火绒安全软件

标题: Windows10 总是时不时的蓝屏 [打印本页]
作者: 18023302    时间: 2021-7-24 21:22
标题: Windows10 总是时不时的蓝屏
进图就是时不时这个样子 玩游戏也有 不玩也有
QQ图片20210724212234.jpg
作者: 18023302    时间: 2021-7-24 21:25
@火绒运营专员
作者: 18023302    时间: 2021-7-24 22:52
标题: 温十系统电脑总是蓝屏 有什么办法么
如图 总是时不时的蓝屏 玩游戏 挂机 以前也有没今天出现频率高 今天出现三四次 @火绒运营专员  
QQ图片20210724212234.jpg
作者: Bob0800    时间: 2021-7-25 08:44
有全盘扫描过了吗？
作者: 一只野生的屑    时间: 2021-7-25 09:13
提示: 作者被禁止或删除 内容自动屏蔽
作者: 一只野生的屑    时间: 2021-7-25 09:17
提示: 作者被禁止或删除 内容自动屏蔽
作者: 你来打我呀    时间: 2021-7-25 09:26
请查看C:\Windows\Minidump 下有没有文件，有就最好发上来
作者: 火绒运营专员    时间: 2021-7-25 09:51
您好，您看下您那儿是否有蓝屏的dump文件，如果有的话您跟帖上传我们分析看下~

dump提取位置：%SystemRoot%\MEMORY.DMP
%SystemRoot%\Minidump\*.dmp
作者: 18023302    时间: 2021-7-25 10:25
Bob0800 发表于 2021-7-25 08:44
有全盘扫描过了吗？

全盘没问题
作者: 18023302    时间: 2021-7-25 10:28
你来打我呀 发表于 2021-7-25 09:26
请查看C:\Windows\Minidump 下有没有文件，有就最好发上来

没文件                        
作者: 18023302    时间: 2021-7-25 10:30
火绒运营专员 发表于 2021-7-25 09:51
您好，您看下您那儿是否有蓝屏的dump文件，如果有的话您跟帖上传我们分析看下~

dump提取位置：%SystemRoot ...

在哪里提取啊              
作者: 火绒运营专员    时间: 2021-7-25 10:34
18023302 发表于 2021-7-25 10:30
在哪里提取啊

dump提取位置：
C:\Windows\MEMORY.DMP
C:\Windows\Minidump\*.dmp
作者: 18023302    时间: 2021-7-25 10:43
火绒运营专员 发表于 2021-7-25 10:34
dump提取位置：
C:\Windows\MEMORY.DMP
C:\Windows\Minidump\*.dmp

第二个没文件 第一个C盘都没有
作者: 火绒运营专员    时间: 2021-7-25 10:56
18023302 发表于 2021-7-25 10:43
第二个没文件 第一个C盘都没有

那就是没有生成dump文件呢，您可以看下“启动和故障恢复”的位置是否有勾选“将事件写入系统日志”
作者: 18023302    时间: 2021-7-25 11:01
火绒运营专员 发表于 2021-7-25 10:56
那就是没有生成dump文件呢，您可以看下“启动和故障恢复”的位置是否有勾选“将事件写入系统日志” ...

有勾选  这样是不是需要等下次蓝屏才有
作者: Bob0800    时间: 2021-7-25 11:14
18023302 发表于 2021-7-24 22:52
如图 总是时不时的蓝屏 玩游戏 挂机 以前也有没今天出现频率高 今天出现三四次 @火绒运营专员  
...

应该是硬件问题吧
作者: 18023302    时间: 2021-7-25 11:27
Bob0800 发表于 2021-7-25 11:14
应该是硬件问题吧

原装电脑就加了一个内存
作者: huolongguo10    时间: 2021-7-25 11:28
18023302 发表于 2021-7-25 11:27
原装电脑就加了一个内存

拆了试试
作者: 18023302    时间: 2021-7-25 11:45
huolongguo10 发表于 2021-7-25 11:28
拆了试试

试过没用 还是蓝屏
作者: Bob0800    时间: 2021-7-25 11:59
18023302 发表于 2021-7-25 11:45
试过没用 还是蓝屏

硬盘重插呢？
作者: huolongguo10    时间: 2021-7-25 12:25
Bug Check 0x1A: MEMORY_MANAGEMENT
02/04/2020
7 minutes to read




The MEMORY_MANAGEMENT bug check has a value of 0x0000001A. This indicates that a severe memory management error occurred.

Important

This topic is for programmers. If you are a customer who has received a blue screen error code while using your computer, see Troubleshoot blue screen errors.

MEMORY_MANAGEMENT Parameters
Parameter 1 identifies the exact violation.

