none
遭遇蓝屏,贴出代码,望高手解答 RRS feed

  • 问题

  • 系统为全新正规步骤安装的XP SP3原版,打完所有补丁,安装全WHQL且为官方网站下载的正式版驱动(偶从不用测试版驱动),所有驱动均安装(包括:Intel Matrix Storage Manager),且在新装系统前经过多款软件的全盘杀毒。无任何病毒。

    囧囧囧 已经很久没有蓝屏了,就当我逐渐将她遗忘的时候,她又用她那迷人的蓝色提醒我,她又回来了!!!囧囧囧

    硬件配置
    CPU:Q8200
    主板:华硕 P5Q
    内存:金士顿 DDR2 800 2G X 2 窄板
    显卡:GTX260+ 公版
    硬盘:ST 7200.11 320G (固件版本:CC2H),ST 7200.10 320G(固件版本:3.AAE) 都是串口,组RAID 0
    声卡:Creative Sound Blaster Audigy 2 ZS
    光驱:DVD刻录机 三星TS-H652M
    打印机:Cannon i560

    囧囧囧囧囧囧囧囧囧囧囧囧囧囧囧囧囧囧囧囧囧囧囧囧囧囧囧囧囧囧囧囧囧囧囧囧囧囧囧囧囧囧囧囧囧囧囧囧囧囧囧囧囧囧囧囧囧囧囧囧囧囧囧囧囧囧囧囧囧囧囧囧囧囧囧囧囧囧囧囧

    蓝屏时,在蓝色屏幕上有这样一个文件的名字
    “AFD.SYS”

    囧囧囧囧囧囧囧囧囧囧囧囧囧囧囧囧囧囧囧囧囧囧囧囧囧囧囧囧囧囧囧囧囧囧囧囧囧囧囧囧囧囧囧囧囧囧囧囧囧囧囧囧囧囧囧囧囧囧囧囧囧囧囧囧囧囧囧囧囧囧囧囧囧囧囧囧囧囧囧囧

    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************

    Use !analyze -v to get detailed debugging information.

    BugCheck 10000050, {8fc0a863, 0, aafd7cf0, 0}


    Could not read faulting driver name
    Unable to load image Hookport.sys, Win32 error 0n2
    *** WARNING: Unable to verify timestamp for Hookport.sys
    *** ERROR: Module load completed but symbols could not be loaded for Hookport.sys
    Probably caused by : Hookport.sys ( Hookport+47cf )

    Followup: MachineOwner
    ---------

    2: kd> !analyze -v
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************

    PAGE_FAULT_IN_NONPAGED_AREA (50)
    Invalid system memory was referenced.  This cannot be protected by try-except,
    it must be protected by a Probe.  Typically the address is just plain bad or it
    is pointing at freed memory.
    Arguments:
    Arg1: 8fc0a863, memory referenced.
    Arg2: 00000000, value 0 = read operation, 1 = write operation.
    Arg3: aafd7cf0, If non-zero, the instruction address which referenced the bad memory
     address.
    Arg4: 00000000, (reserved)

    Debugging Details:
    ------------------


    Could not read faulting driver name

    READ_ADDRESS:  8fc0a863

    FAULTING_IP:
    afd!AfdIsAddressInUse+40
    aafd7cf0 8b567c          mov     edx,dword ptr [esi+7Ch]

    MM_INTERNAL_CODE:  0

    CUSTOMER_CRASH_COUNT:  1

    DEFAULT_BUCKET_ID:  DRIVER_FAULT

    BUGCHECK_STR:  0x50

    PROCESS_NAME:  QQ.exe

    LAST_CONTROL_TRANSFER:  from aafd7c00 to aafd7cf0

    STACK_TEXT: 
    b3d8d9b4 aafd7c00 870851f0 00000000 00012003 afd!AfdIsAddressInUse+0x40
    b3d8db40 aafde2d7 878696e0 88708710 b3d8db74 afd!AfdBind+0x1f4
    b3d8db50 804f019f 88f5be50 87b0b7a8 806e7410 afd!AfdDispatchDeviceControl+0x53
    b3d8db60 80580982 87b0b884 878696e0 87b0b7a8 nt!IopfCallDriver+0x31
    b3d8db74 805817f7 88f5be50 87b0b7a8 878696e0 nt!IopSynchronousServiceTail+0x70
    b3d8dc10 8057a274 00000fc8 000004e0 00000000 nt!IopXxxControlFile+0x5c5
    b3d8dc44 b80dc7cf 00000fc8 000004e0 00000000 nt!NtDeviceIoControlFile+0x2a
    WARNING: Stack unwind information not available. Following frames may be wrong.
    b3d8dd34 8054262c 00000fc8 000004e0 00000000 Hookport+0x47cf
    b3d8dd34 7c92e514 00000fc8 000004e0 00000000 nt!KiFastCallEntry+0xfc
    0012f814 00000000 00000000 00000000 00000000 0x7c92e514


