BSOD'y i adware

[beyondZork]

Witam po raz kolejny, tym razem laptop kumpla. Pojawia mu sie czesto "niebieski ekran". Zdolalem zaobserwowac jeden:

Problem signature:  Problem Event Name: BlueScreen
  OS Version: 6.1.7601.2.1.0.768.3
  Locale ID: 2057


Additional information about the problem:
  BCCode: 1000007e
  BCP1: FFFFFFFFC0000005
  BCP2: FFFFF800037B3E8F
  BCP3: FFFFF880037F8968
  BCP4: FFFFF880037F81C0
  OS Version: 6_1_7601
  Service Pack: 1_0
  Product: 768_1


Files that help describe the problem:
  C:\Windows\Minidump\100613-20732-01.dmp
  C:\Users\milenka21\AppData\Local\Temp\WER-79747-0.sysdata.xml

 

 

Poskanowalem, wymagane logi w zalaczniku. Nie wiem czy do diagnostyki bsod'ow potrzeba wiecej informacji, w razie potrzeby dostarcze. Z gory dzieki za wszelka pomoc.

FRST.txt

Addition.txt

OTL.Txt

Extras.Txt

gmer-log.txt

[picasso]

Mało danych na temat BSOD. Skopiuj cały folder C:\Windows\Minidump na Pulpit, spakuj do ZIP, shostuj gdzieś i dostarcz paczkę. Ale od razu powiem, że tu może być problem konfliktu antywirusów, są zainstalowane dwa mocarne kombajny (!): avast! Internet Security + Kaspersky PURE 2.0. Drama. Jeden z nich z pewnością musi być odinstalowany.

 

W kwestii adware, ogłuszająca ilość. Będą też usuwane szczątki Firefox. Akcje:

 

1. Otwórz Notatnik i wklej w nim:

 

