AMD配置机器运行XP系统不定时蓝屏,运行windows7无蓝屏故障.

0

登录进行投票

很可能是硬件设备驱动程序的差异引起的问题。Windows XP、Windows 7 使用的驱动应该是不同的。

如果要了解具体原因，最好提供一些 Crash Dump 内存转储文件供分析。

--

Alexis Zhang

http://mvp.support.microsoft.com/profile/jie

http://blogs.itecn.net/blogs/alexis

推荐以 NNTP Bridge 桥接新闻组方式访问论坛以获取最佳用户体验。

本帖是回复帖，原帖作者是楼上的 "kfwqm2000"

蓝屏代码固定在0A,50,7E,8E,24这几个代码.蓝屏时间不固定,从开机几分钟就蓝屏到运行若干小时后蓝屏.

这种配置运行windows7证明无蓝屏故障.相当稳定.

已建议为答案 Alexis ZhangMVP, Moderator 2013年5月19日 1:24

2013年5月14日 23:45

版主

0

登录进行投票

请问这个问题有何进展吗？如果需要了解详细的故障原因，最好提供一下几次蓝屏时生成的 Dump 文件。

--

Alexis Zhang

http://mvp.support.microsoft.com/profile/jie

http://blogs.itecn.net/blogs/alexis

推荐以 NNTP Bridge 桥接新闻组方式访问论坛以获取最佳用户体验。

本帖是回复帖，原帖作者是楼上的 "Alexis Zhang"

很可能是硬件设备驱动程序的差异引起的问题。Windows XP、Windows 7 使用的驱动应该是不同的。

如果要了解具体原因，最好?峁┮恍?Crash Dump 内存转储文件供分析。

2013年5月19日 1:25

版主

0

登录进行投票

手头目前没有最新的DUMP文件，但有一些老的文件，从这些文件看象是搜狗拼音的后台管理程序引起的。但卸载掉搜狗拼音后仍然没有排除蓝屏的故障。之后重新安装过系统，更换过各种硬件的驱动，更换过CPU，内存，主板，显卡，也没有排除蓝屏的故障，代码依旧是标题中所示的那几个蓝屏代码。因机器有软保护，没能得到新的DUMP文件，先上几个早期的DUMP文件分析一下。

Loading Dump File [D:\公司文档\蓝屏代码\Minidump011-0a\Minidump\Mini120412-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*C:\Symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows XP Kernel Version 2600 (Service Pack 3) MP (3 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 2600.xpsp_sp3_qfe.120411-1615
Machine Name:
Kernel base = 0x804d8000 PsLoadedModuleList = 0x8055e720
Debug session time: Tue Dec 4 15:03:16.156 2012 (UTC + 8:00)
System Uptime: 0 days 0:41:38.984
Loading Kernel Symbols
...............................................................
....................................................
Loading User Symbols
Loading unloaded module list
..................
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1000000A, {100014, 2, 0, 8050d592}

Probably caused by : memory_corruption ( nt!MiFindImageSectionObject+26 )

Followup: MachineOwner
---------

1: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 00100014, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000000, bitfield :
bit 0 : value 0 = read operation, 1 = write operation
bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: 8050d592, address which referenced memory

Debugging Details:
------------------

READ_ADDRESS: 00100014

CURRENT_IRQL: 2

FAULTING_IP:
nt!MiFindImageSectionObject+26
8050d592 8b4014 mov eax,dword ptr [eax+14h]

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: 0xA

PROCESS_NAME: PinyinUp.exe

LAST_CONTROL_TRANSFER: from 8050db5d to 8050d592

STACK_TEXT:
abb56664 8050db5d 00100000 00000001 abb566cc nt!MiFindImageSectionObject+0x26
abb56704 00000000 00000010 0000f190 00000078 nt!MmCreateSection+0x2a9

STACK_COMMAND: kb

FOLLOWUP_IP:
nt!MiFindImageSectionObject+26
8050d592 8b4014 mov eax,dword ptr [eax+14h]

