询问者
偶尔蓝屏,请大家给分析分析!谢谢!

问题
-
Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [C:\WINDOWS\Minidump\Mini072209-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are availableSymbol search path is: SRV*c:\temp*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows XP Kernel Version 2600 (Service Pack 2) UP Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 2600.xpsp_sp2_qfe.090206-1239
Machine Name:
Kernel base = 0x804d8000 PsLoadedModuleList = 0x80554dc0
Debug session time: Wed Jul 22 20:17:32.859 2009 (GMT+8)
System Uptime: 0 days 1:14:16.421
Loading Kernel Symbols
...............................................................
................................................................
......
Loading User Symbols
Loading unloaded module list
...............
Unable to load image SKNFW.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for SKNFW.sys
*** ERROR: Module load completed but symbols could not be loaded for SKNFW.sys
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************Use !analyze -v to get detailed debugging information.
BugCheck 100000D1, {0, 2, 8, 0}
*** WARNING: Unable to verify timestamp for rt73.sys
*** ERROR: Module load completed but symbols could not be loaded for rt73.sys
Probably caused by : SKNFW.sys ( SKNFW+3e2d )Followup: MachineOwner
---------kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: 00000000, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000008, value 0 = read operation, 1 = write operation
Arg4: 00000000, address which referenced memoryDebugging Details:
------------------
READ_ADDRESS: 00000000CURRENT_IRQL: 2
FAULTING_IP:
+2a
00000000 ?? ???PROCESS_NAME: svchost.exe
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: DRIVER_FAULT
BUGCHECK_STR: 0xD1
LAST_CONTROL_TRANSFER: from f765ae2d to 00000000
FAILED_INSTRUCTION_ADDRESS:
+2a
00000000 ?? ???STACK_TEXT:
WARNING: Frame IP not in any known module. Following frames may be wrong.
f78b28ec f765ae2d 00000000 00000016 f78b29f0 0x0
f78b2970 f44ec86c 841bd8e8 00000016 f78b29f0 SKNFW+0x3e2d
f78b2a0c f44f7f31 82baf550 f21e0ddd 00003500 tcpip!UDPDeliver+0x1be
f78b2a64 f44ebef5 842b3228 6401a8c0 f21e0ddd tcpip!UDPRcv+0x164
f78b2ac4 f44ebb19 00000020 842b3228 f44ec592 tcpip!DeliverToUser+0x18e
f78b2b40 f44eb836 f452b570 842b3228 84192038 tcpip!DeliverToUserEx+0x95e
f78b2bf8 f44ea922 842b3228 8419204c 00000071 tcpip!IPRcvPacket+0x6cb
f78b2c38 f44ef2da 00000000 839cd000 8419202a tcpip!ARPRcvIndicationNew+0x149
f78b2c68 f7657cc6 84040918 839cd000 8419202a tcpip!ARPRcv+0x42
f78b2c94 f7286c72 82b38320 f44ef2a0 84040918 SKNFW+0xcc6
f78b2cd0 f67a05d7 84040368 839cd000 00000000 NDIS!EthFilterDprIndicateReceive+0x17c
f78b2d10 f7657cc6 8403c4e8 839cd000 8419202a psched!ClReceiveIndication+0x21b
f78b2d3c f7286bd6 82b47260 f67a03bc 8403c4e8 SKNFW+0xcc6
f78b2d78 f41ee187 84035d98 839cd000 8419202a NDIS!EthFilterDprIndicateReceive+0xe0
f78b2e2c f4213e04 839cd000 83a3a9f0 00000000 rt73+0xe187
f78b2e4c 804f168c 00000000 829358b0 83a3a9f0 rt73+0x33e04
f78b2e7c f6939ee5 829358b0 8425b580 83d9b028 nt!IopfCompleteRequest+0xa2
f78b2ee4 f693ab57 8413f150 00000000 83d9b7d8 USBPORT!USBPORT_CompleteTransfer+0x373
f78b2f14 f693b754 026e6f44 83d9b0e0 83d9b0e0 USBPORT!USBPORT_DoneTransfer+0x137
f78b2f4c f693cf6a 83d9b028 805434c8 83d9b230 USBPORT!USBPORT_FlushDoneTransferList+0x16c
f78b2f78 f694afb0 83d9b028 805434c8 83d9b028 USBPORT!USBPORT_DpcWorker+0x224
f78b2fb4 f694b128 83d9b028 00000001 806d2737 USBPORT!USBPORT_IsrDpcWorker+0x37e
f78b2fd0 8054297d 83d9b64c 6b755044 00000000 USBPORT!USBPORT_IsrDpc+0x166
f78b2ff4 8054264a ba4dda7c 00000000 00000000 nt!KiRetireDpcList+0x46
f78b2ff8 ba4dda7c 00000000 00000000 00000000 nt!KiDispatchInterrupt+0x2a
8054264a 00000000 00000009 bb835675 00000128 0xba4dda7c
STACK_COMMAND: kbFOLLOWUP_IP:
SKNFW+3e2d
f765ae2d ?? ???SYMBOL_STACK_INDEX: 1
SYMBOL_NAME: SKNFW+3e2d
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: SKNFW
IMAGE_NAME: SKNFW.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 43e9b70f
FAILURE_BUCKET_ID: 0xD1_CODE_AV_NULL_IP_SKNFW+3e2d
BUCKET_ID: 0xD1_CODE_AV_NULL_IP_SKNFW+3e2d
Followup: MachineOwner
---------kd> lmvm SKNFW
start end module name
f7657000 f7664b80 SKNFW T (no symbols)
Loaded symbol image file: SKNFW.sys
Image path: SKNFW.sys
Image name: SKNFW.sys
Timestamp: Wed Feb 08 17:17:03 2006 (43E9B70F)
CheckSum: 00010162
ImageSize: 0000DB80
Translations: 0000.04b0 0000.04e4 0409.04b0 0409.04e4
WinDbg报告呈上,在线等,谢谢!
全部回复
-
你的藍屏與安裝天網防火墻有關.
網上有不少關於這個問題的鏈接.
這是其中一個帖子.
安装天网导致蓝屏
http://baike.360.cn/4024037/7120686.html
Folding@Home- 已建议为答案 Alexis ZhangMVP, Moderator 2009年7月25日 10:37
-
-
SKNFW.sys 的确是天网防火墙的驱动,当天网检测到无效的网卡信息时就会蓝屏,想要彻底删除该网卡信息必须删除与之对应的inf驱动信息文件,一般情况下在C:\WINDOWS\inf目录中保存。
夜鹰- 已建议为答案 Alexis ZhangMVP, Moderator 2009年7月25日 10:37