AppInit_DLLs: [0 ] ()
AppInit_DLLs-x32: c:\progra~3\browse~1\261519~1.190\{c16c1~1\browse~1.dll [ ] ()
HKCU\Software\Microsoft\Internet Explorer\Main,bProtector Start Page = http://search.babylon.com/?affID=120519&babsrc=HP_ss_gin2g&mntrId=B84900264DBF5C79
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,SearchAssistant = http://inboxtoolbar.com/search/ie.aspx?tbid=80137
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,CustomizeSearch = http://inboxtoolbar.com/help/sa_customize.aspx?tbid=80137
URLSearchHook: (No Name) - {D3D233D5-9F6D-436C-B6C7-E63F77503B30} - No File
URLSearchHook: (No Name) - {a24f3f59-1021-4e02-856c-99d9b4a03d83} - No File
URLSearchHook: (No Name) - {796b75f6-6187-47e2-8f1f-c16e059e6e19} - No File
URLSearchHook: (No Name) - {26842a09-ffa8-4e2c-ae12-0c80f01c3295} - No File
SearchScopes: HKLM - DefaultScope {9BB47C17-9C68-4BB3-B188-DD9AF0FD2406} URL = http://dts.search-results.com/sr?src=ieb&appid=360&systemid=406&sr=0&q={searchTerms}
SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM - {9BB47C17-9C68-4BB3-B188-DD9AF0FD2406} URL = http://dts.search-results.com/sr?src=ieb&appid=360&systemid=406&sr=0&q={searchTerms}
SearchScopes: HKLM-x32 - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM-x32 - {56256A51-B582-467e-B8D4-7786EDA79AE0} URL = http://search.mywebsearch.com/mywebsearch/GGmain.jhtml?id=ZVxdm006YYGB&ptb=IHE1Sh5GIsiM5nqdO0SpRA&psa=&ind=2010112411&ptnrS=ZVxdm006YYGB&si=36602&st=sb&n=77cfe19b&searchfor={searchTerms}
SearchScopes: HKLM-x32 - {9BB47C17-9C68-4BB3-B188-DD9AF0FD2406} URL = http://dts.search-results.com/sr?src=ieb&appid=360&systemid=406&sr=0&q={searchTerms}
SearchScopes: HKLM-x32 - {9BB47C17-9C68-4BB3-B188-DD9AF0FD2A69} URL = http://search.bearshare.com/web?src=ieb&systemid=2&q={searchTerms}
SearchScopes: HKLM-x32 - {afdbddaa-5d3f-42ee-b79c-185a7020515b} URL = http://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2644243
SearchScopes: HKCU - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKCU - bProtectorDefaultScope {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}
SearchScopes: HKCU - {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} URL = http://www2.delta-search.com/?q={searchTerms}&affID=120519&babsrc=SP_ss&mntrId=B84900264DBF5C79
SearchScopes: HKCU - {4A9E77AA-FF0F-4A0C-A864-C17C17C4AAB5} URL = http://websearch.ask.com/custom/java/redirect?client=ie&tb=ORJ&o=100000026&src=kw&q={searchTerms}&locale=&apn_ptnrs=U3&apn_dtid=OSJ000
SearchScopes: HKCU - {56256A51-B582-467e-B8D4-7786EDA79AE0} URL = http://search.mywebsearch.com/mywebsearch/GGmain.jhtml?id=ZVxdm006YYGB&ptb=IHE1Sh5GIsiM5nqdO0SpRA&psa=&ind=2010112411&ptnrS=ZVxdm006YYGB&si=36602&st=sb&n=77cfe19b&searchfor={searchTerms}
SearchScopes: HKCU - {9BB47C17-9C68-4BB3-B188-DD9AF0FD2406} URL = http://dts.search-results.com/sr?src=ieb&appid=360&systemid=406&sr=0&q={searchTerms}
SearchScopes: HKCU - {9BB47C17-9C68-4BB3-B188-DD9AF0FD2A69} URL = http://search.bearshare.com/web?src=ieb&systemid=2&q={searchTerms}
SearchScopes: HKCU - {afdbddaa-5d3f-42ee-b79c-185a7020515b} URL = http://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2644243
SearchScopes: HKCU - {B2596224-EA6A-4CA0-BF1E-CA3C5BAF86E1} URL =
SearchScopes: HKCU - {C04B7D22-5AEC-4561-8F49-27F6269208F6} URL = http://inboxtoolbar.com/search/dispatcher.aspx?tp=bs&qkw={searchTerms}&tbid=80137&lng=en
SearchScopes: HKCU - {CFF4DB9B-135F-47c0-9269-B4C6572FD61A} URL = http://mystart.incredibar.com/mb155/?search={searchTerms}&loc=IB_DS&a=6OyM1vXySZ&i=26
BHO: Web Assistant - {336D0C35-8A85-403a-B9D2-65C292C39087} - C:\Program Files\Web Assistant\Extension64.dll ()
BHO-x32: MyWebSearch Search Assistant BHO - {00A6FAF1-072E-44cf-8957-5838F569A31D} - No File
BHO-x32: No Name - {11BF46C6-B3DE-48BD-BF70-3AD85CAB80B5} - C:\Program Files (x86)\SiteRanker\SiteRank.dll (Crawler, LLC)
BHO-x32: Toolbar BHO - {1e91a655-bb4b-4693-a05e-2edebc4c9d89} - No File
BHO-x32: Toolbar BHO - {285028f8-201e-4f8f-827b-7381fc181c3e} - No File
BHO-x32: Toolbar BHO - {631acb68-57c3-48af-9cc5-fcec0837ffd3} - No File
BHO-x32: Incredibar.com Helper Object - {6E13DDE1-2B6E-46CE-8B66-DC8BF36F6B99} - No File
BHO-x32: Search Assistant BHO - {71c1d63a-c944-428a-a5bd-ba513190e5d2} - No File
BHO-x32: Search Assistant BHO - {73b8e1fd-331f-4c17-8613-8a3034d3b0ca} - No File
Toolbar: HKLM - No Name - !{318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - No File
Toolbar: HKLM - No Name - !{8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - No File
