| | |
Please have a look at this HijackThis Log
![]() |
•
•
Join Date: Mar 2008
Posts: 18
Reputation:
Solved Threads: 0
I posted a thread a few days because I was experiencing a couple of different Blue Screens of Death (see: http://www.daniweb.com/forums/post94...ml#post949427). Well, I have not experienced a Blue Screen of Death since switching to a new anti-virus program today (Avira - which found three new problems and quarantined them). My Malwarebytes Anti-Malware program also found a new problem and quarantined it. I'm not sure if these two programs have quarantined the source(s) of my problems, because the Blue Screens of Death tend to occur when I am viewing videos on the Internet. I have decided to post a HijackThis Log because I am now experiencing something new, a Black Screen of Death.
I've seen it twice. I first saw it after I decided to start a second full scan of my PC with Avira, but the second scan was being performed in safe mode. And then it happened again about an hour ago while I was checking out some sports scores online. No information was given when the black screens occured. The system just went black and restarted on it's own. I see no errors in my Event Viewer. I checked out my advanced System Properties just now and put a checkmark next to "Write an event in the system log" for system failures. I also just did a boot records scan with Avira, but it found nothing. From looking at my new HiJackThis log, I think I see at least one problem. Hopefully someone here can determine what I need to delete.
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 6:42:38 PM, on 8/16/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16876)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir Desktop\sched.exe
C:\Program Files\Avira\AntiVir Desktop\avguard.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxsrvc.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Page_URL = http://www.google.com/ig/dell?hl=en&...us&ibd=0080521
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://go.microsoft.com/fwlink/?LinkId=74005
R3 - URLSearchHook: (no name) - {A3BC75A2-1F87-4686-AA43-5347D756017C} - (no file)
R3 - URLSearchHook: (no name) - *{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - (no file)
O2 - BHO: (no name) - {A3BC75A2-1F87-4686-AA43-5347D756017C} - (no file)
O3 - Toolbar: (no name) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [dscactivate] "C:\Program Files\Dell Support Center\gs_agent\custom\dsca.exe"
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262F} (System Requirements Lab) - http://www.nvidia.com/content/Driver...reqlab_nvd.cab
O16 - DPF: {5AE58FCF-6F6A-49B2-B064-02492C66E3F4} (MUCatalogWebControl Class) - http://catalog.update.microsoft.com/...?1250386865358
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - (no file)
O20 - Winlogon Notify: avgrsstarter - avgrsstx.dll (file missing)
O23 - Service: Avira AntiVir Scheduler (AntiVirSchedulerService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avguard.exe
--
End of file - 3909 bytes
I've seen it twice. I first saw it after I decided to start a second full scan of my PC with Avira, but the second scan was being performed in safe mode. And then it happened again about an hour ago while I was checking out some sports scores online. No information was given when the black screens occured. The system just went black and restarted on it's own. I see no errors in my Event Viewer. I checked out my advanced System Properties just now and put a checkmark next to "Write an event in the system log" for system failures. I also just did a boot records scan with Avira, but it found nothing. From looking at my new HiJackThis log, I think I see at least one problem. Hopefully someone here can determine what I need to delete. Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 6:42:38 PM, on 8/16/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16876)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir Desktop\sched.exe
C:\Program Files\Avira\AntiVir Desktop\avguard.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxsrvc.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Page_URL = http://www.google.com/ig/dell?hl=en&...us&ibd=0080521
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://go.microsoft.com/fwlink/?LinkId=74005
R3 - URLSearchHook: (no name) - {A3BC75A2-1F87-4686-AA43-5347D756017C} - (no file)
R3 - URLSearchHook: (no name) - *{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - (no file)
O2 - BHO: (no name) - {A3BC75A2-1F87-4686-AA43-5347D756017C} - (no file)
O3 - Toolbar: (no name) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [dscactivate] "C:\Program Files\Dell Support Center\gs_agent\custom\dsca.exe"
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262F} (System Requirements Lab) - http://www.nvidia.com/content/Driver...reqlab_nvd.cab
O16 - DPF: {5AE58FCF-6F6A-49B2-B064-02492C66E3F4} (MUCatalogWebControl Class) - http://catalog.update.microsoft.com/...?1250386865358
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - (no file)
O20 - Winlogon Notify: avgrsstarter - avgrsstx.dll (file missing)
O23 - Service: Avira AntiVir Scheduler (AntiVirSchedulerService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avguard.exe
--
End of file - 3909 bytes
I honestly don't see any major problems in your HJT log, just mainly some deactivated entries which are deactivated because of your removal of AVG.
