System Crash And What To Do Next Time ?

[Robert11]

Hello,

Running W7 64 bit on a 1.5 yr old HP desktop.
Have never had any problems, until today.

Was reading some articles via Firefox, when, the system crashed and the blue screen came up. Just out of the blue so to speak; no downloading, or programs being installed. Just a nice stable page that I was reading and bamm.

Tried re-starting, and could get to the point where you pick which of the two Users (I have my son as a User) to click on. When clicking, on either, the blue screen comes up.

However, I can start in Safe Mode.

Tried a System Restore, several times, no luck.

Then I tried the HP Recovery Disk CD with the few options to try on it.
Said it couldn't repair. Not aure I am using this disk correctly.
How should it be used ?

Tried the System Restore a few more times, and finally it worked from a Restore Point of yesterday. Great feature. Seems to work fine now.

So my question is this.

a. I assume that it is just about impossible to know what happened. Right ?
Any thoughts, though ?

b. Want to plan ahead, if possible:
If it happens again, and a Restore Point won't do it (it took several tries to get it to work today), what should be the next thing(s) to try ?

Not too sharp with this stuff, so the exact, detailed, steps to try would be much appreciated.

Thank for the help,
Bob

 

[fimble]

A) Thoughts. First Off, Download TDSSKiller and run it in Safe Mode to rule out a prevalent RootKit.
There's a rootkit that's been doing the rounds since December that shows itself through blue screens with a IRQ not less or equal stop code. It usually blames the iastor.sys driver as the cause.
It starts by blue screening/freezing on random programs, then when booting to Normal Mode, then when you try to boot to Safe Mode. Eventually it will allow no access whatsoever.

Do an AV scan.

Download, install and update Malwarebytes' Free. Run a full scan in Safe Mode.

Enable Minidumps.

To ensure minidumps are enabled:
Go to Start, in the Search Box type: sysdm.cpl, press Enter.
Under the Advanced tab, click on the Startup and Recovery Settings... button.
Ensure that Automatically restart is unchecked.
Under the Write Debugging Information header select Small memory dump (256 kB) in the dropdown box (the 256kb varies).
Ensure that the Small Dump Directory is listed as %systemroot%\Minidump.
OK your way out.
Reboot if changes have been made.


B) What to do next/in the future.
Make an image of your system. Many people including myself use Macrium Reflect Free.

 

[zigzag3143]

Hello,

Running W7 64 bit on a 1.5 yr old HP desktop.
Have never had any problems, until today.

Was reading some articles via Firefox, when, the system crashed and the blue screen came up. Just out of the blue so to speak; no downloading, or programs being installed. Just a nice stable page that I was reading and bamm.

Tried re-starting, and could get to the point where you pick which of the two Users (I have my son as a User) to click on. When clicking, on either, the blue screen comes up.

However, I can start in Safe Mode.

Tried a System Restore, several times, no luck.

Then I tried the HP Recovery Disk CD with the few options to try on it.
Said it couldn't repair. Not aure I am using this disk correctly.
How should it be used ?

Tried the System Restore a few more times, and finally it worked from a Restore Point of yesterday. Great feature. Seems to work fine now.

So my question is this.

a. I assume that it is just about impossible to know what happened. Right ?
Any thoughts, though ?

b. Want to plan ahead, if possible:
If it happens again, and a Restore Point won't do it (it took several tries to get it to work today), what should be the next thing(s) to try ?

Not too sharp with this stuff, so the exact, detailed, steps to try would be much appreciated.

Thank for the help,
Bob

Hi Bob and welcome

a) It is not impossible in fact it is probable we can give you some kind of answer. We need files called DMP. here is where and how.

To enable us to assist you with your computer's BSOD symptoms, upload the contents of your "\Windows\Minidump" folder.

The procedure:

* Copy the contents of \Windows\Minidump to another (temporary) location somewhere on your machine.
* Zip up the copy.
* Attach the ZIP archive to your post using the "paperclip" (file attachments) button.



