+- Windows 7 Forum: konfiguracja, optymalizacja, porady, gadżety • (https://windows7forum.pl)
+-- Dział: Pomoc i wsparcie, Windows 7 (/pomoc-i-wsparcie-windows-7-26-f)
+--- Dział: Bezpieczeństwo Windows 7 (/bezpieczenstwo-windows-7-15-f)
+--- Wątek: Problem z plikiem ntoskrnl.exe i blue screen (/problem-z-plikiem-ntoskrnl-exe-i-blue-screen-14655-t)
Strony: 1 2
RE: Problem z plikiem ntoskrnl.exe i blue screen - biedrona01 - 19.04.2011 05:26
Używam Avasta
nie ma nigdzie Poslanec czy Usluga Poslaniec.. a mozna jakos inaczej to znaleść ?
RE: Problem z plikiem ntoskrnl.exe i blue screen - bodziulla - 20.04.2011 21:57
Hej.
No tak co ze mnie za gapa. Kod z reguły dotyczył błędu z usługą Posłaniec z tym, że od systemu Vista nie ma już jej. Jest też opcja, że po prostu masz infekcję. Przepraszam za mój pierwszy błąd. Jeżeli możesz pobierz sobie program GData link:
http://www.gdata.pl/page/4/wersje-testowe-do-pobrania
W Twoim przypadku wersja na 30 dni wystarczy. Odinstaluj Avasta. Zainstaluj GData, zaktualizuj i przeskanuj. Zobaczymy jaki efekt. Mam również do Ciebie prośbę jakbyś mógł po tej operacji zrobić log programem OTL?. Jeżeli nie wiesz co i jak napisz
Pzdr
RE: Problem z plikiem ntoskrnl.exe i blue screen - biedrona01 - 21.04.2011 12:37
http://www.wrzuc.to/bBilzwtH1x.wt linki do pliku z log
http://www.wrzuc.to/9VAzzw.wt
Przeskanowałem GData lecz nic nie wykrył
RE: Problem z plikiem ntoskrnl.exe i blue screen - bodziulla - 21.04.2011 14:05
Hej.
W teorii wobec OTL niby gra. Teraz tak mam do Ciebie prośbę i zrób skan programem HDTune swojego dysku. Zakładka ErrorScan i Scan. Po czym jak możesz pokaż też zakładkę jak wygląda sprawa w Health
Dwa jak możesz zrób skan programem też BurnIn Test jak nie wiesz jak go obsłużyć pisz
Pzdr
RE: Problem z plikiem ntoskrnl.exe i blue screen - biedrona01 - 22.04.2011 08:28
Zainstalowałem kasperskiegoi on wykrył 2 jakieś pliki zarażone . Jeden z nich to HEUR:Trojan.Win32. oraz jakiś drugi plik który jest '' nieznanym zagrożeniem ''
Moze te pliki są odpowiedzialne za to wszystko ?
RE: Problem z plikiem ntoskrnl.exe i blue screen - biedrona01 - 26.04.2011 13:30
Niestety blue screen ZNÓW powrócił
. Zrobiłem test '' BurnIn Test'' lecz nic nie wykrył , a także programem HDTune też nic .Oto zdjęcie z zakładką health w załączniku
RE: Problem z plikiem ntoskrnl.exe i blue screen - biedrona01 - 30.04.2011 10:59
Czy ma ktoś jeszcze jakiś pomysł jak znaleść żródło tego problemu ?
;P
RE: Problem z plikiem ntoskrnl.exe i blue screen - bodziulla - 03.05.2011 13:12
Hej.
Mam prośbę jak piszesz o bluescrenie wyślij odrazu plik dmp to bardziej pomoże
Pzdr
RE: Problem z plikiem ntoskrnl.exe i blue screen - Przemas90 - 25.10.2011 14:10
Mam identyczny problem. Wyświetlało mi błąd pliku ntoskrnl.exe. Mam blue screeny przy starcie systemu. Na jednym z nich (inny niż pozostałe) zauważyłem również błąd pliku win32k.sys.
