系统蓝屏问题常规处理步骤

匿名

蓝屏（Blue Screen）错误可能是Windows系统中比较常见的一种错误。而且对于我们大多数人来说，发生蓝屏之后可能就束手无策了。这里介绍一些发生蓝屏错误时的一些办法。办法很多，但是今天这部分，主要介绍如何用Windows Debugging Tool，或者叫Windbg，结合微软的论坛来处理问题的办法。

首先，要用WinDBG处理蓝屏问题，要确保系统有生成内存转储文件。

确认存在内存转储文件

默认配置的Windows 7，生成的可能是核心转储文件（Kernal Memory Dump）或是小内存转储文件（Minidump）。如果是核心转储文件，默认会存为C:\Windows\Memory.dmp，如果是小内存转储文件，相关文件会保存在C:\Windows\MiniDump目录下面。

所以，出现蓝屏后，请检查系统中有没有C:\Windows\Memory.dmp这个文件，或者是C:\Windows\MiniDump目录下面按照日期命名的文件。比如，Mini010810-01.dmp就是2010年1月8日的第一个小内存转储文件。

如果没有相应的内存转储文件，请参考有关文档。

安装Windows Debugging Tool （WinDBG）

接下来，我们要安装Windbg了。WinDBG可以在微软网站下载，32位的地址是http://www.microsoft.com/whdc/devtools/debugging/installx86.mspx ，64位的地址是http://www.microsoft.com/whdc/devtools/debugging/install64bit.mspx 。注意WinDBG只有英文版的。你只要到这两个地方找一个最新的版本下载安装就可以了。如果你不是很懂英语，那就直接到这两个地址下载：32位：http://msdl.microsoft.com/download/symbols/debuggers/dbg_x86_6.11.1.404.msi，64位：

http://msdl.microsoft.com/download/symbols/debuggers/dbg_amd64_6.11.1.404.msi

http://msdl.microsoft.com/download/symbols/debuggers/dbg_ia64_6.11.1.404.msi。然后一路Next安转就可以了。WinDBG安转文件大小，大概在15-30兆左右。

配置Windows Debugging Tool （WinDBG）

在用WinDBG分析内存转储文件之前，我们要配置一下WinDBG。

首先，选一个临时目录存放Symbol文件。比如，建立一个目录叫C:\Temp

然后，打开WinDBG，在File菜单-〉选择Symbol File Path。在打开的对话框里输入：

SRV*c:\temp*http://msdl.microsoft.com/download/symbols

选择OK确定。WinDBG就配置好了。

用Windows Debugging Tool （WinDBG）分析内存转储文件

在WinDBG里面，在File菜单，选择Open Crash Dump，然后找到前面说的那个核心内存转储文件或者小内存转储文件，选择打开。等待一会儿，如果需要从微软网站下载Symbole文件的话，时间可能会比较长。如果不出现大量Warning，就说明设置是成功的。如果出现Your debugger is not using the correct symbols 之类的信息，说明配置有问题，到上一步再仔细检查一下。

一直等到出现Use !analyze -v to get detailed debugging information.字样和0: kd>提示符。

按照提示，输入!analyze -v命令。等待命令执行完成。

分析Windows Debugging Tool（WinDBG）结果

如果你的英文有一定基础，!analyze -v命令可能就告诉你很多信息了。如果看的不是很明白，就把结果贴出来让热心的网友给你分析一下吧。

http://shower-thunder.spaces.live.com/blog/cns!250DE47BD119587C!131.entry

锁定的问题。此问题已从 Microsoft 支持社区迁移。你可投票决定它是否有用，但不能添加评论或回复，也不能关注问题。

0 个注释

问题作者接受的答案

匿名

您好，

从您提供的蓝屏信息中可以查看到是由于EagleX64.sys、KartRider.exe文件导致的。

错误代码: 0x00000019，表示磁盘驱动器在磁盘找不到持定的扇区或磁道。

Eaglex64.sys 是安博士杀毒软件，可能是游戏自带的安全软件也有可能是您安装的该软件。

KartRider.exe是跑跑卡丁车这款游戏的进程，可能是该软件不兼容当前系统或与电脑上安装的应用软件存在冲突（特别是杀毒软件）。

建议您暂时卸载掉电脑上的安全防护类软件再确认问题（您安装了360和迅雷之类的应用了）。

0 个注释

80 个其他答案

匿名

2016-06-28T08:54:52+00:00

您好，请您看一下我这个，谢谢。
此答案是否有帮助?

