再谈Win7 x64 Explorer.exe R6025错误

虽然平时不怎么关机，但是每次重启系统之后都会看到这个蛋疼的R6025错误也是一件很蛋疼的事情，以前曾经尝试过解决这个问题，虽然当时是没有什么问题了，但是后来这个问题却又出现了（传送门链接：http://www.h4ck.org.cn/2012/11/win7-x64-explorer-exe-r6025-pure-virtual-function-call/）。

今天又看到这个鸟错误，实在受不了鸟，于是直接操起windbg挂在exporer.exe进行调试。启动之后会发现调用堆栈基本没什么东西。

转到未处理的异常，然后中断调试，查看调用堆栈：

0:028> gn
Mon Dec 17 15:56:44.025 2012 (UTC + 8:00): (a08.9d4): Break instruction exception - code 80000003 (first chance)
ntdll!DbgBreakPoint:
00000000`76e60530 cc              int     3
0:028> k
Child-SP          RetAddr           Call Site
00000000`0636f958 00000000`76f07ef8 ntdll!DbgBreakPoint
00000000`0636f960 00000000`7684652d ntdll!DbgUiRemoteBreakin+0x38
00000000`0636f990 00000000`76e3c521 kernel32!BaseThreadInitThunk+0xd
00000000`0636f9c0 00000000`00000000 ntdll!RtlUserThreadStart+0x21

可以看到是ntdll返回出现了错误，直接进行分析，得到如下的内容：

0:028> !analyze
*******************************************************************************
*                                                                             *
*                        Exception Analysis                                   *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