Just run HJT again and place check marks next to these;
R3 - URLSearchHook: (no name) - {A3BC75A2-1F87-4686-AA43-5347D756017C} - (no file)
R3 - URLSearchHook: (no name) - *{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - (no file)
O2 - BHO: (no name) - {A3BC75A2-1F87-4686-AA43-5347D756017C} - (no file)
O3 - Toolbar: (no name) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - (no file)
O20 - Winlogon Notify: avgrsstarter - avgrsstx.dll (file missing)
Once you place the check marks then click the Fix Checked button.
Exit HJT.
Since your blue screens happen or happened when you are viewing videos it could be a problem with your Video Card, possibly you need to update the drivers. It could also be that the card is failing. The problems you note here and on the other thread could also be due to either insufficient RAM or failing RAM also. How much RAM do you have installed?
Just run HJT again and place check marks next to these;
R3 - URLSearchHook: (no name) - {A3BC75A2-1F87-4686-AA43-5347D756017C} - (no file)
R3 - URLSearchHook: (no name) - *{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - (no file)
O2 - BHO: (no name) - {A3BC75A2-1F87-4686-AA43-5347D756017C} - (no file)
O3 - Toolbar: (no name) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - (no file)
O20 - Winlogon Notify: avgrsstarter - avgrsstx.dll (file missing)
Once you place the check marks then click the Fix Checked button.
Exit HJT.
Since your blue screens happen or happened when you are viewing videos it could be a problem with your Video Card, possibly you need to update the drivers. It could also be that the card is failing. The problems you note here and on the other thread could also be due to either insufficient RAM or failing RAM also. How much RAM do you have installed?
•
•
Join Date: Mar 2008
Posts: 18
Reputation:
Solved Threads: 0
I really appreciate the quick response and input. I should have mentioned that I started to notice the blue screens after Malwarebytes Anti-Malware got rid of a bunch of nasties it found several days ago. I then thought that maybe it removed something that my system actually needed, so I ran a chkdsk / r during a system start-up recently. One file was replaced during the chkdsk, but I believe I saw one of the blue screen errors again later, though I am not 100% certain of that. Those two black screens have me thinking that something bad is still lurking in my system. Here is my system information: Intel Pentium Duel CPU E2180 @ 2.00GHz (2 CPUs). Memory: 1014 RAM, 367 MB used, 2073MB available. I have version 9.0c for DirectX. Around the time I changed anti-virus programs (AVG to Avira) and ran chkdsk, I also did a critical update for a sound driver at the Dell Drivers and Downloads website. I'm about to start a long sports video over the Internet to see what happens. The computer itself is only two years old, and I just started using it again about 90 days ago, so I wouldn't think that anything inside could start to go bad, but with my luck, I guess anything is possible <laughs>. I read somewhere that the blue and black screen errors could be related to the power supply (I think that's what it said). Is there a program that checks everything else within the system and saves a log? Any other advice or input from you would be greatly appreciated.
•
•
Join Date: Mar 2008
Posts: 18
Reputation:
Solved Threads: 0
Okay. So I decided to watch a recently televised sports game, and browse other sites with short, sport recap clips at the same time. Well, here is what happened within about 15 minutes: I started to hear that tapping noise again from the right speaker. I knew what was coming at this point, and sure enough, there before my eyes appeared the wonderful Fault In Nonpaged Area error message. It showed me the following: kmixer.sys - Address A8E7CD83 base at A8E5F000, DATESTAMP 480254b3. It also showed the Stop at: 0x00000050 (0XAA1E3B18, 0X00000000, 0XA8E7CD83, 0X0000000). I guess this means I do have some sort of hardware problem. Maybe it's a sound card issue (based on the noise from the speaker), or do you think it's more than likely a Video Card issue? I better look over my Dell Warrenty information. Jholland1964, please let me know your thoughts on everything. Your help is greatly appreciated.
•
•
Join Date: Mar 2008
Posts: 18
Reputation:
Solved Threads: 0
I just got the Driver IRQL Not Less Or Equal error message. I was not watching any videos or playing any music when this error hit. To recap, for about 6 days now I have been receiving two different types of blue screen errors. One is known as the Fault In Nonpaged Area error message, and the other is known as the Driver IRQL Not Less Or Equal error message.
Here is the error information for the last two Blue Screen Errors:
Fault In Nonpaged Area error message info: kmixer.sys - Address A8E7CD83 base at A8E5F000, DATESTAMP 480254b3. Stop at: 0x00000050 (0XAA1E3B18, 0X00000000, 0XA8E7CD83, 0X0000000).
