none
异常蓝屏（vista32）问题 RRS feed

 > 

  • 问题

  • Question
    登录进行投票
    0
    登录进行投票

    这是重启之后系统给的信息
    问题签名:

      问题事件名称:                 BlueScreen

      OS 版本:                      6.0.6002.2.2.0.768.2

      区域设置 ID:                  2052

     

    有关该问题的其他信息:

      BCCode:                                             1000008e

      BCP1:                                                  C0000005

      BCP2:                                                  87F95247

      BCP3:                                                  9A61C9BC

      BCP4:                                                  00000000

      OS Version:                                        6_0_6002

      Service Pack:                                     2_0

      Product:                                             768_1

     

    有助于描述该问题的文件:

      C:\Windows\Minidump\Mini081309-02.dmp

      C:\Users\hp\AppData\Local\Temp\WER-77704-0.sysdata.xml

      C:\Users\hp\AppData\Local\Temp\WER6FF1.tmp.version.txt

    这是debugging  tool给的分析，麻烦高手帮我分析症状所在，谢谢!
                      Bugcheck  Analysis
    Use !analysis-v to get detailed debugging information.

    Bugcheck  8E,{c0000005,87f95247,9a61c9bc,0}

    ERROR:Module load completed but symbols could not be loaded for TfFsMon.sys
       Kernel symbols are WRONG. Please fix symbols to do analysis.

    Your debugger is not using the correct symbols.

    In order for this command to work properly,your symbol path must point to .pdb files that have full type information.

    Certain .pdb files (such as the public OS symbols) do not contain the required information.Contact the group that provided you with these symbols if you need this command to work.

    Type referenced:nt!_KPRCB  
    ********************************
    Symbols can not be loaded because symbols path is not initialized.

    The Symbols Path can be set by:
       using the _NT_SYMBOL_PATH environment variable.
       using the _y <symbols path> argument when starting the debugger.
       using .synbols and .symbols+
    ****************************
    Probably caused by: TfFsMON.sys(TfFsMON+3247)

    Followup: MachineOwner 

    2009年8月14日 10:20
    |

全部回复

  • Question
    登录进行投票
    0
    登录进行投票
    因為你沒有執行 !analyze -v 命令, 所以只能從已有的信息進行判斷.

    從下面地址看

    tffsmon.sys
    http://www.freefixer.com/library/file/16905/

    是 PC Tools 的一個軟件的相關驅動程序文件, 因為沒有安裝過 PC Tools 的相關軟件, 只能猜測其可能屬於 PC Tools Firewall.

    如果安裝了該軟件, 建議你先禁用, 觀察藍屏是否還會發生.

    同時不排除是 PC Tools 軟件與其他軟件有衝突造成的.

    最後建議你把執行完 !analyze -v 命令後的詳細診斷結果貼上來, 以便能更加準確的確定問題原因.
    Folding@Home
    2009年8月14日 11:25
    |
  • Question
    登录进行投票
    0
    登录进行投票
    是否安装了ThreatFire产品,看会再发生此蓝屏现象,

    如果是安装了某个硬件或软件后出现就先卸载它.
    2009年8月15日 0:18
    |
  • Question
    登录进行投票
    0
    登录进行投票
    是安装了threatfire，但是蓝屏在安装前就已经出现了很多次了，安装后又出现了几次。
    • 已编辑 jzyanglj 2009年8月15日 4:44
    2009年8月15日 4:30
    |
  • Question
    登录进行投票
    0
    登录进行投票
    那需要分析安裝 threatfire 之前的 DMP 文件. DMP 文件命名規則: MiniMMDDYY-NN.dmp
    Folding@Home
    2009年8月15日 4:32
    |
  • Question
    登录进行投票
    0
    登录进行投票
    我系统默认的是核心内存转储，全都生成在一个文件里。分析的结果全都是下面这个原因，
    Your debugger is not using the correct symbols.

    In order for this command to work properly,your symbol path must point to .pdb files that have full type information.

    Certain .pdb files (such as the public OS symbols) do not contain the required information.Contact the group that provided you with these symbols if you need this command to work.

    Type referenced:nt!_KPRCB  

    我把其余的相同结果就省略了。
    2009年8月15日 4:38
    |
  • Question
    登录进行投票
    0
    登录进行投票

    ADDITIONAL_DEBUG_TEXT: 
    Use '!findthebuild' command to search for the target build information.
    If the build information is available, run '!findthebuild -s ; .reload' to set symbol path and load symbols.

    MODULE_NAME: TfFsMon

    FAULTING_MODULE: 81e4f000 nt

    DEBUG_FLR_IMAGE_TIMESTAMP:  4a3bf22f

    EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - 0x%08lx

    FAULTING_IP:
    TfFsMon+3247
    87f95247 397108          cmp     dword ptr [ecx+8],esi

    TRAP_FRAME:  9a61c9bc -- (.trap 0xffffffff9a61c9bc)
    ErrCode = 00000000
    eax=a0bf6cb4 ebx=8630d908 ecx=12f0aa90 edx=000000e6 esi=a417cb80 edi=00000000
    eip=87f95247 esp=9a61ca30 ebp=9a61ca38 iopl=0         nv up ei pl nz ac po cy
    cs=0008  ss=0010  ds=0023  es=0023  fs=0030  gs=0000             efl=00010213
    TfFsMon+0x3247:
    87f95247 397108          cmp     dword ptr [ecx+8],esi ds:0023:12f0aa98=????????
    Resetting default scope

    DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

    BUGCHECK_STR:  0x8E

    CURRENT_IRQL:  0

    LAST_CONTROL_TRANSFER:  from 81e76918 to 81f1cb0d

    STACK_TEXT: 
    WARNING: Stack unwind information not available. Following frames may be wrong.
    9a61c57c 81e76918 0000008e c0000005 87f95247 nt!KeBugCheckEx+0x1e
    9a61c94c 81e9a83a 9a61c968 00000000 9a61c9bc nt!KeSetKernelStackSwapEnable+0x25a
    9a61c9d0 81f3ccc9 98478138 98478310 8630d908 nt!Kei386EoiHelper+0x1d2
    9a61ca38 87f99338 a0bf6560 a417cb80 9ae633a3 nt!ExAllocatePoolWithTag+0x188
    9a61cab0 81e93976 8630d850 98478138 985fb3b4 TfFsMon+0x7338
    9a61cac8 8208e0d5 7728335d acb270ac 8605b3b0 nt!IofCallDriver+0x64
    9a61cb98 8207c521 8605b3c8 00000000 acb27008 nt!CcMapData+0x133d
    9a61cc28 82089aa2 00000000 9a61cc80 00000040 nt!SeUnlockSubjectContext+0x62d
    9a61cc88 8208f1dc 05faf4fc 00000000 82089301 nt!ObOpenObjectByName+0x13c
    9a61ccfc 82054fc3 05faf548 00100001 05faf4fc nt!SeSetAccessStateGenericMapping+0x7a2
    9a61cd44 81e99c7a 05faf548 00100001 05faf4fc nt!NtOpenFile+0x2a
    9a61cd64 76f15e74 badb0d00 05faf4d8 00000000 nt!ZwQueryLicenseValue+0xbc6
    9a61cd68 badb0d00 05faf4d8 00000000 00000000 0x76f15e74
    9a61cd6c 05faf4d8 00000000 00000000 00000000 0xbadb0d00
    9a61cd70 00000000 00000000 00000000 00000000 0x5faf4d8


    STACK_COMMAND:  kb

    FOLLOWUP_IP:
    TfFsMon+3247
    87f95247 397108          cmp     dword ptr [ecx+8],esi

    SYMBOL_STACK_INDEX:  0

    SYMBOL_NAME:  TfFsMon+3247

    FOLLOWUP_NAME:  MachineOwner

    IMAGE_NAME:  TfFsMon.sys

    BUCKET_ID:  WRONG_SYMBOLS

    Followup: MachineOwner
    ---------

    这是執行 !analyze -v 命令后的分析结果。请帮我分析下，谢谢。

    2009年8月15日 4:43
    |
  • Question
    登录进行投票
    0
    登录进行投票
    C:\Windows\Minidump 文件夾下面沒有其他的 DMP 文件了嗎?
    Folding@Home
    2009年8月15日 4:53
    |
  • Question
    登录进行投票
    0
    登录进行投票

    有，我把最近一次的分析报告给你。
    Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
    Copyright (c) Microsoft Corporation. All rights reserved.


    Loading Dump File [C:\Windows\Minidump\Mini081309-02.dmp]
    Mini Kernel Dump File: Only registers and stack trace are available

    Symbol search path is: *** Invalid ***
    ****************************************************************************
    * Symbol loading may be unreliable without a symbol search path.           *
    * Use .symfix to have the debugger choose a symbol path.                   *
    * After setting your symbol path, use .reload to refresh symbol locations. *
    ****************************************************************************
    Executable search path is:
    *********************************************************************
    * Symbols can not be loaded because symbol path is not initialized. *
    *                                                                   *
    * The Symbol Path can be set by:                                    *
    *   using the _NT_SYMBOL_PATH environment variable.                 *
    *   using the -y <symbol_path> argument when starting the debugger. *
    *   using .sympath and .sympath+                                    *
    *********************************************************************
    Unable to load image \SystemRoot\system32\ntkrnlpa.exe, Win32 error 0n2
    *** WARNING: Unable to verify timestamp for ntkrnlpa.exe
    *** ERROR: Module load completed but symbols could not be loaded for ntkrnlpa.exe
    Windows Server 2008/Windows Vista Kernel Version 6002 (Service Pack 2) MP (2 procs) Free x86 compatible
    Product: WinNt, suite: TerminalServer SingleUserTS Personal
    Machine Name:
    Kernel base = 0x81e4f000 PsLoadedModuleList = 0x81f66c70
    Debug session time: Thu Aug 13 17:00:10.578 2009 (GMT+8)
    System Uptime: 0 days 6:35:10.560
    *********************************************************************
    * Symbols can not be loaded because symbol path is not initialized. *
    *                                                                   *
    * The Symbol Path can be set by:                                    *
    *   using the _NT_SYMBOL_PATH environment variable.                 *
    *   using the -y <symbol_path> argument when starting the debugger. *
    *   using .sympath and .sympath+                                    *
    *********************************************************************
    Unable to load image \SystemRoot\system32\ntkrnlpa.exe, Win32 error 0n2
    *** WARNING: Unable to verify timestamp for ntkrnlpa.exe
    *** ERROR: Module load completed but symbols could not be loaded for ntkrnlpa.exe
    Loading Kernel Symbols
    ...............................................................
    ................................................................
    ..................................
    Loading User Symbols
    Loading unloaded module list
    ...
    Unable to load image \SystemRoot\system32\drivers\TfFsMon.sys, Win32 error 0n2
    *** WARNING: Unable to verify timestamp for TfFsMon.sys
    *** ERROR: Module load completed but symbols could not be loaded for TfFsMon.sys
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************

    Use !analyze -v to get detailed debugging information.