Dodam że problem powstał w wyniku dodania 2GB RAMu i zmiany systemu z WinXP na Win7 HP x64. Mam 2 sloty. W obu po 2GB ram co daje razem 4GB. Pamięci przemieniałem na wszystkie różne sposoby. Problemu nie było kiedy laptop pracował na 2GB RAM w dolnym slocie ale nawet jak zamieniłem na górny to był błąd. Teraz udało mi się odpalić system z 4GB ale poszedłem do serwisu i tam już przy starcie był blue screen. Facet nie chciał zbytnio zdradzić o co chodzi, powiedział jedynie że źle zainstalowałem system. Żebym sterowniki wgrał od dysku przy starcie systemu ale powiedział że muszę to zrobić w odpowiednim momencie instalacji. Za wszystko by kase brali. Laptop wrócił od nich z naprawy 4 dni temu i poza naprawą karty graficznej dokupiłem sobie od nich te 2GB RAM.
Nie wiem czy u każdego tak jest ale gdy mam 4GB ram to mam ponad 3GB więcej zajętego miejsca na dysku C: :/
Prosze o pomoc. Jestem cały czas do dyspozycji więc szybko odpisze na pytania.
Edit: Teraz mi się włączył bluescreen przy 1 kości (tej nowej), a następnie po restarcie uruchomil mi sie system tyle że ze starą kompozycją Windows, nie z tą z Win7.
Zrobiłem restart i teraz włączył mi się CHKDSK i sprawdza pliki na dysku C.
----------------------------
I proszę zamieniłem kości, i potwierdza się to że na mojej starej pamięci RAM, która jest w dolnym slocie wszystko działa poprawnie.
Tutaj jeszcze zostawiam 2 logi
Kod:
Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [C: \Users\Przemek\Desktop\102511-26395-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: *** Invalid ***
****************************************************************************
* Symbol loading may be unreliable without a symbol search path. *
* Use .symfix to have the debugger choose a symbol path. *
* After setting your symbol path, use .reload to refresh symbol locations. *
****************************************************************************
Executable search path is:
*********************************************************************
* Symbols can not be loaded because symbol path is not initialized. *
* *
* The Symbol Path can be set by: *
* using the _NT_SYMBOL_PATH environment variable. *
* using the -y <symbol_path> argument when starting the debugger. *
* using .sympath and .sympath+ *
*********************************************************************
Unable to load image \SystemRoot\system32\ntoskrnl.exe, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
*** ERROR: Module load completed but symbols could not be loaded for ntoskrnl.exe
Windows 7 Kernel Version 7600 MP (2 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7600.16841.amd64fre.win7_gdr.110622-1503
Machine Name:
Kernel base = 0xfffff800`02a08000 PsLoadedModuleList = 0xfffff800`02c45e70
Debug session time: Tue Oct 25 15: 40: 12.052 2011 (GMT+2)
System Uptime: 0 days 0: 00: 27.471
*********************************************************************
* Symbols can not be loaded because symbol path is not initialized. *
* *
* The Symbol Path can be set by: *
* using the _NT_SYMBOL_PATH environment variable. *
* using the -y <symbol_path> argument when starting the debugger. *
* using .sympath and .sympath+ *
*********************************************************************
Unable to load image \SystemRoot\system32\ntoskrnl.exe, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
*** ERROR: Module load completed but symbols could not be loaded for ntoskrnl.exe
Loading Kernel Symbols
...............................................................
................................................................
.........
Loading User Symbols
Loading unloaded module list
....
