Skocz do zawartości

BSOD'y i adware


Rekomendowane odpowiedzi

Witam po raz kolejny, tym razem laptop kumpla. Pojawia mu sie czesto "niebieski ekran". Zdolalem zaobserwowac jeden:

Problem signature:  Problem Event Name: BlueScreen
  OS Version: 6.1.7601.2.1.0.768.3
  Locale ID: 2057


Additional information about the problem:
  BCCode: 1000007e
  BCP1: FFFFFFFFC0000005
  BCP2: FFFFF800037B3E8F
  BCP3: FFFFF880037F8968
  BCP4: FFFFF880037F81C0
  OS Version: 6_1_7601
  Service Pack: 1_0
  Product: 768_1


Files that help describe the problem:
  C:\Windows\Minidump\100613-20732-01.dmp
  C:\Users\milenka21\AppData\Local\Temp\WER-79747-0.sysdata.xml
 
 
Poskanowalem, wymagane logi w zalaczniku. Nie wiem czy do diagnostyki bsod'ow potrzeba wiecej informacji, w razie potrzeby dostarcze. Z gory dzieki za wszelka pomoc.

FRST.txt

Addition.txt

OTL.Txt

Extras.Txt

gmer-log.txt

Odnośnik do komentarza
Pomoc jest darmowa, ale proszę rozważ przekazanie dotacji na utrzymanie serwisu: klik.

Mało danych na temat BSOD. Skopiuj cały folder C:\Windows\Minidump na Pulpit, spakuj do ZIP, shostuj gdzieś i dostarcz paczkę. Ale od razu powiem, że tu może być problem konfliktu antywirusów, są zainstalowane dwa mocarne kombajny (!): avast! Internet Security + Kaspersky PURE 2.0. Drama. Jeden z nich z pewnością musi być odinstalowany.

 

W kwestii adware, ogłuszająca ilość. Będą też usuwane szczątki Firefox. Akcje:

 

1. Otwórz Notatnik i wklej w nim:

 

