none
AMD配置机器运行XP系统不定时蓝屏,运行windows7无蓝屏故障. RRS feed

  • 问题

  • CPU:Athlon II x3 450 3.2G AM3

    主板:FOXCONN M61PMP-K V1.0

    内存:Kingston ACR256X64D3U1333C9 2G DDR3 1333

    系统:windows xp sp3

    蓝屏代码固定在0A,50,7E,8E,24这几个代码.蓝屏时间不固定,从开机几分钟就蓝屏到运行若干小时后蓝屏.

    这种配置运行windows7证明无蓝屏故障.相当稳定.

    2013年5月14日 9:11

全部回复

  • 很可能是硬件设备驱动程序的差异引起的问题。Windows XP、Windows 7 使用的驱动应该是不同的。
     
    如果要了解具体原因,最好提供一些 Crash Dump 内存转储文件供分析。
     
    --
    Alexis Zhang
     
    http://mvp.support.microsoft.com/profile/jie
    http://blogs.itecn.net/blogs/alexis
     
    推荐以 NNTP Bridge 桥接新闻组方式访问论坛以获取最佳用户体验。
     
    本帖是回复帖,原帖作者是楼上的 "kfwqm2000"
     
    蓝屏代码固定在0A,50,7E,8E,24这几个代码.蓝屏时间不固定,从开机几分钟就蓝屏到运行若干小时后蓝屏.
    这种配置运行windows7证明无蓝屏故障.相当稳定.
     
     
    2013年5月14日 23:45
    版主
  • 请问这个问题有何进展吗?如果需要了解详细的故障原因,最好提供一下几次蓝屏时生成的 Dump 文件。
     
    --
    Alexis Zhang
     
    http://mvp.support.microsoft.com/profile/jie
    http://blogs.itecn.net/blogs/alexis
     
    推荐以 NNTP Bridge 桥接新闻组方式访问论坛以获取最佳用户体验。
     
    本帖是回复帖,原帖作者是楼上的 "Alexis Zhang"
     
    很可能是硬件设备驱动程序的差异引起的问题。Windows XP、Windows 7 使用的驱动应该是不同的。
    如果要了解具体原因,最好?峁┮恍?Crash Dump 内存转储文件供分析。
     
     
    2013年5月19日 1:25
    版主
  • 手头目前没有最新的DUMP文件,但有一些老的文件,从这些文件看象是搜狗拼音的后台管理程序引起的。但卸载掉搜狗拼音后仍然没有排除蓝屏的故障。之后重新安装过系统,更换过各种硬件的驱动,更换过CPU,内存,主板,显卡,也没有排除蓝屏的故障,代码依旧是标题中所示的那几个蓝屏代码。因机器有软保护,没能得到新的DUMP文件,先上几个早期的DUMP文件分析一下。

    Microsoft (R) Windows Debugger Version 6.12.0002.633 X86
    Copyright (c) Microsoft Corporation. All rights reserved.


    Loading Dump File [D:\公司文档\蓝屏代码\Minidump011-0a\Minidump\Mini120412-01.dmp]
    Mini Kernel Dump File: Only registers and stack trace are available

    Symbol search path is: SRV*C:\Symbols*http://msdl.microsoft.com/download/symbols
    Executable search path is:
    Windows XP Kernel Version 2600 (Service Pack 3) MP (3 procs) Free x86 compatible
    Product: WinNt, suite: TerminalServer SingleUserTS
    Built by: 2600.xpsp_sp3_qfe.120411-1615
    Machine Name:
    Kernel base = 0x804d8000 PsLoadedModuleList = 0x8055e720
    Debug session time: Tue Dec  4 15:03:16.156 2012 (UTC + 8:00)
    System Uptime: 0 days 0:41:38.984
    Loading Kernel Symbols
    ...............................................................
    ....................................................
    Loading User Symbols
    Loading unloaded module list
    ..................
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************

    Use !analyze -v to get detailed debugging information.

