Random restart/Windows Update bluescreen problem

By Not_too_happy
Nov 12, 2006
  1. I'm not really sure where to start with all this.
    I'm running a Dell Dimension 9150 with an Intel Pentium 4 HT processor.
    Soundcard is a Creative SoundBlaster Audigy 2 ZS.
    Video card is an ATI Radeon X600.
    Running Windows XP Media Center Edition Version 5.1, Service Pack 2.
    I have McAfee antivirus and firewall (and all the other little bits that come with it), as well as AVG free version antivirus.
    I also have Spybot S&D and SpywareBlaster - all the above programs give me a clean bill of health.
    Basically my PC has recently recovered from a whole load of virus infections which I think were started by the MSN virus (yinstall.exe), except now it's taken to restarting randomly with the message
    "This system is shutting down. The System process system32\services.exe terminated unexpectedly. Status code 204" (This thread describes a problem very similar to mine). From what I can gather, this may be caused by too many people trying to hack into the computer at once - McAfee reported a good seven in one minute recently.
    As if that isn't bad enough, Windows won't finish installing updates, it just gives me the good old BSOD.
    Microsoft online crash analysis reckons it's a problem with video drivers, which may be true as whenever I install the optional software that goes with my video card (ATI Catalyst Control Centre), it will not work, giving me the message "cli.exe error The application failed to initialize properly (0xc0000135), click OK to terminate the application". Drivers are all up to date, and installing older versions has not worked.

    Debugging info from one of these crashes:

    "Debugging Details:

    EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx". The memory could not be "%s".

    eb3f5b6d 8a1401 mov dl,byte ptr [ecx+eax]

    TRAP_FRAME: ac223a28 -- (.trap ffffffffac223a28)
    ErrCode = 00000000
    eax=00000000 ebx=eb3fbb0f ecx=0101d000 edx=804ffd5f esi=00001000 edi=0101c000
    eip=eb3f5b6d esp=ac223a9c ebp=ac223aa8 iopl=0 nv up ei pl nz na pe nc
    cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010206
    eb3f5b6d 8a1401 mov dl,byte ptr [ecx+eax] ds:0023:0101d000=??
    Resetting default scope



    PROCESS_NAME: xmllitesetup.ex

    LAST_CONTROL_TRANSFER: from 804fe5eb to 804f9d1b

    ac2235f0 804fe5eb 0000008e c0000005 eb3f5b6d nt!KeBugCheckEx+0x1b
    ac2239b8 805411f5 ac2239d4 00000000 ac223a28 nt!KiDispatchException+0x3b1
    ac223a20 805411a6 ac223aa8 eb3f5b6d badb0d00 nt!CommonDispatchException+0x4d
    ac223a28 eb3f5b6d badb0d00 804ffd5f 00000000 nt!KiExceptionExit+0x18a
    WARNING: Frame IP not in any known module. Following frames may be wrong.
    ac223b80 805cecdb 00000850 8406e2d8 00000001 0xeb3f5b6d
    ac223afc eb3f7b2d 8406e2d8 01000000 01000218 nt!PspCreateThread+0x3a7
    ac223b80 805cecdb 00000850 8406e2d8 00000001 0xeb3f7b2d
    ac223b80 805cecdb 00000850 8406e2d8 00000001 nt!PspCreateThread+0x3a7
    ac223cc4 805cf93a 00fef868 001f03ff 00000000 nt!PspCreateThread+0x3a7
    ac223d3c 8054078c 00fef868 001f03ff 00000000 nt!NtCreateThread+0xfc
    ac223d3c 7c90eb94 00fef868 001f03ff 00000000 nt!KiFastCallEntry+0xfc
    00fefee4 00000000 00000000 00000000 00000000 0x7c90eb94


    804fe5eb cc int 3


    FOLLOWUP_NAME: MachineOwner


    IMAGE_NAME: ntkrpamp.exe


    SYMBOL_NAME: nt!KiDispatchException+3b1

    FAILURE_BUCKET_ID: 0x8E_nt!KiDispatchException+3b1

    BUCKET_ID: 0x8E_nt!KiDispatchException+3b1

    Followup: MachineOwner"

    Attached is a HijackThis log from just now.

    I have tried System Restore to before the virus trouble but Windows tells me nothing has changed so it won't restore. I don't have any Windows install CDs - just a helpful little note from Dell saying "You don't need it, just use System Restore if anything goes wrong!". B******s.

    Any help is appreciated, thanks in advance - this is driving me insane.
  2. howard_hopkinso

    howard_hopkinso TS Rookie Posts: 24,177   +19

    Hello and welcome to Techspot.

    I have moved your thread to our security and the web forum. This is because your system is infected with several nasties.

    Go and read the Trojan Pakes and other nasties preliminary removal instructions. Follow all the instructions exactly.

    Post fresh HJT and AVG Antispyware logs as attachments into this thread, only after doing the above.

    Regards Howard :wave: :wave:

    This thread is for the use of Not_too_happy only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.
  3. Not_too_happy

    Not_too_happy TS Rookie Topic Starter

    Thanks for the fast response, that's all done and the logs are attached.
    The first two times I ran Ad-Aware, winlogon.exe crashed and left me with a lovely BSOD.
    AVG Antispyware also crashed and then bluescreened once, with the message
    "**STOP: 0x0000007E (0xc0000005, 0xF70A97A2, 0xF724AC28, 0xF724A294)**
    **lzx32.sys - Address F70A97A2base at F70A7000 DateStamp 4555387d**"
    Both of them have run completely now though, and I ran Ccleaner again in case they'd mucked up anything in the registry (don't know if they would have, but I thought it might be worth it). Also, I forgot to mention in my first post that I have run a memory diagnostic which found no problems.
    Hope that helps a bit more, thanks again.
  4. howard_hopkinso

    howard_hopkinso TS Rookie Posts: 24,177   +19

    Your HJT log is now clean.

    Have HJT fix these inactive entries.

    O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)

    O20 - Winlogon Notify: scsiusr4 - scsiusr4.dll (file missing)

    Click fix checked and close HJT.

    Delete all files in AVG Antispyware quarantine.

    If you`re still having problems, please go HERE and follow the instructions. If that doesn`t help, attach 5 or 6 of your latest minidumps here.

    Regards Howard :)

    This thread is for the use of Not_too_happy only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.
  5. Not_too_happy

    Not_too_happy TS Rookie Topic Starter

    Just to let you know, I've done all in the above thread except the pagefile, as I ran System File Checker and it threw up a few missing dlls. As I mentioned above I don't have a Windows install CD so I'm going to phone Dell and ask for one before I try anything else.
Topic Status:
Not open for further replies.

Similar Topics

Add New Comment

You need to be a member to leave a comment. Join thousands of tech enthusiasts and participate.
TechSpot Account You may also...