My computer get crashed and the power button on CPU is not working

[jun2306]

I was facing the problem first when I start my game, my screen appeared some lines of words (it is really small so I can't read that) and my computer was totally crashed. mouse , keyboard and the "power" button on CPU were not working for that. I had to cut the electricity and start my computer again. I thought that was the viruses, so I'd formatted and re-install windows 7, but the problem still exists. What should I do? the problem is now occur randomly (sometimes it happen even I am not playing games, just on websites)

 

[marsmimar]

Hello jun2306 and welcome to Seven Forums.

Please follow the BSOD posting instructions. You'll have to configure your computer to create dump files and then post those files in this thread for someone to analyze. Thanks.

http://www.sevenforums.com/crashes-debugging/96879-blue-screen-death-bsod-posting-instructions.html

 

[jun2306]

Sorry I am new here, and here is the zipped folder.
View attachment 240976

I hope this may help. Any questions about my computer I am willing to answer them, thanks.

 

[marsmimar]

Hello again jun2306. According to the dump file you provided, there seems to be two problems involving system files wininit.exe and werfault.exe. The first is Windows Initialize and it's job is to help coordinate how and when programs start up during the boot process. The second is Windows Error Reporting Service and it ... well ... helps report operating system errors. Normally, these two programs are safe and needed for Windows 7 to function properly. But malware has been known to disguise itself by using these names.

The first thing I'd like for you to do is run a full malware scan using your own anti-virus suite. No anti-malware program is 100% effective 100% of the time (if there was such a thing we'd all be using it.) I'd next like for you to run a couple more on-demand scans using these free products and post back if any malware was found.

Windows Defender Offline

Malwarebytes

ESET Online Scanner

After running the malware scans I'd like for you to check your computer for damaged or corrupt system files by running a system file checker scan from an elevated command prompt (option two.) If problems are found, run the scan 3 times and reboot your computer after each scan.

http://www.sevenforums.com/tutorials/1538-sfc-scannow-command-system-file-checker.html

Please post back if any of this helped or not.

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

CRITICAL_OBJECT_TERMINATION (f4)
A process or thread crucial to system operation has unexpectedly exited or been
terminated.
Several processes and threads are necessary for the operation of the
system; when they are terminated (for any reason), the system can no
longer function.
Arguments:
Arg1: 0000000000000003, Process
Arg2: fffffa8003824060, Terminating object
Arg3: fffffa8003824340, Process image file name
Arg4: fffff80002bcbd50, Explanatory message (ascii)

Debugging Details:
------------------


PROCESS_OBJECT: fffffa8003824060

DEBUG_FLR_IMAGE_TIMESTAMP:  0

[COLOR="red"]MODULE_NAME: wininit[/COLOR]

FAULTING_MODULE: 0000000000000000 

[COLOR="red"]PROCESS_NAME:  WerFault.exe[/COLOR]

BUGCHECK_STR:  0xF4_WerFault.exe

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

CURRENT_IRQL:  0

LAST_CONTROL_TRANSFER:  from fffff80002c50eb2 to fffff800028c55c0

STACK_TEXT:  
fffff880`05fb4ac8 fffff800`02c50eb2 : 00000000`000000f4 00000000`00000003 fffffa80`03824060 fffffa80`03824340 : nt!KeBugCheckEx
fffff880`05fb4ad0 fffff800`02bf9203 : ffffffff`ffffffff fffffa80`0217a9a0 fffffa80`03824060 fffffa80`022d9060 : nt!PspCatchCriticalBreak+0x92
fffff880`05fb4b10 fffff800`02b7e02c : ffffffff`ffffffff 00000000`00000001 fffffa80`03824060 00000000`00000008 : nt! ?? ::NNGAKEGL::`string'+0x17336
fffff880`05fb4b60 fffff800`028c4813 : fffffa80`03824060 fffff880`000000ff 00000000`0000073c fffffa80`0217a9a0 : nt!NtTerminateProcess+0x20c
fffff880`05fb4be0 00000000`7724f97a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`0029ce48 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x7724f97a


STACK_COMMAND:  kb

FOLLOWUP_NAME:  MachineOwner

IMAGE_NAME:  wininit.exe

[COLOR="Red"]FAILURE_BUCKET_ID:  X64_0xF4_WerFault.exe_IMAGE_wininit.exe[/COLOR]

BUCKET_ID:  X64_0xF4_WerFault.exe_IMAGE_wininit.exe

Followup: MachineOwner

 

[jun2306]

I used the malwarebytes and 21 objects are scanned and removed, here is it.

Malwarebytes Anti-Malware 1.65.1.1000
Malwarebytes : Free anti-malware download

Database version: v2012.11.12.04

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 9.0.8112.16421
JUN :: JUN-PC [administrator]

11/12/2012 11:45:02 PM
mbam-log-2012-11-12 (23-45-02).txt

Scan type: Quick scan
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 197304
Time elapsed: 3 minute(s), 39 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 8
HKCR\CLSID\{669751ED-D558-49AE-B01A-3B374CC7910E} (Trojan.Agent) -> Quarantined and deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{669751ED-D558-49AE-B01A-3B374CC7910E} (Trojan.Agent) -> Quarantined and deleted successfully.
HKCR\CLSID\{A57E074F-56D8-4A33-8112-AAC9693AA909} (Trojan.Agent) -> Quarantined and deleted successfully.
HKCR\CLSID\{A4A8D17B-83D7-582B-F170-E0A7EC1A387D} (Trojan.Agent) -> Quarantined and deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{A4A8D17B-83D7-582B-F170-E0A7EC1A387D} (Trojan.Agent) -> Quarantined and deleted successfully.
HKCR\CLSID\{DB8B2393-7A6C-4C76-88CE-6B1F6FF6FFE9} (Trojan.Agent) -> Quarantined and deleted successfully.
HKCU\Software\SogouExplorer (Adware.Sogou) -> Quarantined and deleted successfully.
HKLM\SOFTWARE\Microsoft\Internet Explorer\AdvancedOptions\TBH (Trojan.Agent) -> Quarantined and deleted successfully.

