BSOD Random PFN LIST Corrupt 0X0000004e

[deweylim]

Hi Guys,

I really need your help, at my wits end now about this random error. It seems to occur mostly when i'm torrenting and playing games or surfing the net.

I have updated the graphic card, network card's driver. Did a mem86 RAM check, took out the old set of rams and i'm still getting the blue screen. I'm short of reinstalling the OS. Please help me solve this issue.

Using Window 7 Ultimate Retail X64.

 

[zigzag3143]

Hi Guys,

I really need your help, at my wits end now about this random error. It seems to occur mostly when i'm torrenting and playing games or surfing the net.

I have updated the graphic card, network card's driver. Did a mem86 RAM check, took out the old set of rams and i'm still getting the blue screen. I'm short of reinstalling the OS. Please help me solve this issue.

Using Window 7 Ultimate Retail X64.

These are all related to a PFN either a bad driver or corrupt OS file. They seem to point to tcpip.sys and reference MSE as active at the poinit of the crash. Possibly malware.

Please download the free version of Malwarebytes.
Update it immediately.
Do a full system scan
Let us know the results at the end.

Malwarebytes : Download free malware, virus and spyware tools to get your computer back in shape!

Malwarebytes : Download free malware, virus and spyware tools to get your computer back in shape!


Please run a system file check.

Run a system file check to verify and repair your system files.

To do this type cmd in search, then right click to run as administrator, then
SFC /SCANNOW

It may need to be run up to three times before successful
Let us know the results from the report at the end.

Read here for more information http://www.sevenforums.com/tutorials/1538-sfc-scannow-command-system-file-checker.html



How many memtest passes?

Run driver verifier to find the driver responsible.

 

[deweylim]

Hi,

thanks for your advice. I did the malware checks and everything seems fine. i ran 6 memtest passes a few days ago.

I ran the driver verifier and pbfilter.sys seems to be giving the issue. The windows will not boot properly until i go into safe mode and reset the verifier program. It is from peerblock. Do you think that cause the issues? I have it for a while now and it only seems to give me BSOD issues recently.

 

[deweylim]

This is the malwarebyte results.

Malwarebytes Anti-Malware (Trial) 1.60.0.1800
Malwarebytes : Free anti-malware, anti-virus and spyware removal download

Database version: v2012.01.01.04

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 9.0.8112.16421
****

Protection: Enabled

1/2/2012 9:23:15 PM
mbam-log-2012-01-02 (22-52-28).txt

Scan type: Full scan
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 416722
Time elapsed: 1 hour(s), 9 minute(s), 31 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 16
HKCR\CLSID\{78F3A323-798E-4AEA-9A57-88F4B05FD5DD} (PUP.VShareRedir) -> No action taken.
HKCR\TypeLib\{BB7256DD-EBA9-480B-8441-A00388C2BEC3} (PUP.VShareRedir) -> No action taken.
HKCR\Interface\{3D782BB2-F2A5-11D3-BF4C-000000000000} (PUP.VShareRedir) -> No action taken.
HKCR\MyNewsBarLauncher.IE5BarLauncherBHO.1 (PUP.VShareRedir) -> No action taken.
HKCR\MyNewsBarLauncher.IE5BarLauncherBHO (PUP.VShareRedir) -> No action taken.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{78F3A323-798E-4AEA-9A57-88F4B05FD5DD} (PUP.VShareRedir) -> No action taken.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{78F3A323-798E-4AEA-9A57-88F4B05FD5DD} (PUP.VShareRedir) -> No action taken.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{78F3A323-798E-4AEA-9A57-88F4B05FD5DD} (PUP.VShareRedir) -> No action taken.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{78F3A323-798E-4AEA-9A57-88F4B05FD5DD} (PUP.VShareRedir) -> No action taken.
HKCR\CLSID\{7AC3E13B-3BCA-4158-B330-F66DBB03C1B5} (PUP.VShareRedir) -> No action taken.
HKCR\MyNewsBarLauncher.IE5BarLauncher.1 (PUP.VShareRedir) -> No action taken.
HKCR\MyNewsBarLauncher.IE5BarLauncher (PUP.VShareRedir) -> No action taken.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{7AC3E13B-3BCA-4158-B330-F66DBB03C1B5} (PUP.VShareRedir) -> No action taken.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{7AC3E13B-3BCA-4158-B330-F66DBB03C1B5} (PUP.VShareRedir) -> No action taken.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{7AC3E13B-3BCA-4158-B330-F66DBB03C1B5} (PUP.VShareRedir) -> No action taken.
HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A078F691-9C07-4AF2-BF43-35E79EECF8B7} (Adware.Softomate) -> No action taken.

