![Windows 7 SP1 32 位 - Windows 资源管理器因“ntdll.dll”模块故障而崩溃](https://linux22.com/image/1452835/Windows%207%20SP1%2032%20%E4%BD%8D%20-%20Windows%20%E8%B5%84%E6%BA%90%E7%AE%A1%E7%90%86%E5%99%A8%E5%9B%A0%E2%80%9Cntdll.dll%E2%80%9D%E6%A8%A1%E5%9D%97%E6%95%85%E9%9A%9C%E8%80%8C%E5%B4%A9%E6%BA%83.png)
我在一家小公司的 IT 部门担任暑期实习生。一位用户经常遇到 Windows 资源管理器崩溃的情况,而且似乎是随机的 - 可能是在各种文件夹、控制面板、网络驱动器或任何地方 - 没有规律。事件日志声称崩溃是由错误模块“ntdll.dll”引起的。我尝试了几乎所有从以前的知识和 Google 搜索中找到的可能修复方法,包括:
SFC 扫描(未发现任何内容)
内存测试(未发现任何内容)
chkdsk(未找到任何内容)
禁用 DEP
禁用缩略图
Shell 菜单查看器/Shellex 查看器更改
更新显卡驱动程序
启动修复(未发现任何内容)
病毒/恶意软件扫描
还有其他各种方法。对我而言,这些方法都不起作用。客户使用 Adobe Framemaker 9、Acrobat XI、SnagIt 等程序。这些崩溃没有明显的原因,因为它可能出现在 Windows 资源管理器的任何地方。我最后的办法是拿走他的电脑(然后用锤子敲打它) 并在 64 位上重建 Windows,然后重新安装其各种程序。
但在我这样做之前,还有其他人有什么想法吗?任何帮助都值得感激。
答案1
根据应用程序验证器启用转储后,Adobe DLLC:\Program Files\Adobe\Adobe Technical Communication Suite 2\Adobe RoboSource Control 3.1\NGMenu.dll
会尝试释放内存两次,这是无效的,并会导致崩溃:
APPLICATION_VERIFIER_HEAPS_DOUBLE_FREE (7)
Heap block already freed.
This situation happens if the block is freed twice. Freed blocks are marked in a
special way and are kept around for a while in a delayed free queue. If a buggy
program tries to free the block again this will be caught assuming the block was not
dequeued from delayed free queue and its memory reused for other allocations.
The depth of the delay free queue is in the order of thousands of blocks therefore
there are good chances that most double frees will be caught.
Arguments:
Arg1: 00191000, Heap handle for the heap owning the block.
Arg2: 0767c550, Heap block being freed again.
Arg3: 00000010, Size of the heap block.
Arg4: 00000000, Not used
GetUrlPageData2 (WinHttp) failed: 12030.
CONTEXT: (.ecxr)
eax=00715168 ebx=00000000 ecx=00000002 edx=00715168 esi=00190000 edi=00190000
eip=5799ba58 esp=0373f140 ebp=0373f15c iopl=0 nv up ei pl nz na po nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000202
verifier!VerifierStopMessage+0x1f8:
5799ba58 cc int 3
Resetting default scope
FAULTING_IP:
verifier!VerifierStopMessage+1f8
5799ba58 cc int 3
EXCEPTION_RECORD: (.exr -1)
ExceptionAddress: 5799ba58 (verifier!VerifierStopMessage+0x000001f8)
ExceptionCode: 80000003 (Break instruction exception)
ExceptionFlags: 00000000
NumberParameters: 3
Parameter[0]: 00000000
Parameter[1]: 85d82d48
Parameter[2]: 00715168
DEFAULT_BUCKET_ID: STATUS_BREAKPOINT_AVRF
PROCESS_NAME: explorer.exe
ERROR_CODE: (NTSTATUS) 0x80000003 - {AUSNAHME} Haltepunkt Im Quellprogramm wurde ein Haltepunkt erreicht.
EXCEPTION_CODE: (HRESULT) 0x80000003 (2147483651) - Mindestens ein Argument ist ung ltig.
EXCEPTION_PARAMETER1: 00000000
EXCEPTION_PARAMETER2: 85d82d48
EXCEPTION_PARAMETER3: 00715168
NTGLOBALFLAG: 2000100
APPLICATION_VERIFIER_FLAGS: 48004
APPLICATION_VERIFIER_LOADED: 1
APP: explorer.exe
ANALYSIS_VERSION: 10.0.10069.9 amd64fre
LAST_CONTROL_TRANSFER: from 57999d3c to 5799ba58
BUGCHECK_STR: STATUS_BREAKPOINT_AVRF
STACK_TEXT:
07 ntdll!RtlDispatchException
08 ntdll!KiUserExceptionDispatcher
09 verifier!VerifierStopMessage
0a verifier!AVrfpDphReportCorruptedBlock
0b verifier!AVrfpDphCheckNormalHeapBlock
0c verifier!AVrfpDphNormalHeapFree
0d verifier!AVrfDebugPageHeapFree
0e ntdll!RtlDebugFreeHeap
0f ntdll!RtlpFreeHeap
10 ntdll!RtlFreeHeap
11 verifier!AVrfpRtlFreeHeap
12 ole32!CRetailMalloc_Free
13 oleaut32!APP_DATA::FreeCachedMem
14 oleaut32!SysFreeString
15 verifier!AVrfpSysFreeString
WARNING: Stack unwind information not available. Following frames may be wrong.
16 NGMenu!DllUnregisterServer
17 shell32!CFSIconOverlayManager::_GetFileOverlayInfo
18 shell32!CFSIconOverlayManager::GetFileOverlayInfo
19 shell32!CFSFolder::_GetOverlayInfo
1a shell32!CFSFolder::GetOverlayIndex
1b shell32!CIconOverlayTask::InternalResumeRT
1c shell32!CRunnableTask::Run
1d shell32!CShellTask::TT_Run
1e shell32!CShellTaskThread::ThreadProc
1f shell32!CShellTaskThread::s_ThreadProc
20 shlwapi!ExecuteWorkItemThreadProc
21 ntdll!RtlpTpWorkCallback
22 ntdll!TppWorkerThread
23 kernel32!BaseThreadInitThunk
24 ntdll!__RtlUserThreadStart
25 ntdll!_RtlUserThreadStart
FAILURE_IMAGE_NAME: NGMenu.dll
FAILURE_BUCKET_ID: STATUS_BREAKPOINT_AVRF_80000003_NGMenu.dll!DllUnregisterServer
Loaded symbol image file: NGMenu.dll
Image path: C:\Program Files\Adobe\Adobe Technical Communication Suite 2\Adobe RoboSource Control 3.1\NGMenu.dll
Image name: NGMenu.dll
Browse all global symbols functions data
Timestamp: Mon Sep 10 15:51:00 2007 (46E54BC4)
CheckSum: 00023BF4
ImageSize: 00023000
File version: 3.8.0.1
Product version: 3.8.0.1
File flags: 0 (Mask 3F)
File OS: 4 Unknown Win32
File type: 2.0 Dll
File date: 00000000.00000000
Translations: 0409.04b0
CompanyName: Adobe Systems
ProductName: RoboSource Control 3
InternalName: NGMenu
OriginalFilename: NGMenu.DLL
ProductVersion: 3, 8, 0, 1
FileVersion: 3, 8, 0, 1
FileDescription: Menu Module
LegalCopyright: Copyright (C) 2006. Adobe Macromedia Software LLC. All rights reserved.
删除此旧的 Adobe 软件(它是 2007 年的)以修复崩溃问题。