Nidaamka hawlgalka Windows waxa uu ka kooban yahay noocyo badan oo faylal iyo barnaamijyo ah. Qaar ka mid ah kuwan ayaa mar walba shaqeeya, halka qaar kalena loogu yeero nidaamka qalliinka mararka qaarkood.

Ku dhawaad ​​dhammaan faylalka nidaamka hawlgalka Windows^(Windows) ee xudunta u ah waxa lagu kaydiyaa galka C:\Windows\System iyo C:\Windows\System32 (kumbuyuutarkaaga, xarafka darawalku wuu ka duwanaan karaa). Galka Windows laftiisa waxa kale oo uu hayaa tiro faylal muhiim ah.

Dhammaan barnaamijyada lagu rakibay kombuyuutarkaaga waxay sida caadiga ah leeyihiin faylal la fulin karo iyo kuwo la xidhiidha oo lagu kaydiyay C:\Program Files ama C:\Program Files (x86) .

Guud ahaan, marna ma rabto inaad wax ka beddesho, tirtirto, ama dhaqaajiso mid ka mid ah faylalka nidaamka Windows ee ku yaal mid ka mid ah hagahan. Si kastaba ha ahaatee, waxaa jira dhowr faylal oo udub dhexaad u ah shaqada nidaamka qalliinka. Haddii faylashan la tirtiro ama si kale la kharribo, waxaad u baahan doontaa inaad soo celiso nidaamkaaga hawlgalka Windows .

Ntoskrnl.exe

Tan la fulin karo waa sawirka kernel-ka. Tani waxay ka dhigan tahay asal ahaan waa code-ka xudunta u ah (fulinta) kaas oo ka dhigaya nidaamka hawlgalka inuu si sax ah u shaqeeyo. 

Koodhkani waxa uu qabtaa maaraynta qalabka, habsocodka nidaamka, iyo maaraynta xusuusta. Sidoo kale waa code-ka jadwaleeya waxa codsiyadu galaangal u leeyihiin processor-ka nidaamka iyo inta xusuusta (iyo cinwaannada xusuusta) loo qoondeeyay inay isticmaalaan.

Fulintu waxay ka muuqanaysaa Maamulaha Hawsha^{(Task Manager)} oo leh magaca Nidaamka^(System) iyo Diiwaangelinta^(Registry) . Waa fayl si weyn loo ilaaliyo, sidaas darteed way ku adag tahay codsi kasta sida malware inuu kharribo ama tirtiro faylka.

Noocyadii hore ee Windows , haddii aad furto tiro badan oo codsiyo ah, Ntoskrnl.exe waxay bilaabi doontaa isticmaalka xaddi badan oo xusuusta ah. Laga bilaabo Windows 10 , Ntoskrnl.exe hadda waxay cadaadisaa boggaga aan la isticmaalin halkii lagu kaydin lahaa xusuusta. Tani waxay yaraynaysaa isticmaalka xusuusta, laakiin waxay kordhin kartaa isticmaalka CPU haddii aad sameyso codsiyo badan hal mar.

Ntkrnlpa.exe

Habkani waa qayb ka mid ah software-ka asaasiga ah ee Microsoft Windows kernel iyo code code. Magaca waxa uu u taagan yahay Qaybiyaha Geedi socodka Kernel ee Tignoolajiyada Cusub^{(New Technology Kernel Process Allocator)} . Marka lagu daro Ntoskrnl.exe^{(Alongside Ntoskrnl.exe)} , waxay maamushaa jadwalka iyo maareynta xusuusta.

Waxa kale oo ay ka hortagtaa codsiyada iyo adeegyada aan muhiimka ahayn in ay galaan qaybaha asaasiga ah ee nidaamka qalliinka, taas oo OS ku ilaalinaysa in ay si badbaado leh ugu socoto meel la ilaaliyo oo xusuusta nidaamka ah.

