00.000
KernelTime 00:00:00.000
QuotaPoolUsage[PagedPool] 347596
QuotaPoolUsage[NonPagedPool] 41232
Working Set Sizes (now,min,max) (20455, 50, 345) (81820KB, 200KB, 1380KB)
PeakWorkingSetSize 24955
VirtualSize 287 Mb
PeakVirtualSize 303 Mb
PageFaultCount 34319
MemoryPriority BACKGROUND
BasePriority 8
CommitCharge 16446
*** Error in reading nt!_ETHREAD @ 82f32780
[/mw_shl_code]
虽然钱两台没有 dump 但日志里有记录 （在蓝屏重启 都有 bdav 服务停止）
|
楼主: wanjun
发表于 2014-11-13 22:06:23
楼主
百度的推广
额，好像没有（内存就 1G ，能奔 IE已经很不错了……为什么装杀毒，这，因为他们经常用U盘
）…… 有一台 3位数字解压缩 ，一台Winrar,一台 4位数字的解压缩