    BugCheck 1000008E, {c0000005, 87f95247, 9a61c9bc, 0}

    ***** Kernel symbols are WRONG. Please fix symbols to do analysis.

    *************************************************************************
    ***                                                                   ***
    ***                                                                   ***
    ***    Your debugger is not using the correct symbols                 ***
    ***                                                                   ***
    ***    In order for this command to work properly, your symbol path   ***
    ***    must point to .pdb files that have full type information.      ***
    ***                                                                   ***
    ***    Certain .pdb files (such as the public OS symbols) do not      ***
    ***    contain the required information.  Contact the group that      ***
    ***    provided you with these symbols if you need this command to    ***
    ***    work.                                                          ***
    ***                                                                   ***
    ***    Type referenced: nt!_KPRCB                                     ***
    ***                                                                   ***
    *************************************************************************
    *************************************************************************
    ***                                                                   ***
    ***                                                                   ***
    ***    Your debugger is not using the correct symbols                 ***
    ***                                                                   ***
    ***    In order for this command to work properly, your symbol path   ***
    ***    must point to .pdb files that have full type information.      ***
    ***                                                                   ***
    ***    Certain .pdb files (such as the public OS symbols) do not      ***
    ***    contain the required information.  Contact the group that      ***
    ***    provided you with these symbols if you need this command to    ***
    ***    work.                                                          ***
    ***                                                                   ***
    ***    Type referenced: nt!KPRCB                                      ***
    ***                                                                   ***
    *************************************************************************
    *************************************************************************
    ***                                                                   ***
    ***                                                                   ***
    ***    Your debugger is not using the correct symbols                 ***
    ***                                                                   ***
    ***    In order for this command to work properly, your symbol path   ***
    ***    must point to .pdb files that have full type information.      ***
    ***                                                                   ***
    ***    Certain .pdb files (such as the public OS symbols) do not      ***
    ***    contain the required information.  Contact the group that      ***
    ***    provided you with these symbols if you need this command to    ***
    ***    work.                                                          ***
    ***                                                                   ***
    ***    Type referenced: nt!_KPRCB                                     ***
    ***                                                                   ***
    *************************************************************************
    *************************************************************************
    ***                                                                   ***
    ***                                                                   ***
    ***    Your debugger is not using the correct symbols                 ***
    ***                                                                   ***
    ***    In order for this command to work properly, your symbol path   ***
    ***    must point to .pdb files that have full type information.      ***
    ***                                                                   ***
    ***    Certain .pdb files (such as the public OS symbols) do not      ***
    ***    contain the required information.  Contact the group that      ***
    ***    provided you with these symbols if you need this command to    ***
    ***    work.                                                          ***
    ***                                                                   ***
    ***    Type referenced: nt!KPRCB                                      ***
    ***                                                                   ***
    *************************************************************************
    *************************************************************************
    ***                                                                   ***
    ***                                                                   ***
    ***    Your debugger is not using the correct symbols                 ***
    ***                                                                   ***
    ***    In order for this command to work properly, your symbol path   ***
    ***    must point to .pdb files that have full type information.      ***
    ***                                                                   ***
    ***    Certain .pdb files (such as the public OS symbols) do not      ***
    ***    contain the required information.  Contact the group that      ***
    ***    provided you with these symbols if you need this command to    ***
    ***    work.                                                          ***
    ***                                                                   ***
    ***    Type referenced: nt!_KPRCB                                     ***
    ***                                                                   ***
    *************************************************************************
    *************************************************************************
    ***                                                                   ***
    ***                                                                   ***
    ***    Your debugger is not using the correct symbols                 ***
    ***                                                                   ***
    ***    In order for this command to work properly, your symbol path   ***
    ***    must point to .pdb files that have full type information.      ***
    ***                                                                   ***
    ***    Certain .pdb files (such as the public OS symbols) do not      ***
    ***    contain the required information.  Contact the group that      ***
    ***    provided you with these symbols if you need this command to    ***
    ***    work.                                                          ***
    ***                                                                   ***
    ***    Type referenced: nt!_KPRCB                                     ***
    ***                                                                   ***
    *************************************************************************
    *************************************************************************
    ***                                                                   ***
    ***                                                                   ***
    ***    Your debugger is not using the correct symbols                 ***
    ***                                                                   ***
    ***    In order for this command to work properly, your symbol path   ***
    ***    must point to .pdb files that have full type information.      ***
    ***                                                                   ***
    ***    Certain .pdb files (such as the public OS symbols) do not      ***
    ***    contain the required information.  Contact the group that      ***
    ***    provided you with these symbols if you need this command to    ***
    ***    work.                                                          ***
    ***                                                                   ***
    ***    Type referenced: nt!_KPRCB                                     ***
    ***                                                                   ***
    *************************************************************************
    *************************************************************************
    ***                                                                   ***
    ***                                                                   ***
    ***    Your debugger is not using the correct symbols                 ***
    ***                                                                   ***
    ***    In order for this command to work properly, your symbol path   ***
    ***    must point to .pdb files that have full type information.      ***
    ***                                                                   ***
    ***    Certain .pdb files (such as the public OS symbols) do not      ***
    ***    contain the required information.  Contact the group that      ***
    ***    provided you with these symbols if you need this command to    ***
    ***    work.                                                          ***
    ***                                                                   ***
    ***    Type referenced: nt!_KPRCB                                     ***
    ***                                                                   ***
    *************************************************************************
    *********************************************************************
    * Symbols can not be loaded because symbol path is not initialized. *
    *                                                                   *
    * The Symbol Path can be set by:                                    *
    *   using the _NT_SYMBOL_PATH environment variable.                 *
    *   using the -y <symbol_path> argument when starting the debugger. *
    *   using .sympath and .sympath+                                    *
    *********************************************************************
    *********************************************************************
    * Symbols can not be loaded because symbol path is not initialized. *
    *                                                                   *
    * The Symbol Path can be set by:                                    *
    *   using the _NT_SYMBOL_PATH environment variable.                 *
    *   using the -y <symbol_path> argument when starting the debugger. *
    *   using .sympath and .sympath+                                    *
    *********************************************************************
    Probably caused by : TfFsMon.sys ( TfFsMon+3247 )

    Followup: MachineOwner

    2009年8月15日 4:57
    |
  • Question
    登录进行投票
    0
    登录进行投票

    首先感謝你間接推薦這個軟件, 從介紹看很不錯. 應該適合虛擬機.

