Błąd - BlueScreen

Na kompie z systemem Windows Vista Home Basic chciałem zainstalować Eset Smart Security. Już był koniec instalacji i pojawił się czarny ekran z niebieskimi plamkami (wygląda jak tekst, sądząc po linijkach, ale nie da rady odczytać). Następnie komputer się zrestartował i … nie chciał się włączyć. Znów wyskakiwało to samo. Wreszcie odpaliłem tryb awaryjny i chciałem odinstalować owy program. Jednak, nie było go na liście programów w “Programy i funkcje”. Znalazłem więc folder w Program Files, ale nie było tam pliku “uninstall”. Usunąłem więc folder i wyczyściłem rejestr. Próbowałem też przywrócić system. W efekcie tego, komputer działa co drugi/trzeci raz, czasem sam się zresetuje, czasem przez 5 włączeń zamiast się włączać się restartuje. Po włączeniu jest napisane, że był błąd BlueScreen.

Sformatowałbym dysk C i od nowa zainstalował Vistę, ale po bootowaniu płyty z Vistą robi się czarny ekran i koniec…

Co teraz? :?

Co do BSODa to: PPM na mój komp > zaawansowane > uruchamianie i odzyskiwanie --> ustawienia > odznacz automatycznie uruchom ponownie > ok

I teraz spisz co to za BSOD. (może być nr błędu lub jakiś plik który wywołał ten błąd).

Spisz jedno i drugie, sam plik to często za mało.

Można też odczytać ostatnie przyczyny błędów z plików DMP:

Aby odczytać problem, którego dotyczy BSOD użyj tego: Klik

Ale ja nie mogę tego odczytać nie dlatego że szybko znika (restart) ale dlatego, że to tylko plamki, które sądząc po linijkach są tekstem

Jak za szybko znika to zrób to co napisałem wcześniej.

Microsoft (R) Windows Debugger Version 6.9.0003.113 X86

Copyright (c) Microsoft Corporation. All rights reserved.



Loading Dump File [C]

Mini Kernel Dump File: Only registers and stack trace are available


Symbol search path is: ***Invalid***

****************************************************************************

* Symbol loading may be unreliable without a symbol search path. *

* Use .symfix to have the debugger choose a symbol path. *

* After setting your symbol path, use .reload to refresh symbol locations. *

****************************************************************************

Executable search path is: 

*********************************************************************

* Symbols can not be loaded because symbol path is not initialized. *

* *

* The Symbol Path can be set by: *

* using the _NT_SYMBOL_PATH environment variable. *

* using the -y argument when starting the debugger. *

* using .sympath and .sympath+ *

*********************************************************************

Unable to load image ntoskrnl.exe, Win32 error 0n2

*** WARNING: Unable to verify timestamp for ntoskrnl.exe

*** ERROR: Module load completed but symbols could not be loaded for ntoskrnl.exe

Windows Vista Kernel Version 6000 MP (2 procs) Free x86 compatible

Product: WinNt, suite: TerminalServer SingleUserTS Personal

Kernel base = 0x81c00000 PsLoadedModuleList = 0x81d11e10

Debug session time: Mon Jul 28 22:25:19.426 2008 (GMT+2)

System Uptime: 0 days 0:00:30.082

*********************************************************************

* Symbols can not be loaded because symbol path is not initialized. *

* *

* The Symbol Path can be set by: *

* using the _NT_SYMBOL_PATH environment variable. *

* using the -y argument when starting the debugger. *

* using .sympath and .sympath+ *

*********************************************************************

Unable to load image ntoskrnl.exe, Win32 error 0n2

*** WARNING: Unable to verify timestamp for ntoskrnl.exe

*** ERROR: Module load completed but symbols could not be loaded for ntoskrnl.exe

Loading Kernel Symbols

.................................................................................................................................................

Loading User Symbols

Loading unloaded module list

.....

Unable to load image ndisuio.sys, Win32 error 0n2

*** WARNING: Unable to verify timestamp for ndisuio.sys

*** ERROR: Module load completed but symbols could not be loaded for ndisuio.sys

Unable to load image ndis.sys, Win32 error 0n2

*** WARNING: Unable to verify timestamp for ndis.sys

*** ERROR: Module load completed but symbols could not be loaded for ndis.sys

*******************************************************************************

* *

* Bugcheck Analysis *

* *

*******************************************************************************


Use !analyze -v to get detailed debugging information.


