none
dell320,光盘工具检测无硬件故障;XP SP2+SEP11;系统间断性蓝屏,dmp文件分析;都与ntoskrnl.exe相关。 RRS feed

  • 问题

  • 3月1号蓝屏记录DMP文件分析

    Copyright (c) Microsoft Corporation. All rights reserved.


    Loading Dump File [C:\Documents and Settings\Administrator\桌面\dmp文件\xiaf\Mini030110-01.dmp]
    Mini Kernel Dump File: Only registers and stack trace are available

    Symbol search path is: C:\WINDOWS\Symbols
    Executable search path is:
    Unable to load image ntoskrnl.exe, Win32 error 0n2
    *** WARNING: Unable to verify timestamp for ntoskrnl.exe
    Windows XP Kernel Version 2600 (Service Pack 2) MP (2 procs) Free x86 compatible
    Product: WinNt, suite: TerminalServer SingleUserTS
    Machine Name:
    Kernel base = 0x804d8000 PsLoadedModuleList = 0x8055d700
    Debug session time: Mon Mar 1 09:13:15.562 2010 (GMT+8)
    System Uptime: 0 days 0:51:29.260
    Unable to load image ntoskrnl.exe, Win32 error 0n2
    *** WARNING: Unable to verify timestamp for ntoskrnl.exe
    Loading Kernel Symbols
    ...............................................................
    ................................................................
    ......
    Loading User Symbols
    Loading unloaded module list
    .............
    *******************************************************************************
    * *
    * Bugcheck Analysis *
    * *
    *******************************************************************************

    Use !analyze -v to get detailed debugging information.

    BugCheck 4E, {99, 3602b, 0, 0}

    Probably caused by : ntoskrnl.exe ( nt!PspReaper+39 )

    Followup: MachineOwner
    ---------

    1: kd> !analyze -v
    *******************************************************************************
    * *
    * Bugcheck Analysis *
    * *
    *******************************************************************************

    PFN_LIST_CORRUPT (4e)
    Typically caused by drivers passing bad memory descriptor lists (ie: calling
    MmUnlockPages twice with the same list, etc). If a kernel debugger is
    available get the stack trace.
    Arguments:
    Arg1: 00000099, A PTE or PFN is corrupt
    Arg2: 0003602b, page frame number
    Arg3: 00000000, current page state
    Arg4: 00000000, 0

    Debugging Details:
    ------------------


    BUGCHECK_STR: 0x4E_99

    CUSTOMER_CRASH_COUNT: 1

    DEFAULT_BUCKET_ID: DRIVER_FAULT

    PROCESS_NAME: WINWORD.EXE

    LAST_CONTROL_TRANSFER: from 0003602b to 804fac4b

    STACK_TEXT:
    a7343bac 0003602b 00000000 00000000 00000000 nt!PspReaper+0x39
    WARNING: Frame IP not in any known module. Following frames may be wrong.
    a7343bc0 80522ed8 0000004e 00000099 0003602b 0x3602b
    a7343bf0 80511bc7 c08895e0 00001639 87a896a8 nt!MiResolvePageFileFault+0x1c5
    a7343c14 805afc03 0bde1109 87a894b0 007ffff8 nt!PopIdleUpdateIdleHandler+0x4b
    a7343c34 80513669 87a894b0 87a895e8 87a894b0 nt!CmpCheckKey+0x53a
    a7343c68 805d1ef3 00a894b0 89cc0200 00000000 nt!FsRtlCancelNotify+0x68
    a7343cf0 805d1fd7 00000000 a7343d4c 804ffcc5 nt!ObCreateObjectType+0x5db
    a7343cfc 804ffcc5 89cc0200 a7343d48 a7343d3c nt!IopQueryReconfiguration+0x1c
    a7343d4c 80541687 00000001 00000000 a7343d64 nt!IoBuildAsynchronousFsdRequest+0x38
    a7343d64 7c92eb94 badb0d00 0a75fe24 a7343d98 nt!RtlIpv4StringToAddressA+0x178
    a7343d78 00000000 00000000 00000000 00000000 0x7c92eb94


    STACK_COMMAND: kb

    FOLLOWUP_IP:
    nt!PspReaper+39
    804fac4b 5d pop ebp

    SYMBOL_STACK_INDEX: 0

    SYMBOL_NAME: nt!PspReaper+39

    FOLLOWUP_NAME: MachineOwner

    MODULE_NAME: nt

    IMAGE_NAME: ntoskrnl.exe

    DEBUG_FLR_IMAGE_TIMESTAMP: 4249fa54

    FAILURE_BUCKET_ID: 0x4E_99_nt!PspReaper+39

    BUCKET_ID: 0x4E_99_nt!PspReaper+39

    Followup: MachineOwner

    3月3号蓝屏记录DMP文件分析

    Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
    Copyright (c) Microsoft Corporation. All rights reserved.


