【解决中】PROCESS_NAME: W 经常蓝屏疑似中毒

devSteven

半小时之内发生两次蓝屏，上个月也发生过多次蓝屏。
下面是最近两次蓝屏日志，东发生在这个 PROCESS_NAME: W 上面名字很诡异，没找到这个程序在哪。

[Shell] 纯文本查看 复制代码

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

SYSTEM_SERVICE_EXCEPTION (3b)
An exception happened while executing a system service routine.
Arguments:
Arg1: 00000000c0000005, Exception code that caused the BugCheck
Arg2: fffff8011100bd11, Address of the instruction which caused the BugCheck
Arg3: fffff0030226e920, Address of the context record for the exception that caused the BugCheck
Arg4: 0000000000000000, zero.

Debugging Details:
------------------


KEY_VALUES_STRING: 1

    Key  : Analysis.CPU.mSec
    Value: 12156

    Key  : Analysis.DebugAnalysisManager
    Value: Create

    Key  : Analysis.Elapsed.mSec
    Value: 13997

    Key  : Analysis.Init.CPU.mSec
    Value: 1046

    Key  : Analysis.Init.Elapsed.mSec
    Value: 5765

    Key  : Analysis.Memory.CommitPeak.Mb
    Value: 93

    Key  : Bugcheck.Code.DumpHeader
    Value: 0x3b

    Key  : Bugcheck.Code.Register
    Value: 0x3b

    Key  : WER.OS.Branch
    Value: vb_release

    Key  : WER.OS.Timestamp
    Value: 2019-12-06T14:06:00Z

    Key  : WER.OS.Version
    Value: 10.0.19041.1


FILE_IN_CAB:  030326-7156-01.dmp

BUGCHECK_CODE:  3b

BUGCHECK_P1: c0000005

BUGCHECK_P2: fffff8011100bd11

BUGCHECK_P3: fffff0030226e920

BUGCHECK_P4: 0

CONTEXT:  fffff0030226e920 -- (.cxr 0xfffff0030226e920)
rax=ffff9301ad5d1b70 rbx=ffffb988452ea0f8 rcx=0800000000000000
rdx=ffff9301ad5d1b50 rsi=ffffb988452ea018 rdi=ffff9301adae8010
rip=fffff8011100bd11 rsp=fffff0030226f320 rbp=ffffb988452ea0f8
 r8=fffff0030226f330  r9=0000000000000028 r10=fffff8010da1f410
r11=ffffb98848bb6b00 r12=0000000000000000 r13=fffff80111094000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl nz na po nc
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010206
Ntfs!NtfsProcessUsnRecordsForCommit+0xf1:
fffff801`1100bd11 48394108        cmp     qword ptr [rcx+8],rax ds:002b:08000000`00000008=????????????????
Resetting default scope

BLACKBOXBSD: 1 (!blackboxbsd)


BLACKBOXNTFS: 1 (!blackboxntfs)


BLACKBOXPNP: 1 (!blackboxpnp)