    STACK_COMMAND:  kb

    FOLLOWUP_IP:
    Hookport+47cf
    b80dc7cf ??              ???

    SYMBOL_STACK_INDEX:  7

    SYMBOL_NAME:  Hookport+47cf

    FOLLOWUP_NAME:  MachineOwner

    MODULE_NAME: Hookport

    IMAGE_NAME:  Hookport.sys

    DEBUG_FLR_IMAGE_TIMESTAMP:  4ad8646c

    FAILURE_BUCKET_ID:  0x50_Hookport+47cf

    BUCKET_ID:  0x50_Hookport+47cf

    Followup: MachineOwner
    ---------

     

    囧囧囧囧囧囧囧囧囧囧囧囧囧囧囧囧囧囧囧囧囧囧囧囧囧囧囧囧囧囧囧囧囧囧囧囧囧囧囧囧囧囧囧囧囧囧囧囧囧囧囧囧囧囧囧囧囧囧囧囧囧囧囧囧囧囧囧囧囧囧囧囧囧囧囧囧囧囧囧囧

    第二次发生时间:11:00

    刚刚在发回复,结果就蓝屏了,我晕,只有全部重新打一遍了

    现在的系统是新装的,所有补丁都打完了,而且上两次蓝屏的时候没装360,不过现在这个电脑有点奇怪,就在不久前(仿佛就是上个星期),电脑开始出现偶尔会有点卡
    情况一:基本没用任何程序,CPU占用很低(0-3%),卡的时候打开记事本打字都能明显感觉到顿,持续时间从几秒到几十秒,但不会长到几分钟,然后就会恢复
    情况二:IE中FLASH比较多的网站卡,CPU占用比较高(50-60%),这时拉动屏幕能明显感觉到卡,其中网站上的FLASH全部像幻灯片样,持续几秒到几十秒,不会长到几分钟(但奇怪的是这种情况仿佛分网站,如:Mydrivers和华军会出现这种情况,而同样FLASH同样多的163和QQ却从不出现,当然也许是巧合)
    情况三:放电影文件的时候,全屏幕和恢复窗口的时候画面会卡住,或像幻灯片一样,持续时间也是几秒到几十秒
    以上三种情况持续时间都是几秒到几十秒

    刚开始怀疑是系统问题,于是重新安装,结果发现问题依旧
    PS:以上情况几个月内都从未出现过(包括酷热的夏天),就上个星期开始突然出现,现已经排除病毒问题(使用了卡巴、麦咖啡、瑞星、金山、BITFEND及木马专杀类软件等全盘扫描过)。

    有个问题,上次蓝屏的时候,蓝屏上有这个文件名afd.SYS,是什么文件,网上查了下,好像很多因为他引起的蓝屏,但又各不相同,不过,分析文件时候,整个分析中却找不到他的名字,这是怎么回事,只有QQ.EXE这些

    贴上刚刚的蓝屏分析:(PS:这次蓝屏时蓝屏画面中没出现afd.SYS这个文件名)


    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************

    Use !analyze -v to get detailed debugging information.

    BugCheck 1000000A, {20000000, 1c, 1, 80503ccc}

    Probably caused by : win32k.sys ( win32k!SetWakeBit+b2 )

    Followup: MachineOwner
    ---------

    2: kd> !analyze -v
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************

    IRQL_NOT_LESS_OR_EQUAL (a)
    An attempt was made to access a pageable (or completely invalid) address at an
    interrupt request level (IRQL) that is too high.  This is usually
    caused by drivers using improper addresses.
    If a kernel debugger is available get the stack backtrace.
    Arguments:
    Arg1: 20000000, memory referenced
    Arg2: 0000001c, IRQL
    Arg3: 00000001, bitfield :
     bit 0 : value 0 = read operation, 1 = write operation
     bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
    Arg4: 80503ccc, address which referenced memory

