本帖最后由 livearn 于 -12-22 16:20 编辑
操作系统环境 :windows server r2 database版
安装了12月份的几个更新程序后反复出现蓝屏,根据dump文件分析怀疑是360netmon.sys所致,退出360就不会出现蓝屏问题,
更新程序代号:KB4471320 KB4471989KB890830KB4470630KB4470639
请官方提供帮助解决!!
dump文件:
Microsoft (R) Windows Debugger Version 6.3.9600.17788 X86
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [C:\Users\Administrator\Desktop\MEMORY.DMP]
Kernel Bitmap Dump File: Only kernel address space is available
Symbol search path is: *** Invalid ***
****************************************************************************
* Symbol loading may be unreliable without a symbol search path. *
* Use .symfix to have the debugger choose a symbol path. *
* After setting your symbol path, use .reload to refresh symbol locations. *
****************************************************************************
Executable search path is:
*********************************************************************
* Symbols can not be loaded because symbol path is not initialized. *
* *
* The Symbol Path can be set by: *
* using the _NT_SYMBOL_PATH environment variable.*
* using the -y argument when starting the debugger. *
* using .sympath and .sympath+ *
*********************************************************************
*** ERROR: Symbol file could not be found.Defaulted to export symbols for ntkrnlmp.exe -
Windows 8 Kernel Version 9600 MP (2 procs) Free x64
Product: Server, suite: TerminalServer DataCenter SingleUserTS
Built by: 9600.19202.amd64fre.winblue_ltsb.181110-0600
Machine Name:
Kernel base = 0xfffff800`0e48e000 PsLoadedModuleList = 0xfffff800`0e752610
Debug session time: Fri Dec 21 14:18:51.952 (UTC + 8:00)
System Uptime: 0 days 0:03:27.870
*********************************************************************
* Symbols can not be loaded because symbol path is not initialized. *
* *
* The Symbol Path can be set by: *
* using the _NT_SYMBOL_PATH environment variable.*
* using the -y argument when starting the debugger. *
* using .sympath and .sympath+ *
*********************************************************************
*** ERROR: Symbol file could not be found.Defaulted to export symbols for ntkrnlmp.exe -
Loading Kernel Symbols
...............................................................
................................................................
............
Loading User Symbols
Loading unloaded module list
.....
************* Symbol Loading Error Summary **************
Module name Error
ntkrnlmpThe system cannot find the file specified
You can troubleshoot most symbol related issues by turning on symbol loading diagnostics (!sym noisy) and repeating the command that caused symbols to be loaded.
You should also verify that your symbol search path (.sympath) is correct.
The call to LoadLibrary(ext) failed, Win32 error 0n2
"系统找不到指定的文件。"
Please check your debugger configuration and/or network access.
The call to LoadLibrary(exts) failed, Win32 error 0n2
"系统找不到指定的文件。"
Please check your debugger configuration and/or network access.
The call to LoadLibrary(kext) failed, Win32 error 0n2
"系统找不到指定的文件。"
Please check your debugger configuration and/or network access.
The call to LoadLibrary(kdexts) failed, Win32 error 0n2
"系统找不到指定的文件。"
Please check your debugger configuration and/or network access.
The call to LoadLibrary(ext) failed, Win32 error 0n2
"系统找不到指定的文件。"
Please check your debugger configuration and/or network access.
The call to LoadLibrary(exts) failed, Win32 error 0n2
"系统找不到指定的文件。"
Please check your debugger configuration and/or network access.
The call to LoadLibrary(kext) failed, Win32 error 0n2
"系统找不到指定的文件。"
Please check your debugger configuration and/or network access.
The call to LoadLibrary(kdexts) failed, Win32 error 0n2
"系统找不到指定的文件。"
Please check your debugger configuration and/or network access.
