1. This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn More.
  2. Колесо Йорм Поэзия Календарь Гильдия Дайджест Календарь событий в Aion

Опять синий экран

Discussion in 'Архив' started by Fendorka, May 27, 2012.

  1. Fendorka

    Fendorka User

    Joined:
    24.05.12
    Messages:
    19
    Likes Received:
    0
    здравствуйте. снова вам пишу. весь день игра работала идеально, но вечером вновь вылетел bsod с другим кодом ошибки (к сожалению, не записал, если ещё раз вылетит - запишу). я сделал мини-дамп памяти. посмотрите этот, пожалуйста. извините за частое беспокойство. 052712-18548-01.zip.html :266:
     
    Last edited by a moderator: May 27, 2012
  2. Ari0nhh

    Ari0nhh User

    Joined:
    22.12.09
    Messages:
    4,684
    Likes Received:
    356
    поврежденный заголовок блока памяти из системного пула:
    microsoft (r) windows debugger version 6.2.8229.0 amd64
    copyright (c) microsoft corporation. all rights reserved.


    loading dump file [f:\dumps\052712-18548-01.dmp]
    mini kernel dump file: only registers and stack trace are available

    symbol search path is: srv*d:\symbols*http://msdl.microsoft.com/download/symbols;d:\
    executable search path is:
    windows 7 kernel version 7601 (service pack 1) mp (4 procs) free x86 compatible
    product: winnt, suite: terminalserver singleuserts
    built by: 7601.17803.x86fre.win7sp1_gdr.120330-1504
    machine name:
    kernel base = 0xe2c08000 psloadedmodulelist = 0xe2d514d0
    debug session time: sun may 27 22:38:49.256 2012 (utc + 6:00)
    system uptime: 0 days 0:55:01.256
    loading kernel symbols
    ...............................................................
    ................................................................
    .......................
    loading user symbols
    loading unloaded module list
    ........
    triager: could not open triage file : c:\program files (x86)\windows kits\8.0\debuggers\x64\triage\oca.ini, error 2
    *******************************************************************************
    * *
    * bugcheck analysis *
    * *
    *******************************************************************************

    use !analyze -v to get detailed debugging information.

    bugcheck 19, {20, c596f4f8, c596f5c8, 181a0000}

    getpointerfromaddress: unable to read from e2d71848
    unable to read misystemvatype memory at e2d50e20
    triager: could not open triage file : c:\program files (x86)\windows kits\8.0\debuggers\x64\triage\modclass.ini, error 2
    probably caused by : ntkrpamp.exe ( nt!exfreepoolwithtag+1b1 )

    followup: machineowner
    ---------

    2: kd> !analyze -v
    *******************************************************************************
    * *
    * bugcheck analysis *
    * *
    *******************************************************************************

    bad_pool_header (19)
    the pool is already corrupt at the time of the current request.
    this may or may not be due to the caller.
    the internal pool links must be walked to figure out a possible cause of
    the problem, and then special pool applied to the suspect tags or the driver
    verifier to a suspect driver.
    arguments:
    arg1: 00000020, a pool block header size is corrupt.
    arg2: c596f4f8, the pool entry we were looking for within the page.
    arg3: c596f5c8, the next pool entry.
    arg4: 181a0000, (reserved)

    debugging details:
    ------------------

    getpointerfromaddress: unable to read from e2d71848
    unable to read misystemvatype memory at e2d50e20
    triager: could not open triage file : c:\program files (x86)\windows kits\8.0\debuggers\x64\triage\modclass.ini, error 2

    bugcheck_str: 0x19_20

    pool_address: getpointerfromaddress: unable to read from e2d71848
    unable to read misystemvatype memory at e2d50e20
    c596f4f8

