Народ подскажите у знакомого на компе постоянно подает svchost.exe пишет, что то типа приложение будет закрыто по безопасности вроде дамп у него слил только понять не могу где баг и как исправить Код (Text): 0:020> !analyze -v ******************************************************************************* * * * Exception Analysis * * * ******************************************************************************* Cannot find frame 0x94, previous scope unchanged Cannot find frame 0xef, previous scope unchanged Matched: 7c887764 kernel32!BasepAppCertDllsList = <no type information> Matched: 7c8858d0 kernel32!BasepAppCertDllsList = <no type information> ************************************************************************* *** *** *** *** *** Your debugger is not using the correct symbols *** *** *** *** In order for this command to work properly, your symbol path *** *** must point to .pdb files that have full type information. *** *** *** *** Certain .pdb files (such as the public OS symbols) do not *** *** contain the required information. Contact the group that *** *** provided you with these symbols if you need this command to *** *** work. *** *** *** *** Type referenced: kernel32!pNlsUserInfo *** *** *** ************************************************************************* ************************************************************************* *** *** *** *** *** Your debugger is not using the correct symbols *** *** *** *** In order for this command to work properly, your symbol path *** *** must point to .pdb files that have full type information. *** *** *** *** Certain .pdb files (such as the public OS symbols) do not *** *** contain the required information. Contact the group that *** *** provided you with these symbols if you need this command to *** *** work. *** *** *** *** Type referenced: kernel32!pNlsUserInfo *** *** *** ************************************************************************* FAULTING_IP: +6f8916e2 6f8916e2 ?? ??? EXCEPTION_RECORD: ffffffff -- (.exr 0xffffffffffffffff) ExceptionAddress: 6f8916e2 ExceptionCode: c0000005 (Access violation) ExceptionFlags: 00000000 NumberParameters: 2 Parameter[0]: 00000008 Parameter[1]: 6f8916e2 Attempt to execute non-executable address 6f8916e2 DEFAULT_BUCKET_ID: SOFTWARE_NX_FAULT PROCESS_NAME: svchost.exe ERROR_CODE: (NTSTATUS) 0xc0000005 - <Unable to get error code text> WRITE_ADDRESS: 6f8916e2 FAILED_INSTRUCTION_ADDRESS: +6f8916e2 6f8916e2 ?? ??? NTGLOBALFLAG: 0 APPLICATION_VERIFIER_FLAGS: 0 ADDITIONAL_DEBUG_TEXT: Followup set via attribute from Frame 0 on thread ffffffff LAST_CONTROL_TRANSFER: from 555a534e to 6f8916e2 FAULTING_THREAD: 0000070c PRIMARY_PROBLEM_CLASS: SOFTWARE_NX_FAULT BUGCHECK_STR: APPLICATION_FAULT_SOFTWARE_NX_FAULT_BAD_INSTRUCTION_PTR_STACK_CORRUPTION_STACK_CORRUPTION IP_ON_HEAP: 555a534e FRAME_ONE_INVALID: 1 STACK_TEXT: 7c910202 ntdll!RtlpAllocateFromHeapLookaside 7c90e900 ntdll!