Mar haddii Ntkrnlpa.exe^{(Ntkrnlpa.exe)} ay mas'uul ka tahay ka xannibista codsiyada gelitaanka xusuusta nidaamka la ilaaliyo, isticmaaleyaal badan ayaa inta badan u maleynaya inay tahay Ntkrnlpa.exe taas oo keenta fashilka nidaamka Windows . Tani waa sababta oo ah Ntkrnlpa.exe waa habka soo celiya qaladka.

Caadi ahaan sababta tani dhab ahaantii waa nooc ka mid ah malware-ka oo isku dayaya inuu keeno xusuusta nidaamka la ilaaliyo, oo laado khaladaadka Ntkrnlpa.exe .

Hal.dll

Fayl kale oo xudun u ah nidaamka kernel-ka iyo nidaamka xudunta u ah waa Hal.dll . Magaca faylka DLL wuxuu u taagan yahay lakabka Abstraction Hardware.^{(Hardware Abstraction Layer.)}

Faylkan waxa uu ka kooban yahay koodka xudunta u ah codsiyada in ay la falgalaan qalabka kombayutarka iyaga oo isticmaalaya hawlaha barnaamijka fudud halkii ay ka ahaan lahaayeen koodka mashiinka adag. 

Si sax ah loo magacaabay, waxay ka saartaa abstraction-ka la xidhiidhka iyo xakamaynta qalabka kombiyuutarka.

Tani waxay ku socotaa gudaha xusuusta RAM waxayna ku taal hagaha System32^(System32) .

Hal.dll caadi ahaan wax dhibaato ah kuma keento kombiyuutarka, si kastaba ha ahaatee codsiyada malware-ka qaarkood waxay isku dayaan inay xidhaan kuwa la fulin karo iyagoo siinaya isla magac. Si kastaba ha ahaatee, waxaad u aqoonsan kartaa inuu yahay codsi been abuur ah marka uu ku yaalo gal ka duwan kan System32 .

Weligaa ha joojin hawsha Hal.dll sababtoo ah tani waxay ka dhigaysaa nidaamkaaga mid aan shaqaynayn waxayna kugu qasbi kartaa inaad soo celiso nidaamka hawlgalka Windows .

Win32k.sys

Faylkan waa waxa loo yaqaan Multi-User Win32 faylalka darawalka, oo markii hore loo sii daayay qayb ka mid ah nidaamka hawlgalka Windows XP . Waxaa lagu cusboonaysiiyay sii dayn kasta oo cusub oo Windows ah, oo ay ku jirto Windows 10.

Waa interface darawalka garaafyada kaas oo maamula u dirida garaafyada kormeerayaasha iyo aaladaha kale ee wax soo saarka. Koodhka waxaa fuliyay gdi32.dll Windows 10. 

Nasiib darrose, sababtoo ah Win32k.sys waxa ay muddo dheer ahayd xudunta u ah nidaamka hawlgalka Windows , iyo sababta oo ah waxa ay ku jirtaa galka ( Program Files ) oo aan inta badan si fiican loo ilaalin sida System32 folder, malware inta badan waxa uu bartilmaameedsadaa faylkan. musuqmaasuq.

Intaa waxaa dheer, sidoo kale waa magac caadi ah oo ay doorteen malware-ka faylalka u gaarka ah, si dadka isticmaala aysan uga shakin faylka qayb ka mid ah caabuqa kombiyuutarka.

Ntdll.dll

Faylkaani waxa uu ku yaalaa nidaamka^(System) iyo hagaha nidaamka System32 . Sharaxaada faylka waa NT Layer DLL . Asal ahaan waa faylka DLL oo ka kooban hawlaha kernel-ka ee xudunta u ah.

Tani waxay ka dhigan tahay inay ka kooban tahay lambarka mashiinka kaas oo u oggolaanaya nidaamka hawlgalka asaasiga ah inuu si habboon u shaqeeyo. Barnaamijka kernel-ka xudunta u ah waxa uu gelayaa hawlaha ay ku jiraan Ntdll.dll , oo faylkani waxa uu socodsiiyaa shaqooyinka heerka mishiinka.

