Member Avatar for dadelson

Hi,
I connect to the internet at home via a modem. When i log in to my account (UCLA is my ISP), the screen immediately goes blue with a messsage saying the system is doing a memory dump. I don't have the exact error msg with me (for which i apologize). I read a number of tech support threads for similar behavior, installed Ewido, CWShredder, Kerio Personal Firewall, and ran several anti-spyware programs, all in Safe Mode. All to no avail, although i did clean out a whole lot of spyware, trojan horses, etc. But something is still persisting. From everything i've read, it seems to be something related to Sasser, but i can't tell what.

btw, I still run an old, unpatched version of XP Service Pack 1 because my connection is so slow that i never downloaded the upgrades...i don't want to try to install the updates until this problem is resolved (well, i can't really, because i still can't reach the internet)...

I ran HijackThis and created the following log...any help in troubleshooting this would be deeply appreciated, as it's crippling not being able to reach the net...

Logfile of HijackThis v1.99.1
Scan saved at 11:36:03 AM, on 9/15/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\cisvc.exe
C:\WINDOWS\System32\CTsvcCDA.exe
C:\Program Files\Kerio\Personal Firewall 4\kpf4ss.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\Program Files\Kerio\Personal Firewall 4\kpf4gui.exe
C:\WINDOWS\system32\cidaemon.exe
C:\WINDOWS\system32\cidaemon.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Kerio\Personal Firewall 4\kpf4gui.exe
C:\WINDOWS\System32\DSentry.exe
C:\Program Files\Creative\SBAudigy2\Surround Mixer\CTSysVol.exe
C:\WINDOWS\System32\CTHELPER.EXE
C:\Program Files\Creative\SBAudigy2\DVDAudio\CTDVDDet.EXE
C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\WINDOWS\System32\RUNDLL32.exe
C:\Program Files\iRiver\iRiver Manager\Updater\Updater.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Java\jre1.5.0_01\bin\jusched.exe
C:\Program Files\Logitech\iTouch\iTouch.exe
C:\Program Files\Logitech\MouseWare\system\em_exec.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
C:\PROGRA~1\SIMPLE~1\PHOTOS~1\data\xtras\mssysmgr.exe
C:\Program Files\mozilla.org\Mozilla\Mozilla.exe
C:\WINDOWS\System32\196_150_ni.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\Program Files\Microsoft Office\Office\OSA.EXE
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {7A1693A1-AFAF-4F1E-9B05-EEC38A85FBF3} - C:\WINDOWS\SYSTEM32\gcw.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [DwlClient] C:\Program Files\Common Files\Dell\EUSW\Support.exe
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [DVDSentry] C:\WINDOWS\System32\DSentry.exe
O4 - HKLM\..\Run: [CTSysVol] C:\Program Files\Creative\SBAudigy2\Surround Mixer\CTSysVol.exe
O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE
O4 - HKLM\..\Run: [CTDVDDet] C:\Program Files\Creative\SBAudigy2\DVDAudio\CTDVDDet.EXE
O4 - HKLM\..\Run: [AsioReg] REGSVR32.EXE /S CTASIO.DLL
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [WildTangent CDA] RUNDLL32.exe "C:\Program Files\WildTangent\Apps\CDA\cdaEngine0400.dll",cdaEngineMain
O4 - HKLM\..\Run: [iRiver Updater] C:\Program Files\iRiver\iRiver Manager\Updater\Updater.exe
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_01\bin\jusched.exe
O4 - HKLM\..\Run: [zBrowser Launcher] C:\Program Files\Logitech\iTouch\iTouch.exe
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [0XQPA7] "C:\WINDOWS\System32\ld.exe" /PC=CP.ANT2 /PC=CP.ANT2 /PC=CP.ANT2 /PC=CP.ANT2 /PC=CP.ANT2 /PC=CP.ANT2 /PC=CP.ANT2 /PC=CP.ANT2 /PC=CP.ANT2 /PC=CP.ANT2 /PC=CP.ANT2 /PC=CP.ANT2 /PC=CP.ANT2 /PC=CP.ANT2 /PC=CP.ANT2 /PC=CP.ANT2 /PC=CP.ANT2 C:\WINDOWS\System32\196_150_ni.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKCU\..\Run: [SB Audigy 2 Startup Menu] /L:ENG
O4 - HKCU\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet
O4 - HKCU\..\Run: [PhotoShow Deluxe Media Manager] C:\PROGRA~1\SIMPLE~1\PHOTOS~1\data\xtras\mssysmgr.exe
O4 - HKCU\..\Run: [Mozilla Quick Launch] "C:\Program Files\mozilla.org\Mozilla\Mozilla.exe" -turbo
O4 - HKCU\..\Run: [mshtmled] C:\WINDOWS\System32\mshtmled.exe
O4 - HKCU\..\Run: [196_150_ni] C:\WINDOWS\System32\196_150_ni.exe
O4 - Startup: Microsoft Find Fast.lnk = C:\Program Files\Microsoft Office\Office\FINDFAST.EXE
O4 - Startup: Office Startup.lnk = C:\Program Files\Microsoft Office\Office\OSA.EXE
O4 - Global Startup: Digital Line Detect.lnk = ?
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_01\bin\npjpi150_01.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_01\bin\npjpi150_01.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\Yahoo!\MESSEN~1\YPager.exe
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\Yahoo!\MESSEN~1\YPager.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Kerio Personal Firewall 4 (KPF4) - Kerio Technologies - C:\Program Files\Kerio\Personal Firewall 4\kpf4ss.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\NCS\Sync\NetSvc.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe

  • 2 Contributors
  • 2 Replies
  • 306 Views
  • 6 Hours Discussion Span
  • Latest Post Latest Post by dadelson

Dani AI

Generated

A compact troubleshooting roadmap for a blue-screen that appears immediately after the Internet connection comes up. has already run anti-spyware scans and added a personal firewall, which are good first steps. is also correct that faulty drivers or hardware can cause BSODs. Given the "crash-on-network-connect" pattern, priority should be: (1) capture the exact STOP code/minidump, (2) perform offline scanning and patching from a clean machine, and (3) run a few hardware/consistency checks before wide changes.

Disable automatic restart so the STOP code and the faulting module can be read (My Computer -> Properties -> Advanced -> Startup and Recovery -> Settings -> uncheck "Automatically restart"). Enable or check for small memory dumps in %SystemRoot%\Minidump and copy any dump files to a second, clean computer for analysis (BlueScreenView or WinDbg). If the dump points at lsass.exe or a network-driver module, that steers diagnosis toward either a network-targeting worm or a driver stack conflict.

Suggested offline workflow (use a second PC to download tools/updates, transfer via CD/USB): boot the affected machine to Safe Mode (preferably without networking), run up-to-date offline AV/anti-malware scanners or a bootable rescue disk, disable nonessential startup items (msconfig), and check disk and system files. Useful commands to run from a clean command prompt:

msconfig
chkdsk C: /f
sfc /scannow   (requires Windows XP CD)

Also run a memory test (Memtest86+) from a boot CD/USB to rule out bad RAM.

If a Sasser-like infection is suspected, apply the relevant Microsoft security updates (use the clean machine to download installers) before reconnecting. If cleaning fails or instability persists, back up user data (scan backups on another PC) and consider a clean install. Collecting the exact STOP code and the minidump's faulting module is the single most useful piece of information for narrowing the root cause.

Recommended Answers

All 2 Replies

Member Avatar for nanosani

Blue screen errors are usually due to faulty hardware .. or incompatible device drivers ... tell us exactly what the error was .. and what was the error code. And also some specs about your modem .. and the driver installed.

Member Avatar for dadelson

Blue screen errors are usually due to faulty hardware .. or incompatible device drivers ... tell us exactly what the error was .. and what was the error code. And also some specs about your modem .. and the driver installed.

I have been using this modem to connect to this service for about 4 years without problems. I don't recall installing any new drivers recently, but can check. It's my machine at home...i'll copy down the msg and post it by tomorrow.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.