0 个注释无注释
匿名

2015-12-02T07:09:17+00:00

Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64

Copyright (c) Microsoft Corporation. All rights reserved.

Loading Dump File [C:\Temp\120215-13088-01.dmp]

Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\temp*http://msdl.microsoft.com/download/symbols

Executable search path is:

Windows 7 Kernel Version 7601 (Service Pack 1) MP (8 procs) Free x64

Product: WinNt, suite: TerminalServer SingleUserTS

Built by: 7601.18247.amd64fre.win7sp1_gdr.130828-1532

Machine Name:

Kernel base = 0xfffff8000421d000 PsLoadedModuleList = 0xfffff800044606d0

Debug session time: Wed Dec 2 14:44:37.144 2015 (UTC + 8:00)

System Uptime: 0 days 2:15:59.971

Loading Kernel Symbols

...............................................................

................................................................

.............................................................

Loading User Symbols

Loading unloaded module list

..........

*******************************************************************************

* *

* Bugcheck Analysis *

* *

*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck A, {22, 2, 0, fffff800042db5c7}

Unable to load image TsQBDrv.sys, Win32 error 0n2

*** WARNING: Unable to verify timestamp for TsQBDrv.sys

*** ERROR: Module load completed but symbols could not be loaded for TsQBDrv.sys

Probably caused by : TsQBDrv.sys ( TsQBDrv+7898 )

Followup: MachineOwner

4: kd> !analyze -v

*******************************************************************************

* *

* Bugcheck Analysis *

* *

*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)

An attempt was made to access a pageable (or completely invalid) address at an

interrupt request level (IRQL) that is too high. This is usually

caused by drivers using improper addresses.

If a kernel debugger is available get the stack backtrace.

Arguments:

Arg1: 0000000000000022, memory referenced

Arg2: 0000000000000002, IRQL

Arg3: 0000000000000000, bitfield :

bit 0 : value 0 = read operation, 1 = write operation

bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)

Arg4: fffff800042db5c7, address which referenced memory

Debugging Details:

READ_ADDRESS: GetPointerFromAddress: unable to read from fffff800044ca100

0000000000000022

CURRENT_IRQL: 2

FAULTING_IP:

nt!IoBoostThreadIoPriority+1e7

fffff800`042db5c7 418a442422 mov al,byte ptr [r12+22h]

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT

BUGCHECK_STR: 0xA

PROCESS_NAME: QQProtect.exe

TRAP_FRAME: fffff88015dce550 -- (.trap 0xfffff88015dce550)

NOTE: The trap frame does not contain all registers.

Some register values may be zeroed or incorrect.

rax=fffff88015dce760 rbx=0000000000000000 rcx=fffff88015dce778

rdx=fffffa801a41b82e rsi=0000000000000000 rdi=0000000000000000

rip=fffff800042db5c7 rsp=fffff88015dce6e0 rbp=0000000000000000

r8=fffffa801a454870 r9=0000000000000000 r10=0000000000000000

r11=fffff88015dceac0 r12=0000000000000000 r13=0000000000000000

r14=0000000000000000 r15=0000000000000000

iopl=0 nv up ei pl nz na pe cy

nt!IoBoostThreadIoPriority+0x1e7:

fffff800042db5c7 418a442422 mov al,byte ptr [r12+22h] ds:e738:0000000000000022=??

