none
BSOD RRS feed

  • Общие обсуждения

  • НА различных ПК от HP, Стоит WinXPPro  SP2 начали появлятся BSOD

    недавно обновляли ie на 7 версию, и антивирус на TRendMicro V8.SP1

    Вот несколько примеров

    Тип события: Ошибка
    Источник события: System Error
    Категория события: (102)
    Код события: 1003
    Дата:  02.12.2008
    Время:  9:13:18
    Пользователь:  Н/Д
    Компьютер: KRAZ-WD-115183
    Описание:
    Код ошибки 1000008e, параметр1 c0000005, параметр2 80573988, параметр3 f73cad20, параметр4 00000000.

    Дополнительные сведения можно найти в центре справки и поддержки, в "http://go.microsoft.com/fwlink/events.asp".
    Данные:
    0000: 53 79 73 74 65 6d 20 45   System E
    0008: 72 72 6f 72 20 20 45 72   rror  Er
    0010: 72 6f 72 20 63 6f 64 65   ror code
    0018: 20 31 30 30 30 30 30 38    1000008
    0020: 65 20 20 50 61 72 61 6d   e  Param
    0028: 65 74 65 72 73 20 63 30   eters c0
    0030: 30 30 30 30 30 35 2c 20   000005,
    0038: 38 30 35 37 33 39 38 38   80573988
    0040: 2c 20 66 37 33 63 61 64   , f73cad
    0048: 32 30 2c 20 30 30 30 30   20, 0000
    0050: 30 30 30 30               0000   

    DUMP

    Microsoft (R) Windows Debugger Version 6.10.0003.233 X86
    Copyright (c) Microsoft Corporation. All rights reserved.


    Loading Dump File [C:\Dump\131114\Minidump\Mini120208-03.dmp]
    Mini Kernel Dump File: Only registers and stack trace are available

    Symbol search path is: C:\symbols;C:\symbols1;C:\symbols3
    Executable search path is:
    Unable to load image ntoskrnl.exe, Win32 error 0n2
    *** WARNING: Unable to verify timestamp for ntoskrnl.exe
    Windows XP Kernel Version 2600 (Service Pack 2) UP Free x86 compatible
    Product: WinNt, suite: TerminalServer SingleUserTS
    Machine Name:
    Kernel base = 0x804d7000 PsLoadedModuleList = 0x805624a0
    Debug session time: Tue Dec  2 10:42:39.921 2008 (GMT+7)
    System Uptime: 0 days 0:13:22.985
    Unable to load image ntoskrnl.exe, Win32 error 0n2
    *** WARNING: Unable to verify timestamp for ntoskrnl.exe
    Loading Kernel Symbols
    ...............................................................
    ................................................................
    .........
    Loading User Symbols
    Loading unloaded module list
    .............
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************

    Use !analyze -v to get detailed debugging information.

    BugCheck 1000008E, {c0000005, 80573988, f73ced20, 0}

    Probably caused by : ntoskrnl.exe ( nt!CcDereferenceFileOffset+dd )

    Followup: MachineOwner
    ---------

    kd> !analyze -v
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************

    KERNEL_MODE_EXCEPTION_NOT_HANDLED_M (1000008e)
    This is a very common bugcheck.  Usually the exception address pinpoints
    the driver/function that caused the problem.  Always note this address
    as well as the link date of the driver/image that contains this address.
    Some common problems are exception code 0x80000003.  This means a hard
    coded breakpoint or assertion was hit, but this system was booted
    /NODEBUG.  This is not supposed to happen as developers should never have
    hardcoded breakpoints in retail code, but ...
    If this happens, make sure a debugger gets connected, and the
    system is booted /DEBUG.  This will let us see why this breakpoint is
    happening.
    Arguments:
    Arg1: c0000005, The exception code that was not handled
    Arg2: 80573988, The address that the exception occurred at
    Arg3: f73ced20, Trap Frame
    Arg4: 00000000

    Debugging Details:
    ------------------


    EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - <Unable to get error code text>

    FAULTING_IP:
    nt!MmAccessFault+cf8
    80573988 f60640          test    byte ptr [esi],40h

    TRAP_FRAME:  f73ced20 -- (.trap 0xfffffffff73ced20)
    ErrCode = 00000000
    eax=8619e801 ebx=9a5f4400 ecx=8619e9f9 edx=00000001 esi=00000248 edi=00000000
    eip=80573988 esp=f73ced94 ebp=f73ceda8 iopl=0         nv up ei ng nz na pe nc
    cs=0008  ss=0010  ds=0023  es=0023  fs=0030  gs=0000             efl=00010286
    nt!MmAccessFault+0xcf8:
    80573988 f60640          test    byte ptr [esi],40h         ds:0023:00000248=??
    Resetting default scope