    Loading Dump File [C:\Documents and Settings\Administrator\桌面\dmp文件\xiaf\Mini030310-01.dmp]
    Mini Kernel Dump File: Only registers and stack trace are available

    Symbol search path is: C:\WINDOWS\Symbols
    Executable search path is:
    Unable to load image ntoskrnl.exe, Win32 error 0n2
    *** WARNING: Unable to verify timestamp for ntoskrnl.exe
    Windows XP Kernel Version 2600 (Service Pack 2) MP (2 procs) Free x86 compatible
    Product: WinNt, suite: TerminalServer SingleUserTS
    Machine Name:
    Kernel base = 0x804d8000 PsLoadedModuleList = 0x8055d700
    Debug session time: Wed Mar 3 08:23:22.812 2010 (GMT+8)
    System Uptime: 0 days 0:02:13.362
    Unable to load image ntoskrnl.exe, Win32 error 0n2
    *** WARNING: Unable to verify timestamp for ntoskrnl.exe
    Loading Kernel Symbols
    ...............................................................
    ................................................................
    ...
    Loading User Symbols
    Loading unloaded module list
    .............
    *******************************************************************************
    * *
    * Bugcheck Analysis *
    * *
    *******************************************************************************

    Use !analyze -v to get detailed debugging information.

    BugCheck 10000050, {e5fd1814, 1, 8054bfd2, 2}


    Could not read faulting driver name
    Probably caused by : ntoskrnl.exe ( nt!ExFreePoolWithTag+38f )

    Followup: MachineOwner
    ---------

    1: kd> !analyze -v
    *******************************************************************************
    * *
    * Bugcheck Analysis *
    * *
    *******************************************************************************

    PAGE_FAULT_IN_NONPAGED_AREA (50)
    Invalid system memory was referenced. This cannot be protected by try-except,
    it must be protected by a Probe. Typically the address is just plain bad or it
    is pointing at freed memory.
    Arguments:
    Arg1: e5fd1814, memory referenced.
    Arg2: 00000001, value 0 = read operation, 1 = write operation.
    Arg3: 8054bfd2, If non-zero, the instruction address which referenced the bad memory
    address.
    Arg4: 00000002, (reserved)

    Debugging Details:
    ------------------


    Could not read faulting driver name

    WRITE_ADDRESS: e5fd1814

    FAULTING_IP:
    nt!ExFreePoolWithTag+38f
    8054bfd2 894804 mov dword ptr [eax+4],ecx

    MM_INTERNAL_CODE: 2

    CUSTOMER_CRASH_COUNT: 1

    DEFAULT_BUCKET_ID: DRIVER_FAULT

    BUGCHECK_STR: 0x50

    PROCESS_NAME: Rtvscan.exe

    LOCK_ADDRESS: 80559b60 -- (!locks 80559b60)

    Resource @ nt!PiEngineLock (0x80559b60) Available

    WARNING: SystemResourcesList->Flink chain invalid. Resource may be corrupted, or already deleted.


    WARNING: SystemResourcesList->Blink chain invalid. Resource may be corrupted, or already deleted.

