PC crashs nasumce - ghidpnp.sys

Akarhys · #1 24 veljača 2008, 08:15

Moj PC sudariti nasumično, dok sam igrati online igre. Ever put je to veliki sudar jer uvijek popularan Plava boja Zaslon od Smrt se pojavljuje uz poruku o pogrešci: STOP 0x000000D1 IRQL_NOT_LESS_OR_EQUAL,. Sys varalica taj je uzrok je varalica opozvao gHidpnp.sys.

U nastavku je izvješće Vista problem za događaj:

Proizvod
Windows

Problem
Neočekivano zatvara

Datum
23/02/2008 12:01

Stanje
Nije prijavljeno

Problem potpis
Problem Event Name: BlueScreen
OS Version: 6.0.6000.2.0.0.768.3
Locale ID: 2057

Datoteke koje pomažu opisuju problem (neke datoteke svibanj više neće biti na raspolaganju)
Mini022308-01.dmp
sysdata.xml
Version.txt

Dodatne informacije o problemu
BCCode: D1
BCP1: FFFFF98015AD4CD0
BCP2: 0000000000000002
BCP3: 0000000000000000
BCP4: FFFFF980036427FE
OS Version: 6_0_6000
Service Pack: 0_0
Product: 768_1

Verzija teksta:

Windows NT verzija 6.0 Build: 6000
Proizvod (0x3): Windows Vista (TM) Home Premium
Edition: HomePremium
BuildString: 6000.16584.amd64fre.vista_gdr.071023-1545
Flavor: višeobradnički Besplatni
Arhitektura: X64
Lcid: 1033

Nakon nekoliko istraga s događaj razglednik ako postaviti ovu datoteku u C: \ Windows \ system32 \ drivers. Nakon što pogleda na Prevx.com (http://www.prevx.com/filenames/X5154...PNP% 2ESYS.html) Sam pronašao sljedeće informacije o njemu i njegova je prema njima malware varalica.

Ime datoteke GHIDPNP.SYS je prvi put viđen Stu 13 2007 u Nizozemskoj. To je također vidjeti u sljedećim geografskim regijama Imati prevagu zajednice:

NJEMAČKA on 28 studeni 2007
Europske unije na 13 studeni 2007

Ime datoteke GHIDPNP.SYS se odnosi na mnoge verzije objekta. Oni dijele zajedničke datoteke veličine 16.384 bajtova. Ove datoteke se ne dobavljača, proizvoda ili verziju informacije navedene u datoteci zaglavlja.

GHIDPNP.SYS viđen je za obavljanje sljedećih ponašanja (s): GHIDPNP.SYS je bila predmetom sljedećih ponašanja (e):

Postavio je novi Pozadina Service na stroj

GHIDPNP.SYS također mogu koristiti sljedeće nazive datoteka:

83585039.SVD
76469032.SVD
14717296.SYS

Ja sam mislio pokrenuti sve pre-post korake i nisu našli ništa, ali ovdje su logove.

Anit-virus skandirati:

SUPERAntiSpyware Scan Prijava
http://www.superantispyware.com

Generated 02/24/2008 at 12:14

Application Version: 3/9/1008

Core Pravila Database Version: 3.408
Trace Pravila Database Version: 1400

Scan type: Cijela Scan
Ukupno Scan Time: 01:29:58

Memorija stavke skenirane: 365
Memorija prijetnje otkrivena: 0
Registry stavke skenirane: 6.568
Matični prijetnje otkrivena: 0
File stavke skenirane: 105.877
File prijetnje otkrivena: 0

Onlie skener:

# Version = 4
# OnlineScanner.ocx = 1.0.0.635
# OnlineScannerDLLA.dll = 1, 0, 0, 79
# OnlineScannerDLLW.dll = 1, 0, 0, 78
# OnlineScannerUninstaller.exe = 1, 0, 0, 49
# Vers_standard_module = 2898 (20080223)
# Vers_arch_module = 1,064 (20080214)
# Vers_adv_heur_module = 1,064 (20070717)
# EOSSerial = 647d25ee6f7396488584033c46f2b72e
# End = završio
# Remove_checked = true
# Unwanted_checked = true
# Utc_time = 2008-02-24 02:35:46
# Local_time = 2008-02-24 02:35:46 (+0000, GMT Standard Time)
# Zemlje = "United Kingdom"
# Osver = 6.0.6000 NT
# Skenirane = 516.678
# Pronašao = 0
# Scan_time = 2580

