none
求救帖,0X0000008E蓝屏死机 RRS feed

  • 问题

  •  

    错误代码:0X0000008E(0XC0000005,0X8052E9DB,0XB2AB1C88,0X00000000)

    电脑配置:CPU CORE 6300, 主板 华硕P5B-E plus, 内存 金士顿DDR2 667 1GX2
    操作系统:WINXP SP2 (版本 5.1.2600)



     

    2008年3月8日 13:00

答案

  • tybay.sys导致Windows核心文件崩溃,我查了一下没有此文件的相关信息,排除病毒的可能性就是你安装了某些第三方的应用软件,而加载了某些驱动。

    2008年3月18日 9:01

全部回复

  • 死机之前运行程序:卡巴,AVG Anti-Spyware,IE7.0,Daemon tools,金山词霸2007。

    2008年3月8日 13:05
  • 运行windbg,看不明白,求解。这里好像不能贴图,复制下来。

     

     

    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************

    Use !analyze -v to get detailed debugging information.

    BugCheck 1000008E, {c0000005, 8052e9db, a48eac88, 0}

     

    Probably caused by : ntoskrnl.exe ( nt!IoGetDriverObjectExtension+3e )

    Followup: MachineOwner
    ---------

    0: kd> !analyze -v
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************

    KERNEL_MODE_EXCEPTION_NOT_HANDLED_M (1000008e)
    This is a very common bugcheck.  Usually the exception address pinpoints
    the driver/function that caused the problem.  Always note this address
    as well as the link date of the driver/image that contains this address.
    Some common problems are exception code 0x80000003.  This means a hard
    coded breakpoint or assertion was hit, but this system was booted
    /NODEBUG.  This is not supposed to happen as developers should never have
    hardcoded breakpoints in retail code, but ...
    If this happens, make sure a debugger gets connected, and the
    system is booted /DEBUG.  This will let us see why this breakpoint is
    happening.
    Arguments:
    Arg1: c0000005, The exception code that was not handled
    Arg2: 8052e9db, The address that the exception occurred at
    Arg3: a48eac88, Trap Frame
    Arg4: 00000000

    Debugging Details:
    ------------------

     


    EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - "0x%08lx"

    FAULTING_IP:
    nt!IoGetDriverObjectExtension+3e
    8052e9db f266af          repne scas word ptr es:[edi]

    TRAP_FRAME:  a48eac88 -- (.trap 0xffffffffa48eac88)
    ErrCode = 00000000
    eax=00000000 ebx=11ff5a58 ecx=ffffed5a edx=a48ead18 esi=89e7b998 edi=11ff8000
    eip=8052e9db esp=a48eacfc ebp=a48ead30 iopl=0         nv up ei pl zr na pe nc
    cs=0008  ss=0010  ds=0023  es=0023  fs=0030  gs=0000             efl=00010246
    nt!IoGetDriverObjectExtension+0x3e:
    8052e9db f266af          repne scas word ptr es:[edi]     es:0023:11ff8000=????
    Resetting default scope

    CUSTOMER_CRASH_COUNT:  1

    DEFAULT_BUCKET_ID:  DRIVER_FAULT

    BUGCHECK_STR:  0x8E

    PROCESS_NAME:  iexplore.exe

    LAST_CONTROL_TRANSFER:  from 8054186c to 8052e9db

    STACK_TEXT: 
    a48ead30 8054186c 00001384 00000000 00000000 nt!IoGetDriverObjectExtension+0x3e
    a48ead64 7c92eb94 badb0d00 15e4898c 804db910 nt!RtlIpv4StringToAddressExA+0x149
    WARNING: Frame IP not in any known module. Following frames may be wrong.
    a48ead78 00000000 00000000 00000000 00000000 0x7c92eb94


    STACK_COMMAND:  kb

    FOLLOWUP_IP:
    nt!IoGetDriverObjectExtension+3e
    8052e9db f266af          repne scas word ptr es:[edi]

