电脑cf蓝屏求助，蓝屏文件信息如下，代码是Ox000008e，请专家分析下

显示全部楼层 · 发表于 2015-7-10 00:22:10

本帖最后由 gamefish 于 2015-7-10 22:54 编辑

Microsoft (R) Windows Debugger Version 6.12.0002.633 X86
Copyright (c) Microsoft Corporation. All rights reserved.

Loading Dump File [D:\Minidump\Mini070615-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: *** Invalid ***
****************************************************************************
* Symbol loading may be unreliable without a symbol search path.          *
* Use .symfix to have the debugger choose a symbol path.                *
* After setting your symbol path, use .reload to refresh symbol locations. *
****************************************************************************
Executable search path is:
*********************************************************************
* Symbols can not be loaded because symbol path is not initialized. *
*                                                                *
* The Symbol Path can be set by:                                  *
* using the _NT_SYMBOL_PATH environment variable.                *
* using the -y <symbol_path> argument when starting the debugger. *
* using .sympath and .sympath+                                  *
*********************************************************************
Unable to load image ntoskrnl.exe, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
*** ERROR: Module load completed but symbols could not be loaded for ntoskrnl.exe
Windows XP Kernel Version 2600 (Service Pack 3) MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Machine Name:
Kernel base = 0x804d8000 PsLoadedModuleList = 0x8055e720
Debug session time: Mon Jul  6 01:13:12.578 2015 (UTC + 8:00)
System Uptime: 0 days 1:19:46.321
*********************************************************************
* Symbols can not be loaded because symbol path is not initialized. *
*                                                                *
* The Symbol Path can be set by:                                  *
* using the _NT_SYMBOL_PATH environment variable.                *
* using the -y <symbol_path> argument when starting the debugger. *
* using .sympath and .sympath+                                  *
*********************************************************************
Unable to load image ntoskrnl.exe, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
*** ERROR: Module load completed but symbols could not be loaded for ntoskrnl.exe
Loading Kernel Symbols
...............................................................
....................................................
Loading User Symbols
Loading unloaded module list
...................
Unable to load image win32k.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for win32k.sys
*** ERROR: Module load completed but symbols could not be loaded for win32k.sys
*******************************************************************************
*                                                                            *
*                      Bugcheck Analysis                                  *
*                                                                            *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1000008E, {c0000005, bf86d686, b1121a78, 0}

***** Kernel symbols are WRONG. Please fix symbols to do analysis.

*************************************************************************
***                                                                ***
***                                                                ***
*** Your debugger is not using the correct symbols                ***
***                                                                ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information.    ***
***                                                                ***
*** Certain .pdb files (such as the public OS symbols) do not    ***
*** contain the required information.  Contact the group that    ***
*** provided you with these symbols if you need this command to ***
*** work.                                                       ***
***                                                                ***
*** Type referenced: nt!_KPRCB                                  ***
***                                                                ***
*************************************************************************
*************************************************************************
***                                                                ***
***                                                                ***
*** Your debugger is not using the correct symbols                ***
***                                                                ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information.    ***
***                                                                ***
*** Certain .pdb files (such as the public OS symbols) do not    ***
*** contain the required information.  Contact the group that    ***
*** provided you with these symbols if you need this command to ***
*** work.                                                       ***
***                                                                ***
*** Type referenced: nt!KPRCB                                     ***
***                                                                ***
*************************************************************************
*************************************************************************
***                                                                ***
***                                                                ***
*** Your debugger is not using the correct symbols                ***
***                                                                ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information.    ***
***                                                                ***
*** Certain .pdb files (such as the public OS symbols) do not    ***
*** contain the required information.  Contact the group that    ***
*** provided you with these symbols if you need this command to ***
*** work.                                                       ***
***                                                                ***
*** Type referenced: nt!_KPRCB                                  ***
***                                                                ***
*************************************************************************
*************************************************************************
***                                                                ***
***                                                                ***
*** Your debugger is not using the correct symbols                ***
***                                                                ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information.    ***
***                                                                ***
*** Certain .pdb files (such as the public OS symbols) do not    ***
*** contain the required information.  Contact the group that    ***
*** provided you with these symbols if you need this command to ***
*** work.                                                       ***
***                                                                ***
*** Type referenced: nt!KPRCB                                     ***
***                                                                ***
*************************************************************************
*************************************************************************
***                                                                ***
***                                                                ***
*** Your debugger is not using the correct symbols                ***
***                                                                ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information.    ***
***                                                                ***
*** Certain .pdb files (such as the public OS symbols) do not    ***
*** contain the required information.  Contact the group that    ***
*** provided you with these symbols if you need this command to ***
*** work.                                                       ***
***                                                                ***
*** Type referenced: nt!_KPRCB                                  ***
***                                                                ***
*************************************************************************
*************************************************************************
***                                                                ***
***                                                                ***
*** Your debugger is not using the correct symbols                ***
***                                                                ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information.    ***
***                                                                ***
*** Certain .pdb files (such as the public OS symbols) do not    ***
*** contain the required information.  Contact the group that    ***
*** provided you with these symbols if you need this command to ***
*** work.                                                       ***
***                                                                ***
*** Type referenced: nt!_KPRCB                                  ***
***                                                                ***
*************************************************************************
*************************************************************************
***                                                                ***
***                                                                ***
*** Your debugger is not using the correct symbols                ***
***                                                                ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information.    ***
***                                                                ***
*** Certain .pdb files (such as the public OS symbols) do not    ***
*** contain the required information.  Contact the group that    ***
*** provided you with these symbols if you need this command to ***
*** work.                                                       ***
***                                                                ***
*** Type referenced: nt!_KPRCB                                  ***
***                                                                ***
*************************************************************************
Probably caused by : win32k.sys ( win32k+6d686 )