    1 total locks

    PNP_TRIAGE:
    Lock address : 0x80559b60
    Thread Count : 0
    Thread address: 0x00000000
    Thread wait : 0x0

    LAST_CONTROL_TRANSFER: from 805c0600 to 8054bfd2

    STACK_TEXT:
    a9011ae8 805c0600 00000001 00000001 f4636553 nt!ExFreePoolWithTag+0x38f
    a9011b0c 805c0cfe 854ff078 a9011b01 00000000 nt!PiDeviceRegistration+0x161
    a9011b40 8050d0d4 a9011b01 865b1418 00000000 nt!IoReadPartitionTable+0x27d
    a9011b4c 00000000 a9011b01 00000000 00000028 nt!RtlVerifyVersionInfo+0xd


    STACK_COMMAND: kb

    FOLLOWUP_IP:
    nt!ExFreePoolWithTag+38f
    8054bfd2 894804 mov dword ptr [eax+4],ecx

    SYMBOL_STACK_INDEX: 0

    SYMBOL_NAME: nt!ExFreePoolWithTag+38f

    FOLLOWUP_NAME: MachineOwner

    MODULE_NAME: nt

    IMAGE_NAME: ntoskrnl.exe

    DEBUG_FLR_IMAGE_TIMESTAMP: 4249fa54

    FAILURE_BUCKET_ID: 0x50_nt!ExFreePoolWithTag+38f

    BUCKET_ID: 0x50_nt!ExFreePoolWithTag+38f

    Followup: MachineOwner

     

    3月5号蓝屏记录DMP文件分析

    Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
    Copyright (c) Microsoft Corporation. All rights reserved.


    Loading Dump File [C:\Documents and Settings\Administrator\桌面\dmp文件\xiaf\Mini030510-01.dmp]
    Mini Kernel Dump File: Only registers and stack trace are available

    Symbol search path is: C:\WINDOWS\Symbols
    Executable search path is:
    Unable to load image ntoskrnl.exe, Win32 error 0n2
    *** WARNING: Unable to verify timestamp for ntoskrnl.exe
    Windows XP Kernel Version 2600 (Service Pack 2) MP (2 procs) Free x86 compatible
    Product: WinNt, suite: TerminalServer SingleUserTS
    Machine Name:
    Kernel base = 0x804d8000 PsLoadedModuleList = 0x8055d700
    Debug session time: Fri Mar 5 08:25:01.265 2010 (GMT+8)
    System Uptime: 0 days 0:02:33.953
    Unable to load image ntoskrnl.exe, Win32 error 0n2
    *** WARNING: Unable to verify timestamp for ntoskrnl.exe
    Loading Kernel Symbols
    ...............................................................
    ................................................................
    ...........
    Loading User Symbols
    Loading unloaded module list
    ...........
    *******************************************************************************
    * *
    * Bugcheck Analysis *
    * *
    *******************************************************************************

    Use !analyze -v to get detailed debugging information.

    BugCheck 1000008E, {c0000005, 8054bfd2, a762a780, 0}

    Unable to load image aswSP.SYS, Win32 error 0n2
    *** WARNING: Unable to verify timestamp for aswSP.SYS
    *** ERROR: Module load completed but symbols could not be loaded for aswSP.SYS
    *** WARNING: Unable to verify timestamp for Hookport.sys
    *** ERROR: Module load completed but symbols could not be loaded for Hookport.sys
    Probably caused by : aswSP.SYS ( aswSP+85c6 )

    Followup: MachineOwner
    ---------

    1: kd> !analyze -v
    *******************************************************************************
    * *
    * Bugcheck Analysis *
    * *
    *******************************************************************************

    KERNEL_MODE_EXCEPTION_NOT_HANDLED_M (1000008e)
    This is a very common bugcheck. Usually the exception address pinpoints
    the driver/function that caused the problem. Always note this address
    as well as the link date of the driver/image that contains this address.
    Some common problems are exception code 0x80000003. This means a hard
    coded breakpoint or assertion was hit, but this system was booted
    /NODEBUG. This is not supposed to happen as developers should never have
    hardcoded breakpoints in retail code, but ...
    If this happens, make sure a debugger gets connected, and the
    system is booted /DEBUG. This will let us see why this breakpoint is
    happening.
    Arguments:
    Arg1: c0000005, The exception code that was not handled
    Arg2: 8054bfd2, The address that the exception occurred at
    Arg3: a762a780, Trap Frame
    Arg4: 00000000

    Debugging Details:
    ------------------


    EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - "0x%08lx"

    FAULTING_IP:
    nt!ExFreePoolWithTag+38f
    8054bfd2 894804 mov dword ptr [eax+4],ecx

