BSODs and Prime 95

[mb2cotter]

Bobbye on the malware board recommended that I come to this board for help. He was helping me with malware on this thread:
https://www.techspot.com/vb/topic155812.html

He thinks that I may be getting BSODs related to Prime95.

I have been unable to get combofix to work and keep getting BSODs when I try. Also, internet explorer is not working even though I have internet.

Here are my comments from the last few BSODs on the other thread:

I ran combofix and my computer froze the first time.
The second time I got BSOD after at least 5 stages.
I tried a 3rd time and got BSOD again.

This is the error message from eventvwr that i got from the first BSOD:

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7034
Date: 11/3/2010
Time: 9:05:43 PM
User: N/A
Computer: COTTER
Description:
The Prime95 Service service terminated unexpectedly. It has done this 1 time(s).

After that error, I uninstalled Prime95 (a program I've had for years on multiple computers). This is the error message from eventvwr that I got from the second BSOD, after I uninstalled Prime95:

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7000
Date: 11/3/2010
Time: 9:27:15 PM
User: N/A
Computer: COTTER
Description:
The Prime95 Service service failed to start due to the following error:
The system cannot find the file specified

After that I used autoruns and found Prime95. I unchecked it. I renamed combofix as Bobbye instructed. I turned off Norton Antivirus. I ran the renamed combofix and . . . got BSOD.

I went to eventvwr and there was no Error listed anywhere for that BSOD.

I rebooted the computer and tried again. Same thing - BSOD. I rebooted and went to eventvwr and there still was no error listed.

I should add that I've never used Prime 95 for overclocking. I just liked participating in the search for Mersenne Primes.

Does anyone have any suggestions for how to stop the BSODs?

Thanks for the help.
Mike

 

[Route44]

Hi Mike. Just F.Y.I. the mods will probably move this to the proper BSOD forum but no problem in posting your issue here to begin with.

Question: Are any of your components overclocked?

Also...

How to find and post your Minidump Files:

My Computer > C Drive > Windows Folder > Minidump Folder > Minidump Files.

It is these files that we need (not the folder). Attach to your next post the five most recent dumps. Notice the Manage Attachments button at the bottom when you go to post the next time. You can Zip up to five files per Zip; if you only have one or two you don’t need to zip them, just attach as is. Please do us a favor and don’t Zip each one individually.

 

[mb2cotter]

Thanks for the help.

I don't know how to tell if something is overclocked . . .and only have a vague idea of what that means.

Attached is the zip file of the 5 most recent minidump files.

 

[Route44]

Two drivers were cited as the probable cause for your BSODs:

1) catchme.sys which is a legitimate rootkit detection driver and is part of Combofix.

2) mbr.sys driver which is related to the MBR rootkit detection software

Catchme.sys is a legitimate rootkit detection tool used by several programs, including ComboFix. It is not malware, and will not cause you any harm if you leave it on your PC. Having said that, it's also not especially useful to you if you PC is clean, and will really only sit around taking up space, there's no need to keep it. Feel free to delete it if you wish, but know that it is not malware so you need not be concerned.

However, it is coming up as one of the causes of your system crashes. Post back to your thread with Bobbye and report that Route44 read the five latest minidumps and these two drivers were cited as probable cause. Then we'll take it from there after any advice/insight is given.

 

[mb2cotter]

Thanks for the reply. I'll post this over there.

I was never able to run Combofix becasue it kept crashing. There may be stuff, I presume, that Combofix was unable to find becasue it never ran.

 

[Route44]

I would then recommend the following:

1. Before removing Combofix ask Bobbye if there are any special instructions for a complete uninstall.

2. Run ChkDsk on your harddrive and pay attention to Stage 2 to see if it says "Recovering Lost Files."

Start > Run > ChkDsk > Okay

3. Run a complete harddrive diagnostics. You HD manufacture should have a free utility on their site.

 

[mb2cotter]

Bobbye had asked me to uninstall combofix before In posted in this forum, which I did. Maybe I should ahve mentioned that. I did a search for catchme.sys and mbr.sys and it said it could not find them.

I typed in chkdsk /f /r in start/run (which I got from this thread: https://www.techspot.com/vb/topic51365.html), and I get the following message "Chkdsk cannot run becasue the volume is in use by another process. Would you like to schedule this volume to be checked the next time the system restarts (Y/N)?

Any advice?

Thanks for the help.

 

[Route44]

Okay, for clarification, were these minidumps created before Combofix was uninstalled or after?

You want to choose Y for yes and then reboot. ChkDsk will take over.

 

[mb2cotter]

If a minidump file is created when a system crashes, then the files were created before I uninstalled combofix. The BSODs came every time I tried to run combofix. Afterwards, Bobbye told me to uninstall combofix. There's been no BSOD since I uninstalled combofix.

 

[Route44]

Then I would say that was your issue and therefore just run your system as is because I take it it is now stable, correct?

No need to run any tests. Can you run Prime 95 without issue now?

 

[mb2cotter]

Well, my issue was many viruses taking over the computer causing havoc. Combofix was one of the tools we were trying to use to find/fix them. I was never able to run it. Does it sound like
i just might not be able to run that program on my computer?

I have not tried Prime 95 since I uninstalled it. I don't need it, so I think I'll leave it off from now on.

Thanks.

 

[Route44]

I never before heard of anyone having issues running Combofix but that really isn't an area that I have a great deal of working knowledge.

I think it would be a good idea from a diagnostic perspective for you to run a harddrive diagnostics. Your harddrive manufacture will provide a free diagnostics utility that you can download and then burn to a CD.

Place the CD in your CD/DVD drive and reboot. The test should load seconds after booting and choose from there. Do both short and long tests.

If it doesn't engage it means you have to place your CD drive as first bootable in the BIOS.