2011-7-17 blue screen-优快云博客

本文链接：https://blog.youkuaiyun.com/goodpress/article/details/6611790

本文详细记录了2011年7月17日遇到的Windows蓝屏问题，探讨了微软操作系统中出现蓝屏的原因，涉及C语言编程、Windows内核调试以及模块搜索等方面。通过深入分析系统日志和使用调试工具，定位到问题根源，为类似故障提供了解决思路。

摘要生成于 C知道，由 DeepSeek-R1 满血版支持，前往体验 >

Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Windows\Minidump\061811-35171-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*D:\down\TEMP*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7600 MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16695.x86fre.win7_gdr.101026-1503
Machine Name:
Kernel base = 0x84240000 PsLoadedModuleList = 0x84388810
Debug session time: Sat Jun 18 11:42:57.190 2011 (GMT+8)
System Uptime: 0 days 0:41:06.268
Loading Kernel Symbols
...............................................................
................................................................
..........................................
Loading User Symbols
Loading unloaded module list
......
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck A, {3888cc05, 2, 1, 842e80c8}

*** WARNING: Unable to verify timestamp for Hookport.sys
*** ERROR: Module load completed but symbols could not be loaded for Hookport.sys
Probably caused by : NETIO.SYS ( NETIO!NsiGetAllParametersEx+182 )

Followup: MachineOwner
---------

1: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 3888cc05, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000001, bitfield :
	bit 0 : value 0 = read operation, 1 = write operation
	bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: 842e80c8, address which referenced memory

Debugging Details:
------------------


WRITE_ADDRESS: GetPointerFromAddress: unable to read from 843a8718
Unable to read MiSystemVaType memory at 84388160
 3888cc05 

CURRENT_IRQL:  2

FAULTING_IP: 
nt!KiDeliverApc+130
842e80c8 8908            mov     dword ptr [eax],ecx

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0xA

PROCESS_NAME:  360tray.exe

TRAP_FRAME:  9be97694 -- (.trap 0xffffffff9be97694)
ErrCode = 00000011
eax=88cc0530 ebx=00200000 ecx=8995d8b8 edx=00000000 esi=8995d8b8 edi=00000000
eip=00200000 esp=9be97708 ebp=9be97724 iopl=0         nv up ei ng nz na po nc
cs=0008  ss=0010  ds=0023  es=0023  fs=0030  gs=0000             efl=00010282
00200000 ??              ???
Resetting default scope

LAST_CONTROL_TRANSFER:  from 842e80c8 to 8428681b

STACK_TEXT:  
9be9754c 842e80c8 badb0d00 01000000 8420eba9 nt!KiTrap0E+0x2cf
9be975f4 8426991e 00000000 00000000 00000000 nt!KiDeliverApc+0x130
9be97608 842c857e 00200000 8995d8b8 9be97724 nt!KiCheckForKernelApcDelivery+0x24
9be9767c 84286628 00000008 00200000 00000000 nt!MmAccessFault+0x2c88
9be9767c 00200000 00000008 00200000 00000000 nt!KiTrap0E+0xdc
WARNING: Frame IP not in any known module. Following frames may be wrong.
9be97704 89d2030c 9be97824 8992353f 00000000 0x200000
9be97724 8998d037 87bd10e0 00000000 00e97824 tcpip!TcpOffloadSendRequest+0x140
9be97744 89921c80 87bd10e0 00000000 9be97824 ndis!ndisQuerySetMiniport+0x1b
9be978b4 8992281c 87bd10e0 86c138c8 87644008 ndis!ndisIfGetMiniportStatistics+0x1f9
9be97980 899212cf 87644008 00020106 9be979a8 ndis!ndisIfQueryObject+0x8c2
9be979c0 89922dfa 874f9008 87644348 9be979e0 ndis!ndisNsiGetInterfaceRodInformation+0x4db
9be97a1c 89c195ef 00e97a34 00000000 86c13830 ndis!ndisNsiGetAllInterfaceInformation+0x2c2
9be97a64 901c09c2 00000000 0bf53fae 00000038 NETIO!NsiGetAllParametersEx+0x182
9be97acc 901c1f1c 00000000 86c13880 86c13868 nsiproxy!NsippGetAllParameters+0xb4
9be97af0 901c1fe5 8898ae01 00000000 8831c390 nsiproxy!NsippDispatchDeviceControl+0x98
9be97b08 8427c4ac 8777d988 8898ae30 8898ae30 nsiproxy!NsippDispatch+0x33
9be97b20 8447e3be 8831c390 8898ae30 8898aea0 nt!IofCallDriver+0x63
9be97b40 8449b1af 8777d988 8831c390 00000000 nt!IopSynchronousServiceTail+0x1f8
9be97bdc 8449d98a 8777d988 8898ae30 00000000 nt!IopXxxControlFile+0x6aa
9be97c10 84fa5a41 000003f4 000009ec 00000000 nt!NtDeviceIoControlFile+0x2a
9be97d04 8428343a 000003f4 000009ec 00000000 Hookport+0x4a41
9be97d04 778a6344 000003f4 000009ec 00000000 nt!KiFastCallEntry+0x12a
019aedf4 00000000 00000000 00000000 00000000 0x778a6344


STACK_COMMAND:  kb

FOLLOWUP_IP: 
NETIO!NsiGetAllParametersEx+182
89c195ef 8bf0            mov     esi,eax

SYMBOL_STACK_INDEX:  c

SYMBOL_NAME:  NETIO!NsiGetAllParametersEx+182

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: NETIO

IMAGE_NAME:  NETIO.SYS

DEBUG_FLR_IMAGE_TIMESTAMP:  4a5bbf63

FAILURE_BUCKET_ID:  0xA_NETIO!NsiGetAllParametersEx+182

BUCKET_ID:  0xA_NETIO!NsiGetAllParametersEx+182

Followup: MachineOwner
---------