Resetting default scope

LAST_CONTROL_TRANSFER: from fffff80004292169 to fffff80004292bc0

STACK_TEXT:

fffff88015dce408 fffff80004292169 : 000000000000000a 0000000000000022 0000000000000002 0000000000000000 : nt!KeBugCheckEx

fffff88015dce410 fffff80004290de0 : fffff8a000000000 fffff8a000000000 fffff8a00e9e2e68 0000000000000001 : nt!KiBugCheckDispatch+0x69

fffff88015dce550 fffff800042db5c7 : fffff9800d702670 0000000000000020 0000000000000001 fffff8a014e59690 : nt!KiPageFault+0x260

fffff88015dce6e0 fffff80004272a75 : fffffa802c36f060 fffff88000000002 fffffa802c36f450 fffff88015dce760 : nt!IoBoostThreadIoPriority+0x1e7

fffff88015dce890 fffff80004272b2d : fffffa801a8eadc0 0000000000000001 0000000000000000 fffff880009b3180 : nt!ExpCheckForIoPriorityBoost+0x151

fffff88015dce8d0 fffff80004297dbc : ffffffffffb3b4c0 fffffa80273da7e0 fffffa801a8eadc0 fffff880014ad4ef : nt!ExpWaitForResource+0x8d

fffff88015dce940 fffff8800140fc93 : 00000000c00000d8 fffffa801a43b850 fffffa802c7b5910 fffffa802c41e001 : nt!ExAcquireResourceExclusiveLite+0x14f

fffff88015dce9b0 fffff88001418433 : fffffa801a454870 fffffa802b47a010 0000000000000000 fffffa802c7b5910 : Ntfs!NtfsAcquireExclusiveFcb+0x73

fffff88015dcea00 fffff880014bdee0 : fffffa802c7b5910 fffffa802c7b5910 0000000000000001 fffff8a00e9e2e30 : Ntfs!NtfsAcquireExclusiveScb+0x1f

fffff88015dcea30 fffff880014bcb77 : fffffa802c7b5910 fffffa801a8f2180 fffffa802c41e000 0000000000000000 : Ntfs!NtfsAllocateMftRecord+0x2c

fffff88015dceaf0 fffff880014a61bc : fffffa802c7b5910 fffffa802c7b5910 fffff8a016d1aa01 0000000000000000 : Ntfs!NtfsCreateNewFile+0x3d7

fffff88015dcee30 fffff8800140f40d : fffffa802c7b5910 fffffa802b47a010 fffff88015dcf1e0 0000000000000000 : Ntfs!NtfsCommonCreate+0xe9c

fffff88015dcf010 fffff8000429e878 : fffff88015dcf150 fffff88015dcfae0 fffffa802c7e8894 fffff88015dcf240 : Ntfs!NtfsCommonCreateCallout+0x1d

fffff88015dcf040 fffff8800140fb8f : fffff8800140f3f0 fffff8800140ea20 fffff88015dcf200 fffff880014afd00 : nt!KeExpandKernelStackAndCalloutEx+0xd8

fffff88015dcf120 fffff880014a878c : 0000000000000000 0000000000000000 fffff88015dcf380 fffffa802b47a010 : Ntfs!NtfsCommonCreateOnNewStack+0x4f

fffff88015dcf180 fffff880013b4bcf : fffffa801a8f2030 fffffa802b47a010 fffffa8023050000 fffff88015dcf5b0 : Ntfs!NtfsFsdCreate+0x1ac

fffff88015dcf330 fffff880013d42b9 : fffffa802b47a010 fffffa801a8f5010 fffffa802b47a000 fffffa801a43bde0 : fltmgr!FltpLegacyProcessingAfterPreCallbacksCompleted+0x24f

fffff88015dcf3c0 fffff8800d693898 : fffff88015dcf5b0 0000000000000008 fffffa8026664de0 0000000000000000 : fltmgr!FltpCreate+0x2a9

fffff88015dcf470 fffff88015dcf5b0 : 0000000000000008 fffffa8026664de0 0000000000000000 0000000000000000 : TsQBDrv+0x7898

fffff88015dcf478 0000000000000008 : fffffa8026664de0 0000000000000000 0000000000000000 fffff8800d68d7c0 : 0xfffff880`15dcf5b0

fffff88015dcf480 fffffa8026664de0 : 0000000000000000 0000000000000000 fffff8800d68d7c0 fffffa802b839b20 : 0x8

fffff88015dcf488 0000000000000000 : 0000000000000000 fffff8800d68d7c0 fffffa802b839b20 0000000000000000 : 0xfffffa80`26664de0

STACK_COMMAND: kb

FOLLOWUP_IP:

TsQBDrv+7898

fffff880`0d693898 ?? ???

