BleepingComputer.com: BSOD

Hi guys...

I received the blue screen this morning and my windows shut down. I have used your help in the past but it has been awhile. Any help is appreciated. Thanks

In order to assist you effectively, we need more specific information. Please read:

• Before you post about a problem, Some simple guidelines
  
• How To Not Get or Give Technical Assistance on Usenet and Web Forums

Did the BSOD provide a stop error messages or identify a driver (.sys file) as shown in this example?

Crashes (BSOD), unexpected shutdowns, sudden freezing, random restarting, and booting problems could be symptomatic of a variety of things to include hardware/software issues, overheating caused by a failed processor fan, bad memory (RAM), failing or underpowered power supply, CPU overheating, motherboard, video card, faulty or unsigned device drivers, CMOS battery going bad, BIOS and firmware problems, dirty hardware components, programs hanging or unresponsive in the background, and sometimes malware. Even legitimate programs like CD Emulators (Daemon Tools, Alchohol 120%, Astroburn, AnyDVD) can trigger crashes, various stop error messages and system hangs so you may want to disable them if using any while troubleshooting. If the computer is overheating, it usually begins to shutdown/restart on a more regular basis. Troubleshooting for these kinds of issues can be arduous and time consuming. There are no shortcuts.

When Windows detects a problem from which it cannot recover, it displays stop error messages which contain specific information that can help diagnose and resolve the problem detected by the Windows kernel. An error message can be related to a broad number of problems such as driver conflicts, hardware issues, read/write errors, and software malfunctions and malware. In Windows XP, the default setting is for the computer to reboot automatically when a fatal error or crash occurs. You may not see the error code because the computer reboots too fast.

If you turn off the automatic reboot feature you can actually see the error code/STOP Message when it happens - this is also known as the Blue Screen Of Death (BSOD). To change the recovery settings and Disable the Automatic Restart on System Failure in Windows XP, go to Start > Run and type: sysdm.cpl
Click Ok to open System Properties.

Alternatively you can just press WINKEY + Pause/Break keys to bring up System Properties.

• Go to the Advanced tab and under "Startup and Recovery", click on the "Settings" button and go to "System failure".
  
• Make sure "Write an event to the system log" is checked and that "Automatically restart" is unchecked.
  
• Click "OK" and reboot manually for the changes to take effect.

This can also be done in the Windows Advanced Options Menu as shown here by pressing the F8 key repeatedly like you would do for entering safe mode.

-- Vista users can refer to these instructions: How To Disable the Automatic Restart on System Failure in Windows Vista.
-- Windows 7 users can refer to these instructions: How To Disable the Automatic Restart on System Failure in Windows 7.

Doing this won't cure your problem but instead of crashing and restarting you will get a blue diagnostic screen with an error code and other information to include file(s) that may be involved which will allow you to better trace your problem. Write down the full error code and the names of any files/drivers listed, then provide that information in your next reply so we can assist you with investigating the cause. Without that specific information, we would only be guessing rather than troubleshooting.

Thanks for your help quietman...I copied this...does this help??


System Information report written at: 08/01/11 15:02:34
System Name: DFP3L5B1
[Windows Error Reporting]

Time Type Details
7/29/2011 9:43 PM Application Error Faulting application viewnx.exe, version 1.5.1.3000, faulting module nkvrtl.dll, version 1.5.1.3000, fault address 0x0002d218.

6/8/2011 6:40 PM Application Error Faulting application dvdflick.exe, version 1.307.0.738, faulting module msvbvm60.dll, version 6.0.98.2, fault address 0x00063f5a.

4/26/2011 11:20 PM Application Error Faulting application plugin-container.exe, version 1.9.2.4095, faulting module ntdll.dll, version 5.1.2600.6055, fault address 0x0000100b.

4/9/2011 10:27 AM Application Error Faulting application plugin-container.exe, version 1.9.2.4095, faulting module ntdll.dll, version 5.1.2600.6055, fault address 0x0000100b.

4/6/2011 2:10 PM Application Error Faulting application plugin-container.exe, version 1.9.2.4095, faulting module ntdll.dll, version 5.1.2600.6055, fault address 0x0000100b.

