I'm trying to get my bearings on this as well. So I'm reading things correctly, you only get BSODs when you attempt a clean shutdown of your system?
Can you provide the latest crashdumps using the reporting method specified in this article?
Seems kind of stupid since it is the exact same info as i have on my profile...
Thanks. Just wanted a glimpse of the hardware temperatures.
Please provide the information Vir has asked for.
These all look very consistent, so yes, I agree we got a runaway driver somewhere. However, unfortunately all these crashes look to be after the culprit ran away. There are some suspicious items that are popping up, but I can't guarantee they're involved, other than what little evidence I can find here in conjunction with their track record for being unstable. I'll list them as follows:
- Norton Antivirus. If anything at least uninstall and reinstall it and update it, otherwise uninstall it for the time being while we're checking this out.
- Modem drivers. You have drivers for what appears to be a modem. Unless absolutely necessary, remove the modem from your device manager list and uninstall the drivers.
- TuneUpUtilities. This thing is one of those gimmicky items that are known for causing crashes. Uninstall it.
- MBAM (Malwarebytes) Protector - Using this in conjunction with another AV like Norton is just asking for trouble. Take care of it.
- HotSpotShield - A known cause of instability issues. Will also conflict with your Norton product. Uninstall and look for another solution.
Again, these aren't definitive but they're a good start. Unfortunately without Driver Verifier workin its magic, finding cause is going to be quite difficult and might end up being a process of elimination.
Hmm, I just thought of something. You may be able to get Driver Verifier to save its settings with a clean restart by using a Diagnostic startup. Go into Safe Mode, then in the Start Menu type MSCONFIG and in the window select Diagnostic startup. Restart into normal Windows and - if it works - it'll startup with a very barebones setup, much akin to Safe Mode. You can then startup Driver Verifier, run through the setup, and restart the PC from there. Hopefully the result will be a clean restart and DV will be alive and running (make sure to check). If it does, go back into MSCONFIG (don't need to enter Safe Mode) and select Normal startup then restart again. After that DV may kick into gear and BSOD your system, which you can go into Safe Mode to recover from and send us crashdumps.
Sadly it didnt work
Same thing there to.
That means that it is some kind of system driver that is infected right?
Hmm, AVs and other programs and whatnot may try to circumvent the Diagnostic startup. Try Autoruns, and see if you can't uncheck everything (setting Diagnostic startup in MSconfig will uncheck a lot), and restart. In worst case scenario just go into Safe Mode and use Autoruns and/or MSConfig to recheck items. Note this includes drivers, so your graphics and audio drivers most likely won't be enabled.
If you suspect some form of corruption in Windows, try CHKDSK /R (remember to select option to fix bad sectors) and follow up with SFC /SCANNOW (from Windows DVD environment, not drive). Of course, also run some AV scans, like Kaspersky (especially their TDSSKiller to ensure no rootkits). Do NOT opt to have them fix/clean/delete the infections. If they find any, report to us in our Security forum with the findings, linking to this thread as well. Follow their instructions there. Security problems is a whole other issue which should be handled separately.
Sick weird!
I just tried to start in safe mode and tried to start up verifier.exe
And it worked!
I verified all drivers that wasnt from Microsoft, and next time i started Windows it didnt came up any BSOD!!
It started fine and all stuff works.
But now when all is finished i got from Norton that explorer.exe is a suspicious file and i should remove it.
The info is this:
Full path: c:\users\nicklas\msdata\explorer.exe
____________________________
____________________________
On computer 2012-11-22 på 18:02:23
Last used 2012-11-22 på 18:02:23
Startobject Yes
Started: Yes
____________________________
____________________________
Few users
Fewer than 100 users in Norton Community has used this file.
____________________________
New
File was released 9 days ago
____________________________
High
This file risk is high
____________________________
Basefile:
explorer.exe
____________________________
Start changes:
Change of register: Autostart: \REGISTRY\USER\S-1-5-21-588537147-2881847441-2572422912-1000\Software\Microsoft\Windows\CurrentVersion\Run:Windows Explorer (Utfördes av c:\users\nicklas\msdata\explorer.exe, PID:4396)
Inget försök till åtgärd gjordes
Ändring av register: Autostart: \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run:Windows Explorer (Utfördes av c:\users\nicklas\msdata\explorer.exe, PID:4396)
Inget försök till åtgärd gjordes
____________________________
Nätverksåtgärder
Händelse: Nätverksaktivitet (Utfördes av c:\users\nicklas\msdata\explorer.exe, PID:1688)
Inget försök till åtgärd gjordes
____________________________
Systemsettings
What happened: PE-fil skapades: c:\Users\Nicklas\msdata\iexplorer.exe (done by c:\users\nicklas\msdata\explorer.exe, PID:1688)
No change was tried to be done
What happened: Processstart (done by c:\users\nicklas\msdata\explorer.exe, PID:1688)
No change was tried to be done
What happened: Processtart: c:\Windows\SysWOW64\cmd.exe, PID:4584 (done by c:\users\nicklas\msdata\explorer.exe, PID:4396)
Inget försök till åtgärd gjordes
____________________________
What should i do?!
If i press the Locate button i get to:
MYUSERNAME/msdata and there is just a file called cmdhost_w1c_4495.exe
This is weird shit, need help!
Really sorry for the partly Swedish text, my Norton is in Swedish
That's an infection. Explorer.exe should not be in any directory besides in the Windows directory. That is a copycat explorer executable that is used to redirect explorer usage through a false version. I noticed it's also doing the same with IE as well. You may not be able to see these files on your own either because you haven't setup to see files tagged as system/hidden, or because of that fact that you're actually using the fake explorer to locate them, and it is hiding them purposely so you cannot detect them. Either way you have an infection, so you'll want to go to our Security Forum and talk with them there, linking to this thread for extra details.
Quote