Registry Values Detected: 9
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved|{669751ED-D558-49AE-B01A-3B374CC7910E} (Trojan.Agent) -> Data: -> Quarantined and deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved|{A4A8D17B-83D7-582B-F170-E0A7EC1A387D} (Trojan.Agent) -> Data: -> Quarantined and deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved|{A57E074F-56D8-4A33-8112-AAC9693AA909} (Trojan.Agent) -> Data: -> Quarantined and deleted successfully.
HKCU\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks|{DB8B2393-7A6C-4C76-88CE-6B1F6FF6FFE9} (Trojan.Agent) -> Data: -> Quarantined and deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved|{DB8B2393-7A6C-4C76-88CE-6B1F6FF6FFE9} (Trojan.Agent) -> Data: -> Quarantined and deleted successfully.
HKCU\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks\{DB8B2393-7A6C-4C76-88CE-6B1F6FF6FFE9} (Trojan.Agent) -> Data: -> Quarantined and deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{DB8B2393-7A6C-4C76-88CE-6B1F6FF6FFE9} (Trojan.Agent) -> Data: -> Quarantined and deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{A57E074F-56D8-4A33-8112-AAC9693AA909} (Trojan.Agent) -> Data: -> Quarantined and deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{669751ED-D558-49AE-B01A-3B374CC7910E} (Trojan.Agent) -> Data: -> Quarantined and deleted successfully.

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 6
C:\$Recycle.Bin\S-1-5-21-974853396-1168405008-2199073565-1000\$RG1SUBG.exe (PUP.BundleInstaller.BI) -> No action taken.
C:\$Recycle.Bin\S-1-5-21-974853396-1168405008-2199073565-1000\$RPNVJ83.exe (PUP.AdBundle) -> No action taken.
C:\$Recycle.Bin\S-1-5-21-974853396-1168405008-2199073565-1000\$RYEGUE6.exe (PUP.AdBundle) -> No action taken.
C:\Program Files\TENCENT\SSPlus\SSup.dll (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Program Files\TENCENT\SSPlus\SAddr.dll (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Users\JUN\AppData\Roaming\SogouExplorer\SogouExplorerSetup.exe (Adware.Sogou) -> Quarantined and deleted successfully.

(end)

Then I done with the sfc/scannow, there were nothing goes wrong.

"Windows Resource Protection did not find any integrity violations."

So, what shall I do next?

 

[marsmimar]

Looks like you had some serious malware on that computer. I would very strongly suggest you run Malwarebytes again, but this time select "Perform a Full Scan". This scan could take over an hour to complete but it's very possible your computer has more malware deeply hidden. After you re-scan with Malwarebytes, I would also suggest you use the ESET Online Scanner. As I said, no scanner is 100% effective 100% of the time so running multiple scans (one at a time) increases the chances of finding malware.

Because Malwarebytes found some Trojans, I believe your computer may also have rootkits installed. A rootkit is a very nasty form of malware that can often avoid detection because it can hide so well, even from very trusted and highly recommended malware removal programs. Rootkits can also cause serious damage to operating system files. So serious that sometimes a clean reinstall is necessary to rid the computer of all malware. So I would ask that you also run a special rootkit detection program from Kaspersky called TDSSKiller.

Anti-rootkit utility TDSSKiller

If any more malware is found by Malwarebytes full scan, ESET Online Scanner, or TDSSKiller, I would encourage you to find a computer that you know is malware free and create the bootable disk in Windows Defender Offline from my previous post. This is a very special anti-malware program that can scan your computer BEFORE Windows 7 even starts up. And this is very important to find malware that hides inside the operating system. So run these extra scans and please post back what the results are.

 

[jun2306]

I had run few more scans with malwarebytes, but the ESET Online Scanner link was not available.
The Windows Defender Offline bootable disk must be create on a computer that safe from malware, but the computer must be same OS with mine? For example, mine is 64 bit, the computer must be also 64 bit?

 

[marsmimar]

I had run few more scans with malwarebytes, but the ESET Online Scanner link was not available.
The Windows Defender Offline bootable disk must be create on a computer that safe from malware, but the computer must be same OS with mine? For example, mine is 64 bit, the computer must be also 64 bit?

The computer used to create the WDO bootable disk must be 64-bit. It does not have to be the same OS as yours. You could create it on any version of Windows 7 as long as it's 64-bit.

Are you saying the ESET link I provided didn't work or the blue ESET run scan button? I double-checked the link and it's working.

View attachment 241432

 

[jun2306]

Now I have no problem with the ESET scanner, and I had run also the TDSS Killer, both results were no more threats found. I am willing to Windows Defender Offline bootable disk, but I have no more computer with 64-bit, but only 32-bit, what shall I do? Any other suggestions or I shall send my computer to be repair?