    Debugging Details:
    ------------------


    WRITE_ADDRESS:  20000000

    CURRENT_IRQL:  1c

    FAULTING_IP:
    nt!KiUnlinkThread+c
    80503ccc 8916            mov     dword ptr [esi],edx

    CUSTOMER_CRASH_COUNT:  1

    DEFAULT_BUCKET_ID:  DRIVER_FAULT

    BUGCHECK_STR:  0xA

    PROCESS_NAME:  csrss.exe

    LAST_CONTROL_TRANSFER:  from 80503d2e to 80503ccc

    STACK_TEXT: 
    b8207a60 80503d2e 87ab8090 00000000 00000000 nt!KiUnlinkThread+0xc
    b8207a74 804fb28d 00000002 00000000 00000010 nt!KiUnwaitThread+0x12
    b8207a90 bf801766 87ec1fc0 00000002 00000000 nt!KeSetEvent+0x49
    b8207aac bf801285 e2bfecf8 00000010 80501264 win32k!SetWakeBit+0xb2
    b8207ad4 bf89fc6b 00000022 0074fff4 bf8010ca win32k!TimersProc+0xeb
    b8207d30 bf88467b b81f7490 00000002 b8207d54 win32k!RawInputThread+0x634
    b8207d40 bf8010ed b81f7490 b8207d64 0074fff4 win32k!xxxCreateSystemThreads+0x60
    b8207d54 8054262c 00000000 00000022 00000000 win32k!NtUserCallOneParam+0x23
    b8207d54 7c92e514 00000000 00000022 00000000 nt!KiFastCallEntry+0xfc
    WARNING: Frame IP not in any known module. Following frames may be wrong.
    00000000 00000000 00000000 00000000 00000000 0x7c92e514


    STACK_COMMAND:  kb

    FOLLOWUP_IP:
    win32k!SetWakeBit+b2
    bf801766 ebe2            jmp     win32k!SetWakeBit+0xb2 (bf80174a)

    SYMBOL_STACK_INDEX:  3

    SYMBOL_NAME:  win32k!SetWakeBit+b2

    FOLLOWUP_NAME:  MachineOwner

    MODULE_NAME: win32k

    IMAGE_NAME:  win32k.sys

    DEBUG_FLR_IMAGE_TIMESTAMP:  49e87572

    FAILURE_BUCKET_ID:  0xA_win32k!SetWakeBit+b2

    BUCKET_ID:  0xA_win32k!SetWakeBit+b2

    Followup: MachineOwner
    ---------


    囧囧囧囧囧囧囧囧囧囧囧囧囧囧囧囧囧囧囧囧囧囧囧囧囧囧囧囧囧囧囧囧囧囧囧囧囧囧囧囧囧囧囧囧囧囧囧囧囧囧囧囧囧囧囧囧囧囧囧囧囧囧囧囧囧囧囧囧囧囧囧囧囧囧囧囧囧囧囧囧

    第三次发生时间:01:00

    要疯了,今天第3次蓝屏了
    蓝屏前出现explorer.exe出错
    然后正常了,不过没过2分钟,蓝屏

    贴出分析

    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************

    Use !analyze -v to get detailed debugging information.

    BugCheck 10000050, {e2b0f000, 0, 805a9a2c, 1}


    Could not read faulting driver name
    Probably caused by : memory_corruption ( nt!MiSectionDelete+10 )

    Followup: MachineOwner
    ---------

    3: kd> !analyze -v
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************

    PAGE_FAULT_IN_NONPAGED_AREA (50)
    Invalid system memory was referenced.  This cannot be protected by try-except,
    it must be protected by a Probe.  Typically the address is just plain bad or it
    is pointing at freed memory.
    Arguments:
    Arg1: e2b0f000, memory referenced.
    Arg2: 00000000, value 0 = read operation, 1 = write operation.
    Arg3: 805a9a2c, If non-zero, the instruction address which referenced the bad memory
     address.
    Arg4: 00000001, (reserved)

    Debugging Details:
    ------------------


    Could not read faulting driver name

    READ_ADDRESS:  e2b0f000

    FAULTING_IP:
    nt!MiSectionDelete+10
    805a9a2c 8b00            mov     eax,dword ptr [eax]

