Каковы возможные причины того, что Windows мигает оранжевым при запуске
В операционной системе Windows 7 PosReady обратите внимание на оранжевую вспышку при запуске. Происходит это очень быстро, практически незаметно. Чтобы захватить его, я запустил Hyper-V и установил CPU на максимальное использование 1%, чтобы замедлить процесс загрузки. При поиске в Google этого опыта многие пользователи сталкиваются с этим, но не нашли окончательного определения.
Снимок экрана с виртуальной машины:
Поскольку это было достаточно медленно, я мог теперь взломать отладчик ядра, пока отображался оранжевый экран.
Вот что работает во времени:
WinLogon / WinInit складываются по времени. SWIN - это агент McAfee Solidcore.
PROCESS 86c5b7f0 SessionId: 1 Cid: 02c4 Peb: 7ffd8000 ParentCid: 028c
DirBase: f6ea50e0 ObjectTable: a1cd5a88 HandleCount: 0.
Image: winlogon.exe
VadRoot 85cca438 Vads 8 Clone 0 Private 9. Modified 0. Locked 0.
DeviceMap 00000000
Token a1cd69a8
ElapsedTime 00:00:06.609
UserTime 00:00:00.000
KernelTime 00:00:00.000
QuotaPoolUsage[PagedPool] 7636
QuotaPoolUsage[NonPagedPool] 480
Working Set Sizes (now,min,max) (18, 50, 345) (72KB, 200KB, 1380KB)
PeakWorkingSetSize 19
VirtualSize 2 Mb
PeakVirtualSize 2 Mb
PageFaultCount 15
MemoryPriority BACKGROUND
BasePriority 8
CommitCharge 60
THREAD 86e9e378 Cid 02c4.02c8 Teb: 7ffdf000 Win32Thread: 00000000 RUNNING on processor 0
IRP List:
86feea50: (0006,02d4) Flags: 00000884 Mdl: 00000000
Not impersonating
Owning Process 86c5b7f0 Image: winlogon.exe
Attached Process N/A Image: N/A
Wait Start TickCount 37023 Ticks: 13 (0:00:00:00.203)
Context Switch Count 6 IdealProcessor: 0
UserTime 00:00:00.000
KernelTime 00:00:00.093
Win32 Start Address 0x006412bf
Stack Init 91407ed0 Current 914074f0 Base 91408000 Limit 91405000 Call 00000000
Priority 8 BasePriority 8 PriorityDecrement 0 IoPriority 2 PagePriority 5
ChildEBP RetAddr
91407400 828c99d0 nt!RtlpBreakWithStatusInstruction (FPO: [1,0,0])
91407408 828c99a2 nt!KdCheckForDebugBreak+0x22 (FPO: [0,0,0])
91407438 828c9830 nt!KeUpdateRunTime+0x164
91407490 828c9033 nt!KeUpdateSystemTime+0x613
91407490 82971605 nt!KeUpdateSystemTimeAssist+0x13 (FPO: [0,2] TrapFrame @ 914074a4)
91407560 8d6249d0 nt!ExAllocatePoolWithTag+0x5fb
WARNING: Stack unwind information not available. Following frames may be wrong.
91407574 8d6d9dbf swin+0x39d0
91407590 8d6d9ed6 swin+0xb8dbf
914075a8 8d67cb90 swin+0xb8ed6
914075f4 8d673d95 swin+0x5bb90
91407614 8d68db07 swin+0x52d95
914076dc 8d68e114 swin+0x6cb07
9140770c 8d64c80a swin+0x6d114
9140772c 8d648c4f swin+0x2b80a
9140775c 8d64a9ca swin+0x27c4f
9140778c 8d64b1c2 swin+0x299ca
914077c0 8d64482f swin+0x2a1c2
914077dc 8d7d4e09 swin+0x2382f
91407820 82885129 swin+0x1b3e09
91407838 82a99539 nt!IofCallDriver+0x63
91407918 82a788fe nt!IopParseDevice+0xf08
91407994 82a88eb0 nt!ObpLookupObjectName+0x510
914079f4 82a7f7db nt!ObOpenObjectByName+0x165
91407a70 82a85b33 nt!IopCreateFile+0x673
91407ab8 82acfea3 nt!NtOpenFile+0x2a
91407b38 82aae8e9 nt!PfSnGetPrefetchInstructions+0xab
91407bc8 82ac67bd nt!PfSnBeginAppLaunch+0x303
91407bd8 82aac652 nt!PfProcessCreateNotification+0x65
91407c20 828ffa59 nt!PspUserThreadStartup+0x113
00000000 00000000 nt!KiThreadStartup+0x19
PROCESS 85ccad28 SessionId: 0 Cid: 02cc Peb: 7ffd3000 ParentCid: 025c
DirBase: f6ea5100 ObjectTable: 9f20f820 HandleCount: 0.
Image: wininit.exe
VadRoot 86c4c568 Vads 8 Clone 0 Private 10. Modified 0. Locked 0.