Toolbar: HKLM - No Name - !{98889811-442D-49dd-99D7-DC866BE87DBC} - No File
Toolbar: HKLM - No Name - !{F9639E4A-801B-4843-AEE3-03D9DA199E77} - No File
Toolbar: HKLM-x32 - No Name - {0974BA1E-64EC-11DE-B2A5-E43756D89593} - No File
Toolbar: HKLM-x32 - No Name - !{318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - No File
Toolbar: HKLM-x32 - No Name - !{8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - No File
Toolbar: HKLM-x32 - No Name - !{98889811-442D-49dd-99D7-DC866BE87DBC} - No File
Toolbar: HKLM-x32 - No Name - !{F9639E4A-801B-4843-AEE3-03D9DA199E77} - No File
Toolbar: HKCU - No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File
Toolbar: HKCU - No Name - {D2F11D8B-3EB5-4B42-9511-370DBEC707FB} - No File
Toolbar: HKCU - No Name - {D7E97865-918F-41E4-9CD0-25AB1C574CE8} - No File
Toolbar: HKCU - No Name - {D4027C7F-154A-4066-A1AD-4243D8127440} - No File
DPF: HKLM-x32 {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} http://ak.exe.imgfarm.com/images/nocache/funwebproducts/ei-4/IWONBarInitialSetup1.0.1.1.cab
Handler-x32: gopher - {79eac9e4-baf9-11ce-8c82-00aa004ba90b} - No File
CHR HKLM\...\Chrome\Extension: [dlnembnfbcpjnepmfjmngjenhhajpdfd] - C:\Program Files\Web Assistant\source.crx
CHR HKLM-x32\...\Chrome\Extension: [ahilkiibpgjnonbhdfkkgjddddmapala] - C:\Users\milenka21\AppData\Local\CRE\ahilkiibpgjnonbhdfkkgjddddmapala.crx
CHR HKLM-x32\...\Chrome\Extension: [dlnembnfbcpjnepmfjmngjenhhajpdfd] - C:\Program Files\Web Assistant\source.crx
CHR HKLM-x32\...\Chrome\Extension: [kpionmjnkbpcdpcflammlgllecmejgjj] - C:\Program Files (x86)\vShare.tv plugin\vshareplg.crx
CHR HKLM-x32\...\Chrome\Extension: [ogccgbmabaphcakpiclgcnmcnimhokcj] - C:\Windows\SysWOW64\jmdp\SweetNT.crx
CHR HKCU\SOFTWARE\Policies\Google: Policy restriction 
Task: {09DC21D5-1798-4F54-8CF9-E563F3DB47D8} - System32\Tasks\BrowserProtect => Sc.exe start BrowserProtect
Task: {6381AF6D-6753-426A-BC63-924E33484B7F} - System32\Tasks\LaunchApp => C:\Program Files (x86)\MyPC Backup\MyPC Backup.exe
Task: {A304C5E2-0E5F-43F7-ACE5-269C32146A88} - System32\Tasks\{B04D2CBF-7D80-47E8-9BE8-745DA8B88C17} => C:\Program Files (x86)\BearShare Applications\BearShare\BearShare.exe
Task: {C3E42AA4-1E70-4935-A45C-1AE0B4C8B644} - System32\Tasks\{6AF42E20-343F-49CB-9248-B9A872500086} => C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2011\avp.exe
Task: {C5666A07-A585-4F5F-8F8B-D9E03ED75B14} - System32\Tasks\TuneUpUtilities_Task_BkGndMaintenance => C:\Program Files (x86)\TuneUp Utilities 2010\OneClick.exe
Task: {EEE1C293-B0B8-45BD-B5AD-E87F97D29228} - System32\Tasks\{3C83C151-3FFC-4175-B737-24940C4A2ABD} => Chrome.exe
Task: C:\Windows\Tasks\TuneUpUtilities_Task_BkGndMaintenance.job => C:\Program Files (x86)\TuneUp Utilities 2010\OneClick.exe
R2 IBUpdaterService; C:\Windows\system32\dmwu.exe [1762608 2013-09-15] ()
R2 MyWebSearchService; C:\PROGRA~2\MYWEBS~1\bar\1.bin\mwssvc.exe [28762 2010-11-24] (MyWebSearch.com)
S4 Web Assistant; C:\Program Files\Web Assistant\ExtensionUpdaterService.exe [188760 2013-01-29] ()
S3 ewusbnet; system32\DRIVERS\ewusbnet.sys [x]
S3 hwusbfake; system32\DRIVERS\ewusbfake.sys [x]
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\McMPFSvc => ""="Service"
C:\Users\milenka21\AppData\Local\Temp*.html
C:\Users\milenka21\AppData\Roaming\avg
C:\Users\milenka21\AppData\Roaming\Babylon
C:\Users\milenka21\AppData\Roaming\File Scout
C:\Users\milenka21\AppData\Roaming\Gadu-Gadu 10
C:\Users\milenka21\AppData\Roaming\ipla
C:\Users\milenka21\AppData\Roaming\iWin
C:\Users\milenka21\AppData\Roaming\Mozilla
C:\Users\milenka21\AppData\Roaming\OpenCandy
C:\Users\milenka21\AppData\Roaming\OpenFM
C:\Users\milenka21\AppData\Roaming\PlayFirst
C:\Users\milenka21\AppData\Roaming\TuneUp Software
C:\ProgramData\39575304
C:\Program Files (x86)\MyWebSearch
C:\Program Files (x86)\MapsGalaxy_39
C:\Program Files (x86)\FilmFanatic
C:\Program Files (x86)\SoccerInferno
C:\Program Files (x86)\Mozilla Firefox
Reg: reg delete HKCU\Software\Mozilla /f
Reg: reg delete HKLM\SOFTWARE\Mozilla /f
Reg: reg delete HKLM\SOFTWARE\MozillaPlugins /f
Reg: reg delete HKLM\SOFTWARE\Wow6432Node\Mozilla /f
Reg: reg delete HKLM\SOFTWARE\Wow6432Node\mozilla.org /f
Reg: reg delete HKLM\SOFTWARE\Wow6432Node\MozillaPlugins /f
Reg: reg delete "HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Search" /f
Reg: reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\mountpoints2 /f
CMD: attrib -h "C:\Users\milenka21\AppData\Roaming\Toshiba"
CMD: netsh advfirewall reset