    customer_crash_count: 1

    default_bucket_id: win7_driver_fault

    process_name: skype.exe

    current_irql: 1

    irp_address: 00ce7008

    last_control_transfer: from e2c890d1 to e2d28c6b

    stack_text:
    e5355b38 e2c890d1 c596f500 00000000 c39fb5bc nt!exfreepoolwithtag+0x1b1
    e5355b84 e2cb96d6 00ce7048 e5355bb0 e5355bbc nt!iopcompleterequest+0xe6
    e5355bd4 e2c86645 00000000 00000000 00000000 nt!kideliverapc+0x111
    e5355c18 e2c854a7 c57bae08 c57bad48 c57b71d8 nt!kiswapthread+0x24e
    e5355c40 e2c7f0cf c57bad48 c57bae08 000000c0 nt!kicommitthreadwait+0x1df
    e5355cb8 e2e30d17 c57b71d8 00000006 00000001 nt!kewaitforsingleobject+0x393
    e5355d20 e2c4627a 00000354 00000001 e5355ce4 nt!ntwaitforsingleobject+0xc6
    e5355d20 777d7094 00000354 00000001 e5355ce4 nt!kifastcallentry+0x12a
    warning: frame ip not in any known module. following frames may be wrong.
    04cecbc0 00000000 00000000 00000000 00000000 0x777d7094


    stack_command: kb

    followup_ip:
    nt!exfreepoolwithtag+1b1
    e2d28c6b cc int 3

    symbol_stack_index: 0

    symbol_name: nt!exfreepoolwithtag+1b1

    followup_name: machineowner

    module_name: nt

    image_name: ntkrpamp.exe

    debug_flr_image_timestamp: 4f766ae5

    failure_bucket_id: 0x19_20_nt!exfreepoolwithtag+1b1

    bucket_id: 0x19_20_nt!exfreepoolwithtag+1b1

    followup: machineowner
    ---------

    рухнуло в контексте процесса скайпа, но виновник, судя по всему, не он. попробуйте для начала, откатить модификацию размера пользовательского адресного пространства, которую вы делали в прошлой теме.
    (для этого вам нужно запустить команду bcdedit /deletevalue increaseuserva с правами администратора и перезагрузить пк)
     
  3. Fendorka

    Fendorka User

    Joined:
    24.05.12
    Messages:
    19
    Likes Received:
    0
    спасибо, вроде не вылетает. можете, пожалуйста, на будущее сказать, какой вы программой пользуетесь для расшифровки дампов?
     
    Last edited by a moderator: May 28, 2012
  4. Ari0nhh

    Ari0nhh User

    Joined:
    22.12.09
    Messages:
    4,684
    Likes Received:
    356
  5. Fendorka

    Fendorka User

    Joined:
    24.05.12
    Messages:
    19
    Likes Received:
    0
    опять весь день нормально, а вечером вылетел. и снова код ошибки другой. =( что ж за наказание такое? весь год ни одного bsod'а и тут началось. посмотрите, пожалуйста. 052812-17503-01.zip.html
     
  6. Ari0nhh

    Ari0nhh User

    Joined:
    22.12.09
    Messages:
    4,684
    Likes Received:
    356
    один в один ваш первый bsod:
    microsoft (r) windows debugger version 6.2.8229.0 amd64
    copyright (c) microsoft corporation. all rights reserved.


    loading dump file [d:\debug\dumps\bsod\052812-17503-01.dmp]
    mini kernel dump file: only registers and stack trace are available

    symbol search path is: symsrv*symsrv.dll*d:\symbols*http://msdl.microsoft.com/download/symbols
    executable search path is:
    windows 7 kernel version 7601 (service pack 1) mp (4 procs) free x86 compatible
    product: winnt, suite: terminalserver singleuserts
    built by: 7601.17803.x86fre.win7sp1_gdr.120330-1504
    machine name:
    kernel base = 0x82c1d000 psloadedmodulelist = 0x82d664d0
    debug session time: mon may 28 23:22:02.500 2012 (utc + 6:00)
    system uptime: 0 days 2:09:45.873
    loading kernel symbols
    ...............................................................
    ................................................................
    .......................
    loading user symbols
    loading unloaded module list
    ........
    triager: could not open triage file : c:\program files (x86)\windows kits\8.0\debuggers\x64\triage\oca.ini, error 2
    triager: could not open triage file : c:\program files (x86)\windows kits\8.0\debuggers\x64\winxp\triage.ini, error 2
    *******************************************************************************
    * *
    * bugcheck analysis *
    * *
    *******************************************************************************

    use !analyze -v to get detailed debugging information.

