none
xp在点击待机后蓝屏 RRS feed

  • 问题

  • xp-sp3,笔记本

    现象:一直以来待机都没有问题,只是最近两周的才开始的。开机运行一段时间后点击待机,电脑屏幕先关闭,然后等三四秒钟(正常时可以听到硬盘关闭,但是这时硬盘始终运转),电脑蓝屏。但是如果在开机后立即就点击待机就不会蓝屏,可以正常待机。

    蓝屏代码:irql_not_less_or_equal;0x0000000a(0x00000065,0x0000001c,0x00000000,0x每次不同)

    (dump文件地址:https://cid-34e9002e15d4d421.office.live.com/browse.aspx/.QuickDocuments

    把dump文件拖到windbg里显示如下:


    Microsoft (R) Windows Debugger Version 6.11.0001.402 X86
    Copyright (c) Microsoft Corporation. All rights reserved.


    Loading Dump File [C:\WINDOWS\Minidump\Mini011311-02.dmp]
    Mini Kernel Dump File: Only registers and stack trace are available

    Symbol search path is: *** Invalid ***
    ****************************************************************************
    * Symbol loading may be unreliable without a symbol search path.           *
    * Use .symfix to have the debugger choose a symbol path.                   *
    * After setting your symbol path, use .reload to refresh symbol locations. *
    ****************************************************************************
    Executable search path is:
    *********************************************************************
    * Symbols can not be loaded because symbol path is not initialized. *
    *                                                                   *
    * The Symbol Path can be set by:                                    *
    *   using the _NT_SYMBOL_PATH environment variable.                 *
    *   using the -y <symbol_path> argument when starting the debugger. *
    *   using .sympath and .sympath+                                    *
    *********************************************************************
    Unable to load image ntoskrnl.exe, Win32 error 0n2
    *** WARNING: Unable to verify timestamp for ntoskrnl.exe
    *** ERROR: Module load completed but symbols could not be loaded for ntoskrnl.exe
    Windows XP Kernel Version 2600 (Service Pack 3) MP (2 procs) Free x86 compatible
    Product: WinNt, suite: TerminalServer SingleUserTS
    Machine Name:
    Kernel base = 0x804d8000 PsLoadedModuleList = 0x805644c0
    Debug session time: Thu Jan 13 03:26:58.328 2011 (GMT+8)
    System Uptime: 0 days 0:35:38.037
    *********************************************************************
    * Symbols can not be loaded because symbol path is not initialized. *
    *                                                                   *
    * The Symbol Path can be set by:                                    *
    *   using the _NT_SYMBOL_PATH environment variable.                 *
    *   using the -y <symbol_path> argument when starting the debugger. *
    *   using .sympath and .sympath+                                    *
    *********************************************************************
    Unable to load image ntoskrnl.exe, Win32 error 0n2
    *** WARNING: Unable to verify timestamp for ntoskrnl.exe
    *** ERROR: Module load completed but symbols could not be loaded for ntoskrnl.exe
    Loading Kernel Symbols
    ...............................................................
    ................................................................
    ..............................
    Loading User Symbols
    Loading unloaded module list
    .................
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************

    Use !analyze -v to get detailed debugging information.

