none
windows server 2012 r2蓝屏 RRS feed

  • 问题

  • Microsoft (R) Windows Debugger Version 6.12.0002.633 X86
    Copyright (c) Microsoft Corporation. All rights reserved.

    Loading Dump File [C:\Users\haibi\Desktop\Minidump\032718-16203-01.dmp]
    Mini Kernel Dump File: Only registers and stack trace are available
    Symbol search path is: SRV*F:\SymbolCache*http://msdl.microsoft.com/download/symbols
    Executable search path is:
    Windows 7 Kernel Version 14393 MP (32 procs) Free x64
    Product: Server, suite: TerminalServer DataCenter SingleUserTS
    Built by: 14393.2155.amd64fre.rs1_release_1.180305-1842
    Machine Name:
    Kernel base = 0xfffff803`ddc85000 PsLoadedModuleList = 0xfffff803`ddf8d1a0
    Debug session time: Tue Mar 27 13:47:54.412 2018 (UTC + 8:00)
    System Uptime: 0 days 0:32:52.977
    Loading Kernel Symbols
    ...............................................................
    ................................................................
    .................................................
    Loading User Symbols
    Loading unloaded module list
    ......
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************
    Use !analyze -v to get detailed debugging information.
    BugCheck C2, {7, 0, 0, ffffb80978e4f600}
    unable to get nt!MmSpecialPoolStart
    unable to get nt!MmSpecialPoolEnd
    unable to get nt!MmPoolCodeStart
    unable to get nt!MmPoolCodeEnd
    GetUlongFromAddress: unable to read from fffff803ddf82b00
    *** WARNING: Unable to verify timestamp for cdd.dll
    *** ERROR: Module load completed but symbols could not be loaded for cdd.dll
    *** WARNING: Unable to verify timestamp for RDPUDD.dll
    *** ERROR: Module load completed but symbols could not be loaded for RDPUDD.dll
    *** ERROR: Module load completed but symbols could not be loaded for partmgr.sys
    *** WARNING: Unable to verify timestamp for percsas3.sys
    *** ERROR: Module load completed but symbols could not be loaded for percsas3.sys
    *** WARNING: Unable to verify timestamp for elxfc.sys
    *** ERROR: Module load completed but symbols could not be loaded for elxfc.sys
    *** ERROR: Symbol file could not be found.  Defaulted to export symbols for clipsp.sys -
    *** WARNING: Unable to verify timestamp for WdFilter.sys
    *** ERROR: Module load completed but symbols could not be loaded for WdFilter.sys
    *** ERROR: Symbol file could not be found.  Defaulted to export symbols for CLASSPNP.SYS -
    *** WARNING: Unable to verify timestamp for condrv.sys
    *** ERROR: Module load completed but symbols could not be loaded for condrv.sys
    *** WARNING: Unable to verify timestamp for ResumeKeyFilter.sys
    *** ERROR: Module load completed but symbols could not be loaded for ResumeKeyFilter.sys
    *** WARNING: Unable to verify timestamp for mrxsmb10.sys
    *** ERROR: Module load completed but symbols could not be loaded for mrxsmb10.sys
    *** WARNING: Unable to verify timestamp for CsvNSFlt.sys
    *** ERROR: Module load completed but symbols could not be loaded for CsvNSFlt.sys
    *** WARNING: Unable to verify timestamp for CsvFlt.sys
    *** ERROR: Module load completed but symbols could not be loaded for CsvFlt.sys
    *** WARNING: Unable to verify timestamp for srvnet.sys
    *** ERROR: Module load completed but symbols could not be loaded for srvnet.sys
    *** WARNING: Unable to verify timestamp for netbt.sys
    *** ERROR: Module load completed but symbols could not be loaded for netbt.sys
    *** WARNING: Unable to verify timestamp for VMMDHCPSvr.sys
    *** ERROR: Module load completed but symbols could not be loaded for VMMDHCPSvr.sys
    *** ERROR: Symbol file could not be found.  Defaulted to export symbols for rdbss.sys -
    *** WARNING: Unable to verify timestamp for nsiproxy.sys
    *** ERROR: Module load completed but symbols could not be loaded for nsiproxy.sys
    *** WARNING: Unable to verify timestamp for npsvctrig.sys
    *** ERROR: Module load completed but symbols could not be loaded for npsvctrig.sys
    *** WARNING: Unable to verify timestamp for gpuenergydrv.sys
    *** ERROR: Module load completed but symbols could not be loaded for gpuenergydrv.sys
    *** WARNING: Unable to verify timestamp for dfsc.sys
    *** ERROR: Module load completed but symbols could not be loaded for dfsc.sys
    *** WARNING: Unable to verify timestamp for ahcache.sys
    *** ERROR: Module load completed but symbols could not be loaded for ahcache.sys
    *** WARNING: Unable to verify timestamp for vmbusr.sys
    *** ERROR: Module load completed but symbols could not be loaded for vmbusr.sys
    *** WARNING: Unable to verify timestamp for hvsocket.sys
