Blue Screen of Death

[disturbed]

Hi guys, need some serious help with this one. I get blue screen that pretty much says that I do not have enough disk space along with possibly upgrading BIOS and I believe something about shadowing.

I get this every time I try to run avg anti spyware or sometimes just random times.

I have done the disk scan and my video card drivers are up to date. Where can I upgrade by BIOS? I read the thread and it also says to upgrade motherboard drivers I think. I have an ASUS P5GD1 where can I upgrade this?

Also any other ways to combat this problem will be greatly appreciated.

Thanks in advance.

P.S. I have not installed any new hardware for quite a long period of time.

 

[Jase123]

You tested your memory? Go to THIS thread and download memtest86 + and follow the guide there on how to use it.

Updating the bios for asus, you can usually get the updates from the Asus site.

Please read THIS thread. A guide to updating your bios.

Regards Jase

 

[disturbed]

These are my minidumps, if somebody could help me looking at the info.

Thanks in advance.

This is the complete message:

Check to be sure you have adequate disk space. If A driver is identified in the stop message disable it or check for driver updates. Try changing video adapters.

Check with hardware vendor for BIOS updates. Disable memory options such as caching or shadowing.

Tech Info:
Stop: 0x0000008E (0XC0000005, 0X86731099, 0XBAA32B80, 0X00000000)

 

[peterdiva]

All the crashes are the same, which can indicate a software problem. I think you've got a Rootkit - asc3550o.SYS. INFO

https://www.techspot.com/vb/topic65943.html

BugCheck 1000008E, {c0000005, 866bf099, f4ed4b80, 0}
Probably caused by : ntkrnlmp.exe ( nt!IopSynchronousServiceTail+60 )
baf76000 baf88000 asc3550o.SYS Timestamp: unavailable (00000000)

 

[Jase123]

If after reading the above link from peterdiva, you wish to clean your system, then do the following;

Go and read Viruses/Spyware/Malware, preliminary removal instructions

Post fresh HJT, AVG Antispyware and Combofix logs as attachments into this thread, only after doing the above.

Also, let me know the results from the Panda Antirootkit.

Regards Jase

This thread is for the use of disturbed only. Please do not post your own virus/spyware problems into this thread. Instead, open a new thread in our security and the web forum.

 

[howard_hopkinso]

I can confirm, your system is infected with malware.

I have therefore moved your thread to our Security and the Web forum.

Very Important: Before deciding whether you should clean or reformat your system, go and read this thread HERE and decide what it is you want to do.

If after reading the above, you wish to clean your system, do the following.

Go and read the Viruses/Spyware/Malware, preliminary removal instructions. Follow all the instructions exactly.

Post fresh HJT, AVG Antispyware and Combofix logs as attachments into this thread, only after doing the above.

Also, let me know the results of the Panda Antirootkit scan.

Regards Howard

This thread is for the use of disturbed only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.

 

[disturbed]

Thank you very much for your help both Jase and Howard. Here are the new logs, please check them out and tell me my new steps. AVG was able to find a trojan and a virus both were promptly removed. As for the panda rootkit result, everything seemed to be clear and nothing was found.

Thanks in advance.

 

[howard_hopkinso]

1. Please download The Avenger by Swandog46 from HERE. Save it to your Desktop and extract it.

2. Download the attached avengerscript.txt and save it to your desktop

Note: the above code was created specifically for this user. If you are not this user, do NOT follow these directions as they could damage the workings of your system.

3. Now, start The Avenger program by double clicking on its icon on your desktop.

Under "Script file to execute" choose "Load script from file".
Now click on the folder icon which will open a new window titled "open Script File"
navigate to the file you have just downloaded, click on it and press open
Now click on the Green Light to begin execution of the script
Answer "Yes" twice when prompted.

4. The Avenger will automatically do the following:

It will Restart your computer. ( In cases where the code to execute contains "Drivers to Unload", The Avenger will actually restart your system twice.)
On reboot, it will briefly open a black command window on your desktop, this is normal.
After the restart, it creates a log file that should open with the results of Avenger’s actions. This log file will be located at C:\avenger.txt
The Avenger will also have backed up all the files, etc., that you asked it to delete, and will have zipped them and moved the zip archives to C:\avenger\backup.zip.

5. Please attach the content of c:\avenger.txt into your reply as well as a fresh Combofix log.

Regards Howard

This thread is for the use of disturbed only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.

 

[disturbed]

Here you go Howard, both logs. Please inform me of my next steps.

 

[howard_hopkinso]

Boot into safe mode, under your normal user name(NOT THE ADMINISTRATOR ACCOUNT). See how HERE.

In Windows Explorer, turn on "Show all files and folders, including hidden and system". See how HERE.


See if you can locate either of these files and delete them.

C:\WINDOWS\NV28243912.TMP
C:\Windows\system32\drivers\asc3550o.sys

Reboot into normal mode and rehide your protected OS files.

Are you still having problems with your system restarting?

Regards Howard

 

[disturbed]

Howard, I just want to say I love you!

Thanks for the help everything seems to be running smoothly and the problem is solved for now at least.

Thanks.

 

[howard_hopkinso]

No probs mate.

It was peterdiva that spotted your problem. I only tried to get rid of it.

Regards Howard

This thread is now closed: If you need this thread unlocking, please pm a moderator with a link to the thread.

Only the original thread starter can do this. Anyone else, will be ignored.