    bugcheck 1000007e, {c0000005, 8c26a6c0, 8e78f6a0, 8e78f280}

    triager: could not open triage file : c:\program files (x86)\windows kits\8.0\debuggers\x64\triage\modclass.ini, error 2
    probably caused by : wdf01000.sys ( wdf01000!fxdriver::adddevice+2c )

    followup: machineowner
    ---------

    1: kd> !analyze -v
    *******************************************************************************
    * *
    * bugcheck analysis *
    * *
    *******************************************************************************

    system_thread_exception_not_handled_m (1000007e)
    this is a very common bugcheck. usually the exception address pinpoints
    the driver/function that caused the problem. always note this address
    as well as the link date of the driver/image that contains this address.
    some common problems are exception code 0x80000003. this means a hard
    coded breakpoint or assertion was hit, but this system was booted
    /nodebug. this is not supposed to happen as developers should never have
    hardcoded breakpoints in retail code, but ...
    if this happens, make sure a debugger gets connected, and the
    system is booted /debug. this will let us see why this breakpoint is
    happening.
    arguments:
    arg1: c0000005, the exception code that was not handled
    arg2: 8c26a6c0, the address that the exception occurred at
    arg3: 8e78f6a0, exception record address
    arg4: 8e78f280, context record address

    debugging details:
    ------------------

    triager: could not open triage file : c:\program files (x86)\windows kits\8.0\debuggers\x64\triage\modclass.ini, error 2

    exception_code: (ntstatus) 0xc0000005 - the instruction at 0x%08lx referenced memory at 0x%08lx. the memory could not be %s.

    faulting_ip:
    wdf01000!fxdriver::adddevice+2c
    8c26a6c0 80b89c00000000 cmp byte ptr [eax+9ch],0

    exception_record: 8e78f6a0 -- (.exr 0xffffffff8e78f6a0)
    exceptionaddress: 8c26a6c0 (wdf01000!fxdriver::adddevice+0x0000002c)
    exceptioncode: c0000005 (access violation)
    exceptionflags: 00000000
    numberparameters: 2
    parameter[0]: 00000000
    parameter[1]: 6d4d69f2
    attempt to read from address 6d4d69f2

    context: 8e78f280 -- (.cxr 0xffffffff8e78f280)
    eax=6d4d6956 ebx=8580e9d8 ecx=00000000 edx=00000000 esi=88677b88 edi=85956598
    eip=8c26a6c0 esp=8e78f768 ebp=8e78f964 iopl=0 nv up ei pl zr na pe nc
    cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010246
    wdf01000!fxdriver::adddevice+0x2c:
    8c26a6c0 80b89c00000000 cmp byte ptr [eax+9ch],0 ds:0023:6d4d69f2=??
    resetting default scope

    customer_crash_count: 1

    default_bucket_id: win7_driver_fault

    process_name: system

    current_irql: 0

    error_code: (ntstatus) 0xc0000005 - the instruction at 0x%08lx referenced memory at 0x%08lx. the memory could not be %s.

    exception_parameter1: 00000000

    exception_parameter2: 6d4d69f2

    read_address: getpointerfromaddress: unable to read from 82d86848
    unable to read misystemvatype memory at 82d65e20
    6d4d69f2

    followup_ip:
    wdf01000!fxdriver::adddevice+2c
    8c26a6c0 80b89c00000000 cmp byte ptr [eax+9ch],0

    bugcheck_str: 0x7e

    lock_address: 82d83be0 -- (!locks 82d83be0)

    resource @ nt!pienginelock (0x82d83be0) available

    warning: systemresourceslist->flink chain invalid. resource may be corrupted, or already deleted.


    warning: systemresourceslist->blink chain invalid. resource may be corrupted, or already deleted.

    1 total locks

    pnp_triage:
    lock address : 0x82d83be0
    thread count : 0
    thread address: 0x00000000
    thread wait : 0x0

    last_control_transfer: from 8c26a821 to 8c26a6c0

    stack_text:
    8e78f964 8c26a821 8580e9d8 8e78f98c 82c2eff9 wdf01000!fxdriver::adddevice+0x2c
    8e78f970 82c2eff9 85956598 8580e9d8 8794dbb8 wdf01000!fxdriver::adddevice+0x1b
    8e78f98c 82dcce99 8580e9d8 8c26a806 00000004 nt!ppvutilcalladddevice+0x19
    8e78f9d4 82dda90a 85956598 8c26a806 00000002 nt!pnpcalladddevice+0xb9
    8e78faa8 82dd9e96 8794dbb8 8e78fcd0 85e48908 nt!pipcalldriveradddevice+0x565
    8e78fca4 82ddae29 85aa4800 85e48908 8e78fcd0 nt!pipprocessdevnodetree+0x15d
    8e78fcd8 82c31d10 82d81b00 8572ed48 82d583bc nt!piprocessreenumeration+0x74
    8e78fd00 82c9aa6b 00000000 00000000 8572ed48 nt!pnpdeviceactionworker+0x224
    8e78fd50 82e26056 00000001 a8a1af98 00000000 nt!expworkerthread+0x10d
    8e78fd90 82cce1a9 82c9a95e 00000001 00000000 nt!pspsystemthreadstartup+0x9e
    00000000 00000000 00000000 00000000 00000000 nt!kithreadstartup+0x19


