PLZ Help! Can you check my log?

[butler05]

Hey my computer has got the blue screen of death coming up. It will work fine for awhile then all the sudden a blue screen appears and before i can read it, it restarts my PC. I was told i had a looping virus, i dont know if thats true but i know ive got something seriously wrong. Please Help Thanks



Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 7:11:08 PM, on 12/6/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16915)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\savedump.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Creative\Shared Files\CTAudSvc.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\ASUS\EPU-6 Engine\SixEngine.exe
C:\Program Files\ASUS\TurboV\TurboV.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Program Files\Analog Devices\SoundMAX\Smax4.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Creative\Sound Blaster X-Fi Surround 5.1\Volume Panel\VolPanlu.exe
C:\Program Files\Creative\Shared Files\Module Loader\DLLML.exe
C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\WINDOWS\system32\RunDll32.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\ASUS\AsSysCtrlService\1.00.00\AsSysCtrlService.exe
C:\WINDOWS\system32\CTsvcCDA.exe
C:\WINDOWS\system32\dlbucoms.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Norton AntiVirus\Engine\16.7.2.11\ccSvcHst.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Creative\ShareDLL\CADI\NotiMan.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\PnkBstrB.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Norton AntiVirus\Engine\16.7.2.11\ccSvcHst.exe
C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/def ... earch.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ie/def ... .yahoo.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://us.rd.yahoo.com/customize/ie/def ... .yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/def ... earch.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ie/def ... .yahoo.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ie/def ... .yahoo.com
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://go.microsoft.com/fwlink/?LinkId=74005
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files\Norton AntiVirus\Engine\16.7.2.11\IPSBHO.DLL
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\YTSingleInstance.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [Six Engine] "C:\Program Files\ASUS\EPU-6 Engine\SixEngine.exe" -r
O4 - HKLM\..\Run: [TurboV] "C:\Program Files\ASUS\TurboV\TurboV.exe"
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [SoundMAX] "C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" /tray
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [DLBUCATS] rundll32 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\DLBUtime.dll,_RunDLLEntry@16
O4 - HKLM\..\Run: [VolPanel] "C:\Program Files\Creative\Sound Blaster X-Fi Surround 5.1\Volume Panel\VolPanlu.exe" /r
O4 - HKLM\..\Run: [Module Loader] C:\Program Files\Creative\Shared Files\Module Loader\DLLML.exe -StartUpRun
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [Creative KSRun Persistence Module] RunDll32 KSRun.dll,RunDLLEntry
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKCU\..\Run: [Messenger (Yahoo!)] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Steam] "C:\Program Files\Steam\Steam.exe" -silent
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://ccfiles.creative.com/Web/softwar ... /CTPID.cab
O23 - Service: ASUS System Control Service (AsSysCtrlService) - Unknown owner - C:\Program Files\ASUS\AsSysCtrlService\1.00.00\AsSysCtrlService.exe
O23 - Service: Creative Audio Engine Licensing Service - Creative Labs - C:\Program Files\Common Files\Creative Labs Shared\Service\CTAELicensing.exe
O23 - Service: Creative Media Toolbox 6 Licensing Service - Creative Labs - C:\Program Files\Common Files\Creative Labs Shared\Service\MT6Licensing.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe
O23 - Service: Creative Audio Service (CTAudSvcService) - Creative Technology Ltd - C:\Program Files\Creative\Shared Files\CTAudSvc.exe
O23 - Service: dlbu_device - - C:\WINDOWS\system32\dlbucoms.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Norton AntiVirus - Symantec Corporation - C:\Program Files\Norton AntiVirus\Engine\16.7.2.11\ccSvcHst.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: PnkBstrB - Unknown owner - C:\WINDOWS\system32\PnkBstrB.exe

--
End of file - 8081 bytes

[Gecko]

butler05

Your log is clean.
So the BSOD must be something else.

Go to Start > Control panel > Administrative tools > Event viewer > look in the system section.

You are looking for any red or yellow icons, double click on the icon.
Click inside the 'Description' section then highlight the text and copy and paste it into notepad.
At the bottom of the event window check 'words' and then copy and paste that text also
Then past it all into your reply to this thread.

If you don't show any errors in the event viewer then:
Go to Start > Control Panel > System > Advanced tab > Startup and Recovery section
Settings button > System Failure section > check the box 'Write an event to the system log'

[butler05]

I have serveral of these errors:

Error code 100000d1, parameter1 00000001, parameter2 00000002, parameter3 00000008, parameter4 00000001.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

0000: 74737953 45206d65 726f7272 72452020
0010: 20726f72 65646f63 30303120 64303030
0020: 50202031 6d617261 72657465 30302073
0030: 30303030 202c3130 30303030 32303030
0040: 3030202c 30303030 202c3830 30303030
0050: 31303030



Generate Activation Context failed for C:\WINDOWS\WindowsShell.Manifest. Reference error message: The operation completed successfully.
.








Here are my warning messages:

The time service has not been able to synchronize the system time for 49152 seconds because none of the time providers has been able to provide a usable time stamp. The system clock is unsynchronized.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.