 

Adnotacja dla innych czytających: skrypt unikatowy - dopasowany tylko i wyłącznie pod ten system, proszę nie stosować na swoich systemach.

 

Plik zapisz pod nazwą fixlist.txt i umieść obok narzędzia FRST. Uruchom FRST i kliknij w Fix. Powstanie plik fixlog.txt.

 

2. Przez Panel sterowania odinstaluj: BrowserProtect, Disk Speedup, IB Updater Service, Inbox Toolbar, PjPlayer, SiteRanker, vShare.tv plugin, Web Assistant, Updater.

 

3. Wyczyść Google Chrome:

• Zresetuj cache wtyczek. W pasku adresów wpisz chrome://plugins i ENTER. Na liście wtyczek wybierz dowolną i kliknij Wyłącz. Następnie wtyczkę ponownie włącz.
• Ustawienia > karta Ustawienia > Po uruchomieniu > usuń adres mystart.incredibar.com, przestaw na "Otwórz stronę nowej karty"
• Ustawienia > karta Ustawienia > Wygląd i zaznacz "Pokaż przycisk strony startowej" > klik w Zmień i usuń adres mystart.incredibar.com
• Ustawienia > karta Ustawienia > sekcja Wyszukiwanie > klik w Zarządzanie wyszukiwarkami > na liście ustaw Google jako domyślną, po tym skasuj z listy MyStart
• Ustawienia > karta Rozszerzenia > odinstaluj SweetPacks Chrome Extension, vshare plugin
• Ustawienia > karta Historia > wyczyść

4. Uruchom AdwCleaner. Zastosuj Szukaj, a po tym Usuń. Powstanie folder C:\AdwCleaner z raportem z usuwania.

 

5. Uruchom TFC - Temp Cleaner.

 

6. Zrób nowy skan FRST (bez Addition). Dołącz plik fixlog.txt i log z AdwCleaner.

 

 

 

.

[beyondZork]

Dziekuje. Wyrzucilem oba antywirusy, zainstaluje darmowego avasta. Zalaczam wymagane logi i link do paczki minidump:

http://speedy.sh/Kce2W/Minidump.zip

Znalazlem tez dziwny katalog C:\Windows\winsxs a w nim 18 000 plikow o nazwach typu:

• amd64_61883.inf.resources_31bf3856ad364e35_6.1.7600.16385_en-us_91f21dbac7469950,
• msil_microsoft.grouppolicy.reporting_31bf3856ad364e35_6.1.7600.16385_none_49e365c00c77e1fc,
• wow64_microsoft-windows-gdi_31bf3856ad364e35_6.1.7600.16763_none_10305b4da889affa,
• x86_microsoft.windows.c..-controls.resources_6595b64144ccf1df_6.0.7600.16385_hr-hr_40dc0024304153a4,
• x86_microsoft-windows-tcpip.resources_31bf3856ad364e35_6.1.7600.16385_en-us_cc18cf7c2e77940e.

Mozna okreslic czy to potrzebne czy do skasowania?