    另外你有無安裝其他安全軟件(防病毒軟件和第三方防火墻), 在這幾次藍屏之前, 有無進行過相同的操作? 如果有可以考慮, 暫時將那些軟件暫時禁用, 觀察 threatfire 的 TfFsMon.sys 是否還會導致藍屏. 也可以不禁用那些軟件, 而吧 threatfire 的某些保護功能暫時禁用.

    Folding@Home
    2009年8月15日 5:03
    |
  • Question
    登录进行投票
    0
    登录进行投票
    安装的是诺顿的杀毒和threatfire ，关掉threatfire 可以吧。用过的DMP文件是不是可以删掉啊？
    2009年8月15日 5:12
    |
  • Question
    登录进行投票
    0
    登录进行投票

    其實關掉諾頓也可以, 只用 Threatfire, 並且除了安裝軟件或修改系統設置在管理員帳戶下進行外, 其他都在受限用戶帳戶下進行, 遭到病毒攻擊的幾率很低.

    Folding@Home
    2009年8月15日 5:14
    |
  • Question
    登录进行投票
    0
    登录进行投票
    哦，真是长见识了，太谢谢你了。
    2009年8月15日 5:30
    |
  • Question
    登录进行投票
    0
    登录进行投票

    可能是诺顿和Threatfire冲突引起的,建议你更换两者中的任何一个就可以了.

    如果使用诺顿,个人更推荐你NIS,而不是NAV,如果你选择了NIS的话,就卸载Threatfire.

    2009年8月15日 5:36
    |
  • Question
    登录进行投票
    0
    登录进行投票

    關於如何在 Windows Vista 選擇何種用戶組請參閱下面這個帖子:

    关于Viata系统下建议使用标准帐户的疑问！
    http://social.microsoft.com/Forums/zh-CN/vistazhchs/thread/dc7784b6-950c-444a-9fa8-1c13d1774d66

    Folding@Home
    2009年8月15日 5:55
    |
  • Question
    登录进行投票
    0
    登录进行投票
    向樓主彙報一下, 我在虛擬機 Windows XP 實體關於 ThreatFire 的測試:

    1. 在虛擬機上成功安裝 ThreatFire, 期間沒有遇到任何問題.

    相關截圖:


    2. 但是在通過 ThreatFire 的 Smart Update 升級時遇到問題, 當下載完數據庫進行安裝時, TFUN.exe 發生錯誤,  Windows 系統彈出"錯誤應用程序"對話框, 該程序將被終止, 但在 Windows 任務管理器查看發現 TFUN.exe 是一個 SYSTEM 帳戶進程, 并沒有被終止, 同時 CPU 占用率達到 100% (進程 drwtsn32.exe CPU 占用 80% ~ 90%).

    相關截圖:

    注: 部分信息被隱去.

    3.  在關閉 "錯誤應用程序" 對話框并取消 ThreatFire 更新後, 進行重新啟動.

    4. 在 Windows 開始加載的滾動條滾動幾圈後, 發生 BSOD 錯誤.

    相關截圖:

    5. 強制重新啟動虛擬機并進入安全模式後再次重新啟動, 這次成功看到 Windows 登錄界面并能進入桌面.

    6. 不清楚 ThreatFire 是否同虛擬機的增強組件有衝突, 或虛擬機本身存在某些問題導致升級失敗進而在開機啟動過程中發生 BSOD 錯誤.

    7. 兩次嘗試用 Smart Update 對 ThreatFire 進行升級, 但都發生相同錯誤.
    Folding@Home
    2009年8月15日 8:21
    |
  • Question
    登录进行投票
    0
    登录进行投票
    但是我的机子在安装ThreatFire之前也不止一次出现蓝屏，就不知道是怎么回事？
    2009年8月16日 10:17
    |
  • Question
    登录进行投票
    0
    登录进行投票
    那NIS能否监管日常的如U盘类的插入吗？
    2009年8月16日 10:19
    |
  • Question
    登录进行投票
    0
    登录进行投票
    這個建議閱讀 NIS 的用戶幫助或說明書, 以及在明天(星期一)致電 Symantec 售後.
    Folding@Home
    2009年8月16日 10:24
    |
  • Question
    登录进行投票
    0
    登录进行投票
    安裝 ThreatFire 之前發生的藍屏, 有當時的 DMP 文件最好, 或有藍屏代碼和文字信息也行, 如果都沒有的話, 是沒法進行分析的.
    Folding@Home
    2009年8月16日 10:26
    |
  • Question
    登录进行投票
    0
    登录进行投票
    我用手机拍了最近的蓝屏画面，但是不完整。其中最下面的部分代码是：
    kc0000005，0×87F95247，0×9A61C9BC，后面的看不见，下排是
    ress  87F95247 base at 87F92000，。。。。。。。。。
    2009年8月16日 10:38
    |
  • Question
    登录进行投票
    0
    登录进行投票
    請參照我下面的截圖進行關於轉儲文件設置的截圖:




    注: 不能勾選 "自動重新啟動(R)" 複選框.
    如果勾選了你將沒有用手機或用筆記錄藍屏信息的機會, 在不能保存轉儲文件的情況下.