SYMBOL_STACK_INDEX: 0

SYMBOL_NAME: nt!MiFindImageSectionObject+26

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nt

DEBUG_FLR_IMAGE_TIMESTAMP: 4f857c1e

IMAGE_NAME: memory_corruption

FAILURE_BUCKET_ID: 0xA_nt!MiFindImageSectionObject+26

BUCKET_ID: 0xA_nt!MiFindImageSectionObject+26

Followup: MachineOwner
---------

已编辑 kfwqm2000 2013年8月29日 4:26 修改内容

2013年8月29日 4:21

0

登录进行投票

Loading Dump File [D:\公司文档\蓝屏代码\Mini120512-01-54-7f\Mini120512-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*C:\Symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows XP Kernel Version 2600 (Service Pack 3) MP (3 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 2600.xpsp_sp3_qfe.120411-1615
Machine Name:
Kernel base = 0x804d8000 PsLoadedModuleList = 0x8055e720
Debug session time: Wed Dec 5 12:56:01.234 2012 (UTC + 8:00)
System Uptime: 0 days 0:01:40.078
Loading Kernel Symbols
...............................................................
....................................................
Loading User Symbols
Loading unloaded module list
.................
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1000007F, {8, 80042000, 0, 0}

Probably caused by : ntkrpamp.exe ( nt!_SEH_prolog+1a )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

UNEXPECTED_KERNEL_MODE_TRAP_M (1000007f)
This means a trap occurred in kernel mode, and it's a trap of a kind
that the kernel isn't allowed to have/catch (bound trap) or that
is always instant death (double fault). The first number in the
bugcheck params is the number of the trap (8 = double fault, etc)
Consult an Intel x86 family manual to learn more about what these
traps are. Here is a *portion* of those codes:
If kv shows a taskGate
        use .tss on the part before the colon, then kv.
Else if kv shows a trapframe
        use .trap on that value
Else
        .trap on the appropriate frame will show where the trap was taken
        (on x86, this will be the ebp that goes with the procedure KiTrap)
Endif
kb will then show the corrected stack.
Arguments:
Arg1: 00000008, EXCEPTION_DOUBLE_FAULT
Arg2: 80042000
Arg3: 00000000
Arg4: 00000000

Debugging Details:
------------------

BUGCHECK_STR: 0x7f_8

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: DRIVER_FAULT

PROCESS_NAME: wmiprvse.exe

EXCEPTION_RECORD: b1947a7c -- (.exr 0xffffffffb1947a7c)
ExceptionAddress: 80531f9e (nt!RtlIsValidHandler+0x0000003c)
   ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 00000000
   Parameter[1]: 00000780
Attempt to read from address 00000780

TRAP_FRAME: b19475a4 -- (.trap 0xffffffffb19475a4)
ErrCode = 00000000
eax=00000280 ebx=b1948764 ecx=00000140 edx=00000000 esi=00000280 edi=4e92c280
eip=80531f9e esp=b1947618 ebp=b1947628 iopl=0         nv up ei pl nz ac po nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000             efl=00010212
nt!RtlIsValidHandler+0x3c:
80531f9e 8b1c88          mov     ebx,dword ptr [eax+ecx*4] ds:0023:00000780=????????
Resetting default scope