*******************************************************************************
**
* Bugcheck Analysis *
**
*******************************************************************************
Bugcheck code 000000D1
Arguments 00000000`0000003c 00000000`00000002 00000000`00000001 fffff800`cba8e272
RetAddr : Args to Child : Call Site
fffff800`0e5de529 : 00000000`0000000a 00000000`0000003c 00000000`00000002 00000000`00000001 : nt!KeBugCheckEx
fffff800`0e5dba62 : ffffe000`7b0d4300 ffffe000`7b0d4304 00000010`00000000 ffffe000`00000020 : nt!setjmpex+0x68c9
fffff800`cba8e272 : 00000000`fffffffe ffffe000`7b0d4240 00000000`0000000c 00000000`00005000 : nt!setjmpex+0x3e02
*** ERROR: Module load completed but symbols could not be loaded for tcpip.sys
fffff800`cba8d63f : 00025000`989b009f fffff800`cc6d8936 ffffe000`7b5c7c50 ffffe000`7b0d4240 : tcpip+0x47272
fffff800`cbaaec91 : 00000000`f533b6dc 00000000`0000b6dc 00000000`00000000 00000000`00000000 : tcpip+0x4663f
fffff800`cba84ecc : ffffe000`00000000 00000000`00005134 00000000`00000000 fffff800`cbc01100 : tcpip+0x67c91
fffff800`cbab99ba : ffffe000`78528b40 fffff800`0fad2b88 fffff800`0fad5000 fffff800`cc6d95a0 : tcpip+0x3decc
fffff800`cbab564b : 00000000`00000014 fffff800`0fad2be9 ffffe000`7853c000 00000000`00000001 : tcpip+0x729ba
fffff800`cbab3aa2 : 00000000`00000000 fffff800`0fad2be9 00000000`00000006 fffff800`cbc01180 : tcpip+0x6e64b
fffff800`cbab1e80 : 00000000`00000000 ffffe000`7a621a00 ffffe000`7853c000 ffffe000`7853c000 : tcpip+0x6caa2
fffff800`cbab0ba2 : ffffe000`7a1d81f0 00000000`00000000 fffff800`0fad3001 ffffe000`7b888e00 : tcpip+0x6ae80
fffff800`cbab15c5 : ffffe000`7a1e0002 00000000`00000000 fffff800`cbab1610 fffff800`00000101 : tcpip+0x69ba2
fffff800`0e4c7319 : ffffe000`7853381c ffffe000`78517820 ffffe000`78517810 fffff800`0e7d5a00 : tcpip+0x6a5c5
fffff800`cbab17b6 : fffff800`cbab1470 fffff800`0fad32f0 00000000`00000000 fffff800`00000000 : nt!KeExpandKernelStackAndCalloutEx+0x2fd
*** ERROR: Symbol file could not be found.Defaulted to export symbols for NDIS.SYS -
fffff800`cb29ba53 : 00000000`00000000 fffff800`0fad33a1 00000000`00000001 00000000`00000000 : tcpip+0x6a7b6
fffff800`cb29be7f : ffffe000`7807e008 00000000`00000000 00000000`00000000 fffff800`00000001 : NDIS!NdisAcquireRWLockWrite+0x6b3
fffff800`cb29c094 : ffffe000`785561a0 00000000`00000001 00000000`000033f7 00000000`00000001 : NDIS!NdisAcquireRWLockWrite+0xadf
*** ERROR: Module load completed but symbols could not be loaded for netkvm.sys
fffff800`cc6d4c2c : ffffe000`7877d010 ffffe000`7877d010 fffff800`00000001 fffff800`0fad3718 : NDIS!NdisMIndicateReceiveNetBufferLists+0x114
fffff800`cc6d23f8 : ffffe000`00000001 ffffe000`7a621a00 00000000`0000003f ffffe000`7a621a00 : netkvm+0x5c2c
fffff800`cc6ddbfa : fffff800`0fad37e0 00000000`00000000 00000000`00000000 ffffe000`7877d010 : netkvm+0x33f8
fffff800`cb29de12 : 00000000`00000000 00000000`00000002 00000000`00000001 ffff2b61`07fe5426 : netkvm+0xebfa
fffff800`0e4bc3e0 : 00000000`00000000 00000000`00000002 00000000`00000001 00000000`000000f0 : NDIS!NdisGetThreadObjectCompartmentId+0x472
fffff800`0e4bb727 : 00000000`00000000 00000000`ffffffff 00000000`00000000 00000000`7be917bb : nt!ExAcquireRundownProtectionCacheAwareEx+0xfe0
fffff800`0e5d1faa : fffff800`0e76e180 fffff800`0e76e180 fffff800`0e7d5a00 ffffe000`780c4880 : nt!ExAcquireRundownProtectionCacheAwareEx+0x327
00000000`00000000 : fffff800`0fad4000 fffff800`0face000 00000000`00000000 00000000`00000000 : nt!KeSynchronizeExecution+0x2fba