    TRAP_FRAME: a762a780 -- (.trap 0xffffffffa762a780)
    ErrCode = 00000002
    eax=00000000 ebx=89e580a0 ecx=89e585e8 edx=00000038 esi=89bd85e8 edi=000001ff
    eip=8054bfd2 esp=a762a7f4 ebp=a762a848 iopl=0 nv up ei ng nz na pe cy
    cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010287
    nt!ExFreePoolWithTag+0x38f:
    8054bfd2 894804 mov dword ptr [eax+4],ecx ds:0023:00000004=????????
    Resetting default scope

    CUSTOMER_CRASH_COUNT: 1

    DEFAULT_BUCKET_ID: DRIVER_FAULT

    BUGCHECK_STR: 0x8E

    PROCESS_NAME: CCAAgent.exe

    LAST_CONTROL_TRANSFER: from 805bf881 to 8054bfd2

    STACK_TEXT:
    a762a848 805bf881 00000001 00000001 7153624f nt!ExFreePoolWithTag+0x38f
    a762a86c 805bfca5 e5b9e288 a762a894 a762a888 nt!MmSessionCreate+0x86
    a762a874 a762a894 a762a888 e5bd4508 a762ab48 nt!PoInitHiberServices+0x8
    WARNING: Frame IP not in any known module. Following frames may be wrong.
    a762a898 8062e210 e5b9e288 89037440 00000001 0xa762a894
    a762a8e4 8062ea9a e4a32008 008aae08 00000000 nt!PspQueryDescriptorThread+0xa7
    a762aadc 805beec0 008aae08 00000000 89037440 nt!PspSetLdtInformation+0x67
    a762ab54 805bb548 00000000 a762ab94 00000040 nt!NtCreatePagingFile+0x5ef
    a762aba8 806247d3 00000000 89e155f8 00000001 nt!CcPfParametersRead+0x24d
    a762ac7c a86d15c6 0012ea10 00020019 0012e534 nt!MmSetBankedSection+0x1da
    a762ac98 ba0bc926 0012ea10 00020019 0012e534 aswSP+0x85c6
    a762ad50 805419ac 0012ea10 00020019 0012e534 Hookport+0x4926
    a762ad64 7c92eb94 badb0d00 0012e51c 00000000 nt!RtlIpv6StringToAddressW+0xe9
    a762ad74 00000000 00000000 00000000 00000000 0x7c92eb94


    STACK_COMMAND: kb

    FOLLOWUP_IP:
    aswSP+85c6
    a86d15c6 ?? ???

    SYMBOL_STACK_INDEX: 9

    SYMBOL_NAME: aswSP+85c6

    FOLLOWUP_NAME: MachineOwner

    MODULE_NAME: aswSP

    IMAGE_NAME: aswSP.SYS

    DEBUG_FLR_IMAGE_TIMESTAMP: 4922b825

    FAILURE_BUCKET_ID: 0x8E_aswSP+85c6

    BUCKET_ID: 0x8E_aswSP+85c6

    Followup: MachineOwner
    ---------

    系统再次出现蓝屏

    蓝屏记录为3月11号

    Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
    Copyright (c) Microsoft Corporation. All rights reserved.


    Loading Dump File [C:\Documents and Settings\Administrator\桌面\dmp文件\xiaf\Mini031110-01.dmp]
    Mini Kernel Dump File: Only registers and stack trace are available

    Symbol search path is: C:\WINDOWS\Symbols
    Executable search path is:
    Unable to load image ntoskrnl.exe, Win32 error 0n2
    *** WARNING: Unable to verify timestamp for ntoskrnl.exe
    Windows XP Kernel Version 2600 (Service Pack 2) MP (2 procs) Free x86 compatible
    Product: WinNt, suite: TerminalServer SingleUserTS
    Machine Name:
    Kernel base = 0x804d8000 PsLoadedModuleList = 0x8055d700
    Debug session time: Thu Mar 11 08:55:47.843 2010 (GMT+8)
    System Uptime: 0 days 0:12:59.542
    Unable to load image ntoskrnl.exe, Win32 error 0n2
    *** WARNING: Unable to verify timestamp for ntoskrnl.exe
    Loading Kernel Symbols
    ...............................................................
    ................................................................

    Loading User Symbols
    Loading unloaded module list
    .........
    *******************************************************************************
    * *
    * Bugcheck Analysis *
    * *
    *******************************************************************************

    Use !analyze -v to get detailed debugging information.