Hijack / Sniper Prijava:

Logfile of Trend Micro HijackThis v2.0.2
Skenirajte spremljena u 13:47:45, 24/02/2008
Platforma: Windows Vista (Winnt 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16609)
Boot mode: Normal

Pokretanje procesa:
C: \ Windows \ SysWOW64 \ RunDll32.exe
C: \ Program Files (x86) \ Creative \ Shared Files \ CTSched.exe
C: \ Program Files (x86) \ Windows Live \ Messenger \ msnmsgr.exe
C: \ Program Files (x86) \ DAEMON Tools Lite \ daemon.exe
C: \ Program Files (x86) \ Spybot - Search & Destroy \ TeaTimer.exe
C: \ Program Files (x86) \ SUPERAntiSpyware \ SUPERAntiSpyware.exe
C: \ Program Files (x86) \ NETGEAR \ WG111v2 \ WG111v2.exe
C: \ Program Files (x86) \ Creative \ Sound blaster X-Fi \ Volumen Panel \ VolPanlu.exe
C: \ Program Files (x86) \ Grisoft \ AVG7 \ avgcc.exe
C: \ Program Files (x86) \ iTunes \ iTunesHelper.exe
C: \ Program Files (x86) \ Java \ jre1.6.0_03 \ bin \ jusched.exe
C: \ Windows \ SysWOW64 \ CTHELPER.EXE
C: \ Windows \ SysWOW64 \ CTXFIHLP.EXE
C: \ Windows \ SysWOW64 \ CTXFISPI.EXE
C: \ Program Files (x86) \ ASUS \ AASP \ 1.00.32 \ aaCenter.exe
C: \ Program Files (x86) \ Mozilla Firefox \ firefox.exe
C: \ Program Files (x86) \ Trend Micro \ HijackThis \ sniper.exe

