BleepingComputer.com: Multiple BSOD a day

Hello, to get a start on this lets get a scan log.
b]Next run MBAM (MalwareBytes):[/b]

Please download Malwarebytes Anti-Malware and save it to your desktop.

Download Link 1
Download Link 2

MBAM may "make changes to your registry" as part of its disinfection routine. If using other security programs that detect registry changes (ie Spybot's Teatimer), they may interfere or alert you. Temporarily disable such programs or permit them to allow the changes.

• Make sure you are connected to the Internet.
  
• Double-click on mbam-setup.exe to install the application.
  For instructions with screenshots, please refer to the How to use Malwarebytes' Anti-Malware Guide.
  
• When the installation begins, follow the prompts and do not make any changes to default settings.
  
• When installation has finished, make sure you leave both of these checked:
  • Update Malwarebytes' Anti-Malware
    
  • Launch Malwarebytes' Anti-Malware
  
  
• Then click Finish.

MBAM will automatically start and you will be asked to update the program before performing a scan.

• If an update is found, the program will automatically update itself. Press the OK button to close that box and continue.
  
• If you encounter any problems while downloading the definition updates, manually download them from here and just double-click on mbam-rules.exe to install.

On the Scanner tab:

• Make sure the "Perform Quick Scan" option is selected.
  
• Then click on the Scan button.
  
• If asked to select the drives to scan, leave all the drives selected and click on the Start Scan button.
  
• The scan will begin and "Scan in progress" will show at the top. It may take some time to complete so please be patient.
  
• When the scan is finished, a message box will say "The scan completed successfully. Click 'Show Results' to display all objects found".
  
• Click OK to close the message box and continue with the removal process.

Back at the main Scanner screen:

• Click on the Show Results button to see a list of any malware that was found.
  
• Make sure that everything is checked, and click Remove Selected.
  
• When removal is completed, a log report will open in Notepad.
  
• The log is automatically saved and can be viewed by clicking the Logs tab in MBAM.
  
• Copy and paste the contents of that report in your next reply. Be sure to post the complete log to include the top portion which shows MBAM's database version and your operating system.
  
• Exit MBAM when done.

Note: If MBAM encounters a file that is difficult to remove, you will be asked to reboot your computer so MBAM can proceed with the disinfection process. If asked to restart the computer, please do so immediately. Failure to reboot normally (not into safe mode) will prevent MBAM from removing all the malware.

Troubleshoot Malwarebytes' Anti-Malware

Nothing found by MBAM

Malwarebytes' Anti-Malware 1.50.1.1100
www.malwarebytes.org

Database version: 6369

Windows 6.0.6001 Service Pack 1
Internet Explorer 7.0.6001.18000

4/15/2011 1:21:15 PM
mbam-log-2011-04-15 (13-21-15).txt

Scan type: Quick scan
Objects scanned: 156149
Time elapsed: 5 minute(s), 15 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

Please run an online scan next. You should also install Service pack 2 from Windows Updates.

ESET Online Scanner:

Note: You can use either Internet Explorer or Mozilla FireFox for this scan. You will however need to disable your current installed Anti-Virus, how to do so can be read here.

Vista/Windows 7 users: You will need to to right-click on the either the IE or FF icon in the Start Menu or Quick Launch Bar on the Taskbar and select Run as Administrator from the context menu.

• Please go here to run the scan.
  

  Quote

  Note: If using Mozilla Firefox you will need to download esetsmartinstaller_enu.exe when prompted then double click on it to install.
  All of the below instructions are compatible with either Internet Explorer or Mozilla FireFox.
• Select the option YES, I accept the Terms of Use then click on:
  
• When prompted allow the Add-On/Active X to install.
  
• Make sure that the option Remove found threats is NOT checked, and the option Scan archives is checked.
  
• Now click on Advanced Settings and select the following:

• Scan for potentially unwanted applications
  
• Scan for potentially unsafe applications
  
• Enable Anti-Stealth Technology


• Now click on:
  
• The virus signature database... will begin to download. Be patient this make take some time depending on the speed of your Internet Connection.
  
• When completed the Online Scan will begin automatically.
  
• Do not touch either the Mouse or keyboard during the scan otherwise it may stall.
  
• When completed select Uninstall application on close if you so wish, make sure you copy the logfile first!
  
• Now click on:
  
• Use notepad to open the logfile located at C:\Program Files\ESET\EsetOnlineScanner\log.txt.
  
• Copy and paste that log as a reply to this topic.

Note: Do not forget to re-enable your Anti-Virus application after running the above scan!

Two things I want to mention...

1. Vista SP2 is not coming up on my update list. I'll have to check why it's not. Maybe because I haven't installed IE 8.0 yet
2. I tried to run a sfc /scannow prior to you answering this thread. I not sure if it ran or not. I looked at the CBS.log and it looked like some files were replaced.
I then ran a sfc /verifyonly and it ran clean, nothing bad found.



ESET log
ESETSmartInstaller@High as CAB hook log:
OnlineScanner.ocx - registred OK
# version=7
# iexplore.exe=7.00.6000.16386 (vista_rtm.061101-2205)
# OnlineScanner.ocx=1.0.0.6427
# api_version=3.0.2
# EOSSerial=a9d1c8ec9d987842a60591deeefe50d9
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=true
# antistealth_checked=true
# utc_time=2011-04-15 11:02:16
# local_time=2011-04-15 07:02:16 (-0500, Eastern Daylight Time)
# country="United States"
# lang=1033
# osver=6.0.6001 NT Service Pack 1
# compatibility_mode=768 16777215 100 0 16244210 16244210 0 0
# compatibility_mode=5121 16776893 100 96 22074289 54907787 0 0
# compatibility_mode=5892 16776573 100 100 574432 139506591 0 0
# compatibility_mode=8192 67108863 100 0 0 0 0 0
# scanned=206146
# found=0
# cleaned=0
# scan_time=9473

Are you still having the BSOD's as there is no visible malware?

I had one this morning from the fltmgr.sys. I haven't been on the computer much since the BSOD, other than running the scans and the SFC. I'll use it more tonight and tomorrow and let you know. Usually if I use it heavily it will BSOD on me.

FltMgr.sys is a “system” file used by Windows to help control various aspects of your hard drives & files. Its official name is the “Microsoft Filesystem Filter Manager” and its main duty in the operating system is make sure that the data written to the hard drive is correct and not corrupted.

I think that running the Startup repair could fix this.

How to automatically repair Windows Vista using Startup Repair

Been on PC quite a bit today and "cross fingers" no BSOD. Maybe the SFC worked. I will wait on doing the Repair through Vista a little longer.

SFC has probably repaired the system file. So.. we'll leave it here for now. If it happens again then do the next.

Hi, I was still getting the BSOD. I didn't do the startup repair but I did do a restore from back in late March. I also changed my power scheme to have the pc go to sleep after a period of time. It's been a week and no BSOD. Don't know what did the trick but seems to be working.

Thanks for all your help!

Sometimes I don't question good fortune.