补充:这个是完整的 我觉得不是eprocess被抹杀关系  可能我想错了 ~~ 病毒驱动是 红红的~~~ 0x000000............  卸载一下就蓝了
Microsoft (R) Windows Debugger Version 6.12.0002.633 X86
Copyright (c) Microsoft Corporation. All rights reserved.

Opened \\.\pipe\com_2
Waiting to reconnect...
Connected to Windows XP 2600 x86 compatible target at (Sun Feb 10 20:23:53.706 2013 (UTC + 8:00)), ptr64 FALSE
Kernel Debugger connection established.  (Initial Breakpoint requested)
Symbol search path is: SRV*c:\mysymbol* http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows XP Kernel Version 2600 (Service Pack 3) UP Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 2600.xpsp_sp3_qfe.101209-1646
Machine Name:
Kernel base = 0x804d8000 PsLoadedModuleList = 0x805550c0
Debug session time: Sun Feb 10 20:23:48.406 2013 (UTC + 8:00)
System Uptime: 0 days 0:00:34.046
Break instruction exception - code 80000003 (first chance)
*******************************************************************************
*                                                                             *
*   You are seeing this message because you pressed either                    *
*       CTRL+C (if you run kd.exe) or,                                        *
*       CTRL+BREAK (if you run WinDBG),                                       *
*   on your debugger machine's keyboard.                                      *
*                                                                             *
*                   THIS IS NOT A BUG OR A SYSTEM CRASH                       *
*                                                                             *
* If you did not intend to break into the debugger, press the "g" key, then   *
* press the "Enter" key now.  This message might immediately reappear.  If it *
* does, press "g" and "Enter" again.                                          *
*                                                                             *
*******************************************************************************
nt!RtlpBreakWithStatusInstruction:
80528c0c cc              int     3
kd> g
Break instruction exception - code 80000003 (first chance)
*******************************************************************************
*                                                                             *
*   You are seeing this message because you pressed either                    *
*       CTRL+C (if you run kd.exe) or,                                        *
*       CTRL+BREAK (if you run WinDBG),                                       *
*   on your debugger machine's keyboard.                                      *
*                                                                             *
*                   THIS IS NOT A BUG OR A SYSTEM CRASH                       *
*                                                                             *
* If you did not intend to break into the debugger, press the "g" key, then   *
* press the "Enter" key now.  This message might immediately reappear.  If it *
* does, press "g" and "Enter" again.                                          *
*                                                                             *
*******************************************************************************
nt!RtlpBreakWithStatusInstruction:
80528c0c cc              int     3
kd> g
ERROR: DavReadRegistryValues/RegQueryValueExW(4). WStatus = 5
ERROR: DavReadRegistryValues/RegQueryValueExW(5). WStatus = 5
ERROR: DavReadRegistryValues/RegQueryValueExW(6). WStatus = 5
[1360499058.453] VMUpgradeHelperService::GetConfigValue: Getting configuration value "NetConfigRestoreOnStart".
[1360499058.500] VMUpgradeHelperService::GetConfigValue: Getting configuration value "NetConfigSaveOnStop".
[1360499058.562] VMUpgradeHelperService::GetConfigValue: Getting configuration value "NetConfigSaveOnShutdown".
[1360499058.640] VMUpgradeHelperService::GetConfigValue: Getting configuration value "NetConfigSaved".
[1360499081.846] NetworkAdapterFactory::getNetworkAdapters: Read configuration for "PCI\VEN_1022&DEV_2000&SUBSYS_20001022&REV_10\4&47B7341&0&0888".
[1360499081.986] NetworkAdapterFactory::getNetworkAdapters: Read configuration for "".
[1360499082.002] NetworkAdapterFactory::getNetworkAdapters: Not a virtual ethernet adapter; skipped.
[1360499082.143] NetworkAdapterFactory::getNetworkAdapters: Read configuration for "ROOT\MS_PSCHEDMP\0000".
[1360499082.158] NetworkAdapterFactory::getNetworkAdapters: Not a virtual ethernet adapter; skipped.
[1360499082.299] NetworkAdapterFactory::getNetworkAdapters: Read configuration for "ROOT\MS_L2TPMINIPORT\0000".
[1360499082.314] NetworkAdapterFactory::getNetworkAdapters: Not a virtual ethernet adapter; skipped.
[1360499082.455] NetworkAdapterFactory::getNetworkAdapters: Read configuration for "ROOT\MS_PPTPMINIPORT\0000".
[1360499082.471] NetworkAdapterFactory::getNetworkAdapters: Not a virtual ethernet adapter; skipped.
[1360499082.643] NetworkAdapterFactory::getNetworkAdapters: Read configuration for "ROOT\MS_PPPOEMINIPORT\0000".
