Win7睡眠蓝屏解决方法（ntkrnlpa.exe ）

一、症状：

（1）Win7系统可以正常使用，但从待机或休眠返回时则蓝屏，重启后系统提示：

Windows已从异常关机中恢复

问题签名:

  问题事件名称:        BlueScreen

  OS 版本:        6.1.7601.2.1.0.256.1

  区域设置 ID:        2052

 

有关该问题的其他信息:

  BCCode:       9f

  BCP1:       00000003

  BCP2:       878D5030

  BCP3:       8078ADB0

  BCP4:       87607858

  OS Version:        6_1_7601

  Service Pack:        1_0

  Product:        256_1

 

有助于描述该问题的文件:

  C:\Windows\Minidump\011012-28470-01.dmp

 C:\Users\Mc\AppData\Local\Temp\WER-58313-0.sysdata.xml

 

（2）谷歌或百度下载安装windbg，打开上述*.dmp文件，内容大致为：

（ps，windbg配置和使用可以参考：

http://www.cnblogs.com/happyhippy/archive/2007/04/08/710933.html，不过这里不需要那么复杂，下载windbg安装，然后直接打开dmp文件即可，如需近一步研究，可以参考上述帖子并下载BlueScreenView查看错误信息）

Microsoft (R) Windows Debugger Version6.11.0001.404 X86

Copyright (c) Microsoft Corporation. Allrights reserved.

 

Loading Dump File[C:\Windows\Minidump\090412-25022-01.dmp]

Mini Kernel Dump File: Only registers andstack trace are available

Symbol search path is: *** Invalid ***

****************************************************************************

* Symbol loading may be unreliable withouta symbol search path.           *

* Use .symfix to have the debugger choose asymbol path.                   *

* After setting your symbol path, use.reload to refresh symbol locations. *

****************************************************************************

Executable search path is:

*********************************************************************

* Symbols can not be loaded because symbolpath is not initialized. *

*                                                                  *

* The Symbol Path can be set by:                                    *

*  using the _NT_SYMBOL_PATH environment variable.                 *

*  using the -y <symbol_path> argument when starting the debugger. *

*  using .sympath and .sympath+                                    *

*********************************************************************

Unable to load image\SystemRoot\system32\ntkrnlpa.exe, Win32 error 0n2

*** WARNING: Unable to verify timestamp forntkrnlpa.exe

*** ERROR: Module load completed butsymbols could not be loaded for ntkrnlpa.exe

Windows 7 Kernel Version 7601 (Service Pack1) MP (2 procs) Free x86 compatible

Product: WinNt, suite: TerminalServerSingleUserTS

Built by:7601.17713.x86fre.win7sp1_gdr.111025-1505

Machine Name:

Kernel base = 0x8440b000 PsLoadedModuleList= 0x845544d0

Debug session time: Tue Sep  4 11:45:10.257 2012 (GMT+8)

System Uptime: 0 days 2:55:15.068

*********************************************************************

* Symbols can not be loaded because symbolpath is not initialized. *

*                                                                  *

* The Symbol Path can be set by:                                    *

*  using the _NT_SYMBOL_PATH environment variable.                 *

*  using the -y <symbol_path> argument when starting the debugger. *

*  using .sympath and .sympath+                                    *

*********************************************************************

Unable to load image\SystemRoot\system32\ntkrnlpa.exe, Win32 error 0n2

*** WARNING: Unable to verify timestamp forntkrnlpa.exe

*** ERROR: Module load completed butsymbols could not be loaded for ntkrnlpa.exe

Loading Kernel Symbols

...............................................................

................................................................

..............................

Loading User Symbols

Loading unloaded module list

.......................

二、解决方案

（1）从上述dmp文件内容来看，前述症状可能是ntkrnlpa.exe引起的，目前可能已知系统更新安装了漏洞补丁会导致ntkrnlpa.exe出问题，因此，首先考虑替换ntkrnlpa.exe文件，具体方法见：

http://hi.baidu.com/gttsrikphibdgpd/item/5ea00631e292974a3175a150

 

（2）如果方法（1）仍不能解决问题，可能是所安装的系统存在不稳定性的问题，对此，微软已经出了相应的补丁，具体见：

http://support.microsoft.com/kb/2315295#

这可能是某些版本Win7的一个bug。