4/4/2011 6:41 PM Application Error Faulting application plugin-container.exe, version 1.9.2.4095, faulting module ntdll.dll, version 5.1.2600.6055, fault address 0x0000100b.

4/1/2011 10:40 AM Application Error Faulting application plugin-container.exe, version 1.9.2.4095, faulting module ntdll.dll, version 5.1.2600.6055, fault address 0x0000100b.

3/28/2011 12:05 PM Application Error Faulting application plugin-container.exe, version 1.9.2.4095, faulting module ntdll.dll, version 5.1.2600.6055, fault address 0x0000100b.

3/28/2011 10:54 AM Application Error Faulting application plugin-container.exe, version 1.9.2.4095, faulting module ntdll.dll, version 5.1.2600.6055, fault address 0x0000100b.

3/26/2011 8:40 PM Application Error Faulting application plugin-container.exe, version 1.9.2.4095, faulting module ntdll.dll, version 5.1.2600.6055, fault address 0x0000100b.

3/24/2011 2:07 PM Application Error Faulting application plugin-container.exe, version 1.9.2.4095, faulting module ntdll.dll, version 5.1.2600.6055, fault address 0x0000100b.

3/21/2011 9:31 AM Application Error Faulting application plugin-container.exe, version 1.9.2.4079, faulting module ntdll.dll, version 5.1.2600.6055, fault address 0x0000100b.

3/20/2011 10:41 AM Application Error Faulting application plugin-container.exe, version 1.9.2.4079, faulting module xul.dll, version 1.9.2.4079, fault address 0x00443238.

3/16/2011 11:25 PM Application Error Faulting application plugin-container.exe, version 1.9.2.4079, faulting module ntdll.dll, version 5.1.2600.6055, fault address 0x0000100b.

3/13/2011 10:06 PM Application Error Faulting application plugin-container.exe, version 1.9.2.4079, faulting module ntdll.dll, version 5.1.2600.6055, fault address 0x0000100b.

3/11/2011 4:09 PM Application Error Faulting application plugin-container.exe, version 1.9.2.4079, faulting module ntdll.dll, version 5.1.2600.6055, fault address 0x0000100b.

3/11/2011 12:11 PM Microsoft Office 11 Faulting application outlook.exe, version 11.0.8326.0, stamp 4c1c2372, faulting module outmme32.dll, version 1.30.6.0, stamp 4d081570, debug? 0, fault address 0x00044181.

3/4/2011 10:05 AM Application Error Faulting application plugin-container.exe, version 1.9.2.4066, faulting module ntdll.dll, version 5.1.2600.6055, fault address 0x0000100b.

1/20/2011 9:55 PM Application Error Faulting application plugin-container.exe, version 1.9.2.3989, faulting module ntdll.dll, version 5.1.2600.5755, fault address 0x0000100b.

12/14/2010 3:02 PM Application Error Faulting application , version 0.0.0.0, faulting module unknown, version 0.0.0.0, fault address 0x00000000.

11/23/2010 11:12 PM Application Error Faulting application plugin-container.exe, version 1.9.2.3951, faulting module xul.dll, version 1.9.2.3951, fault address 0x004433f9.

6/8/2011 5:44 PM MsiInstaller Detection of product '{4A7FDA4D-F4D7-4A49-934A-066D59A43C7E}', feature 'Quicktracks' failed during request for component '{3207D1B8-80E5-11D2-B95D-006097C4DE24}'

5/30/2011 3:35 PM MsiInstaller Detection of product '{4A7FDA4D-F4D7-4A49-934A-066D59A43C7E}', feature 'Quicktracks' failed during request for component '{3207D1B8-80E5-11D2-B95D-006097C4DE24}'

5/30/2011 3:31 PM MsiInstaller Detection of product '{4A7FDA4D-F4D7-4A49-934A-066D59A43C7E}', feature 'Quicktracks' failed during request for component '{3207D1B8-80E5-11D2-B95D-006097C4DE24}'

1/31/2011 12:14 PM MsiInstaller Detection of product '{5DFC26EF-8316-41D5-BCCD-E562A79EC3B2}', feature 'Complete' failed during request for component '{19241715-A551-4827-B3DC-143E9495E103}'