    CUSTOMER_CRASH_COUNT:  3

    DEFAULT_BUCKET_ID:  DRIVER_FAULT

    BUGCHECK_STR:  0x8E

    PROCESS_NAME:  System

    LAST_CONTROL_TRANSFER:  from 80574134 to 80573988

    STACK_TEXT: 
    f73ceda8 80574134 00000000 00000000 00000000 nt!MmAccessFault+0xcf8
    f73ceddc 804ec781 804e22f1 80000000 00000000 nt!MmAccessFault+0x14a4
    00000000 00000000 00000000 00000000 00000000 nt!CcDereferenceFileOffset+0xdd


    STACK_COMMAND:  kb

    FOLLOWUP_IP:
    nt!CcDereferenceFileOffset+dd
    804ec781 ??              ???

    SYMBOL_STACK_INDEX:  2

    SYMBOL_NAME:  nt!CcDereferenceFileOffset+dd

    FOLLOWUP_NAME:  MachineOwner

    MODULE_NAME: nt

    IMAGE_NAME:  ntoskrnl.exe

    DEBUG_FLR_IMAGE_TIMESTAMP:  45e54690

    FAILURE_BUCKET_ID:  0x8E_nt!CcDereferenceFileOffset+dd

    BUCKET_ID:  0x8E_nt!CcDereferenceFileOffset+dd

    Followup: MachineOwner
    ---------
    !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!

     


    Тип события: Ошибка
    Источник события: System Error
    Категория события: (102)
    Код события: 1003
    Дата:  08.12.2008
    Время:  8:51:22
    Пользователь:  Н/Д
    Компьютер: KRAZ-WD-116012
    Описание:
    Код ошибки 1000008e, параметр1 c0000005, параметр2 805c79ff, параметр3 f79efd20, параметр4 00000000.

    Дополнительные сведения можно найти в центре справки и поддержки, в "http://go.microsoft.com/fwlink/events.asp".
    Данные:
    0000: 53 79 73 74 65 6d 20 45   System E
    0008: 72 72 6f 72 20 20 45 72   rror  Er
    0010: 72 6f 72 20 63 6f 64 65   ror code
    0018: 20 31 30 30 30 30 30 38    1000008
    0020: 65 20 20 50 61 72 61 6d   e  Param
    0028: 65 74 65 72 73 20 63 30   eters c0
    0030: 30 30 30 30 30 35 2c 20   000005,
    0038: 38 30 35 63 37 39 66 66   805c79ff
    0040: 2c 20 66 37 39 65 66 64   , f79efd
    0048: 32 30 2c 20 30 30 30 30   20, 0000
    0050: 30 30 30 30               0000   


    Microsoft (R) Windows Debugger Version 6.10.0003.233 X86
    Copyright (c) Microsoft Corporation. All rights reserved.


    Loading Dump File [C:\Dump\KRAZ-WD-116012\MEMORY.DMP]
    Kernel Complete Dump File: Full address space is available

    Symbol search path is: C:\symbols;C:\symbols1;C:\symbols3;SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols
    Executable search path is:
    Windows XP Kernel Version 2600 (Service Pack 2) UP Free x86 compatible
    Product: WinNt, suite: TerminalServer SingleUserTS
    Built by: 2600.xpsp_sp2_qfe.070227-2300
    Machine Name:
    Kernel base = 0x804d7000 PsLoadedModuleList = 0x805535a0
    Debug session time: Mon Dec  8 08:40:11.593 2008 (GMT+7)
    System Uptime: 0 days 0:13:52.744
    Loading Kernel Symbols
    ...............................................................
    ................................................................
    .........
    Loading User Symbols

    Loading unloaded module list
    .................
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************

    Use !analyze -v to get detailed debugging information.

    BugCheck 8E, {c0000005, 805c79ff, f79efd20, 0}

    Probably caused by : ntkrnlpa.exe ( nt!PspTerminateThreadByPointer+17 )

    Followup: MachineOwner
    ---------

    kd> !analyze -v
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************

    KERNEL_MODE_EXCEPTION_NOT_HANDLED (8e)
    This is a very common bugcheck.  Usually the exception address pinpoints
    the driver/function that caused the problem.  Always note this address
    as well as the link date of the driver/image that contains this address.
    Some common problems are exception code 0x80000003.  This means a hard
    coded breakpoint or assertion was hit, but this system was booted
    /NODEBUG.  This is not supposed to happen as developers should never have
    hardcoded breakpoints in retail code, but ...
    If this happens, make sure a debugger gets connected, and the
    system is booted /DEBUG.  This will let us see why this breakpoint is
    happening.
    Arguments:
    Arg1: c0000005, The exception code that was not handled
    Arg2: 805c79ff, The address that the exception occurred at
    Arg3: f79efd20, Trap Frame
    Arg4: 00000000