    symbol_stack_index: 0

    symbol_name: wdf01000!fxdriver::adddevice+2c

    followup_name: machineowner

    module_name: wdf01000

    image_name: wdf01000.sys

    debug_flr_image_timestamp: 4a5bbf28

    stack_command: .cxr 0xffffffff8e78f280 ; kb

    failure_bucket_id: 0x7e_wdf01000!fxdriver::adddevice+2c

    bucket_id: 0x7e_wdf01000!fxdriver::adddevice+2c

    followup: machineowner
    ---------

    1: kd> lmtn
    start end module name
    80bba000 80bc2000 kdcom kdcom.dll tue jul 14 07:08:58 2009 (4a5bdaaa)
    82000000 82023000 mrxsmb mrxsmb.sys wed apr 27 08:17:20 2011 (4db77cb0)
    82024000 820f2000 eamonm eamonm.sys tue aug 02 15:33:18 2011 (4e37c45e)
    820f2000 8210c000 wudfpf wudfpf.sys sat nov 20 15:58:55 2010 (4ce79bdf)
    8210c000 8211c000 lltdio lltdio.sys tue jul 14 05:53:18 2009 (4a5bc8ee)
    8211c000 8212f000 rspndr rspndr.sys tue jul 14 05:53:20 2009 (4a5bc8f0)
    8212f000 821b4000 http http.sys sat nov 20 14:40:17 2010 (4ce78971)
    821b4000 821cd000 bowser bowser.sys wed feb 23 10:47:32 2011 (4d649164)
    821cd000 821df000 mpsdrv mpsdrv.sys tue jul 14 05:52:52 2009 (4a5bc8d4)
    821df000 821fa000 mrxsmb20 mrxsmb20.sys wed apr 27 08:17:26 2011 (4db77cb6)
    82c1d000 8302f000 nt ntkrpamp.exe sat mar 31 08:24:37 2012 (4f766ae5)
    8302f000 83066000 hal halmacpi.dll sat nov 20 14:37:38 2010 (4ce788d2)
    83225000 832aa000 mcupdate mcupdate.dll sat nov 20 18:00:54 2010 (4ce7b876)
    832aa000 832bb000 pshed pshed.dll tue jul 14 07:09:36 2009 (4a5bdad0)
    832bb000 832c3000 bootvid bootvid.dll tue jul 14 07:04:34 2009 (4a5bd9a2)
    832c3000 83305000 clfs clfs.sys tue jul 14 05:11:10 2009 (4a5bbf0e)
    83305000 833b0000 ci ci.dll sat nov 20 18:05:17 2010 (4ce7b97d)
    833b0000 833d3000 ataport ataport.sys sat nov 20 14:38:00 2010 (4ce788e8)
    8c200000 8c229180 vmbus vmbus.sys sat nov 20 15:14:58 2010 (4ce79192)
    8c22a000 8c23c000 winhv winhv.sys sat nov 20 14:38:15 2010 (4ce788f7)
    8c23f000 8c2b0000 wdf01000 wdf01000.sys tue jul 14 05:11:36 2009 (4a5bbf28)
    8c2b0000 8c2be000 wdfldr wdfldr.sys tue jul 14 05:11:25 2009 (4a5bbf1d)
    8c2be000 8c306000 acpi acpi.sys sat nov 20 14:37:52 2010 (4ce788e0)
    8c306000 8c30f000 wmilib wmilib.sys tue jul 14 05:11:22 2009 (4a5bbf1a)
    8c30f000 8c317000 msisadrv msisadrv.sys tue jul 14 05:11:09 2009 (4a5bbf0d)
    8c317000 8c341000 pci pci.sys sat nov 20 14:37:57 2010 (4ce788e5)
    8c341000 8c34c000 vdrvroot vdrvroot.sys tue jul 14 05:46:19 2009 (4a5bc74b)
    8c34c000 8c35d000 partmgr partmgr.sys sat mar 17 11:03:08 2012 (4f641b0c)
    8c35d000 8c36d000 volmgr volmgr.sys sat nov 20 14:38:06 2010 (4ce788ee)
    8c36d000 8c3b8000 volmgrx volmgrx.sys tue jul 14 05:11:41 2009 (4a5bbf2d)
    8c3b8000 8c3bf000 pciide pciide.sys tue jul 14 05:11:19 2009 (4a5bbf17)
    8c3bf000 8c3cd000 pciidex pciidex.sys tue jul 14 05:11:15 2009 (4a5bbf13)
    8c3cd000 8c3e3000 mountmgr mountmgr.sys sat nov 20 14:38:09 2010 (4ce788f1)
    8c3e3000 8c3ec000 atapi atapi.sys tue jul 14 05:11:15 2009 (4a5bbf13)