1/31/2011 11:40 AM MsiInstaller Detection of product '{5DFC26EF-8316-41D5-BCCD-E562A79EC3B2}', feature 'Complete' failed during request for component '{19241715-A551-4827-B3DC-143E9495E103}'

1/31/2011 11:40 AM MsiInstaller Detection of product '{5DFC26EF-8316-41D5-BCCD-E562A79EC3B2}', feature 'Complete' failed during request for component '{19241715-A551-4827-B3DC-143E9495E103}'

1/31/2011 11:35 AM MsiInstaller Detection of product '{E3D4F451-5F04-4082-BE21-1C0C1ADF5014}', feature 'Complete' failed during request for component '{3FDC80A8-876D-4C95-91D7-C347472C3D22}'

11/29/2010 3:54 PM MsiInstaller Detection of product '{E3D4F451-5F04-4082-BE21-1C0C1ADF5014}', feature 'Complete' failed during request for component '{3FDC80A8-876D-4C95-91D7-C347472C3D22}'

6/25/2011 6:53 PM Application Hang Hanging application chrome.exe, version 0.0.0.0, hang module hungapp, version 0.0.0.0, hang address 0x00000000.

6/25/2011 6:53 PM Application Hang Hanging application chrome.exe, version 0.0.0.0, hang module hungapp, version 0.0.0.0, hang address 0x00000000.

6/3/2011 9:52 AM Application Hang Hanging application nero.exe, version 6.3.1.18, hang module hungapp, version 0.0.0.0, hang address 0x00000000.

4/26/2011 11:20 PM Application Hang Hanging application WINWORD.EXE, version 11.0.8328.0, hang module hungapp, version 0.0.0.0, hang address 0x00000000.

4/26/2011 11:20 PM Application Hang Hanging application WINWORD.EXE, version 11.0.8328.0, hang module hungapp, version 0.0.0.0, hang address 0x00000000.

4/26/2011 11:19 PM Application Hang Hanging application firefox.exe, version 1.9.2.4095, hang module hungapp, version 0.0.0.0, hang address 0x00000000.

4/26/2011 9:41 AM Application Hang Hanging application firefox.exe, version 1.9.2.4095, hang module hungapp, version 0.0.0.0, hang address 0x00000000.

4/25/2011 5:28 PM Application Hang Hanging application firefox.exe, version 1.9.2.4095, hang module hungapp, version 0.0.0.0, hang address 0x00000000.

4/25/2011 5:19 PM Application Hang Hanging application firefox.exe, version 1.9.2.4095, hang module hungapp, version 0.0.0.0, hang address 0x00000000.

4/18/2011 9:17 PM Application Hang Hanging application SpybotSD.exe, version 1.6.0.30, hang module hungapp, version 0.0.0.0, hang address 0x00000000.

4/18/2011 9:17 PM Application Hang Hanging application SpybotSD.exe, version 1.6.0.30, hang module hungapp, version 0.0.0.0, hang address 0x00000000.

3/28/2011 12:06 PM Application Hang Hanging application WINWORD.EXE, version 11.0.8328.0, hang module hungapp, version 0.0.0.0, hang address 0x00000000.

3/28/2011 12:06 PM Application Hang Hanging application WINWORD.EXE, version 11.0.8328.0, hang module hungapp, version 0.0.0.0, hang address 0x00000000.

3/28/2011 12:05 PM Application Hang Hanging application firefox.exe, version 1.9.2.4095, hang module hungapp, version 0.0.0.0, hang address 0x00000000.

3/28/2011 10:55 AM Application Hang Hanging application firefox.exe, version 1.9.2.4095, hang module hungapp, version 0.0.0.0, hang address 0x00000000.

3/28/2011 10:53 AM Application Hang Hanging application firefox.exe, version 1.9.2.4095, hang module hungapp, version 0.0.0.0, hang address 0x00000000.

3/26/2011 6:03 PM Application Hang Hanging application firefox.exe, version 1.9.2.4095, hang module hungapp, version 0.0.0.0, hang address 0x00000000.

3/21/2011 9:37 AM Application Hang Hanging application firefox.exe, version 1.9.2.4079, hang module hungapp, version 0.0.0.0, hang address 0x00000000.

