Windows 7: Random BSOD, SF Diagnostic tool zip file attached.

karlsnooks · 19 Sep 2012

brook;

WIN | type MSCONFIG | ENTER | STARTUP tab |
Uncheck ALL except for:

Script:


			
MSC    Microsoft Corporation    "c:\Program Files\Microsoft Security Client\msseces.exe" -hide -runkey

REBOOT!

You have just told Win 7 to not run unchecked programs at start up time.

You have not disabled the programs. They will be run when needed.

WIN = key with the Microsoft logo on top

=======================================
=======================================

After the REBOOT, then:

CCLEANER | TOOLS icon | STARTUP tab | SCHEDULED TASKS tab |
Use DISABLE button to disable ALL

Close CCleaner.

REBOOT!

You have not disabled any programs. You have disabled the scheduled running.
Later, after your system is running smoothly, you may reenable desired programs.

====================================
====================================

After that REBOOT finishes,then:

UNINSTALL

Script:


			
AVG Security Toolbar    AVG Technologies    9/15/2012        12.2.5.34
BitTorrent    BitTorrent Inc.    9/15/2012        7.7.0
BitTorrentControl_v12 Toolbar    BitTorrentControl_v12    9/15/2012        6.9.0.16
Bonjour    Apple Inc.    8/31/2012    2.00 MB    3.0.0.10
Yontoo 1.10.02    Yontoo LLC    9/15/2012    1.27 MB    1.10.02

REBOOT

Those are all known trouble-makers.

With MSE installed, you have no use for any other anti-malware software.

On the following advice, I'm very emphatic:
REMOVAL OF P2P PROGRAMS

There are signs of one or more P2P (Peer to Peer) File Sharing Programs on your computer.

As long as you are using any form of P2P networking to download files, you can anticipate malware infestations.

References citing the risk of using P2P programs:

Malware: Help prevent the Infection
Perils of P2P File Sharing
How to Prevent the Online Invasion of Spyware and Adware
The Hidden Security Risks of P2P Traffic

I strongly recommend that you uninstall:
µTorrent
BitTorrent
Vuze

karlsnooks · 19 Sep 2012

With the programs that were on your install list and using torrent software, then I must ask you to:

HOW TO USE MICROSOFT'S OFFLINE MALWARE REMOVER
Windows Defender Offline
· performs an offline scan of an infected PC to remove viruses, rootkits and other advanced malware.
· is a free standalone, bootable malware and virus remover from Microsoft.

Download Windows Defender Offline (about 785 kB)
You will have the choice of downloading the 32bit version (x86) or the 64 bit version (x64).
The link will help you determine whether you are running a 32 bit version or 64 bit version of Windows

NOTE!! You can download and prepare a 32 bit version using a 64 bit version of Windows
NOTE!! You can download and prepare a 64 bit version using a 32bit version of Windows.

You run the 32 bit version on a 32 bit version of Windows.
You run the 64 bit version on a 64 bit version of Windows.

The 32 bit download file name is: mssstool32.exe
The 64 bit download file name is: mssstool64.exe

For the curious, this program was originally name Microsoft Standalone System Sweeper.

INSTALLATION:
· Requires an Internet Connection.
· Insert 512 mB or larger USB stick into a usb port.
· Run the downloaded program--mssstool64.exe or mssstool32.exe
· NEXT button
· Choose the option On a USB flash drive that is not password protected
· NEXT button
· NEXT button
.
The install program will:
· format the usb stick using the NTFS format.
· download less than 230 mB.
· name the USB stick WDO_Media32 or WDO_Media64
· use less than 300 mB.

How to UPDATE the Windows Defender Offline USB stick:
· reinsert the usb stick
· run the installation program, mssstool64.exe or mssstool32.exe, again.
· the update will download less than 65 mB.

Since the malware database is sometimes updated several times in a day, always update before running.

PERFORM AN OFFLINE SCAN
Bootup your computer from the USB stick
Windows Defender Offline will automatically perform a quick scan.
After the quick scan finishes, Choose Full Scan
Select all of your drives

The initial, full scan can easily take several hours, but
Remember, your computer is being very thoroughly checked for all types of malware.
========================================

When that is finished,Ive a script for you to run which will show me the results.

brook4 · 20 Sep 2012

So far every thing has gone well and the computer is no longer blue screening. I am up to the point where you want me to boot my computer from the USB drive. I don't know how to do that. Thank you so much for your help karlsnook and Arc.

karlsnooks · 21 Sep 2012

brook,
Of course, how to boot to USB is covered in your user's manual.

If you do not have one, then go to the manufacturer's site and download the manual.

Fill out fully and completely your system specs.

You need to help us so that we can help you.

Update your SevenForums System Specs
User CP (located on the top menu bar) |
Your Profile | Edit System Spec (left-hand column)

To gather info, use Speccy (my favorite) or SIW or System Info

In the System Manufacturer Block, enter:
Ø Manufacturer and Model OR Custom build.
Ø ADD the word laptop, desktop, netbook or tablet.
For example:
Toshiba Satellite L305D notebook.

Provide full windows version info, for example:
MS Windows 7 Ultimate SP1 64-bit

Use the “Other Info” block for Optical Reader,
Mouse, touchpad, wifi adapter, speakers, monitor, etc

Scroll down and click on SAVE CHANGES.

With Speccy, you can select with your mouse/touchpad info from the display
and paste that info into your specs.

SIW is a marvelous program, but the free version does not offer
this capability.
====================================

After that, then using the info you gained from the manual for your computer, you will be able to boot from a USB stick and run WDO.

Awaiting the report that you have run WDO.

brook4 · 21 Sep 2012

I figured out the boot from USB. The scan is currently running. I'll message back after it's done.