    8c3ec000 8c3f5000 amdxata amdxata.sys fri mar 19 22:19:01 2010 (4ba3a3f5)
    8c421000 8c455000 fltmgr fltmgr.sys tue jul 14 05:11:13 2009 (4a5bbf11)
    8c455000 8c466000 fileinfo fileinfo.sys tue jul 14 05:21:51 2009 (4a5bc18f)
    8c466000 8c595000 ntfs ntfs.sys fri mar 11 09:21:11 2011 (4d799527)
    8c595000 8c5c0000 msrpc msrpc.sys tue jul 14 05:11:59 2009 (4a5bbf3f)
    8c5c0000 8c5d3000 ksecdd ksecdd.sys thu nov 17 09:15:56 2011 (4ec47c6c)
    8c62a000 8c687000 cng cng.sys thu nov 17 09:36:35 2011 (4ec48143)
    8c687000 8c695000 pcw pcw.sys tue jul 14 05:11:10 2009 (4a5bbf0e)
    8c695000 8c69e000 fs_rec fs_rec.sys thu mar 01 09:21:26 2012 (4f4eeb36)
    8c69e000 8c755000 ndis ndis.sys sat nov 20 14:39:19 2010 (4ce78937)
    8c755000 8c793000 netio netio.sys sat nov 20 14:40:03 2010 (4ce78963)
    8c793000 8c7b8000 ksecpkg ksecpkg.sys thu nov 17 09:37:34 2011 (4ec4817e)
    8c7b8000 8c7e5000 rdyboost rdyboost.sys sat nov 20 15:00:07 2010 (4ce78e17)
    8c811000 8c95c000 tcpip tcpip.sys fri mar 30 14:08:52 2012 (4f756a14)
    8c95c000 8c98d000 fwpkclnt fwpkclnt.sys sat nov 20 14:39:08 2010 (4ce7892c)
    8c98d000 8c995380 vmstorfl vmstorfl.sys sat nov 20 15:14:37 2010 (4ce7917d)
    8c996000 8c9d5000 volsnap volsnap.sys sat nov 20 14:38:13 2010 (4ce788f5)
    8c9d5000 8c9dd000 spldr spldr.sys mon may 11 22:13:47 2009 (4a084ebb)
    8c9dd000 8c9ed000 mup mup.sys tue jul 14 05:14:14 2009 (4a5bbfc6)
    8c9ed000 8c9f5000 hwpolicy hwpolicy.sys sat nov 20 14:37:35 2010 (4ce788cf)
    8ca26000 8ca58000 fvevol fvevol.sys sat nov 20 14:40:22 2010 (4ce78976)
    8ca58000 8ca69000 disk disk.sys tue jul 14 05:11:28 2009 (4a5bbf20)
    8ca69000 8ca8e000 classpnp classpnp.sys tue jul 14 05:11:20 2009 (4a5bbf18)
    8cac0000 8cadf000 cdrom cdrom.sys sat nov 20 14:38:09 2010 (4ce788f1)
    8cadf000 8cae6000 null null.sys tue jul 14 05:11:12 2009 (4a5bbf10)
    8cae6000 8caed000 beep beep.sys tue jul 14 05:45:00 2009 (4a5bc6fc)
    8caed000 8cb0d000 ehdrv ehdrv.sys tue jun 28 13:34:32 2011 (4e098408)
    8cb0d000 8cb19000 vga vga.sys tue jul 14 05:25:50 2009 (4a5bc27e)
    8cb19000 8cb3a000 videoprt videoprt.sys tue jul 14 05:25:49 2009 (4a5bc27d)
    8cb3a000 8cb47000 watchdog watchdog.sys tue jul 14 05:24:10 2009 (4a5bc21a)
    8cb47000 8cb4f000 rdpcdd rdpcdd.sys sat nov 20 16:22:19 2010 (4ce7a15b)
    8cb4f000 8cb57000 rdpencdd rdpencdd.sys tue jul 14 06:01:39 2009 (4a5bcae3)
    8cb57000 8cb5f000 rdprefmp rdprefmp.sys tue jul 14 06:01:41 2009 (4a5bcae5)
    8cb5f000 8cb6a000 msfs msfs.sys tue jul 14 05:11:26 2009 (4a5bbf1e)
    8cb6a000 8cb78000 npfs npfs.sys tue jul 14 05:11:31 2009 (4a5bbf23)
    8cb78000 8cb8f000 tdx tdx.sys sat nov 20 14:39:17 2010 (4ce78935)
    8cb8f000 8cb9b000 tdi tdi.sys sat nov 20 14:39:18 2010 (4ce78936)
    8cb9b000 8cbf5000 afd afd.sys mon apr 25 08:18:00 2011 (4db4d9d8)
    92200000 92221000 tunnel tunnel.sys sat nov 20 16:06:40 2010 (4ce79db0)
    92221000 92233000 intelppm intelppm.sys tue jul 14 05:11:03 2009 (4a5bbf07)
