Ongoing frequent BSOD, error 0x0000001E (no pattern as to when)

[SarahCali]

So relieved to have found you, I'm in over my head. Many thanks in advance.

For one week I have been getting frequent bluescreen, with no pattern as to when it happens (always the STOP leads with 0X0000001E). I can usually restart, though once it could not until I allowed suggested troubleshoot/system restore.

I run AVG, and last night purchased their PCTuneup, pretty desperate. It made several changes, but has not resolved the issue.

 

[SarahCali]

In case this is useful, I think I have identified Chrome as a trigger here. Unless it's just coincidence, two BSODs since last posting were both triggered by opening Chrome (I had been working within Firefox and Open Office without issue before doing so).

I am using the latest version, as Chrome was removed when doing the earlier system restore point thing when the machine had problems on startup after a previous BSOD (causing me to reinstall it).

A couple of months ago I had to remove the Google Redirect Virus - which was only impacting Chrome. It took a very long time to remove it (with much help from a forum such as this), and all had seemed OK since then ... until now. I like Chrome (and have over 500 bookmarks I would need to transfer somehow), but this situation is untenable - do I really have to use another browser? This seems insane.

I hope that's not a red herring, but seems to be the only pattern I can identify. Thanks in advance for any help, Sarah

 

[koolkat77]

Welcome to Seven Forums.

AVG itself can be a cause of BSOD's. As a test I would recommend uninstalling AVG with its removal tool from here: Uninstallers (removal tools) for common antivirus software - ESET Knowledgebase

We recommended Microsoft Security Essentials from a strict BSOD perspective. Is most compatible & provides best stability compared to other antivirus app/Internet Security Software.

• Microsoft Security Essentials, Free antivirus for windows
• Malwarebytes Anti-Malware Free
• Good and Free system security combination

   Warning

Do not start the free trial of Malware Bytes; remember to deselect that option when prompted.

Run a full scan with both (separately) once downloaded, installed and updated.

[B]lmvm iaStor
start             end                 module name
fffff880`01044000 fffff880`01198000   iaStor   T (no symbols)           
    Loaded symbol image file: iaStor.sys
    Image path: \SystemRoot\system32\DRIVERS\iaStor.sys
    [COLOR="Teal"]Image name: iaStor.sys
    Timestamp:        Thu Jan 13 07:50:12 2011 (4D2E5A54)[/COLOR]
    CheckSum:         0007188C
    ImageSize:        00154000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4[/B]

Please download the stable version of Intel Rapid Storage drivers from here:

• Intel® Rapid Storage Technology Version:11.2.0.1006

Sometimes drivers remain, not completely uninstalled. Follow this tutorial for complete removal of drivers of the particular program:

• How to Clean Left Over Driver Files with Driver Sweeper

Number down items at start-up. Keep only your anti-virus, this also improves the time for logging into windows.

• Click on the Start button
• Type “msconfig (without quotes), click the resulting link. It will open the System Configuration window.
• Select the “Startup” tab.
• Deselect all items other than the antivirus.
• Apply > OK
• Accept then restart.

Full tutorial:

• http://www.sevenforums.com/tutorials/1401-startup-programs-change.html
• http://www.sevenforums.com/tutorial...ation-conflicts-performing-clean-startup.html

Perform a System File Check to check the integrity of all protected Windows 7:

• Click Start Menu
• Click All Programs
• Click Accessories
• Right click Command Prompt
• Click Run as administrator
• Type

• sfc /scannow

• and press Enter

Full tutorial here:

• SFC /Scannow Command - System File Checker

Check your hard drive(s) for errors by running chkdsk:

• Check your hard disk for errors
• http://www.sevenforums.com/tutorials/433-disk-check.html

Take memtest. Run for 8 passes and test each stick in a know good slot for an additional 6 passes.

• http://www.sevenforums.com/tutorials/105647-ram-test-memtest86.html

   Note

Pay close attention to part 3 of the tutorial in order to rule out the faulty stick.

   Information

Errors are sometimes found after 8 passes.

   Tip

Do this test overnight, before going to bed.

Let us know the results and further BSOD reports if you have them.

 

[SarahCali]

Many thanks, will try these steps.

One question - I am already running Malware Bytes, and unfortunately knew no better when I first installed it, so DID run the free trial option. It's now a pain and frequently reminds me of the fact I have 0 trial days left - although I can and do regularly scan.

Is this a problem I should address?

 

[koolkat77]

Download and install Revo Uninstaller free from here: Download Revo Uninstaller Freeware - Free and Full Download - Uninstall software, remove programs, solve uninstall problems

Opt for "Advanced Mode" and uninstall Malware bytes (also delete the leftover registry entries of mbam) then, reinstall malware bytes free and remember to unselect the free trial option.

Hope this helps,

 

[SarahCali]

Following all the steps so far has turned up nothing, and I've had 2 BSOD's today, so unfortunately it's not resolved (checkdisk C: took more than 2 hours, is that normal?).

I am about to run the memtest overnight, have followed the instructions and have it on a USB - but it did not run when I restarted. I know the answer is "If Memtest does not automatically boot, go into the BIOS and change the CD drive or USB drive to be the first to boot' ... but I'm not a tech, I'm afraid that's a foreign language to me. Talk of RAM sticks also over my head, TBH.

Could someone spell it out for me in super basic language please, and also perhaps reassure my pessimistic ass that this may help? I have a hunch it will be clean, and that this is a software bug of sorts, or possibly a hangover from the redirect virus. I realise I may sound like a fool commenting when so ignorant ... I'm just very nervous about this : (

 

[koolkat77]

I'm calling a friend to help you with RAM.

Can you upload the new dumps.