_except_handler3 7c910208 ntdll!RtlpRunTable 7c91017b ntdll!RtlAllocateHeap 7c9101bb ntdll!RtlAllocateHeap 7c910415 ntdll!RtlAcquirePebLock 7c91041e ntdll!RtlAcquirePebLock 7c918367 ntdll!RtlIsDosDeviceName_Ustr 7c901000 ntdll!RtlEnterCriticalSection 7c910440 ntdll!RtlReleasePebLock 7c97d600 ntdll!FastPebLock 7c914029 ntdll!RtlGetFullPathName_Ustr 7c91401c ntdll!RtlGetFullPathName_Ustr 01000000 svchost!_imp__RegQueryValueExW <PERF> (svchost+0x0) 7c914202 ntdll!RtlDosPathNameToNtPathName_Ustr 7c9142c7 ntdll!RtlDosPathNameToNtPathName_Ustr 7c91428f ntdll!RtlDosPathNameToNtPathName_Ustr 7c91405c ntdll!`string' 00690070 xpsp2res 00650070 xpsp2res 006c0075 xpsp2res 00700065 xpsp2res 00780045 xpsp2res 00630065 xpsp2res 00690050 xpsp2res 7c910098 ntdll!RtlpFreeToHeapLookaside 7c910021 ntdll!RtlFreeHeap 7c91003d ntdll!RtlFreeHeap 7c90ff0d ntdll!RtlFreeHeap 7c912e9b ntdll!RtlEqualUnicodeString 7c914298 ntdll!`string' 7c90f63c ntdll!RtlNtStatusToDosError 7c90f641 ntdll!RtlNtStatusToDosError 7c90df3c ntdll!NtWaitForSingleObject 7c8025db kernel32!WaitForSingleObjectEx 7c90fe01 ntdll!RtlGetLastWin32Error 7c839ac0 kernel32!_except_handler3 7c802608 kernel32!`string' 7c802542 kernel32!WaitForSingleObject 699e044d faultrep!MyCallNamedPipe 7e368ffb user32!GetSystemMetrics 699dee90 faultrep!_except_handler3 699d39f8 faultrep!`string' 699d79d0 faultrep!StartManifestReport 0073005c xpsp2res 00730079 xpsp2res 00650074 xpsp2res 00760073 xpsp2res 00680063 xpsp2res 0073006f xpsp2res 00780065 xpsp2res 77bf1e71 version!_except_handler3 77bf1478 version!`string' 77bf1475 version!GetFileVersionInfoSizeW 699e0f24 faultrep!IsMicrosoftApp 699e1418 faultrep!IsMicrosoftApp 7c90d950 ntdll!NtQueryValueKey 7c90d95c ntdll!NtQueryValueKey 7c90f648 ntdll!RtlpRunTable 77dc6fdb advapi32!LocalBaseRegQueryValue 77dc6fe6 advapi32!LocalBaseRegQueryValue 006f0072 xpsp2res 0065006d xpsp2res 7c80eeeb kernel32!FindClose 7c9020f5 ntdll!memmove 7c90d7ec ntdll!ZwQueryInformationProcess 7c80acf5 kernel32!GetErrorMode 7c90dc8c ntdll!ZwSetInformationProcess 7c80acd1 kernel32!SetErrorMode 7c8136e1 kernel32!GetLongPathNameW 7c8136f4 kernel32!GetLongPathNameW 77dc707b advapi32!RegQueryValueExW 699e0000 faultrep!CPFFaultClientCfg::ShouldCollect 699df5ca faultrep!CAutoUnlockCS::~CAutoUnlockCS 699e0036 faultrep!CPFFaultClientCfg::ShouldCollect 699e0047 faultrep!CPFFaultClientCfg::ShouldCollect 0072004b xpsp2res 00760065 xpsp2res 00640065 xpsp2res 006f006b xpsp2res 7e36a044 user32!ClientThreadSetup 7e3c12a0 user32!gcsAccelCache 7c90f60d ntdll!RtlNtStatusToDosError 7c912cae ntdll!LdrLockLoaderLock 7c912ce4 ntdll!LdrLockLoaderLock 7c912d51 ntdll!LdrUnlockLoaderLock 7c912d58 ntdll!LdrUnlockLoaderLock 7e368d23 user32!NtUserGetObjectInformation 699d9e41 faultrep!DoWinstaDesktopMatch 699d27a0 faultrep!