    MM_INTERNAL_CODE:  1

    CUSTOMER_CRASH_COUNT:  1

    DEFAULT_BUCKET_ID:  DRIVER_FAULT

    BUGCHECK_STR:  0x50

    PROCESS_NAME:  QQ.exe

    LAST_CONTROL_TRANSFER:  from 805bc474 to 805a9a2c

    STACK_TEXT: 
    a45d9cb0 805bc474 e3648dd0 00000000 e3648db8 nt!MiSectionDelete+0x10
    a45d9ccc 805276da e3648dd0 00000000 00000c04 nt!ObpRemoveObjectRoutine+0xe0
    a45d9ce4 805bd349 8766f5d0 e1807e18 879475a0 nt!ObfDereferenceObject+0x4c
    a45d9cfc 805bd3df e1807e18 e3648dd0 00000c04 nt!ObpCloseHandleTableEntry+0x155
    a45d9d44 805bd517 00000c04 00000001 00000000 nt!ObpCloseHandle+0x87
    a45d9d58 8054262c 00000c04 0013fb74 7c92e514 nt!NtClose+0x1d
    a45d9d58 7c92e514 00000c04 0013fb74 7c92e514 nt!KiFastCallEntry+0xfc
    WARNING: Frame IP not in any known module. Following frames may be wrong.
    0013fb74 00000000 00000000 00000000 00000000 0x7c92e514


    STACK_COMMAND:  kb

    FOLLOWUP_IP:
    nt!MiSectionDelete+10
    805a9a2c 8b00            mov     eax,dword ptr [eax]

    SYMBOL_STACK_INDEX:  0

    SYMBOL_NAME:  nt!MiSectionDelete+10

    FOLLOWUP_NAME:  MachineOwner

    MODULE_NAME: nt

    DEBUG_FLR_IMAGE_TIMESTAMP:  4a784394

    IMAGE_NAME:  memory_corruption

    FAILURE_BUCKET_ID:  0x50_nt!MiSectionDelete+10

    BUCKET_ID:  0x50_nt!MiSectionDelete+10

    Followup: MachineOwner
    ---------

    2009年11月9日 3:52

全部回复

  • Hookport.sys 好像是 360 安全卫士的组件,可能是它在检测 QQ 时遇到了问题。
    Alexis Zhang (Microsoft MVP 2004' 2007' 2008' 2009')
    2009年11月9日 4:36
    版主
  • 在这之前还有两次蓝屏
    但是代码不一样,其中一次是8E,就是未知错误
    分析后又不是QQ,但我忘了是什么了
    而且这次蓝屏时,在蓝色屏幕上有这样一个文件的名字
    “AFD.SYS”
    2009年11月9日 4:43
  • 建议尝试卸载360安全卫士,然后运行WINDOWS UPDATE更新补丁.
    2009年11月9日 12:01
  • 刚刚在发回复,结果就蓝屏了,我晕,只有全部重新打一遍了

    现在的系统是新装的,所有补丁都打完了,而且上两次蓝屏的时候没装360,不过现在这个电脑有点奇怪,就在不久前(仿佛就是上个星期),电脑开始出现偶尔会有点卡
    情况一:基本没用任何程序,CPU占用很低(0-3%),卡的时候打开记事本打字都能明显感觉到顿,持续时间从几秒到几十秒,但不会长到几分钟,然后就会恢复
    情况二:IE中FLASH比较多的网站卡,CPU占用比较高(50-60%),这时拉动屏幕能明显感觉到卡,其中网站上的FLASH全部像幻灯片样,持续几秒到几十秒,不会长到几分钟(但奇怪的是这种情况仿佛分网站,如:Mydrivers和华军会出现这种情况,而同样FLASH同样多的163和QQ却从不出现,当然也许是巧合)
    情况三:放电影文件的时候,全屏幕和恢复窗口的时候画面会卡住,或像幻灯片一样,持续时间也是几秒到几十秒
    以上三种情况持续时间都是几秒到几十秒

    刚开始怀疑是系统问题,于是重新安装,结果发现问题依旧
    PS:以上情况几个月内都从未出现过(包括酷热的夏天),就上个星期开始突然出现,现已经排除病毒问题(使用了卡巴、麦咖啡、瑞星、金山、BITFEND及木马专杀类软件等全盘扫描过)。

    有个问题,上次蓝屏的时候,蓝屏上有这个文件名afd.SYS,是什么文件,网上查了下,好像很多因为他引起的蓝屏,但又各不相同,不过,分析文件时候,整个分析中却找不到他的名字,这是怎么回事,只有QQ.EXE这些

    贴上刚刚的蓝屏分析:(PS:这次蓝屏时蓝屏画面中没出现afd.SYS这个文件名)


    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************

    Use !analyze -v to get detailed debugging information.