DeviceMap 00000000
Token 9f24c770
ElapsedTime 00:00:01.109
UserTime 00:00:00.000
KernelTime 00:00:00.000
QuotaPoolUsage[PagedPool] 7236
QuotaPoolUsage[NonPagedPool] 480
Working Set Sizes (now,min,max) (19, 50, 345) (76KB, 200KB, 1380KB)
PeakWorkingSetSize 20
VirtualSize 1 Mb
PeakVirtualSize 1 Mb
PageFaultCount 16
MemoryPriority BACKGROUND
BasePriority 8
CommitCharge 59
THREAD 8707f560 Cid 02cc.02d0 Teb: 7ffdf000 Win32Thread: 00000000 READY on processor 0
IRP List:
88b77008: (0006,02d4) Flags: 00060043 Mdl: 9a1f0900
87eda788: (0006,02d4) Flags: 00000884 Mdl: 00000000
Not impersonating
Owning Process 85ccad28 Image: wininit.exe
Attached Process N/A Image: N/A
Wait Start TickCount 37032 Ticks: 4 (0:00:00:00.062)
Context Switch Count 4 IdealProcessor: 0
UserTime 00:00:00.000
KernelTime 00:00:00.140
Win32 Start Address 0x00ea4dc8
Stack Init 8f8f0ed0 Current 8f8f02e8 Base 8f8f1000 Limit 8f8ee000 Call 00000b2c
Priority 8 BasePriority 8 PriorityDecrement 0 IoPriority 2 PagePriority 5
ChildEBP RetAddr
8f8f0300 828ccf6d nt!KiSwapContext+0x26 (FPO: [Uses EBP] [0,0,4])
8f8f0338 828cbdc7 nt!KiSwapThread+0x266
8f8f0360 828c560f nt!KiCommitThreadWait+0x1df
8f8f03dc 8d825c77 nt!KeWaitForSingleObject+0x393
8f8f03fc 8d82674a Ntfs!NtfsWaitOnIo+0x1c (FPO: [Non-Fpo])
8f8f051c 8d82a765 Ntfs!NtfsNonCachedIo+0x456 (FPO: [Non-Fpo])
8f8f05f0 8d82bdc5 Ntfs!NtfsCommonRead+0x1148 (FPO: [Non-Fpo])
8f8f0728 82885129 Ntfs!NtfsFsdRead+0x279 (FPO: [Non-Fpo])
8f8f0740 8d49e20c nt!IofCallDriver+0x63
8f8f0764 8d49e3cb FLTMGR!FltpLegacyProcessingAfterPreCallbacksCompleted+0x2aa (FPO: [Non-Fpo])
8f8f079c 82885129 FLTMGR!FltpDispatch+0xc5 (FPO: [Non-Fpo])
8f8f07b4 8d64483e nt!IofCallDriver+0x63
WARNING: Stack unwind information not available. Following frames may be wrong.
8f8f07c8 8d66153f swin+0x2383e
8f8f0808 82885129 swin+0x4053f
8f8f0820 82913ddf nt!IofCallDriver+0x63
8f8f083c 828f5deb nt!IoPageRead+0x1f5
8f8f08a4 828df2cc nt!MiIssueHardFault+0x28c
8f8f0924 8288ef98 nt!MmAccessFault+0x29fc
8f8f0924 82a84de6 nt!KiTrap0E+0xdc (FPO: [0,0] TrapFrame @ 8f8f093c)
8f8f09f0 8d8c1305 nt!CcMapData+0xae
8f8f0a18 8d8c6931 Ntfs!NtfsMapStream+0x4a (FPO: [Non-Fpo])
8f8f0a48 8d8b2792 Ntfs!ReadIndexBuffer+0xdd (FPO: [Non-Fpo])
8f8f0a78 8d8bd050 Ntfs!FindFirstIndexEntry+0x1fa (FPO: [Non-Fpo])
8f8f0ac4 8d8c543b Ntfs!NtfsFindIndexEntry+0x48 (FPO: [Non-Fpo])
8f8f0af8 8d8ad6bb Ntfs!NtfsLookupEntry+0xa4 (FPO: [Non-Fpo])
8f8f0bdc 8d8311b6 Ntfs!NtfsCommonCreate+0x98a (FPO: [Non-Fpo])
8f8f0c1c 828ce08a Ntfs!NtfsCommonCreateCallout+0x20 (FPO: [Non-Fpo])
8f8f0c1c 828ce181 nt!KiSwapKernelStackAndExit+0x15a (FPO: [0,0] TrapFrame @ 8f8f0c34)
9140b4fc 828d7d7f nt!KiSwitchKernelStackAndCallout+0x31
9140b570 8d8310ec nt!KeExpandKernelStackAndCalloutEx+0x29d
9140b5a8 8d8c2a6a Ntfs!NtfsCommonCreateOnNewStack+0x39 (FPO: [Non-Fpo])
9140b6a4 82885129 Ntfs!NtfsFsdCreate+0x1f8 (FPO: [Non-Fpo])
9140b6bc 8d49e20c nt!IofCallDriver+0x63
9140b6e0 8d4b18c9 FLTMGR!FltpLegacyProcessingAfterPreCallbacksCompleted+0x2aa (FPO: [Non-Fpo])
9140b72c 82885129 FLTMGR!FltpCreate+0x2db (FPO: [Non-Fpo])
9140b744 8d664745 nt!IofCallDriver+0x63
9140b758 8d64aa53 swin+0x43745
9140b78c 8d64b1c2 swin+0x29a53
9140b7c0 8d64482f swin+0x2a1c2
9140b7dc 8d7d4e09 swin+0x2382f