MEMORY_MANAGEMENT PARAMETERS
Parameter 1        Cause of Error
0x1

The fork clone block reference count is corrupt. This only occurs on checked builds of Windows. Checked builds were available on older versions of Windows, before Windows 10 version 1803.

0x31

The image relocation fix-up table or code stream has been corrupted. This is probably a hardware error.

0x3f

An inpage operation failed with a CRC error. Parameter 2 contains the pagefile offset. Parameter 3 contains the page CRC value. Parameter 4 contains the expected CRC value.

0x403

The page table and PFNs are out of sync . This is probably a hardware error, especially if parameters 3 & 4 differ by only a single bit.

0x404

In the process of deleting a system page there was an inconsistency between the Page Frame Number (PFN) and the current Page Table Entry (PTE) pointer. Parameter 2 is the expected PTE. Parameter 3 is the PTE contents and parameter 4 is the PFN’s PTE.

0x411

A page table entry (PTE) has been corrupted. Parameter 2 is the address of the PTE.

0x777

The caller is unlocking a system cache address that is not currently locked. (This address was either never mapped or is being unlocked twice.)

0x778

The system is using the very last system cache view address, instead of preserving it.

0x780

0x781

The PTEs mapping the argument system cache view have been corrupted.

0x1000

A caller of MmGetSystemAddressForMdl* tried to map a fully-cached physical page as non-cached. This action would cause a conflicting hardware translation buffer entry, and so it was refused by the operating system. Since the caller specified "bug check on failure" in the requesting MDL, the system had no choice but to issue a bug check in this instance.

0x1010

The caller is unlocking a pageable section that is not currently locked. (This section was either never locked or is being unlocked twice.)

0x1233

A driver tried to map a physical memory page that was not locked. This is illegal because the contents or attributes of the page can change at any time. This is a bug in the code that made the mapping call. Parameter 2 is the page frame number of the physical page that the driver attempted to map.

0x1234

The caller is trying lock a nonexistent pageable section.

0x1235

The caller is trying to protect an MDL with an invalid mapping.

0x1236

The caller specified an MDL that contains an unlocked (or invalid) physical page. Parameter 2 contains a pointer to the MDL. Parameter 3 contains a pointer to the invalid PFN. Parameter 4 contains the invalid PFN value.

0x1240

It is illegal for callers to build an MDL for a virtual address range that is not resident. Parameter 2 is the Memory Descriptor List (MDL) and Parameter 3 is the PTE pointer.

0x1241

The virtual address for the MDL was unexpectedly asynchronously unmapped midway through the call to build the MDL. Parameter 2 is the MDL, Parameter 3 is the PTE pointer.

0x3300

In the process of performing a write, the referenced virtual address is mistakenly marked as copy on write. Parameter 2 is the FaultingAddress. Parameter 3 is the PTE contents. Parameter 4 indicates the virtual address space type.

0x3451

The PTEs of a kernel thread stack that has been swapped out are corrupted.

0x3453

All the page table pages of an exited process could not be deleted due to outstanding references. This typically indicates corruption in the process’ page table structures.

0x3470

A cached kernel stack was corrupted while on the freelist – this memory corruption indicates a serious problem of which the calling stack may be a victim or a culprit. Parameter 2 is Virtual Address (VA), Parameter 3 is the VA Cookie.

0x4477

A driver tried to write to an unallocated address in the user space of the system process. Parameter 2 contains the address of the attempted write.

0x5003

The working set free list is corrupt. This is probably a hardware error.

0x5100

The allocation bitmap is corrupt. The memory manager is about to overwrite a virtual address that was already in use.

0x5200

A page on a free pool SLIST has been corrupted. This can be the result of a write-after-free bug in a driver, or an overrun from a previous page. Parameter 2 contains the address of a free pool block. Parameter 4 contains the value that was expected to be at that address. Parameter 3 contains the actual value that was found.

0x5305

The caller is specifying an invalid pool address (parameter 2) to free. Parameter 2 is Virtual Address (VA) being evaluated, Parameter 3 is the region size.

0x6001

The memory store component’s private memory range is corrupted, causing it to become inaccessible. Parameter 2 is the returned status. Parameter 3 is the virtual address in the store’s private memory range. Parameter 4 is the MemoryDescriptorList.

0x8884

0x8885

0x8886

0x8887

(Windows 7 and later). Two pages on the standby list that were supposed to have identical page priority values do not, in fact, have identical page priority values. The differing values are captured in parameter 4.

0x8888

0x8889

Internal memory management structures are corrupted.

0x888A

Internal memory management structures (likely the PTE or PFN) are corrupted.

0x9696

A PFN (parameter 2) was encountered with a corrupted linkage no longer connected to its top level process. This indicates corruption in the PFN structures.

0x15000

The caller is supplying either the wrong address or is calling this routine in the wrong process context. Both are illegal because we cannot unsecure a range we cannot find due to this error. Parameter 2 is the Virtual Address (VA) being evaluated.