LAST_CONTROL_TRANSFER: from 805430f5 to 8053cc0a

STACK_TEXT:
b1946084 805430f5 b19460a0 00000000 b19460f4 nt!_SEH_prolog+0x1a
b19460ec 805430a6 b1946178 80531f9e badb0d00 nt!CommonDispatchException+0x4d
b1946178 80532023 00000280 00000000 b19465cc nt!Kei386EoiHelper+0x18a
b19461f4 804ff5d0 b19465cc b19462c8 00000780 nt!RtlDispatchException+0x59
b19465b0 805430f5 b19465cc 00000000 b1946620 nt!KiDispatchException+0x13e
b1946618 805430a6 b19466a4 80531f9e badb0d00 nt!CommonDispatchException+0x4d
b19466a4 80532023 00000280 00000000 b1946af8 nt!Kei386EoiHelper+0x18a
b1946720 804ff5d0 b1946af8 b19467f4 00000780 nt!RtlDispatchException+0x59
b1946adc 805430f5 b1946af8 00000000 b1946b4c nt!KiDispatchException+0x13e
b1946b44 805430a6 b1946bd0 80531f9e badb0d00 nt!CommonDispatchException+0x4d
b1946bd0 80532023 00000280 00000000 b1947024 nt!Kei386EoiHelper+0x18a
b1946c4c 804ff5d0 b1947024 b1946d20 00000780 nt!RtlDispatchException+0x59
b1947008 805430f5 b1947024 00000000 b1947078 nt!KiDispatchException+0x13e
b1947070 805430a6 b19470fc 80531f9e badb0d00 nt!CommonDispatchException+0x4d
b19470fc 80532023 00000280 00000000 b1947550 nt!Kei386EoiHelper+0x18a
b1947178 804ff5d0 b1947550 b194724c 00000780 nt!RtlDispatchException+0x59
b1947534 805430f5 b1947550 00000000 b19475a4 nt!KiDispatchException+0x13e
b194759c 805430a6 b1947628 80531f9e badb0d00 nt!CommonDispatchException+0x4d
b1947628 80532023 00000280 00000000 b1947a7c nt!Kei386EoiHelper+0x18a
b19476a4 804ff5d0 b1947a7c b1947778 00000780 nt!RtlDispatchException+0x59
b1947a60 805430f5 b1947a7c 00000000 b1947ad0 nt!KiDispatchException+0x13e
b1947ac8 805430a6 b1947b54 80531f9e badb0d00 nt!CommonDispatchException+0x4d
b1947b54 80532023 00000280 00000000 b1947fa8 nt!Kei386EoiHelper+0x18a
b1947bd0 804ff5d0 b1947fa8 b1947ca4 00000780 nt!RtlDispatchException+0x59
b1947f8c 805430f5 b1947fa8 00000000 b1947ffc nt!KiDispatchException+0x13e
b1947ff4 805430a6 b1948080 80531f9e badb0d00 nt!CommonDispatchException+0x4d
b1948080 80532023 00000280 00000000 b19484d4 nt!Kei386EoiHelper+0x18a
b19480fc 804ff5d0 b19484d4 b19481d0 0000102e nt!RtlDispatchException+0x59
b19484b8 805430f5 b19484d4 00000000 b1948528 nt!KiDispatchException+0x13e
b1948520 805430a6 b19486dc 8056d1b8 badb0d00 nt!CommonDispatchException+0x4d
b1948528 8056d1b8 badb0d00 00000001 00000000 nt!Kei386EoiHelper+0x18a
b19486dc 00000000 00000000 00058000 00000400 nt!FsRtlAcquireFileExclusiveCommon+0x1c6

STACK_COMMAND: kb

MODULE_NAME: nt

IMAGE_NAME: ntkrpamp.exe

FOLLOWUP_NAME: MachineOwner

DEBUG_FLR_IMAGE_TIMESTAMP: 4f857c1e

FOLLOWUP_IP:
nt!_SEH_prolog+1a
8053cc0a 53 push ebx

SYMBOL_STACK_INDEX: 0

SYMBOL_NAME: nt!_SEH_prolog+1a

FAILURE_BUCKET_ID: TRAP_FRAME_RECURSION

BUCKET_ID: TRAP_FRAME_RECURSION

Followup: MachineOwner
---------

2013年8月29日 4:22

0

登录进行投票

Loading Dump File [D:\公司文档\蓝屏代码\Mini120512-04-8E\Mini120512-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*C:\Symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows XP Kernel Version 2600 (Service Pack 3) MP (3 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 2600.xpsp_sp3_qfe.120411-1615
Machine Name:
Kernel base = 0x804d8000 PsLoadedModuleList = 0x8055e720
Debug session time: Wed Dec 5 15:04:29.390 2012 (UTC + 8:00)
System Uptime: 0 days 0:38:26.218
Loading Kernel Symbols
...............................................................
....................................................
Loading User Symbols
Loading unloaded module list
.................
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1000008E, {c0000005, 805471d8, ad1636c0, 0}

Probably caused by : ntkrpamp.exe ( nt!RtlpInterlockedPushEntrySList+c )

Followup: MachineOwner
---------

2: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

KERNEL_MODE_EXCEPTION_NOT_HANDLED_M (1000008e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003. This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG. This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG. This will let us see why this breakpoint is
happening.
Arguments:
Arg1: c0000005, The exception code that was not handled
Arg2: 805471d8, The address that the exception occurred at
Arg3: ad1636c0, Trap Frame
Arg4: 00000000

Debugging Details:
------------------

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - "0x%08lx"

FAULTING_IP:
nt!RtlpInterlockedPushEntrySList+c
805471d8 8903 mov dword ptr [ebx],eax

TRAP_FRAME: ad1636c0 -- (.trap 0xffffffffad1636c0)
ErrCode = 00000002
eax=00000000 ebx=00000000 ecx=b7e19020 edx=c2a90000 esi=89821c00 edi=8054c2e0
eip=805471d8 esp=ad163734 ebp=b7e19020 iopl=0         nv up ei ng nz ac pe cy
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000             efl=00010297
nt!RtlpInterlockedPushEntrySList+0xc:
805471d8 8903            mov     dword ptr [ebx],eax ds:0023:00000000=????????
Resetting default scope

