BleepingComputer.com: Reinstalled Windows, Getting BSOD & virus

Hello,

Im new to the forum so hello .

My PC was getting slow and I had loads of crap on it so I backed up certain files I wanted (scanned them with AVG and on totalvirus and they look fine). Then I uploaded it to Megaupload to get a hold of quickly.

I put in my Windows 7 disc and reinstalled it all (using 'custom install') thinking it would delete EVERYTHING then selected the partition (C drive, which was like 140GB I think). So I allowed it to install and it finished successfully. But as soon as I set up my account and was logged in, it was REALLY slow. It took ages to install the driver for my tenda wireless PCI adapter. Once that was done I installed my GFX card driver, connected to the internet ad installed all the other drivers and updates (while it was REALLY SLOW, using task manager I saw my CPU ussage was 100%, even when I wasnt doing anything). As soon as I did an update, it seemed to be an ok speed (not the kind of speed I was looking for, but it worked.

Then out of no-where I get BSOD. It wasnt up long, but I noticed it said 'hardware'. What first came to mind was my processor. So it restarts automatically, goes through booting process but before it loads up windows, it restarts again, then I get beebs coming out (when im aware means hardware problems).

So I leave it (it was like 3am last night) and go to bed. In the morning when I got up, I tried it and when booting into windows, it took a long long time. I clicked my user account, it was then stuck on that for about 2 mins then I got black screen and that was stuck for 5-10 mins. Then it did load up and CPU usage was 100%. There wee a few more updates, I installed a few programmes then restarted but this time it loaded up normally.

I then notice I have the 'Windows.old' folder with all my old files in it. Obviously It wasnt a fresh reinstall with everything deleted. This makes me think any viruses I had (Im sure I had 1 or 2) could still be with me. So I delete this file (googled to see if it was safe to delete and results suggested it was). It was 30GBs in size, but I still have 2 files left which wont go (apparently there not there) and I cant virus scan them either. They have odd file names (check pic). I can only see them when hidden files option is enabled.



Iv received a few more 'Hardware' BSODs as well. At the moment my CPU usage is low, but can very easily go right up. I dont have the best CPU in the world, but it 'appears' to be slower then usual. Could it be a virus or will the damn thing need to be replaced? Its an Intel Celron D 3.33 GHz. Iv been thinking about an upgrade, just wont have any money for quite a while.

Iv just done an AVG scan and its found 2 trojans. When I go to the folder it was spotted, even having 'show hidden files' and 'show system files' enabled, I cant see them (before it was moved to the vault).



Any ideas? If it is a virus, will I be better off reinstalling Windows 7 again but as a FULLY clean install, including removing ALL previous files (I may need guidance as that was the original plan).

Thank you & have a great day.

This post has been edited by forever_insane: 10 March 2010 - 01:48 PM

Yes, that is definitely a virus.

Option 1: Install Windows 7 again, making sure to format fully first (to keep from having the Windows.old folder).

Option 2: Hack it out in the Malware Removal sub-forum and try to get rid of the virus.

If it were me, I'd just install Windows 7 again, being sure in Step 8 to format the drive before continuing installation. That is your quickest and best option, in my opinion.

Come back if you still have problems afterward. Good luck.

keyboardNinja, on Mar 10 2010, 06:58 PM, said:

Thank you for the quick reply. I will try that and see. So it 100% isnt my CPU? I dont understand why i got the beebs in teh 1st place, maybe something was just overheating (I left my PC on all night and heating was on nearly the whole day).

When I was choosing the settings, I had 3 partitions.. something I forgot to mention. 1 was Local Disc (which was what I originally installed to), 1 was recovery and 1 was..... I cant remember 100%, I think it was system. Hows the best way for me to do it?

Thank you.

Yes, you could potentially have CPU problems. And it's also possible your machine isn't capable of running Windows 7 (see Windows 7 Upgrade Advisor). But you most certainly have a virus.

When you choose Custom Installation and you see the partitions, click on "Local Disk", then "Advanced Disk Options" (like in the tutorial). Format the partition (Local Disk) before clicking Next.

Any other things that need clarifying?

What is your computer's manufacturer and model, by the way?