Followup: MachineOwner
---------

下面是BlueScreenView的分析
ntoskrnl.exe ntoskrnl.exe+30c49cf0 0x804d8000 0x806e5000 0x0020d000 0x4802516a 2008-4-14 2:31:06
win32k.sys win32k.sys+6d686 0xbf800000 0xbf9c2800 0x001c2800 0x48025f2a 2008-4-14 3:29:46

显示全部楼层 · 发表于 2015-7-10 00:28:32

求助

显示全部楼层 · 发表于 2015-7-10 06:50:15

你贴的日志全是调试器报错信息，没有安装内核符号文件，无法进行调试，建议用bluescreenview分析，既简单又方便，windebug太麻烦

显示全部楼层 · 发表于 2015-7-10 12:49:39

win32k.sys 是不是和某一软件有冲突

显示全部楼层 · 发表于 2015-7-10 14:39:06

本帖最后由 Liselsia 于 2015-7-10 14:40 编辑

0: kd> !process
PROCESS 8826e720  SessionId: none  Cid: 174c Peb: 7ffd4000  ParentCid: 10ac
DirBase: 0a4c0ae0  ObjectTable: e3685428  HandleCount: <Data Not Accessible>
Image: 360se.exe

0: kd> lmm 360*
start end       module name
b2715000 b272a000 360AvFlt
b4335000 b4357000 360AntiHacker
b45c9000 b461a700 360netmon
b464e000 b4677600 360SelfProtection
b4678000 b46ae000 360Box
b82a8000 b82b4000 360reskit

可能是兼容性问题了，装360卫士了吧，让360的大大们来分析可能会准确点

显示全部楼层 · 发表于 2015-7-10 23:00:55

温馨小屋发表于 2015-7-10 06:50
你贴的日志全是调试器报错信息，没有安装内核符号文件，无法进行调试，建议用bluescreenview分析，既简单又 ...

下面是BlueScreenView的分析
ntoskrnl.exe ntoskrnl.exe+30c49cf0 0x804d8000 0x806e5000 0x0020d000 0x4802516a 2008-4-14 2:31:06
win32k.sys win32k.sys+6d686 0xbf800000 0xbf9c2800 0x001c2800 0x48025f2a 2008-4-14 3:29:46

显示全部楼层 · 发表于 2015-7-10 23:02:01

Liselsia 发表于 2015-7-10 14:39
0: kd> !process
PROCESS 8826e720 SessionId: none Cid: 174c Peb: 7ffd4000 ParentCid: 10ac
...

360不能修复，压根没有修我这错误的程序

显示全部楼层 · 发表于 2015-7-10 23:02:29

cnseatech 发表于 2015-7-10 12:49
win32k.sys 是不是和某一软件有冲突

怎么弄？

显示全部楼层 · 发表于 2015-7-11 10:46:51

gamefish 发表于 2015-7-10 23:02
怎么弄？

回忆一下这个现象是在装了什么软件后或者软件升级后出现的，将此软件卸载看一下有没有此现象重现

显示全部楼层 · 发表于 2015-7-11 12:26:42

gamefish 发表于 2015-7-10 23:00
下面是BlueScreenView的分析
ntoskrnl.exe ntoskrnl.exe+30c49cf0 0x804d8000 0x8 ...

这个是win32多用户管理程序，是重要的系统文件，这种蓝屏多由硬件不兼容导致

[系统] 电脑cf蓝屏求助，蓝屏文件信息如下，代码是Ox000008e，请专家分析下

本帖子中包含更多资源