    BugCheck 1000000A, {0, 1c, 0, 805228d7}

    ***** Kernel symbols are WRONG. Please fix symbols to do analysis.

    *** WARNING: Unable to verify timestamp for ati2mtag.sys
    *** ERROR: Module load completed but symbols could not be loaded for ati2mtag.sys
    *** WARNING: Unable to verify timestamp for VIDEOPRT.SYS
    *** ERROR: Module load completed but symbols could not be loaded for VIDEOPRT.SYS
    *************************************************************************
    ***                                                                   ***
    ***                                                                   ***
    ***    Your debugger is not using the correct symbols                 ***
    ***                                                                   ***
    ***    In order for this command to work properly, your symbol path   ***
    ***    must point to .pdb files that have full type information.      ***
    ***                                                                   ***
    ***    Certain .pdb files (such as the public OS symbols) do not      ***
    ***    contain the required information.  Contact the group that      ***
    ***    provided you with these symbols if you need this command to    ***
    ***    work.                                                          ***
    ***                                                                   ***
    ***    Type referenced: nt!_KPRCB                                     ***
    ***                                                                   ***
    *************************************************************************
    *************************************************************************
    ***                                                                   ***
    ***                                                                   ***
    ***    Your debugger is not using the correct symbols                 ***
    ***                                                                   ***
    ***    In order for this command to work properly, your symbol path   ***
    ***    must point to .pdb files that have full type information.      ***
    ***                                                                   ***
    ***    Certain .pdb files (such as the public OS symbols) do not      ***
    ***    contain the required information.  Contact the group that      ***
    ***    provided you with these symbols if you need this command to    ***
    ***    work.                                                          ***
    ***                                                                   ***
    ***    Type referenced: nt!KPRCB                                      ***
    ***                                                                   ***
    *************************************************************************
    *************************************************************************
    ***                                                                   ***
    ***                                                                   ***
    ***    Your debugger is not using the correct symbols                 ***
    ***                                                                   ***
    ***    In order for this command to work properly, your symbol path   ***
    ***    must point to .pdb files that have full type information.      ***
    ***                                                                   ***
    ***    Certain .pdb files (such as the public OS symbols) do not      ***
    ***    contain the required information.  Contact the group that      ***
    ***    provided you with these symbols if you need this command to    ***
    ***    work.                                                          ***
    ***                                                                   ***
    ***    Type referenced: nt!_KPRCB                                     ***
    ***                                                                   ***
    *************************************************************************
    *************************************************************************
    ***                                                                   ***
    ***                                                                   ***
    ***    Your debugger is not using the correct symbols                 ***
    ***                                                                   ***
    ***    In order for this command to work properly, your symbol path   ***
    ***    must point to .pdb files that have full type information.      ***
    ***                                                                   ***
    ***    Certain .pdb files (such as the public OS symbols) do not      ***
    ***    contain the required information.  Contact the group that      ***
    ***    provided you with these symbols if you need this command to    ***
    ***    work.                                                          ***
    ***                                                                   ***
    ***    Type referenced: nt!KPRCB                                      ***
    ***                                                                   ***
    *************************************************************************
    *************************************************************************
    ***                                                                   ***
    ***                                                                   ***
    ***    Your debugger is not using the correct symbols                 ***
    ***                                                                   ***
    ***    In order for this command to work properly, your symbol path   ***
    ***    must point to .pdb files that have full type information.      ***
    ***                                                                   ***
    ***    Certain .pdb files (such as the public OS symbols) do not      ***
    ***    contain the required information.  Contact the group that      ***
    ***    provided you with these symbols if you need this command to    ***
    ***    work.                                                          ***
    ***                                                                   ***
    ***    Type referenced: nt!_KPRCB                                     ***
    ***                                                                   ***
    *************************************************************************
    *************************************************************************
    ***                                                                   ***
    ***                                                                   ***
    ***    Your debugger is not using the correct symbols                 ***
    ***                                                                   ***
    ***    In order for this command to work properly, your symbol path   ***
    ***    must point to .pdb files that have full type information.      ***
    ***                                                                   ***
    ***    Certain .pdb files (such as the public OS symbols) do not      ***
    ***    contain the required information.  Contact the group that      ***
    ***    provided you with these symbols if you need this command to    ***
    ***    work.                                                          ***
    ***                                                                   ***
    ***    Type referenced: nt!_KPRCB                                     ***
    ***                                                                   ***
    *************************************************************************
    *************************************************************************
    ***                                                                   ***
    ***                                                                   ***
    ***    Your debugger is not using the correct symbols                 ***
    ***                                                                   ***
    ***    In order for this command to work properly, your symbol path   ***
    ***    must point to .pdb files that have full type information.      ***
    ***                                                                   ***
    ***    Certain .pdb files (such as the public OS symbols) do not      ***
    ***    contain the required information.  Contact the group that      ***
    ***    provided you with these symbols if you need this command to    ***
    ***    work.                                                          ***
    ***                                                                   ***
    ***    Type referenced: nt!_KPRCB                                     ***
    ***                                                                   ***
    *************************************************************************
    *********************************************************************
    * Symbols can not be loaded because symbol path is not initialized. *
    *                                                                   *
    * The Symbol Path can be set by:                                    *
    *   using the _NT_SYMBOL_PATH environment variable.                 *
    *   using the -y <symbol_path> argument when starting the debugger. *
    *   using .sympath and .sympath+                                    *
    *********************************************************************
    *********************************************************************
    * Symbols can not be loaded because symbol path is not initialized. *
    *                                                                   *
    * The Symbol Path can be set by:                                    *
    *   using the _NT_SYMBOL_PATH environment variable.                 *
    *   using the -y <symbol_path> argument when starting the debugger. *
    *   using .sympath and .sympath+                                    *
    *********************************************************************
    Probably caused by : ati2mtag.sys ( ati2mtag+599c )

    Followup: MachineOwner
    ---------

    可能调试环境不对,再请教一下该怎么设置windug。

    我注意到了最后几句,所以查看了ati2mtag.sys这个文件的属性,最近一次修改在去年7月份,一直以来都没有变动。而蓝屏是最近两周才有的。

    • 已编辑 打喷嚏 2011年1月13日 5:27 添加dump文献下载地址
    2011年1月13日 5:16

答案

  • 显示驱动程序配置问题阻止了 Windows 进入待机,这倒不一定与驱动程序文件损坏有关,与显示驱动自身的设置、ACPI 电源选项设置、第三方软件设置都可能有关。
     
    建议首先重新安装一遍显示驱动,最好完全卸载后全新安装。如果问题依旧,再重新安装一下主板芯片组驱动,令 Windows 重新配置 ACPI 高级电源选项。最后排查第三方软件的影响,特别是发生问题前新安装的软件及修改过的系统设置。
     
    --
    Alexis Zhang
     
    https://mvp.support.microsoft.com/profile/jie
    http://blogs.itecn.net/blogs/alexis
     
    推荐以 NNTP Bridge 桥接新闻组方式访问论坛以获取最佳用户体验。
     
    本帖是回复帖,原帖作者是楼上的 "打喷嚏"
     
    xp-sp3,笔记本
    现象:一直以来待机都没有问题,只是最近两周的才开始的。
     
     
    2011年1月13日 9:28
    版主

全部回复

  • 请问楼主最近两周安装过什么软件或什么驱动吗?安全模式下蓝屏吗?
    在IT的路上,You'll never walk alone
    2011年1月13日 5:53
  • 谢谢回复!