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: 0x8E

PROCESS_NAME: ImeUtil.exe

LAST_CONTROL_TRANSFER: from b7dfb474 to 805471d8

STACK_TEXT:
ad163738 b7dfb474 000012c0 0000001c 00000000 nt!RtlpInterlockedPushEntrySList+0xc
ad163740 00000000 00000000 00000000 00000000 Ntfs!ExFreeToPagedLookasideList+0x29

STACK_COMMAND: kb

FOLLOWUP_IP:
nt!RtlpInterlockedPushEntrySList+c
805471d8 8903 mov dword ptr [ebx],eax

SYMBOL_STACK_INDEX: 0

SYMBOL_NAME: nt!RtlpInterlockedPushEntrySList+c

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nt

IMAGE_NAME: ntkrpamp.exe

DEBUG_FLR_IMAGE_TIMESTAMP: 4f857c1e

FAILURE_BUCKET_ID: 0x8E_nt!RtlpInterlockedPushEntrySList+c

BUCKET_ID: 0x8E_nt!RtlpInterlockedPushEntrySList+c

Followup: MachineOwner
---------

2013年8月29日 4:24

0

登录进行投票

这几个 Crash Dump 分析的确与输入法程序有关。

如果说卸载搜狗拼音后依然有问题，包括重新安装系统也没有解决问题，有没有刚安装好的系统、没有安装什么第三方软件时就蓝屏的分析结果？

--
Alexis Zhang

http://mvp.support.microsoft.com/profile/jie
http://blogs.itecn.net/blogs/alexis

本帖是回复帖，原帖作者是楼上的 "kfwqm2000"

手头目前没有最新的DUMP文件，但有一些老的文件，从这些文件看象是搜狗拼音的后台管理程序引起的。但卸载掉搜狗拼音后仍然没有排除蓝屏的故障。

2013年9月1日 10:19

版主

0

登录进行投票

以下这两个DUMP文件是8月31日用OEM版一步一步安装的操作系统分区安装系统，装好后没有运行任何软件、驱动，也没安装其它软件，裸系统运行驱动精灵2013随即蓝屏。另外在用原版系统DOS下分区时也有蓝屏的故障，但没提取到DUMP文件，只有图片。现发上来帮忙分析一下。谢谢。

1

Loading Dump File [D:\公司文档\蓝屏代码\2013.8.31\39Mini083013-02.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*C:\Symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows XP Kernel Version 2600 (Service Pack 2) MP (3 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 2600.xpsp_sp2_rtm.040803-2158
Machine Name:
Kernel base = 0x804d8000 PsLoadedModuleList = 0x8055d700
Debug session time: Fri Aug 30 11:45:54.390 2013 (UTC + 8:00)
System Uptime: 0 days 0:00:15.968
Loading Kernel Symbols
...............................................................
...........................
Loading User Symbols
Loading unloaded module list
.......
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck C000021A, {e19184f0, c0000005, 7c9306c3, 71ed04}

unable to get nt!KiCurrentEtwBufferOffset
unable to get nt!KiCurrentEtwBufferBase
Probably caused by : ntkrpamp.exe ( nt!KiFastCallEntry+fc )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

WINLOGON_FATAL_ERROR (c000021a)
The Winlogon process terminated unexpectedly.
Arguments:
Arg1: e19184f0, String that identifies the problem.
Arg2: c0000005, Error Code.
Arg3: 7c9306c3
Arg4: 0071ed04

Debugging Details:
------------------

unable to get nt!KiCurrentEtwBufferOffset
unable to get nt!KiCurrentEtwBufferBase

