TechSpot

BSOD on legitimate Win 7 Home, two different stop errors

By Lokalaskurar
Mar 23, 2011
Post New Reply
  1. Basically, my brother's computer (laptop, Toshiba Satellite C650D) is running Windows 7 Home (Premium), 64 bit legitimate.

    (Btw, don't be worried of giving me "jargon-support" like; check the register-entry for halfdumped software keys and so on, I'm very experienced with computers :) )

    He's had a BSOD... well... actually, 96 of them the last 5 days. (I checked the Windows log) - it says Kernel-power error, but I know that's just from every unsuccessful shutdown he's had...

    Basically, about 75% of all his tries to boot results in the following STOP code:
    0X0000000A
    (0X0000000000000000,
    0X0000000000000002,
    0X0000000000000000,
    0XFFFFF800032A8015)

    And this message stays on-screen for as long as you don't press the start button.

    But when the computer crashes from time to time, it displays an error message for exactly 5 seconds that is too hard to read at that speed (and every camera we have is too slow in order to snap the moment :) ).

    But it ends with the STOP: 0x000000000002 - that, we can read.

    It often happens after installations to the Program (x86) - folder.

    So how will we go from here? The setup guide at the forum index did not cover this problem.
     
  2. Route44

    Route44 TechSpot Ambassador Posts: 12,172   +37

    0xA errors are caused either by hardware or a driver attempting to address a higher IRQ Level than they are designed for resulting in system crashes.

    Question: Can he get to his desktop screen? If so...

    How to find and post your Minidump Files:

    My Computer > C Drive > Windows Folder > Minidump Folder > Minidump Files.

    It is these files that we need (not the folder). Attach to your next post the five most recent dumps. Notice the Manage Attachments button at the bottom when you go to post the next time. You can Zip up to five files per Zip; if you only have one or two you don’t need to zip them, just attach as is. Please do us a favor and don’t Zip each one individually.

    * If he can't get to the desktop can he boot into Safe Mode?
     
  3. Lokalaskurar

    Lokalaskurar TS Enthusiast Topic Starter Posts: 616

    Answer: Yes, from time to time, about every fifth boot, he can successfully access his desktop in normal mode, and the PC will temporarily act normal.

    I will help him in about 45 minutes on how to access the minidump-files, just until recently, we didn't know what those were for, to be honest :) .

    We'll upload the minidump files to TechSpot in 1 hour or so. (as of 5:00 PM, GMT+1).
     
  4. Lokalaskurar

    Lokalaskurar TS Enthusiast Topic Starter Posts: 616

    Here are the five latest minidumps.

    Uploaded as one (1) .ZIP file with 5 .DMP files inside.

    Hopefully, they will be of good use!

    We both now eagerly await response from any clever TechSpot heroes :D
     

    Attached Files:

  5. Route44

    Route44 TechSpot Ambassador Posts: 12,172   +37

    Question: Is he running Panda software? The driver cited in two dumps as causing his system crashes is PavTPK.sys belonging to Panda Security. Interestingly enough research shows Panda at first denied it was their issue, even denying the driver! But they eventually retracted. Many people have had issues with this driver.
     
  6. Lokalaskurar

    Lokalaskurar TS Enthusiast Topic Starter Posts: 616

    Well, Yes! He is in fact running Panda. He's been thinking of getting avast! or AVG as his Panda is (still) only a trial.

    My brother's a bit shocked actually; he claims that his problems started before he even installed Panda. But I know this not to be true, he had Panda long before the problems originated. The BSOD's themselves started appearing when he first installed TESIV: Oblivion, nine days ago, and he's had well over 100 BSOD's now.

    Oh, I forgot to mention: pretty important I think, he ran a Panda antivirus check right after the first 2 BSOD's, and Panda reported 23 pieces of malware in the system. Although Panda fixed these problems.

    So my questions are:
    Could it be that Panda perhaps even removed crucial OS files, causing the BSOD's to appear as some files doesn't exist anymore?

    Should I tell him to switch to avast! or AVG? Will it make a difference?

    Edit:
    He now also claims that the BSOD's started appearing when in failsafe-mode as well. Although not remotely as often as in ordinary mode.
     
  7. Route44

    Route44 TechSpot Ambassador Posts: 12,172   +37

    AVG is no better. It used to be a good product three years ago but we have seen quite a few issues here with AVG (and I've seen it flagged on other tech forums as well). It has become bloated and late last year one of its updates literally bricked systems running Vista and Windows 7.

    Avast is very good. The thing is he has got to make sure Panda everything and anything is removed first.

    Whether or not Panda itself could remove crucial OS files is doubtful but we're talking PCs here so anything is possible. Here is what I would suggest.

    1. There is a good chance his system may still be infected. Thus I strongly recommend that you go to our Virus and Malware Removal forum, read the UPDATED 8 Step sticky, follow the advice exactly given in the steps given and on that forum post with the required logs pasted within your post. Bobbye and Broni are excellent in the help they give.

    2. If you suspect missing OS files a Windows Repair may be in order.

    3. When all is said and done install Avast. I run the free on one PC and two laptops and the $ version on my wife's laptop. I really like the interface.
     