FRST.txt

Fixlog.txt

AdwCleanerS0.txt

AdwCleanerR0.txt

[picasso]

1. Czyszczenie z adware wykonane. Mini poprawka na wpisy szczątkowe. Otwórz Notatnik i wklej w nim:

 

Winlogon\Notify\klogon: %SystemRoot%\System32\klogon.dll [X]
C:\Windows\system32\ljkb_old
C:\Users\milenka21\AppData\Local\CRE
Reg: reg add "HKCU\Software\Microsoft\Internet Explorer\SearchScopes" /v DefaultScope /t REG_SZ /d {6A1806CD-94D4-4689-BA73-E35EA1EA9990} /f
Reg: reg add "HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes" /v DefaultScope /t REG_SZ /d {6A1806CD-94D4-4689-BA73-E35EA1EA9990} /f
Reg: reg add "HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes" /v DefaultScope /t REG_SZ /d {6A1806CD-94D4-4689-BA73-E35EA1EA9990} /f
Reg: reg delete "HKU\S-1-5-18\Software\Microsoft\Internet Explorer\SearchScopes" /f
Reg: reg delete "HKU\S-1-5-19\Software\Microsoft\Internet Explorer\SearchScopes" /f
Reg: reg delete "HKU\S-1-5-20\Software\Microsoft\Internet Explorer\SearchScopes" /f

 

Plik zapisz pod nazwą fixlist.txt i umieść obok narzędzia FRST. Uruchom FRST i kliknij w Fix. Przedstaw wynikowy fixlog.txt.

 

2. W folderze Minidump był tylko jeden plik. Wyniki jego debugowania nic mi nie mówią:

 

 

 

*******************************************************************************

* *

* Bugcheck Analysis *

* *

*******************************************************************************
 

Use !analyze -v to get detailed debugging information.
 

BugCheck 1000007E, {ffffffffc0000005, fffff800037b3e8f, fffff880037f8968, fffff880037f81c0}
 

Probably caused by : ntkrnlmp.exe ( nt! ?? ::NNGAKEGL::`string'+f1df )
 

Followup: MachineOwner

---------
 

1: kd> !analyze -v

*******************************************************************************

* *

* Bugcheck Analysis *

* *

*******************************************************************************
 

SYSTEM_THREAD_EXCEPTION_NOT_HANDLED_M (1000007e)

This is a very common bugcheck. Usually the exception address pinpoints

the driver/function that caused the problem. Always note this address

as well as the link date of the driver/image that contains this address.

Some common problems are exception code 0x80000003. This means a hard

coded breakpoint or assertion was hit, but this system was booted

/NODEBUG. This is not supposed to happen as developers should never have

hardcoded breakpoints in retail code, but ...

If this happens, make sure a debugger gets connected, and the

system is booted /DEBUG. This will let us see why this breakpoint is

happening.

Arguments:

Arg1: ffffffffc0000005, The exception code that was not handled

Arg2: fffff800037b3e8f, The address that the exception occurred at

Arg3: fffff880037f8968, Exception Record Address

Arg4: fffff880037f81c0, Context Record Address
 

Debugging Details:

------------------
 
 

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - Instrukcja spod 0x%08lx odwo
 

FAULTING_IP:

nt! ?? ::NNGAKEGL::`string'+f1df

fffff800`037b3e8f 488b0f mov rcx,qword ptr [rdi]
 

EXCEPTION_RECORD: fffff880037f8968 -- (.exr 0xfffff880037f8968)

ExceptionAddress: fffff800037b3e8f (nt! ?? ::NNGAKEGL::`string'+0x000000000000f1df)

ExceptionCode: c0000005 (Access violation)

ExceptionFlags: 00000000

NumberParameters: 2

Parameter[0]: 0000000000000000

Parameter[1]: 000000000f003f08

Attempt to read from address 000000000f003f08
 

CONTEXT: fffff880037f81c0 -- (.cxr 0xfffff880037f81c0)

rax=fffffa80015c2b50 rbx=fffff8a00b7eab98 rcx=fffff8a00b7eab98

rdx=0000000000000000 rsi=0000000000000000 rdi=000000000f003f08

rip=fffff800037b3e8f rsp=fffff880037f8ba0 rbp=00000000ffffffff

r8=fffffa80015c2b50 r9=000000000000000d r10=fffff8000340a000

r11=fffff880037f8b50 r12=0000000000000000 r13=0000000000000000

r14=0000000000000000 r15=0000000000000001

iopl=0 nv up ei pl nz na pe nc

cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010202

nt! ?? ::NNGAKEGL::`string'+0xf1df:

fffff800`037b3e8f 488b0f mov rcx,qword ptr [rdi] ds:002b:00000000`0f003f08=????????????????