Haddii aad aragto farriimaha khaladka ah ee ka imanaya habka Ntdll.dll , tan waxaa badanaa keena mid ka mid ah faylka Ntdll.dll ee musuqmaasuqa , ama dhibaatooyinka hardware-ka ee kombiyuutarkaaga taasoo keenaysa in habka uu shil galo.

Caadiyan, dib-u-kicinta darawalka hardware-ka ee keenaya qaladka badanaa waxay xallisaa qaladka. Haddii arrintu tahay fayl Ntdll.dll musuqmaasuq ah, software-ka antivirus ayaa awood u leh inuu hagaajiyo arrinta. Haddii aysan awoodin, soo celinta Windows ayaa laga yaabaa in loo baahdo.

Kernel32.dll

Faylkan DLL waa mid kale oo la helay isagoo qayb ka ah kernel-ka nidaamka hawlgalka Windows . Waxay maamushaa xusuusta, oo ay ku jiraan xusuusta kala goysa. Waxa kale oo ay maamushaa dhammaan hawlgallada wax-gelinta iyo soo-saarka.

Kernel32.dll waa fayl kale oo lagu shubo meel xafidan oo xusuusta ah halkaasoo codsiyada isticmaalaha caadiga ah aysan shaqeyn karin.

Haddii aad waligaa aragto cilad la xiriirta Kernel32.dll , badanaa waxaa sabab u ah malware ama darawalada qalabka kharriban (ama qalab khaldan) oo isku dayaya inay wax u qoraan xusuusta la ilaaliyo ee uu Kernel32.dll degan yahay. Caadi ahaan dib u rakibida darawalada qalabka ama qalab cusub ayaa xalliya khaladaadkan.

Advapi32.dll

Faylkan DLL waa qayb kale oo udub dhexaad u ah nidaamka hawlgalka Windows . Magaceedu wuxuu u taagan yahay Advanced Application Programming Interface , ama API Advanced^{(Advanced API)} . Waxay wax ka qabataa wicitaanada amniga nidaamka waxayna ka soo horjeedaa nidaamka diiwaangelinta.

DLL -kan waxa ay maamushaa bilawga iyo xidhida Windows , waxay maamushaa diiwaanka Windows , maaraynta xisaabaadka isticmaalaha iyo ammaanka akoontiga, iyo maamulka adeegyada Windows .

Iyadoo faylkan aan looga baahnayn Windows si uu u bootiyo si sax ah, waxaa looga baahan yahay hawlgelinta habboon ee codsiyada iyo qalabka badankooda. Haddii feylkan nidaamka Windows la tirtiro ama la kharribo, codsi kasta oo API soo wacaya si loo galo nidaamka diiwaanka ama amniga wuu guuldareysan doonaa oo waxaad arki doontaa tiro fariimo khalad ah.

Isticmaale32.dll^(User32.dll)

DLL kale oo xudunta u ah , nidaamkan Windows -ka waxa ku jira inta badan xudunta u ah Windows API ee codsiyada isticmaalaha si ay ula xidhiidhaan nidaamka hawlgalka. Waxay gacanta ku haysaa inta badan daaqadaha iyo kontaroolada ay soo bandhigaan barnaamijyada Windows .

Codsi kasta oo leh is-dhexgal isticmaale garaaf ah ayaa caadi ahaan isticmaala qaybaha uu bixiyo faylka User32.dll . 

Si kastaba ha ahaatee, inta badan, codsiyada Windows waxay isticmaalaan maktabado lagu dhisay qaabka Windows .NET , taas oo iyaduna maamusha xiriirka User32.dll . 

Si kastaba ha noqotee, User32.dll wuxuu u tarjumayaa koodka codsiga caadiga ah, si sahlan loo fahmi karo amarrada heerka mashiinka ee looga baahan yahay nidaamka hawlgalka Windows .

Gdi32.dll

Inta badan sida User32.dll , Gdi32.dll ka kooban yahay hawlaha u ogolaanaya codsiyada si ay u abuuraan garaaf user interfaces ee kormeeraha.