    SYMBOL_STACK_INDEX:  0

    SYMBOL_NAME:  nt!IoGetDriverObjectExtension+3e

    FOLLOWUP_NAME:  MachineOwner

    MODULE_NAME: nt

    IMAGE_NAME:  ntoskrnl.exe

    DEBUG_FLR_IMAGE_TIMESTAMP:  45e53f9d

    FAILURE_BUCKET_ID:  0x8E_nt!IoGetDriverObjectExtension+3e

    BUCKET_ID:  0x8E_nt!IoGetDriverObjectExtension+3e

    Followup: MachineOwner
    ---------

     

     

    2008年3月8日 13:15
  • 你好,根据您给的Crash Dump File文件分析:我发觉似乎是由于硬件的驱动程序调用的断点,导致内核态地址空间的正常读写崩溃。请检查蓝屏之前是否有安装任何的驱动程序或者第三方的软件,如果有的话,你可以重启机器,按F8进入安全模式,将之前安装的驱动程序或者第三方软件卸载,然后再重启,看看蓝屏是否还会出现。
    希望我的回答对你有帮助,谢谢!

     

    2008年3月9日 5:10
  •  

    谢谢楼上的。

    不过蓝屏前没有安装驱动,你说的第3方软件具体指的什么?

    再贴个Crash Dump File文件分析,请你帮忙再看下。先谢谢。

     

    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************

    Use !analyze -v to get detailed debugging information.

    BugCheck 1000008E, {c0000005, badd0745, bacdfb60, 0}

    *** WARNING: Unable to verify timestamp for win32k.sys


    Probably caused by : tvbay.sys ( tvbay+745 )

    Followup: MachineOwner
    ---------

    1: kd> !analyze -v
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************

    KERNEL_MODE_EXCEPTION_NOT_HANDLED_M (1000008e)
    This is a very common bugcheck.  Usually the exception address pinpoints
    the driver/function that caused the problem.  Always note this address
    as well as the link date of the driver/image that contains this address.
    Some common problems are exception code 0x80000003.  This means a hard
    coded breakpoint or assertion was hit, but this system was booted
    /NODEBUG.  This is not supposed to happen as developers should never have
    hardcoded breakpoints in retail code, but ...
    If this happens, make sure a debugger gets connected, and the
    system is booted /DEBUG.  This will let us see why this breakpoint is
    happening.
    Arguments:
    Arg1: c0000005, The exception code that was not handled
    Arg2: badd0745, The address that the exception occurred at
    Arg3: bacdfb60, Trap Frame
    Arg4: 00000000

    Debugging Details:
    ------------------

     


    EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - "0x%08lx"

    FAULTING_IP:
    tvbay+745
    badd0745 393b            cmp     dword ptr [ebx],edi

    TRAP_FRAME:  bacdfb60 -- (.trap 0xffffffffbacdfb60)
    ErrCode = 00000000
    eax=00000000 ebx=68b00243 ecx=00000009 edx=bacdfbf0 esi=00000000 edi=00000000
    eip=badd0745 esp=bacdfbd4 ebp=bacdfbf8 iopl=0         nv up ei pl zr na pe nc
    cs=0008  ss=0010  ds=0023  es=0023  fs=0030  gs=0000             efl=00010246
    tvbay+0x745:
    badd0745 393b            cmp     dword ptr [ebx],edi  ds:0023:68b00243=????????
    Resetting default scope

    CUSTOMER_CRASH_COUNT:  1

    DEFAULT_BUCKET_ID:  DRIVER_FAULT

    BUGCHECK_STR:  0x8E

    PROCESS_NAME:  System

    LAST_CONTROL_TRANSFER:  from 8054186c to badd0745

    STACK_TEXT: 
    WARNING: Stack unwind information not available. Following frames may be wrong.
    bacdfbf8 8054186c 00000d48 00000000 00000000 tvbay+0x745
    bacdfc2c 80500db9 badb0d00 bacdfca4 00000001 nt!RtlIpv4StringToAddressExA+0x149
    bacdfd2c 8a3a8061 e2dfad78 e46f181a 00000010 nt!RtlpRunTable+0x2c9
    00000000 00000000 00000000 00000000 00000000 0x8a3a8061