    *** ERROR: Module load completed but symbols could not be loaded for hvsocket.sys
    *** WARNING: Unable to verify timestamp for vmbkmclr.sys
    *** ERROR: Module load completed but symbols could not be loaded for vmbkmclr.sys
    *** WARNING: Unable to verify timestamp for winhvr.sys
    *** ERROR: Module load completed but symbols could not be loaded for winhvr.sys
    *** WARNING: Unable to verify timestamp for vmswitch.sys
    *** ERROR: Module load completed but symbols could not be loaded for vmswitch.sys
    *** WARNING: Unable to verify timestamp for Wnv.sys
    *** ERROR: Module load completed but symbols could not be loaded for Wnv.sys
    *** WARNING: Unable to verify timestamp for Vid.sys
    *** ERROR: Module load completed but symbols could not be loaded for Vid.sys
    *** WARNING: Unable to verify timestamp for CompositeBus.sys
    *** ERROR: Module load completed but symbols could not be loaded for CompositeBus.sys
    *** WARNING: Unable to verify timestamp for kdnic.sys
    *** ERROR: Module load completed but symbols could not be loaded for kdnic.sys
    *** WARNING: Unable to verify timestamp for umbus.sys
    *** ERROR: Module load completed but symbols could not be loaded for umbus.sys
    *** WARNING: Unable to verify timestamp for acpipmi.sys
    *** ERROR: Module load completed but symbols could not be loaded for acpipmi.sys
    *** WARNING: Unable to verify timestamp for intelppm.sys
    *** ERROR: Module load completed but symbols could not be loaded for intelppm.sys
    *** WARNING: Unable to verify timestamp for errdev.sys
    *** ERROR: Module load completed but symbols could not be loaded for errdev.sys
    *** WARNING: Unable to verify timestamp for wmiacpi.sys
    *** ERROR: Module load completed but symbols could not be loaded for wmiacpi.sys
    *** WARNING: Unable to verify timestamp for e1r65x64.sys
    *** ERROR: Module load completed but symbols could not be loaded for e1r65x64.sys
    *** WARNING: Unable to verify timestamp for usbehci.sys
    *** ERROR: Module load completed but symbols could not be loaded for usbehci.sys
    *** WARNING: Unable to verify timestamp for serial.sys
    *** ERROR: Module load completed but symbols could not be loaded for serial.sys
    *** WARNING: Unable to verify timestamp for serenum.sys
    *** ERROR: Module load completed but symbols could not be loaded for serenum.sys
    *** WARNING: Unable to verify timestamp for IPMIDrv.sys
    *** ERROR: Module load completed but symbols could not be loaded for IPMIDrv.sys
    *** WARNING: Unable to verify timestamp for vpcivsp.sys
    *** ERROR: Module load completed but symbols could not be loaded for vpcivsp.sys
    *** WARNING: Unable to verify timestamp for csvvbus.sys
    *** ERROR: Module load completed but symbols could not be loaded for csvvbus.sys
    *** WARNING: Unable to verify timestamp for storvsp.sys
    *** ERROR: Module load completed but symbols could not be loaded for storvsp.sys
    *** WARNING: Unable to verify timestamp for NdisVirtualBus.sys
    *** ERROR: Module load completed but symbols could not be loaded for NdisVirtualBus.sys
    *** WARNING: Unable to verify timestamp for swenum.sys
    *** ERROR: Module load completed but symbols could not be loaded for swenum.sys
    *** WARNING: Unable to verify timestamp for ks.sys
    *** ERROR: Module load completed but symbols could not be loaded for ks.sys
    *** WARNING: Unable to verify timestamp for rdpbus.sys
    *** ERROR: Module load completed but symbols could not be loaded for rdpbus.sys
    *** WARNING: Unable to verify timestamp for netft.sys
    *** ERROR: Module load completed but symbols could not be loaded for netft.sys
    *** WARNING: Unable to verify timestamp for USBD.SYS
    *** ERROR: Module load completed but symbols could not be loaded for USBD.SYS
    *** WARNING: Unable to verify timestamp for udfs.sys
    *** ERROR: Module load completed but symbols could not be loaded for udfs.sys
    *** WARNING: Unable to verify timestamp for hidusb.sys
    *** ERROR: Module load completed but symbols could not be loaded for hidusb.sys
    *** WARNING: Unable to verify timestamp for HIDCLASS.SYS
    *** ERROR: Module load completed but symbols could not be loaded for HIDCLASS.SYS
    *** WARNING: Unable to verify timestamp for HIDPARSE.SYS
    *** ERROR: Module load completed but symbols could not be loaded for HIDPARSE.SYS
    *** WARNING: Unable to verify timestamp for kbdhid.sys
    *** ERROR: Module load completed but symbols could not be loaded for kbdhid.sys
    *** WARNING: Unable to verify timestamp for kbdclass.sys
    *** ERROR: Module load completed but symbols could not be loaded for kbdclass.sys
    *** WARNING: Unable to verify timestamp for mouhid.sys