BLACKBOXWINLOGON: 1

CUSTOMER_CRASH_COUNT:  1

PROCESS_NAME:  W

STACK_TEXT:  
fffff003`0226f320 fffff801`110f4256     : 00000000`6f217b75 00000000`00000000 ffffb988`40546180 ffffb988`452ea018 : Ntfs!NtfsProcessUsnRecordsForCommit+0xf1
fffff003`0226f350 fffff801`1101a930     : ffffb988`452ea018 00000000`00000000 ffffb988`5067fb50 ffff9301`ad5d1b50 : Ntfs!NtfsCommitCurrentTransaction+0x276
fffff003`0226f3f0 fffff801`1111e6f4     : ffff9301`adae8010 ffff9301`adae8010 ffff9301`adae8010 ffff9301`b3d050a0 : Ntfs!NtfsCleanupTransaction+0x60
fffff003`0226f430 fffff801`11121768     : ffffb988`452ea018 ffff9301`adae8010 ffff9301`adae8170 ffff9301`00000001 : Ntfs!NtfsSetBasicInfo+0x318
fffff003`0226f610 fffff801`11120981     : ffffb988`452ea018 ffffb988`48af4a20 ffffb988`48af4a00 00000000`00000001 : Ntfs!NtfsCommonSetInformation+0xc38
fffff003`0226f6e0 fffff801`0da10665     : ffffb988`48af4a20 ffffb988`48af4a20 ffffb988`452ea018 fffff003`02270000 : Ntfs!NtfsFsdSetInformation+0x151
fffff003`0226f7b0 fffff801`1061710f     : ffffb988`40560002 00000000`00000000 00000000`00000000 fffff003`0226f8e8 : nt!IofCallDriver+0x55
fffff003`0226f7f0 fffff801`10614a43     : fffff003`0226f880 00000000`00000028 ffffb988`0000000a ffffb988`40343d80 : FLTMGR!FltpLegacyProcessingAfterPreCallbacksCompleted+0x28f
fffff003`0226f860 fffff801`0da10665     : ffffb988`4769c560 00000000`00000208 ffffb988`48af4a20 fffff801`00000000 : FLTMGR!FltpDispatch+0xa3
fffff003`0226f8c0 fffff801`0dac7080     : ffffb988`4053a001 ffffb988`48af4a20 ffffb988`48af4e08 00000000`00000004 : nt!IofCallDriver+0x55
fffff003`0226f900 fffff801`0da0fcf5     : fffff003`0226fb80 ffffb988`4769c560 ffffb988`48af4a20 00000000`00000000 : nt!IopCallDriverReference+0xd0
fffff003`0226f970 fffff801`0dc105f5     : 00000000`00001650 0000008c`64bfcba8 0000008c`64bfcd38 00000000`00000028 : nt!NtSetInformationFile+0xb85
fffff003`0226fa90 00007ff8`a5c8d334     : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x25
0000008c`64bfcb18 00000000`00000000     : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x00007ff8`a5c8d334


SYMBOL_NAME:  Ntfs!NtfsProcessUsnRecordsForCommit+f1

MODULE_NAME: Ntfs

IMAGE_NAME:  Ntfs.sys

IMAGE_VERSION:  10.0.19041.3448

STACK_COMMAND:  .cxr 0xfffff0030226e920 ; kb

BUCKET_ID_FUNC_OFFSET:  f1

FAILURE_BUCKET_ID:  AV_Ntfs!NtfsProcessUsnRecordsForCommit

OS_VERSION:  10.0.19041.1

BUILDLAB_STR:  vb_release

OSPLATFORM_TYPE:  x64

OSNAME:  Windows 10

FAILURE_ID_HASH:  {8118c9c0-892c-8fef-d176-fe51f8c17c54}

Followup:     MachineOwner
---------

[Shell] 纯文本查看 复制代码

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

MEMORY_MANAGEMENT (1a)
    # Any other values for parameter 1 must be individually examined.
Arguments:
Arg1: 0000000000041792, A corrupt PTE has been detected. Parameter 2 contains the address of
        the PTE. Parameters 3/4 contain the low/high parts of the PTE.
Arg2: ffffa20063e0db70
Arg3: 0800000000000000
Arg4: 0000000000000000

Debugging Details:
------------------


KEY_VALUES_STRING: 1

    Key  : Analysis.CPU.mSec
    Value: 5702

    Key  : Analysis.DebugAnalysisManager
    Value: Create

    Key  : Analysis.Elapsed.mSec
    Value: 7840

    Key  : Analysis.Init.CPU.mSec
    Value: 1187

    Key  : Analysis.Init.Elapsed.mSec
    Value: 4854

    Key  : Analysis.Memory.CommitPeak.Mb
    Value: 81

    Key  : Bugcheck.Code.DumpHeader
    Value: 0x1a

    Key  : Bugcheck.Code.Register
    Value: 0x1a

    Key  : MemoryManagement.PFN
    Value: 0

    Key  : WER.OS.Branch
    Value: vb_release

    Key  : WER.OS.Timestamp
    Value: 2019-12-06T14:06:00Z

    Key  : WER.OS.Version
    Value: 10.0.19041.1


FILE_IN_CAB:  030326-4828-01.dmp

BUGCHECK_CODE:  1a

BUGCHECK_P1: 41792

BUGCHECK_P2: ffffa20063e0db70

BUGCHECK_P3: 800000000000000

BUGCHECK_P4: 0

MEMORY_CORRUPTOR:  ONE_BIT

BLACKBOXBSD: 1 (!blackboxbsd)


BLACKBOXNTFS: 1 (!blackboxntfs)