    BugCheck 1000000A, {100014, 2, 0, 8050d592}

    Probably caused by : memory_corruption ( nt!MiFindImageSectionObject+26 )

    Followup: MachineOwner
    ---------

    1: kd> !analyze -v
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************

    IRQL_NOT_LESS_OR_EQUAL (a)
    An attempt was made to access a pageable (or completely invalid) address at an
    interrupt request level (IRQL) that is too high.  This is usually
    caused by drivers using improper addresses.
    If a kernel debugger is available get the stack backtrace.
    Arguments:
    Arg1: 00100014, memory referenced
    Arg2: 00000002, IRQL
    Arg3: 00000000, bitfield :
     bit 0 : value 0 = read operation, 1 = write operation
     bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
    Arg4: 8050d592, address which referenced memory

    Debugging Details:
    ------------------


    READ_ADDRESS:  00100014

    CURRENT_IRQL:  2

    FAULTING_IP:
    nt!MiFindImageSectionObject+26
    8050d592 8b4014          mov     eax,dword ptr [eax+14h]

    CUSTOMER_CRASH_COUNT:  1

    DEFAULT_BUCKET_ID:  DRIVER_FAULT

    BUGCHECK_STR:  0xA

    PROCESS_NAME:  PinyinUp.exe

    LAST_CONTROL_TRANSFER:  from 8050db5d to 8050d592

    STACK_TEXT: 
    abb56664 8050db5d 00100000 00000001 abb566cc nt!MiFindImageSectionObject+0x26
    abb56704 00000000 00000010 0000f190 00000078 nt!MmCreateSection+0x2a9


    STACK_COMMAND:  kb

    FOLLOWUP_IP:
    nt!MiFindImageSectionObject+26
    8050d592 8b4014          mov     eax,dword ptr [eax+14h]

    SYMBOL_STACK_INDEX:  0

    SYMBOL_NAME:  nt!MiFindImageSectionObject+26

    FOLLOWUP_NAME:  MachineOwner

    MODULE_NAME: nt

    DEBUG_FLR_IMAGE_TIMESTAMP:  4f857c1e

    IMAGE_NAME:  memory_corruption

    FAILURE_BUCKET_ID:  0xA_nt!MiFindImageSectionObject+26

    BUCKET_ID:  0xA_nt!MiFindImageSectionObject+26

    Followup: MachineOwner
    ---------


    • 已编辑 kfwqm2000 2013年8月29日 4:26 修改内容
    2013年8月29日 4:21
  • Loading Dump File [D:\公司文档\蓝屏代码\Mini120512-01-54-7f\Mini120512-01.dmp]
    Mini Kernel Dump File: Only registers and stack trace are available

    Symbol search path is: SRV*C:\Symbols*http://msdl.microsoft.com/download/symbols
    Executable search path is:
    Windows XP Kernel Version 2600 (Service Pack 3) MP (3 procs) Free x86 compatible
    Product: WinNt, suite: TerminalServer SingleUserTS
    Built by: 2600.xpsp_sp3_qfe.120411-1615
    Machine Name:
    Kernel base = 0x804d8000 PsLoadedModuleList = 0x8055e720
    Debug session time: Wed Dec  5 12:56:01.234 2012 (UTC + 8:00)
    System Uptime: 0 days 0:01:40.078
    Loading Kernel Symbols
    ...............................................................
    ....................................................
    Loading User Symbols
    Loading unloaded module list
    .................
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************

    Use !analyze -v to get detailed debugging information.

    BugCheck 1000007F, {8, 80042000, 0, 0}

    Probably caused by : ntkrpamp.exe ( nt!_SEH_prolog+1a )

    Followup: MachineOwner
    ---------

    0: kd> !analyze -v
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************