    92238000 9226a000 netbt netbt.sys sat nov 20 14:39:22 2010 (4ce7893a)
    9226a000 92271000 wfplwf wfplwf.sys tue jul 14 05:53:51 2009 (4a5bc90f)
    92271000 92290000 pacer pacer.sys tue jul 14 05:53:58 2009 (4a5bc916)
    92290000 9229e000 netbios netbios.sys tue jul 14 05:53:54 2009 (4a5bc912)
    9229e000 922d9000 dtsoftbus01 dtsoftbus01.sys wed dec 22 16:19:35 2010 (4d11d0b7)
    922d9000 922ec000 wanarp wanarp.sys sat nov 20 16:07:45 2010 (4ce79df1)
    922ec000 922fd000 termdd termdd.sys sat nov 20 16:21:10 2010 (4ce7a116)
    922fd000 9233e000 rdbss rdbss.sys sat nov 20 14:42:44 2010 (4ce78a04)
    9233e000 92348000 nsiproxy nsiproxy.sys tue jul 14 05:12:08 2009 (4a5bbf48)
    92348000 92352000 mssmbios mssmbios.sys tue jul 14 05:19:25 2009 (4a5bc0fd)
    92352000 9235e000 discache discache.sys tue jul 14 05:24:04 2009 (4a5bc214)
    9235e000 923c2000 csc csc.sys sat nov 20 14:44:32 2010 (4ce78a70)
    923c2000 923da000 dfsc dfsc.sys sat nov 20 14:42:32 2010 (4ce789f8)
    923da000 923e8000 blbdrive blbdrive.sys tue jul 14 05:23:04 2009 (4a5bc1d8)
    9622c000 96277000 usbport usbport.sys fri mar 25 08:58:05 2011 (4d8c04bd)
    96277000 96296000 hdaudbus hdaudbus.sys sat nov 20 15:59:28 2010 (4ce79c00)
    96296000 962f8000 rt86win7 rt86win7.sys fri jun 10 12:31:55 2011 (4df1ba5b)
    962f8000 962f96c0 asacpi asacpi.sys wed may 13 17:11:32 2009 (4a0aaae4)
    962fa000 96307000 compositebus compositebus.sys sat nov 20 15:50:21 2010 (4ce799dd)
    96307000 96319000 agilevpn agilevpn.sys tue jul 14 05:55:00 2009 (4a5bc954)
    96319000 96331000 rasl2tp rasl2tp.sys tue jul 14 05:54:33 2009 (4a5bc939)
    96331000 9633c000 ndistapi ndistapi.sys tue jul 14 05:54:24 2009 (4a5bc930)
    9633c000 9635e000 ndiswan ndiswan.sys sat nov 20 16:07:48 2010 (4ce79df4)
    9635e000 96376000 raspppoe raspppoe.sys tue jul 14 05:54:53 2009 (4a5bc94d)
    96376000 9638d000 raspptp raspptp.sys tue jul 14 05:54:47 2009 (4a5bc947)
    9638d000 963a4000 rassstp rassstp.sys tue jul 14 05:54:57 2009 (4a5bc951)
    963a4000 963af000 tap0901t tap0901t.sys wed sep 16 12:02:40 2009 (4ab07f80)
    963af000 963b9000 rdpbus rdpbus.sys tue jul 14 06:02:40 2009 (4a5bcb20)
    963b9000 963c6000 kbdclass kbdclass.sys tue jul 14 05:11:15 2009 (4a5bbf13)
    963c6000 963d3000 mouclass mouclass.sys tue jul 14 05:11:15 2009 (4a5bbf13)
    963d3000 963d4380 swenum swenum.sys tue jul 14 05:45:08 2009 (4a5bc704)
    963d5000 963f0000 epfwwfpr epfwwfpr.sys tue jun 28 13:29:04 2011 (4e0982c0)
    96800000 9680b000 dump_ataport dump_ataport.sys tue jul 14 05:11:16 2009 (4a5bbf14)
    9680b000 96814000 dump_atapi dump_atapi.sys tue jul 14 05:11:15 2009 (4a5bbf13)
    96814000 96825000 dump_dumpfve dump_dumpfve.sys tue jul 14 05:12:47 2009 (4a5bbf6f)
    96825000 9682f000 dxapi dxapi.sys tue jul 14 05:25:25 2009 (4a5bc265)
    9682f000 96835480 hidparse hidparse.sys tue jul 14 05:50:59 2009 (4a5bc863)
    96837000 969a6000 viahduaa viahduaa.sys fri jul 10 09:04:40 2009 (4a56afc8)