To ensure minidumps are enabled:

Go to Start, in the Search Box type: sysdm.cpl, press Enter.
Under the Advanced tab, click on the Startup and Recovery Settings... button.
Ensure that Automatically restart is unchecked.
Under the Write Debugging Information header select Small memory dump (256 kB) in the dropdown box (the 256kb varies).
Ensure that the Small Dump Directory is listed as %systemroot%\Minidump.
OK your way out.
Reboot if changes have been made.


b)Many other things to try but probably best if you cross that bridge when/if you come to it.

Keep reading here, ask any questions you have and you will learn fast. Remember everyone here stated with no knowledge of windows 7. We all learned like you.


Ken

 

[James Colbert]

Additionally, take note of the stop error # on the blue screen:

http://www.sevenforums.com/crashes-debugging/163622-win7-bsod-question.html#post1401025

 

[dsperber]

b. Want to plan ahead, if possible:
If it happens again, and a Restore Point won't do it (it took several tries to get it to work today), what should be the next thing(s) to try ?

Burn yourself a Windows "repair CD" to boot from, and then you can revert to the next line of defense: restore a "system image", which is literally a complete image of your critical hard drives. This includes (a) the "active" boot partition (on hard disk#1 according to the BIOS", which in a 1-drive system freshly installed on a brand new/empty hard drive would normally be that small 100MB "system reserved" partition, and (b) the C-partition which contains Win7 itself.

This "system image" backup should be targeted to a second partition somewhere... preferably on a second hard drive, or an external USB drive. Sending it to a second partition on your 1-drive environment doesn't give you a fallback in case the drive itself fails. Putting it on a partition on a second internal hard drive, or on a partition on an external USB drive... that's really where it should go, for maximum protection in case of disaster.

And naturally, you should take a "system image" backup on a fairly regular basis, like weekly? Some people do it more often, some less. But since it's your total protection in the event of a true disaster when you restore it you will literally have your C-partition EXACTLY as it looked when you took that "system image" backup.

Win7 only supports one "system image" backup stored on a given partition. The next time you run a "system image" backup if you select the same target partition (which is the pre-populated default, i.e. the drive you wrote to for the previously taken "system image") it will overwrite the one that's there. So you will only end up with one and only one WindowsImageBackup folder (named exactly that) on a given target partition.

So if you want to have several "generations" just in case, you need to pick different target partitions each time you take one, or you can rename the parent folder so that you can have multiple generations on a single partition. I don't know if Win7 is smart enough to offer you a choice of all the generations it sees on a single partition when you go to "restore" (i.e. if you've renamed the parent folders, say by adding a date suffix), or if it will only offer you the contents of just the one "WindowsImageBackup" folder it sees. But if that's the case, you can use the Win7 "system repair CD" to boot to, and then get into a command prompt and manually rename the parent folders on that source drive you want to use into the restore "system image" process so that the one you want to use is named "WindowsImageBackup", then get back into the REPAIR" function and select it for restore.

Anyway, that's your real disaster/recovery: restore your complete C-drive from your most recent "system image".

 

[Robert11]

From OP:

Hi Guys,

Thanks to everyone for taking ALL the time to help me out with such
great info. Really nice of you all, and I appreciate it very much.

I did the Malware quick scan, and it found nothing.
Will do the full system scan tomorrow.

I looked in the Kaspersky TDSS Killer site that was mentioned, but cannot find on it where to actually get the download.
Probably right there, but just don't see it.
Will blame it on old age now, which is a terrific excuse for just about everything.
Can anyone point me to the download for TDSS on their site, please.

BTW: their was a msg via a Google search of someone who used it, and it apparently really killed his PC. Feel that it is safe ? Any caveats to its use ?

So far, everything seems stable.

Will digest the other suggestions, in detail, tomorrow.

Thanks again; will let you know how things work out if they go bad again.

Best regards,
Bob

 

[fimble]

Probably right there, but just don't see it.

Correct!

IMPORTANT

• The utility has GUI.
• The utility supports 32-bit and 64-bit operation systems.
• The utility can be run in Normal Mode and Safe Mode.

Disinfection of an infected system

• Download the file TDSSKiller.zip and extract it (use archiver, for example, WInZip) into a folder on the infected (or potentially infected) PC.
• Execute the file TDSSKiller.exe.
• Wait for the scan and disinfection process to be over. It is necessary to reboot the PC after the disinfection is over.

NB Above links in my post have been killed so don't try them!!