    更多信息, 請參見:

    易宝典：Windows常见蓝屏故障分析(MVP 撰稿)
    http://support.microsoft.com/kb/972602/zh-cn
    Folding@Home
    • 已编辑 repl 2009年8月16日 11:10
    2009年8月16日 11:08
    |
  • Question
    登录进行投票
    0
    登录进行投票
    完成了，那以后如果蓝屏的话就强行重启？
    2009年8月16日 11:12
    |
  • Question
    登录进行投票
    0
    登录进行投票
    對, 用按復位鍵進行重啟, 如果沒有復位鍵的話, 長按開機鍵進行關機, 而後等待 30 秒再開機.
    Folding@Home
    2009年8月16日 11:13
    |
  • Question
    登录进行投票
    0
    登录进行投票
    好的，太感谢你了！
    2009年8月16日 11:16
    |
  • Question
    登录进行投票
    0
    登录进行投票
    今天再次蓝屏了，上了厕所回来就直接蓝了。下面是蓝屏是记下的代码：
    STOP:0×00000050（0×A5F8F000，0×00000001，0×8E6A3F63，0×00000000）
    SafeBoxkrnl.sys-Address 8E6A3F63 base at 8E6A3000 Datestamp 4a4f1d40
    2009年8月17日 9:24
    |
  • Question
    登录进行投票
    0
    登录进行投票
    你看看在 C:\Windows\Minidump \ 有沒有生成時間為剛才的  DMP 文件, 如果有分析診斷一下.

    另外請查看

    易宝典：Windows常见蓝屏故障分析(MVP 撰稿)
    http://support.microsoft.com/kb/972602/zh-cn

    裏面有關於 0×00000050 的一般處理方法.
    Folding@Home
    2009年8月17日 9:29
    |
  • Question
    登录进行投票
    0
    登录进行投票

    Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
    Copyright (c) Microsoft Corporation. All rights reserved.


    Loading Dump File [C:\Windows\Minidump\Mini081709-01.dmp]
    Mini Kernel Dump File: Only registers and stack trace are available

    Symbol search path is: *** Invalid ***
    ****************************************************************************
    * Symbol loading may be unreliable without a symbol search path.           *
    * Use .symfix to have the debugger choose a symbol path.                   *
    * After setting your symbol path, use .reload to refresh symbol locations. *
    ****************************************************************************
    Executable search path is:
    *********************************************************************
    * Symbols can not be loaded because symbol path is not initialized. *
    *                                                                   *
    * The Symbol Path can be set by:                                    *
    *   using the _NT_SYMBOL_PATH environment variable.                 *
    *   using the -y <symbol_path> argument when starting the debugger. *
    *   using .sympath and .sympath+                                    *
    *********************************************************************
    Unable to load image \SystemRoot\system32\ntkrnlpa.exe, Win32 error 0n2
    *** WARNING: Unable to verify timestamp for ntkrnlpa.exe
    *** ERROR: Module load completed but symbols could not be loaded for ntkrnlpa.exe
    Windows Server 2008/Windows Vista Kernel Version 6002 (Service Pack 2) MP (2 procs) Free x86 compatible
    Product: WinNt, suite: TerminalServer SingleUserTS Personal
    Machine Name:
    Kernel base = 0x81e12000 PsLoadedModuleList = 0x81f29c70
    Debug session time: Mon Aug 17 17:04:29.269 2009 (GMT+8)
    System Uptime: 0 days 4:12:35.904
    *********************************************************************
    * Symbols can not be loaded because symbol path is not initialized. *
    *                                                                   *
    * The Symbol Path can be set by:                                    *
    *   using the _NT_SYMBOL_PATH environment variable.                 *
    *   using the -y <symbol_path> argument when starting the debugger. *
    *   using .sympath and .sympath+                                    *
    *********************************************************************
    Unable to load image \SystemRoot\system32\ntkrnlpa.exe, Win32 error 0n2
    *** WARNING: Unable to verify timestamp for ntkrnlpa.exe
    *** ERROR: Module load completed but symbols could not be loaded for ntkrnlpa.exe
    Loading Kernel Symbols
    ...............................................................
    ................................................................
    ...................................
    Loading User Symbols
    Loading unloaded module list
    .........
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************

    Use !analyze -v to get detailed debugging information.

    BugCheck 50, {a5f8f000, 1, 8e6a3f63, 0}

    *** WARNING: Unable to verify timestamp for SafeBoxKrnl.sys
    *** ERROR: Module load completed but symbols could not be loaded for SafeBoxKrnl.sys
    ***** Kernel symbols are WRONG. Please fix symbols to do analysis.