Gdi32.dll waxa uu ka kooban yahay hawlo u ogolaanaya arjiyada in ay ku abuuraan shayada laba-cabbir. Waxay aqbashaa koodka codsiga ama adeegga Windows waxayna fulisaa koodka mashiinka loo baahan yahay si uu u muujiyo walxaha muuqaalka ah ee kormeeraha.

Halka nidaamka qalliinka ee Windows -ka laga yaabo in xitaa marka DLL - kan uu musuqmaasuqo ama la tirtiro, bandhigga nidaamka hawlgalka si sax ah uma shaqayn doono.

Faylasha Nidaamka Daaqadaha kale ee Muhiimka ah^{(Other Important Windows System Files)}

In kasta oo kuwani yihiin faylalka nidaamka Windows ee asaasiga ah iyo kuwa la fulin karo ee looga baahan yahay habsami u shaqeynta nidaamka qalliinka Windows , waxaa jira dhowr faylal oo dheeri ah oo looga baahan yahay shaqooyinka aan muhiimka ahayn ee nidaamka kumbuyuutarka si ay si sax ah ugu shaqeeyaan.

• Pagefile.sys : Waxay ka caawisaa nidaamka qalliinka inuu maareeyo booska xusuusta RAM iyo hagaajinta waxqabadka nidaamka.^(RAM)
  
• Swapfile.sys : Kani waa faylal nidaam cusub kaas oo ka caawinaya in loo raro apps-ka casriga ah ee Windows dariiqa adag marka ay ku jiraan xaalad hurdo.
  
• Crss.exe : Kani waa nidaamka runtime server-ka kaas oo maamula daaqadaha consoles'ka iyo habka xidhitaanka Windows .
  
• Shell32.dll : Waxa ku jira Windows shell API functional taas oo u oggolaanaysa daalacashada webka iyo codsiyada kale inay soo bandhigaan walxaha nidaamka hawlgalka sida taskbar, desktop, iyo Start menu si sax ah.
  
• Smss.exe : Nidaam hoosaadka maamulaha kalfadhigu wuxuu qabtaa fadhiyada isticmaalaha, oo ay ku jiraan astaanta Windows iyo habaynta nidaamka isticmaalaha.
  
• Sxs.dll : Tani waa qayb muhiim ah oo ka mid ah nidaamka hawlgalka Windows ee gacanta ku haya faylasha muuqda. Kuwani waa faylal u sheega Windows sida loo maamulo codsiga software marka la bilaabayo.

In kasta oo ay jiraan faylal badan oo ka sii liita oo qayb ka ah nidaamka hawlgalka Windows , kuwa kor ku xusan waa qaar ka mid ah kuwa ugu caansan. Taas awgeed inta badan waxaa bartilmaameedsada malware-ka si ay ugu khiyaameeyaan isticmaalayaasha inay u maleeyaan in faylasha malware-ku ay sharci yihiin.

Inta badan codsiyada ka hortagga fayraska ayaa awood u leh inay aqoonsadaan faylka nidaamka Windows ee been abuurka ah waxayna caadi ahaan ka nadiifin doonaan kuwa nidaamkaaga ka hor intaadan weligaa ogaan inay jiraan.

Obscure Windows System Files and Why You Should Know About Them

The Windows operating system is made up of a large assortment of files and programs. Some of these run all the time, while others are called by the operatіng system only occasionally.

Nearly all of the core Windows operating system files are stored in the folders C:\Windows\System and C:\Windows\System32 (on your computer, the drive letter could be different). The Windows folder itself also holds a number of essential files.

All of the programs that are installed on your computer typically have executable and related files stored in C:\Program Files or C:\Program Files (x86).

In general, you never want to modify, delete, or move any of the Windows system files that are located in any of these directories. However, there are a few files that are core to the function of the operating system. If these files get deleted or otherwise corrupted, you’ll need to restore your Windows operating system.

Ntoskrnl.exe

This executable is the kernel image. This means it’s essentially the core code (the executive) that makes the operating system work properly. 