This post has been edited by keyboardNinja: 10 March 2010 - 02:32 PM

I did the upgrade advisor ages ago, I passed. Its an Emachine Ei205 but with upgraded RAM (now 2.5GB), a graphics card (ATI Radeon HD 3450), Network card (Cheap Tenda PCI), Sata card (cheap one off ebay, PCI) & new sata disc drive.

I'll do the reinstall tomorrow, late now and I want to get to bed early. Is there a way to check if my CPU is ok? I havnt had any problems for a few hours now (around 4pm I think I last had a BSOD. Left it turned off for an hour.). Havnt been doing anything heavy.

Thanks.

This post has been edited by forever_insane: 10 March 2010 - 02:53 PM

All right then. Let me know how it goes.

keyboardNinja, on Mar 10 2010, 07:50 PM, said:

Lol, please can you just re-read my previous post, added more info, not sure if you read it as you already had a reply Also, should I format all partitions as its all on 1 HDD?

This post has been edited by forever_insane: 10 March 2010 - 02:58 PM

And should I go 32 or 64 bit? I plan (or hope to) get some more ram and I know 32 bit only uses a certain amount.

You might want to see if there is alot of dust in your computer and over the heatsink that could be part of your over heating problem.

forever_insane, on Mar 10 2010, 01:48 PM, said:

Do like matt3 said and buy some canned air to blow the dust out of your case. I can guarantee there is plenty of dust in there unless you just cleaned it last week or something. You can get canned air in the computer section of the Electronics department at Wal-Mart, or pretty much any office supply store.

forever_insane, on Mar 10 2010, 01:55 PM, said:

No, you should leave the system and recovery partitions alone. Just format the "Local Disk".

forever_insane, on Mar 10 2010, 02:06 PM, said:

Which bit you should chose is mainly dependent on whether or not your processor can run a 64-bit OS. With a Celeron....it's hard to guess. And I wouldn't know where to look online to find out. The easiest way for you to know is to do this:

At the Start Menu, type "perform" and in the list of matches, chose "Performance Information and Tools". Then under the large base score number, click View and print detailed performance and system information. Under "System", the 6th listing should say Yes or No in regards to 64-bit compatibility. Therein lies your answer.

If it is a Yes, then we'll talk about the differences between 64-bit and 32-bit (pros, cons, etc..). If it's a No, we won't waste our time. Yes, you can upgrade your processor (you mentioned possibly doing this), but whether or not you do that is up to you.

Right, done the reinstall (wanted to get it over with). Iv formatted & deleted the Recovery, system and Local disk and made it all 1 big partition.

It is now 100% new, no previous files. I installed drivers ect, updates, restarted. Then, as I was using the browser update change thing recently released by MS, downloading K-meleon and installing Firefox, I got the BSOD. Something I noticed for a split second was that the screen went funny. Could be my GFX card (iv had problems with it before). As I was rebooting it and saving the BSOD report, I got it again.

Iv taken the GFX card out, now my screen is horrible . I'll have to change the resolution soon. Anyway, I have got any problems, YET! Something iv noticed is that the CPU usage seems to be back to normal, FOR NOW! Hopefully its fine. I did overclock it a little, its usually 3.33GHz but iv made it 3.38GHz, that was about 1 month ago and havnt really had any problems. Should I turn it back down? Havnt really noticed any speed difference, so it defies the point of overclocking really lol. Also, who can I keep an eye on the tempurature? People say like "oh its usually this hot but iv overclocked it and now its this hit degrees" but I dont know how to, if I can do.....

If my PC runs fine now, can I assume my CPU is fine. And if so, what shall I do with my GFX card? It usually runs fine. The only time iv had trouble with it was when I first got it (I had Vista at the time), when I installed Windows 7 for the first time and 'supposedly' now. Could it just be a driver problem?

matt3, on Mar 10 2010, 10:58 PM, said:

Its fine now. It was a little dusty in the fine, but got rid of the main chuncks. When I feel steady enough, I may work on getting more, just dont want to do damage. Concentarting too much can make you do more mistakes... At least in my experience, haha.