R1 - HKCU \ Software \ Microsoft \ Internet Explorer \ Main, Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU \ Software \ Microsoft \ Internet Explorer \ Main, Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM \ Software \ Microsoft \ Internet Explorer \ Main, Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM \ Software \ Microsoft \ Internet Explorer \ Main, Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM \ Software \ Microsoft \ Internet Explorer \ Main, Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM \ Software \ Microsoft \ Internet Explorer \ Main, Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM \ Software \ Microsoft \ Internet Explorer \ Search, SearchAssistant =
R0 - HKLM \ Software \ Microsoft \ Internet Explorer \ Search, CustomizeSearch =
R0 - HKCU \ Software \ Microsoft \ Internet Explorer \ Toolbar, LinksFolderName =
R3 - URLSearchHook: Yahoo! Toolbar - (EF99BD32-C1FB-11D2-892F-0090271D4F88) - (no file)
F2 - REG: SYSTEM.INI: UserInit = userinit.exe
O1 - Hosts::: 1 localhost
O2 - BHO: Adobe PDF Reader Link Helper - (06849E9F-C8D7-4D59-B87D-784B7D6BE0B3) - C: \ Program Files (x86) \ Common Files \ Adobe \ Acrobat \ ActiveX \ AcroIEHelper.dll
O2 - BHO: Spybot-S & D IE Protection - (53707962-6F74-2D53-2644-206D7942484F) - C: \ programa ~ 2 \ Spybot ~ 1 \ SDHelper.dll
O2 - BHO: SSVHelper Class - (761497BB-D6F0-462C-B6EB-D4DAF1D92D43) - C: \ Program Files (x86) \ Java \ jre1.6.0_03 \ bin \ ssv.dll
O2 - BHO: (no name) - (7E853D72-626A-48EC-A868-BA8D5E23E045) - (no file)
O2 - BHO: Windows Live Sign-in Helper - (9030D464-4C02-4ABF-8ECC-5164760863C6) - C: \ Program Files (x86) \ Common Files \ Microsoft Shared \ Windows Live \ WindowsLiveLogin.dll
O4 - HKLM \ .. \ Run: [VolPanel] "C: \ Program Files (x86) \ Creative \ Sound blaster X-Fi \ Volumen Panel \ VolPanlu.exe" / r
O4 - HKLM \ .. \ Run: [UpdReg] C: \ Windows \ UpdReg.EXE
O4 - HKLM \ .. \ Run: [AVG7_CC] C: \ Program ~ 2 \ Grisoft \ AVG7 \ avgcc.exe / StartUp
O4 - HKLM \ .. \ Run: [QuickTime Task] "C: \ Program Files (x86) \ QuickTime \ QTTask.exe"-atboottime
O4 - HKLM \ .. \ Run: [iTunesHelper] "C: \ Program Files (x86) \ iTunes \ iTunesHelper.exe"
O4 - HKLM \ .. \ Run: [SunJavaUpdateSched] "C: \ Program Files (x86) \ Java \ jre1.6.0_03 \ bin \ jusched.exe"
O4 - HKLM \ .. \ Run: [AsioThk32Reg] Regsvr32.exe / S CTASIO.DLL
O4 - HKLM \ .. \ Run: [CTHelper] CTHELPER.EXE
O4 - HKLM \ .. \ Run: [CTxfiHlp] CTXFIHLP.EXE
O4 - HKLM \ .. \ Run: [CTXFIREG] CTxfiReg.exe
O4 - HKLM \ .. \ Run: [ioCentre] C: \ Genius \ ioCentre \ gTaskBar.exe
O4 - HKLM \ .. \ Run: [Adobe Reader Speed Launcher] "C: \ Program Files (x86) \ Adobe \ Reader 8,0 \ Reader \ Reader_sl.exe"
O4 - HKLM \ .. \ Run: [! AVG Anti-Spyware] "C: \ Program Files (x86) \ Grisoft \ AVG Anti-Spyware 7,5 \ avgas.exe" / minimiziran
O4 - HKLM \ .. \ Run: [CreativeTaskScheduler] "C: \ Program Files (x86) \ Creative \ Shared Files \ CTSched.exe" / prijava
O4 - HKCU \ .. \ Run: [MsnMsgr] "C: \ Program Files (x86) \ Windows Live \ Messenger \ MsnMsgr.Exe" / background
O4 - HKCU \ .. \ Run: [ehTray.exe] C: \ Windows \ ehome \ ehTray.exe
O4 - HKLM \ .. \ Run: [DAEMON Tools Lite] "C: \ Program Files (x86) \ DAEMON Tools Lite \ daemon.exe"
O4 - HKCU \ .. \ Run: [SpybotSD TeaTimer] C: \ Program Files (x86) \ Spybot - Search & Destroy \ TeaTimer.exe
O4 - HKCU \ .. \ Run: [SUPERAntiSpyware] C: \ Program Files (x86) \ SUPERAntiSpyware \ SUPERAntiSpyware.exe
O4 - HKUS \ S-1-5-19 \ .. \ Run: [Sidebar]% ProgramFiles% \ Windows Sidebar \ Sidebar.exe / detectMem (User 'LOCAL SERVICE')
O4 - HKUS \ S-1-5-19 \ .. \ Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll, ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS \ S-1-5-19 \ .. \ Run: [AVG7_Run] C: \ Program ~ 2 \ Grisoft \ AVG7 \ avgw.exe / RunOnce (User 'LOCAL SERVICE')
O4 - HKUS \ S-1-5-20 \ .. \ Run: [Sidebar]% ProgramFiles% \ Windows Sidebar \ Sidebar.exe / detectMem (User 'NETWORK SERVICE')
O4 - HKUS \ S-1-5-18 \ .. \ Run: [AVG7_Run] C: \ Program ~ 2 \ Grisoft \ AVG7 \ avgw.exe / RunOnce (User 'SYSTEM')
O4 - HKUS \. DEFAULT \ .. \ Run: [AVG7_Run] C: \ Program ~ 2 \ Grisoft \ AVG7 \ avgw.exe / RunOnce (User 'Default user')
O4 - Global Startup: Microsoft Office.lnk = C: \ Program Files (x86) \ Microsoft Office \ Office10 \ OSA.EXE
O4 - Global Startup: NETGEAR WG111v2 Smart Wizard.lnk =?
Ø8 - Extra context menu item: I & zvezi u Microsoft Excel - res: / / C: \ Program ~ 2 \ MICROS ~ 1 \ Office10 \ EXCEL.EXE/3000
O9 - Extra button: (no name) - (08B0E5C0-4FCB-11CF-AAA5-00401C608501) - C: \ Program Files (x86) \ Java \ jre1.6.0_03 \ bin \ ssv.dll
O9 - Extra 'Tools' MENUITEM: Sun Java Console - (08B0E5C0-4FCB-11CF-AAA5-00401C608501) - C: \ Program Files (x86) \ Java \ jre1.6.0_03 \ bin \ ssv.dll