    BugCheck 1000007E, {c0000005, 8054b10f, ba547810, ba54750c}

    *** WARNING: Unable to verify timestamp for rdbss.sys
    Probably caused by : rdbss.sys ( rdbss!RxSpinUpWorkerThread+62 )

    Followup: MachineOwner
    ---------

    0: kd> !analyze -v
    *******************************************************************************
    * *
    * Bugcheck Analysis *
    * *
    *******************************************************************************

    SYSTEM_THREAD_EXCEPTION_NOT_HANDLED_M (1000007e)
    This is a very common bugcheck. Usually the exception address pinpoints
    the driver/function that caused the problem. Always note this address
    as well as the link date of the driver/image that contains this address.
    Some common problems are exception code 0x80000003. This means a hard
    coded breakpoint or assertion was hit, but this system was booted
    /NODEBUG. This is not supposed to happen as developers should never have
    hardcoded breakpoints in retail code, but ...
    If this happens, make sure a debugger gets connected, and the
    system is booted /DEBUG. This will let us see why this breakpoint is
    happening.
    Arguments:
    Arg1: c0000005, The exception code that was not handled
    Arg2: 8054b10f, The address that the exception occurred at
    Arg3: ba547810, Exception Record Address
    Arg4: ba54750c, Context Record Address

    Debugging Details:
    ------------------


    EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - "0x%08lx"

    FAULTING_IP:
    nt!MiAllocatePoolPages+447
    8054b10f 895f04 mov dword ptr [edi+4],ebx

    EXCEPTION_RECORD: ba547810 -- (.exr 0xffffffffba547810)
    ExceptionAddress: 8054b10f (nt!MiAllocatePoolPages+0x00000447)
    ExceptionCode: c0000005 (Access violation)
    ExceptionFlags: 00000000
    NumberParameters: 2
    Parameter[0]: 00000001
    Parameter[1]: 000004c4
    Attempt to write to address 000004c4

    CONTEXT: ba54750c -- (.cxr 0xffffffffba54750c)
    eax=e2411720 ebx=89c175f8 ecx=000001ff edx=e2411720 esi=89e57078 edi=000004c0
    eip=8054b10f esp=ba5478d8 ebp=ba547918 iopl=0 nv up ei ng nz ac pe cy
    cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010297
    nt!MiAllocatePoolPages+0x447:
    8054b10f 895f04 mov dword ptr [edi+4],ebx ds:0023:000004c4=????????
    Resetting default scope

    CUSTOMER_CRASH_COUNT: 1

    PROCESS_NAME: System

    ERROR_CODE: (NTSTATUS) 0xc0000005 - "0x%08lx"

    EXCEPTION_PARAMETER1: 00000001

    EXCEPTION_PARAMETER2: 000004c4

    WRITE_ADDRESS: 000004c4

    FOLLOWUP_IP:
    rdbss!RxSpinUpWorkerThread+62
    a8a41af8 ?? ???

    BUGCHECK_STR: 0x7E

    DEFAULT_BUCKET_ID: NULL_CLASS_PTR_DEREFERENCE

    LAST_CONTROL_TRANSFER: from 8054b75f to 8054b10f

    STACK_TEXT:
    ba547918 8054b75f 00000001 ba547a50 8000000b nt!MiAllocatePoolPages+0x447
    ba547958 805e507a e12cc008 00000000 ba5479d4 nt!MiFreePoolPages+0x660
    ba54797c 805e5539 00000000 00000000 00000000 nt!IoReadPartitionTable+0x53c
    ba547a58 805f086b 00000000 e2be2430 ba547ab0 nt!IopNotifyAlreadyRegisteredFileSystems+0x13
    ba547a84 805bf9ff 00000000 00000000 ba547ab0 nt!NtAllocateVirtualMemory+0xf44
    ba547ab4 805c2e3d ba547bc8 00000000 89331da8 nt!PopCreateHiberFile+0xd0
    ba547b9c 805d00f8 89331da8 ba547bc8 00000000 nt!IoAssignDriveLetters+0x6de
    ba547cec 805d0b8b ba547d50 001f0fff 00000000 nt!`string'+0xa0
    ba547d20 a8a41af8 ba547d50 001f0fff 00000000 nt!HvInitializeHive+0x309
    ba547d58 a8a41a67 a8a4aec0 a8a4b82b a8a4aec0 rdbss!RxSpinUpWorkerThread+0x62
    ba547d78 a8a4b7b9 a8a4aec4 ba547dac a8a41991 rdbss!RxSpinUpWorkerThreads+0x71
    ba547d84 a8a41991 a8a4aec0 00000000 00000000 rdbss!RxScavengeVNetRoots+0xd1
    ba547dac 805cf9c2 00a4b0a0 00000000 00000000 rdbss!RxSpinUpRequestsDispatcher+0x11a
    ba547ddc 8054646e a8a418b1 a8a4b0a0 00000000 nt!`string'+0xa
    ba547e14 00000000 00000000 00000000 00000000 nt!NtTraceEvent+0xb6