    UNEXPECTED_KERNEL_MODE_TRAP_M (1000007f)
    This means a trap occurred in kernel mode, and it's a trap of a kind
    that the kernel isn't allowed to have/catch (bound trap) or that
    is always instant death (double fault).  The first number in the
    bugcheck params is the number of the trap (8 = double fault, etc)
    Consult an Intel x86 family manual to learn more about what these
    traps are. Here is a *portion* of those codes:
    If kv shows a taskGate
            use .tss on the part before the colon, then kv.
    Else if kv shows a trapframe
            use .trap on that value
    Else
            .trap on the appropriate frame will show where the trap was taken
            (on x86, this will be the ebp that goes with the procedure KiTrap)
    Endif
    kb will then show the corrected stack.
    Arguments:
    Arg1: 00000008, EXCEPTION_DOUBLE_FAULT
    Arg2: 80042000
    Arg3: 00000000
    Arg4: 00000000

    Debugging Details:
    ------------------


    BUGCHECK_STR:  0x7f_8

    CUSTOMER_CRASH_COUNT:  1

    DEFAULT_BUCKET_ID:  DRIVER_FAULT

    PROCESS_NAME:  wmiprvse.exe

    EXCEPTION_RECORD:  b1947a7c -- (.exr 0xffffffffb1947a7c)
    ExceptionAddress: 80531f9e (nt!RtlIsValidHandler+0x0000003c)
       ExceptionCode: c0000005 (Access violation)
      ExceptionFlags: 00000000
    NumberParameters: 2
       Parameter[0]: 00000000
       Parameter[1]: 00000780
    Attempt to read from address 00000780

    TRAP_FRAME:  b19475a4 -- (.trap 0xffffffffb19475a4)
    ErrCode = 00000000
    eax=00000280 ebx=b1948764 ecx=00000140 edx=00000000 esi=00000280 edi=4e92c280
    eip=80531f9e esp=b1947618 ebp=b1947628 iopl=0         nv up ei pl nz ac po nc
    cs=0008  ss=0010  ds=0023  es=0023  fs=0030  gs=0000             efl=00010212
    nt!RtlIsValidHandler+0x3c:
    80531f9e 8b1c88          mov     ebx,dword ptr [eax+ecx*4] ds:0023:00000780=????????
    Resetting default scope

    LAST_CONTROL_TRANSFER:  from 805430f5 to 8053cc0a

    STACK_TEXT: 
    b1946084 805430f5 b19460a0 00000000 b19460f4 nt!_SEH_prolog+0x1a
    b19460ec 805430a6 b1946178 80531f9e badb0d00 nt!CommonDispatchException+0x4d
    b1946178 80532023 00000280 00000000 b19465cc nt!Kei386EoiHelper+0x18a
    b19461f4 804ff5d0 b19465cc b19462c8 00000780 nt!RtlDispatchException+0x59
    b19465b0 805430f5 b19465cc 00000000 b1946620 nt!KiDispatchException+0x13e
    b1946618 805430a6 b19466a4 80531f9e badb0d00 nt!CommonDispatchException+0x4d
    b19466a4 80532023 00000280 00000000 b1946af8 nt!Kei386EoiHelper+0x18a
    b1946720 804ff5d0 b1946af8 b19467f4 00000780 nt!RtlDispatchException+0x59
    b1946adc 805430f5 b1946af8 00000000 b1946b4c nt!KiDispatchException+0x13e
    b1946b44 805430a6 b1946bd0 80531f9e badb0d00 nt!CommonDispatchException+0x4d
    b1946bd0 80532023 00000280 00000000 b1947024 nt!Kei386EoiHelper+0x18a
    b1946c4c 804ff5d0 b1947024 b1946d20 00000780 nt!RtlDispatchException+0x59
    b1947008 805430f5 b1947024 00000000 b1947078 nt!KiDispatchException+0x13e
    b1947070 805430a6 b19470fc 80531f9e badb0d00 nt!CommonDispatchException+0x4d
    b19470fc 80532023 00000280 00000000 b1947550 nt!Kei386EoiHelper+0x18a
    b1947178 804ff5d0 b1947550 b194724c 00000780 nt!RtlDispatchException+0x59
    b1947534 805430f5 b1947550 00000000 b19475a4 nt!KiDispatchException+0x13e
    b194759c 805430a6 b1947628 80531f9e badb0d00 nt!CommonDispatchException+0x4d
    b1947628 80532023 00000280 00000000 b1947a7c nt!Kei386EoiHelper+0x18a
    b19476a4 804ff5d0 b1947a7c b1947778 00000780 nt!RtlDispatchException+0x59
    b1947a60 805430f5 b1947a7c 00000000 b1947ad0 nt!KiDispatchException+0x13e
    b1947ac8 805430a6 b1947b54 80531f9e badb0d00 nt!CommonDispatchException+0x4d
    b1947b54 80532023 00000280 00000000 b1947fa8 nt!Kei386EoiHelper+0x18a
    b1947bd0 804ff5d0 b1947fa8 b1947ca4 00000780 nt!RtlDispatchException+0x59
    b1947f8c 805430f5 b1947fa8 00000000 b1947ffc nt!KiDispatchException+0x13e
    b1947ff4 805430a6 b1948080 80531f9e badb0d00 nt!CommonDispatchException+0x4d
    b1948080 80532023 00000280 00000000 b19484d4 nt!Kei386EoiHelper+0x18a
    b19480fc 804ff5d0 b19484d4 b19481d0 0000102e nt!RtlDispatchException+0x59
    b19484b8 805430f5 b19484d4 00000000 b1948528 nt!KiDispatchException+0x13e
    b1948520 805430a6 b19486dc 8056d1b8 badb0d00 nt!CommonDispatchException+0x4d
    b1948528 8056d1b8 badb0d00 00000001 00000000 nt!Kei386EoiHelper+0x18a
    b19486dc 00000000 00000000 00058000 00000400 nt!FsRtlAcquireFileExclusiveCommon+0x1c6