O9 - Extra button: Ovaj blog - (219C3416-8CB2-491a-A3C7-D9FCDDC9D600) - C: \ Program Files (x86) \ Windows Live \ Writer \ WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: & Blog This u sustavu Windows Live Writer - (219C3416-8CB2-491a-A3C7-D9FCDDC9D600) - C: \ Program Files (x86) \ Windows Live \ Writer \ WriterBrowserExtension.dll
O9 - Extra button: (no name) - (DFB852A3-47F8-48C4-A200-58CAB36FD2A2) - C: \ programa ~ 2 \ Spybot ~ 1 \ SDHelper.dll
O9 - Extra 'Tools' MENUITEM: Spybot - Search & Destroy Configuration - (DFB852A3-47F8-48C4-A200-58CAB36FD2A2) - C: \ programa ~ 2 \ Spybot ~ 1 \ SDHelper.dll
O16 - DPF: (20A60F0D-9AFA-4515-A0FD-83BD84642501) (dame Class) -- http://messenger.zone.msn.com/binary...r.cab56986.cab
O16 - DPF: (56762DEC-6B0D-4AB4-A8AD-989993B5D08B) (OnlineScanner Control) -- http://www.eset.eu/buxus/docs/OnlineScanner.cab
O16 - DPF: (5C051655-FCD5-4969-9182-770EA5AA5565) (Solitaire Showdown Class) -- http://messenger.zone.msn.com/binary...n.cab56986.cab
O16 - DPF: (C3F79A2B-B9B4-4A66-B012-3EE46475B072) (MessengerStatsClient Class) -- http://messenger.zone.msn.com/binary...t.cab56907.cab
O16 - DPF: (D27CDB6E-AE6D-11CF-96B8-444553540000) (Shockwave Flash Object) -- http://fpdownload2.macromedia.com/ge...sh/swflash.cab
O16 - DPF: (F6ACF75C-C32C-447B-9BEF-46B766368D29) (Creative Software automatskog Support Package) -- http://www.creative.com/su2/CTL_V020...5030/CTPID.cab
O20 - Winlogon Obavijesti:! SASWinLogon - C: \ Program Files (x86) \ SUPERAntiSpyware \ SASWINLO.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C: \ Program Files (x86) \ Lavasoft \ Ad-Aware 2007 \ aawservice.exe
O23 - Service: @% SystemRoot% \ system32 \ Alg.exe, -112 (ALG) - Unknown vlasnika - C: \ Windows \ System32 \ alg.exe (file missing)
O23 - Service: AVG Anti-Spyware Guard - Grisoft sro - C: \ Program Files (x86) \ Grisoft \ AVG Anti-Spyware 7,5 \ guard.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - Grisoft, sro - C: \ Program ~ 2 \ Grisoft \ AVG7 \ avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - Grisoft, sro - C: \ Program ~ 2 \ Grisoft \ AVG7 \ avgupsvc.exe
O23 - Service: AVG7 Resident Shield Service (AvgCoreSvc) - Grisoft, sro - C: \ Program ~ 2 \ Grisoft \ AVG7 \ avgrssvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - Grisoft, sro - C: \ Program ~ 2 \ Grisoft \ AVG7 \ avgemc.exe
O23 - Service: @ dfsrres.dll, -101 (DFSR) - Unknown vlasnika - C: \ Windows \ system32 \ DFSR.exe (file missing)
O23 - Service: iPod Service - Apple Inc - C: \ Program Files (x86) \ iPod \ bin \ iPodService.exe
O23 - Service: @ keyiso.dll, -100 (KeyIso) - Unknown vlasnika - C: \ Windows \ system32 \ lsass.exe (file missing)
O23 - Service: @ comres.dll, -2797 (MSDTC) - Unknown vlasnika - C: \ Windows \ System32 \ msdtc.exe (file missing)
O23 - Service: NBService - Nero AG - C: \ Program Files (x86) \ Nero \ Nero 7 \ Nero BackItUp \ NBService.exe
O23 - Service: @% SystemRoot% \ System32 \ netlogon.dll, -102 (Netlogon) - Unknown vlasnika - C: \ Windows \ system32 \ lsass.exe (file missing)
O23 - Service: PnkBstrA - Unknown vlasnika - C: \ Windows \ system32 \ PnkBstrA.exe
O23 - Service: @% SystemRoot% \ System32 \ psbase.dll, -300 (ProtectedStorage) - Unknown vlasnika - C: \ Windows \ system32 \ lsass.exe (file missing)
O23 - Service: @% SystemRoot% \ System32 \ Locator.exe, -2 (RpcLocator) - Unknown vlasnika - C: \ Windows \ system32 \ locator.exe (file missing)
O23 - Service: @% SystemRoot% \ system32 \ samsrv.dll, -1 (SamSs) - Unknown vlasnika - C: \ Windows \ system32 \ lsass.exe (file missing)
O23 - Service: SBSD Security Center Service (SBSDWSCService) - Safer Networking Ltd - C: \ Program Files (x86) \ Spybot - Search & Destroy \ SDWinSec.exe
O23 - Service: SCM_Service - Unknown owner - C: \ Windows \ SysWOW64 \ WinService.exe
O23 - Service: @% SystemRoot% \ system32 \ SLsvc.exe, -101 (slsvc) - Unknown vlasnika - C: \ Windows \ system32 \ SLsvc.exe (file missing)
O23 - Service: @% SystemRoot% \ system32 \ snmptrap.exe, -3 (SNMPTRAP) - Unknown vlasnika - C: \ Windows \ System32 \ snmptrap.exe (file missing)
O23 - Service: @% systemroot% \ system32 \ spoolsv.exe, -1 (red čekanja) - Unknown vlasnika - C: \ Windows \ System32 \ spoolsv.exe (file missing)
O23 - Service: @% SystemRoot% \ system32 \ ui0detect.exe, -101 (UI0Detect) - Unknown vlasnika - C: \ Windows \ system32 \ UI0Detect.exe (file missing)
O23 - Service: @% SystemRoot% \ system32 \ vds.exe, -100 (vds) - Unknown vlasnika - C: \ Windows \ System32 \ vds.exe (file missing)
O23 - Service: @% SystemRoot% \ System32 \ vssvc.exe, -102 (VSS) - Unknown vlasnika - C: \ Windows \ system32 \ vssvc.exe (file missing)
O23 - Service: @% SystemRoot% \ System32 \ wbem \ wmiapsrv.exe, -110 (wmiApSrv) - Unknown vlasnika - C: \ Windows \ system32 \ wbem \ WmiApSrv.exe (file missing)
O23 - Service: @% ProgramFiles% \ Windows Media Player \ wmpnetwk.exe, -101 (WMPNetworkSvc) - Unknown vlasnika - C: \ Program Files (x86) \ Windows Media Player \ wmpnetwk.exe (file missing)