0x15001

An error occurred In the process of un-securing memory that was previously secured. This can happen when the caller mistakenly invoked MmUnsecureVirtualMemory in the wrong process context.

0x41201

In the process of querying a virtual address, there was an inconsistency between the Page Frame Number(PFN) and the current Page Table Entry (PTE) pointer. Parameter 2 is the corresponding PTE. Parameter 3 is the PTE contents and parameter 4 is the virtual address descriptor.

0x41202

In the process of determining the page protection of a non-zero PTE, it was determined that the PTE is corrupt. Parameter 2 is the PTE pointer, Parameter 3 is the PTE contents and Parameter 4 is Virtual Address Descriptor (VAD).

0x41283

The working set index encoded in the PTE is corrupted.

0x41284

A PTE or the working set list is corrupted.

0x41286

The caller is trying to free an invalid pool address.

0x41785

The working set list is corrupted.

0x41287

An illegal page fault occurred while holding working set synchronization. Parameter 2 contains the referenced virtual address.

0x41790

A page table page has been corrupted. On a 64 bit version of Windows, parameter 2 contains the address of the PFN for the corrupted page table page. On a 32 bit version of Windows, parameter 2 contains a pointer to the number of used PTEs, and parameter 3 contains the number of used PTEs.

0x41792

A corrupted PTE has been detected. Parameter 2 contains the address of the PTE. Parameters 3/4 contain the low/high parts of the PTE.

0x41793

A page table page has been corrupted. Parameter 2 contains a pointer to the last processed PTE. Parameter 3 contains the number of non-zero PTEs found. Parameter 4 contains the expected number of non-zero PTEs in the page table.

This memory parameter has been deprecated and is no longer available after Windows 10 version 1803.

0x61940

A PDE has been unexpectedly invalidated.

0x61941

The paging hierarchy is corrupt. Parameter 2 is a pointer to the virtual address which caused the fault.

0x61946

The MDL being created is flawed. This almost always means the driver calling MmProbeAndLockPages is at fault. Typically the driver is attempting to create a Write MDL when it is being asked to process a paging Read.

0x61948

In the process of decrementing the reference counts for an I/O space region, its accounting node could not be found. Typically this means the argument range was never locked or has already been unlocked. Parameter 2 is the base I/O frame. Parameter 3 is the number of pages in the region, and parameter 4 is the specific I/O frame whose node could not be found.

0x61949

The IoPageFrameNode is null. Parameter 2 is PageFrameIndex.

0x6194A

An error occurred when decrementing the reference counts on I/O space physical pages which are being unmapped. An entry which is not currently referenced is being dereferenced. Parameter 2 and 3 describe the caller’s I/O space range being unmapped, and parameter 4 is the I/O space physical page which is expected to be referenced but is not.

0x03030303

The boot loader is broken. (This value applies only to Intel Itanium machines.)

0x03030308

The range to remove (or truncate) is in use by the loader so it cannot be safely removed, so the system must issue a stop code. Parameter 2 is HighestPhysicalPage.

Resolution
The !analyze debug extension displays information about the bug check and can be helpful in determining the root cause.

Running the Windows Memory Diagnostic tool could be useful as well to exclude any kind of problem affecting the physical memory modules.









需要dump
作者: 18023302    时间: 2021-7-25 12:34
Bob0800 发表于 2021-7-25 11:59
硬盘重插呢？

没试过 不过我不知道怎么弄
作者: 18023302    时间: 2021-7-25 13:30
@火绒运营专员    这是刚才蓝屏出来的文件 是这个吧

072521-38546-01.zip

350.75 KB, 下载次数: 4, 下载积分: 金钱 -1

作者: 火绒运营专员    时间: 2021-7-25 14:20
18023302 发表于 2021-7-25 13:30
@火绒运营专员    这是刚才蓝屏出来的文件 是这个吧

是的，我们看下蓝屏的dump之后给您回复~
作者: 18023302    时间: 2021-7-25 15:51
火绒运营专员 发表于 2021-7-25 14:20
是的，我们看下蓝屏的dump之后给您回复~

好的 谢谢
作者: 18023302    时间: 2021-7-25 21:03
这是刚才有出现的@火绒运营专员

072521-33968-02.zip

173.85 KB, 下载次数: 3, 下载积分: 金钱 -1

作者: 火绒运营专员    时间: 2021-7-26 10:33
18023302 发表于 2021-7-25 21:03
这是刚才有出现的@火绒运营专员

好的，收到~
作者: huolongguo10    时间: 2021-7-26 12:26
18023302 发表于 2021-7-25 21:03
这是刚才有出现的@火绒运营专员