ERROR_CODE: (NTSTATUS) 0xc000021a - {

EXCEPTION_CODE: (NTSTATUS) 0xc000021a - {

EXCEPTION_PARAMETER1: e19184f0

EXCEPTION_PARAMETER2: c0000005

EXCEPTION_PARAMETER3: 7c9306c3

EXCEPTION_PARAMETER4: 71ed04

ADDITIONAL_DEBUG_TEXT: Windows SubSystem

BUGCHECK_STR: 0xc000021a_csrss.exe_c0000005

CUSTOMER_CRASH_COUNT: 2

DEFAULT_BUCKET_ID: DRIVER_FAULT

PROCESS_NAME: csrss.exe

LAST_CONTROL_TRANSFER: from 805c6a5a to 804fac37

STACK_TEXT:
baab7934 805c6a5a 0000004c c000021a baab79b0 nt!KeBugCheckEx+0x1b
baab7970 80656377 00000001 0000004c c000021a nt!PoShutdownBugCheck+0x5c
baab7b28 8061384a c000021a 00000004 00000001 nt!ExpSystemErrorHandler+0x511
baab7cd4 80613dcb c000021a 00000004 00000001 nt!ExpRaiseHardError+0x9a
baab7d44 8054160c c000021a 00000004 00000001 nt!NtRaiseHardError+0x16b
baab7d44 7c92eb94 c000021a 00000004 00000001 nt!KiFastCallEntry+0xfc
WARNING: Frame IP not in any known module. Following frames may be wrong.
0071eb74 7c92e273 75aa32b7 c000021a 00000004 0x7c92eb94
0071ebcc 75aa4aea 0071ebf4 75aa68b1 0071ebfc 0x7c92e273
0071ebd0 0071ebf4 75aa68b1 0071ebfc 00000001 0x75aa4aea
0071ebd4 75aa68b1 0071ebfc 00000001 0071ebfc 0x71ebf4
0071ebf4 0071ed04 0071ec20 7c9237bf 0071ece8 0x75aa68b1
0071ece8 00000000 00000000 7c9306c3 00000002 0x71ed04

STACK_COMMAND: kb

FOLLOWUP_IP:
nt!KiFastCallEntry+fc
8054160c 8be5 mov esp,ebp

SYMBOL_STACK_INDEX: 5

SYMBOL_NAME: nt!KiFastCallEntry+fc

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nt

IMAGE_NAME: ntkrpamp.exe

DEBUG_FLR_IMAGE_TIMESTAMP: 41107b0d

FAILURE_BUCKET_ID: 0xc000021a_csrss.exe_c0000005_nt!KiFastCallEntry+fc

BUCKET_ID: 0xc000021a_csrss.exe_c0000005_nt!KiFastCallEntry+fc

Followup: MachineOwner
---------

2013年9月2日 8:25

0

登录进行投票

2

Loading Dump File [D:\公司文档\蓝屏代码\2013.8.31\39Mini083013-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*C:\Symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows XP Kernel Version 2600 (Service Pack 2) MP (3 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 2600.xpsp_sp2_rtm.040803-2158
Machine Name:
Kernel base = 0x804d8000 PsLoadedModuleList = 0x8055d700
Debug session time: Fri Aug 30 11:45:05.593 2013 (UTC + 8:00)
System Uptime: 0 days 0:01:06.437
Loading Kernel Symbols
...............................................................
............................
Loading User Symbols
Loading unloaded module list
.......
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck C000021A, {e15b0b20, c0000005, 7c9306c3, 155f36c}

unable to get nt!KiCurrentEtwBufferOffset
unable to get nt!KiCurrentEtwBufferBase
Probably caused by : ntkrpamp.exe ( nt!KiFastCallEntry+fc )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

WINLOGON_FATAL_ERROR (c000021a)
The Winlogon process terminated unexpectedly.
Arguments:
Arg1: e15b0b20, String that identifies the problem.
Arg2: c0000005, Error Code.
Arg3: 7c9306c3
Arg4: 0155f36c

Debugging Details:
------------------

unable to get nt!KiCurrentEtwBufferOffset
unable to get nt!KiCurrentEtwBufferBase

ERROR_CODE: (NTSTATUS) 0xc000021a - {

EXCEPTION_CODE: (NTSTATUS) 0xc000021a - {

EXCEPTION_PARAMETER1: e15b0b20

EXCEPTION_PARAMETER2: c0000005

EXCEPTION_PARAMETER3: 7c9306c3

EXCEPTION_PARAMETER4: 155f36c

ADDITIONAL_DEBUG_TEXT: Windows SubSystem

BUGCHECK_STR: 0xc000021a_csrss.exe_c0000005

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: DRIVER_FAULT

PROCESS_NAME: csrss.exe

LAST_CONTROL_TRANSFER: from 805c6a5a to 804fac37

STACK_TEXT:
ba9f7934 805c6a5a 0000004c c000021a ba9f79b0 nt!KeBugCheckEx+0x1b
ba9f7970 80656377 00000001 0000004c c000021a nt!PoShutdownBugCheck+0x5c
ba9f7b28 8061384a c000021a 00000004 00000001 nt!ExpSystemErrorHandler+0x511
ba9f7cd4 80613dcb c000021a 00000004 00000001 nt!ExpRaiseHardError+0x9a
ba9f7d44 8054160c c000021a 00000004 00000001 nt!NtRaiseHardError+0x16b
ba9f7d44 7c92eb94 c000021a 00000004 00000001 nt!KiFastCallEntry+0xfc
WARNING: Frame IP not in any known module. Following frames may be wrong.
0155f1dc 7c92e273 75aa32b7 c000021a 00000004 0x7c92eb94
0155f234 75aa4aea 0155f25c 75aa68b1 0155f264 0x7c92e273
0155fff4 00000000 00000000 00000000 00000000 0x75aa4aea