    *************************************************************************
    ***                                                                   ***
    ***                                                                   ***
    ***    Your debugger is not using the correct symbols                 ***
    ***                                                                   ***
    ***    In order for this command to work properly, your symbol path   ***
    ***    must point to .pdb files that have full type information.      ***
    ***                                                                   ***
    ***    Certain .pdb files (such as the public OS symbols) do not      ***
    ***    contain the required information.  Contact the group that      ***
    ***    provided you with these symbols if you need this command to    ***
    ***    work.                                                          ***
    ***                                                                   ***
    ***    Type referenced: nt!_KPRCB                                     ***
    ***                                                                   ***
    *************************************************************************
    *************************************************************************
    ***                                                                   ***
    ***                                                                   ***
    ***    Your debugger is not using the correct symbols                 ***
    ***                                                                   ***
    ***    In order for this command to work properly, your symbol path   ***
    ***    must point to .pdb files that have full type information.      ***
    ***                                                                   ***
    ***    Certain .pdb files (such as the public OS symbols) do not      ***
    ***    contain the required information.  Contact the group that      ***
    ***    provided you with these symbols if you need this command to    ***
    ***    work.                                                          ***
    ***                                                                   ***
    ***    Type referenced: nt!KPRCB                                      ***
    ***                                                                   ***
    *************************************************************************
    *************************************************************************
    ***                                                                   ***
    ***                                                                   ***
    ***    Your debugger is not using the correct symbols                 ***
    ***                                                                   ***
    ***    In order for this command to work properly, your symbol path   ***
    ***    must point to .pdb files that have full type information.      ***
    ***                                                                   ***
    ***    Certain .pdb files (such as the public OS symbols) do not      ***
    ***    contain the required information.  Contact the group that      ***
    ***    provided you with these symbols if you need this command to    ***
    ***    work.                                                          ***
    ***                                                                   ***
    ***    Type referenced: nt!_KPRCB                                     ***
    ***                                                                   ***
    *************************************************************************
    *************************************************************************
    ***                                                                   ***
    ***                                                                   ***
    ***    Your debugger is not using the correct symbols                 ***
    ***                                                                   ***
    ***    In order for this command to work properly, your symbol path   ***
    ***    must point to .pdb files that have full type information.      ***
    ***                                                                   ***
    ***    Certain .pdb files (such as the public OS symbols) do not      ***
    ***    contain the required information.  Contact the group that      ***
    ***    provided you with these symbols if you need this command to    ***
    ***    work.                                                          ***
    ***                                                                   ***
    ***    Type referenced: nt!KPRCB                                      ***
    ***                                                                   ***
    *************************************************************************
    *************************************************************************
    ***                                                                   ***
    ***                                                                   ***
    ***    Your debugger is not using the correct symbols                 ***
    ***                                                                   ***
    ***    In order for this command to work properly, your symbol path   ***
    ***    must point to .pdb files that have full type information.      ***
    ***                                                                   ***
    ***    Certain .pdb files (such as the public OS symbols) do not      ***
    ***    contain the required information.  Contact the group that      ***
    ***    provided you with these symbols if you need this command to    ***
    ***    work.                                                          ***
    ***                                                                   ***
    ***    Type referenced: nt!_KPRCB                                     ***
    ***                                                                   ***
    *************************************************************************
    *************************************************************************
    ***                                                                   ***
    ***                                                                   ***
    ***    Your debugger is not using the correct symbols                 ***
    ***                                                                   ***
    ***    In order for this command to work properly, your symbol path   ***
    ***    must point to .pdb files that have full type information.      ***
    ***                                                                   ***
    ***    Certain .pdb files (such as the public OS symbols) do not      ***
    ***    contain the required information.  Contact the group that      ***
    ***    provided you with these symbols if you need this command to    ***
    ***    work.                                                          ***
    ***                                                                   ***
    ***    Type referenced: nt!_KPRCB                                     ***
    ***                                                                   ***
    *************************************************************************
    *************************************************************************
    ***                                                                   ***
    ***                                                                   ***
    ***    Your debugger is not using the correct symbols                 ***
    ***                                                                   ***
    ***    In order for this command to work properly, your symbol path   ***
    ***    must point to .pdb files that have full type information.      ***
    ***                                                                   ***
    ***    Certain .pdb files (such as the public OS symbols) do not      ***
    ***    contain the required information.  Contact the group that      ***
    ***    provided you with these symbols if you need this command to    ***
    ***    work.                                                          ***
    ***                                                                   ***
    ***    Type referenced: nt!_KPRCB                                     ***
    ***                                                                   ***
    *************************************************************************
    *************************************************************************
    ***                                                                   ***
    ***                                                                   ***
    ***    Your debugger is not using the correct symbols                 ***
    ***                                                                   ***
    ***    In order for this command to work properly, your symbol path   ***
    ***    must point to .pdb files that have full type information.      ***
    ***                                                                   ***
    ***    Certain .pdb files (such as the public OS symbols) do not      ***
    ***    contain the required information.  Contact the group that      ***
    ***    provided you with these symbols if you need this command to    ***
    ***    work.                                                          ***
    ***                                                                   ***
    ***    Type referenced: nt!_KPRCB                                     ***
    ***                                                                   ***
    *************************************************************************
    *********************************************************************
    * Symbols can not be loaded because symbol path is not initialized. *
    *                                                                   *
    * The Symbol Path can be set by:                                    *
    *   using the _NT_SYMBOL_PATH environment variable.                 *
    *   using the -y <symbol_path> argument when starting the debugger. *
    *   using .sympath and .sympath+                                    *
    *********************************************************************
    *********************************************************************
    * Symbols can not be loaded because symbol path is not initialized. *
    *                                                                   *
    * The Symbol Path can be set by:                                    *
    *   using the _NT_SYMBOL_PATH environment variable.                 *
    *   using the -y <symbol_path> argument when starting the debugger. *
    *   using .sympath and .sympath+                                    *
    *********************************************************************
    Probably caused by : SafeBoxKrnl.sys ( SafeBoxKrnl+f63 )

    Followup: MachineOwner
    ---------

    0: kd> !analyze -v
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************

    PAGE_FAULT_IN_NONPAGED_AREA (50)
    Invalid system memory was referenced.  This cannot be protected by try-except,
    it must be protected by a Probe.  Typically the address is just plain bad or it
    is pointing at freed memory.
    Arguments:
    Arg1: a5f8f000, memory referenced.
    Arg2: 00000001, value 0 = read operation, 1 = write operation.
    Arg3: 8e6a3f63, If non-zero, the instruction address which referenced the bad memory
     address.
    Arg4: 00000000, (reserved)