    时间有点长,实在记不起来之间做过什么改动了。的确,个人在使用时经常安装卸载软件,但硬件驱动程序很久没有动过。

    2011年1月13日 8:47
  • 显示驱动程序配置问题阻止了 Windows 进入待机,这倒不一定与驱动程序文件损坏有关,与显示驱动自身的设置、ACPI 电源选项设置、第三方软件设置都可能有关。
     
    建议首先重新安装一遍显示驱动,最好完全卸载后全新安装。如果问题依旧,再重新安装一下主板芯片组驱动,令 Windows 重新配置 ACPI 高级电源选项。最后排查第三方软件的影响,特别是发生问题前新安装的软件及修改过的系统设置。
     
    --
    Alexis Zhang
     
    https://mvp.support.microsoft.com/profile/jie
    http://blogs.itecn.net/blogs/alexis
     
    推荐以 NNTP Bridge 桥接新闻组方式访问论坛以获取最佳用户体验。
     
    本帖是回复帖,原帖作者是楼上的 "打喷嚏"
     
    xp-sp3,笔记本
    现象:一直以来待机都没有问题,只是最近两周的才开始的。
     
     
    2011年1月13日 9:28
    版主
  • 应该是,今天又出现了另一种错误代码,windug的结果是Probably caused by : KSysMon.sys ( KSysMon+5b92 ) 。看来是有某些软件在捣乱了,我一个个卸载试试。 谢谢大家的回复!
    2011年1月14日 4:22
  • KSysMon.SYS 应该是江民安全防护软件的组件。
     
    --
    Alexis Zhang
     
    https://mvp.support.microsoft.com/profile/jie
    http://blogs.itecn.net/blogs/alexis
     
    推荐以 NNTP Bridge 桥接新闻组方式访问论坛以获取最佳用户体验。
     
    本帖是回复帖,原帖作者是楼上的 "打喷嚏"
     
    应该是,今天又出现了另一种错误代码,windug的结果是Probably caused by : KSysMon.sys ( KSysMon+5b92 ) 。看来是有某些软件在捣乱了,我一个个卸载试试。 谢谢大家的回复!
     
     
    2011年1月14日 16:35
    版主
  • 更改了一些配置,现在已经连续好几天不蓝屏了。也不知道到底是哪里出的毛病。

    做的改动有:

    禁止360软件开机启动(安装了不到一个月,安装后的几周里并没有蓝屏);

    360主动防御服务改为手动;

    ATI-hotkey服务改为手动(进程里没有两个ati2evxx.exe了);

    卸载客户端inode(占用资源太多,老是操作硬盘,怀疑点击待机时硬盘不停是它引起的?但以前好好的);

    安装另外一个精简H3C802.1X客户端。

    大体就这些,现在好了,硬盘也不再每秒钟读一次了(能听到)。

    2011年1月18日 17:51
  • 你有安装江民杀毒软件吗?在硬盘中能搜索到 KSysMon.SYS 吗?
     
    --
    Alexis Zhang
     
    http://mvp.support.microsoft.com/profile/jie
    http://blogs.itecn.net/blogs/alexis
     
    推荐以 NNTP Bridge 桥接新闻组方式访问论坛以获取最佳用户体验。
     
    本帖是回复帖,原帖作者是楼上的 "打喷嚏"
     
    更改了一些配置,现在已经连续好几天不蓝屏了。也不知道到底是哪里出的毛病。
    做的改动有:
     
     
    2011年1月19日 3:29
    版主
  • 安装了,kv2010,每天升级。KSysMon.SYS此文件在安装目录里。

    我还更换了迅雷的版本,改动太多,现在估计是找不出原因了。

     

    2011年1月19日 16:11
  • 能找到就对了,之前一次的蓝屏分析是江民引起的,不用在其它软件设置中排查。
     
    可能是江民在处理某些监控任务时出现了错误,不排除与其它软件有冲突的可能。
     
    --
    Alexis Zhang
     
    http://mvp.support.microsoft.com/profile/jie
    http://blogs.itecn.net/blogs/alexis
     
    推荐以 NNTP Bridge 桥接新闻组方式访问论坛以获取最佳用户体验。
     
    本帖是回复帖,原帖作者是楼上的 "打喷嚏"
     
    安装了,kv2010,每天升级。KSysMon.SYS此文件在安装目录里。
    我还更换了迅雷的版本,改动太多,现在估计是?也怀鲈蛄恕?
     
     
    2011年1月20日 4:21
    版主