***** OS symbols are WRONG. Please fix symbols to do analysis.

*************************************************************************
***                                                                   ***
***                                                                   ***
***    Your debugger is not using the correct symbols                 ***
***                                                                   ***
***    In order for this command to work properly, your symbol path   ***
***    must point to .pdb files that have full type information.      ***
***                                                                   ***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                          ***
***                                                                   ***
***    Type referenced: ntdll!_PEB                                    ***
***                                                                   ***
*************************************************************************
*************************************************************************
***                                                                   ***
***                                                                   ***
***    Your debugger is not using the correct symbols                 ***
***                                                                   ***
***    In order for this command to work properly, your symbol path   ***
***    must point to .pdb files that have full type information.      ***
***                                                                   ***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                          ***
***                                                                   ***
***    Type referenced: nt!IMAGE_NT_HEADERS32                         ***
***                                                                   ***
*************************************************************************
*********************************************************************
* Symbols can not be loaded because symbol path is not initialized. *
*                                                                   *
* The Symbol Path can be set by:                                    *
*   using the _NT_SYMBOL_PATH environment variable.                 *
*   using the -y  argument when starting the debugger. *
*   using .sympath and .sympath+                                    *
*********************************************************************
*** ERROR: Module load completed but symbols could not be loaded for C:\Windows\Explorer.EXE
*** ERROR: Symbol file could not be found.  Defaulted to export symbols for C:\Windows\System32\ieframe.dll - 
*********************************************************************
* Symbols can not be loaded because symbol path is not initialized. *
*                                                                   *
* The Symbol Path can be set by:                                    *
*   using the _NT_SYMBOL_PATH environment variable.                 *
*   using the -y  argument when starting the debugger. *
*   using .sympath and .sympath+                                    *
*********************************************************************
*********************************************************************
* Symbols can not be loaded because symbol path is not initialized. *
*                                                                   *
* The Symbol Path can be set by:                                    *
*   using the _NT_SYMBOL_PATH environment variable.                 *
*   using the -y  argument when starting the debugger. *
*   using .sympath and .sympath+                                    *
*********************************************************************
*********************************************************************
* Symbols can not be loaded because symbol path is not initialized. *
*                                                                   *
* The Symbol Path can be set by:                                    *
*   using the _NT_SYMBOL_PATH environment variable.                 *
*   using the -y  argument when starting the debugger. *
*   using .sympath and .sympath+                                    *
*********************************************************************
*********************************************************************
* Symbols can not be loaded because symbol path is not initialized. *
*                                                                   *
* The Symbol Path can be set by:                                    *
*   using the _NT_SYMBOL_PATH environment variable.                 *
*   using the -y  argument when starting the debugger. *
*   using .sympath and .sympath+                                    *
*********************************************************************
*********************************************************************
* Symbols can not be loaded because symbol path is not initialized. *
*                                                                   *
* The Symbol Path can be set by:                                    *
*   using the _NT_SYMBOL_PATH environment variable.                 *
*   using the -y  argument when starting the debugger. *
*   using .sympath and .sympath+                                    *
*********************************************************************
*********************************************************************
* Symbols can not be loaded because symbol path is not initialized. *
*                                                                   *
* The Symbol Path can be set by:                                    *
*   using the _NT_SYMBOL_PATH environment variable.                 *
*   using the -y  argument when starting the debugger. *
*   using .sympath and .sympath+                                    *
*********************************************************************
*********************************************************************
* Symbols can not be loaded because symbol path is not initialized. *
*                                                                   *
* The Symbol Path can be set by:                                    *
*   using the _NT_SYMBOL_PATH environment variable.                 *
*   using the -y  argument when starting the debugger. *
*   using .sympath and .sympath+                                    *
*********************************************************************
*********************************************************************
* Symbols can not be loaded because symbol path is not initialized. *
*                                                                   *
* The Symbol Path can be set by:                                    *
*   using the _NT_SYMBOL_PATH environment variable.                 *
*   using the -y  argument when starting the debugger. *
*   using .sympath and .sympath+                                    *
*********************************************************************
*********************************************************************
* Symbols can not be loaded because symbol path is not initialized. *
*                                                                   *
* The Symbol Path can be set by:                                    *
*   using the _NT_SYMBOL_PATH environment variable.                 *
*   using the -y  argument when starting the debugger. *
*   using .sympath and .sympath+                                    *
*********************************************************************
*** ERROR: Symbol file could not be found.  Defaulted to export symbols for C:\Windows\system32\ole32.dll - 
*** ERROR: Symbol file could not be found.  Defaulted to export symbols for C:\Windows\system32\RPCRT4.dll - 
*** ERROR: Symbol file could not be found.  Defaulted to export symbols for C:\Windows\system32\DUser.dll - 
*** ERROR: Symbol file could not be found.  Defaulted to export symbols for C:\Windows\system32\msvcrt.dll - 
*** ERROR: Symbol file could not be found.  Defaulted to export symbols for C:\Users\obaby\AppData\Roaming\baidu\BaiduYun\NetdiskExt64.dll - 
*** ERROR: Symbol file could not be found.  Defaulted to export symbols for C:\Windows\system32\UxTheme.dll - 
*** ERROR: Symbol file could not be found.  Defaulted to export symbols for C:\Windows\ehome\ehSSO.dll - 
*** ERROR: Symbol file could not be found.  Defaulted to export symbols for C:\Windows\system32\stobject.dll - 
*** ERROR: Symbol file could not be found.  Defaulted to export symbols for C:\Windows\System32\MMDevApi.dll - 
*** ERROR: Symbol file could not be found.  Defaulted to export symbols for C:\Windows\system32\msiltcfg.dll - 
*** ERROR: Symbol file could not be found.  Defaulted to export symbols for C:\Windows\system32\fxsst.dll - 
*** ERROR: Symbol file could not be found.  Defaulted to export symbols for C:\Windows\System32\AltTab.dll - 
*** ERROR: Symbol file could not be found.  Defaulted to export symbols for C:\Windows\system32\Wlanapi.dll - 
*** ERROR: Symbol file could not be found.  Defaulted to export symbols for C:\Windows\system32\WINMM.dll - 
GetPageUrlData failed, server returned HTTP status 404
URL requested: http://watson.microsoft.com/StageOne/Explorer_EXE/6_1_7601_17567/4d672ee4/ntdll_dll/6_1_7601_17725/4ec4aa8e/80000003/00050530.htm?Retriage=1
Probably caused by : ntdll.dll ( ntdll!DbgBreakPoint+0 )

Followup: MachineOwner
---------

系统给出的错误可能原因是ntdll.dll文件，但是用脚指头想想也不可能是这个问题，而加载的用户的dll只有一个，就是：C:\Users\obaby\AppData\Roaming\baidu\BaiduYun\NetdiskExt64.dll – 这个东西是百度云盘的客户端，没有对这个文件进行详细的分析，但是大体已经可以确定问题的原因了，直接删除百度云盘，然后重新启动，嗯，系统从此就清静了。
但是重启之后出现了另外一个问题，就是原来的百度云盘的那个图标没了，在系统的盘符浏览器那里看起来灰常的蛋疼，处理的方式也比较简单，删除注册表的如下项目即可：

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B303091}]
@="百度云"
"LocalizedString"="百度云"
"InfoTip"="从这里进入百度云"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B303091}\DefaultIcon]
@="C:\\Users\\obaby\\AppData\\Roaming\\baidu\\BaiduYun\\baohefolder.ico"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B303091}\InprocServer32]
@="shdocvw.dll"
"ThreadingModel"="Apartment"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B303091}\Instance]
@=""
"CLSID"="{0AFACED1-E828-11D1-9187-B532F1E9575D}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B303091}\Instance\InitPropertyBag]
"Target"="F:\\百度云\\"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B303091}\ShellFolder]
"Attributes"=dword:f8801148
"PinToNameSpaceTree"=""
"QueryForOverlay"=""
"wantsFORPARSING"=""