Windows 7 crashing

[Olaf69]

Hi

My HTPC has crashed about 4 times in the last month with a green screen. The last time I managed to take a snap of the screen with my mobile but quality is poor, I can decipher the following but can't read the rest

'A problem has been detected and Windows has been shutdown to prevent damage to your computer.

DRIVER_IRQL_NOT_LESS_OR_EQUAL (Not sure if the IRQL is correct)

If this is the first time you have seen this stop error screen, restart your computer. If this screen appears again follow these steps:

Check to make sure any new hardware or software is properly installed, if this is a new installation, ask your hardware or software manufacturer for any windows updates you may need.

If problem continues disable or remove any recently removed hardware or software. Disable BIOS memory'

I have attached the photo as well as other reports as requested.

The PC is a home build with Windows 7 Processional 32 bit. Previously had XP on the machine and made the mistake when installing where you have to choose between the two OS when booting each time.

Hardware is approx 2 years old and OS is 9 months old

Any help would be appreciated and will supply more info if required.

Thanks

 

[yowanvista]

Two drivers were involved, ymiqvflos.sys (unknown driver) and Rt86win7.sys (realtek lan driver)

Update both

Relatek Realtek
For ymiqvflos.sys, either remove the software using it or go to C:\Windows\System32 and rename it from .sys to .old

BugCheck D1, {c52d3000, 2, 0, 87e61741}

Unable to load image \SystemRoot\System32\Drivers\ymiqvflos.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for ymiqvflos.sys
*** ERROR: Module load completed but symbols could not be loaded for ymiqvflos.sys
Unable to load image \SystemRoot\system32\DRIVERS\Rt86win7.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for Rt86win7.sys
*** ERROR: Module load completed but symbols could not be loaded for Rt86win7.sys
Probably caused by : ymiqvflos.sys ( ymiqvflos+4741 )

 

[Olaf69]

Thanks yowanvista much appreciated,

I have updated Realtek driver but am having problems with the unknown driver. Not sure how to find out what software uses it so I tried to rename it but got the message

'cant read from the source file or disk - created 26/10/2010 9.26pm try again' (see screen capture attached)

I tried again and get the same message

Checked for installations for that day and no software was installed or any updates either.

Any suggestions?

 

[yowanvista]

Thanks yowanvista much appreciated,

I have updated Realtek driver but am having problems with the unknown driver. Not sure how to find out what software uses it so I tried to rename it but got the message

'cant read from the source file or disk - created 26/10/2010 9.26pm try again' (see screen capture attached)

I tried again and get the same message

Checked for installations for that day and no software was installed or any updates either.

Any suggestions?

Boot int safe mode and retry to rename it
I found no information on this driver, it could be some malware
Run a scan of Malwarebytes in safe mode with networking

 

[Olaf69]

Tried malwarebytes scan in safe mode and nothing found and same response for renaming in safe mode as I got in normal mode

 

[Olaf69]

Please help

Originally only performed quick scan in Malwarebytes which did not pick up anything. Went and did full scan and it picked up the following:

Files Infected:
c:\windows\system32\drivers\ymiqvflos.sys (Trojan.Bubnix) -> Quarantined and deleted successfully.

Restarted PC as suggested and checked if driver was still there and it was. Performed another full scan and the same infection was still there.

Does anyone know how I can delete this thing?

 

[yowanvista]

Originally only performed quick scan in Malwarebytes which did not pick up anything. Went and did full scan and it picked up the following:

Files Infected:
c:\windows\system32\drivers\ymiqvflos.sys (Trojan.Bubnix) -> Quarantined and deleted successfully.

Restarted PC as suggested and checked if driver was still there and it was. Performed another full scan and the same infection was still there.

Does anyone know how I can delete this thing?

Try this Rescue Disk, it will remove deep infections
Download Kaspersky Rescue Disk 10

 

[Olaf69]

Originally only performed quick scan in Malwarebytes which did not pick up anything. Went and did full scan and it picked up the following:

Files Infected:
c:\windows\system32\drivers\ymiqvflos.sys (Trojan.Bubnix) -> Quarantined and deleted successfully.

Restarted PC as suggested and checked if driver was still there and it was. Performed another full scan and the same infection was still there.

Does anyone know how I can delete this thing?

Try this Rescue Disk, it will remove deep infections
Download Kaspersky Rescue Disk 10

Thanks yowanvista, worked a treat