    969a6000 969d5000 portcls portcls.sys tue jul 14 05:51:00 2009 (4a5bc864)
    969d5000 969ee000 drmk drmk.sys tue jul 14 06:36:05 2009 (4a5bd2f5)
    969ee000 969fb000 crashdmp crashdmp.sys tue jul 14 05:45:50 2009 (4a5bc72e)
    969fb000 969fc700 usbd usbd.sys fri mar 25 08:57:53 2011 (4d8c04b1)
    96a18000 96a4c000 ks ks.sys sat nov 20 15:50:17 2010 (4ce799d9)
    96a4c000 96a5a000 umbus umbus.sys sat nov 20 16:00:23 2010 (4ce79c37)
    96a5a000 96a9e000 usbhub usbhub.sys fri mar 25 08:58:34 2011 (4d8c04da)
    96a9e000 96aaf000 ndproxy ndproxy.sys sat nov 20 16:07:39 2010 (4ce79deb)
    96aaf000 96aba000 hidusb hidusb.sys sat nov 20 15:59:38 2010 (4ce79c0a)
    96aba000 96acd000 hidclass hidclass.sys sat nov 20 15:59:37 2010 (4ce79c09)
    96acd000 96ad8000 mouhid mouhid.sys tue jul 14 05:45:08 2009 (4a5bc704)
    96ad8000 96ae3000 monitor monitor.sys tue jul 14 05:25:58 2009 (4a5bc286)
    96ae3000 96afa000 usbccgp usbccgp.sys fri mar 25 08:58:06 2011 (4d8c04be)
    96afa000 96b06000 kbdhid kbdhid.sys sat nov 20 15:50:10 2010 (4ce799d2)
    96b06000 96b76c00 pac7302 pac7302.sys tue apr 28 08:08:40 2009 (49f66528)
    96b77000 96b84180 stream stream.sys tue jul 14 05:50:57 2009 (4a5bc861)
    96b85000 96b98b80 usbaudio usbaudio.sys sat nov 20 15:59:43 2010 (4ce79c0f)
    96b99000 96bb4000 luafv luafv.sys tue jul 14 05:15:44 2009 (4a5bc020)
    96bb4000 96bef000 mrxsmb10 mrxsmb10.sys sat jul 09 08:29:57 2011 (4e17bd25)
    9a800000 9a80f000 usbehci usbehci.sys fri mar 25 08:57:58 2011 (4d8c04b6)
    9a813000 9b306000 nvlddmkm nvlddmkm.sys tue may 15 13:34:51 2012 (4fb2071b)
    9b306000 9b30a000 nvbridge nvbridge.kmd sat may 21 09:57:55 2011 (4dd73843)
    9b30a000 9b3c1000 dxgkrnl dxgkrnl.sys sat nov 20 15:08:14 2010 (4ce78ffe)
    9b3c1000 9b3fa000 dxgmms1 dxgmms1.sys thu feb 03 09:45:05 2011 (4d4a24c1)
    9bcd0000 9bf20000 win32k win32k.sys sat mar 31 08:35:51 2012 (4f766d87)
    9bf30000 9bf39000 tsddd tsddd.dll tue jul 14 06:01:40 2009 (4a5bcae4)
    9bf60000 9bf7e000 cdd cdd.dll sat nov 20 17:56:35 2010 (4ce7b773)
    9f600000 9f62a000 fastfat fastfat.sys tue jul 14 05:14:01 2009 (4a5bbfb9)
    9f63b000 9f6d2000 peauth peauth.sys tue jul 14 06:35:44 2009 (4a5bd2e0)
    9f6d2000 9f6dc000 secdrv secdrv.sys wed sep 13 19:18:32 2006 (45080528)
    9f6dc000 9f6fd000 srvnet srvnet.sys fri apr 29 08:46:08 2011 (4dba2670)
    9f6fd000 9f70a000 tcpipreg tcpipreg.sys sat nov 20 16:07:13 2010 (4ce79dd1)
    9f70a000 9f736000 000 000.fcl fri sep 26 19:11:12 2008 (48dcdf70)
    9f736000 9f786000 srv2 srv2.sys fri apr 29 08:46:13 2011 (4dba2675)
    9f786000 9f7d8000 srv srv.sys fri apr 29 08:46:30 2011 (4dba2686)
    9f7d8000 9f7e0f00 fsusbexdisk fsusbexdisk.sys fri may 28 07:03:10 2010 (4bff164e)
    b0e91000 b0e9a000 asyncmac asyncmac.sys tue jul 14 05:54:46 2009 (4a5bc946)
    b0ea2000 b0eaa000 umpass umpass.sys tue jul 14 05:51:35 2009 (4a5bc887)
    b0eaa000 b0eb8900 frost frost.sys wed nov 23 18:54:41 2011 (4ecced11)