    BugCheck 1000000A, {20000000, 1c, 1, 80503ccc}

    Probably caused by : win32k.sys ( win32k!SetWakeBit+b2 )

    Followup: MachineOwner
    ---------

    2: kd> !analyze -v
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************

    IRQL_NOT_LESS_OR_EQUAL (a)
    An attempt was made to access a pageable (or completely invalid) address at an
    interrupt request level (IRQL) that is too high.  This is usually
    caused by drivers using improper addresses.
    If a kernel debugger is available get the stack backtrace.
    Arguments:
    Arg1: 20000000, memory referenced
    Arg2: 0000001c, IRQL
    Arg3: 00000001, bitfield :
     bit 0 : value 0 = read operation, 1 = write operation
     bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
    Arg4: 80503ccc, address which referenced memory

    Debugging Details:
    ------------------


    WRITE_ADDRESS:  20000000

    CURRENT_IRQL:  1c

    FAULTING_IP:
    nt!KiUnlinkThread+c
    80503ccc 8916            mov     dword ptr [esi],edx

    CUSTOMER_CRASH_COUNT:  1

    DEFAULT_BUCKET_ID:  DRIVER_FAULT

    BUGCHECK_STR:  0xA

    PROCESS_NAME:  csrss.exe

    LAST_CONTROL_TRANSFER:  from 80503d2e to 80503ccc

    STACK_TEXT: 
    b8207a60 80503d2e 87ab8090 00000000 00000000 nt!KiUnlinkThread+0xc
    b8207a74 804fb28d 00000002 00000000 00000010 nt!KiUnwaitThread+0x12
    b8207a90 bf801766 87ec1fc0 00000002 00000000 nt!KeSetEvent+0x49
    b8207aac bf801285 e2bfecf8 00000010 80501264 win32k!SetWakeBit+0xb2
    b8207ad4 bf89fc6b 00000022 0074fff4 bf8010ca win32k!TimersProc+0xeb
    b8207d30 bf88467b b81f7490 00000002 b8207d54 win32k!RawInputThread+0x634
    b8207d40 bf8010ed b81f7490 b8207d64 0074fff4 win32k!xxxCreateSystemThreads+0x60
    b8207d54 8054262c 00000000 00000022 00000000 win32k!NtUserCallOneParam+0x23
    b8207d54 7c92e514 00000000 00000022 00000000 nt!KiFastCallEntry+0xfc
    WARNING: Frame IP not in any known module. Following frames may be wrong.
    00000000 00000000 00000000 00000000 00000000 0x7c92e514


    STACK_COMMAND:  kb

    FOLLOWUP_IP:
    win32k!SetWakeBit+b2
    bf801766 ebe2            jmp     win32k!SetWakeBit+0xb2 (bf80174a)

    SYMBOL_STACK_INDEX:  3

    SYMBOL_NAME:  win32k!SetWakeBit+b2

    FOLLOWUP_NAME:  MachineOwner

    MODULE_NAME: win32k

    IMAGE_NAME:  win32k.sys

    DEBUG_FLR_IMAGE_TIMESTAMP:  49e87572

    FAILURE_BUCKET_ID:  0xA_win32k!SetWakeBit+b2

    BUCKET_ID:  0xA_win32k!SetWakeBit+b2

    Followup: MachineOwner
    ---------

    2009年11月10日 2:24
  • 要疯了,今天第3次蓝屏了
    蓝屏前出现explorer.exe出错
    然后正常了,不过没过2分钟,蓝屏

    贴出分析

    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************

    Use !analyze -v to get detailed debugging information.

    BugCheck 10000050, {e2b0f000, 0, 805a9a2c, 1}


    Could not read faulting driver name
    Probably caused by : memory_corruption ( nt!MiSectionDelete+10 )

    Followup: MachineOwner
    ---------

    3: kd> !analyze -v
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************

    PAGE_FAULT_IN_NONPAGED_AREA (50)
    Invalid system memory was referenced.  This cannot be protected by try-except,
    it must be protected by a Probe.  Typically the address is just plain bad or it
    is pointing at freed memory.
    Arguments:
    Arg1: e2b0f000, memory referenced.
    Arg2: 00000000, value 0 = read operation, 1 = write operation.
    Arg3: 805a9a2c, If non-zero, the instruction address which referenced the bad memory
     address.
    Arg4: 00000001, (reserved)