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 1A, {41790, fffffa800139a340, ffff, 0}
***** Kernel symbols are WRONG. Please fix symbols to do analysis.
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
*************************************************************************
*********************************************************************
* Symbols can not be loaded because symbol path is not initialized. *
* *
* The Symbol Path can be set by: *
* using the _NT_SYMBOL_PATH environment variable. *
* using the -y <symbol_path> argument when starting the debugger. *
* using .sympath and .sympath+ *
*********************************************************************
*********************************************************************
* Symbols can not be loaded because symbol path is not initialized. *
* *
* The Symbol Path can be set by: *
* using the _NT_SYMBOL_PATH environment variable. *
* using the -y <symbol_path> argument when starting the debugger. *
* using .sympath and .sympath+ *
*********************************************************************
Probably caused by : ntoskrnl.exe ( nt+705c0 )
Followup: MachineOwner
---------
[/quote]
[quote]
Loading Dump File [C: \Windows\Minidump\102511-19890-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: *** Invalid ***
****************************************************************************
* Symbol loading may be unreliable without a symbol search path. *
* Use .symfix to have the debugger choose a symbol path. *
* After setting your symbol path, use .reload to refresh symbol locations. *
****************************************************************************
Executable search path is:
*********************************************************************
* Symbols can not be loaded because symbol path is not initialized. *
* *
* The Symbol Path can be set by: *
* using the _NT_SYMBOL_PATH environment variable. *
* using the -y <symbol_path> argument when starting the debugger. *
* using .sympath and .sympath+ *
*********************************************************************
Unable to load image ntoskrnl.exe, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
*** ERROR: Module load completed but symbols could not be loaded for ntoskrnl.exe
Windows 7 Kernel Version 7600 MP (2 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Machine Name:
Kernel base = 0xfffff800`02a19000 PsLoadedModuleList = 0xfffff800`02c56e70
Debug session time: Tue Oct 25 15: 51: 14.218 2011 (GMT+2)
System Uptime: 0 days 0: 00: 11.622
*********************************************************************
* Symbols can not be loaded because symbol path is not initialized. *
* *
* The Symbol Path can be set by: *
* using the _NT_SYMBOL_PATH environment variable. *
* using the -y <symbol_path> argument when starting the debugger. *
* using .sympath and .sympath+ *
*********************************************************************
Unable to load image ntoskrnl.exe, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
*** ERROR: Module load completed but symbols could not be loaded for ntoskrnl.exe
Loading Kernel Symbols
...................................................
Loading User Symbols
Mini Kernel Dump does not contain unloaded driver list
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 124, {0, fffffa80027fb038, 0, 0}
***** Kernel symbols are WRONG. Please fix symbols to do analysis.
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_WHEA_ERROR_RECORD_HEADER ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_WHEA_ERROR_RECORD_HEADER ***
*** ***
*************************************************************************
Unable to load image PSHED.dll, Win32 error 0n2
*** WARNING: Unable to verify timestamp for PSHED.dll
*** ERROR: Module load completed but symbols could not be loaded for PSHED.dll
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: pshed!_WHEA_ERROR_RECORD_HEADER ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: pshed!_WHEA_ERROR_RECORD_SECTION_DESCRIPTOR ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: pshed!_WHEA_ERROR_RECORD_HEADER ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: pshed!_WHEA_ERROR_RECORD_HEADER ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: pshed!_WHEA_ERROR_RECORD_HEADER ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
*************************************************************************
*********************************************************************
* Symbols can not be loaded because symbol path is not initialized. *
* *
* The Symbol Path can be set by: *
* using the _NT_SYMBOL_PATH environment variable. *
* using the -y <symbol_path> argument when starting the debugger. *
* using .sympath and .sympath+ *
*********************************************************************
*********************************************************************
* Symbols can not be loaded because symbol path is not initialized. *
* *
* The Symbol Path can be set by: *
* using the _NT_SYMBOL_PATH environment variable. *
* using the -y <symbol_path> argument when starting the debugger. *
* using .sympath and .sympath+ *
*********************************************************************
Probably caused by : hardware
Followup: MachineOwner