    STACK_COMMAND:  kb

    MODULE_NAME: nt

    IMAGE_NAME:  ntkrpamp.exe

    FOLLOWUP_NAME:  MachineOwner

    DEBUG_FLR_IMAGE_TIMESTAMP:  4f857c1e

    FOLLOWUP_IP:
    nt!_SEH_prolog+1a
    8053cc0a 53              push    ebx

    SYMBOL_STACK_INDEX:  0

    SYMBOL_NAME:  nt!_SEH_prolog+1a

    FAILURE_BUCKET_ID:  TRAP_FRAME_RECURSION

    BUCKET_ID:  TRAP_FRAME_RECURSION

    Followup: MachineOwner
    ---------

    2013年8月29日 4:22
  • Loading Dump File [D:\公司文档\蓝屏代码\Mini120512-04-8E\Mini120512-01.dmp]
    Mini Kernel Dump File: Only registers and stack trace are available

    Symbol search path is: SRV*C:\Symbols*http://msdl.microsoft.com/download/symbols
    Executable search path is:
    Windows XP Kernel Version 2600 (Service Pack 3) MP (3 procs) Free x86 compatible
    Product: WinNt, suite: TerminalServer SingleUserTS
    Built by: 2600.xpsp_sp3_qfe.120411-1615
    Machine Name:
    Kernel base = 0x804d8000 PsLoadedModuleList = 0x8055e720
    Debug session time: Wed Dec  5 15:04:29.390 2012 (UTC + 8:00)
    System Uptime: 0 days 0:38:26.218
    Loading Kernel Symbols
    ...............................................................
    ....................................................
    Loading User Symbols
    Loading unloaded module list
    .................
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************

    Use !analyze -v to get detailed debugging information.

    BugCheck 1000008E, {c0000005, 805471d8, ad1636c0, 0}

    Probably caused by : ntkrpamp.exe ( nt!RtlpInterlockedPushEntrySList+c )

    Followup: MachineOwner
    ---------

    2: kd> !analyze -v
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************

    KERNEL_MODE_EXCEPTION_NOT_HANDLED_M (1000008e)
    This is a very common bugcheck.  Usually the exception address pinpoints
    the driver/function that caused the problem.  Always note this address
    as well as the link date of the driver/image that contains this address.
    Some common problems are exception code 0x80000003.  This means a hard
    coded breakpoint or assertion was hit, but this system was booted
    /NODEBUG.  This is not supposed to happen as developers should never have
    hardcoded breakpoints in retail code, but ...
    If this happens, make sure a debugger gets connected, and the
    system is booted /DEBUG.  This will let us see why this breakpoint is
    happening.
    Arguments:
    Arg1: c0000005, The exception code that was not handled
    Arg2: 805471d8, The address that the exception occurred at
    Arg3: ad1636c0, Trap Frame
    Arg4: 00000000