    STACK_COMMAND:  kb

    FOLLOWUP_IP:
    tvbay+745
    badd0745 393b            cmp     dword ptr [ebx],edi

    SYMBOL_STACK_INDEX:  0

    SYMBOL_NAME:  tvbay+745

    FOLLOWUP_NAME:  MachineOwner

    MODULE_NAME: tvbay

    IMAGE_NAME:  tvbay.sys

    DEBUG_FLR_IMAGE_TIMESTAMP:  47bf973e

    FAILURE_BUCKET_ID:  0x8E_tvbay+745

    BUCKET_ID:  0x8E_tvbay+745

    Followup: MachineOwner
    ---------

    2008年3月9日 6:26
  • 再贴个

     

     

    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************

    Use !analyze -v to get detailed debugging information.

    BugCheck 10000050, {e5db7043, 0, badc0745, 2}


    Could not read faulting driver name
    *** WARNING: Unable to verify timestamp for win32k.sys


    Probably caused by : tvbay.sys ( tvbay+745 )

    Followup: MachineOwner
    ---------

    0: kd> !analyze -v
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************

    PAGE_FAULT_IN_NONPAGED_AREA (50)
    Invalid system memory was referenced.  This cannot be protected by try-except,
    it must be protected by a Probe.  Typically the address is just plain bad or it
    is pointing at freed memory.
    Arguments:
    Arg1: e5db7043, memory referenced.
    Arg2: 00000000, value 0 = read operation, 1 = write operation.
    Arg3: badc0745, If non-zero, the instruction address which referenced the bad memory
     address.
    Arg4: 00000002, (reserved)

    Debugging Details:
    ------------------


    Could not read faulting driver name

     

    READ_ADDRESS:  e5db7043

    FAULTING_IP:
    tvbay+745
    badc0745 393b            cmp     dword ptr [ebx],edi

    MM_INTERNAL_CODE:  2

    CUSTOMER_CRASH_COUNT:  2

    DEFAULT_BUCKET_ID:  DRIVER_FAULT

    BUGCHECK_STR:  0x50

    PROCESS_NAME:  System

    LAST_CONTROL_TRANSFER:  from 8054186c to badc0745

    STACK_TEXT: 
    WARNING: Stack unwind information not available. Following frames may be wrong.
    bace3bf8 8054186c 00000ad0 00000000 00000000 tvbay+0x745
    bace3c2c 80500db9 badb0d00 bace3ca4 00000001 nt!RtlIpv4StringToAddressExA+0x149
    bace3d2c 8a3cd061 e52c3bf8 e4ce8338 00000010 nt!RtlpRunTable+0x2c9
    bace3d30 e52c3bf8 e4ce8338 00000010 bace3d58 0x8a3cd061
    bace3d34 e4ce8338 00000010 bace3d58 895df040 0xe52c3bf8
    bace3d38 00000000 bace3d58 895df040 895df000 0xe4ce8338


    STACK_COMMAND:  kb

    FOLLOWUP_IP:
    tvbay+745
    badc0745 393b            cmp     dword ptr [ebx],edi

    SYMBOL_STACK_INDEX:  0

    SYMBOL_NAME:  tvbay+745

    FOLLOWUP_NAME:  MachineOwner

    MODULE_NAME: tvbay

    IMAGE_NAME:  tvbay.sys

    DEBUG_FLR_IMAGE_TIMESTAMP:  47bf973e

    FAILURE_BUCKET_ID:  0x50_tvbay+745

    BUCKET_ID:  0x50_tvbay+745

    Followup: MachineOwner

    2008年3月9日 6:30
  •  

    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************

    Use !analyze -v to get detailed debugging information.