Registry Values Detected: 4
HKCU\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser|{7AC3E13B-3BCA-4158-B330-F66DBB03C1B5} (PUP.VShareRedir) -> Data: ;áÃzÊ;XA³0öm»Áµ -> No action taken.
HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar|{7AC3E13B-3BCA-4158-B330-F66DBB03C1B5} (PUP.VShareRedir) -> Data: VShareTB -> No action taken.
HKCU\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser\{7AC3E13B-3BCA-4158-B330-F66DBB03C1B5} (PUP.VShareRedir) -> Data: -> No action taken.
HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar\{7AC3E13B-3BCA-4158-B330-F66DBB03C1B5} (PUP.VShareRedir) -> Data: -> No action taken.

Registry Data Items Detected: 1
HKLM\SOFTWARE\Microsoft\Internet Explorer\Main|Start Page (Hijack.StartPage) -> Bad: (Search) Good: (Google) -> No action taken.

Folders Detected: 4
C:\Users\Jojo\funshion (Adware.Funshion) -> No action taken.
C:\Users\Jojo\funshion\cache (Adware.Funshion) -> No action taken.
C:\Users\Jojo\funshion\cache\Cacheflash (Adware.Funshion) -> No action taken.
C:\Users\Jojo\funshion\Seed (Adware.Funshion) -> No action taken.

Files Detected: 11
C:\Program Files (x86)\vShare.tv plugin\BarLcher.dll (PUP.VShareRedir) -> No action taken.
C:\Users\Jojo\Downloads\FunshionInstall2.3.0.21(2).exe (Adware.Funshion) -> No action taken.
C:\Users\Jojo\Downloads\FunshionInstall2.3.0.21.exe (Adware.Funshion) -> No action taken.
C:\Program Files (x86)\alchemyext.dll (Spyware.OnlineGames) -> No action taken.
C:\Program Files (x86)\IGAttrs.dll (Spyware.OnlineGames) -> No action taken.
C:\Program Files (x86)\IGCore.dll (Spyware.OnlineGames) -> No action taken.
C:\Program Files (x86)\IGGfx.dll (Spyware.OnlineGames) -> No action taken.
C:\Program Files (x86)\IGMath.dll (Spyware.OnlineGames) -> No action taken.
C:\Program Files (x86)\IGSg.dll (Spyware.OnlineGames) -> No action taken.
C:\Program Files (x86)\IGUtils.dll (Spyware.OnlineGames) -> No action taken.
C:\Program Files (x86)\slapi.dll (Spyware.OnlineGames) -> No action taken.

(end)

 

[zigzag3143]

Hi,

thanks for your advice. I did the malware checks and everything seems fine. i ran 6 memtest passes a few days ago.

I ran the driver verifier and pbfilter.sys seems to be giving the issue. The windows will not boot properly until i go into safe mode and reset the verifier program. It is from peerblock. Do you think that cause the issues? I have it for a while now and it only seems to give me BSOD issues recently.

It certainly can be the issue but with 16 reg keys infected I would get rid of the malware first.

 

[deweylim]

Hi,

I got rid of the malware and it looks good for now. The computer didn't get a BS last night.. will monitor for tonight too and keep you update.