Your computer was not able to renew its address from the network (from the DHCP Server) for the Network Card with network address 00248C2CC238. The following error occurred:
An operation was attempted on something that is not a socket. . Your computer will continue to try and obtain an address on its own from the network address (DHCP) server.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

[Gecko]

butler05,

That's a DRIVER_IRQL_NOT_LESS_OR_EQUAL error and it looks like it could be you network card driver.
Almost all d1 errors are driver related so first check to see if there is an update for your network card.

[butler05]

Where would i find and update on my network card. I just built this pc a few months ago everything is new in it. Why would my network card cause my PC to crash, and a blue screen appear real fast then reboot my computer. Then say your computer just recovered from a serious error. Everytime i get on it, taht blue screen flashes and then restarts my PC. I dont know if its a virus or what.

[Gecko]

butler05,

Lets set it so your system won't reboot on the error.
Start > Control panel > System > Advanced tab > Start up and recovery section > Settings button.
Uncheck the box for "Automatically Restart" click ok and then apply.
Now when this happens you will be able to see the BSOD and read all the information presented, there might be a file name.

As for checking for updated drivers first let windows try.
Start > Control panel > System > Hardware tab > Device manager > Network adapters
Right click on your network card and select Update driver.

The next most common reason for the 0xD1 error is bad RAM.

[butler05]

OK i turned off the auto restart. Now i just need the error to come up. Its weird my computer will run two days and never perform but then sometimes that blue screen will appear everytime i open something. I had windows look for updates for my network adapters but they didnt find any better for it. I dont know how my ram could be bad already. The computer is brand new. I even pulled my memory out and stuck it back in to make sure it was seated good.

[butler05]

Hey Gecko my blue screen came up and the error is in Driver_IROL_Not_Less_Or_Equal. Its says If continues diasble Bios Memory Options such as caching and shadowing. And a few other things. At the bottom it has

Stop: 0x0000001 0x00000002, 0x00000008, 0x00000001

[Gecko]

butler05,

Please download the following zip file and extract it to it's own folder.
http://www.nirsoft.net/utils/bluescreenview.zip

Now open the folder and click on BlueScreenView.exe
Its going to take a minute to load because you will have a lot of minidump files to read.
Once it's loaded in the top section will be a list of each minidump (crash)
In the lower section will be highlighted lines, these will be the file names that caused the crash selected in the top section.

Please post back with the file name(s) that are the most common.

[butler05]

Mini021106-02.dmp 2/11/2006 8:09:31 PM IRQL_NOT_LESS_OR_EQUAL 0x1000000a 0x00040000 0x00000002 0x00000001 0x806ffa2a hal.dll hal.dll+2a2a Hardware Abstraction Layer DLL Microsoft® Windows® Operating System Microsoft Corporation 5.1.2600.5512 (xpsp.080413-2111) 32-bit C:\WINDOWS\minidump\Mini021106-02.dmp



hal.dll hal.dll+2a2a 0x806fd000 0x8071dd00 0x00020d00 0x41107b2d 8/4/2004 12:59:09 AM Microsoft® Windows® Operating System Hardware Abstraction Layer DLL 5.1.2600.5512 (xpsp.080413-2111) Microsoft Corporation C:\WINDOWS\system32\hal.dll

Ntfs.sys Ntfs.sys+2abd2 0xba688000 0xba714480 0x0008c480 0x41107eea 8/4/2004 1:15:06 AM Microsoft® Windows® Operating System NT File System Driver 5.1.2600.5512 (xpsp.080413-2111) Microsoft Corporation C:\WINDOWS\system32\drivers\Ntfs.sys


THis one was in every dump file:

ntoskrnl.exe ntoskrnl.exe+33c6 0x804d7000 0x806fd000 0x00226000 0x42250f77 3/1/2005 7:57:27 PM Microsoft® Windows® Operating System NT Kernel & System 5.1.2600.5857 (xpsp_sp3_gdr.090804-1435) Microsoft Corporation C:\WINDOWS\system32\ntoskrnl.exe


The weird thing is all my dates from the crash times were in 2006? I dont know why never had PC in 2006. But i did notice that same error name IRQL_NOT_LESS_OR_EQUAL. I hope this like help you out.

THanks for all the help!
Matt

[Gecko]

butler05,

Those are all system files so you should run windows System file checker tool to see if they are in fact damaged or have been changed.

Click on Start and then Run, in the input field type the following:
cmd
then press Enter

You will now see a command line box, type the following:
sfc /scannow (note space between the c and /) and press Enter.

That will Start the system File Checker, it will take some time to run this check.
Follow any on screen instructions if you encounter them.

If any files are damaged or have been altered it will replace them from the dllcache backup.
If they are also bad then it might ask you for your windows CD.

[butler05]

Hey I did that scan and it did ask for my windows cd. After the scan was finished it didnt look like it had done anything so i restarted my computer and when it came back up everything was really small and then right after the main screen come up that same blue screen come up. So do you have any other ideas?

[butler05]

So i guess your not gonna help me anymore? Ok well thanks for trying i really appreciate it. I guess im gonna have to try and reinstall windows.

Thanks again

Matt