Driver IRQL Not Less Or Equal error message info: ndisuio.sys - Address A9DAEAD9 base at A9DAD000, DATASTAMP 4802573d. Stop at: 0x000000D1 (OXF7A1DFF8, 0x00000002, 0x00000001, 0XA9DAEAD9)
I am beginning to suspect that the blue screen errors, along with my black screen errors, are due to the faulty power supply that exists here in the upstairs part of the house that I live in. I guess I'll have to plug my system in downstairs to see if I experience the same problems there.
Here is the error information for the last two Blue Screen Errors:
Fault In Nonpaged Area error message info: kmixer.sys - Address A8E7CD83 base at A8E5F000, DATESTAMP 480254b3. Stop at: 0x00000050 (0XAA1E3B18, 0X00000000, 0XA8E7CD83, 0X0000000).
Driver IRQL Not Less Or Equal error message info: ndisuio.sys - Address A9DAEAD9 base at A9DAD000, DATASTAMP 4802573d. Stop at: 0x000000D1 (OXF7A1DFF8, 0x00000002, 0x00000001, 0XA9DAEAD9)
I am beginning to suspect that the blue screen errors, along with my black screen errors, are due to the faulty power supply that exists here in the upstairs part of the house that I live in. I guess I'll have to plug my system in downstairs to see if I experience the same problems there.
Last edited by Mike24x; Aug 17th, 2009 at 6:10 am. Reason: I left something out.
•
•
Join Date: Mar 2008
Posts: 18
Reputation:
Solved Threads: 0
Yikes! Well, nevermind what I said about the power supply upstairs. I can no longer access my system restore and I am unable to create another new user account. C:\WINDOWS\system32\jscript.dll is corrupt and unreadable according to a message that I see from Windows. And according to CCleaner, C:\Documents and Settings\user1\LocalSettings\Temporary Internet Files\Content.EI5.AMTKL0CJ\head_thread[1].gif is also corrupt. What can create black screens, blue screens, and cause files to go corrupt?
Well of course malware can cause this but honestly it sounds to me like a major hardware failure. Which of course can all come from faulty power problems that you mention. If the actual power supply in your house is bad then this of course can cause major damage to the computer. All of those errors all point to corrupted or damaged hardware...kmixer.sys refers to audio, video and or faulty RAM, PCASp50 NDIS Protocol Driver can refer to a printer, ndisuio.sys is support for wireless devices such as Bluetooth and the like and then of course the crashing while attempting to watch videos can point to the video driver.
Sounds to me like a total hardware failure.
I would DEFINITELY call Dell even though you are not certain of the warranty.
Sounds to me like a total hardware failure.
I would DEFINITELY call Dell even though you are not certain of the warranty.
![]() |
Similar Threads
- Helping yourself: What to do before starting a new thread or posting a HiJackThis log (Viruses, Spyware and other Nasties)
- Help with HiJackThis log, please (Viruses, Spyware and other Nasties)
- problems with MSIESH.DLL (Viruses, Spyware and other Nasties)
- Another hijackthis log (Viruses, Spyware and other Nasties)
- hijackthis log (Viruses, Spyware and other Nasties)
- Stu's Hijackthis log file. (Viruses, Spyware and other Nasties)
- Bridge.dll error please help me here is my hijackthis log file! (Viruses, Spyware and other Nasties)
- Hijackthis log file (Viruses, Spyware and other Nasties)
- HijackThis log file (Viruses, Spyware and other Nasties)
Other Threads in the Viruses, Spyware and other Nasties Forum
- Previous Thread: Retrieval Operations...
- Next Thread: win32 cutwail removal
| Thread Tools | Search this Thread |
adware anti-malware anti-virussitesaccessissue antivirus attack audio avg backtoschoolspeech bar blackhat botnet botnets censorship china commercial commercials conficker connect control crosssitescripting cyber cybercrime cyberwarfare ddos domains e-mafia education email europe exam exploit facebook fake fancheckvirus gaming gumblar halloween herss.exe hijack hosting internet kaspersky legal logfiles mail malware mcafee mega-d messagelabs microsoft mobile nazi news obama onlinethreats paedophile panel parents patch phishing police policeprovirusmba-mblockedinternetaccess president privacy pro problem redirect redirecting reliability report research risk rogueantivirus samhain sans scareware school search security seopoisoning software spam spyware spywareexternalwindows7adminstratortrojans sqlinjection symantec trojan unwanted update usa virus viruses vista volume war warning windows worm yahoo zeroday