AppInit_DLLs: [0 ] ()
AppInit_DLLs-x32: c:\progra~3\browse~1\261519~1.190\{c16c1~1\browse~1.dll [ ] ()
HKCU\Software\Microsoft\Internet Explorer\Main,bProtector Start Page = http://search.babylon.com/?affID=120519&babsrc=HP_ss_gin2g&mntrId=B84900264DBF5C79
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,SearchAssistant = http://inboxtoolbar.com/search/ie.aspx?tbid=80137
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,CustomizeSearch = http://inboxtoolbar.com/help/sa_customize.aspx?tbid=80137
URLSearchHook: (No Name) - {D3D233D5-9F6D-436C-B6C7-E63F77503B30} - No File
URLSearchHook: (No Name) - {a24f3f59-1021-4e02-856c-99d9b4a03d83} - No File
URLSearchHook: (No Name) - {796b75f6-6187-47e2-8f1f-c16e059e6e19} - No File
URLSearchHook: (No Name) - {26842a09-ffa8-4e2c-ae12-0c80f01c3295} - No File
SearchScopes: HKLM - DefaultScope {9BB47C17-9C68-4BB3-B188-DD9AF0FD2406} URL = http://dts.search-results.com/sr?src=ieb&appid=360&systemid=406&sr=0&q={searchTerms}
SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM - {9BB47C17-9C68-4BB3-B188-DD9AF0FD2406} URL = http://dts.search-results.com/sr?src=ieb&appid=360&systemid=406&sr=0&q={searchTerms}
SearchScopes: HKLM-x32 - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM-x32 - {56256A51-B582-467e-B8D4-7786EDA79AE0} URL = http://search.mywebsearch.com/mywebsearch/GGmain.jhtml?id=ZVxdm006YYGB&ptb=IHE1Sh5GIsiM5nqdO0SpRA&psa=&ind=2010112411&ptnrS=ZVxdm006YYGB&si=36602&st=sb&n=77cfe19b&searchfor={searchTerms}
SearchScopes: HKLM-x32 - {9BB47C17-9C68-4BB3-B188-DD9AF0FD2406} URL = http://dts.search-results.com/sr?src=ieb&appid=360&systemid=406&sr=0&q={searchTerms}
SearchScopes: HKLM-x32 - {9BB47C17-9C68-4BB3-B188-DD9AF0FD2A69} URL = http://search.bearshare.com/web?src=ieb&systemid=2&q={searchTerms}
SearchScopes: HKLM-x32 - {afdbddaa-5d3f-42ee-b79c-185a7020515b} URL = http://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2644243
SearchScopes: HKCU - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKCU - bProtectorDefaultScope {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}
SearchScopes: HKCU - {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} URL = http://www2.delta-search.com/?q={searchTerms}&affID=120519&babsrc=SP_ss&mntrId=B84900264DBF5C79
SearchScopes: HKCU - {4A9E77AA-FF0F-4A0C-A864-C17C17C4AAB5} URL = http://websearch.ask.com/custom/java/redirect?client=ie&tb=ORJ&o=100000026&src=kw&q={searchTerms}&locale=&apn_ptnrs=U3&apn_dtid=OSJ000
SearchScopes: HKCU - {56256A51-B582-467e-B8D4-7786EDA79AE0} URL = http://search.mywebsearch.com/mywebsearch/GGmain.jhtml?id=ZVxdm006YYGB&ptb=IHE1Sh5GIsiM5nqdO0SpRA&psa=&ind=2010112411&ptnrS=ZVxdm006YYGB&si=36602&st=sb&n=77cfe19b&searchfor={searchTerms}
SearchScopes: HKCU - {9BB47C17-9C68-4BB3-B188-DD9AF0FD2406} URL = http://dts.search-results.com/sr?src=ieb&appid=360&systemid=406&sr=0&q={searchTerms}
SearchScopes: HKCU - {9BB47C17-9C68-4BB3-B188-DD9AF0FD2A69} URL = http://search.bearshare.com/web?src=ieb&systemid=2&q={searchTerms}