Heres the BSOD error report Iv managed to save, if its of use:

BSOD report said:

Download, and install SpeedFan: http://www.almico.com/sfdownload.php
Post your computer temperatures:



Download BlueScreenView
No installation required.
Double click on BlueScreenView.exe file to run the program.
When scanning is done, go Edit>Select All.
Go File>Save Selected Items, and save the report as BSOD.txt.
Open BSOD.txt in Notepad, copy all content, and paste it into your next reply.

keyboardNinja, on Mar 10 2010, 11:23 PM, said:

Im in the UK, so we dont have Wal-mart, and theres not many office shops near me (I live in a village). I will keep an eye out for it though.

keyboardNinja, on Mar 10 2010, 11:23 PM, said:

Oops lol..... Well tbh, when I 1st got my PC, I dont think I had these partitions on it (I could be wrong, cant remember that far back). I had a few viruses that did real damage, so I used the recovery disc that came with my mums laptop, so the PC didnt come with one I got shouted at by Tech guy on the phone as its illegal and not meant for my PC..... I 'think' the partition was installed then'. I know it definetly was instlled when the PC was a vista, so surly id be ok, right? If not, damn it. Serves me right for rushing along with the reinstall.

I did google it, and I read worms and stuff like to hide in it because it doesnt usually get moved. if this is true, then could possibly make it pointless for me to reinstall.

keyboardNinja, on Mar 10 2010, 11:23 PM, said:

Yes, my processor does appear capable for 64 bit.

==================================================
Dump File : 031010-57969-01.dmp
Crash Time : 10/03/2010 11:05:51 PM
Bug Check String :
Bug Check Code : 0x00000124
Parameter 1 : 0x00000004
Parameter 2 : 0x858c7024
Parameter 3 : 0x00000000
Parameter 4 : 0x00000000
Caused By Driver : halmacpi.dll
Caused By Address : halmacpi.dll+ef3f
File Description : Hardware Abstraction Layer DLL
Product Name : Microsoft® Windows® Operating System
Company : Microsoft Corporation
File Version : 6.1.7600.16385 (win7_rtm.090713-1255)
Processor : 32-bit
Computer Name :
Full Path : C:\Windows\minidump\031010-57969-01.dmp
Processors Count : 1
Major Version : 15
Minor Version : 7600
==================================================

==================================================
Dump File : 031010-63804-01.dmp
Crash Time : 10/03/2010 10:54:32 PM
Bug Check String :
Bug Check Code : 0x00000124
Parameter 1 : 0x00000004
Parameter 2 : 0x858c36a4
Parameter 3 : 0x00000000
Parameter 4 : 0x00000000
Caused By Driver : halmacpi.dll
Caused By Address : halmacpi.dll+ef3f
File Description : Hardware Abstraction Layer DLL
Product Name : Microsoft® Windows® Operating System
Company : Microsoft Corporation
File Version : 6.1.7600.16385 (win7_rtm.090713-1255)
Processor : 32-bit
Computer Name :
Full Path : C:\Windows\minidump\031010-63804-01.dmp
Processors Count : 1
Major Version : 15
Minor Version : 7600
==================================================

forever_insane, on Mar 10 2010, 05:38 PM, said:

Oh well....it's always handy to have, not only for blowing out the guts but also the keyboard and such.

forever_insane, on Mar 10 2010, 01:55 PM, said:

Well, it's not terrible that you formatted the whole drive. The Recovery partition is just there in case you want to do a factory restore somewhere down the road. Don't sweat it.

forever_insane, on Mar 10 2010, 02:06 PM, said:

Then, we can begin to discuss the ins and outs of 64 vs. 32 after getting your system stable. Do a search in this sub-forum for "64 32". There have been plenty of topics in the past month about this. There is no need to rehash all of it. If you have specific questions or need clarification, I'll be glad to assist. But I'm not going to take the time to lecture you on the differences when it has already been stated more than once.

Your CPU temps look fine, but the HAL (Hardware Abstraction Layer) related BSOD's worry me. That was the very thing that forced me to reinstall Vista on my laptop the same day I got it. I'm not sure how to fix this type of problem. It is outside my range of computer knowledge. It is likely related to your graphics card, but it's hard to know for sure. I don't know if there is Windows 7 support (drivers) for your particular computer model and/or graphics card. Somebody else will have to handle that.