    Debugging Details:
    ------------------


    Could not read faulting driver name

    READ_ADDRESS:  e2b0f000

    FAULTING_IP:
    nt!MiSectionDelete+10
    805a9a2c 8b00            mov     eax,dword ptr [eax]

    MM_INTERNAL_CODE:  1

    CUSTOMER_CRASH_COUNT:  1

    DEFAULT_BUCKET_ID:  DRIVER_FAULT

    BUGCHECK_STR:  0x50

    PROCESS_NAME:  QQ.exe

    LAST_CONTROL_TRANSFER:  from 805bc474 to 805a9a2c

    STACK_TEXT: 
    a45d9cb0 805bc474 e3648dd0 00000000 e3648db8 nt!MiSectionDelete+0x10
    a45d9ccc 805276da e3648dd0 00000000 00000c04 nt!ObpRemoveObjectRoutine+0xe0
    a45d9ce4 805bd349 8766f5d0 e1807e18 879475a0 nt!ObfDereferenceObject+0x4c
    a45d9cfc 805bd3df e1807e18 e3648dd0 00000c04 nt!ObpCloseHandleTableEntry+0x155
    a45d9d44 805bd517 00000c04 00000001 00000000 nt!ObpCloseHandle+0x87
    a45d9d58 8054262c 00000c04 0013fb74 7c92e514 nt!NtClose+0x1d
    a45d9d58 7c92e514 00000c04 0013fb74 7c92e514 nt!KiFastCallEntry+0xfc
    WARNING: Frame IP not in any known module. Following frames may be wrong.
    0013fb74 00000000 00000000 00000000 00000000 0x7c92e514


    STACK_COMMAND:  kb

    FOLLOWUP_IP:
    nt!MiSectionDelete+10
    805a9a2c 8b00            mov     eax,dword ptr [eax]

    SYMBOL_STACK_INDEX:  0

    SYMBOL_NAME:  nt!MiSectionDelete+10

    FOLLOWUP_NAME:  MachineOwner

    MODULE_NAME: nt

    DEBUG_FLR_IMAGE_TIMESTAMP:  4a784394

    IMAGE_NAME:  memory_corruption

    FAILURE_BUCKET_ID:  0x50_nt!MiSectionDelete+10

    BUCKET_ID:  0x50_nt!MiSectionDelete+10

    Followup: MachineOwner
    ---------

     

    2009年11月10日 17:01
  • 建议安装XP SP3 然后硬盘打上IMSM驱动即Intel Matrix Storage Manager   主板驱动都打上 全部更新补丁这次 全部不安装任何软件只安装FLASH  PLAYER   然后你的驱动要用官方的  或是你买电脑时 送的
    Windows System & Performance
    2009年11月11日 1:45
  • 看了一大串 都出现驱动 这英文单词  Intel Matrix Storage Manager是英特尔矩阵存储技术软件,对高性能串行ATA RAID 0、ATA RAID 1、ATA RAID 5、ATA RAID 10阵列提供支持。  你 的网卡驱动一定要用原装的  然后安装上这个IMSM
    Windows System & Performance
    2009年11月11日 1:47
  • 又再度蓝屏
    12点10,重新启动电脑,点了重新启动,结果蓝屏,要疯了!!!
    ...........
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************

    Use !analyze -v to get detailed debugging information.

    BugCheck 1000008E, {c0000005, bf8498d0, aa03f89c, 0}

    Probably caused by : win32k.sys ( win32k!vSpRedrawSprite+17 )

    Followup: MachineOwner
    ---------

    3: kd> !analyze -v
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************

    KERNEL_MODE_EXCEPTION_NOT_HANDLED_M (1000008e)
    This is a very common bugcheck.  Usually the exception address pinpoints
    the driver/function that caused the problem.  Always note this address
    as well as the link date of the driver/image that contains this address.
    Some common problems are exception code 0x80000003.  This means a hard
    coded breakpoint or assertion was hit, but this system was booted
    /NODEBUG.  This is not supposed to happen as developers should never have
    hardcoded breakpoints in retail code, but ...
    If this happens, make sure a debugger gets connected, and the
    system is booted /DEBUG.  This will let us see why this breakpoint is
    happening.
    Arguments:
    Arg1: c0000005, The exception code that was not handled
    Arg2: bf8498d0, The address that the exception occurred at
    Arg3: aa03f89c, Trap Frame
    Arg4: 00000000