    unloaded modules:
    b0e9a000 b0ea2000 umpass.sys
    timestamp: unavailable (00000000)
    checksum: 00000000
    imagesize: 00008000
    9f62a000 9f632000 umpass.sys
    timestamp: unavailable (00000000)
    checksum: 00000000
    imagesize: 00008000
    b0e27000 b0e91000 spsys.sys
    timestamp: unavailable (00000000)
    checksum: 00000000
    imagesize: 0006a000
    96a00000 96a18000 parport.sys
    timestamp: unavailable (00000000)
    checksum: 00000000
    imagesize: 00018000
    8ca8e000 8ca9b000 crashdmp.sys
    timestamp: unavailable (00000000)
    checksum: 00000000
    imagesize: 0000d000
    8ca9b000 8caa6000 dump_ataport
    timestamp: unavailable (00000000)
    checksum: 00000000
    imagesize: 0000b000
    8caa6000 8caaf000 dump_atapi.s
    timestamp: unavailable (00000000)
    checksum: 00000000
    imagesize: 00009000
    8caaf000 8cac0000 dump_dumpfve
    timestamp: unavailable (00000000)
    checksum: 00000000
    imagesize: 00011000

    что характерно, samsung kies вы удалили, а драйвер в системе остался:
    9f7d8000 9f7e0f00 fsusbexdisk fsusbexdisk.sys fri may 28 07:03:10 2010 (4bff164e)

    попробуйте удалить его вручную, для этого вам необходимо загрузить windows в безопасном режиме (доступен при нажатии на кнопку f8 в процессе загрузки пк), удалить файл fsusbexdisk.sys из каталога system32, затем открыть редактор реестра (пуск -> выполнить-> regedit), открыть ветку hkey_local_machine/system/currentcontrolset/services, найти ключ fsusbexdisk и удалить его. после этого загрузите пк в обычном режиме и посмотрите его поведение.
     
    Last edited by a moderator: May 29, 2012
    Fendorka likes this.