    *** ERROR: Module load completed but symbols could not be loaded for mouhid.sys
    *** WARNING: Unable to verify timestamp for mouclass.sys
    *** ERROR: Module load completed but symbols could not be loaded for mouclass.sys
    *** ERROR: Module load completed but symbols could not be loaded for luafv.sys
    *** WARNING: Unable to verify timestamp for dump_diskdump.sys
    *** ERROR: Module load completed but symbols could not be loaded for dump_diskdump.sys
    *** WARNING: Unable to verify timestamp for dump_percsas3.sys
    *** ERROR: Module load completed but symbols could not be loaded for dump_percsas3.sys
    *** WARNING: Unable to verify timestamp for monitor.sys
    *** ERROR: Module load completed but symbols could not be loaded for monitor.sys
    *** WARNING: Unable to verify timestamp for dxgkrnl.sys
    *** ERROR: Module load completed but symbols could not be loaded for dxgkrnl.sys
    *** WARNING: Unable to verify timestamp for BasicRender.sys
    *** ERROR: Module load completed but symbols could not be loaded for BasicRender.sys
    *** WARNING: Unable to verify timestamp for Npfs.SYS
    *** ERROR: Module load completed but symbols could not be loaded for Npfs.SYS
    *** WARNING: Unable to verify timestamp for Msfs.SYS
    *** ERROR: Module load completed but symbols could not be loaded for Msfs.SYS
    *** WARNING: Unable to verify timestamp for tdx.sys
    *** ERROR: Module load completed but symbols could not be loaded for tdx.sys
    *** WARNING: Unable to verify timestamp for TDI.SYS
    *** ERROR: Module load completed but symbols could not be loaded for TDI.SYS
    *** WARNING: Unable to verify timestamp for CsvFs.sys
    *** ERROR: Module load completed but symbols could not be loaded for CsvFs.sys
    *** WARNING: Unable to verify timestamp for NdisImPlatform.sys
    *** ERROR: Module load completed but symbols could not be loaded for NdisImPlatform.sys
    *** WARNING: Unable to verify timestamp for peauth.sys
    *** ERROR: Module load completed but symbols could not be loaded for peauth.sys
    *** WARNING: Unable to verify timestamp for tunnel.sys
    *** ERROR: Module load completed but symbols could not be loaded for tunnel.sys
    *** WARNING: Unable to verify timestamp for passthruparser.sys
    *** ERROR: Module load completed but symbols could not be loaded for passthruparser.sys
    *** WARNING: Unable to verify timestamp for vhdparser.sys
    *** ERROR: Module load completed but symbols could not be loaded for vhdparser.sys
    *** WARNING: Unable to verify timestamp for FsDepends.sys
    *** ERROR: Module load completed but symbols could not be loaded for FsDepends.sys
    *** WARNING: Unable to verify timestamp for vhdmp.sys
    *** ERROR: Module load completed but symbols could not be loaded for vhdmp.sys
    *** WARNING: Unable to verify timestamp for terminpt.sys
    *** ERROR: Module load completed but symbols could not be loaded for terminpt.sys
    *** WARNING: Unable to verify timestamp for MpKslf5329e52.sys
    *** ERROR: Module load completed but symbols could not be loaded for MpKslf5329e52.sys
    *** WARNING: Unable to verify timestamp for srv2.sys
    *** ERROR: Module load completed but symbols could not be loaded for srv2.sys
    GetUlongFromAddress: unable to read from fffff803ddf82b00
    Unable to open image file: C:\Program Files (x86)\Debugging Tools for Windows (x86)\sym\CsvNSFlt.sys\578999D617000\CsvNSFlt.sys
    ϵͳÕÒ²»µ½Ö¸¶¨µÄÎļþ¡£
    Unable to open image file: C:\Program Files (x86)\Debugging Tools for Windows (x86)\sym\vmbkmclr.sys\5A49BDB31a000\vmbkmclr.sys
    ϵͳÕÒ²»µ½Ö¸¶¨µÄÎļþ¡£
    Probably caused by : ntkrnlmp.exe ( nt!ExFreePoolWithTag+196d )
    Followup: MachineOwner
    ---------
    13: kd>
    13: kd> !analyze -v
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************
    BAD_POOL_CALLER (c2)
    The current thread is making a bad pool request.  Typically this is at a bad IRQL level or double freeing the same allocation, etc.
    Arguments:
    Arg1: 0000000000000007, Attempt to free pool which was already freed
    Arg2: 0000000000000000, (reserved)
    Arg3: 0000000000000000, Memory contents of the pool block
    Arg4: ffffb80978e4f600, Address of the block of pool being deallocated
    Debugging Details:
    ------------------
    GetUlongFromAddress: unable to read from fffff803ddf82b00
    GetUlongFromAddress: unable to read from fffff803ddf82b00
    Unable to open image file: C:\Program Files (x86)\Debugging Tools for Windows (x86)\sym\CsvNSFlt.sys\578999D617000\CsvNSFlt.sys
    ϵͳÕÒ²»µ½Ö¸¶¨µÄÎļþ¡£
    Unable to open image file: C:\Program Files (x86)\Debugging Tools for Windows (x86)\sym\vmbkmclr.sys\5A49BDB31a000\vmbkmclr.sys
    ϵͳÕÒ²»µ½Ö¸¶¨µÄÎļþ¡£

