New PC has issues, BSOD

[Tmagic650]

Well, good luck with this...

 

[stijnnnn]

2 more. I disabled DEAMON TOOLS drivers on boot now. But still 2 BSOD's, I think it has something to do with my Bittorrent when booting. When I close it, BSOD kicks in. Take a look at the dumps while I disable Bittorrent drivers on boot. Probably 2 more of those NTOSKRNL.EXE.

 

[stijnnnn]

Oops, I forgot to add dumps on that one. Sorry.

 

[Tmagic650]

Bittorrent use can bring in all sorts of malware, and DEAMON TOOLS is a good source of spyware. This might be what you are dealing with... Yes, NTOSKRNL.exe times 2. What antivirus and malware protection are you using?

 

[stijnnnn]

Wow, something real bad happened. My pc got another BSOD and when I tried to reboot it it would give another BSOD saying PROCESS1_INITIALIZATION_FAILED. After some googling on my laptop I found out I had to delete a file named bootcat.cache after booting it in safemode. I did this, but now my pc is acting very weird. It wont let me enable my Microsoft Security Essentials Reatime Protection for some reason.

The malware protection I got is malwarebites anti malware.

I'll post this with the last 2 minidumps I got, eventhough I thought there were a lot more BSOD's but apparently it didnt make a log of those ones.

 

[stijnnnn]

Can you please take a look at the latest ones? Is it ntoskrnl.exe causin the bsods? Size of the dumps tells me that only the ones from jan 10th and jan 25th are different from the others. As far as I know they all had the same BCCode (f4).

 

[stijnnnn]

Oops, I'm just now reading your last post. I will try and run the combofix now and give you the log later tonight

 

[Tmagic650]

Cool, remember to take your time and follow all directions... Good luck and thank you for reading my replies

 

[stijnnnn]

Oh god. I ran combofix and even lookin at the log makes me sick. I don't know a lot about those logfiles but even I can see that my pc was flooded with trojans and malware. Today mmy MSE found 2 trojans and I had a strange bsod, so that's why I finally decided to run Combofix. Take a look at it, thanks for helping me and I hope the troubles are finally over now.

Ps; IE is acting weird, after the trojans it crashes a lot and doesnt load other pages then my homepage.... Very strange.

 

[Tmagic650]

Combofix logs show things that were deleted or corrected. If it looks like a mess, your computer was a mess. There is nothing to do with it now. Is the computer running better?

It might be time to re-think your antivirus and antimalware program choices

 

[stijnnnn]

Well, you better take a look at it, because you know what it all means. Personally the log tells me that there was a file on my external harddrive called G:\Autorun.inf that made a lot of strange .exe files on my ssd harddrive (c, which are gone now because of the ComboFix. I suspect this was the autorun of a trojan hid in a program.

Other files were c:\program files (x86)\Battlelog Web Plugins\Sonar\esnsonar_uninstall.exe and f:\europoker tournament director's poker clock\EuroPoker Tournament Director's Poker Clock.exe. I suspect these files to be trojans aswell.

The bad (or good) thing - because i'm not sure if its fixed now - is that I also installed the pokerclock on one of my laptops and it died like 2 weeks after that. So I just might be lucky that this didnt happen to this pc or maybe it is about to happen, I dont know.

What does the log tells you? Do you think my pc is clean now?

For antivirus I'm using MSE and for antimalwere I'm using Malwarebytes, so I think those are quite good right?

My pc is running quite good now, except for IE which I just deinstalled. I'm now using chrome. I also changed most of my passwords incl. to serious things as my bankaccount and also passwords to other important accounts because I did that all on this pc.

Thanks for all the help already.

Ps; I think I also found a reason for the last BSOD's that kept coming. I'm pretty sure that BitTorrent was the reason. Somehow it interferred with my system so after a few hours of p2p seeding a BSOD kicked in. I changed it's affinity (dont know if that's correct english) to low, and haven't had any BSOD's since then except for the other one this morning (probably caused by one of the virusses)

 

[Tmagic650]

So you are German? Bitorrant's and Daemon toolbars are malware magnets at best. As I said, the Combofix log just contains information of what was deleted or "fixed". It also gives info on what malware was seen. Your antivirus program is good, but if you were seriously infected before you installed it, it could be missing some things. Download and run this temp file cleaner. Run it from the desktop, and run it weekly:

http://www.geekstogo.com/forum/files/file/187-tfc-temp-file-cleaner-by-oldtimer/

If you still get BSOD's you may consider re-installing Windows fresh and be sure to do a full format before installing Windows again

 

[stijnnnn]

Haha, no I'm not german ;p I'm from Holland.

My pc is running pretty good at the moment, also haven't had any BSODs lately. I have been lookinh on the internet a lot for solutions for the strange behavior of my pc. I'm pretty sure I cleaned it from Malware and virusses now, so that's great.

For example, after reading some forums, I opened cmd with administrator rights and ran "sfc /scannow" (which is a build-in systemscan i presume) and I saw some strange things in the log file. As I said before, I'm pretty bad with hardware but I know some about software etcetera. I cant add the full log with this post because it is about 1.7mb, but some lines that grabbed my attention were:

Hashes for file member \??\C:\Windows\apppatch\msimain.sdb do not match actual file [l:22{11}]"msimain.sdb" :

Could not reproject corrupted file [ml:520{260},l:46{23}]"\??\C:\Windows\apppatch"\[l:22{11}]"msimain.sdb"; source file in store is also corrupted

Hashes for file member \??\C:\Windows\apppatch\sysmain.sdb do not match actual file [l:22{11}]"sysmain.sdb" :

Could not reproject corrupted file [ml:520{260},l:46{23}]"\??\C:\Windows\apppatch"\[l:22{11}]"sysmain.sdb"; source file in store is also corrupted

That is quite odd isn't it? I did some research and found out that this means that somehow my Windows is kinda f*cked up. I can recall it shutting down because of a local blackout while it was doing windows updates just after I got it. That might be the problem of all these corrupt systemfiles. I might just reinstall Windows in a few days.

 

[Tmagic650]

Holland, sorry about that

Run a check of the hard drive fixing any errors, going to Computer, and right-click on the C drive. Select properties, tools and select disk check, putting a check mark in each of the 2 boxes. Set a check on the next start up. Shut down the computer and start it back up. The disk check will run

 

[stijnnnn]

Damn, I reinstalled windows, and thought the problems were gone, but..... here is the same BSOD again............. Can you tell me which file it is this time? If its NTOSKRNL.exe I'm going to be so mad. HOW CAN THIS BE??? I only installed like 5 programs so it cant be the software...

 

[Tmagic650]

CRITICAL_OBJECT_TERMINATION
Ntoskrnl.exe

Time to check your memory using Memtest86

 

[stijnnnn]

Can I get that for free somewhere? Btw, I got a new BSOD with a NEW error code Maybe you can find out what this one tells ya

 

[Tmagic650]

Download Memtest86:
http://www.memtest.org/
Version 4.20. Get the pre-complied iso file and burn it to a CD or DVD. Boot your computer with that CD and let Memtest86 run for at least 7 passes. Any errors mean trouble

 

[stijnnnn]

Ok, I will do, and what about the minidump in my last comment? Which file is causing the BSOD on that one? And by the way, trouble means I need to get new memory? (That is pretty cheap right?)

 

[Tmagic650]

KERNEL_DATA_INPAGE_ERROR
Ntoskrnl.exe
NTFS.sys

Any error with "page" in it refers to memory. Ntoskrnl.exe is general Windows instability and NTFS. sys refers to the hard drive. You really should check the memory before you buy new memory...