    Debugging Details:
    ------------------

    ***** Kernel symbols are WRONG. Please fix symbols to do analysis.

    *************************************************************************
    ***                                                                   ***
    ***                                                                   ***
    ***    Your debugger is not using the correct symbols                 ***
    ***                                                                   ***
    ***    In order for this command to work properly, your symbol path   ***
    ***    must point to .pdb files that have full type information.      ***
    ***                                                                   ***
    ***    Certain .pdb files (such as the public OS symbols) do not      ***
    ***    contain the required information.  Contact the group that      ***
    ***    provided you with these symbols if you need this command to    ***
    ***    work.                                                          ***
    ***                                                                   ***
    ***    Type referenced: nt!_KPRCB                                     ***
    ***                                                                   ***
    *************************************************************************
    *************************************************************************
    ***                                                                   ***
    ***                                                                   ***
    ***    Your debugger is not using the correct symbols                 ***
    ***                                                                   ***
    ***    In order for this command to work properly, your symbol path   ***
    ***    must point to .pdb files that have full type information.      ***
    ***                                                                   ***
    ***    Certain .pdb files (such as the public OS symbols) do not      ***
    ***    contain the required information.  Contact the group that      ***
    ***    provided you with these symbols if you need this command to    ***
    ***    work.                                                          ***
    ***                                                                   ***
    ***    Type referenced: nt!KPRCB                                      ***
    ***                                                                   ***
    *************************************************************************
    *************************************************************************
    ***                                                                   ***
    ***                                                                   ***
    ***    Your debugger is not using the correct symbols                 ***
    ***                                                                   ***
    ***    In order for this command to work properly, your symbol path   ***
    ***    must point to .pdb files that have full type information.      ***
    ***                                                                   ***
    ***    Certain .pdb files (such as the public OS symbols) do not      ***
    ***    contain the required information.  Contact the group that      ***
    ***    provided you with these symbols if you need this command to    ***
    ***    work.                                                          ***
    ***                                                                   ***
    ***    Type referenced: nt!_KPRCB                                     ***
    ***                                                                   ***
    *************************************************************************
    *************************************************************************
    ***                                                                   ***
    ***                                                                   ***
    ***    Your debugger is not using the correct symbols                 ***
    ***                                                                   ***
    ***    In order for this command to work properly, your symbol path   ***
    ***    must point to .pdb files that have full type information.      ***
    ***                                                                   ***
    ***    Certain .pdb files (such as the public OS symbols) do not      ***
    ***    contain the required information.  Contact the group that      ***
    ***    provided you with these symbols if you need this command to    ***
    ***    work.                                                          ***
    ***                                                                   ***
    ***    Type referenced: nt!KPRCB                                      ***
    ***                                                                   ***
    *************************************************************************
    *************************************************************************
    ***                                                                   ***
    ***                                                                   ***
    ***    Your debugger is not using the correct symbols                 ***
    ***                                                                   ***
    ***    In order for this command to work properly, your symbol path   ***
    ***    must point to .pdb files that have full type information.      ***
    ***                                                                   ***
    ***    Certain .pdb files (such as the public OS symbols) do not      ***
    ***    contain the required information.  Contact the group that      ***
    ***    provided you with these symbols if you need this command to    ***
    ***    work.                                                          ***
    ***                                                                   ***
    ***    Type referenced: nt!_KPRCB                                     ***
    ***                                                                   ***
    *************************************************************************
    *************************************************************************
    ***                                                                   ***
    ***                                                                   ***
    ***    Your debugger is not using the correct symbols                 ***
    ***                                                                   ***
    ***    In order for this command to work properly, your symbol path   ***
    ***    must point to .pdb files that have full type information.      ***
    ***                                                                   ***
    ***    Certain .pdb files (such as the public OS symbols) do not      ***
    ***    contain the required information.  Contact the group that      ***
    ***    provided you with these symbols if you need this command to    ***
    ***    work.                                                          ***
    ***                                                                   ***
    ***    Type referenced: nt!_KPRCB                                     ***
    ***                                                                   ***
    *************************************************************************
    *************************************************************************
    ***                                                                   ***
    ***                                                                   ***
    ***    Your debugger is not using the correct symbols                 ***
    ***                                                                   ***
    ***    In order for this command to work properly, your symbol path   ***
    ***    must point to .pdb files that have full type information.      ***
    ***                                                                   ***
    ***    Certain .pdb files (such as the public OS symbols) do not      ***
    ***    contain the required information.  Contact the group that      ***
    ***    provided you with these symbols if you need this command to    ***
    ***    work.                                                          ***
    ***                                                                   ***
    ***    Type referenced: nt!_KPRCB                                     ***
    ***                                                                   ***
    *************************************************************************
    *************************************************************************
    ***                                                                   ***
    ***                                                                   ***
    ***    Your debugger is not using the correct symbols                 ***
    ***                                                                   ***
    ***    In order for this command to work properly, your symbol path   ***
    ***    must point to .pdb files that have full type information.      ***
    ***                                                                   ***
    ***    Certain .pdb files (such as the public OS symbols) do not      ***
    ***    contain the required information.  Contact the group that      ***
    ***    provided you with these symbols if you need this command to    ***
    ***    work.                                                          ***
    ***                                                                   ***
    ***    Type referenced: nt!_KPRCB                                     ***
    ***                                                                   ***
    *************************************************************************
    *********************************************************************
    * Symbols can not be loaded because symbol path is not initialized. *
    *                                                                   *
    * The Symbol Path can be set by:                                    *
    *   using the _NT_SYMBOL_PATH environment variable.                 *
    *   using the -y <symbol_path> argument when starting the debugger. *
    *   using .sympath and .sympath+                                    *
    *********************************************************************
    *********************************************************************
    * Symbols can not be loaded because symbol path is not initialized. *
    *                                                                   *
    * The Symbol Path can be set by:                                    *
    *   using the _NT_SYMBOL_PATH environment variable.                 *
    *   using the -y <symbol_path> argument when starting the debugger. *
    *   using .sympath and .sympath+                                    *
    *********************************************************************

    ADDITIONAL_DEBUG_TEXT: 
    Use '!findthebuild' command to search for the target build information.
    If the build information is available, run '!findthebuild -s ; .reload' to set symbol path and load symbols.

    FAULTING_MODULE: 81e12000 nt

    DEBUG_FLR_IMAGE_TIMESTAMP:  4a4f1d40

    WRITE_ADDRESS: unable to get nt!MmSpecialPoolStart
    unable to get nt!MmSpecialPoolEnd
    unable to get nt!MmPoolCodeStart
    unable to get nt!MmPoolCodeEnd
     a5f8f000

    FAULTING_IP:
    SafeBoxKrnl+f63
    8e6a3f63 ??              ???

