蓝屏

Question

Microsoft (R) Windows Debugger Version 6.10.0003.233 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [I:\新建文件夹\MEMORY.DMP]
Kernel Summary Dump File: Only kernel address space is available

Symbol search path is: SRV*d:\DebugSymbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7600 MP (16 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.17273.x86fre.win7_gdr.130318-1532
Machine Name:
Kernel base = 0x84a41000 PsLoadedModuleList = 0x84b89810
Debug session time: Wed May  2 18:27:11.010 2018 (GMT+8)
System Uptime: 0 days 7:45:40.946
Loading Kernel Symbols
...............................................................
................................................................
.........Page 10fd9 not present in the dump file. Type ".hh dbgerr004" for details
..........Page 42080 not present in the dump file. Type ".hh dbgerr004" for details
.........................
Loading User Symbols
PEB is paged out (Peb.Ldr = 7ffda00c).  Type ".hh dbgerr001" for details
Loading unloaded module list
......
0: kd> !analvze -v
No export analvze found
0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

KERNEL_MODE_EXCEPTION_NOT_HANDLED (8e)
This is a very common bugcheck.  Usually the exception address pinpoints
the driver/function that caused the problem.  Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003.  This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG.  This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG.  This will let us see why this breakpoint is
happening.
Arguments:
Arg1: 80000004, The exception code that was not handled
Arg2: ffdff2a5, The address that the exception occurred at
Arg3: a5154d48, Trap Frame
Arg4: 00000000

Debugging Details:
------------------

Page 10fd9 not present in the dump file. Type ".hh dbgerr004" for details
Page 10fd9 not present in the dump file. Type ".hh dbgerr004" for details
Page 42080 not present in the dump file. Type ".hh dbgerr004" for details
PEB is paged out (Peb.Ldr = 7ffda00c).  Type ".hh dbgerr001" for details
Page 10fd9 not present in the dump file. Type ".hh dbgerr004" for details
Page 42080 not present in the dump file. Type ".hh dbgerr004" for details
PEB is paged out (Peb.Ldr = 7ffda00c).  Type ".hh dbgerr001" for details

EXCEPTION_CODE: (HRESULT) 0x80000004 (2147483652) - <Unable to get error code text>

FAULTING_IP: 
+ffffffffffdff2a5
ffdff2a5 c3              ret

TRAP_FRAME:  a5154d48 -- (.trap 0xffffffffa5154d48)
ErrCode = 00000000
eax=00000000 ebx=84a835b0 ecx=00000000 edx=00000000 esi=02f7fbac edi=00135701
eip=ffdff2a5 esp=a5154dbc ebp=801ec000 iopl=0         ov dn di ng nz na pe nc
cs=0008  ss=0010  ds=0023  es=0023  fs=0030  gs=0000             efl=00044c86
ffdff2a5 c3              ret
Resetting default scope

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0x8E

PROCESS_NAME:  360sd.exe

CURRENT_IRQL:  0

LAST_CONTROL_TRANSFER:  from 84afe532 to 84b1db3c

STACK_TEXT:  
a51548b4 84afe532 0000008e 80000004 ffdff2a5 nt!KeBugCheckEx+0x1e
a5154cd8 84a842c6 a5154cf4 00000000 a5154d48 nt!KiDispatchException+0x1ac
a5154d40 84a84262 801ec000 ffdff2a5 badb0d00 nt!CommonDispatchException+0x4a
a5154d48 ffdff2a5 badb0d00 00000000 ffffffff nt!Kei386EoiHelper+0x17a
WARNING: Frame IP not in any known module. Following frames may be wrong.
a5154d4c badb0d00 00000000 ffffffff 0000003b 0xffdff2a5
a5154d50 00000000 ffffffff 0000003b 00000000 0xbadb0d00


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt!KiDispatchException+1ac
84afe532 cc              int     3

SYMBOL_STACK_INDEX:  1

SYMBOL_NAME:  nt!KiDispatchException+1ac

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrpamp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  5147d3b2