This code handles management of hardware, system processes, and memory management. It’s also the code that schedules what applications have access to the system processor and how much memory (and memory addresses) they’re allocated to use.

This executable shows up in Task Manager with the name System and Registry. It is a heavily protected file, so it’s difficult for any application like malware to corrupt or delete the file.

In older versions of Windows, if you opened up a large number of applications, Ntoskrnl.exe would start consuming a large amount of memory. Starting with Windows 10, the Ntoskrnl.exe now compresses unused pages rather than storing them to memory. This reduces memory consumption, but can increase CPU usage if you run a lot of applications at once.

Ntkrnlpa.exe

This process is a core software component of the Microsoft Windows kernel and system code. The name stands for New Technology Kernel Process Allocator. Alongside Ntoskrnl.exe, it controls scheduling and memory management.

It also prevents non-core applications and services from accessing the core areas of the operating system, which keeps the OS safely running in a protected area of system memory.

Since Ntkrnlpa.exe is responsible for blocking applications from accessing protected system memory, many users often think it’s Ntkrnlpa.exe that’s causing a Windows system failure. This is because Ntkrnlpa.exe is the process that returns the error.

Usually the cause of this is actually some form of malware attempting to cause protected system memory, kicking off the Ntkrnlpa.exe errors.

Hal.dll

Another core file related to the system kernel and core system is Hal.dll. The name of this DLL file stands for Hardware Abstraction Layer.

This file contains core code that allows applications to interact with computer hardware using simple program functions rather than complicated machine code. 

Aptly named, it removes the abstraction from communicating with and controlling computer hardware.

This executable runs inside RAM memory and is located in the System32 directory.

Hal.dll typically doesn’t cause any issues with the computer, however some malware applications attempt to cloak their executables by giving them the same name. However, you can identify it as a counterfeit application when it’s located in a different folder than System32.

Never stop the Hal.dll task as this will make your system non-functional and could force you to have to restore the Windows operating system.

Win32k.sys

This file is what’s known as the Multi-User Win32 driver file, originally released as part of the Windows XP operating system. It’s been upgraded through each new Windows release, including Windows 10.

It’s a graphics driver interface that manages sending graphics to monitors and other output devices. The code is executed by gdi32.dll on Windows 10. 

Unfortunately, because Win32k.sys has been such a long-time core piece of the Windows operating system, and because it resides in a folder (Program Files) that isn’t usually as well protected as the System32 folder, malware often targets this file for corruption.

Additionally, it’s also a common name chosen by malware for its own files, so that users don’t suspect the file as part of a computer infection.

Ntdll.dll

This file is located in the System and System32 system directories. The description of the file is NT Layer DLL. It’s essentially a DLL file that contains core NT kernel functions.

This means it contains the machine code that allows the core operating system to function properly. The core kernel program accesses functions contained by Ntdll.dll, and this file processes those machine level functions.

If you see any error messages coming from the Ntdll.dll process, this is usually caused by either a corrupt Ntdll.dll file, or hardware problems on your computer that are causing the process to crash.

Usually, reinstalling the hardware driver causing the error usually resolves the error. If the issue is a corrupt Ntdll.dll file, antivirus software is capable of repairing the issue. If it can’t, a Windows restore may be required.

Kernel32.dll

This DLL file is another found as part of the Windows operating system kernel. It manages memory, including memory interrupts. It also manages all input and output operations.

Kernel32.dll is another file that gets loaded into protected memory space where regular user applications can’t operate.

If you ever see an error related to Kernel32.dll, it’s usually due to either malware or corrupt hardware drivers (or faulty hardware) attempting to write to the protected memory where Kernel32.dll resides. Usually reinstalling hardware drivers or new hardware resolves these errors.

Advapi32.dll

This DLL file is another core component of the Windows operating system. Its name stands for Advanced Application Programming Interface, or Advanced API. It handles system security calls and calls against the system registry.

This DLL manages starting and shutting down Windows, manages the Windows registry, handling user accounts and account security, and the management of Windows services.