`string' 7c80e6c0 kernel32!`string' 7c80e6bb kernel32!BasepGetModuleHandleExW 7c81fcd4 kernel32!GetModuleHandleExW 699d1a84 faultrep!`string' 699d69f2 faultrep!FixDirect3DScreenCapture 699d82f1 faultrep!ReportFault 00770000 xpsp2res 00740061 xpsp2res 006f0073 xpsp2res 0069006d xpsp2res 00720063 xpsp2res 0066006f xpsp2res 006f0063 xpsp2res 00720074 xpsp2res 0064002e xpsp2res 006c006c xpsp2res 7c916fc8 ntdll!`string' 01000040 svchost!_imp__RegQueryValueExW <PERF> (svchost+0x40) 00800040 xpsp2res 7c915bd8 ntdll!RtlDosApplyFileIsolationRedirection_Ustr 7c915c3d ntdll!RtlDosApplyFileIsolationRedirection_Ustr 7c97b214 ntdll!DllExtension 7c9165b0 ntdll!`string' 7c912d60 ntdll!`string' 7c916612 ntdll!LdrLoadDll 7c9164ee ntdll!LdrLoadDll 7c910000 ntdll!RtlFreeHeap 699e29a8 faultrep!_NULL_IMPORT_DESCRIPTOR 699e2910 faultrep!_NULL_IMPORT_DESCRIPTOR 7c917ed3 ntdll!LdrpSnapThunk 699d0000 faultrep!_imp__GetSecurityDescriptorDacl <PERF> (faultrep+0x0) 699e2970 faultrep!_NULL_IMPORT_DESCRIPTOR 699d00f0 faultrep!_imp__GetSecurityDescriptorDacl <PERF> (faultrep+0xf0) 7c910365 ntdll!RtlImageDirectoryEntryToData 7c917d9a ntdll!LdrpGetProcedureAddress 007ced60 xpsp2res 7c917e3f ntdll!LdrpGetProcedureAddress 7c97b178 ntdll!LdrpLoaderLock 7c917de9 ntdll!LdrpGetProcedureAddress 5d0781b1 shimeng!SE_GetProcAddress 699d7d7e faultrep!ReportFault 7c90d91c ntdll!ZwQuerySystemInformation 7c965071 ntdll!RtlUnhandledExceptionFilter2 7c9652ee ntdll!RtlUnhandledExceptionFilter2 7c917df0 ntdll!`string' 699d1c48 faultrep!`string' 7c8643c6 kernel32!UnhandledExceptionFilter 7c81a274 kernel32!`string' 7c887378 kernel32!BasepProcessCurrentDirPlacement 007cf224 xpsp2res 7c910303 ntdll!RtlpImageNtHeader 7c800000 kernel32!_imp___wcsnicmp <PERF> (kernel32+0x0) 7c8000f0 kernel32!_imp___wcsnicmp <PERF> (kernel32+0xf0) 7c90d96c ntdll!ZwQueryVirtualMemory 7c880a31 kernel32!_ValidateEH3RN 7c80b720 kernel32!`string' 7c80b000 kernel32!LongCompareStringW 7c864948 kernel32!`string' 7c83ab38 kernel32!BaseThreadStart 7c839b21 kernel32!_except_handler3 7c9032a8 ntdll!ExecuteHandler2 7c9032bc ntdll!ExecuteHandler2 7c90327a ntdll!ExecuteHandler 7c92a9ef ntdll!RtlDispatchException 77efb340 rpcrt4!NullContext 7c90e46a ntdll!KiUserExceptionDispatcher 7c911008 ntdll!RtlAllocateHeap 7c911066 ntdll!RtlAllocateHeap 77a716df crypt32!DllMain 77a70000 crypt32!_imp__CryptAcquireContextA <PERF> (crypt32+0x0) 77a7167a crypt32!_DllMainCRTStartup 77a71632 crypt32!_DllMainCRTStartup 7c91b010 ntdll!`string' 7c91b00a ntdll!