    OVERLAPPED_MODULE: Address regions for 'mrxsmb20' and 'dump_storpor' overlap
    POOL_ADDRESS:  ffffb80978e4f600
    BUGCHECK_STR:  0xc2_7
    CUSTOMER_CRASH_COUNT:  1
    DEFAULT_BUCKET_ID:  DRIVER_FAULT_SERVER_MINIDUMP
    PROCESS_NAME:  svchost.exe
    CURRENT_IRQL:  0
    LAST_CONTROL_TRANSFER:  from fffff803ddedacfd to fffff803ddde06c0
    STACK_TEXT: 
    ffffca81`eda63218 fffff803`ddedacfd : 00000000`000000c2 00000000`00000007 00000000`00000000 00000000`00000000 : nt!KeBugCheckEx
    ffffca81`eda63220 fffff803`de153d19 : ffffb809`78e4f600 ffffb809`7896e060 00000000`0000001c 00000000`00000000 : nt!ExFreePoolWithTag+0x196d
    ffffca81`eda63300 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!RtlpNewSecurityObject+0x19a9

    STACK_COMMAND:  kb
    FOLLOWUP_IP:
    nt!ExFreePoolWithTag+196d
    fffff803`ddedacfd cc              int     3
    SYMBOL_STACK_INDEX:  1
    SYMBOL_NAME:  nt!ExFreePoolWithTag+196d
    FOLLOWUP_NAME:  MachineOwner
    MODULE_NAME: nt
    IMAGE_NAME:  ntkrnlmp.exe
    DEBUG_FLR_IMAGE_TIMESTAMP:  5a9e2286
    FAILURE_BUCKET_ID:  X64_0xc2_7_nt!ExFreePoolWithTag+196d
    BUCKET_ID:  X64_0xc2_7_nt!ExFreePoolWithTag+196d
    Followup: MachineOwner
    2018年3月28日 14:32