    Debugging Details:
    ------------------


    EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - <Unable to get error code text>

    FAULTING_IP:
    nt!PspTerminateThreadByPointer+17
    805c79ff f60640          test    byte ptr [esi],40h

    TRAP_FRAME:  f79efd20 -- (.trap 0xfffffffff79efd20)
    ErrCode = 00000000
    eax=8621c901 ebx=9a5f4400 ecx=8621caa1 edx=00000001 esi=00000248 edi=00000000
    eip=805c79ff esp=f79efd94 ebp=f79efda8 iopl=0         nv up ei ng nz na pe nc
    cs=0008  ss=0010  ds=0023  es=0023  fs=0030  gs=0000             efl=00010286
    nt!PspTerminateThreadByPointer+0x17:
    805c79ff f60640          test    byte ptr [esi],40h         ds:0023:00000248=??
    Resetting default scope

    DEFAULT_BUCKET_ID:  DRIVER_FAULT

    BUGCHECK_STR:  0x8E

    PROCESS_NAME:  System

    LAST_CONTROL_TRANSFER:  from 804fcc8f to 804f8c3f

    STACK_TEXT: 
    f79ef8e8 804fcc8f 0000008e c0000005 805c79ff nt!KeBugCheckEx+0x1b
    f79efcb0 8053d611 f79efccc 00000000 f79efd20 nt!KiDispatchException+0x3b1
    f79efd18 8053d5c2 f79efda8 805c79ff badb0d00 nt!CommonDispatchException+0x4d
    f79efd38 805004c0 8621c9d0 8621c960 804fb256 nt!Kei386EoiHelper+0x18a
    f79efd44 804fb256 80558d20 00000000 00000023 nt!KiSwapThread+0x68
    f79efda8 805c507e 00000000 00000000 00000000 nt!KeRemoveQueue+0x20e
    f79efddc 80541362 8053408a 80000000 00000000 nt!PspSystemThreadStartup+0x40
    00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16


    STACK_COMMAND:  kb

    FOLLOWUP_IP:
    nt!PspTerminateThreadByPointer+17
    805c79ff f60640          test    byte ptr [esi],40h

    SYMBOL_STACK_INDEX:  0

    SYMBOL_NAME:  nt!PspTerminateThreadByPointer+17

    FOLLOWUP_NAME:  MachineOwner

    MODULE_NAME: nt

    IMAGE_NAME:  ntkrnlpa.exe

    DEBUG_FLR_IMAGE_TIMESTAMP:  45e54849

    FAILURE_BUCKET_ID:  0x8E_nt!PspTerminateThreadByPointer+17

    BUCKET_ID:  0x8E_nt!PspTerminateThreadByPointer+17

    Followup: MachineOwner
    ---------


    !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
    Тип события: Ошибка
    Источник события: System Error
    Категория события: (102)
    Код события: 1003
    Дата:  08.12.2008
    Время:  11:53:20
    Пользователь:  Н/Д
    Компьютер: KRAZ-WD-036167
    Описание:
    Код ошибки 1000008e, параметр1 c0000005, параметр2 8057b5f7, параметр3 f7245d20, параметр4 00000000.

    Дополнительные сведения можно найти в центре справки и поддержки, в "http://go.microsoft.com/fwlink/events.asp".
    Данные:
    0000: 53 79 73 74 65 6d 20 45   System E
    0008: 72 72 6f 72 20 20 45 72   rror  Er
    0010: 72 6f 72 20 63 6f 64 65   ror code
    0018: 20 31 30 30 30 30 30 38    1000008
    0020: 65 20 20 50 61 72 61 6d   e  Param
    0028: 65 74 65 72 73 20 63 30   eters c0
    0030: 30 30 30 30 30 35 2c 20   000005,
    0038: 38 30 35 37 62 35 66 37   8057b5f7
    0040: 2c 20 66 37 32 34 35 64   , f7245d
    0048: 32 30 2c 20 30 30 30 30   20, 0000
    0050: 30 30 30 30               0000   

    Dump

    Microsoft (R) Windows Debugger Version 6.10.0003.233 X86
    Copyright (c) Microsoft Corporation. All rights reserved.