SearchScopes: HKCU - {afdbddaa-5d3f-42ee-b79c-185a7020515b} URL = http://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2644243
SearchScopes: HKCU - {B2596224-EA6A-4CA0-BF1E-CA3C5BAF86E1} URL =
SearchScopes: HKCU - {C04B7D22-5AEC-4561-8F49-27F6269208F6} URL = http://inboxtoolbar.com/search/dispatcher.aspx?tp=bs&qkw={searchTerms}&tbid=80137&lng=en
SearchScopes: HKCU - {CFF4DB9B-135F-47c0-9269-B4C6572FD61A} URL = http://mystart.incredibar.com/mb155/?search={searchTerms}&loc=IB_DS&a=6OyM1vXySZ&i=26
BHO: Web Assistant - {336D0C35-8A85-403a-B9D2-65C292C39087} - C:\Program Files\Web Assistant\Extension64.dll ()
BHO-x32: MyWebSearch Search Assistant BHO - {00A6FAF1-072E-44cf-8957-5838F569A31D} - No File
BHO-x32: No Name - {11BF46C6-B3DE-48BD-BF70-3AD85CAB80B5} - C:\Program Files (x86)\SiteRanker\SiteRank.dll (Crawler, LLC)
BHO-x32: Toolbar BHO - {1e91a655-bb4b-4693-a05e-2edebc4c9d89} - No File
BHO-x32: Toolbar BHO - {285028f8-201e-4f8f-827b-7381fc181c3e} - No File
BHO-x32: Toolbar BHO - {631acb68-57c3-48af-9cc5-fcec0837ffd3} - No File
BHO-x32: Incredibar.com Helper Object - {6E13DDE1-2B6E-46CE-8B66-DC8BF36F6B99} - No File
BHO-x32: Search Assistant BHO - {71c1d63a-c944-428a-a5bd-ba513190e5d2} - No File
BHO-x32: Search Assistant BHO - {73b8e1fd-331f-4c17-8613-8a3034d3b0ca} - No File
Toolbar: HKLM - No Name - !{318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - No File
Toolbar: HKLM - No Name - !{8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - No File
Toolbar: HKLM - No Name - !{98889811-442D-49dd-99D7-DC866BE87DBC} - No File
Toolbar: HKLM - No Name - !{F9639E4A-801B-4843-AEE3-03D9DA199E77} - No File
Toolbar: HKLM-x32 - No Name - {0974BA1E-64EC-11DE-B2A5-E43756D89593} - No File
Toolbar: HKLM-x32 - No Name - !{318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - No File
Toolbar: HKLM-x32 - No Name - !{8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - No File
Toolbar: HKLM-x32 - No Name - !{98889811-442D-49dd-99D7-DC866BE87DBC} - No File
Toolbar: HKLM-x32 - No Name - !{F9639E4A-801B-4843-AEE3-03D9DA199E77} - No File
Toolbar: HKCU - No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File
Toolbar: HKCU - No Name - {D2F11D8B-3EB5-4B42-9511-370DBEC707FB} - No File
Toolbar: HKCU - No Name - {D7E97865-918F-41E4-9CD0-25AB1C574CE8} - No File
Toolbar: HKCU - No Name - {D4027C7F-154A-4066-A1AD-4243D8127440} - No File
DPF: HKLM-x32 {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} http://ak.exe.imgfarm.com/images/nocache/funwebproducts/ei-4/IWONBarInitialSetup1.0.1.1.cab
Handler-x32: gopher - {79eac9e4-baf9-11ce-8c82-00aa004ba90b} - No File
CHR HKLM\...\Chrome\Extension: [dlnembnfbcpjnepmfjmngjenhhajpdfd] - C:\Program Files\Web Assistant\source.crx
CHR HKLM-x32\...\Chrome\Extension: [ahilkiibpgjnonbhdfkkgjddddmapala] - C:\Users\milenka21\AppData\Local\CRE\ahilkiibpgjnonbhdfkkgjddddmapala.crx
CHR HKLM-x32\...\Chrome\Extension: [dlnembnfbcpjnepmfjmngjenhhajpdfd] - C:\Program Files\Web Assistant\source.crx