    BugCheck 10000050, {e4fab000, 0, 8052e9db, 1}


    Could not read faulting driver name


    Probably caused by : ntoskrnl.exe ( nt!IoGetDriverObjectExtension+3e )

    Followup: MachineOwner
    ---------

    0: kd> !analyze -v
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************

    PAGE_FAULT_IN_NONPAGED_AREA (50)
    Invalid system memory was referenced.  This cannot be protected by try-except,
    it must be protected by a Probe.  Typically the address is just plain bad or it
    is pointing at freed memory.
    Arguments:
    Arg1: e4fab000, memory referenced.
    Arg2: 00000000, value 0 = read operation, 1 = write operation.
    Arg3: 8052e9db, If non-zero, the instruction address which referenced the bad memory
     address.
    Arg4: 00000001, (reserved)

    Debugging Details:
    ------------------


    Could not read faulting driver name

     

    READ_ADDRESS:  e4fab000

    FAULTING_IP:
    nt!IoGetDriverObjectExtension+3e
    8052e9db f266af          repne scas word ptr es:[edi]

    MM_INTERNAL_CODE:  1

    CUSTOMER_CRASH_COUNT:  1

    DEFAULT_BUCKET_ID:  DRIVER_FAULT

    BUGCHECK_STR:  0x50

    PROCESS_NAME:  System

    LAST_CONTROL_TRANSFER:  from 8054186c to 8052e9db

    STACK_TEXT: 
    bace7bf8 8054186c 00000ac4 00000000 00000000 nt!IoGetDriverObjectExtension+0x3e
    bace7c2c 80500db9 badb0d00 bace7ca4 00000001 nt!RtlIpv4StringToAddressExA+0x149
    bace7d2c 8a45c061 e13585c0 e348b72e 00000010 nt!RtlpRunTable+0x2c9
    WARNING: Frame IP not in any known module. Following frames may be wrong.
    bace7d30 e13585c0 e348b72e 00000010 bace7d58 0x8a45c061
    bace7d34 e348b72e 00000010 bace7d58 88f57040 0xe13585c0
    bace7d38 00000000 bace7d58 88f57040 88f57000 0xe348b72e


    STACK_COMMAND:  kb

    FOLLOWUP_IP:
    nt!IoGetDriverObjectExtension+3e
    8052e9db f266af          repne scas word ptr es:[edi]

    SYMBOL_STACK_INDEX:  0

    SYMBOL_NAME:  nt!IoGetDriverObjectExtension+3e

    FOLLOWUP_NAME:  MachineOwner

    MODULE_NAME: nt

    IMAGE_NAME:  ntoskrnl.exe

    DEBUG_FLR_IMAGE_TIMESTAMP:  45e53f9d

    FAILURE_BUCKET_ID:  0x50_nt!IoGetDriverObjectExtension+3e

    BUCKET_ID:  0x50_nt!IoGetDriverObjectExtension+3e

    Followup: MachineOwner

    2008年3月9日 6:40
  •  

    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************

    Use !analyze -v to get detailed debugging information.

    BugCheck 1000008E, {c0000005, 8052e9db, ad10bc88, 0}

     

    Probably caused by : ntoskrnl.exe ( nt!IoGetDriverObjectExtension+3e )

    Followup: MachineOwner
    ---------

    0: kd> !analyze -v
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************

    KERNEL_MODE_EXCEPTION_NOT_HANDLED_M (1000008e)
    This is a very common bugcheck.  Usually the exception address pinpoints
    the driver/function that caused the problem.  Always note this address
    as well as the link date of the driver/image that contains this address.
    Some common problems are exception code 0x80000003.  This means a hard
    coded breakpoint or assertion was hit, but this system was booted
    /NODEBUG.  This is not supposed to happen as developers should never have
    hardcoded breakpoints in retail code, but ...
    If this happens, make sure a debugger gets connected, and the
    system is booted /DEBUG.  This will let us see why this breakpoint is
    happening.
    Arguments:
    Arg1: c0000005, The exception code that was not handled
    Arg2: 8052e9db, The address that the exception occurred at
    Arg3: ad10bc88, Trap Frame
    Arg4: 00000000

    Debugging Details:
    ------------------

     


    EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - "0x%08lx"

