spontaneous BSOD crashes, please help

[c9chen]

Hello,

I am having BSOD crashes, from a few minutes to several minutes into running windows. One time the screen said something about a file win2ky.sys (or something similar). another time "not_less_or_equal". yet another "stop: 0x0000008E (0xc0000005, 0x8055096d, 0xb7483f48, 0x00000000), and other times other hexadecimal type messages.


I followed the virus removal instructions as best i could; here is what happened.

4 tools:
virtumondo and vundo found nothing.
During running smitfraud, the windows disk cleanup program spontaneously ran when i tried to do option 2 (clean). The 1st time I cancelled the windows disk cleanup and got a bsod, the 2nd time I let it go through and then tried to continue with smitfraud but the puter froze. so I gave up with the tools and continued.

SS&D found nothing. Adware found 1 tracing cookie. In the middle of Anti-Spyware, I got a BSOD. In previously successful scans, I remember that it always found a trace of something like Downloader.Agent in windows/svchost.exe. This always appeared even though the it was cleaned each time. Also, there were several tracing cookies.


I also ran combofix. The scan completed but the report generation got hung up.

Other symptoms: I have the latest version of IE and it almost always crashes the 1st time i open it. Right now there is a new thing that happened: the time and date display in the start menu tray has changed format.

Please find attached an hjt log. I would have attached other logs but they didn't complete successfully.

Please let me know what I should do.

Thanks!

 

[CCT]

If you have more than 1 stick of ram, try alternating the sticks one at a time.

If you CAN stay logged long enough, download and use Memtest86 (works from a floppy):

http://www.majorgeeks.com/Memtest86_d4226.html

 

[howard_hopkinso]

Hello and welcome to Techspot.

There`s nothing particularly nasty is your HJT log. However, you should do the following.

You might want to copy and paste these instructions into a notepad file. Then you can have the file open in safe mode, so you can follow the instructions easier.

Boot into safe mode, under your normal user name(NOT THE ADMINISTRATOR ACCOUNT). See how HERE.

In Windows Explorer, turn on "Show all files and folders, including hidden and system". See how HERE.

Go to add remove programmes in your control panel and uninstall anything to do with(if there).

Viewpoint
Viewpoint Manager
Viewpoint Toolbar

Close control panel.

Run HJT with no other programmes open(except notepad). Click the scan button. Have HJT fix the following, by placing a tick in the little box next to(if there).

O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)

O2 - BHO: IeCatch2 Class - {A5366673-E8CA-11D3-9CD9-0090271D075B} - C:\PROGRA~1\FlashGet\jccatch.dll (file missing)

O2 - BHO: Viewpoint Toolbar BHO - {A7327C09-B521-4EDB-8509-7D2660C9EC98} - C:\Program Files\Viewpoint\Viewpoint Toolbar\3.8.0\ViewBarBHO.dll

O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\fgiebar.dll (file missing)

O3 - Toolbar: Viewpoint Toolbar - {F8AD5AA5-D966-4667-9DAF-2561D68B2012} - C:\Program Files\Common Files\Viewpoint\Toolbar Runtime\3.8.0\IEViewBar.dll

O4 - HKUS\S-1-5-18\..\RunOnce: [RunNarrator] Narrator.exe (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\RunOnce: [RunNarrator] Narrator.exe (User 'Default user')

Click on the fix checked button.

Close HJT.

Locate and delete the following bold files and/or directories(if there).

C:\Program Files\Viewpoint<Delete the entire folder.
C:\Program Files\Common Files\Viewpoint<Delete the entire folder.

Reboot into normal mode and rehide your protected OS files.

Go HERE and follow the instructions for posting your minidumps. Attach 5 or 6 of your latest minidumps as well as a fresh HJT log.

Regards Howard :wave: :wave:

This thread is for the use of c9chen only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.

 

[c9chen]

new hjt log

Hello Howard,

Thanks for your reply. I did as you specified.

Please find attached a new hjt log and all of the minidumps that were in the folder.

CCT, thanks too. I'll be sure to give the hardware a checkup too.

c.

 

[peterdiva]

One of the dumps has crashed at IRQL 1c and a Windows system file. This is almost always caused by hardware. Follow CCT's advice.

BugCheck 1000000A, {0, 1c, 1, 804e1bf8} <-- IRQL 1c
Probably caused by : ntkrnlmp.exe ( nt!KeWaitForSingleObject+186 )

 

[howard_hopkinso]

Your HJT log is now clean.

I have now moved this thread to our Windows OS forum. I suggest you follow the advice given by CCT and peterdiva.

Regards Howard

 

[c9chen]

thanks howard, cct, pd so much for your help,

so, how do i run the memtest.iso file? boot from a floppy, or? i just tried double-clicking on it from windows, but the .iso file ext is associated with my sonic record burning program....

c.

 

[howard_hopkinso]

Take a look at this thread HERE for info on how to use Memtest86+

Regards Howard

 

[c9chen]

Hi everyone,

I started running Memtest and it looks as though some of my RAM is bad. Still in the middle of the testing, but i'll be out of town for a couple weeks, so i'm putting off the puter fixing until after.

Again, thanks so much for the help and I'll let you know if there are still any problems.

c.

 

[c9chen]

well, i haven't gone away yet, and i'm thinking of taking my puter on the road with me to fix it.

i tried doing the other stuff that i read about through the minidump link. Resetting page file and defrag. But now when I try to change my page file back to 1.5 times my ram, it doesn't let me. every time i restart, it shows no page file. only when i click on system managed size does it create a page file. right now i have 2 sticks of 1G ram. I took out the older two sticks of 256MB. haven't done a thorough ram check but i've had to do some work at home...

my computer crashed after the defrag, and several times since. but there's only one new minidump file, which i've attached here.

any suggestions?

Thanks,
c.