3/21/2011 9:30 AM Application Hang Hanging application firefox.exe, version 1.9.2.4079, hang module hungapp, version 0.0.0.0, hang address 0x00000000.

3/21/2011 9:30 AM Application Hang Hanging application firefox.exe, version 1.9.2.4079, hang module hungapp, version 0.0.0.0, hang address 0x00000000.

3/11/2011 4:12 PM Application Hang Hanging application firefox.exe, version 1.9.2.4079, hang module hungapp, version 0.0.0.0, hang address 0x00000000.

3/11/2011 10:54 AM Application Hang Hanging application nero.exe, version 6.3.1.18, hang module hungapp, version 0.0.0.0, hang address 0x00000000.

1/5/2011 3:46 PM Application Hang Hanging application AcroRd32.exe, version 9.4.0.195, hang module hungapp, version 0.0.0.0, hang address 0x00000000.

11/29/2010 7:14 PM Application Hang Hanging application iSupport.exe, version 4.0.0.6, hang module hungapp, version 0.0.0.0, hang address 0x00000000.


That report does not provide the stop error message as shown in the example I provided. You need to follow those instructions to get that information.

Most of those Application Errors and Hangs for Windows Error Reporting are related to Firefox (plugin-container.exe) and Chrome. I see other hangs on Microsoft Word, Spybot S&D, Nero and Acrobat Reader.

viewnx.exe is a process related to ViewNX from Nikon Corporation.

dvdflick.exe gives mixed results so you may want to get a second opinion and submit it to one of the following online services that analyzes suspicious files:

• Jotti's virusscan
  
• VirusTotal
  
• VirSCAN

In the "File to upload & scan" box, browse to the location of the suspicious file and submit (upload) it for scanning/analysis. If you get a message saying "File has already been analyzed", click Reanalyze file now.

Please download Malwarebytes Anti-Malware and save it to your desktop.

• Double-click on the setup file to install, then follow these instructions for doing a Quick Scan in normal mode.
  
• Don't forget to check for database definition updates through the program's interface (preferable method) before scanning.

Malwarebytes may "make changes to your registry" as part of its disinfection routine. If using other security programs that detect registry changes (ie Spybot's Teatimer), they may interfere or alert you. Temporarily disable such programs or permit them to allow the changes.

• After completing the scan, a log report will open in Notepad.
  
• The log is automatically saved and can be viewed by clicking the Logs tab .
  
• Copy and paste the contents of that report in your next reply. Be sure to post the complete log to include the top portion which shows the database version and your operating system.
  
• Exit Malwarebytes when done.

Note: If Malwarebytes encounters a file that is difficult to remove, you will be asked to reboot your computer so it can proceed with the disinfection process. If asked to restart the computer, please do so immediately. Failure to reboot normally will prevent Malwarebytes from removing all the malware.

Sorry it took so long.....

Malwarebytes' Anti-Malware 1.51.1.1800
www.malwarebytes.org

Database version: 7357

Windows 5.1.2600 Service Pack 3
Internet Explorer 7.0.5730.11

8/2/2011 12:44:50 PM
mbam-log-2011-08-02 (12-44-50).txt

Scan type: Full scan (C:\|)
Objects scanned: 279596
Time elapsed: 1 hour(s), 4 minute(s), 0 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

Did you submit dvdflick.exe for analysis and get a second opinion?

oh sorry...it said found nothing on all scanners.

Try doing an online scan to see if it finds anything else that the other scans may have missed.

Please perform a scan with Eset Online Anti-virus Scanner.

• If using Mozilla Firefox, you will be prompted to download and use the ESET Smart Installer. Just double-click on esetsmartinstaller_enu.exe to install.
  
• Vista/Windows 7 users need to run Internet Explorer/Firefox as Administrator. To do this, right-click on the IE icon in the Start Menu or Quick Launch Bar on the Taskbar and select Run As Administrator from the context menu.

• Click the green button.
  
• Read the End User License Agreement and check the box:
• Check .
  
• Click the button.
  
• Accept any security warnings from your browser and allow the download/installation of any require files.
  
• Under scan settings, check and make sure that the option Remove found threats is NOT checked.
  
• Click Advanced settings and select the following:
  • Scan potentially unwanted applications
    
  • Scan for potentially unsafe applications
    
  • Enable Anti-Stealth technology
  
  
• Click the Start button.
  