    SYMBOL_STACK_INDEX: 9

    SYMBOL_NAME: rdbss!RxSpinUpWorkerThread+62

    FOLLOWUP_NAME: MachineOwner

    MODULE_NAME: rdbss

    IMAGE_NAME: rdbss.sys

    DEBUG_FLR_IMAGE_TIMESTAMP: 445b1f4b

    STACK_COMMAND: .cxr 0xffffffffba54750c ; kb

    FAILURE_BUCKET_ID: 0x7E_rdbss!RxSpinUpWorkerThread+62

    BUCKET_ID: 0x7E_rdbss!RxSpinUpWorkerThread+62

    Followup: MachineOwner

     

    • 已编辑 cocomao 2010年3月11日 1:49 系统再次出现蓝屏,无语了!
    2010年3月5日 2:15

全部回复

  • 您好:
              rtvscan.exe是Symantec Internet Security网络安全套装的一部分。CCAAgent.exe 位于一 个子文件夹的“C:\ Program Files” 文件CCAAgent.exe不是Windows核心 文件。 您可以卸载在控制面板这一计划, 一些恶意软件伪装成CCAAgent.exe本 身,尤其是如果它们位于c:\ Windows或C:\窗口\ System32文件夹中。 Thus check the CCAAgent.exe process on your pc whether it is pest. 因此,检 查您的电脑是否有害虫CCAAgent.exe进程.而 aswSP.SYS貌似是蠕虫病毒的一种。
             建议在安全模式下卸载诺顿,再重新安装或跟换另一种杀毒软件。然后全盘查杀病毒。
    在IT的路上,You'll never walk alone
    2010年3月5日 3:16
  • 你好!

        CCaagent.exe是CISCO ACCESS AGENT(公司接入网络的验证程序),在windows目录及system32下未发现该文件

       aswSP.sys是我怀疑SEP11可能对木马检测偏弱,安装的avast杀毒软件的文件,在安装该防毒软件之前我还安装过小红伞进行杀毒,也未发现病毒,只是邮件系统里面出现有木马,都被SEP11给隔离了。

      该台电脑蓝屏的最后一次是开机的时候蓝屏,上2次是在使用程序的时候突然蓝屏,在这3次蓝屏之前还有3次蓝屏,记录都是因为ntoskrnl.exe引起。

     该台电脑系统安装是干净光盘安装,安装的软件很少,使用360打补丁,软件环境为Adobe reader 、office2003、msn、遨游、7zip、thunderbird。

    现已卸载sep11,保留avast。

    但蓝屏故障原因一直无法找到根源,希望能够给予帮助!

    2010年3月5日 3:37
  • 请问是在运行什么程序的情况下蓝屏的?建议使用以此干净启动。我以前DELL电脑也出现过类似现象我将系统所有软件全部删掉了然后再安全模式下安装后正常。同时尽可能不要用360打补丁而使用windows UPdate.
    在IT的路上,You'll never walk alone
    2010年3月5日 6:00
  • 你好!

     

        最近的一次是在启动的时候蓝屏,上一次是在编辑excel的时候,再上一次是在word的时候突然蓝屏;也就是在最后一次是启动的时候蓝屏,其他几次都是在使用程序或者打开网页的时候蓝屏。这种故障很诡异,个人怀疑是软件导致的,但其他用户的电脑比该电脑的软件多多了;因为蓝屏的问题,该电脑用户之前更换了一台新机器,都是DELL系列的,刚开始我安装完成软件后,没有什么异常,系统日志都正常,但该用户开始使用后不到一两天无故蓝屏,该用户基本操作就是收发邮件,编辑文档,浏览网页,非异常操作。

    2010年3月5日 6:55