Blue screen

[infinity]

Witam. Dziś po zainstalowaniu AC3 w czasie zamykania systemu zaczął pojawiać się blue screen. Grę odinstalowałem, skanowałem pc antywirusem ale to nic nie pomogło. Jestem zielony w tym temacie więc proszę o szczegółowe informacje. Dołączam screena z programu blue screen viev.

[mgrzeg]

Witam na forum,

 

spakuj zawartość katalogu c:\windows\minidump i wrzuć na speedyshare.com

 

m.g.

[infinity]

http://speedy.sh/8EAq2/Minidump.rar

[mgrzeg]

Dzięki za pliki.

1. Czy zaobserwowałeś BSOD przed odinstalowaniem AC3 (jak się domyślam, chodzi o grę Assassin's Creed 3?)?

2. Bardzo podejrzanie wyglądają stosy w każdym z dumpów z 20.11:

 

 

  Pokaż ukrytą zawartość

 

**************************Tue Nov 20 20:51:43.141 2012 (UTC + 1:00)**************************
STACK_TEXT:
fffff880`0a71cac8 fffff800`03408eb2 : 00000000`000000f4 00000000`00000003 fffffa80`07d12b30 fffffa80`07d12e10 : nt!KeBugCheckEx
fffff880`0a71cad0 fffff800`033b1203 : ffffffff`ffffffff fffffa80`058b7b60 fffffa80`07d12b30 fffffa80`075aab30 : nt!PspCatchCriticalBreak+0x92
fffff880`0a71cb10 fffff800`0333602c : ffffffff`ffffffff 00000000`00000001 fffffa80`07d12b30 00000000`00000008 : nt! ?? ::NNGAKEGL::`string'+0x17336
fffff880`0a71cb60 fffff800`0307c813 : fffffa80`07d12b30 fffff880`40010004 00000000`00000000 fffffa80`058b7b60 : nt!NtTerminateProcess+0x20c
fffff880`0a71cbe0 00000000`7702f97a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`0117f5f8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x7702f97a

¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨
**************************Tue Nov 20 18:02:09.509 2012 (UTC + 1:00)**************************
STACK_TEXT:
fffff880`031b6928 fffff800`03413eb2 : 00000000`000000f4 00000000`00000003 fffffa80`07c03060 fffffa80`07c03340 : nt!KeBugCheckEx
fffff880`031b6930 fffff800`033bc203 : ffffffff`ffffffff fffffa80`04eb0040 fffffa80`07c03060 fffffa80`04e9ab30 : nt!PspCatchCriticalBreak+0x92
fffff880`031b6970 fffff800`0334102c : ffffffff`ffffffff 00000000`00000001 fffffa80`07c03060 fffff800`00000008 : nt! ?? ::NNGAKEGL::`string'+0x17336
fffff880`031b69c0 fffff800`03087813 : fffffa80`07c03060 00000000`00000000 00000000`00000000 fffffa80`04eb0040 : nt!NtTerminateProcess+0x20c
fffff880`031b6a40 fffff800`03083db0 : fffff880`08abd37c fffff8a0`0001a010 fffffa80`07bb1a50 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
fffff880`031b6bd8 fffff880`08abd37c : fffff8a0`0001a010 fffffa80`07bb1a50 00000000`00000000 fffff8a0`0984c000 : nt!KiServiceLinkage
fffff880`031b6be0 fffff8a0`0001a010 : fffffa80`07bb1a50 00000000`00000000 fffff8a0`0984c000 fffffa80`0536f560 : avgidsdrivera+0x537c
fffff880`031b6be8 fffffa80`07bb1a50 : 00000000`00000000 fffff8a0`0984c000 fffffa80`0536f560 fffff880`08ad100c : 0xfffff8a0`0001a010
fffff880`031b6bf0 00000000`00000000 : fffff8a0`0984c000 fffffa80`0536f560 fffff880`08ad100c ffffffff`800022a8 : 0xfffffa80`07bb1a50

¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨
**************************Tue Nov 20 17:56:28.605 2012 (UTC + 1:00)**************************
STACK_TEXT:
fffff880`0b8ebac8 fffff800`0340beb2 : 00000000`000000f4 00000000`00000003 fffffa80`0719a630 fffffa80`0719a910 : nt!KeBugCheckEx
fffff880`0b8ebad0 fffff800`033b4203 : ffffffff`ffffffff fffffa80`078df060 fffffa80`0719a630 fffffa80`0707da30 : nt!PspCatchCriticalBreak+0x92
fffff880`0b8ebb10 fffff800`0333902c : ffffffff`ffffffff 00000000`00000001 fffffa80`0719a630 00000000`00000008 : nt! ?? ::NNGAKEGL::`string'+0x17336
fffff880`0b8ebb60 fffff800`0307f813 : fffffa80`0719a630 fffff880`40010004 00000000`00000000 fffffa80`078df060 : nt!NtTerminateProcess+0x20c
fffff880`0b8ebbe0 00000000`76eff97a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`00c3f748 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x76eff97a

¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨
**************************Tue Nov 20 17:03:11.389 2012 (UTC + 1:00)**************************
STACK_TEXT:
fffff880`0212cac8 fffff800`03459eb2 : 00000000`000000f4 00000000`00000003 fffffa80`07d8d060 fffffa80`07d8d340 : nt!KeBugCheckEx
fffff880`0212cad0 fffff800`03402203 : ffffffff`ffffffff fffffa80`07617b60 fffffa80`07d8d060 fffffa80`07258b30 : nt!PspCatchCriticalBreak+0x92
fffff880`0212cb10 fffff800`0338702c : ffffffff`ffffffff 00000000`00000001 fffffa80`07d8d060 00000000`00000008 : nt! ?? ::NNGAKEGL::`string'+0x17336
fffff880`0212cb60 fffff800`030cd813 : fffffa80`07d8d060 fffff880`40010004 00000000`00000000 fffffa80`07617b60 : nt!NtTerminateProcess+0x20c
fffff880`0212cbe0 00000000`7750f97a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`0028f308 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x7750f97a

¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨
**************************Tue Nov 20 16:43:41.373 2012 (UTC + 1:00)**************************
STACK_TEXT:
fffff880`03316928 fffff800`0345ceb2 : 00000000`000000f4 00000000`00000003 fffffa80`07f47060 fffffa80`07f47340 : nt!KeBugCheckEx
fffff880`03316930 fffff800`03405203 : ffffffff`ffffffff fffffa80`04ec6b60 fffffa80`07f47060 fffffa80`04ea5b30 : nt!PspCatchCriticalBreak+0x92
fffff880`03316970 fffff800`0338a02c : ffffffff`ffffffff 00000000`00000001 fffffa80`07f47060 fffff800`00000008 : nt! ?? ::NNGAKEGL::`string'+0x17336
fffff880`033169c0 fffff800`030d0813 : fffffa80`07f47060 00000000`00000000 00000000`00000000 fffffa80`04ec6b60 : nt!NtTerminateProcess+0x20c
fffff880`03316a40 fffff800`030ccdb0 : fffff880`0a98137c 00000000`00018358 fffffa80`05defa50 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
fffff880`03316bd8 fffff880`0a98137c : 00000000`00018358 fffffa80`05defa50 00000000`00000000 fffff8a0`09212000 : nt!KiServiceLinkage
fffff880`03316be0 00000000`00018358 : fffffa80`05defa50 00000000`00000000 fffff8a0`09212000 fffffa80`06c86820 : avgidsdrivera+0x537c
fffff880`03316be8 fffffa80`05defa50 : 00000000`00000000 fffff8a0`09212000 fffffa80`06c86820 fffff880`0a99500c : 0x18358
fffff880`03316bf0 00000000`00000000 : fffff8a0`09212000 fffffa80`06c86820 fffff880`0a99500c ffffffff`80000198 : 0xfffffa80`05defa50

¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨
**************************Tue Nov 20 16:40:49.659 2012 (UTC + 1:00)**************************
STACK_TEXT:
fffff880`07fceac8 fffff800`03461eb2 : 00000000`000000f4 00000000`00000003 fffffa80`05692470 fffffa80`05692750 : nt!KeBugCheckEx
fffff880`07fcead0 fffff800`0340a203 : ffffffff`ffffffff fffffa80`06cb5060 fffffa80`05692470 fffffa80`064bf330 : nt!PspCatchCriticalBreak+0x92
fffff880`07fceb10 fffff800`0338f02c : ffffffff`ffffffff 00000000`00000001 fffffa80`05692470 00000000`00000008 : nt! ?? ::NNGAKEGL::`string'+0x17336
fffff880`07fceb60 fffff800`030d5813 : fffffa80`05692470 00000000`40010004 00000000`00000001 fffffa80`06cb5060 : nt!NtTerminateProcess+0x20c
fffff880`07fcebe0 00000000`77baf97a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`02c0f1d8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x77baf97a

 

 

Każdy z nich zaczyna się w usermode gdzieś w obszarze procesu explorer.exe

 

 

  Pokaż ukrytą zawartość

 

BugCheck F4, {3, fffffa8007d12b30, fffffa8007d12e10, fffff80003383d50}
Probably caused by : explorer.exe
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨
BugCheck F4, {3, fffffa8007c03060, fffffa8007c03340, fffff8000338ed50}
Probably caused by : explorer.exe
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨
BugCheck F4, {3, fffffa800719a630, fffffa800719a910, fffff80003386d50}
Probably caused by : explorer.exe
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨
BugCheck F4, {3, fffffa8007d8d060, fffffa8007d8d340, fffff800033d4d50}
Probably caused by : explorer.exe
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨
BugCheck F4, {3, fffffa8007f47060, fffffa8007f47340, fffff800033d7d50}
Probably caused by : explorer.exe
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨
BugCheck F4, {3, fffffa8005692470, fffffa8005692750, fffff800033dcd50}
Probably caused by : explorer.exe

 

 

więc obawiam się, że to może być infekcja podobna do tej: [KLIK]

 

Dlatego przygotuj logi OTL+Extras zgodnie z opisem: [KLIK]

 

m.g.

[infinity]

Tak dokładnie, chodziło o Assasins Creed 3. Przed zainstalowaniem tego nigdy wcześniej nie było na tym komputerze takich kłopotów.Przed momentem oddałem sprzęt znajomemu, który się zajmuje takimi sprawami, więc już wszystko powinno być w porządku. Dzięki za zainteresowanie i pomoc. Dobrze, że jest taka stronka. Pozdrawiam.