    Debugging Details:
    ------------------


    EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - "0x%08lx"

    FAULTING_IP:
    nt!RtlpInterlockedPushEntrySList+c
    805471d8 8903            mov     dword ptr [ebx],eax

    TRAP_FRAME:  ad1636c0 -- (.trap 0xffffffffad1636c0)
    ErrCode = 00000002
    eax=00000000 ebx=00000000 ecx=b7e19020 edx=c2a90000 esi=89821c00 edi=8054c2e0
    eip=805471d8 esp=ad163734 ebp=b7e19020 iopl=0         nv up ei ng nz ac pe cy
    cs=0008  ss=0010  ds=0023  es=0023  fs=0030  gs=0000             efl=00010297
    nt!RtlpInterlockedPushEntrySList+0xc:
    805471d8 8903            mov     dword ptr [ebx],eax  ds:0023:00000000=????????
    Resetting default scope

    CUSTOMER_CRASH_COUNT:  1

    DEFAULT_BUCKET_ID:  DRIVER_FAULT

    BUGCHECK_STR:  0x8E

    PROCESS_NAME:  ImeUtil.exe

    LAST_CONTROL_TRANSFER:  from b7dfb474 to 805471d8

    STACK_TEXT: 
    ad163738 b7dfb474 000012c0 0000001c 00000000 nt!RtlpInterlockedPushEntrySList+0xc
    ad163740 00000000 00000000 00000000 00000000 Ntfs!ExFreeToPagedLookasideList+0x29


    STACK_COMMAND:  kb

    FOLLOWUP_IP:
    nt!RtlpInterlockedPushEntrySList+c
    805471d8 8903            mov     dword ptr [ebx],eax

    SYMBOL_STACK_INDEX:  0

    SYMBOL_NAME:  nt!RtlpInterlockedPushEntrySList+c

    FOLLOWUP_NAME:  MachineOwner

    MODULE_NAME: nt

    IMAGE_NAME:  ntkrpamp.exe

    DEBUG_FLR_IMAGE_TIMESTAMP:  4f857c1e

    FAILURE_BUCKET_ID:  0x8E_nt!RtlpInterlockedPushEntrySList+c

    BUCKET_ID:  0x8E_nt!RtlpInterlockedPushEntrySList+c

    Followup: MachineOwner
    ---------

    2013年8月29日 4:24
  • 这几个 Crash Dump 分析的确与输入法程序有关。
    如果说卸载搜狗拼音后依然有问题,包括重新安装系统也没有解决问题,有没有刚安装好的系统、没有安装什么第三方软件时就蓝屏的分析结果?

    --
    Alexis Zhang

    http://mvp.support.microsoft.com/profile/jie
    http://blogs.itecn.net/blogs/alexis

    本帖是回复帖,原帖作者是楼上的 "kfwqm2000"
    手头目前没有最新的DUMP文件,但有一些老的文件,从这些文件看象是搜狗拼音的后台管理程序引起的。但卸载掉搜狗拼音后仍然没有排除蓝屏的故障。
    2013年9月1日 10:19
    版主
  • 以下这两个DUMP文件是8月31日用OEM版一步一步安装的操作系统分区安装系统,装好后没有运行任何软件、驱动,也没安装其它软件,裸系统运行驱动精灵2013随即蓝屏。另外在用原版系统DOS下分区时也有蓝屏的故障,但没提取到DUMP文件,只有图片。现发上来帮忙分析一下。谢谢。

    1

    Loading Dump File [D:\公司文档\蓝屏代码\2013.8.31\39Mini083013-02.dmp]
    Mini Kernel Dump File: Only registers and stack trace are available