BugCheck 100000D1, {14, 2, 0, 88fa6f7c}


*** WARNING: Unable to verify timestamp for Epfwndis.sys

*** ERROR: Module load completed but symbols could not be loaded for Epfwndis.sys

*** WARNING: Unable to verify timestamp for RT61.sys

*** ERROR: Module load completed but symbols could not be loaded for RT61.sys

***** Kernel symbols are WRONG. Please fix symbols to do analysis.


*************************************************************************

******

******

***Your debugger is not using the correct symbols***

******

***In order for this command to work properly, your symbol path***

***must point to .pdb files that have full type information.***

******

***Certain .pdb files (such as the public OS symbols) do not***

***contain the required information. Contact the group that***

***provided you with these symbols if you need this command to***

***work.***

******

***Type referenced: nt!_KPRCB***

******

*************************************************************************

*************************************************************************

******

******

***Your debugger is not using the correct symbols***

******

***In order for this command to work properly, your symbol path***

***must point to .pdb files that have full type information.***

******

***Certain .pdb files (such as the public OS symbols) do not***

***contain the required information. Contact the group that***

***provided you with these symbols if you need this command to***

***work.***

******

***Type referenced: nt!KPRCB***

******

*************************************************************************

*************************************************************************

******

******

***Your debugger is not using the correct symbols***

******

***In order for this command to work properly, your symbol path***

***must point to .pdb files that have full type information.***

******

***Certain .pdb files (such as the public OS symbols) do not***

***contain the required information. Contact the group that***

***provided you with these symbols if you need this command to***

***work.***

******

***Type referenced: nt!_KPRCB***

******

*************************************************************************

*************************************************************************

******

******

***Your debugger is not using the correct symbols***

******

***In order for this command to work properly, your symbol path***

***must point to .pdb files that have full type information.***

******

***Certain .pdb files (such as the public OS symbols) do not***

***contain the required information. Contact the group that***

***provided you with these symbols if you need this command to***

***work.***

******

***Type referenced: nt!KPRCB***

******

*************************************************************************

*************************************************************************

******

******

***Your debugger is not using the correct symbols***

******

***In order for this command to work properly, your symbol path***

***must point to .pdb files that have full type information.***

******

***Certain .pdb files (such as the public OS symbols) do not***

***contain the required information. Contact the group that***

***provided you with these symbols if you need this command to***

***work.***

******

***Type referenced: nt!_KPRCB***

******

*************************************************************************

*************************************************************************

******

******

***Your debugger is not using the correct symbols***

******

***In order for this command to work properly, your symbol path***

***must point to .pdb files that have full type information.***

******

***Certain .pdb files (such as the public OS symbols) do not***

***contain the required information. Contact the group that***

***provided you with these symbols if you need this command to***

***work.***

******

***Type referenced: nt!_KPRCB***

******

*************************************************************************

*************************************************************************

******

******

***Your debugger is not using the correct symbols***

******

***In order for this command to work properly, your symbol path***

***must point to .pdb files that have full type information.***

******

***Certain .pdb files (such as the public OS symbols) do not***

***contain the required information. Contact the group that***

***provided you with these symbols if you need this command to***

***work.***

******

***Type referenced: nt!_KPRCB***

******

*************************************************************************

*************************************************************************

******

******

***Your debugger is not using the correct symbols***

******

***In order for this command to work properly, your symbol path***

***must point to .pdb files that have full type information.***

******

***Certain .pdb files (such as the public OS symbols) do not***

***contain the required information. Contact the group that***

***provided you with these symbols if you need this command to***

***work.***

******

***Type referenced: nt!_KPRCB***

******

*************************************************************************

*********************************************************************

* Symbols can not be loaded because symbol path is not initialized. *

* *

* The Symbol Path can be set by: *

* using the _NT_SYMBOL_PATH environment variable. *

* using the -y argument when starting the debugger. *

* using .sympath and .sympath+ *

*********************************************************************

*********************************************************************

* Symbols can not be loaded because symbol path is not initialized. *

* *

* The Symbol Path can be set by: *

* using the _NT_SYMBOL_PATH environment variable. *

* using the -y argument when starting the debugger. *

* using .sympath and .sympath+ *

*********************************************************************

Probably caused by : ndisuio.sys ( ndisuio+2f7c )


Followup: MachineOwner

Chyba mam tego trojana:

Jak go usunąć?

Powiem tak: Skończyła mi się licencja NOD32 i jakieś 2 tyg śmigałem bez antywira i cóż…

Ktoś wie jak się tego pozbyć?

Co do tego wirusa to masz odpowiedni dział viewforum.php?f=16

Załóż nowy temat i podaj logi z HijackThis i Combofix.

OK, dzięki