Resetting default scope
 

CUSTOMER_CRASH_COUNT: 1
 

DEFAULT_BUCKET_ID: WIN7_DRIVER_FAULT
 

PROCESS_NAME: System
 

CURRENT_IRQL: 0
 

ERROR_CODE: (NTSTATUS) 0xc0000005 - Instrukcja spod 0x%08lx odwo
 

EXCEPTION_PARAMETER1: 0000000000000000
 

EXCEPTION_PARAMETER2: 000000000f003f08
 

READ_ADDRESS: GetPointerFromAddress: unable to read from fffff800036b7100

GetUlongFromAddress: unable to read from fffff800036b71c0

000000000f003f08 Nonpaged pool
 

FOLLOWUP_IP:

nt! ?? ::NNGAKEGL::`string'+f1df

fffff800`037b3e8f 488b0f mov rcx,qword ptr [rdi]
 

BUGCHECK_STR: 0x7E
 

LAST_CONTROL_TRANSFER: from fffff8000376626b to fffff800037b3e8f
 

STACK_TEXT:

fffff880`037f8ba0 fffff800`0376626b : fffff8a0`0b7eab98 fffff880`037f8c44 00000000`00000004 00000000`00000001 : nt! ?? ::NNGAKEGL::`string'+0xf1df

fffff880`037f8bd0 fffff800`036d720e : fffff8a0`0b7eab98 fffffa80`015c2b50 fffff880`037f8ca4 00000000`000007ff : nt!CmpCleanUpKcbCacheWithLock+0x2b

fffff880`037f8c00 fffff800`03489261 : fffff800`036d6ed4 fffff800`036252d8 fffffa80`015c2b50 00000000`00000000 : nt!CmpDelayCloseWorker+0x33a

fffff880`037f8cb0 fffff800`0371dbae : 9d4219ff`4d3bf3ef fffffa80`015c2b50 00000000`00000080 fffffa80`015b2040 : nt!ExpWorkerThread+0x111

fffff880`037f8d40 fffff800`034708c6 : fffff880`009e6180 fffffa80`015c2b50 fffff880`009f0f40 fdbfffff`ffbbefff : nt!PspSystemThreadStartup+0x5a

fffff880`037f8d80 00000000`00000000 : fffff880`037f9000 fffff880`037f3000 fffff880`037f89e0 00000000`00000000 : nt!KxStartSystemThread+0x16
 
 

SYMBOL_STACK_INDEX: 0
 

SYMBOL_NAME: nt! ?? ::NNGAKEGL::`string'+f1df
 

FOLLOWUP_NAME: MachineOwner
 

MODULE_NAME: nt
 

IMAGE_NAME: ntkrnlmp.exe
 

DEBUG_FLR_IMAGE_TIMESTAMP: 51fb06cd
 

STACK_COMMAND: .cxr 0xfffff880037f81c0 ; kb
 

FAILURE_BUCKET_ID: X64_0x7E_nt!_??_::NNGAKEGL::_string_+f1df
 

BUCKET_ID: X64_0x7E_nt!_??_::NNGAKEGL::_string_+f1df
 

Followup: MachineOwner

---------

 

 

 

Czy po deinstalacji Avast + Kaspersky BSODy nadal występują?

 

 

Znalazlem tez dziwny katalog C:\Windows\winsxs a w nim 18 000 plikow o nazwach typu:

 

amd64_61883.inf.resources_31bf3856ad364e35_6.1.7600.16385_en-us_91f21dbac7469950,

msil_microsoft.grouppolicy.reporting_31bf3856ad364e35_6.1.7600.16385_none_49e365c00c77e1fc,

wow64_microsoft-windows-gdi_31bf3856ad364e35_6.1.7600.16763_none_10305b4da889affa,

x86_microsoft.windows.c..-controls.resources_6595b64144ccf1df_6.0.7600.16385_hr-hr_40dc0024304153a4,

x86_microsoft-windows-tcpip.resources_31bf3856ad364e35_6.1.7600.16385_en-us_cc18cf7c2e77940e.

 

Mozna okreslic czy to potrzebne czy do skasowania?

W żadnym wypadku tego nie ruszać. To podstawa Windows, folder komponentów.

 

 

 

.

[beyondZork]

Zrobione, zalaczam plik fixlog.txt. BSODy przestaly sie pojawiac. Dziekuje bardzo za pomoc ^^

Fixlog.txt