[1360499082.658] NetworkAdapterFactory::getNetworkAdapters: Not a virtual ethernet adapter; skipped.
[1360499082.799] NetworkAdapterFactory::getNetworkAdapters: Read configuration for "ROOT\MS_PTIMINIPORT\0000".
[1360499082.814] NetworkAdapterFactory::getNetworkAdapters: Not a virtual ethernet adapter; skipped.
[1360499082.939] NetworkAdapterFactory::getNetworkAdapters: Read configuration for "ROOT\MS_NDISWANIP\0000".
[1360499082.955] NetworkAdapterFactory::getNetworkAdapters: Not a virtual ethernet adapter; skipped.
[1360499083.096] NetworkAdapterFactory::getNetworkAdapters: Read configuration for "ROOT\MS_PSCHEDMP\0001".
[1360499083.111] NetworkAdapterFactory::getNetworkAdapters: Not a virtual ethernet adapter; skipped.
[1360499083.127] VMUpgradeHelperService::RestoreNetConfig: Restoring device "PCI\VEN_1022&DEV_2000&SUBSYS_20001022&REV_10\4&47B7341&0&0888".
[1360499083.721] NetworkAdapterFactory::getNetworkAdapters: Read configuration for "PCI\VEN_1022&DEV_2000&SUBSYS_20001022&REV_10\4&47B7341&0&0888".
[1360499083.861] NetworkAdapterFactory::getNetworkAdapters: Read configuration for "".
[1360499083.893] NetworkAdapterFactory::getNetworkAdapters: Not a virtual ethernet adapter; skipped.
[1360499084.033] NetworkAdapterFactory::getNetworkAdapters: Read configuration for "ROOT\MS_PSCHEDMP\0000".
[1360499084.049] NetworkAdapterFactory::getNetworkAdapters: Not a virtual ethernet adapter; skipped.
[1360499084.189] NetworkAdapterFactory::getNetworkAdapters: Read configuration for "ROOT\MS_L2TPMINIPORT\0000".
[1360499084.205] NetworkAdapterFactory::getNetworkAdapters: Not a virtual ethernet adapter; skipped.
[1360499084.346] NetworkAdapterFactory::getNetworkAdapters: Read configuration for "ROOT\MS_PPTPMINIPORT\0000".
[1360499084.377] NetworkAdapterFactory::getNetworkAdapters: Not a virtual ethernet adapter; skipped.
[1360499084.518] NetworkAdapterFactory::getNetworkAdapters: Read configuration for "ROOT\MS_PPPOEMINIPORT\0000".
[1360499084.533] NetworkAdapterFactory::getNetworkAdapters: Not a virtual ethernet adapter; skipped.
[1360499084.674] NetworkAdapterFactory::getNetworkAdapters: Read configuration for "ROOT\MS_PTIMINIPORT\0000".
[1360499084.689] NetworkAdapterFactory::getNetworkAdapters: Not a virtual ethernet adapter; skipped.
[1360499084.846] NetworkAdapterFactory::getNetworkAdapters: Read configuration for "ROOT\MS_NDISWANIP\0000".
[1360499084.861] NetworkAdapterFactory::getNetworkAdapters: Not a virtual ethernet adapter; skipped.
[1360499084.986] NetworkAdapterFactory::getNetworkAdapters: Read configuration for "ROOT\MS_PSCHEDMP\0001".
[1360499085.002] NetworkAdapterFactory::getNetworkAdapters: Not a virtual ethernet adapter; skipped.