 

[Britton30]

At startup try pressing F2 or F6 to bring up the boot priority choices, this will be a one-time change.
Did you unzip the memtest file and add to the formatted USB drive?

 

[VistaKing]

I believe on HPs its F9 for one time boot menu .

 

[Britton30]

I got it from a HP support page but it did allow some models may be different.

 

[SarahCali]

At startup try pressing F2 or F6 to bring up the boot priority choices, this will be a one-time change.
Did you unzip the memtest file and add to the formatted USB drive?

Yes, I did that - but it wouldn't boot from there. I will try F2, F6 and F9!

Sorry, it's a delayed response - very frustrating chicken and egg whereby I'm bluescreened whenever I get on here in search of solutions to the bluescreen ... This is both scaring me and driving me nuts. Will try again to run the memtest thing. Thanks all.

 

[SarahCali]

Also

I did as suggested, removed AVG and replaced it with Microsoft Sec. Essentials. It found a Rootkit Trojan, Alureon (which I am guessing is what was causing the 'AVG has successfully blocked a threat' warnings over recent days), and prompted me to run Windows Defender. I should do this, yes?

Is it possible that this is the cause of my issue, and that it is related to Chrome (which I have noted seems to trigger the BSOD)? I have uninstalled Chrome (again), and will do without it if necessary ... though I do like it.

I had the Google Redirect Virus (on Chrome ONLY, IE was OK) 2 months ago, and eventually was able to clear that. Or did I not, and is it possible the machine is still compromised?

Sorry I'm flinging out questions, I just so badly need to resolve this. Grateful for your help.

 

[VistaKing]

Hi Sarah

   Note

download the tool from a clean computer

Download Farbar Recovery Scan Tool from below on a non infected PC
For 32-bit (x86) systems
Download


Farbar Recovery Scan Tool and save it to a flash drive.
For 64-bit (x64) systems
Download


Farbar Recovery Scan Tool x64 and save it to a flash drive.

Plug the flashdrive into the infected PC.

Enter System Recovery Options.

:ar: To enter System Recovery Options from the Advanced Boot Options:
Restart the computer.
As soon as the BIOS is loaded begin tapping the F8 key until Advanced Boot Options appears.
Use the arrow keys to select the Repair your computer menu item.
Select US as the keyboard language settings, and then click Next.
Select the operating system you want to repair, and then click Next.
Select your user account an click Next.

:ar: To enter System Recovery Options by using Windows installation disc:
Insert the installation disc.
Restart your computer.
If prompted, press any key to start Windows from the installation disc. If your computer is not configured to start from a CD or DVD, check your BIOS settings.
Click Repair your computer.
Select US as the keyboard language settings, and then click Next.
Select the operating system you want to repair, and then click Next.
Select your user account and click Next.

:ar: On the System Recovery Options menu you will get the following options:
Startup Repair

System Restore

Windows Complete PC Restore

Windows Memory Diagnostic Tool

Command Prompt

Select Command Prompt

In the command window type e:\frst.exe (for x64 bit version type e:\frst64) and press Enter

   Note

Replace letter e with the drive letter of your flash drive.

   Tip

Type the commands below to see what your letter is for the USB drive and press ENTER after each command

Diskpart
List volume

The tool will start to run.
When the tool opens click Yes to disclaimer.
Press Scan button.
FRST will let you know when the scan is complete and has written the FRST.txt to file, close out this message, then type the following into the search box:
be written to your USB
Type exit and reboot the computer normally
Please copy and paste the login your reply.(FRST.txt )

 

[SarahCali]

Damn - as in, MSE isn't able to get this off? I don't really have access to another PC, is this the only option?

 

[SarahCali]

Oh Gods it's just getting worse. I cannot open a single site except this page (which was already open) since removing Chrome. Not here (Firefox), nor IE. I am in the freakin' Twilight Zone, I cannot see how this is possible.

 

[VistaKing]

Does MSE say it is an Alureon.E virus ?

ADDED :

Download TSSKiller


Download



Press the button Start scan for the utility to start scanning.


When the scan is over, the utility outputs a list of detected objects with description.
The utility automatically selects an action (Cure or Delete) for malicious objects.
The utility prompts the user to select an action to apply to suspicious objects (Skip, by default).

Choose Skip for all

Upload the log . Log will be C:\TDSSKiller_Quarantine\23.07.2010_15.31.43 ( an example )

 

[SarahCali]

I think it just said Rootkit, Trojan, Alureon? And I said yes to the remove option (naturally!) which is when it said run Defender

 

[SarahCali]

Is Alureon bad? Should I not ask? Luckily I can't google myself scared, since I have no web access beyond this page (I realize this is not possible?!)

 

[VistaKing]

We will fix it . Download TSSKiller . Once its done make sure the results point to skip and continue and upload the log fle .

Steps for TSSKiller

A TDSSKiller folder is found on your Desktop.
Open the folder, and double-click the TDSSKiller application.

When TDSSKiller opens, click on: Change Parameters
Under Additional Options, place a check in the box next to: Detect TDLFS File System

Press START

If a suspicious object is detected, the default action is Skip, leave it as is, and click on: Continue
If malicious objects are found, they show in the Scan results.
Ensure Cure (the default) is selected, then click: Continue > Reboot now, to finish the cleaning process.
(Note: If Cure is not available, select Skip, >>Do not select: Delete<<)

When done, the tool outputs its log to the system disk root folder (the disk with the Windows Operating System, normally C:\).

 

[SarahCali]

Does MSE say it is an Alureon.E virus ?

ADDED :

Download TSSKiller

Ah, that one I recognise - it was one of the (MANY!) solutions I ran to get rid of the Google Redirect. I should run it again?