--
End of file - 10.326 bajtova

Ja sam sada na izgubljen kao što će učiniti, jer STOP nesreći čuva se događa. Nadam se da li sva pošta pravo info i, ako je potrebno će postavljati više jer ovaj problem je vozeći mene sićušna posuda.

**evilfantasy** · #2 24 veljača 2008, 09:29

HijackThis nije u skladu s 64bitne sustave tako da ne mogu napraviti dobru odluku na zapisnik. Ali ono što ja mogu vidjeti to nije problem malware. To je hardverski problem tako da ću ovo premjestiti na hardver forum.

http://support.microsoft.com/kb/810980

**philthomas** · #3 24 veljača 2008, 11:55

Ova greška se često javlja kao rezultat loše ili neispravan upravljački program.

Jeste li instalirali ili nadogradili upravljački programi bilo prije ovo događa? ...... ako je tako probati valjanje leđa ili deinstalacijom / ih i vidjeti ako izgubite problema.

Akarhys · #4 24. veljača 2008, 13:39

Ive 'obnovljeno moj gfx karta vozač, bežični miš, tipkovnica i mrežni prilagodnik i vidjeti ako ovaj vrste problema. Kao što se slučajno dogodi ja ću pustiti te znati što ide dalje.

Blacky · #5 1. srpnja 2008, 13:57

Imam isti problem, ali to se događa kad procesor aktivnosti doći maksimalno (ususlly ekran bi trebao pravedan smrznuti se u nekoliko trenutaka), a kad je moj usb miš pluged - genijalac ergo 525v. Imam slab Vista ... Kad sam deinstalira miš, plava boja zaslon prestao pojavljivati. Ali, dodatne tipke stoped radi kao ... da ne molim za mene.

**winifred42** · #6 1. srpnja 2008, 14:25

Bok
Imao sam ovaj problem prije nego i ispostavilo se da se RAM-a na taj način pokušati promjena ili čišćenje RAM-a i vidjeti ako još niste dobili ovaj problem.