BLACKBOXWINLOGON: 1

CUSTOMER_CRASH_COUNT:  1

PROCESS_NAME:  W

STACK_TEXT:  
ffff878e`dc252dd8 fffff804`2408124a     : 00000000`0000001a 00000000`00041792 ffffa200`63e0db70 08000000`00000000 : nt!KeBugCheckEx
ffff878e`dc252de0 fffff804`2402f7b6     : 00000000`00000000 00000000`00000000 00000000`00000009 ffffa200`63e0db70 : nt!MiDeleteVa+0x153a
ffff878e`dc252ee0 fffff804`2402f8cb     : ffffa251`0031f068 ffffc28e`25e04940 ffff878e`00000000 ffff878e`dc253350 : nt!MiWalkPageTablesRecursively+0x776
ffff878e`dc252f80 fffff804`2402f8cb     : ffffa251`288018f8 ffffc28e`25e04940 ffff878e`00000001 ffff878e`dc253360 : nt!MiWalkPageTablesRecursively+0x88b
ffff878e`dc253020 fffff804`2402f8cb     : ffffa251`28801000 ffffc28e`25e04940 ffff878e`00000002 ffff878e`dc253370 : nt!MiWalkPageTablesRecursively+0x88b
ffff878e`dc2530c0 fffff804`2402c8cb     : 00350062`0038002d ffffc28e`25e04940 00390037`00000003 ffff878e`dc253380 : nt!MiWalkPageTablesRecursively+0x88b
ffff878e`dc253160 fffff804`2407fae1     : ffff878e`dc253300 ffffc28e`00000000 ffffa200`00000002 00000000`00000000 : nt!MiWalkPageTables+0x36b
ffff878e`dc253260 fffff804`240407b0     : 00000000`00000001 ffff878e`00000000 ffffc28e`25e04790 ffffc28e`24307080 : nt!MiDeletePagablePteRange+0x4f1
ffff878e`dc253570 fffff804`2441f3db     : ffffc28e`24307080 00000000`00000000 ffffc28e`00000000 ffffc28e`00000000 : nt!MiDeleteVad+0x360
ffff878e`dc253680 fffff804`2441d83f     : ffffc28e`2615c870 ffffc28e`2615c870 ffffc28e`262c21d0 ffffc28e`25e042c0 : nt!MiCleanVad+0x43
ffff878e`dc2536b0 fffff804`2449aa18     : ffffffff`00000000 ffffffff`ffffffff 00000000`00000001 ffffc28e`25e042c0 : nt!MmCleanProcessAddressSpace+0x137
ffff878e`dc253730 fffff804`244aeb6e     : ffffc28e`25e042c0 ffff8a04`2cc5d060 ffff878e`dc253959 00000000`00000000 : nt!PspRundownSingleProcess+0x20c
ffff878e`dc2537c0 fffff804`244e7858     : ffffc28e`00000000 fffff804`2401b101 00004001`0000003b 000000c7`b0b93000 : nt!PspExitThread+0x5f6
ffff878e`dc2538c0 fffff804`240f8ead     : ffffc28e`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSchedulerApcTerminate+0x38
ffff878e`dc253900 fffff804`242021c0     : 00000000`00000000 ffff878e`dc2539c0 ffff878e`dc253b00 aaaaaaaa`aaaaaaaa : nt!KiDeliverApc+0x60d
ffff878e`dc2539c0 fffff804`2421069f     : 00004414`00018460 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiInitiateUserApc+0x70
ffff878e`dc253b00 00007ffc`4588ced4     : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceExit+0x9f
000000c7`b33ff968 00000000`00000000     : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x00007ffc`4588ced4


MODULE_NAME: hardware

IMAGE_NAME:  memory_corruption

STACK_COMMAND:  .cxr; .ecxr ; kb

FAILURE_BUCKET_ID:  MEMORY_CORRUPTION_ONE_BIT

OS_VERSION:  10.0.19041.1

BUILDLAB_STR:  vb_release

OSPLATFORM_TYPE:  x64

OSNAME:  Windows 10

FAILURE_ID_HASH:  {e3faf315-c3d0-81db-819a-6c43d23c63a7}

Followup:     MachineOwner
---------

devSteven

PROCESS_NAME: W 疑似是腾讯家的软件进程名称截断，已经寻求官方协助排查解决中。