Random restart/Windows Update bluescreen problem

[Not_too_happy]

I'm not really sure where to start with all this.
I'm running a Dell Dimension 9150 with an Intel Pentium 4 HT processor.
Soundcard is a Creative SoundBlaster Audigy 2 ZS.
Video card is an ATI Radeon X600.
Running Windows XP Media Center Edition Version 5.1, Service Pack 2.
I have McAfee antivirus and firewall (and all the other little bits that come with it), as well as AVG free version antivirus.
I also have Spybot S&D and SpywareBlaster - all the above programs give me a clean bill of health.
Basically my PC has recently recovered from a whole load of virus infections which I think were started by the MSN virus (yinstall.exe), except now it's taken to restarting randomly with the message
"This system is shutting down. The System process system32\services.exe terminated unexpectedly. Status code 204" (This thread describes a problem very similar to mine). From what I can gather, this may be caused by too many people trying to hack into the computer at once - McAfee reported a good seven in one minute recently.
As if that isn't bad enough, Windows won't finish installing updates, it just gives me the good old BSOD.
Microsoft online crash analysis reckons it's a problem with video drivers, which may be true as whenever I install the optional software that goes with my video card (ATI Catalyst Control Centre), it will not work, giving me the message "cli.exe error The application failed to initialize properly (0xc0000135), click OK to terminate the application". Drivers are all up to date, and installing older versions has not worked.

Debugging info from one of these crashes:

"Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx". The memory could not be "%s".

FAULTING_IP:
+ffffffffeb3f5b6d
eb3f5b6d 8a1401 mov dl,byte ptr [ecx+eax]

TRAP_FRAME: ac223a28 -- (.trap ffffffffac223a28)
ErrCode = 00000000
eax=00000000 ebx=eb3fbb0f ecx=0101d000 edx=804ffd5f esi=00001000 edi=0101c000
eip=eb3f5b6d esp=ac223a9c ebp=ac223aa8 iopl=0 nv up ei pl nz na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010206
eb3f5b6d 8a1401 mov dl,byte ptr [ecx+eax] ds:0023:0101d000=??
Resetting default scope

DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: 0x8E

PROCESS_NAME: xmllitesetup.ex

LAST_CONTROL_TRANSFER: from 804fe5eb to 804f9d1b

STACK_TEXT:
ac2235f0 804fe5eb 0000008e c0000005 eb3f5b6d nt!KeBugCheckEx+0x1b
ac2239b8 805411f5 ac2239d4 00000000 ac223a28 nt!KiDispatchException+0x3b1
ac223a20 805411a6 ac223aa8 eb3f5b6d badb0d00 nt!CommonDispatchException+0x4d
ac223a28 eb3f5b6d badb0d00 804ffd5f 00000000 nt!KiExceptionExit+0x18a
WARNING: Frame IP not in any known module. Following frames may be wrong.
ac223b80 805cecdb 00000850 8406e2d8 00000001 0xeb3f5b6d
ac223afc eb3f7b2d 8406e2d8 01000000 01000218 nt!PspCreateThread+0x3a7
ac223b80 805cecdb 00000850 8406e2d8 00000001 0xeb3f7b2d
ac223b80 805cecdb 00000850 8406e2d8 00000001 nt!PspCreateThread+0x3a7
ac223cc4 805cf93a 00fef868 001f03ff 00000000 nt!PspCreateThread+0x3a7
ac223d3c 8054078c 00fef868 001f03ff 00000000 nt!NtCreateThread+0xfc
ac223d3c 7c90eb94 00fef868 001f03ff 00000000 nt!KiFastCallEntry+0xfc
00fefee4 00000000 00000000 00000000 00000000 0x7c90eb94


STACK_COMMAND: kb

FOLLOWUP_IP:
nt!KiDispatchException+3b1
804fe5eb cc int 3

SYMBOL_STACK_INDEX: 1

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nt

IMAGE_NAME: ntkrpamp.exe

DEBUG_FLR_IMAGE_TIMESTAMP: 42b9fcda

SYMBOL_NAME: nt!KiDispatchException+3b1

FAILURE_BUCKET_ID: 0x8E_nt!KiDispatchException+3b1

BUCKET_ID: 0x8E_nt!KiDispatchException+3b1

Followup: MachineOwner"

Attached is a HijackThis log from just now.

I have tried System Restore to before the virus trouble but Windows tells me nothing has changed so it won't restore. I don't have any Windows install CDs - just a helpful little note from Dell saying "You don't need it, just use System Restore if anything goes wrong!". B******s.

Any help is appreciated, thanks in advance - this is driving me insane.

 

[howard_hopkinso]

Hello and welcome to Techspot.

I have moved your thread to our security and the web forum. This is because your system is infected with several nasties.

Go and read the Trojan Pakes and other nasties preliminary removal instructions. Follow all the instructions exactly.

Post fresh HJT and AVG Antispyware logs as attachments into this thread, only after doing the above.


Regards Howard :wave: :wave:


This thread is for the use of Not_too_happy only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.

 

[Not_too_happy]

Thanks for the fast response, that's all done and the logs are attached.
The first two times I ran Ad-Aware, winlogon.exe crashed and left me with a lovely BSOD.
AVG Antispyware also crashed and then bluescreened once, with the message
"**STOP: 0x0000007E (0xc0000005, 0xF70A97A2, 0xF724AC28, 0xF724A294)**
**lzx32.sys - Address F70A97A2base at F70A7000 DateStamp 4555387d**"
Both of them have run completely now though, and I ran Ccleaner again in case they'd mucked up anything in the registry (don't know if they would have, but I thought it might be worth it). Also, I forgot to mention in my first post that I have run a memory diagnostic which found no problems.
Hope that helps a bit more, thanks again.

 

[howard_hopkinso]

Your HJT log is now clean.

Have HJT fix these inactive entries.

O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)

O20 - Winlogon Notify: scsiusr4 - scsiusr4.dll (file missing)

Click fix checked and close HJT.

Delete all files in AVG Antispyware quarantine.

If you`re still having problems, please go HERE and follow the instructions. If that doesn`t help, attach 5 or 6 of your latest minidumps here.

Regards Howard

This thread is for the use of Not_too_happy only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.

 

[Not_too_happy]

Just to let you know, I've done all in the above thread except the pagefile, as I ran System File Checker and it threw up a few missing dlls. As I mentioned above I don't have a Windows install CD so I'm going to phone Dell and ask for one before I try anything else.