    Loading Dump File [C:\Dump\KRAZ-WD-036167\Minidump\Mini120808-02.dmp]
    Mini Kernel Dump File: Only registers and stack trace are available

    Symbol search path is: C:\symbols;C:\symbols1;C:\symbols3
    Executable search path is:
    Unable to load image ntoskrnl.exe, Win32 error 0n2
    *** WARNING: Unable to verify timestamp for ntoskrnl.exe
    Windows XP Kernel Version 2600 (Service Pack 2) UP Free x86 compatible
    Product: WinNt, suite: TerminalServer SingleUserTS
    Machine Name:
    Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055a820
    Debug session time: Mon Dec  8 11:38:11.953 2008 (GMT+7)
    System Uptime: 0 days 0:19:03.359
    Unable to load image ntoskrnl.exe, Win32 error 0n2
    *** WARNING: Unable to verify timestamp for ntoskrnl.exe
    Loading Kernel Symbols
    ...............................................................
    ................................................................
    ..............
    Loading User Symbols
    Loading unloaded module list
    ................
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************

    Use !analyze -v to get detailed debugging information.

    BugCheck 1000008E, {c0000005, 8057b5f7, f7245d20, 0}

    Probably caused by : memory_corruption ( nt!MiRemoveZeroPage+48d )

    Followup: MachineOwner
    ---------

    kd> !analyze -v
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************

    KERNEL_MODE_EXCEPTION_NOT_HANDLED_M (1000008e)
    This is a very common bugcheck.  Usually the exception address pinpoints
    the driver/function that caused the problem.  Always note this address
    as well as the link date of the driver/image that contains this address.
    Some common problems are exception code 0x80000003.  This means a hard
    coded breakpoint or assertion was hit, but this system was booted
    /NODEBUG.  This is not supposed to happen as developers should never have
    hardcoded breakpoints in retail code, but ...
    If this happens, make sure a debugger gets connected, and the
    system is booted /DEBUG.  This will let us see why this breakpoint is
    happening.
    Arguments:
    Arg1: c0000005, The exception code that was not handled
    Arg2: 8057b5f7, The address that the exception occurred at
    Arg3: f7245d20, Trap Frame
    Arg4: 00000000

    Debugging Details:
    ------------------


    EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - <Unable to get error code text>

    FAULTING_IP:
    nt!MiRemoveZeroPage+48d
    8057b5f7 f60640          test    byte ptr [esi],40h

    TRAP_FRAME:  f7245d20 -- (.trap 0xfffffffff7245d20)
    ErrCode = 00000000
    eax=82011801 ebx=9a5f4400 ecx=820119f9 edx=00000001 esi=00000248 edi=00000000
    eip=8057b5f7 esp=f7245d94 ebp=f7245da8 iopl=0         nv up ei ng nz na pe nc
    cs=0008  ss=0010  ds=0023  es=0023  fs=0030  gs=0000             efl=00010286
    nt!MiRemoveZeroPage+0x48d:
    8057b5f7 f60640          test    byte ptr [esi],40h         ds:0023:00000248=??
    Resetting default scope

    CUSTOMER_CRASH_COUNT:  2

    DEFAULT_BUCKET_ID:  DRIVER_FAULT

    BUGCHECK_STR:  0x8E

    PROCESS_NAME:  System

    LAST_CONTROL_TRANSFER:  from 8057cfda to 8057b5f7

    STACK_TEXT: 
    f7245da8 8057cfda 00000000 00000000 00000000 nt!MiRemoveZeroPage+0x48d
    f7245dc4 f7245818 ffffffff 804e2490 804f8ac0 nt!MiDecrementShareCount+0x10
    WARNING: Frame IP not in any known module. Following frames may be wrong.
    f7245ddc 804f88fa 804e4196 80000000 00000000 0xf7245818
    f7245dec 00000000 00000000 00000000 00000000 nt!IoSetCompletionRoutineEx+0x66


    STACK_COMMAND:  kb

    FOLLOWUP_IP:
    nt!MiRemoveZeroPage+48d
    8057b5f7 f60640          test    byte ptr [esi],40h

    SYMBOL_STACK_INDEX:  0

    SYMBOL_NAME:  nt!MiRemoveZeroPage+48d

    FOLLOWUP_NAME:  MachineOwner

    MODULE_NAME: nt

    DEBUG_FLR_IMAGE_TIMESTAMP:  45e55172

    IMAGE_NAME:  memory_corruption

    FAILURE_BUCKET_ID:  0x8E_nt!MiRemoveZeroPage+48d

    BUCKET_ID:  0x8E_nt!MiRemoveZeroPage+48d

    Followup: MachineOwner
    ---------

     

     

     

     

    • Изменен тип Vinokurov YuriyModerator 6 августа 2010 г. 9:16 давность и отсутствие активности в теме
    8 декабря 2008 г. 7:37

Все ответы