FAILURE_BUCKET_ID:  0x8E_nt!KiDispatchException+1ac

BUCKET_ID:  0x8E_nt!KiDispatchException+1ac

Followup: MachineOwner
---------

0: kd> !process
PROCESS 89b4e0e8  SessionId: 1  Cid: 0dcc    Peb: 7ffda000  ParentCid: 065c
    DirBase: 779af7e0  ObjectTable: a11c9e40  HandleCount: 292.
    Image: 360sd.exe
    VadRoot 897e4130 Vads 423 Clone 0 Private 8430. Modified 98082. Locked 0.
    DeviceMap 97939c78
    Token                             a11ba978
    ElapsedTime                       07:44:59.431
    UserTime                          00:00:00.000
    KernelTime                        00:00:00.046
    QuotaPoolUsage[PagedPool]         0
    QuotaPoolUsage[NonPagedPool]      0
    Working Set Sizes (now,min,max)  (413, 122, 244) (1652KB, 488KB, 976KB)
    PeakWorkingSetSize                11883
    VirtualSize                       174 Mb
    PeakVirtualSize                   192 Mb
    PageFaultCount                    317066
    MemoryPriority                    BACKGROUND
    BasePriority                      8
    CommitCharge                      10847

        THREAD 89abfd48  Cid 0dcc.0dd0  Teb: 7ffdf000 Win32Thread: fcb297e0 WAIT: (WrUserRequest) UserMode Non-Alertable
            898045d0  SynchronizationEvent

        THREAD 8852a830  Cid 0dcc.0dd8  Teb: 7ffde000 Win32Thread: 00000000 WAIT: (UserRequest) UserMode Alertable
            89aec030  NotificationEvent

        THREAD 89b78918  Cid 0dcc.0ddc  Teb: 7ffdd000 Win32Thread: 00000000 WAIT: (UserRequest) UserMode Non-Alertable
            89aec030  NotificationEvent
            89adb3c8  Semaphore Limit 0x7fffffff

        THREAD 89b78d48  Cid 0dcc.0de0  Teb: 7ffdc000 Win32Thread: 00000000 WAIT: (UserRequest) UserMode Alertable
            89ac2970  NotificationEvent

        THREAD 89addd48  Cid 0dcc.0de4  Teb: 7ffdb000 Win32Thread: 00000000 WAIT: (UserRequest) UserMode Non-Alertable
            89ac2970  NotificationEvent
            89b787f0  Semaphore Limit 0x7fffffff

        THREAD 89ca3d48  Cid 0dcc.0ee4  Teb: 7ffd8000 Win32Thread: 00000000 WAIT: (UserRequest) UserMode Non-Alertable
            883f8ebc  NotificationEvent

        THREAD 89ca15b8  Cid 0dcc.0ee8  Teb: 7ffd7000 Win32Thread: 00000000 WAIT: (UserRequest) UserMode Alertable
            89803960  NotificationEvent

        THREAD 89ca12d0  Cid 0dcc.0eec  Teb: 7ffd6000 Win32Thread: 00000000 RUNNING on processor 0
        THREAD 89ca37b0  Cid 0dcc.0ef0  Teb: 7ffd5000 Win32Thread: fdb934f8 WAIT: (UserRequest) UserMode Non-Alertable
            89803960  NotificationEvent
            89c47be0  Semaphore Limit 0x7fffffff

        THREAD 89ca34c8  Cid 0dcc.0ef4  Teb: 7ffd4000 Win32Thread: 00000000 WAIT: (UserRequest) UserMode Alertable
            897ffa00  NotificationEvent

        THREAD 89ca31e0  Cid 0dcc.0ef8  Teb: 7ffd3000 Win32Thread: 00000000 WAIT: (UserRequest) UserMode Non-Alertable
            897ffa00  NotificationEvent
            897ffe70  Semaphore Limit 0x7fffffff

        THREAD 897a6cb8  Cid 0dcc.0f00  Teb: 7ff9e000 Win32Thread: fe72fdd8 WAIT: (DelayExecution) UserMode Non-Alertable
            893c0540  SynchronizationEvent