CHR HKLM-x32\...\Chrome\Extension: [kpionmjnkbpcdpcflammlgllecmejgjj] - C:\Program Files (x86)\vShare.tv plugin\vshareplg.crx
CHR HKLM-x32\...\Chrome\Extension: [ogccgbmabaphcakpiclgcnmcnimhokcj] - C:\Windows\SysWOW64\jmdp\SweetNT.crx
CHR HKCU\SOFTWARE\Policies\Google: Policy restriction 
Task: {09DC21D5-1798-4F54-8CF9-E563F3DB47D8} - System32\Tasks\BrowserProtect => Sc.exe start BrowserProtect
Task: {6381AF6D-6753-426A-BC63-924E33484B7F} - System32\Tasks\LaunchApp => C:\Program Files (x86)\MyPC Backup\MyPC Backup.exe
Task: {A304C5E2-0E5F-43F7-ACE5-269C32146A88} - System32\Tasks\{B04D2CBF-7D80-47E8-9BE8-745DA8B88C17} => C:\Program Files (x86)\BearShare Applications\BearShare\BearShare.exe
Task: {C3E42AA4-1E70-4935-A45C-1AE0B4C8B644} - System32\Tasks\{6AF42E20-343F-49CB-9248-B9A872500086} => C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2011\avp.exe
Task: {C5666A07-A585-4F5F-8F8B-D9E03ED75B14} - System32\Tasks\TuneUpUtilities_Task_BkGndMaintenance => C:\Program Files (x86)\TuneUp Utilities 2010\OneClick.exe
Task: {EEE1C293-B0B8-45BD-B5AD-E87F97D29228} - System32\Tasks\{3C83C151-3FFC-4175-B737-24940C4A2ABD} => Chrome.exe
Task: C:\Windows\Tasks\TuneUpUtilities_Task_BkGndMaintenance.job => C:\Program Files (x86)\TuneUp Utilities 2010\OneClick.exe
R2 IBUpdaterService; C:\Windows\system32\dmwu.exe [1762608 2013-09-15] ()
R2 MyWebSearchService; C:\PROGRA~2\MYWEBS~1\bar\1.bin\mwssvc.exe [28762 2010-11-24] (MyWebSearch.com)
S4 Web Assistant; C:\Program Files\Web Assistant\ExtensionUpdaterService.exe [188760 2013-01-29] ()
S3 ewusbnet; system32\DRIVERS\ewusbnet.sys [x]
S3 hwusbfake; system32\DRIVERS\ewusbfake.sys [x]
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\McMPFSvc => ""="Service"
C:\Users\milenka21\AppData\Local\Temp*.html
C:\Users\milenka21\AppData\Roaming\avg
C:\Users\milenka21\AppData\Roaming\Babylon
C:\Users\milenka21\AppData\Roaming\File Scout
C:\Users\milenka21\AppData\Roaming\Gadu-Gadu 10
C:\Users\milenka21\AppData\Roaming\ipla
C:\Users\milenka21\AppData\Roaming\iWin
C:\Users\milenka21\AppData\Roaming\Mozilla
C:\Users\milenka21\AppData\Roaming\OpenCandy
C:\Users\milenka21\AppData\Roaming\OpenFM
C:\Users\milenka21\AppData\Roaming\PlayFirst
C:\Users\milenka21\AppData\Roaming\TuneUp Software
C:\ProgramData\39575304
C:\Program Files (x86)\MyWebSearch
C:\Program Files (x86)\MapsGalaxy_39
C:\Program Files (x86)\FilmFanatic
C:\Program Files (x86)\SoccerInferno
C:\Program Files (x86)\Mozilla Firefox
Reg: reg delete HKCU\Software\Mozilla /f
Reg: reg delete HKLM\SOFTWARE\Mozilla /f
Reg: reg delete HKLM\SOFTWARE\MozillaPlugins /f
Reg: reg delete HKLM\SOFTWARE\Wow6432Node\Mozilla /f
Reg: reg delete HKLM\SOFTWARE\Wow6432Node\mozilla.org /f
Reg: reg delete HKLM\SOFTWARE\Wow6432Node\MozillaPlugins /f
Reg: reg delete "HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Search" /f
Reg: reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\mountpoints2 /f
CMD: attrib -h "C:\Users\milenka21\AppData\Roaming\Toshiba"
CMD: netsh advfirewall reset

