Windows：EternalBlue 漏洞导致的停止代码0x50 srv.sys

Summary: 本文详细介绍了如何解决由 EternalBlue 漏洞引起的停止代码0x50 srv.sys。

This article applies to This article does not apply to This article is not tied to any specific product. Not all product versions are identified in this article.
Check out other resources

Symptoms

Microsoft 发布了 有关 SMBv1.0This hyperlink is taking you to a website outside of Dell Technologies. 的安全公告。如果攻击者向 Microsoft 服务器消息块 1.0 （SMBv1） 服务器发送特制消息，则最严重的漏洞可能允许远程执行代码。

您可以通过分析内存转储上的堆栈并找到以下特定行来确定是否发生了此问题：
 

ffffd001`078b0700 fffff801`71252360 nt!KiPageFault+0x12f
ffffd001`078b0890 fffff801`712522a5 srv!SrvOs2FeaToNt+0x48
ffffd001`078b08c0 fffff801`7127369b srv!SrvOs2FeaListToNt+0x125
ffffd001`078b0910 fffff801`7127c8ba srv!SrvSmbOpen2+0xc3
ffffd001`078b09b0 fffff801`7127fb2e srv!ExecuteTransaction+0x2ca
ffffd001`078b09f0 fffff801`7120d84f srv!SrvSmbTransactionSecondary+0x40b
ffffd001`078b0a90 fffff801`7120da20 srv!SrvProcessSmb+0x237
ffffd001`078b0b10 fffff801`7124cac8 srv!SrvRestartReceive+0x114
ffffd001`078b0b50 fffff800`13591306 srv!WorkerThread+0x5248
ffffd001`078b0bd0 fffff800`1317f280 nt!IopThreadStart+0x26
ffffd001`078b0c00 fffff800`131d89c6 nt!PspSystemThreadStartup+0x58
ffffd001`078b0c60 00000000`00000000 nt!KiStartSystemThread+0x16



受影响的系统：
Windows Server 2008
Windows Server 2008 R2
Windows Server 2012
Windows Server 2012 R2
Windows Server 2016
Windows 7
Windows 8
Windows 8.1
Windows 10
 

 

Cause

。

Resolution

Microsoft 发表了一篇关于 SMB1 的 博客文章This hyperlink is taking you to a website outside of Dell Technologies.，解释说它已过时，不应在最新的作系统版本上使用。

由于此问题是由漏洞引起的，因此需要在受影响的系统上运行防病毒程序。

临时解决方法

以下解决方法This hyperlink is taking you to a website outside of Dell Technologies.在您遇到的情形中可能会有所帮助：

  • 禁用 SMBv1

    对于运行 Windows Vista 及更高版本的客户

    请参阅Microsoft知识库文章 2696547This hyperlink is taking you to a website outside of Dell Technologies.。

    运行 Windows 8.1 或 Windows Server 2012 R2 及更高版本的客户的替代方法

    对于客户端作系统：

    1. 打开控制面板，单击程序，然后单击打开或关闭 Windows 功能。
    2. 在“Windows 功能”窗口中，清除“SMB1.0/CIFS 文件共享支持”复选框，然后单击“确定”关闭窗口。
    3. 重新启动系统。
       

    对于服务器作系统：

    1. 打开服务器管理器，然后单击管理菜单，然后选择删除角色和功能。
    2. 在功能窗口中，清除SMB1.0/CIFS 文件共享支持复选框，然后单击确定以关闭该窗口。
    3. 重新启动系统。
       

    变通办法的影响。目标系统上已禁用 SMBv1 协议。
    SMBv1.0 为旧式系统（Windows XP、Windows Vista、Windows 2000、Windows 2003、Windows 2003 R2）提供支持。

    如何撤消解决方法。回溯解决方法步骤，然后选中 SMB1.0/CIFS 文件共享支持复选框，以将 SMB1.0/CIFS 文件共享支持功能还原到活动状态。

Affected Products

Microsoft Windows Server 2016, Microsoft Windows 2012 Server, Microsoft Windows 2012 Server R2

Products

PowerEdge FC640, PowerEdge M640, PowerEdge M640 (for PE VRTX), PowerEdge MX740C, PowerEdge MX840C, PowerEdge R240, PowerEdge R250, PowerEdge R340, PowerEdge R350, PowerEdge R440, PowerEdge R450, PowerEdge R540, PowerEdge R550, PowerEdge R640 , PowerEdge R6415, PowerEdge R650, PowerEdge R650xs, PowerEdge R6515, PowerEdge R6525, PowerEdge R740, PowerEdge R740XD, PowerEdge R740XD2, PowerEdge R7415, PowerEdge R7425, PowerEdge R750, PowerEdge R750XA, PowerEdge R750xs, PowerEdge R7515, PowerEdge R7525, PowerEdge R840, PowerEdge R940, PowerEdge R940xa, PowerEdge T140, PowerEdge T150, PowerEdge T340, PowerEdge T350, PowerEdge T40, PowerEdge T440, PowerEdge T550, PowerEdge T640 ...
Article Properties
Article Number: 000141143
Article Type: Solution
Last Modified: 11 Dec 2024
Version:  4
Find answers to your questions from other Dell users
Support Services
Check if your device is covered by Support Services.