SYMBOL_STACK_INDEX: 12

SYMBOL_NAME: TsQBDrv+7898

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: TsQBDrv

IMAGE_NAME: TsQBDrv.sys

DEBUG_FLR_IMAGE_TIMESTAMP: 55fb84d7

FAILURE_BUCKET_ID: X64_0xA_TsQBDrv+7898

BUCKET_ID: X64_0xA_TsQBDrv+7898

Followup: MachineOwner

4: kd> lmvm TsQBDrv

start end module name

fffff8800d68c000 fffff8800d6a0000 TsQBDrv T (no symbols)

Loaded symbol image file: TsQBDrv.sys

Image path: TsQBDrv.sys

Image name: TsQBDrv.sys

Timestamp: Fri Sep 18 11:28:23 2015 (55FB84D7)

CheckSum: 0001C1F3

ImageSize: 00014000

Translations: 0000.04b0 0000.04e4 0409.04b0 0409.04e4
此答案是否有帮助?

0 个注释无注释
匿名

2015-08-07T15:04:10+00:00

版主您好

請幫忙分析一下 Windbg 的藍屏訊息

DRIVER_CORRUPTED_EXPOOL (c5)

An attempt was made to access a pageable (or completely invalid) address at an

interrupt request level (IRQL) that is too high. This is

caused by drivers that have corrupted the system pool. Run the driver

verifier against any new (or suspect) drivers, and if that doesn't turn up

the culprit, then use gflags to enable special pool.

Arguments:

Arg1: 0000000000000000, memory referenced

Arg2: 0000000000000002, IRQL

Arg3: 0000000000000000, value 0 = read operation, 1 = write operation

Arg4: fffff80003210b23, address which referenced memory

Debugging Details:

BUGCHECK_STR: 0xC5_2

CURRENT_IRQL: 2

FAULTING_IP:

nt!ExDeferredFreePool+257

fffff800`03210b23 4c3918          cmp     qword ptr [rax],r11

DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT

PROCESS_NAME: System

TRAP_FRAME: fffff880025fe480 -- (.trap 0xfffff880025fe480)

NOTE: The trap frame does not contain all registers.

Some register values may be zeroed or incorrect.

rax=0000000000000000 rbx=0000000000000000 rcx=fffff8000326c6e0

rdx=fffffa80124fb720 rsi=0000000000000000 rdi=0000000000000000

rip=fffff80003210b23 rsp=fffff880025fe610 rbp=0000000000000000

r8=fffffa80142d9890 r9=fffffa80124fb9b0 r10=0000000000000001

r11=fffffa80124fb9c0 r12=0000000000000000 r13=0000000000000000

r14=0000000000000000 r15=0000000000000000

iopl=0         nv up ei pl zr na po nc

nt!ExDeferredFreePool+0x257:

fffff800`03210b23 4c3918          cmp     qword ptr [rax],r11 ds:1e10:0000=????????????????

Resetting default scope

LAST_CONTROL_TRANSFER: from fffff800030d7e69 to fffff800030d88c0

STACK_TEXT:

fffff880025fe338 fffff800030d7e69 : 000000000000000a 0000000000000000 0000000000000002 0000000000000000 : nt!KeBugCheckEx

fffff880025fe340 fffff800030d6ae0 : fffffa8008092190 fffffa8007d85300 0000000000000000 0000000000000000 : nt!KiBugCheckDispatch+0x69

fffff880025fe480 fffff80003210b23 : fffffa8007d85300 0000000000000000 0000000000000000 0000000000000000 : nt!KiPageFault+0x260

fffff880025fe610 fffff8000320f501 : fffffa8013d81f70 fffffa800babd700 0000000000000000 fffff88003028c5d : nt!ExDeferredFreePool+0x257

fffff880025fe6a0 fffff880030656b7 : 0000000000000018 fffffa8010d57970 fffffa80744d454d 000000000000afd6 : nt!ExFreePoolWithTag+0x411