 

Adnotacja dla innych czytających: skrypt unikatowy - dopasowany tylko i wyłącznie pod ten system, proszę nie stosować na swoich systemach.

 

Plik zapisz pod nazwą fixlist.txt i umieść obok narzędzia FRST. Uruchom FRST i kliknij w Fix. Powstanie plik fixlog.txt.

 

2. Przez Panel sterowania odinstaluj: BrowserProtect, Disk Speedup, IB Updater Service, Inbox Toolbar, PjPlayer, SiteRanker, vShare.tv plugin, Web Assistant, Updater.

 

3. Wyczyść Google Chrome:

  • Zresetuj cache wtyczek. W pasku adresów wpisz chrome://plugins i ENTER. Na liście wtyczek wybierz dowolną i kliknij Wyłącz. Następnie wtyczkę ponownie włącz.
  • Ustawienia > karta Ustawienia > Po uruchomieniu > usuń adres mystart.incredibar.com, przestaw na "Otwórz stronę nowej karty"
  • Ustawienia > karta Ustawienia > Wygląd i zaznacz "Pokaż przycisk strony startowej" > klik w Zmień i usuń adres mystart.incredibar.com
  • Ustawienia > karta Ustawienia > sekcja Wyszukiwanie > klik w Zarządzanie wyszukiwarkami > na liście ustaw Google jako domyślną, po tym skasuj z listy MyStart
  • Ustawienia > karta Rozszerzenia > odinstaluj SweetPacks Chrome Extension, vshare plugin
  • Ustawienia > karta Historia > wyczyść
4. Uruchom AdwCleaner. Zastosuj Szukaj, a po tym Usuń. Powstanie folder C:\AdwCleaner z raportem z usuwania.

 

5. Uruchom TFC - Temp Cleaner.

 

6. Zrób nowy skan FRST (bez Addition). Dołącz plik fixlog.txt i log z AdwCleaner.

 

 

 

.

Odnośnik do komentarza

Dziekuje. Wyrzucilem oba antywirusy, zainstaluje darmowego avasta. Zalaczam wymagane logi i link do paczki minidump:

http://speedy.sh/Kce2W/Minidump.zip

Znalazlem tez dziwny katalog C:\Windows\winsxs a w nim 18 000 plikow o nazwach typu:

  • amd64_61883.inf.resources_31bf3856ad364e35_6.1.7600.16385_en-us_91f21dbac7469950,
  • msil_microsoft.grouppolicy.reporting_31bf3856ad364e35_6.1.7600.16385_none_49e365c00c77e1fc,
  • wow64_microsoft-windows-gdi_31bf3856ad364e35_6.1.7600.16763_none_10305b4da889affa,
  • x86_microsoft.windows.c..-controls.resources_6595b64144ccf1df_6.0.7600.16385_hr-hr_40dc0024304153a4,
  • x86_microsoft-windows-tcpip.resources_31bf3856ad364e35_6.1.7600.16385_en-us_cc18cf7c2e77940e.

Mozna okreslic czy to potrzebne czy do skasowania?

FRST.txt

Fixlog.txt

AdwCleanerS0.txt

AdwCleanerR0.txt

Odnośnik do komentarza

1. Czyszczenie z adware wykonane. Mini poprawka na wpisy szczątkowe. Otwórz Notatnik i wklej w nim:

 

Winlogon\Notify\klogon: %SystemRoot%\System32\klogon.dll [X]
C:\Windows\system32\ljkb_old
C:\Users\milenka21\AppData\Local\CRE
Reg: reg add "HKCU\Software\Microsoft\Internet Explorer\SearchScopes" /v DefaultScope /t REG_SZ /d {6A1806CD-94D4-4689-BA73-E35EA1EA9990} /f
Reg: reg add "HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes" /v DefaultScope /t REG_SZ /d {6A1806CD-94D4-4689-BA73-E35EA1EA9990} /f
Reg: reg add "HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes" /v DefaultScope /t REG_SZ /d {6A1806CD-94D4-4689-BA73-E35EA1EA9990} /f
Reg: reg delete "HKU\S-1-5-18\Software\Microsoft\Internet Explorer\SearchScopes" /f
Reg: reg delete "HKU\S-1-5-19\Software\Microsoft\Internet Explorer\SearchScopes" /f
Reg: reg delete "HKU\S-1-5-20\Software\Microsoft\Internet Explorer\SearchScopes" /f

 

Plik zapisz pod nazwą fixlist.txt i umieść obok narzędzia FRST. Uruchom FRST i kliknij w Fix. Przedstaw wynikowy fixlog.txt.

 

2. W folderze Minidump był tylko jeden plik. Wyniki jego debugowania nic mi nie mówią:

 

 

 

*******************************************************************************

* *

* Bugcheck Analysis *

* *

*******************************************************************************

 

Use !analyze -v to get detailed debugging information.