全部回复

  • 你好,

    从你上传的windbg 截图来看,并不能分析出什么,看样子是symbol没有正确load,windbg 镜像不能正确打开等等。

    我建议你把蓝屏文档上传网盘,并分享到这儿,这样我们可以从网盘中下载dump文件。

    另外,为了更好的解决这个问题,请问蓝屏是最近出现的吗?如果是,最近对电脑有没有做什么更改呢,比如更新了系统、驱动,更换了硬件等。

    请问出现蓝屏时你正在运行什么app吗?比如游戏,看视频等。同时如果你正在使用一些三方的杀毒软件,如360,金山毒霸等等,请暂时卸载,以帮助我们缩小问题的范围。



    Please remember to mark the replies as answers if they help.
    If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.

    2018年3月29日 1:53
  • 0x000000C2 错误表示内核程序或硬件设备驱动程序试图进行错误的内存操作。这个错误一般是因为应用软件或硬件设备驱动程序存在 BUG 引起的。


    Alexis Zhang

    http://mvp.microsoft.com/zh-cn/mvp/Jie%20Zhang-4000545
    http://blogs.itecn.net/blogs/alexis

    推荐以 NNTP Bridge 桥接新闻组方式访问论坛。

    本帖是回复帖,原帖作者是楼上的 <howard.liu>;

    | Use !analyze -v to get detailed debugging information.
    | BugCheck C2, {7, 0, 0, ffffb80978e4f600}

    2018年3月29日 13:59
  • 您好:以下是dump文件下载地址 

    链接: https://pan.baidu.com/s/183z0NqQP3SGbZ6d1cVlVyg 密码: 24fg

    2018年4月1日 13:24
  • 你好,

    根据dump文件,看出来是kernel下的驱动设备存在异常,为了进一步解决这个问题,我们需要蓝屏发生时的症状。

    我有以下问题需要您的回答:

    1.请问最近有没有装什么驱动更新,或者在蓝屏发生前连接了某些设备等。

    2.蓝屏发生时你正在运行什么?比如正在启动某个程序,调用某个设备等等。

    3.鉴于有可能是驱动程序异常导致的蓝屏,请运行Verify Driver,是否能检测出异常的驱动:

    https://docs.microsoft.com/en-us/windows-hardware/drivers/devtest/driver-verifier

    4. 同时你也可以运行Memory diagnostic tool来检测RAM问题。


    Please remember to mark the replies as answers if they help.
    If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.

    2018年4月2日 8:46
  • 1. 没有更新任何驱动

    2.部署了hyper-v与故障转移群集

    2018年4月3日 3:25
  • 如果是这样的话,建议联系server论坛:https://social.technet.microsoft.com/Forums/windowsserver/en-US/home?category=windowsserver 那里的工程师对server更加了解,能为您提出更多可供参考的建议。

    感谢您的理解与配合。


    Please remember to mark the replies as answers if they help.
    If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.

    2018年4月3日 8:52