  8. Lokalaskurar

    Lokalaskurar TS Enthusiast Topic Starter Posts: 616

    My brother uninstalled Panda and installed avast! 5.

    The BSOD's went away and he has not had an error ever since (3 days ago) = about 30 BSOD's on a normal basis. avast! noted 1 piece of malicious software, and removed it.

    Conclusion: It seems like Panda was causing the problem all along. We both humbly thank you for your much appreciated assistance!
     
  9. Route44

    Route44 TechSpot Ambassador Posts: 12,172   +37

    Excellent! Thanks for getting back to us with the update.
     
  10. Lokalaskurar

    Lokalaskurar TS Enthusiast Topic Starter Posts: 616

    Blast, they have returned (the BSOD's)! They went away for a while, interestingly enough - but the PC works a lot better since we uninstalled Panda. The PC has had 2 BSOD's since my last post, and several other errors (se further).

    This time, a ~10 second long BSOD is displayed, this is long enough to study - so we'll look at it closely next time it appears. The STOP begins with 0x00000004 - and that's just about everything we can analyze by now.

    (minidump files will be attached in a while)

    Other errors have started to appear;
    1. Last night - the PC froze during boot, twice, and froze several times during regular usage (i.e. web-surfing, writing some documents, playing a bit of Oblivion). The PC simply freezes - does not respond to any signals whether it being mouse-movement or keyboard commands like Ctrl+Alt+Del. Manual restart solves the problem temporarily.

    2. The screen sometimes shuts off unexpectedly (remember, this is a laptop btw) - Manual restart also solves this problem temporarily.

    3. Finally, a BSOD appears from time to time - which we'll analyze next time it appears. Minidumps will be posted shortly.

    The PC is actually working a lot better, still - some of the problems have returned it seems.
     
  11. Route44

    Route44 TechSpot Ambassador Posts: 12,172   +37

    I'll read them for you when you post them. Are the vents cleared of dust?
     
     
  12. Lokalaskurar

    Lokalaskurar TS Enthusiast Topic Starter Posts: 616

    The vents are cleared alright. :haha:
    Blasted them out with hyper-compressed helium (no components where harmed, this is a certified and approved way of cleaning laptop-fans - also; I do it on laptops twice a month at least - and have never experienced any trouble because of it).

    Even though ordinary PC-shops use compressed air, I don't have a can of compressed air standing around. Hyper-compressed helium on the other hand... :p




    So one of the BSOD's mentioned that win32k.sys caused a problem - thus after some soul-devouring work, we managed to rename win32k.sys to win32k.old. I've tried this trick on other win32k.sys-related BSOD's with successful results before, btw.

    However, my brother tried to send me the five latest .dmp-files via e-mail, yet avast! kept blocking two of the attached files (saying "a rootkit is present"). He performed a simple avast!-quick scan (1 minute before writing this very sentence) and immediately some rootkits popped up. He's performing a greater scan at this moment.

    3 of the 5 latest minidump-files are attached.

    Edit: Thanks for the help so far, by the way :D
     

    Attached Files:

  13. Lokalaskurar

    Lokalaskurar TS Enthusiast Topic Starter Posts: 616

    Ok, so avast! found two pieces of rootkit. Both where removed.

    Results? The OS failed to initialize.

    Edit:
    We have now restored the PC, however it seems like this piece of Malware is deeply rooted... hmm... could it be (earlier) that Panda detected this OS-rootkit and killed the PC in self-defense using BSOD?
     
  14. Route44

    Route44 TechSpot Ambassador Posts: 12,172   +37

    Sorry for the delay. It does seem like a deep infection. My best advice is to go to our Virus and Malware Removal forum, read and follow the advice given in the UPDATED 8 Step sticky and post on that forum according to the given directions.

    Good luck.
     
  15. Lokalaskurar

    Lokalaskurar TS Enthusiast Topic Starter Posts: 616

    Suspected as much... Will go over to the Malware Removal forum provided no-one prompts me with any more questions regarding the BSOD's and this in general.

    Hopefully some luck will come of it.
     
  16. Lokalaskurar

    Lokalaskurar TS Enthusiast Topic Starter Posts: 616

    (Dual posting due to update)

    So there was several rootkits and trojans causing the infection, although thanks to a piece of wonderful help (from Broni, Malware Annihilator) over at the Malware Removal forum, I've seccussfully eliminated the BSOD's. The quest for a perfect PC will continue over at the Windows-forum, as many generic windows-functions/programs does not work ever since the first BSOD.

    Report; the BSOD's are gone!

    I have no clue whether Panda crashed the PC in order to protect it, or if it simply was a piece of bad coding.
     
  17. Route44

    Route44 TechSpot Ambassador Posts: 12,172   +37


    Yes, Broni (and Bobbye) are two of the best. As for Panda, the most important defense against infections is the person's internet habits.

    Glad the BSODs stopped and thanks for the update! :)
     


Add New Comment

TechSpot Members
Login or sign up for free,
it takes about 30 seconds.
You may also...


Get complete access to the TechSpot community. Join thousands of technology enthusiasts that contribute and share knowledge in our forum. Get a private inbox, upload your own photo gallery and more.