_LdrpInitialize 77d04932 netman!ATL::CComContainedObject<CInboundConnectionManager>::`vftable' 76425159 netshell!StringCbPrintfW 4d596465 winhttp!CFsm_NegotiateLoop::CFsm_NegotiateLoop 7c910961 ntdll!RtlFreeHeap 7505297c srvsvc!`string' 7c90d38c ntdll!ZwFsControlFile 77dc7439 advapi32!ImpersonateNamedPipeClient 77e81ada rpcrt4!NMP_ConnectionRevertToSelf 7c9101c0 ntdll!CheckHeapFillPattern 75052be8 srvsvc!`string' 7505415a srvsvc!ConvertStringToTransportAddress 7c809a88 kernel32!`string' 7c929f95 ntdll!RtlReleaseResource 750631d0 srvsvc!SsData 75060251 srvsvc!NetrServerGetInfo 75052c02 srvsvc!`string' 77e7f244 rpcrt4!NdrConformantStringMarshall 77e7f4de rpcrt4!NdrpPointerMarshall 5bd5a0ac netapi32!GetToken 7c809a80 kernel32!LocalAlloc 5bd5d822 netapi32!NetpwPathCompare 5bd685ed netapi32!NetpwPathCompare 5bd5d73b netapi32!NetpwPathCompare 5bd5a137 netapi32!NetpwPathType 5bd5a410 netapi32!NetpwPathCanonicalize 7505d996 srvsvc!NetprPathCanonicalize 77e799f4 rpcrt4!Invoke 77ef421a rpcrt4!NdrStubCall2 7505d97a srvsvc!NetprPathCanonicalize 77c66717 msv1_0!SspEncryptBuffer 750531e0 srvsvc!MIDL_user_allocate 750531c0 srvsvc!MIDL_user_free 7c810634 kernel32!CreateRemoteThread 75051370 srvsvc!`string' 77dd7127 advapi32!MD5Final 75051428 srvsvc!`string' 75051c74 srvsvc!`string' 75051c6e srvsvc!`string' 75051c5e srvsvc!`string' 75051c7c srvsvc!`string' 75051c68 srvsvc!`string' 7505227a srvsvc!`string' 7c9115d9 ntdll!RtlLogStackBackTrace 77e7e75e rpcrt4!RpcMgmtStatsVectorFree 7c910040 ntdll!CheckHeapFillPattern 7c911432 ntdll!RtlpFreeDebugInfo 7c911463 ntdll!RtlpFreeDebugInfo 7c97b120 ntdll!DeferedCriticalSection 7c911440 ntdll!RtlpFreeDebugInfo 77ea04b8 rpcrt4!_except_handler3 77e79ad0 rpcrt4!NdrTypeFlags 77ef46ee rpcrt4!NdrServerCall2 77e794bd rpcrt4!DispatchToStubInC 77e794d0 rpcrt4!SVR_BINDING_HANDLE::`vftable' 77e79422 rpcrt4!RPC_INTERFACE::DispatchToStubWorker 750533bb srvsvc!NdrServerCall2 7c90d9bc ntdll!ZwReadFile 77e8088e rpcrt4!UTIL_ReadFile 77e7934e rpcrt4!RPC_INTERFACE::DispatchToStub 75063f0c srvsvc!srvsvc_DispatchTable 77e8156c rpcrt4!OSF_SCALL::DispatchHelper 77e81ca9 rpcrt4!OSF_SCONNECTION::TransAsyncReceive 77e81499 rpcrt4!OSF_SCALL::DispatchRPCCall 77e8141d rpcrt4!OSF_SCALL::ProcessReceivedPDU 77e81328 rpcrt4!OSF_SCALL::BeginRpcCall 77e7877b rpcrt4!OSF_SCONNECTION::ProcessReceiveComplete 7c80980a kernel32!InterlockedDecrement 77e811fb rpcrt4!BASE_CONNECTION::ProcessRead 77e771d5 rpcrt4!COMMON_ProcessCalls 77e786b6 rpcrt4!ProcessConnectionServerReceivedEvent 77e772ff rpcrt4!LOADABLE_TRANSPORT::ProcessIOEvents 7c9010e0 ntdll!RtlLeaveCriticalSection 77e77328 rpcrt4!ProcessIOEventsWrapper 77e76ad1 rpcrt4!BaseCachedThreadRoutine 77e76c97 rpcrt4!ThreadStartRoutine 7c80b713 kernel32!BaseThreadStart 77e76c7d rpcrt4!ThreadStartRoutine FOLLOWUP_IP: xpsp2res+60070 00690070 0000 add byte ptr [eax],al SYMBOL_STACK_INDEX: 12 SYMBOL_NAME: xpsp2res+60070 FOLLOWUP_NAME: MachineOwner MODULE_NAME: xpsp2res IMAGE_NAME: xpsp2res.dll DEBUG_FLR_IMAGE_TIMESTAMP: 4802454c STACK_COMMAND: dds 17c9308 ; kb FAILURE_BUCKET_ID: SOFTWARE_NX_FAULT_c0000005_xpsp2res.dll!Unknown BUCKET_ID: APPLICATION_FAULT_SOFTWARE_NX_FAULT_BAD_INSTRUCTION_PTR_STACK_CORRUPTION_STACK_CORRUPTION_BAD_IP_xpsp2res+60070 Followup: MachineOwner --------- 0:020> lmvm xpsp2res start end module name 00630000 008fd000 xpsp2res (no symbols) Loaded symbol image file: xpsp2res.dll Mapped memory image file: C:\WINDOWS\system32\xpsp2res.dll Image path: C:\WINDOWS\system32\xpsp2res.dll Image name: xpsp2res.dll Timestamp: Mon Apr 14 01:39:24 2008 (4802454C) CheckSum: 002CCBE6 ImageSize: 002CD000 File version: 5.1.2600.5512 Product version: 5.1.2600.5512 File flags: 0 (Mask 3F) File OS: 40004 NT Win32 File type: 2.0 Dll File date: 00000000.00000000 Translations: 0419.04b0 CompanyName: Корпорация Майкрософт ProductName: Операционная система Microsoft® Windows® InternalName: xpsp2res.dll OriginalFilename: xpsp2res.dll ProductVersion: 5.1.2600.5512 FileVersion: 5.1.2600.5512 (xpsp.080413-2113) FileDescription: Сообщения пакета обновления 2 LegalCopyright: © Корпорация Майкрософт (Microsoft Corp.) Все права защищены. В архиве дамп http://ifolder.ru/18827036
Была такая трабла на работе, решилось установкой какой-то заплатки. Ужо не помню. Можно порекомендовать надыбать в инете набор критических заплаток и накатить. Авось пможет))
У тебя в сети (или сети провайдера) завёлся засранец, который пытается уязвимость в SAMBA использовать. Установи заплаты: KB958644 KB957097 KB958687 И проверься вот этим: http://support.kaspersky.ru/downloads/utils/kk.zip Подробности тут: http://support.kaspersky.ru/faq/?qid=208636215
лучше это (кк у меня не полностью вычищал конфикера) http://us.mcafee.com/virusInfo/default.asp?id=stinger и перед проверкой отрубить сетку, выгрузить побольше прог. и так и перегрузить с отрубленной сеткой. свцхост роняют многие трои. на непочищенный комп бестолку ставить заплатки.
На компе вполне может ничего и не быть, просто атака по сети. И даже на заражённый заплаты нормально ставятся. А вычистить и при помощи CureIt! можно, он Kido (Conficker) тоже палит.
cppasm мое дело сказать. ваше право не поверить. кста, он еще ряд троев отловил, которые другие пропускали. включая нод и куреит. может быть. но береженого бог бережет, как считаете? кстати, это можно проверить. тот же вайршарк покажет кто и кого и как сеткой мучит. если на диалапе/мобиле, то можно пару раз переподключиться. если ничего не меняется, то трой у вас. причем кривой. ловите это позорище и смело сливайте тельце антивирусникам. ату бракоделов.