    FAULTING_IP:
    nt!IoGetDriverObjectExtension+3e
    8052e9db f266af          repne scas word ptr es:[edi]

    TRAP_FRAME:  ad10bc88 -- (.trap 0xffffffffad10bc88)
    ErrCode = 00000000
    eax=00000000 ebx=0c6e40f8 ecx=fffff0aa edx=ad10bd18 esi=89bb6f58 edi=0c6e6000
    eip=8052e9db esp=ad10bcfc ebp=ad10bd30 iopl=0         nv up ei pl zr na pe nc
    cs=0008  ss=0010  ds=0023  es=0023  fs=0030  gs=0000             efl=00010246
    nt!IoGetDriverObjectExtension+0x3e:
    8052e9db f266af          repne scas word ptr es:[edi]     es:0023:0c6e6000=????
    Resetting default scope

    CUSTOMER_CRASH_COUNT:  2

    DEFAULT_BUCKET_ID:  DRIVER_FAULT

    BUGCHECK_STR:  0x8E

    PROCESS_NAME:  iexplore.exe

    LAST_CONTROL_TRANSFER:  from 8054186c to 8052e9db

    STACK_TEXT: 
    ad10bd30 8054186c 0000128c 00000000 00000000 nt!IoGetDriverObjectExtension+0x3e
    ad10bd64 7c92eb94 badb0d00 0d5feb5c b1154d98 nt!RtlIpv4StringToAddressExA+0x149
    WARNING: Frame IP not in any known module. Following frames may be wrong.
    ad10bd78 00000000 00000000 00000000 00000000 0x7c92eb94


    STACK_COMMAND:  kb

    FOLLOWUP_IP:
    nt!IoGetDriverObjectExtension+3e
    8052e9db f266af          repne scas word ptr es:[edi]

    SYMBOL_STACK_INDEX:  0

    SYMBOL_NAME:  nt!IoGetDriverObjectExtension+3e

    FOLLOWUP_NAME:  MachineOwner

    MODULE_NAME: nt

    IMAGE_NAME:  ntoskrnl.exe

    DEBUG_FLR_IMAGE_TIMESTAMP:  45e53f9d

    FAILURE_BUCKET_ID:  0x8E_nt!IoGetDriverObjectExtension+3e

    BUCKET_ID:  0x8E_nt!IoGetDriverObjectExtension+3e

    Followup: MachineOwner

     

     

     

     

     

    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************

    Use !analyze -v to get detailed debugging information.

    BugCheck 10000050, {e9483043, 0, bae30745, 2}


    Could not read faulting driver name
    *** WARNING: Unable to verify timestamp for win32k.sys


    Probably caused by : tvbay.sys ( tvbay+745 )

    Followup: MachineOwner
    ---------

    1: kd> !analyze -v
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************

    PAGE_FAULT_IN_NONPAGED_AREA (50)
    Invalid system memory was referenced.  This cannot be protected by try-except,
    it must be protected by a Probe.  Typically the address is just plain bad or it
    is pointing at freed memory.
    Arguments:
    Arg1: e9483043, memory referenced.
    Arg2: 00000000, value 0 = read operation, 1 = write operation.
    Arg3: bae30745, If non-zero, the instruction address which referenced the bad memory
     address.
    Arg4: 00000002, (reserved)

    Debugging Details:
    ------------------


    Could not read faulting driver name

     

    READ_ADDRESS:  e9483043

    FAULTING_IP:
    tvbay+745
    bae30745 393b            cmp     dword ptr [ebx],edi