Break instruction exception - code 80000003 (first chance)
*******************************************************************************
*                                                                             *
*   You are seeing this message because you pressed either                    *
*       CTRL+C (if you run kd.exe) or,                                        *
*       CTRL+BREAK (if you run WinDBG),                                       *
*   on your debugger machine's keyboard.                                      *
*                                                                             *
*                   THIS IS NOT A BUG OR A SYSTEM CRASH                       *
*                                                                             *
* If you did not intend to break into the debugger, press the "g" key, then   *
* press the "Enter" key now.  This message might immediately reappear.  If it *
* does, press "g" and "Enter" again.                                          *
*                                                                             *
*******************************************************************************
nt!RtlpBreakWithStatusInstruction:
80528c0c cc              int     3
kd> dt _eprocess 81659da0
nt!_EPROCESS
   +0x000 Pcb              : _KPROCESS
   +0x06c ProcessLock      : _EX_PUSH_LOCK
   +0x070 CreateTime       : _LARGE_INTEGER 0x1ce0789`00000000
   +0x078 ExitTime         : _LARGE_INTEGER 0x0
   +0x080 RundownProtect   : _EX_RUNDOWN_REF
   +0x084 UniqueProcessId  : (null)
   +0x088 ActiveProcessLinks : _LIST_ENTRY [ 0x8055b258 - 0x81493510 ]
   +0x090 QuotaUsage       : [3] 0xff0
   +0x09c QuotaPeak        : [3] 0x1bb0
   +0x0a8 CommitCharge     : 0x1ed
   +0x0ac PeakVirtualSize  : 0x2481000
   +0x0b0 VirtualSize      : 0x246d000
   +0x0b4 SessionProcessLinks : _LIST_ENTRY [ 0xf9ec2014 - 0x8149353c ]
   +0x0bc DebugPort        : (null)
   +0x0c0 ExceptionPort    : 0xe16930d8 Void
   +0x0c4 ObjectTable      : 0xe17c4ae0 _HANDLE_TABLE
   +0x0c8 Token            : _EX_FAST_REF
   +0x0cc WorkingSetLock   : _FAST_MUTEX
   +0x0ec WorkingSetPage   : 0xf10b
   +0x0f0 AddressCreationLock : _FAST_MUTEX
   +0x110 HyperSpaceLock   : 0
   +0x114 ForkInProgress   : (null)
   +0x118 HardwareTrigger  : 0
   +0x11c VadRoot          : 0x8114b240 Void
   +0x120 VadHint          : 0x81484448 Void
   +0x124 CloneRoot        : (null)
   +0x128 NumberOfPrivatePages : 0x14d
   +0x12c NumberOfLockedPages : 0
   +0x130 Win32Process     : 0xe1030ce0 Void
   +0x134 Job              : (null)
   +0x138 SectionObject    : 0xe1b95e68 Void
   +0x13c SectionBaseAddress : 0x00400000 Void
   +0x140 QuotaBlock       : 0x81312f78 _EPROCESS_QUOTA_BLOCK
   +0x144 WorkingSetWatch  : (null)
   +0x148 Win32WindowStation : 0x00000024 Void
   +0x14c InheritedFromUniqueProcessId : 0x0000061c Void
   +0x150 LdtInformation   : (null)
   +0x154 VadFreeHint      : (null)
   +0x158 VdmObjects       : (null)
   +0x15c DeviceMap        : 0xe1c66ac8 Void
   +0x160 PhysicalVadList  : _LIST_ENTRY [ 0x81659f00 - 0x81659f00 ]
   +0x168 PageDirectoryPte : _HARDWARE_PTE
   +0x168 Filler           : 0
   +0x170 Session          : 0xf9ec2000 Void
   +0x174 ImageFileName    : [16]  "uB???"
   +0x184 JobLinks         : _LIST_ENTRY [ 0x0 - 0x0 ]
   +0x18c LockedPagesList  : (null)
   +0x190 ThreadListHead   : _LIST_ENTRY [ 0x8166f4d4 - 0x8166f4d4 ]
   +0x198 SecurityPort     : (null)
   +0x19c PaeTop           : 0xfa0d71c0 Void
   +0x1a0 ActiveThreads    : 1
   +0x1a4 GrantedAccess    : 0x1f0fff
   +0x1a8 DefaultHardErrorProcessing : 0x8000
   +0x1ac LastThreadExitStatus : 0n0
   +0x1b0 Peb              : 0x7ffdc000 _PEB
   +0x1b4 PrefetchTrace    : _EX_FAST_REF
   +0x1b8 ReadOperationCount : _LARGE_INTEGER 0xc
   +0x1c0 WriteOperationCount : _LARGE_INTEGER 0xa
   +0x1c8 OtherOperationCount : _LARGE_INTEGER 0x237
   +0x1d0 ReadTransferCount : _LARGE_INTEGER 0x932
   +0x1d8 WriteTransferCount : _LARGE_INTEGER 0x62ec