    MM_INTERNAL_CODE:  0

    CUSTOMER_CRASH_COUNT:  1

    DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

    BUGCHECK_STR:  0x50

    CURRENT_IRQL:  0

    LAST_CONTROL_TRANSFER:  from 81e5fdb4 to 81eaa36d

    STACK_TEXT: 
    WARNING: Stack unwind information not available. Following frames may be wrong.
    af8032f4 81e5fdb4 00000001 a5f8f000 00000000 nt+0x9836d
    af80330c 8e6a3f63 badb0d00 c00603c0 000006f7 nt+0x4ddb4
    af80338c 8e6a53e0 af80341c 8f58eda8 00000000 SafeBoxKrnl+0xf63
    af8033d0 8e6a7a6e 00000b18 af80341c 093ef14c SafeBoxKrnl+0x23e0
    af803448 8e6ac065 0000000a 00000b18 af8038d8 SafeBoxKrnl+0x4a6e
    af803d30 81e5cc7a 093ef14c 093ef12c 02000000 SafeBoxKrnl+0x9065
    af803d64 77bd5e74 badb0d00 093eed24 00000000 nt+0x4ac7a
    af803d68 badb0d00 093eed24 00000000 00000000 0x77bd5e74
    af803d6c 093eed24 00000000 00000000 00000000 0xbadb0d00
    af803d70 00000000 00000000 00000000 00000000 0x93eed24


    STACK_COMMAND:  kb

    FOLLOWUP_IP:
    SafeBoxKrnl+f63
    8e6a3f63 ??              ???

    SYMBOL_STACK_INDEX:  2

    SYMBOL_NAME:  SafeBoxKrnl+f63

    FOLLOWUP_NAME:  MachineOwner

    MODULE_NAME: SafeBoxKrnl

    IMAGE_NAME:  SafeBoxKrnl.sys

    BUCKET_ID:  WRONG_SYMBOLS

    Followup: MachineOwner
    ---------

    0: kd> lmvm SafeBoxKrnl
    start    end        module name
    8e6a3000 8e6d8480   SafeBoxKrnl T (no symbols)          
        Loaded symbol image file: SafeBoxKrnl.sys
        Image path: \??\C:\Windows\system32\drivers\SafeBoxKrnl.sys
        Image name: SafeBoxKrnl.sys
        Timestamp:        Sat Jul 04 17:13:36 2009 (4A4F1D40)
        CheckSum:         00045AEF
        ImageSize:        00035480
        Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4
    这个就是刚才蓝屏的分析报告。


    那个文章说的可能是内存、兼容等方面的问题，具体又没说解决方案。
    2009年8月17日 9:54
    |
  • Question
    登录进行投票
    0
    登录进行投票
    從診斷結果看, 此次藍屏與 360 保險箱有關. 此種情況不排除是某些軟件同 360 保險箱有衝突造成, 目前最簡單的方法就是暫時卸載 360 保險箱, 然後持續觀察.

    [求助]safeboxkrnl.sys与蓝屏
    http://baike.360.cn/3229787/4716872.html

    SafeBoxKrnl.sys导致XP蓝屏.自我保护无法启动
    http://baike.360.cn/3229787/19994927.html
    Folding@Home
    2009年8月17日 10:03
    |
  • Question
    登录进行投票
    0
    登录进行投票
    这次如果是360引起的，那以前怎么没有出现过？以后还会出现吗，怎么办？
    2009年8月17日 10:16
    |
  • Question
    登录进行投票
    0
    登录进行投票

    产生蓝屏的因素各种各样,但还是有方法可以尽量减少蓝屏机率,安装合适的驱动,一般通过WHQL认证相当更有保证些,

    另外不要安装测试版本的软件,不要在同一个系统安装两个或以上的杀软,改善散热条件等等.

    2009年8月17日 10:26
    |
  • Question
    登录进行投票
    0
    登录进行投票
    上面的问题是由360引起的不？
    2009年8月17日 10:38
    |
  • Question
    登录进行投票
    0
    登录进行投票
    从分析来看,应该就是360保险箱引起的,你可以尝试卸载360保险箱,另外,你的计算机安装了那些安全类软件呢?
    2009年8月17日 10:50
    |
  • Question
    登录进行投票
    0
    登录进行投票
    这次如果是360引起的，那以前怎么没有出现过？以后还会出现吗，怎么办？
    請問最近你安裝過哪些軟件? 在此次藍屏之前(你上廁所之前), 運行了哪些軟件, 進行了哪些操作?
    Folding@Home
    2009年8月17日 11:21
    |
  • Question
    登录进行投票
    0
    登录进行投票
    杀毒类的就诺顿、threatfire、360。当时刚浏览完塞班网、此论坛和魔秀手机主题网。但是当时是把窗口最小化了的，回来就蓝屏了。
    2009年8月17日 11:38
    |
  • Question
    登录进行投票
    0
    登录进行投票
    你先把threatfire、360卸载,然后开启系统自带的防火墙,看会否再发生蓝屏现象.
    2009年8月17日 11:40
    |
  • Question
    登录进行投票
    0
    登录进行投票
    請在安全模式下首先卸載 ThreatFire, 卸載完成後重新啟動計算機, 然後再次進入安全模式卸載 360 保險箱.
    Folding@Home
    2009年8月17日 11:50
    |
  • Question
    登录进行投票
    0
    登录进行投票
    在安全模式是可以完整卸載 ThreatFile, 這個我已在測試環境進行了測試. 至於 360 的話, 最好也在安全模式下進行卸載, 已最大限度的保證卸載的成功進行.
    Folding@Home
    2009年8月17日 11:52
    |