    Debugging Details:
    ------------------


    EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - "0x%08lx"

    FAULTING_IP:
    win32k!vSpRedrawSprite+17
    bf8498d0 855920          test    dword ptr [ecx+20h],ebx

    TRAP_FRAME:  aa03f89c -- (.trap 0xffffffffaa03f89c)
    ErrCode = 00000000
    eax=e16be008 ebx=00000400 ecx=00000000 edx=e2cf01f0 esi=e2cf01f0 edi=00000000
    eip=bf8498d0 esp=aa03f910 ebp=aa03f938 iopl=0         nv up ei ng nz na pe nc
    cs=0008  ss=0010  ds=0023  es=0023  fs=0030  gs=0000             efl=00010286
    win32k!vSpRedrawSprite+0x17:
    bf8498d0 855920          test    dword ptr [ecx+20h],ebx ds:0023:00000020=????????
    Resetting default scope

    CUSTOMER_CRASH_COUNT:  1

    DEFAULT_BUCKET_ID:  DRIVER_FAULT

    BUGCHECK_STR:  0x8E

    PROCESS_NAME:  everest.exe

    LAST_CONTROL_TRANSFER:  from bf849bca to bf8498d0

    STACK_TEXT: 
    aa03f938 bf849bca e2cf01f0 e16be048 88c384a0 win32k!vSpRedrawSprite+0x17
    aa03f95c bf849b36 e16be008 e2cf01f0 e4859818 win32k!vSpZorderSprite+0x93
    aa03f978 bf849a04 e16be008 0002052e 00080042 win32k!GreZorderSprite+0x66
    aa03f98c bf836441 b9e86db0 e38b35e0 bf9acaa0 win32k!TrackLayeredZorder+0x35
    aa03f9a0 bf827878 b9e86db0 b9e8bfa0 b9e306e8 win32k!LinkWindow+0x90
    aa03fa08 bf825baa b9e306e8 bf9acaa0 bf9acaa0 win32k!zzzChangeStates+0x2ad
    aa03fa50 bf8241f3 bf9acaa0 00000000 b9e82ad8 win32k!zzzBltValidBits+0xe2
    aa03faa8 bf826f57 b9e306e8 000903f6 b9e82ad8 win32k!xxxEndDeferWindowPosEx+0x13a
    aa03fac8 bf83ca1b b9e82ad8 00000000 00000000 win32k!xxxSetWindowPos+0x101
    aa03fb44 bf861917 00000000 00000994 b9e36d70 win32k!xxxActivateThisWindow+0x26f
    aa03fb7c bf82241d e323f858 e381c6f8 00002200 win32k!xxxProcessEventMessage+0x1e3
    aa03fc94 bf801eb2 e323f858 aa03fd14 00000000 win32k!xxxScanSysQueue+0x10fb
    aa03fce8 bf8036df aa03fd14 000025ff 00000000 win32k!xxxRealInternalGetMessage+0x335
    aa03fd48 8054262c 0206ff5c 00000000 00000000 win32k!NtUserPeekMessage+0x40
    aa03fd48 7c92e514 0206ff5c 00000000 00000000 nt!KiFastCallEntry+0xfc
    WARNING: Frame IP not in any known module. Following frames may be wrong.
    0206ff00 00000000 00000000 00000000 00000000 0x7c92e514


    STACK_COMMAND:  kb

    FOLLOWUP_IP:
    win32k!vSpRedrawSprite+17
    bf8498d0 855920          test    dword ptr [ecx+20h],ebx

    SYMBOL_STACK_INDEX:  0

    SYMBOL_NAME:  win32k!vSpRedrawSprite+17

    FOLLOWUP_NAME:  MachineOwner

    MODULE_NAME: win32k

    IMAGE_NAME:  win32k.sys

    DEBUG_FLR_IMAGE_TIMESTAMP:  4a8564c7

    FAILURE_BUCKET_ID:  0x8E_win32k!vSpRedrawSprite+17

    BUCKET_ID:  0x8E_win32k!vSpRedrawSprite+17

    Followup: MachineOwner
    ---------

     

    2009年11月12日 4:15
  • 重新安装吧。。
    这次安装所有的驱动都去官方下载最新的。
    Intel Matrix Storage Manager装个8.9的。

    如果问题没有解决,还请继续跟帖讨论。
    2009年11月16日 10:26