积极答复者
win7 64bit 在关机时偶尔蓝屏

问题
-
Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [C:\Users\skill\Desktop\111812-7831-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
WARNING: Whitespace at start of path element
Symbol search path is: SRV*C:\Symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.17944.amd64fre.win7sp1_gdr.120830-0333
Machine Name:
Kernel base = 0xfffff800`01a65000 PsLoadedModuleList = 0xfffff800`01ca9670
Debug session time: Sun Nov 18 23:37:15.553 2012 (UTC + 8:00)
System Uptime: 0 days 6:47:53.443
Loading Kernel Symbols
...............................................................
................................................................
.............................................
Loading User Symbols
Loading unloaded module list
............
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 3B, {c0000005, fffff80001a9df78, fffff8801cd5ec50, 0}
Probably caused by : ntkrnlmp.exe ( nt!WmipDoFindRegEntryByProviderId+10 )
Followup: MachineOwner
---------
2: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
SYSTEM_SERVICE_EXCEPTION (3b)
An exception happened while executing a system service routine.
Arguments:
Arg1: 00000000c0000005, Exception code that caused the bugcheck
Arg2: fffff80001a9df78, Address of the instruction which caused the bugcheck
Arg3: fffff8801cd5ec50, Address of the context record for the exception that caused the bugcheck
Arg4: 0000000000000000, zero.
Debugging Details:
------------------
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
FAULTING_IP:
nt!WmipDoFindRegEntryByProviderId+10
fffff800`01a9df78 394830 cmp dword ptr [rax+30h],ecx
CONTEXT: fffff8801cd5ec50 -- (.cxr 0xfffff8801cd5ec50)
rax=4c4c4c4c4c4cd6d5 rbx=0000000000000073 rcx=0000000000000073
rdx=fffff80001c52460 rsi=fffff8801cd5f905 rdi=fffff8801cd5f790
rip=fffff80001a9df78 rsp=fffff8801cd5f638 rbp=fffffa800fedd010
r8=fffff78000000008 r9=0000000000000000 r10=0000000000000000
r11=fffff88002264180 r12=fffff8801cd5f9a8 r13=0000000000000073
r14=0000000000001005 r15=fffff8801cd5f9a8
iopl=0 nv up ei pl nz na pe cy
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010203
nt!WmipDoFindRegEntryByProviderId+0x10:
fffff800`01a9df78 394830 cmp dword ptr [rax+30h],ecx ds:002b:4c4c4c4c`4c4cd705=????????
Resetting default scope
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
BUGCHECK_STR: 0x3B
PROCESS_NAME: WmiPrvSE.exe
CURRENT_IRQL: 0
LAST_CONTROL_TRANSFER: from 0000000000000000 to fffff80001a9df78
STACK_TEXT:
fffff880`1cd5f638 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!WmipDoFindRegEntryByProviderId+0x10
FOLLOWUP_IP:
nt!WmipDoFindRegEntryByProviderId+10
fffff800`01a9df78 394830 cmp dword ptr [rax+30h],ecx
SYMBOL_STACK_INDEX: 0
SYMBOL_NAME: nt!WmipDoFindRegEntryByProviderId+10
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 503f82be
STACK_COMMAND: .cxr 0xfffff8801cd5ec50 ; kb
FAILURE_BUCKET_ID: X64_0x3B_nt!WmipDoFindRegEntryByProviderId+10
BUCKET_ID: X64_0x3B_nt!WmipDoFindRegEntryByProviderId+10
Followup: MachineOwner
---------
答案
-
0x0000003B 错误表示一个从没有权限的代码传送至有权限的代码时遇到了例外的错误,一般是软件兼容性问题引起页面库占用过多,或者用户模式的显示驱动传送了不正确的代码。此问题是否只在试图关机时出现?--Alexis Zhanghttp://mvp.support.microsoft.com/profile/jiehttp://blogs.itecn.net/blogs/alexis推荐以 NNTP Bridge 桥接新闻组方式访问论坛以获取最佳用户体验。本帖是回复帖,原帖作者是楼上的 "CHN.Skill"BugCheck 3B, {c0000005, fffff80001a9df78, fffff8801cd5ec50, 0}PROCESS_NAME: WmiPrvSE.exe
- 已标记为答案 CHN.Skill 2012年11月21日 12:31
全部回复
-
蓝屏错误, 0x0000003B, 是由于在其中分配给驱动程序堆栈的缓冲区不正确地初始化了 Microsoft IEEE 1394 驱动程序堆栈中的错误。
建议下载下文中提到的热修复补丁来解决问题
http://support.microsoft.com/kb/980932/zh-cn
在IT的路上,You'll never walk alone
-
0x0000003B 错误表示一个从没有权限的代码传送至有权限的代码时遇到了例外的错误,一般是软件兼容性问题引起页面库占用过多,或者用户模式的显示驱动传送了不正确的代码。此问题是否只在试图关机时出现?--Alexis Zhanghttp://mvp.support.microsoft.com/profile/jiehttp://blogs.itecn.net/blogs/alexis推荐以 NNTP Bridge 桥接新闻组方式访问论坛以获取最佳用户体验。本帖是回复帖,原帖作者是楼上的 "CHN.Skill"BugCheck 3B, {c0000005, fffff80001a9df78, fffff8801cd5ec50, 0}PROCESS_NAME: WmiPrvSE.exe
- 已标记为答案 CHN.Skill 2012年11月21日 12:31