• ESET will install itself, download virus signature database updates, and begin scanning your computer.
  
• The scan will take a while so be patient and do NOT use the computer while the scan is running. Keep all other programs and windows closed.
  
• When the scan completes, push
  
• Push , and save the file to your desktop as ESETScan.txt.
  
• Push the button, then Finish.
  
• Copy and paste the contents of ESETScan.txt in your next reply. If no threats are found, there is no option to create a log.

You also never answered this question: Did the BSOD provide a stop error messages or identify a driver (.sys file) as shown in this example?

sorry about not answering the question. I cannot remember what it said on the specific file...but that is what the page looked like.

Here is the eset scan....

C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\GameVance10.zip Win32/Bagle.gen.zip worm
C:\Documents and Settings\All Video Deposition\My Documents\Downloads\VideoConverterSetup (1).exe a variant of Win32/InstallCore.A application
C:\Program Files\FoxTabVideoConverter\VideoConverter.exe a variant of Win32/InstallCore.A application
C:\Program Files\FoxTabVideoConverter\Uninstall\Uninstall.exe a variant of Win32/InstallCore.A application
C:\Program Files\ZoneAlarmSB\bar\1.bin\Z4PLUGIN.DLL a variant of Win32/Toolbar.MyWebSearch application

Quote

If a BSOD occurs again, be sure to write down that information.


Rerun Eset Online Anti-virus Scanner again, but this time under scan settings, be sure to check the option to Remove found threats. Save the log as before and copy and paste the contents in your next reply.

Note: If you recognize any of the detections as legitimate programs, it's possible they are "false positives" and you can ignore them or get a second opinion if you're not sure.

quietman...I had a strange error report when I booted up this morning...I wrote down the error.(tried to copy and paste but would not let me)...

C:\Docume~\AllVid~1\locals~Temp\WER134f.dir00\mini080611-01.dmp
C:\Docume~\AllVid~1\locals~Temp\WER134f.dir00\sysdata.xml

But no blues screen...

I will rerun the eset and post today.

This post has been edited by Bashebabutt: 07 August 2011 - 10:39 AM

These files are generally related to memory/minidumps usually created after a system crash. When a serious error occurs, by default the system dumps "Debugging" information to a memory dump file for later retrieval. The dump file is a binary file that a programmer can load into a debugger. Dr. Watson for Windows is a program error debugger that gathers information about your computer when an error (or user-mode fault) occurs with a program. Technical support groups can use the information in these files to diagnose a program error. The random crashes can be related to a number of hardware/driver issues. Changing the settings to stop memory dumps also stops Windows from writing debugging info into a dump file. Memory dumps, depending on which dump type is selected, can take up a lot of paging file RAM and again, depending on which dump type is being used, can speed up or slow the process of recording information.

Quote

About Minidump Files

For the Minidump involving sysdata.xml, please see Examining Errors (the information pertains to Windows XP but its useful for explaining the issue in newer operating systems).

Quote

Troubleshooting for these kinds of issues can be arduous and time consuming.

• How to read the memory dump files
  
• Overview of memory dump file options for Windows
  
• How to: Debug Memory Dumps (Figure out what is causing a BSOD)

C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\GameVance10.zip Win32/Bagle.gen.zip worm cleaned by deleting - quarantined
C:\Documents and Settings\All Video Deposition\My Documents\Downloads\VideoConverterSetup (1).exe a variant of Win32/InstallCore.A application cleaned by deleting - quarantined
C:\Program Files\FoxTabVideoConverter\VideoConverter.exe a variant of Win32/InstallCore.A application cleaned by deleting - quarantined
C:\Program Files\FoxTabVideoConverter\Uninstall\Uninstall.exe a variant of Win32/InstallCore.A application cleaned by deleting - quarantined
C:\Program Files\ZoneAlarmSB\bar\1.bin\Z4PLUGIN.DLL a variant of Win32/Toolbar.MyWebSearch application cleaned by deleting - quarantined

How is your computer running now?

i booted up this morning, and then after about 10 minutes windows shut down to blue screen and it said...
DRIVER_IRQL_NOT_LESS_OR_EQUAL.