Random BSOD and CD won't read data

[michele31415]

SQL Server is needed to run the NeatReceipts scanner software (see www.neatco.com). I can kill it for testing purposes. VNC is a neat program that lets me open a remote desktop to this machine from another one on my LAN. Again, I can kill that. It's not vital.

"Also does it now work ok or not?"

Well, it's too soon to tell for sure. All I know is that I was able to run Avira for the first time in normal mode without BSOD'ing, and we are now up for 3 hours and still running. The last windiag I ran before installing new chips clearly showed RAM errors that had not appeared the first two times I ran it. The new RAM may be the difference.

So I'm hoping the only problem left is the CD drive, which still does not recognize any data discs or DVD's.

 

[kimsland]

Well make sure to run CCleaner often (I do, it helps removing all temp files)

Also regarding your CD\DVD have a look at this:

Download Disc Info
Select your drive (may already be selected)
Click on View
Click on Capabilities info

 

[michele31415]

OK, I ran CCleaner again with all options checked. It removed 7.65M., 1.08K, 460 bytes, 460 bytes, 184 bytes, 552 bytes, and 460 bytes on 7 successive passes. It doesn't seem to ever go to zero. At least it did not BSOD. I closed it and ran it again - this time it removed 1.98K.

Then I ranDiscInfo. I have attached the disc info, capbilities, and summary files.

 

[kimsland]

I'd say it's just faulty or requires one of those CD cleaning discs put through it
Basically the laptop DVD Combo drives aren't that good, and usually have problems reading burnt discs (too light or something)

Or just purchase an external DVD Writer USB drive (that would be easier)

 

[michele31415]

Throw in the Towel?

Yeah, I've been wondering that myself. On the plus side, note that I was able to do a complete run of malwarebytes without BSOD'ing (log attached). Before replacng the RAM, this crashed every time. I'm starting to think that the BSOD part of this problem may finally be solved. Mbam didn't find much of any consequence either.

Here's something that might be a clue:

I put the windiag disk in the drive while Windows was running. (This is a bootable CD). The cursor changed to an hourglass and explorer.exe hung. I went into Task Manager and killed explorer.exe. The system automatically started a new explorer and this time when I opened "My Computer", I saw that the drive D icon label had changed from DVD/CD-RW Drive" to "CD_ROM". And when I opened that, I got a window that correclt showed "Files currently on the CD" and showed one folder named I386, containing one file called WINDIAG.

So I removed that disc and tried putting in an ordinary data CD, and I was back to the problem. The drive icon doesn't change, and when you open the icon, the window is empty. Also, when I eject a disc, now it's making a "thunk" error sound (the sound known as "Default Beep.wav").

I put the bootable CD back in. This time explorer.exe did *not* hang, and it still recognized the disc and its contents.

So the current state is:

Plays audio CD's (music) OK.
Does not recognize DVD movies.
Does not recognize data CD's.
Does recognize bootable CD's.
Boots bootable CD's OK.

 

[kimsland]

Well all the malware found was in:

C:\Program Files\RelevantKnowledge
and C:\Documents and Settings\All Users\Start Menu\Programs\RelevantKnowledge

Pretty sure that RelevantKnowledge aint good

But you did not remove the found malware => No action taken

You need to start up Malwarebytes again
Update it
Then run another full scan
Once finished show results
Remove all found Malwares
Restart

Do you like how I put that in easy point form
Basically remove RelevantKnowledge

 

[michele31415]

Pretty sure that RelevantKnowledge aint good

Oh I'm sure it ain't. I'm also sure I got it from downloading one of the programs you recommended recently, because it wasn't there a few days ago.

But you did not remove the found malware => No action taken

Well actually I did. I just saved the report file before I selected Remove. The remove went OK. I rebooted and ran Adaware. It found AdwareRelevant in the Registry and Win32WormKdCrypt in the SDFix directory. I Quarantined them both.

"Do you like how I put that in easy point form
Basically remove RelevantKnowledge [/QUOTE]"

Yes, that's lovely.

 

[kimsland]

It was stated in Post#45 in your HJT log (but not in your first HJT log)
But I've gone over all posts (that's why the delay just then)
And I cannot see where RelevantKnowledge was installed and what program installed it.

Have you downloaded anything else 3 days ago?

I found it

KCleaner ftp://ftp2.kcsoftwares.com/kcsoftwa/files/kcleaner.exe
Fantastic cleaner. (When installing uncheck Relevant Knowledge do not install)

This quote was from another thread
It seems, Kcleaner has the option of installing Relevant Knowledge or not
This was not mentioned on my side

For now on, when I quote to use this program I will clearly state "uncheck Relevant Knowledge do not install"
Thanks for bringing this to my attention

 

[michele31415]

Yes - that was it alright. It came with KCleaner. Anyway, it seems to be gone now. I ran another full scan with malwarebytes and it was clean. Also, I note that I haven't had a single BSOD since I replaced the RAM.

 

[kimsland]

To uninstall Combofix

Start->Run-> combofix /u​

Clear system restore points

• 
  Clear your existing system restore points and establish a new clean restore point:
  • Go to Start > All Programs > Accessories > System Tools > System Restore
  • Select Create a restore point, and Ok it.
  • Next, go to Start > Run and type in cleanmgr
  • Select the More options tab
  • Choose the option to clean up system restore and OK it.
  This will remove all restore points except the new one you just created.

 

[michele31415]

OK, done. I think I'm about ready to declare victory over both the BSOD problems and the malware infestation. Thanks for all your help with this.

Regarding the CD drive problem, I don't know enough about how these devices work. I find it odd that Windows does recognize a bootable data CD, but no other type. About all I can think of is to start replacing drivers, but I don't know how to do that, or even which ones are needed. For example, see the attached list of everything called "cdrom" on this machine. Just uninstalling the drive and then letting Windows reinstall the drivers automatically doesn't work.

I suppose there's also still an outside chance that it's the drive itself. Is there some strange failure mode of optical drives that can cause this sort of behavior? How does that work?

 

[kimsland]

Windows CDrom driver is installed by Windows itself
There's no update to the driver, and no driver disc received even if you purchase a new drive

But if you suspect that there may be possible missing Windows System files you can do this. But I would uninstall any live protecting softwares as well (ie Antivirus\personal Firewall\Spyware resident applications

Start->Run-> SFC /RUNNOW and then press OK
You may need your Windows CD if any Windows System files are found to be missing or corrupt and require replacing with the working original

Try that

Or just replace the drive

 

[michele31415]

Already ran sfc. See way back in post no. 1, item no. 6. In fact that was a real adventure. You need your Windows CD to run sfc. But my CD drive doesn't work, remember? Anyway, that doesn't even matter because Alienware never gave me a Windows CD. Not that even that would have helped because I'm now running SP3 and when the machine was new they were up to SP nothing, and sfc wants a disc with the same level you're running.

So I had to slipstream SP3 from Microsoft onto the hard drive, then make a merged i386 directory with the partial one I already had in C:\Windows, and then mod some registry key I don't even remember to point sfc to C: instead of D: just to get the program to run at all. Then after all that, it didn't find anything to complain about.

I suppose I could replace the drive. They're only like $35 used on Ebay. I'm just afraid that won't help either. Then I'll still be stuck with the same problem, and I'll be out the 35 bucks.

One thing I still have not been able to find on the net is whether CD drives have some hardware failure mode that still lets them read audio but not data, except from a bootable disc. Sounds far-fetched to me.