求高人帮忙看我蓝屏错的minidump文件

leohart

出错的都是这个错:
UNEXPECTED_KERNEL_MODE_TRAP_M (1000007f)

贴上用windbg看的其中一个结果,这个ms是windows的远程服务的一个驱动,wanarp.sys的问题,其他也有pacer.sys出错(windows的qos包服务),不过俺还是怀疑是ac的问题,因为好几次都是在ac下切网络或者开vpn的时候蓝屏

Microsoft (R) Windows Debugger Version 6.9.0003.113 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Windows\Minidump\Mini100408-02.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*DownstreamStore*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows Server 2008 Kernel Version 6001 (Service Pack 1) MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 6001.18063.x86fre.vistasp1_gdr.080425-1930
Kernel base = 0x81c07000 PsLoadedModuleList = 0x81d1ec70
Debug session time: Sat Oct  4 17:23:50.245 2008 (GMT+8)
System Uptime: 0 days 1:33:28.934
Loading Kernel Symbols
............................................................................................................................................................................
Loading User Symbols
Loading unloaded module list
......
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1000007F, {8, 80154000, 0, 0}

Unable to load image \SystemRoot\system32\DRIVERS\klim6.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for klim6.sys
*** ERROR: Module load completed but symbols could not be loaded for klim6.sys
Probably caused by : wanarp.sys ( wanarp!WanNdisSendComplete+45 )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

UNEXPECTED_KERNEL_MODE_TRAP_M (1000007f)
This means a trap occurred in kernel mode, and it's a trap of a kind
that the kernel isn't allowed to have/catch (bound trap) or that
is always instant death (double fault).  The first number in the
bugcheck params is the number of the trap (8 = double fault, etc)
Consult an Intel x86 family manual to learn more about what these
traps are. Here is a *portion* of those codes:
If kv shows a taskGate
        use .tss on the part before the colon, then kv.
Else if kv shows a trapframe
        use .trap on that value
Else
        .trap on the appropriate frame will show where the trap was taken
        (on x86, this will be the ebp that goes with the procedure KiTrap)
Endif
kb will then show the corrected stack.
Arguments:
Arg1: 00000008, EXCEPTION_DOUBLE_FAULT
Arg2: 80154000
Arg3: 00000000
Arg4: 00000000

Debugging Details:
------------------


BUGCHECK_STR:  0x7f_8

CUSTOMER_CRASH_COUNT:  2

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

PROCESS_NAME:  svchost.exe

CURRENT_IRQL:  2

LAST_CONTROL_TRANSFER:  from 95612ab3 to 87af41e9

STACK_TEXT:  
b4c4b00c 95612ab3 84a73d90 00000004 00000000 ndis!NdisFreeNetBufferListContext+0x4b
b4c4b04c 87b9b41e 0cabb1e4 00000000 84a73d90 wanarp!WanNdisSendComplete+0x45
b4c4b080 87ad04f1 8c5410e8 84a73d90 00000000 ndis!ndisMSendCompleteNetBufferListsInternal+0xb8
b4c4b094 8f7e30ee 9481f408 84a73d90 00000000 ndis!NdisFSendNetBufferListsComplete+0x1a
b4c4b0b8 87ad04f1 94859808 00000000 00000000 pacer!PcFilterSendNetBufferListsComplete+0xba
b4c4b0cc 953f1ebb 9484f578 84a73d90 00000000 ndis!NdisFSendNetBufferListsComplete+0x1a
WARNING: Stack unwind information not available. Following frames may be wrong.
00000000 00000000 00000000 00000000 00000000 klim6+0x1ebb


STACK_COMMAND:  kb

FOLLOWUP_IP:
wanarp!WanNdisSendComplete+45
95612ab3 6a0e            push    0Eh

SYMBOL_STACK_INDEX:  1

SYMBOL_NAME:  wanarp!WanNdisSendComplete+45

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: wanarp

IMAGE_NAME:  wanarp.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4791910f

FAILURE_BUCKET_ID:  0x7f_8_wanarp!WanNdisSendComplete+45

BUCKET_ID:  0x7f_8_wanarp!WanNdisSendComplete+45

Followup: MachineOwner
---------

附上其他几个minidump,我的机器是w500

leohart

0: kd> lmvm wanarp
start    end        module name
9560a000 9561d000   wanarp     (pdb symbols)          DownstreamStore\wanarp.pdb\F87D0AD0018647F2838844672D839D411\wanarp.pdb
    Loaded symbol image file: wanarp.sys
    Mapped memory image file: DownstreamStore\wanarp.sys\4791910F13000\wanarp.sys
    Image path: \SystemRoot\system32\DRIVERS\wanarp.sys
    Image name: wanarp.sys
    Timestamp:        Sat Jan 19 13:56:31 2008 (4791910F)
    CheckSum:         00011F6B
    ImageSize:        00013000
    File version:     6.0.6001.18000
    Product version:  6.0.6001.18000
    File flags:       0 (Mask 3F)
    File OS:          40004 NT Win32
    File type:        3.6 Driver
    File date:        00000000.00000000
    Translations:     0409.04b0
    CompanyName:      Microsoft Corporation
    ProductName:      Microsoft® Windows® Operating System
    InternalName:     WANARP.SYS
    OriginalFilename: WANARP.SYS
    ProductVersion:   6.0.6001.18000
    FileVersion:      6.0.6001.18000 (longhorn_rtm.080118-1840)
    FileDescription:  MS Remote Access and Routing ARP Driver
    LegalCopyright:   © Microsoft Corporation. All rights reserved.

leohart

0: kd> lmvm pacer
start    end        module name
953e9000 953ff000   pacer      (pdb symbols)          DownstreamStore\pacer.pdb\0AC27E0ED2534FEE962FEF01D300B20C1\pacer.pdb
    Loaded symbol image file: pacer.sys
    Mapped memory image file: DownstreamStore\pacer.sys\47F6D42616000\pacer.sys
    Image path: \SystemRoot\system32\DRIVERS\pacer.sys
    Image name: pacer.sys
    Timestamp:        Sat Apr 05 09:21:42 2008 (47F6D426)
    CheckSum:         00016C8B
    ImageSize:        00016000
    File version:     6.0.6001.18046
    Product version:  6.0.6001.18046
    File flags:       0 (Mask 3F)
    File OS:          40004 NT Win32
    File type:        3.6 Driver
    File date:        00000000.00000000
    Translations:     0409.04b0
    CompanyName:      Microsoft Corporation
    ProductName:      Microsoft® Windows® Operating System
    InternalName:     pacer.sys
    OriginalFilename: pacer.sys
    ProductVersion:   6.0.6001.18046
    FileVersion:      6.0.6001.18046 (vistasp1_gdr.080404-1506)
    FileDescription:  QoS Packet Scheduler
    LegalCopyright:   © Microsoft Corporation. All rights reserved.

leohart

就是这两个东西作怪

leohart

顶下...w500用的人不是很多,不知道有没有买一代tp的xd有跟我同样的问题...

leohart

ding

zhaochuan

难道是发包的时候CPU出错？
不会用Windbg，等高手上来吧。