STACK_COMMAND: kb

FOLLOWUP_IP:
nt!KiFastCallEntry+fc
8054160c 8be5 mov esp,ebp

SYMBOL_STACK_INDEX: 5

SYMBOL_NAME: nt!KiFastCallEntry+fc

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nt

IMAGE_NAME: ntkrpamp.exe

DEBUG_FLR_IMAGE_TIMESTAMP: 41107b0d

FAILURE_BUCKET_ID: 0xc000021a_csrss.exe_c0000005_nt!KiFastCallEntry+fc

BUCKET_ID: 0xc000021a_csrss.exe_c0000005_nt!KiFastCallEntry+fc

Followup: MachineOwner
---------

2013年9月2日 8:26

0

登录进行投票

这个图片是用安装版XP创建系统分区快速格式化时蓝屏照片。

已编辑 kfwqm2000 2013年9月2日 8:29

2013年9月2日 8:28

0

登录进行投票

这个是在运行驱动精灵准备安装驱动时蓝图截图。

已编辑 kfwqm2000 2013年9月2日 8:31

2013年9月2日 8:30

0

登录进行投票

0x0000007B 那个错误可能是因为 Windows XP 无法正确配置 SATA 驱动引起。

除非 Windows XP 整合有第三方的 SATA 驱动或者已在 BIOS 设置中开启 IDE 兼容模式，否则很容易在对 SATA 硬盘进行处理时遇到 0x0000007B 错误。

--
Alexis Zhang

http://mvp.support.microsoft.com/profile/jie
http://blogs.itecn.net/blogs/alexis

本帖是回复帖，原帖作者是楼上的 "kfwqm2000"

这个图片是用安装版XP创建系统分区快速格式化时蓝屏照片。

2013年9月2日 9:57

版主

0

登录进行投票

至于 0xc000021a 这个故障不太容易判断原因，因为它是在进入 Windows 内核子模式系统之前遇到的，比较有可能是硬件问题。

建议首先检测一下内存稳定性、扫描一下所有硬盘驱动器，确认没有内存不稳定或硬盘坏道问题。

--
Alexis Zhang

http://mvp.support.microsoft.com/profile/jie
http://blogs.itecn.net/blogs/alexis

本帖是回复帖，原帖作者是楼上的 "kfwqm2000"

以下这两个DUMP文件是8月31日用OEM版一步一步安装的操作系统分区安装系统，装好后没有运行任何软件、驱动，也没安装其它软件，裸系统运行驱动精灵2013随即蓝屏。

2013年9月2日 10:01

版主

0

登录进行投票

是否可以推荐几种检测内存和硬盘的工具软件？

2013年9月3日 8:05

0

登录进行投票

根据你的建议，对多台故障机都做的内存及硬盘的稳定性测试。都没有检测出错误，检测结果显示都是正常的。是否还有其它可能性会出这种故障？

2013年9月6日 9:55

0

登录进行投票

有，而且可能原因很多，包括各种潜在的硬件故障。因为 0xc0000021a 是在进入 Windows 内核子模式系统之前遇到的，所以这个错误基本没有什么可以参考的有价值信息。这种蓝屏也不会有内存转储文件生成。

至于 0x0000007B 那个错误，请确认安装 Windows XP 时是否具有正确的 SATA 或 RAID 驱动。

--
Alexis Zhang

http://mvp.support.microsoft.com/profile/jie
http://blogs.itecn.net/blogs/alexis

本帖是回复帖，原帖作者是楼上的 "kfwqm2000"

根据你的建议，对多台故障机都做的内存及硬盘的稳定性测试。都没有检测出错误，检测结果显示都是正常的。是否还有其它可能性会出这种故障？

2013年9月8日 10:54

版主

产品

Resources

Solutions

更新

试用版

相关站点

培训

认证

其他资源

产品支持

其他支持

不是 IT 专业人员？

询问者

AMD配置机器运行XP系统不定时蓝屏,运行windows7无蓝屏故障.

问题

全部回复