 

BugCheck 1000007E, {ffffffffc0000005, fffff800037b3e8f, fffff880037f8968, fffff880037f81c0}

 

Probably caused by : ntkrnlmp.exe ( nt! ?? ::NNGAKEGL::`string'+f1df )

 

Followup: MachineOwner

---------

 

1: kd> !analyze -v

*******************************************************************************

* *

* Bugcheck Analysis *

* *

*******************************************************************************

 

SYSTEM_THREAD_EXCEPTION_NOT_HANDLED_M (1000007e)

This is a very common bugcheck. Usually the exception address pinpoints

the driver/function that caused the problem. Always note this address

as well as the link date of the driver/image that contains this address.

Some common problems are exception code 0x80000003. This means a hard

coded breakpoint or assertion was hit, but this system was booted

/NODEBUG. This is not supposed to happen as developers should never have

hardcoded breakpoints in retail code, but ...

If this happens, make sure a debugger gets connected, and the

system is booted /DEBUG. This will let us see why this breakpoint is

happening.

Arguments:

Arg1: ffffffffc0000005, The exception code that was not handled

Arg2: fffff800037b3e8f, The address that the exception occurred at

Arg3: fffff880037f8968, Exception Record Address

Arg4: fffff880037f81c0, Context Record Address

 

Debugging Details:

------------------

 

 

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - Instrukcja spod 0x%08lx odwo

 

FAULTING_IP:

nt! ?? ::NNGAKEGL::`string'+f1df

fffff800`037b3e8f 488b0f mov rcx,qword ptr [rdi]

 

EXCEPTION_RECORD: fffff880037f8968 -- (.exr 0xfffff880037f8968)

ExceptionAddress: fffff800037b3e8f (nt! ?? ::NNGAKEGL::`string'+0x000000000000f1df)

ExceptionCode: c0000005 (Access violation)

ExceptionFlags: 00000000

NumberParameters: 2

Parameter[0]: 0000000000000000

Parameter[1]: 000000000f003f08

Attempt to read from address 000000000f003f08

 

CONTEXT: fffff880037f81c0 -- (.cxr 0xfffff880037f81c0)

rax=fffffa80015c2b50 rbx=fffff8a00b7eab98 rcx=fffff8a00b7eab98

rdx=0000000000000000 rsi=0000000000000000 rdi=000000000f003f08

rip=fffff800037b3e8f rsp=fffff880037f8ba0 rbp=00000000ffffffff

r8=fffffa80015c2b50 r9=000000000000000d r10=fffff8000340a000

r11=fffff880037f8b50 r12=0000000000000000 r13=0000000000000000

r14=0000000000000000 r15=0000000000000001

iopl=0 nv up ei pl nz na pe nc

cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010202

nt! ?? ::NNGAKEGL::`string'+0xf1df:

fffff800`037b3e8f 488b0f mov rcx,qword ptr [rdi] ds:002b:00000000`0f003f08=????????????????

Resetting default scope

 

CUSTOMER_CRASH_COUNT: 1

 

DEFAULT_BUCKET_ID: WIN7_DRIVER_FAULT

 

PROCESS_NAME: System

 

CURRENT_IRQL: 0

 

ERROR_CODE: (NTSTATUS) 0xc0000005 - Instrukcja spod 0x%08lx odwo

 

EXCEPTION_PARAMETER1: 0000000000000000

 

EXCEPTION_PARAMETER2: 000000000f003f08

 

READ_ADDRESS: GetPointerFromAddress: unable to read from fffff800036b7100

GetUlongFromAddress: unable to read from fffff800036b71c0

000000000f003f08 Nonpaged pool

 

FOLLOWUP_IP:

nt! ?? ::NNGAKEGL::`string'+f1df

fffff800`037b3e8f 488b0f mov rcx,qword ptr [rdi]

 

BUGCHECK_STR: 0x7E

 

