Bsod

登錄螢幕之前的 Windows 2003 藍屏

  • January 25, 2011

我們有一個非常緊迫的問題,公司舊的 SBS 伺服器在出現登錄螢幕之前就出現了 BSOD。

我通過 WinDbg 執行了迷你轉儲,並得到以下輸出:

CRITICAL_OBJECT_TERMINATION (f4)
A process or thread crucial to system operation has unexpectedly exited or been
terminated.
Several processes and threads are necessary for the operation of the
system; when they are terminated (for any reason), the system can no
longer function.
Arguments:
Arg1: 00000003, Process
Arg2: fe39ad88, Terminating object
Arg3: fe39aeec, Process image file name
Arg4: e094c7c4, Explanatory message (ascii)

Debugging Details:
------------------

unable to get nt!KiCurrentEtwBufferOffset
unable to get nt!KiCurrentEtwBufferBase
<Failed to Read Entire ETW Buffer (expected 0, read 0)>
PROCESS_OBJECT: fe39ad88

IMAGE_NAME:  csrss.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  0

MODULE_NAME: csrss

FAULTING_MODULE: 00000000 

PROCESS_NAME:  csrss.exe

EXCEPTION_CODE: (NTSTATUS) 0xc0000006 - The instruction at "0x%08lx" referenced memory at "0x%08lx". The required data was not placed into memory because of an I/O error status of "0x%08lx".

BUGCHECK_STR:  0xF4_IOERR

CUSTOMER_CRASH_COUNT:  5

DEFAULT_BUCKET_ID:  DRIVER_FAULT_SERVER_MINIDUMP

CURRENT_IRQL:  0

STACK_TEXT:  
f4a0b4e8 e094b927 000000f4 00000003 fe39ad88 nt!KeBugCheckEx+0x1b
f4a0b50c e094c86c e094c7c4 fe39ad88 fe39aeec nt!PspCatchCriticalBreak+0x75
f4a0b53c feb35fa6 ffffffff c0000006 f4a0b58c nt!NtTerminateProcess+0x7a
WARNING: Frame IP not in any known module. Following frames may be wrong.
00000000 f000e81a f000e2c3 f000e81a f000e81a 0xfeb35fa6
00000000 00000000 f000e2c3 f000e81a f000e81a 0xf000e81a


STACK_COMMAND:  kb

FOLLOWUP_NAME:  MachineOwner

FAILURE_BUCKET_ID:  0xF4_IOERR_IMAGE_csrss.exe

BUCKET_ID:  0xF4_IOERR_IMAGE_csrss.exe

Followup: MachineOwner
---------

從轉儲來看,這似乎是驅動程序中的問題,但我不能只得到對此負責的驅動程序。

我會很感激任何暗示可能是罪魁禍首,或者如何尋找罪魁禍首。

謝謝!

致電 Microsoft PSS 並獲得專業幫助。轉移到備份硬體,除非人們現在意識到顯然“重要”。我會說問題是一些基於磁碟的問題。圖像 IO 錯誤表明在關鍵時刻從磁碟讀取錯誤。這意味著 - 使用備份重建機器。

它看起來是導致問題的 csrss.ese。Csrss.exe 是客戶端/伺服器執行時子系統,並且(如調試狀態)對系統至關重要。您是否嘗試過以安全模式啟動 Windows 或使用 Last Known Good 配置啟動它?

引用自:https://serverfault.com/questions/226727