fffff880025fe750 fffff8800306a077 : fffffa8013c2aaf0 fffffa8013d81f78 fffffa8013d81e10 fffffa8013d81e10 : WiseTDIFw64+0x16b7

fffff880025fe7d0 fffff8800306885e : fffffa8013d81e10 fffffa8013d81f70 0000000000000000 fffff800030ea521 : WiseTDIFw64+0x6077

fffff880025fe810 fffff88003068a28 : fffffa8007d85300 fffffa8013d81e10 fffffa8013d81f70 fffff880025fe880 : WiseTDIFw64+0x485e

fffff880025fe850 fffff8800306a157 : fffffa8007d85300 fffffa8013d81e10 000000000000afd6 000000000000afd0 : WiseTDIFw64+0x4a28

fffff880025fe8c0 fffff880034c3ce3 : fffffa8007d85300 fffffa8013d81e10 0000000000000000 0000000000000018 : WiseTDIFw64+0x6157

fffff880025fe900 fffff880034c3daa : fffffa8011042980 000000000000afd1 fffff880034b1c90 00000000000000c0 : afd!AfdIssueDeviceControl+0x123

fffff880025fe9a0 fffff880034c3e06 : 000000000000afd4 fffffa801410e500 0000000000000000 000000000000afd1 : afd!AfdSetEventHandler+0x2a

fffff880025fea00 fffff880034bd3c5 : fffffa8011042aa0 fffffa8000000000 0000000058646600 fffffa8000000300 : afd!AfdTdiClearVcEventHandlers+0x46

fffff880025fea30 fffff880034c7eb1 : fffffa8011042aa0 fffff880034c28a0 fffff880034b1c90 fffff880034c7e90 : afd! ?? ::NNGAKEGL::`string'+0x10bd

fffff880025feae0 fffff8800348dc67 : fffffa8011042aa0 fffffa8011042aa0 fffff880034c28a0 fffff880034b1c90 : afd!AfdFreeEndpointTditl+0x21

fffff880025feb10 fffff800033cdc23 : fffffa8007d26140 fffffa80080a1850 fffff800032822d8 fffffa80066b6660 : afd!AfdDoWork+0x67

fffff880025feb40 fffff800030e24b5 : 0000000000000000 fffff800033cdc01 fffffa80066b6600 fffff800032822d8 : nt!IopProcessWorkItem+0x23

fffff880025feb70 fffff80003372456 : 0000000000000000 fffffa80066b6660 0000000000000080 fffffa80066ab040 : nt!ExpWorkerThread+0x111

fffff880025fec00 fffff800030ca2c6 : fffff88002465180 fffffa80066b6660 fffff8800246ffc0 0000000000000000 : nt!PspSystemThreadStartup+0x5a

fffff880025fec40 0000000000000000 : fffff880025ff000 fffff880025f9000 fffff880025fe8a0 0000000000000000 : nt!KiStartSystemThread+0x16

STACK_COMMAND: kb

FOLLOWUP_IP:

nt!ExDeferredFreePool+257

fffff800`03210b23 4c3918          cmp     qword ptr [rax],r11

SYMBOL_STACK_INDEX: 3

SYMBOL_NAME: nt!ExDeferredFreePool+257

FOLLOWUP_NAME: Pool_corruption

IMAGE_NAME: Pool_Corruption

DEBUG_FLR_IMAGE_TIMESTAMP: 0

MODULE_NAME: Pool_Corruption

FAILURE_BUCKET_ID: X64_0xC5_2_nt!ExDeferredFreePool+257

BUCKET_ID: X64_0xC5_2_nt!ExDeferredFreePool+257

Followup: Pool_corruption

感激不盡
此答案是否有帮助?

0 个注释无注释
匿名

2014-09-16T04:05:13+00:00

您好，

建议您将所有的安全防护类软件卸载掉，然后通过Windows update 更新系统补丁再次确认问题。

Answers 论坛无法提供其他私人服务哦，您也可以拨打微软客服电话，有在线工程师可以远程帮助您操作：

固话拨打800-820-3800

手机拨打400-820-3800
此答案是否有帮助?

0 个注释无注释