    MM_INTERNAL_CODE:  2

    CUSTOMER_CRASH_COUNT:  1

    DEFAULT_BUCKET_ID:  DRIVER_FAULT

    BUGCHECK_STR:  0x50

    PROCESS_NAME:  System

    LAST_CONTROL_TRANSFER:  from 8054186c to bae30745

    STACK_TEXT: 
    WARNING: Stack unwind information not available. Following frames may be wrong.
    bacdfbf8 8054186c 00000a24 00000000 00000000 tvbay+0x745
    bacdfc2c 80500db9 badb0d00 bacdfca4 00000001 nt!RtlIpv4StringToAddressExA+0x149
    bacdfd2c 8a3b7061 e47b99d0 e40e1928 00000010 nt!RtlpRunTable+0x2c9
    bacdfd30 e47b99d0 e40e1928 00000010 bacdfd58 0x8a3b7061
    bacdfd34 e40e1928 00000010 bacdfd58 8868b040 0xe47b99d0
    bacdfd38 00000000 bacdfd58 8868b040 8868b000 0xe40e1928


    STACK_COMMAND:  kb

    FOLLOWUP_IP:
    tvbay+745
    bae30745 393b            cmp     dword ptr [ebx],edi

    SYMBOL_STACK_INDEX:  0

    SYMBOL_NAME:  tvbay+745

    FOLLOWUP_NAME:  MachineOwner

    MODULE_NAME: tvbay

    IMAGE_NAME:  tvbay.sys

    DEBUG_FLR_IMAGE_TIMESTAMP:  47bf973e

    FAILURE_BUCKET_ID:  0x50_tvbay+745

    BUCKET_ID:  0x50_tvbay+745

    Followup: MachineOwner

     

     

     

    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************

    Use !analyze -v to get detailed debugging information.

    BugCheck 10000050, {e9483043, 0, bae30745, 2}


    Could not read faulting driver name
    *** WARNING: Unable to verify timestamp for win32k.sys


    Probably caused by : tvbay.sys ( tvbay+745 )

    Followup: MachineOwner
    ---------

    1: kd> !analyze -v
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************

    PAGE_FAULT_IN_NONPAGED_AREA (50)
    Invalid system memory was referenced.  This cannot be protected by try-except,
    it must be protected by a Probe.  Typically the address is just plain bad or it
    is pointing at freed memory.
    Arguments:
    Arg1: e9483043, memory referenced.
    Arg2: 00000000, value 0 = read operation, 1 = write operation.
    Arg3: bae30745, If non-zero, the instruction address which referenced the bad memory
     address.
    Arg4: 00000002, (reserved)

    Debugging Details:
    ------------------


    Could not read faulting driver name

     

    READ_ADDRESS:  e9483043

    FAULTING_IP:
    tvbay+745
    bae30745 393b            cmp     dword ptr [ebx],edi

    MM_INTERNAL_CODE:  2

    CUSTOMER_CRASH_COUNT:  1

    DEFAULT_BUCKET_ID:  DRIVER_FAULT

    BUGCHECK_STR:  0x50

    PROCESS_NAME:  System

    LAST_CONTROL_TRANSFER:  from 8054186c to bae30745

    STACK_TEXT: 
    WARNING: Stack unwind information not available. Following frames may be wrong.
    bacdfbf8 8054186c 00000a24 00000000 00000000 tvbay+0x745
    bacdfc2c 80500db9 badb0d00 bacdfca4 00000001 nt!RtlIpv4StringToAddressExA+0x149
    bacdfd2c 8a3b7061 e47b99d0 e40e1928 00000010 nt!RtlpRunTable+0x2c9
    bacdfd30 e47b99d0 e40e1928 00000010 bacdfd58 0x8a3b7061
    bacdfd34 e40e1928 00000010 bacdfd58 8868b040 0xe47b99d0
    bacdfd38 00000000 bacdfd58 8868b040 8868b000 0xe40e1928


    STACK_COMMAND:  kb

    FOLLOWUP_IP:
    tvbay+745
    bae30745 393b            cmp     dword ptr [ebx],edi

    SYMBOL_STACK_INDEX:  0

    SYMBOL_NAME:  tvbay+745

    FOLLOWUP_NAME:  MachineOwner

    MODULE_NAME: tvbay

    IMAGE_NAME:  tvbay.sys

    DEBUG_FLR_IMAGE_TIMESTAMP:  47bf973e

    FAILURE_BUCKET_ID:  0x50_tvbay+745

    BUCKET_ID:  0x50_tvbay+745

    Followup: MachineOwner

     

     

     

    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************

    Use !analyze -v to get detailed debugging information.