    Symbol search path is: SRV*C:\Symbols*http://msdl.microsoft.com/download/symbols
    Executable search path is:
    Windows XP Kernel Version 2600 (Service Pack 2) MP (3 procs) Free x86 compatible
    Product: WinNt, suite: TerminalServer SingleUserTS Personal
    Built by: 2600.xpsp_sp2_rtm.040803-2158
    Machine Name:
    Kernel base = 0x804d8000 PsLoadedModuleList = 0x8055d700
    Debug session time: Fri Aug 30 11:45:54.390 2013 (UTC + 8:00)
    System Uptime: 0 days 0:00:15.968
    Loading Kernel Symbols
    ...............................................................
    ...........................
    Loading User Symbols
    Loading unloaded module list
    .......
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************

    Use !analyze -v to get detailed debugging information.

    BugCheck C000021A, {e19184f0, c0000005, 7c9306c3, 71ed04}

    unable to get nt!KiCurrentEtwBufferOffset
    unable to get nt!KiCurrentEtwBufferBase
    Probably caused by : ntkrpamp.exe ( nt!KiFastCallEntry+fc )

    Followup: MachineOwner
    ---------

    0: kd> !analyze -v
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************

    WINLOGON_FATAL_ERROR (c000021a)
    The Winlogon process terminated unexpectedly.
    Arguments:
    Arg1: e19184f0, String that identifies the problem.
    Arg2: c0000005, Error Code.
    Arg3: 7c9306c3
    Arg4: 0071ed04

    Debugging Details:
    ------------------

    unable to get nt!KiCurrentEtwBufferOffset
    unable to get nt!KiCurrentEtwBufferBase

    ERROR_CODE: (NTSTATUS) 0xc000021a - {

    EXCEPTION_CODE: (NTSTATUS) 0xc000021a - {

    EXCEPTION_PARAMETER1:  e19184f0

    EXCEPTION_PARAMETER2:  c0000005

    EXCEPTION_PARAMETER3:  7c9306c3

    EXCEPTION_PARAMETER4: 71ed04

    ADDITIONAL_DEBUG_TEXT:  Windows SubSystem

    BUGCHECK_STR:  0xc000021a_csrss.exe_c0000005

    CUSTOMER_CRASH_COUNT:  2

    DEFAULT_BUCKET_ID:  DRIVER_FAULT

    PROCESS_NAME:  csrss.exe

    LAST_CONTROL_TRANSFER:  from 805c6a5a to 804fac37

    STACK_TEXT: 
    baab7934 805c6a5a 0000004c c000021a baab79b0 nt!KeBugCheckEx+0x1b
    baab7970 80656377 00000001 0000004c c000021a nt!PoShutdownBugCheck+0x5c
    baab7b28 8061384a c000021a 00000004 00000001 nt!ExpSystemErrorHandler+0x511
    baab7cd4 80613dcb c000021a 00000004 00000001 nt!ExpRaiseHardError+0x9a
    baab7d44 8054160c c000021a 00000004 00000001 nt!NtRaiseHardError+0x16b
    baab7d44 7c92eb94 c000021a 00000004 00000001 nt!KiFastCallEntry+0xfc
    WARNING: Frame IP not in any known module. Following frames may be wrong.
    0071eb74 7c92e273 75aa32b7 c000021a 00000004 0x7c92eb94
    0071ebcc 75aa4aea 0071ebf4 75aa68b1 0071ebfc 0x7c92e273
    0071ebd0 0071ebf4 75aa68b1 0071ebfc 00000001 0x75aa4aea
    0071ebd4 75aa68b1 0071ebfc 00000001 0071ebfc 0x71ebf4
    0071ebf4 0071ed04 0071ec20 7c9237bf 0071ece8 0x75aa68b1
    0071ece8 00000000 00000000 7c9306c3 00000002 0x71ed04


    STACK_COMMAND:  kb

    FOLLOWUP_IP:
    nt!KiFastCallEntry+fc
    8054160c 8be5            mov     esp,ebp