In the process of querying a virtual address, there was an inconsistency between the Page Frame Number(PFN) and the current Page Table Entry (PTE) pointer. Parameter 2 is the corresponding PTE. Parameter 3 is the PTE contents and parameter 4 is the virtual address descriptor
作者: huolongguo10    时间: 2021-7-26 12:31
可能需要MEMERY.DMP，我这分析不出来，有一个RetAddr为0地址的函数、
  1. STACK_TEXT:  
  2. fffffc89`823ca448 fffff802`76e17cde : 00000000`0000001a 00000000`00041201 ffffe680`002e1f80 84000002`c4ce0847 : nt!KeBugCheckEx
  3. fffffc89`823ca450 fffff802`76c91431 : ffffe680`002e1f88 84000002`c4ce0847 00000000`00000002 ffffe6f3`40001708 : nt!MiGetPageProtection+0x1872ee
  4. fffffc89`823ca4c0 fffff802`76d099f4 : ffff9984`579a5580 00000000`5c200000 00000000`5d090000 fffff802`76c2f944 : nt!MiQueryAddressState+0x5c1
  5. fffffc89`823ca6e0 fffff802`771e3e77 : fffffc89`00000000 00000000`00000004 fffffc89`00000004 00000052`00000001 : nt!MiQueryAddressSpan+0x1d4
  6. fffffc89`823ca7a0 fffff802`771e3915 : ffffdc47`e5ee91af 00000000`00000000 00000000`00000ef6 fffffc89`823caa80 : nt!MmQueryVirtualMemory+0x557
  7. fffffc89`823ca940 fffff802`76dd4555 : ffff9984`4b8bc900 00000000`00000000 00000000`77566d4d fffffc89`823ca900 : nt!NtQueryVirtualMemory+0x25
  8. fffffc89`823ca990 00007ffb`ed1bc524 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x25
  9. 00000052`73f0f218 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x00007ffb`ed1bc524
复制代码


作者: 火绒运营专员    时间: 2021-7-26 13:08
18023302 发表于 2021-7-25 21:03
这是刚才有出现的@火绒运营专员

您好，经分析，蓝屏原因与火绒无关。在初步查看dmp文件后发现造成蓝屏的原因是在系统文件里，建议您排查下系统环境和硬件环境。感谢您的反馈~
作者: huolongguo10    时间: 2021-7-26 14:20
火绒运营专员 发表于 2021-7-26 13:08
您好，经分析，蓝屏原因与火绒无关。在初步查看dmp文件后发现造成蓝屏的原因是在系统文件里，建议您排查 ...
  1. 00000052`73f0f218 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x00007ffb`ed1bc524
复制代码


看下这个，好像是用户态地址
作者: huolongguo10    时间: 2021-7-26 16:17
https://qastack.cn/superuser/1021027/what-is-causing-this-windows-10-blue-screen-memory_management-ntoskrnlexe
作者: 18023302    时间: 2021-7-26 18:47
火绒运营专员 发表于 2021-7-26 13:08
您好，经分析，蓝屏原因与火绒无关。在初步查看dmp文件后发现造成蓝屏的原因是在系统文件里，建议您排查 ...

怎么排查？        
作者: 火绒运营专员    时间: 2021-7-26 18:50
18023302 发表于 2021-7-26 18:47
怎么排查？

可以先找个时间重新安装系统, 如果仍然存在问题, 建议前往售后检查硬件~
作者: 18023302    时间: 2021-7-26 18:56
huolongguo10 发表于 2021-7-26 16:17
https://qastack.cn/superuser/1021027/what-is-causing-this-windows-10-blue-screen-memory_management-n ...

这个要怎么操作啊
作者: 18023302    时间: 2021-7-26 22:07
火绒运营专员 发表于 2021-7-26 18:50
可以先找个时间重新安装系统, 如果仍然存在问题, 建议前往售后检查硬件~

重装过系统 还是这个样子 是不是只能检查硬件了
作者: huolongguo10    时间: 2021-7-27 10:13
18023302 发表于 2021-7-26 18:56
这个要怎么操作啊

但如果你有时间，这里有一个不完整的列表，没有保证：

删除并重新安装音频驱动程序。
更新所有驱动程序
运行RAM测试。
取代预防措施更换RAM。
删除您的防病毒软件并考虑另一个。
确保你没有病毒，恶意软件......
跑 sfc /scannow 和Microsoft的SUR或DISM实用程序来检查系统运行状况。
重新安装操作系统。
继续更换硬件，直到碎片消失。
作者: 18023302    时间: 2021-7-27 10:23
huolongguo10 发表于 2021-7-27 10:13
但如果你有时间，这里有一个不完整的列表，没有保证：

删除并重新安装音频驱动程序。

好吧 谢谢



欢迎光临 火绒安全软件 (https://bbs.huorong.cn/) Powered by Discuz! X3.4