    BugCheck 1000008E, {c0000005, 8052e9db, b2ab1c88, 0}

     

    Probably caused by : ntoskrnl.exe ( nt!IoGetDriverObjectExtension+3e )

    Followup: MachineOwner
    ---------

    0: kd> !analyze -v
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************

    KERNEL_MODE_EXCEPTION_NOT_HANDLED_M (1000008e)
    This is a very common bugcheck.  Usually the exception address pinpoints
    the driver/function that caused the problem.  Always note this address
    as well as the link date of the driver/image that contains this address.
    Some common problems are exception code 0x80000003.  This means a hard
    coded breakpoint or assertion was hit, but this system was booted
    /NODEBUG.  This is not supposed to happen as developers should never have
    hardcoded breakpoints in retail code, but ...
    If this happens, make sure a debugger gets connected, and the
    system is booted /DEBUG.  This will let us see why this breakpoint is
    happening.
    Arguments:
    Arg1: c0000005, The exception code that was not handled
    Arg2: 8052e9db, The address that the exception occurred at
    Arg3: b2ab1c88, Trap Frame
    Arg4: 00000000

    Debugging Details:
    ------------------

     


    EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - "0x%08lx"

    FAULTING_IP:
    nt!IoGetDriverObjectExtension+3e
    8052e9db f266af          repne scas word ptr es:[edi]

    TRAP_FRAME:  b2ab1c88 -- (.trap 0xffffffffb2ab1c88)
    ErrCode = 00000000
    eax=00000000 ebx=10bead18 ecx=ffffeeba edx=b2ab1d18 esi=89403980 edi=10bed000
    eip=8052e9db esp=b2ab1cfc ebp=b2ab1d30 iopl=0         nv up ei pl zr na pe nc
    cs=0008  ss=0010  ds=0023  es=0023  fs=0030  gs=0000             efl=00010246
    nt!IoGetDriverObjectExtension+0x3e:
    8052e9db f266af          repne scas word ptr es:[edi]     es:0023:10bed000=????
    Resetting default scope

    CUSTOMER_CRASH_COUNT:  2

    DEFAULT_BUCKET_ID:  DRIVER_FAULT

    BUGCHECK_STR:  0x8E

    PROCESS_NAME:  iexplore.exe

    LAST_CONTROL_TRANSFER:  from 8054186c to 8052e9db

    STACK_TEXT: 
    b2ab1d30 8054186c 00001768 00000000 00000000 nt!IoGetDriverObjectExtension+0x3e
    b2ab1d64 7c92eb94 badb0d00 0e6162d0 b556fd98 nt!RtlIpv4StringToAddressExA+0x149
    WARNING: Frame IP not in any known module. Following frames may be wrong.
    b2ab1d78 00000000 00000000 00000000 00000000 0x7c92eb94


    STACK_COMMAND:  kb

    FOLLOWUP_IP:
    nt!IoGetDriverObjectExtension+3e
    8052e9db f266af          repne scas word ptr es:[edi]

    SYMBOL_STACK_INDEX:  0

    SYMBOL_NAME:  nt!IoGetDriverObjectExtension+3e

    FOLLOWUP_NAME:  MachineOwner

    MODULE_NAME: nt

    IMAGE_NAME:  ntoskrnl.exe

    DEBUG_FLR_IMAGE_TIMESTAMP:  45e53f9d

    FAILURE_BUCKET_ID:  0x8E_nt!IoGetDriverObjectExtension+3e

    BUCKET_ID:  0x8E_nt!IoGetDriverObjectExtension+3e

    Followup: MachineOwner

     

     

     

    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************

    Use !analyze -v to get detailed debugging information.