While this file isn’t required for Windows to boot properly, it is required for the proper operation of most applications and hardware. If this Windows system file is deleted or corrupted, any application API calls to access the system registry or security will fail and you’ll see a number of error messages.

User32.dll

Another core DLL, this Windows system file contains most of the core Windows API for user applications to communicate with the operating system. It handles most of the native windows and controls that are displayed by Windows applications.

Any application that has a graphical user interface typically uses components offered by the User32.dll file. 

However, in most cases, Windows applications utilize libraries built into the Windows .NET framework, which in turn manages communication with the User32.dll. 

In either case, the User32.dll translates common, easy-to-understand application code into the machine level commands that are required by the Windows operating system.

Gdi32.dll

Much like User32.dll, Gdi32.dll contains functions that allow applications to create graphical user interfaces on the monitor.

Gdi32.dll contains functions that let applications create 2-dimensional objects on the screen. It accepts code either from a Windows application or service and executes the required machine code to display the visual objects on the monitor.

While a Windows operating system may boot even when this DLL is corrupt or deleted, the operating system display won’t work properly.

Other Important Windows System Files

While those are the core Windows system files and executables required for the proper functioning of the Windows operating system, there are a few additional files required for non-critical functions of the computer system to work properly.

• Pagefile.sys: Helps the operating system manage RAM memory space and improve system performance.
  
• Swapfile.sys: This is a newer system file that helps with moving modern Windows apps to the hard drive when they’re in a hibernation state.
  
• Crss.exe: This is a client server runtime process that handles console windows and the Windows shutdown process.
  
• Shell32.dll: Contains Windows shell API functions that allow web browsers and other applications to display elements of the operating system like the taskbar, desktop, and Start menu properly.
  
• Smss.exe: The session manager subsystem handles user sessions, including Windows logon and user system settings.
  
• Sxs.dll: This is an important component of the Windows operating system that handles manifest files. These are files that tell Windows how to handle a software application when it’s launched.

While there are many more less critical system files as part of the Windows operating system, those listed above are some of the most common. Because of this they often are targeted by malware to trick users into thinking malware files are legitimate.

Most antivirus applications are capable of identifying a counterfeit Windows system file and will typically clean those from your system before you ever know they exist.

Related posts

• Sir faylal iyo faylal leh Nidaamka Faylka Incrypting (EFS) gudaha Windows 10

• Sida loo dayactiro faylalka nidaamka xumaaday ee Windows 10

• Sida loo dayactiro faylalka nidaamka Windows 10

• Hubi diskka iyo faylalka nidaamka gudaha Windows 8/10

• Sida loo furo .aspx files on Windows 10 computer

• Si toos ah uga guur faylasha hal gal una guuri mid kale gudaha Windows 10

• Sida loo soo ceshado faylasha goobta soo celinta nidaamka gudaha Windows 10

• Ka yeel Wadahadalka Daabacaadda Nidaamka ee Microsoft Edge gudaha Windows 10

• Si toos ah u dami codka System Lock adigoo wata WinMute on Windows 10

• Sida loo beddelo Faylka caadiga ah ama Faylka Jiid & Dhaqan-celinta gudaha Windows 10

• Sida PDF loogu badalo MOBI on Windows 10

• Software-ka Kormeerka Faylka ee bilaashka ah ee Windows 10

• Sida faylka .AHK loogu beddelo faylka .EXE gudaha Windows 10

• Waa maxay faylka GPX? Sida loo furo oo loo arko faylasha GPX gudaha Windows 10?

• Sida loo sameeyo shortcut soo celinta System in Windows 10

• Rstrui.exe kuma shaqaynayo ama laguma aqoonsanin Windows 10

• Sida loo furo, loo furo, ama si joogto ah loogu dhejiyo faylka VHD gudaha Windows 10 -

• Sida loo maamulo Faylka Batch sida Maamule iyadoon degdeg loo gelin Windows 10

• Waa maxay faylka CDR? Sida loo eego oo wax looga beddelo faylka CDR gudaha Windows 10?

• Sida loo beddelo ama loo beddelo macluumaadka nidaamka gudaha Windows 10