        THREAD 89ca46d0  Cid 0dcc.0f04  Teb: 7ff9d000 Win32Thread: 00000000 WAIT: (UserRequest) UserMode Non-Alertable
            89c99178  NotificationEvent
            897a7238  NotificationEvent

        THREAD 897a68a0  Cid 0dcc.0f08  Teb: 7ff9c000 Win32Thread: 00000000 WAIT: (UserRequest) UserMode Non-Alertable
            89c600d8  SynchronizationEvent
            897a53f0  SynchronizationEvent

        THREAD 89dacd48  Cid 0dcc.11c0  Teb: 7ffd9000 Win32Thread: 00000000 WAIT: (UserRequest) UserMode Non-Alertable
            89b75b18  NotificationEvent
            89cc9798  SynchronizationEvent

        THREAD 89d98d48  Cid 0dcc.11c4  Teb: 7ff9b000 Win32Thread: 00000000 WAIT: (DelayExecution) UserMode Non-Alertable
            87850ce4  NotificationEvent

        THREAD 89cb7360  Cid 0dcc.0df8  Teb: 7ff9a000 Win32Thread: 00000000 WAIT: (UserRequest) UserMode Alertable
            8941e280  SynchronizationTimer
            8825d658  SynchronizationTimer
            89c8bcb0  SynchronizationTimer
            880de898  SynchronizationTimer
            89dd7818  SynchronizationTimer

        THREAD 89c63d48  Cid 0dcc.0cbc  Teb: 7ff9f000 Win32Thread: fe532568 WAIT: (UserRequest) UserMode Non-Alertable
            87428328  NotificationEvent
            894007b0  SynchronizationEvent

        THREAD 89db1030  Cid 0dcc.1700  Teb: 7ff99000 Win32Thread: 00000000 WAIT: (UserRequest) UserMode Non-Alertable
            89c1e208  SynchronizationEvent
            8858d848  SynchronizationEvent

        THREAD 8950f3e8  Cid 0dcc.16d8  Teb: 7ff98000 Win32Thread: 00000000 WAIT: (UserRequest) UserMode Non-Alertable
            89da9c20  NotificationEvent
            86dd7120  NotificationEvent
            88502e08  SynchronizationEvent

        THREAD 88d2a418  Cid 0dcc.0e50  Teb: 7ff96000 Win32Thread: 00000000 WAIT: (UserRequest) UserMode Non-Alertable
            880e1680  NotificationEvent
            89db65b0  NotificationEvent

        THREAD 86d5d788  Cid 0dcc.17f4  Teb: 7ff94000 Win32Thread: 00000000 WAIT: (WrQueue) UserMode Alertable
            8945e5c0  QueueObject

        THREAD 898ccd48  Cid 0dcc.12ac  Teb: 7ff92000 Win32Thread: 00000000 WAIT: (WrQueue) UserMode Alertable
            8945e5c0  QueueObject

        THREAD 878465b0  Cid 0dcc.0fd8  Teb: 7ff97000 Win32Thread: 00000000 WAIT: (WrQueue) UserMode Alertable
            89c91200  QueueObject

        THREAD 86dd3d48  Cid 0dcc.1a40  Teb: 7ff95000 Win32Thread: 00000000 WAIT: (UserRequest) UserMode Non-Alertable
            878f1900  NotificationEvent
            89b75b18  NotificationEvent

Answer 1

卸载垃圾软件 360，它的组件引起的蓝屏。

---

Alexis Zhang

http://mvp.microsoft.com/zh-cn/mvp/Jie%20Zhang-4000545
http://blogs.itecn.net/blogs/alexis

推荐以 NNTP Bridge 桥接新闻组方式访问论坛。

本帖是回复帖，原帖作者是楼上的 <logdemon>；

| KERNEL_MODE_EXCEPTION_NOT_HANDLED (8e)
| This is a very common bugcheck. Usually the exception address pinpoints