    BugCheck 1000008E, {c0000005, 8052e9db, b3d3dc88, 0}

     

    Probably caused by : ntoskrnl.exe ( nt!IoGetDriverObjectExtension+3e )

    Followup: MachineOwner
    ---------

    0: kd> !analyze -v
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************

    KERNEL_MODE_EXCEPTION_NOT_HANDLED_M (1000008e)
    This is a very common bugcheck.  Usually the exception address pinpoints
    the driver/function that caused the problem.  Always note this address
    as well as the link date of the driver/image that contains this address.
    Some common problems are exception code 0x80000003.  This means a hard
    coded breakpoint or assertion was hit, but this system was booted
    /NODEBUG.  This is not supposed to happen as developers should never have
    hardcoded breakpoints in retail code, but ...
    If this happens, make sure a debugger gets connected, and the
    system is booted /DEBUG.  This will let us see why this breakpoint is
    happening.
    Arguments:
    Arg1: c0000005, The exception code that was not handled
    Arg2: 8052e9db, The address that the exception occurred at
    Arg3: b3d3dc88, Trap Frame
    Arg4: 00000000

    Debugging Details:
    ------------------

     


    EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - "0x%08lx"

    FAULTING_IP:
    nt!IoGetDriverObjectExtension+3e
    8052e9db f266af          repne scas word ptr es:[edi]

    TRAP_FRAME:  b3d3dc88 -- (.trap 0xffffffffb3d3dc88)
    ErrCode = 00000000
    eax=00000000 ebx=02b8cf80 ecx=ffffffee edx=b3d3dd18 esi=89bd2fc8 edi=02b8d000
    eip=8052e9db esp=b3d3dcfc ebp=b3d3dd30 iopl=0         nv up ei pl zr na pe nc
    cs=0008  ss=0010  ds=0023  es=0023  fs=0030  gs=0000             efl=00010246
    nt!IoGetDriverObjectExtension+0x3e:
    8052e9db f266af          repne scas word ptr es:[edi]     es:0023:02b8d000=????
    Resetting default scope

    CUSTOMER_CRASH_COUNT:  1

    DEFAULT_BUCKET_ID:  DRIVER_FAULT

    BUGCHECK_STR:  0x8E

    PROCESS_NAME:  svchost.exe

    LAST_CONTROL_TRANSFER:  from 8054186c to 8052e9db

    STACK_TEXT: 
    b3d3dd30 8054186c 000022f0 00000000 00000000 nt!IoGetDriverObjectExtension+0x3e
    b3d3dd64 7c92eb94 badb0d00 01dce570 b3d3dd98 nt!RtlIpv4StringToAddressExA+0x149
    WARNING: Frame IP not in any known module. Following frames may be wrong.
    b3d3dd78 00000000 00000000 00000000 00000000 0x7c92eb94


    STACK_COMMAND:  kb

    FOLLOWUP_IP:
    nt!IoGetDriverObjectExtension+3e
    8052e9db f266af          repne scas word ptr es:[edi]

    SYMBOL_STACK_INDEX:  0

    SYMBOL_NAME:  nt!IoGetDriverObjectExtension+3e

    FOLLOWUP_NAME:  MachineOwner

    MODULE_NAME: nt

    IMAGE_NAME:  ntoskrnl.exe

    DEBUG_FLR_IMAGE_TIMESTAMP:  45e53f9d

    FAILURE_BUCKET_ID:  0x8E_nt!IoGetDriverObjectExtension+3e

    BUCKET_ID:  0x8E_nt!IoGetDriverObjectExtension+3e

    Followup: MachineOwner

     

     

     

    2008年3月9日 6:49
  •  

    几次蓝屏相隔很近,把几次的Crash Dump File文件分析都发出来,会不会有联系?请你看下。
    2008年3月9日 6:57
  • 顶起来继续求解。

    2008年3月10日 10:57
  • tybay.sys导致Windows核心文件崩溃,我查了一下没有此文件的相关信息,排除病毒的可能性就是你安装了某些第三方的应用软件,而加载了某些驱动。

    2008年3月18日 9:01
  • 会不会是虚拟光驱的问题?还有个就是杀毒软件冲突,虽然可能性不大。

    2008年3月27日 9:59