BSOD at random

[MrBlueScreen]

I've been getting bsod for the past week. I dont recall any changes or updates done that might be the cause. My computer is about 1 year old. Had it built for me so not sure about specifics of the OS other than its Win 7 Ultimate x64. Earlier when I got a blue screen after reboot I got it repeatedly then it finally booted. Please help If you can. thnx

 

[Maguscreed]

There is a long long list of things that may need addressing in the way of drivers on your system, but I'll start simple first. Remove any virtual device software you are running at the moment. For instance, your clone dvd software, as it is installing a massively out of date driver into your system.
(not too mention win 7 has been known to suddenly decide it doesn't like a virtual device)

I am not personally familiar with the following

fffff880`05470000 fffff880`0547a780   wowhd_kern_amd64 wowhd_kern_amd64.sys Thu Jul 26 11:28:46 2007 (46A8CBBE)
fffff880`0547b000 fffff880`0548ab80   csiidecoder_kern_amd64 csiidecoder_kern_amd64.sys Thu Jul 26 11:28:48 2007 (46A8CBC0)
fffff880`0548b000 fffff880`0549ad00   surroundhp_kern_amd64 surroundhp_kern_amd64.sys Thu Jul 26 11:28:45 2007 (46A8CBBD)
fffff880`0549b000 fffff880`054a9a00   tshd4_kern_amd64 tshd4_kern_amd64.sys Thu Jul 26 11:28:42 2007 (46A8CBBA)

but anything before roughly jul 13th '09 is not a win 7 driver.
My driver reference can't even turn up anything on these files.
Willing to bet they are malware related.

Running MBAM with latest definitions will check that.
Malwarebytes (the free version is more than adequate for on demand scanning)

 

[Jonathan_King]

In addition to Maguscreed's advice, uninstall Daemon Tools. After that's done, use this tool to remove SPTD: http://www.duplexsecure.com/download/SPTDinst-v174-x64.exe

SPTD is a driver used by Daemon Tools and a couple other programs, which is known to cause BSODs in Vista and 7.

Please validate your OS: Genuine Microsoft Software

Finally, run driver verifier: http://www.sevenforums.com/tutorials/101379-driver-verifier-enable-disable.html

...Summary of the dumps:

[font=lucida console]
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
*** ERROR: Module load completed but symbols could not be loaded for ntoskrnl.exe
Built by: 7600.16384.amd64fre.win7_rtm.090710-1945
Debug session time: Fri Feb 11 14:54:38.417 2011 (GMT-5)
System Uptime: 0 days 0:00:33.619
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
*** ERROR: Module load completed but symbols could not be loaded for ntoskrnl.exe
Probably caused by : ntoskrnl.exe ( nt+764d8 )
DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT
BUGCHECK_STR:  0xA
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
*** ERROR: Module load completed but symbols could not be loaded for ntoskrnl.exe
Built by: 7600.16384.amd64fre.win7_rtm.090710-1945
Debug session time: Fri Feb 11 14:53:26.170 2011 (GMT-5)
System Uptime: 0 days 0:01:01.372
*** ERROR: Module load completed but symbols could not be loaded for ntoskrnl.exe
Probably caused by : ntoskrnl.exe ( nt+77fef )
DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT
BUGCHECK_STR:  0x3B
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
*** ERROR: Module load completed but symbols could not be loaded for ntoskrnl.exe
Built by: 7600.16384.amd64fre.win7_rtm.090710-1945
Debug session time: Fri Feb 11 14:51:52.496 2011 (GMT-5)
System Uptime: 0 days 0:42:31.698
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
*** ERROR: Module load completed but symbols could not be loaded for ntoskrnl.exe
Probably caused by : ntoskrnl.exe ( nt+914ac )
DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT
BUGCHECK_STR:  0xA
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
*** ERROR: Module load completed but symbols could not be loaded for ntoskrnl.exe
Built by: 7600.16384.amd64fre.win7_rtm.090710-1945
Debug session time: Fri Feb 11 13:42:03.003 2011 (GMT-5)
System Uptime: 0 days 0:32:36.205
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
*** ERROR: Module load completed but symbols could not be loaded for ntoskrnl.exe
Probably caused by : ntoskrnl.exe ( nt+c076a )
DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT
BUGCHECK_STR:  0x50
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
*** ERROR: Module load completed but symbols could not be loaded for ntoskrnl.exe
Built by: 7600.16384.amd64fre.win7_rtm.090710-1945
Debug session time: Fri Feb 11 13:08:50.916 2011 (GMT-5)
System Uptime: 0 days 0:00:33.493
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
*** ERROR: Module load completed but symbols could not be loaded for ntoskrnl.exe
Probably caused by : ntoskrnl.exe ( nt+91a83 )
DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT
BUGCHECK_STR:  0xA
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
  
[/font]

 

[MrBlueScreen]

O.K. I'm starting from the beginning by running Malwarebytes and found 3 viruses. I noticed that my notifications for windows defender was turned off so I enabled it and it had a notification that it found thisTrojan:Win32/Alureon.DX is a rootkit that differs in behavior depending on whether the operating system is 32-bits or 64-bits.) On a 64-bit-based operating system:

Trojan:Win32/Alureon.DX writes directly into the encrypted virtual file system (VFS). It also attempts to directly modify the Master Boot Record (MBR). After attempting these modifications, it attempts to force a reboot of the computer.
I remember now that when I got my first blue screen Avast told me that it detected something trying to control of my asus Q-button. it found a dropper and said to restart to remove it. and I got blue screen when trying to reboot. Had to roll back to a recent restore point to be able to reboot.

 

[Maguscreed]

Boot in safe mode with networking and run malwarebytes and let it do the removal. I think you'll find it a bit safer for virus removal than some of the pay for suites.

Always best to do removals in safemode. It helps prevents possible conflicts.

 

[MrBlueScreen]

I'm running windows defenderscan again and avast is saying found:hidden. File name MBR:\\.\PHYSICALDRIVE0. So in safe mode will an anti virus software be able to remove the virus from my master boot record without erasing it? Or is that why avast can't seem to delete this virus because it has written itself into the MBR. And if so is there anyway to repair or replace the MBR without having to reinstall the OS?

 

[MrBlueScreen]

Used TDSSKILLER to scan and repair MBR. it found infected with that virus. Rebooted and no Blue screen. I'm going to run scans again to make sure all rootkits are gone. I will post back later to let you guys know if this fixed problem.