    SYMBOL_STACK_INDEX:  5

    SYMBOL_NAME:  nt!KiFastCallEntry+fc

    FOLLOWUP_NAME:  MachineOwner

    MODULE_NAME: nt

    IMAGE_NAME:  ntkrpamp.exe

    DEBUG_FLR_IMAGE_TIMESTAMP:  41107b0d

    FAILURE_BUCKET_ID:  0xc000021a_csrss.exe_c0000005_nt!KiFastCallEntry+fc

    BUCKET_ID:  0xc000021a_csrss.exe_c0000005_nt!KiFastCallEntry+fc

    Followup: MachineOwner
    ---------

     

    2013年9月2日 8:25
  • 2

    Loading Dump File [D:\公司文档\蓝屏代码\2013.8.31\39Mini083013-01.dmp]
    Mini Kernel Dump File: Only registers and stack trace are available

    Symbol search path is: SRV*C:\Symbols*http://msdl.microsoft.com/download/symbols
    Executable search path is:
    Windows XP Kernel Version 2600 (Service Pack 2) MP (3 procs) Free x86 compatible
    Product: WinNt, suite: TerminalServer SingleUserTS Personal
    Built by: 2600.xpsp_sp2_rtm.040803-2158
    Machine Name:
    Kernel base = 0x804d8000 PsLoadedModuleList = 0x8055d700
    Debug session time: Fri Aug 30 11:45:05.593 2013 (UTC + 8:00)
    System Uptime: 0 days 0:01:06.437
    Loading Kernel Symbols
    ...............................................................
    ............................
    Loading User Symbols
    Loading unloaded module list
    .......
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************

    Use !analyze -v to get detailed debugging information.

    BugCheck C000021A, {e15b0b20, c0000005, 7c9306c3, 155f36c}

    unable to get nt!KiCurrentEtwBufferOffset
    unable to get nt!KiCurrentEtwBufferBase
    Probably caused by : ntkrpamp.exe ( nt!KiFastCallEntry+fc )

    Followup: MachineOwner
    ---------

    0: kd> !analyze -v
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************

    WINLOGON_FATAL_ERROR (c000021a)
    The Winlogon process terminated unexpectedly.
    Arguments:
    Arg1: e15b0b20, String that identifies the problem.
    Arg2: c0000005, Error Code.
    Arg3: 7c9306c3
    Arg4: 0155f36c

    Debugging Details:
    ------------------

    unable to get nt!KiCurrentEtwBufferOffset
    unable to get nt!KiCurrentEtwBufferBase

    ERROR_CODE: (NTSTATUS) 0xc000021a - {

    EXCEPTION_CODE: (NTSTATUS) 0xc000021a - {

    EXCEPTION_PARAMETER1:  e15b0b20

    EXCEPTION_PARAMETER2:  c0000005

    EXCEPTION_PARAMETER3:  7c9306c3

    EXCEPTION_PARAMETER4: 155f36c

    ADDITIONAL_DEBUG_TEXT:  Windows SubSystem

    BUGCHECK_STR:  0xc000021a_csrss.exe_c0000005

    CUSTOMER_CRASH_COUNT:  1

    DEFAULT_BUCKET_ID:  DRIVER_FAULT

    PROCESS_NAME:  csrss.exe

    LAST_CONTROL_TRANSFER:  from 805c6a5a to 804fac37

    STACK_TEXT: 
    ba9f7934 805c6a5a 0000004c c000021a ba9f79b0 nt!KeBugCheckEx+0x1b
    ba9f7970 80656377 00000001 0000004c c000021a nt!PoShutdownBugCheck+0x5c
    ba9f7b28 8061384a c000021a 00000004 00000001 nt!ExpSystemErrorHandler+0x511
    ba9f7cd4 80613dcb c000021a 00000004 00000001 nt!ExpRaiseHardError+0x9a
    ba9f7d44 8054160c c000021a 00000004 00000001 nt!NtRaiseHardError+0x16b
    ba9f7d44 7c92eb94 c000021a 00000004 00000001 nt!KiFastCallEntry+0xfc
    WARNING: Frame IP not in any known module. Following frames may be wrong.
    0155f1dc 7c92e273 75aa32b7 c000021a 00000004 0x7c92eb94
    0155f234 75aa4aea 0155f25c 75aa68b1 0155f264 0x7c92e273
    0155fff4 00000000 00000000 00000000 00000000 0x75aa4aea