Edit:
I have completed the full system scan.

karlsnooks · 22 Sep 2012

Excellent.
This script will put a zip file on to your desktop. Please upload that zip file.

# **********************INSTRUCTIONS**************************
# STEP 1 ** RUN POWERSHELL AS ADMINISTRATOR ******************
# ************************************************************
#
# WIN key | type POWERSHELL | do NOT hit ENTER |
# in the PROGRAMS list, right-click on WINDOWS POWERSHELL |
# choose "Run as administrator" |
# Click on the YES button (if such appears)
#
# WIN key = key with Microsoft log on top
#
# for the guru:
# WIN | type POWERSHELL | CTRL+SHIFT+ENTER key combo | ALT+Y keycombo
# ************************************************************
# STEP 2 ** COPY AND PASTE ***********************************
# ************************************************************
#
# COPY the script using CTRL+C,
# COPY every line of script down thru both EXIT statements
#
# PASTE into Powershell
#----Right-Click at the PowerShell Prompt
#----(Ctrl+V does not work)
#
# Start copying with first script line without a # at start of the line
# Note: Actually, you can paste the entire file if you rather
#-------Lines starting with a # are ignored by PowerShell
# ************************************************************
# STEP 3 ** SCRIPT OUTPUT & SCRIPT PURPOSE *******************
# ************************************************************
# --The script output and purpose is given at the very front of the script
#
# --The script output and purpose is given at the very front of the script
#
# ************************************************************
# ***************** NOTE - POWERSHELL VERSION*****************
# if you receive this error msg:
#--The system can not find the path specified
# you may need to update your PowerShell
# you must be using Powershell 2.0 or later.
#
# To determine your Powershell version:
#---Run PowerShell
#---enter $host.version
#---you should see at least:
# Major Minor Build Revision
# ----- ----- ----- --------
# 2......0......-1.....-1
#
# If you do not see the above, update your Vista/Win 7.
# ************************************************************
# *************** NOTE - EXECUTION POLICY*********************
# If you haven't set the execution policy, you may need to:
#---Run PowerShell
#---enter SET-EXECUTIONPOLICY -EXECUTIONPOLICY REMOTESIGNED
# ************************************************************

Script:


			
# ************************************************************
# Zips up files from Windows Defender Offline
# Places WDOlogs.ZIP on your Desktop
# ************************************************************
function New-Zip {
    param([Parameter(Mandatory=$true, Position=0, ValueFromPipeline=$true)]
    [String] $Path, [Switch] $PassThru, [Switch] $Force )
    Process { if (Test-Path $path) {if (-not $Force) { return } }
    Set-Content $path ("PK" + [char]5 + [char]6 + ("$([char]0)" * 18))
    $item = Get-Item $path; $item.IsReadOnly = $false;if ($passThru) { $item } } }
function Copy-ToZip {param(
  [Parameter(Mandatory=$true,Position=0,ValueFromPipelineByPropertyName=$true)] [Alias('FullName')] 
  [String]$File, [Parameter(Mandatory=$true,Position=1)] [String]$ZipFile,[Switch]$HideProgress,[Switch]$Force )
  Begin {$ShellApplication = New-Object -ComObject Shell.Application
  if (-not (Test-Path $ZipFile)) {New-Zip $ZipFile};$Path = Resolve-Path $ZipFile
  $ZipPackage =$ShellApplication.Namespace("$Path")}
  Process {$RealFile = Get-Item $File; if (-not $RealFile) { return }        
  if (-not $hideProgress) {$perc +=5; if ($perc -gt 100) { $perc = 0 } 
    Write-Progress "Copying to $ZipFile" $RealFile.FullName -PercentComplete $perc}
  $Flags = 0; if ($force) {$flags = 16 -bor 1024 -bor 64 -bor 512};Write-Verbose $realFile.Fullname
   $ZipPackage.CopyHere($realFile.Fullname, $flags);Start-Sleep -Milliseconds 500}}
$divider = "#" * 79
$fileinfo = join-path $env:TEMP \wdofileinfo.txt
IF (test-path $fileinfo) {del $fileinfo -ea:silentlycontinue -force:$true}
$dir = $env:windir + '\Microsoft Antimalware\Support'
$a = dir $dir  -rec -force -ea:silentlycontinue | sort-object -property lastwritetime | 
select name, lastwritetime, creationtime, lastaccesstime, length, extension, fullname
$f = $a | select name, lastwritetime,creationtime,lastaccesstime,length
$arr = @()
$arr += $f
$a | where {$_.extension -eq '.log'} |Select fullname |
foreach ($_.fullname) {
$c = $divider
$d = $_.fullname;
$e = get-content -path $_.fullname
$arr += $c, $d, $e
}
$arr | out-file $fileinfo
$ziploc = $env:userprofile + '\desktop\WDOlogs.ZIP'
new-zip $ziploc -verbose:$false -ea:silentlycontinue -force:$true
copy-tozip  $fileinfo $ziploc -verbose:$false -hideprogress:$true
del $fileinfo

EXIT
EXIT

brook4 · 22 Sep 2012

Here you go.

rockysx4 · 22 Sep 2012

Hi,
I downloaded windows debugger.I opened it and tried to open the dump files from minidump files,but it showed
"You don't have permission to open this file.
contact file owner or an administrator to obtain permission"

I am the only owner or administrator of my computer.I also checked administrator settings.I also used the "Take a ownership"..but It was not useful...
so i m unable to debugg my blue screen problem.....
DRIVER_IRQL_NOT_LESS_OR_EQUAL
code-: stop 0x0000001
and i tried to attach minidump files here but it also showed that "access is denied"......
so now what should i do?????? plzzz help me in it....

karlsnooks · 22 Sep 2012

Update your system specs please.

brook4 · 26 Sep 2012

I have attached the file you asked for above.