LAST_CONTROL_TRANSFER: from fffff8000376626b to fffff800037b3e8f

 

STACK_TEXT:

fffff880`037f8ba0 fffff800`0376626b : fffff8a0`0b7eab98 fffff880`037f8c44 00000000`00000004 00000000`00000001 : nt! ?? ::NNGAKEGL::`string'+0xf1df

fffff880`037f8bd0 fffff800`036d720e : fffff8a0`0b7eab98 fffffa80`015c2b50 fffff880`037f8ca4 00000000`000007ff : nt!CmpCleanUpKcbCacheWithLock+0x2b

fffff880`037f8c00 fffff800`03489261 : fffff800`036d6ed4 fffff800`036252d8 fffffa80`015c2b50 00000000`00000000 : nt!CmpDelayCloseWorker+0x33a

fffff880`037f8cb0 fffff800`0371dbae : 9d4219ff`4d3bf3ef fffffa80`015c2b50 00000000`00000080 fffffa80`015b2040 : nt!ExpWorkerThread+0x111

fffff880`037f8d40 fffff800`034708c6 : fffff880`009e6180 fffffa80`015c2b50 fffff880`009f0f40 fdbfffff`ffbbefff : nt!PspSystemThreadStartup+0x5a

fffff880`037f8d80 00000000`00000000 : fffff880`037f9000 fffff880`037f3000 fffff880`037f89e0 00000000`00000000 : nt!KxStartSystemThread+0x16

 

 

SYMBOL_STACK_INDEX: 0

 

SYMBOL_NAME: nt! ?? ::NNGAKEGL::`string'+f1df

 

FOLLOWUP_NAME: MachineOwner

 

MODULE_NAME: nt

 

IMAGE_NAME: ntkrnlmp.exe

 

DEBUG_FLR_IMAGE_TIMESTAMP: 51fb06cd

 

STACK_COMMAND: .cxr 0xfffff880037f81c0 ; kb

 

FAILURE_BUCKET_ID: X64_0x7E_nt!_??_::NNGAKEGL::_string_+f1df

 

BUCKET_ID: X64_0x7E_nt!_??_::NNGAKEGL::_string_+f1df

 

Followup: MachineOwner

---------

 

 

 

Czy po deinstalacji Avast + Kaspersky BSODy nadal występują?

 

 

Znalazlem tez dziwny katalog C:\Windows\winsxs a w nim 18 000 plikow o nazwach typu:

 

amd64_61883.inf.resources_31bf3856ad364e35_6.1.7600.16385_en-us_91f21dbac7469950,

msil_microsoft.grouppolicy.reporting_31bf3856ad364e35_6.1.7600.16385_none_49e365c00c77e1fc,

wow64_microsoft-windows-gdi_31bf3856ad364e35_6.1.7600.16763_none_10305b4da889affa,

x86_microsoft.windows.c..-controls.resources_6595b64144ccf1df_6.0.7600.16385_hr-hr_40dc0024304153a4,

x86_microsoft-windows-tcpip.resources_31bf3856ad364e35_6.1.7600.16385_en-us_cc18cf7c2e77940e.

 

Mozna okreslic czy to potrzebne czy do skasowania?

W żadnym wypadku tego nie ruszać. To podstawa Windows, folder komponentów.

 

 

 

.

Odnośnik do komentarza

Jeśli chcesz dodać odpowiedź, zaloguj się lub zarejestruj nowe konto

Jedynie zarejestrowani użytkownicy mogą komentować zawartość tej strony.

Zarejestruj nowe konto

Załóż nowe konto. To bardzo proste!

Zarejestruj się

Zaloguj się

Posiadasz już konto? Zaloguj się poniżej.

Zaloguj się
  • Ostatnio przeglądający   0 użytkowników

    • Brak zarejestrowanych użytkowników przeglądających tę stronę.
×
×
  • Dodaj nową pozycję...