    STACK_COMMAND:  kb

    FOLLOWUP_IP:
    nt!KiFastCallEntry+fc
    8054160c 8be5            mov     esp,ebp

    SYMBOL_STACK_INDEX:  5

    SYMBOL_NAME:  nt!KiFastCallEntry+fc

    FOLLOWUP_NAME:  MachineOwner

    MODULE_NAME: nt

    IMAGE_NAME:  ntkrpamp.exe

    DEBUG_FLR_IMAGE_TIMESTAMP:  41107b0d

    FAILURE_BUCKET_ID:  0xc000021a_csrss.exe_c0000005_nt!KiFastCallEntry+fc

    BUCKET_ID:  0xc000021a_csrss.exe_c0000005_nt!KiFastCallEntry+fc

    Followup: MachineOwner
    ---------

    2013年9月2日 8:26

  •  这个图片是用安装版XP创建系统分区快速格式化时蓝屏照片。
    2013年9月2日 8:28

  • 这个是在运行驱动精灵准备安装驱动时蓝图截图。
    2013年9月2日 8:30
  • 0x0000007B 那个错误可能是因为 Windows XP 无法正确配置 SATA 驱动引起。
    除非 Windows XP 整合有第三方的 SATA 驱动或者已在 BIOS 设置中开启 IDE 兼容模式,否则很容易在对 SATA 硬盘进行处理时遇到 0x0000007B 错误。

    --
    Alexis Zhang

    http://mvp.support.microsoft.com/profile/jie
    http://blogs.itecn.net/blogs/alexis

    本帖是回复帖,原帖作者是楼上的 "kfwqm2000"
     这个图片是用安装版XP创建系统分区快速格式化时蓝屏照片。
    2013年9月2日 9:57
    版主
  • 至于 0xc000021a 这个故障不太容易判断原因,因为它是在进入 Windows 内核子模式系统之前遇到的,比较有可能是硬件问题。
    建议首先检测一下内存稳定性、扫描一下所有硬盘驱动器,确认没有内存不稳定或硬盘坏道问题。

    --
    Alexis Zhang

    http://mvp.support.microsoft.com/profile/jie
    http://blogs.itecn.net/blogs/alexis

    本帖是回复帖,原帖作者是楼上的 "kfwqm2000"
    以下这两个DUMP文件是8月31日用OEM版一步一步安装的操作系统分区安装系统,装好后没有运行任何软件、驱动,也没安装其它软件,裸系统运行驱动精灵2013随即蓝屏。
    2013年9月2日 10:01
    版主
  • 是否可以推荐几种检测内存和硬盘的工具软件?

    2013年9月3日 8:05
  • 根据你的建议,对多台故障机都做的内存及硬盘的稳定性测试。都没有检测出错误,检测结果显示都是正常的。是否还有其它可能性会出这种故障?
    2013年9月6日 9:55
  • 有,而且可能原因很多,包括各种潜在的硬件故障。因为 0xc0000021a 是在进入 Windows 内核子模式系统之前遇到的,所以这个错误基本没有什么可以参考的有价值信息。这种蓝屏也不会有内存转储文件生成。
    至于 0x0000007B 那个错误,请确认安装 Windows XP 时是否具有正确的 SATA 或 RAID 驱动。

    --
    Alexis Zhang

    http://mvp.support.microsoft.com/profile/jie
    http://blogs.itecn.net/blogs/alexis

    本帖是回复帖,原帖作者是楼上的 "kfwqm2000"
    根据你的建议,对多台故障机都做的内存及硬盘的稳定性测试。都没有检测出错误,检测结果显示都是正常的。是否还有其它可能性会出这种故障?
    2013年9月8日 10:54
    版主