   +0x1e0 OtherTransferCount : _LARGE_INTEGER 0x33c3
   +0x1e8 CommitChargeLimit : 0
   +0x1ec CommitChargePeak : 0x1fd
   +0x1f0 AweInfo          : (null)
   +0x1f4 SeAuditProcessCreationInfo : _SE_AUDIT_PROCESS_CREATION_INFO
   +0x1f8 Vm               : _MMSUPPORT
   +0x238 LastFaultCount   : 0
   +0x23c ModifiedPageCount : 0x72
   +0x240 NumberOfVads     : 0x5e
   +0x244 JobStatus        : 0
   +0x248 Flags            : 0x50800
   +0x248 CreateReported   : 0y0
   +0x248 NoDebugInherit   : 0y0
   +0x248 ProcessExiting   : 0y0
   +0x248 ProcessDelete    : 0y0
   +0x248 Wow64SplitPages  : 0y0
   +0x248 VmDeleted        : 0y0
   +0x248 OutswapEnabled   : 0y0
   +0x248 Outswapped       : 0y0
   +0x248 ForkFailed       : 0y0
   +0x248 HasPhysicalVad   : 0y0
   +0x248 AddressSpaceInitialized : 0y10
   +0x248 SetTimerResolution : 0y0
   +0x248 BreakOnTermination : 0y0
   +0x248 SessionCreationUnderway : 0y0
   +0x248 WriteWatch       : 0y0
   +0x248 ProcessInSession : 0y1
   +0x248 OverrideAddressSpace : 0y0
   +0x248 HasAddressSpace  : 0y1
   +0x248 LaunchPrefetched : 0y0
   +0x248 InjectInpageErrors : 0y0
   +0x248 VmTopDown        : 0y0
   +0x248 Unused3          : 0y0
   +0x248 Unused4          : 0y0
   +0x248 VdmAllowed       : 0y0
   +0x248 Unused           : 0y00000 (0)
   +0x248 Unused1          : 0y0
   +0x248 Unused2          : 0y0
   +0x24c ExitStatus       : 0n259
   +0x250 NextPageColor    : 0x7b35
   +0x252 SubSystemMinorVersion : 0 ''
   +0x253 SubSystemMajorVersion : 0x4 ''
   +0x252 SubSystemVersion : 0x400
   +0x254 PriorityClass    : 0x2 ''
   +0x255 WorkingSetAcquiredUnsafe : 0 ''
   +0x258 Cookie           : 0xa6a904f0
kd> g
[kEvP] DriverEntry Success
[kEvP] pCount = 26
0, 04, 12148, 12996, 121044, 121252, 121336, 121596, 12Access violation - code c0000005 (!!! second chance !!!)
nt!SeCreateAccessStateEx+0x5b:
805e8a09 848788000000    test    byte ptr [edi+88h],al
kd> g
Access violation - code c0000005 (!!! second chance !!!)
nt!SeCreateAccessStateEx+0x5b:
805e8a09 848788000000    test    byte ptr [edi+88h],al
kd> g
Access violation - code c0000005 (!!! second chance !!!)
nt!SeCreateAccessStateEx+0x5b:
805e8a09 848788000000    test    byte ptr [edi+88h],al
kd> g
Access violation - code c0000005 (!!! second chance !!!)
nt!SeCreateAccessStateEx+0x5b:
805e8a09 848788000000    test    byte ptr [edi+88h],al
kd> g
Access violation - code c0000005 (!!! second chance !!!)
nt!SeCreateAccessStateEx+0x5b:
805e8a09 848788000000    test    byte ptr [edi+88h],al
kd> g
Access violation - code c0000005 (!!! second chance !!!)
nt!SeCreateAccessStateEx+0x5b:
805e8a09 848788000000    test    byte ptr [edi+88h],al
kd> g
Access violation - code c0000005 (!!! second chance !!!)
nt!SeCreateAccessStateEx+0x5b:
805e8a09 848788000000    test    byte ptr [edi+88h],al
kd> g
Access violation - code c0000005 (!!! second chance !!!)
nt!SeCreateAccessStateEx+0x5b:
805e8a09 848788000000    test    byte ptr [edi+88h],al
kd> g
Access violation - code c0000005 (!!! second chance !!!)
nt!SeCreateAccessStateEx+0x5b:
805e8a09 848788000000    test    byte ptr [edi+88h],al
kd> g
Access violation - code c0000005 (!!! second chance !!!)
nt!SeCreateAccessStateEx+0x5b:
805e8a09 848788000000    test    byte ptr [edi+88h],al
kd> g
Access violation - code c0000005 (!!! second chance !!!)
nt!SeCreateAccessStateEx+0x5b:
805e8a09 848788000000    test    byte ptr [edi+88h],al
kd> g
Access violation - code c0000005 (!!! second chance !!!)
nt!SeCreateAccessStateEx+0x5b:
805e8a09 848788000000    test    byte ptr [edi+88h],al
kd> g
Access violation - code c0000005 (!!! second chance !!!)
nt!SeCreateAccessStateEx+0x5b:
805e8a09 848788000000    test    byte ptr [edi+88h],al
kd> g
Access violation - code c0000005 (!!! second chance !!!)
nt!SeCreateAccessStateEx+0x5b:
805e8a09 848788000000    test    byte ptr [edi+88h],al

看起来貌似因为EProcess里的name那个没有\0造成的~~真心吐槽无力

老V  为什么 一开ark就直接挂了我一直很疑惑~~干其他都没事情 一旦开了有ark相关的工具直接就卡掉了~~360急救箱~~    看来只能恢复快照了~
老V新年好啊