# Solved: Computer keeps crashing. Help



## marc5180 (Sep 7, 2007)

Hi all,
Iv been having a few problems over the past few weeks with my computer just suddenly
switching itself off and then restarting saying " your computer has recovered from a serious error
caused by hardware failure" or something along them lines.iv run all the antivirus and adware progs that
i have and they dont find anything. Over the past few days it has gotten worse and crashes frequently Im running XP
service pack 2 with amd athalon 64 3700+ processor. Below is the last error message that i received about ten mins ago
when it crashed

BCCode : 1000008e BCP1 : C0000005 BCP2 : 805373C2 BCP3 : B7C6BC98
BCP4 : 00000000 OSVer : 5_1_2600 SP : 2_0 Product : 256_1

Error report contents

C:\DOCUME~1\marc1\LOCALS~1\Temp\WER1092.dir00\Mini090607-07.dmp
C:\DOCUME~1\marc1\LOCALS~1\Temp\WER1092.dir00\sysdata.xml


Also in Event viewer, in system i have a few error codes with them ranging from system error category (102) event 1003.
To an error with plug play manager. For 102 code i have found that it means....The semaphore is set and cannot be closed. Id post the event viewer page but i dont know how to copy it because copy and paste (ctrl + C )doesnt work on the page. Does anyone know how i can copy the event viewer page and post it here??

Iv checked under device manager for any hadware issues and there doesnt seem to be anything?????
I also disabled automatic restart, so when the computer shut down suddenly again a blue screen came up with the message
stop 0x0000008E 0xC0000005, 0x805373c2, 0xB7C6BC98, 0x00000000.

Im at my wits end and dont know what to do. Any help would be appreciated
Marc


----------



## marc5180 (Sep 7, 2007)

Can anyone help?


----------



## devil_himself (Apr 7, 2007)

Navigate to C:\windows\Minidump
Zip Some of the Recent Minidumps and Attach Them here


----------



## marc5180 (Sep 7, 2007)

Iv attatched the minindump as requested. Also my computer is shutting down more frequently now, every half an hour sometimes sooner. I opened up the case last night and cleaned everything, so theres no dust inside.


----------



## Frank4d (Sep 10, 2006)

You have a system file "vdo_65aa-7e21.sys" that is causing the problem. It is probably a rootkit which is a type of malware infection.

You can click the red triangle in your post and request this to be moved to the Malware Removal forum, or wait for a malware removal expert to come along here.


----------



## devil_himself (Apr 7, 2007)

Do you have Your XP Disc .. So that You can install the Microsoft Support Tools


----------



## devil_himself (Apr 7, 2007)

Here is the 'Dumpchk' Report 

C:\Program Files\Support Tools>dumpchk.exe d:\Mini071407-01.dmp
Loading dump file d:\Mini071407-01.dmp
----- 32 bit Kernel Mini Dump Analysis

DUMP_HEADER32:
MajorVersion 0000000f
MinorVersion 00000a28
DirectoryTableBase 14030080
PfnDataBase 810a6000
PsLoadedModuleList 805535a0
PsActiveProcessHead 805596b8
MachineImageType 0000014c
NumberProcessors 00000001
BugCheckCode 10000050
BugCheckParameter1 e2d98000
BugCheckParameter2 00000000
BugCheckParameter3 805372bf
BugCheckParameter4 00000001
PaeEnabled 00000001
KdDebuggerDataBlock 805450e0
MiniDumpFields 00000dff

TRIAGE_DUMP32:
ServicePackBuild 00000200
SizeOfDump 00010000
ValidOffset 0000fffc
ContextOffset 00000320
ExceptionOffset 000007d0
MmOffset 00001068
UnloadedDriversOffset 000010a0
PrcbOffset 00001878
ProcessOffset 000024c8
ThreadOffset 00002728
CallStackOffset 00002980
SizeOfCallStack 00000708
DriverListOffset 00003318
DriverCount 0000007c
StringPoolOffset 000057e8
StringPoolSize 00001118
BrokenDriverOffset 00000000
TriageOptions 00000041
TopOfStack b59e98f8
DebuggerDataOffset 00003088
DebuggerDataSize 00000290
DataBlocksOffset 00006900
DataBlocksCount 00000001


Windows XP Kernel Version 2600 (Service Pack 2) UP Free x86 compatible
Kernel base = 0x804d7000 PsLoadedModuleList = 0x805535a0
Debug session time: Sat Jul 14 19:15:53 2007
System Uptime: 1 days 19:43:35
start end module name
804d7000 806cdc80 nt Checksum: 001FFC7C Timestamp: Wed Feb 28 14:
45:53 2007 (45E54849)

Unloaded modules:
b17e9000 b1814000 kmixer.sys Timestamp: unavailable (00000000)
b17e9000 b1814000 kmixer.sys Timestamp: unavailable (00000000)
b17e9000 b1814000 kmixer.sys Timestamp: unavailable (00000000)
b17e9000 b1814000 kmixer.sys Timestamp: unavailable (00000000)
b17e9000 b1814000 kmixer.sys Timestamp: unavailable (00000000)
b17e9000 b1814000 kmixer.sys Timestamp: unavailable (00000000)
b17e9000 b1814000 kmixer.sys Timestamp: unavailable (00000000)
b17e9000 b1814000 kmixer.sys Timestamp: unavailable (00000000)
b17e9000 b1814000 kmixer.sys Timestamp: unavailable (00000000)
b17e9000 b1814000 kmixer.sys Timestamp: unavailable (00000000)
b17e9000 b1814000 kmixer.sys Timestamp: unavailable (00000000)
b17e9000 b1814000 kmixer.sys Timestamp: unavailable (00000000)
b17e9000 b1814000 kmixer.sys Timestamp: unavailable (00000000)
b17e9000 b1814000 kmixer.sys Timestamp: unavailable (00000000)
b17e9000 b1814000 kmixer.sys Timestamp: unavailable (00000000)
b17e9000 b1814000 kmixer.sys Timestamp: unavailable (00000000)
b17e9000 b1814000 kmixer.sys Timestamp: unavailable (00000000)
b17e9000 b1814000 kmixer.sys Timestamp: unavailable (00000000)
b17e9000 b1814000 kmixer.sys Timestamp: unavailable (00000000)
b17e9000 b1814000 kmixer.sys Timestamp: unavailable (00000000)
b37e9000 b3814000 kmixer.sys Timestamp: unavailable (00000000)
b38b4000 b38df000 kmixer.sys Timestamp: unavailable (00000000)
b58df000 b590a000 kmixer.sys Timestamp: unavailable (00000000)
b7e7e000 b7ea9000 kmixer.sys Timestamp: unavailable (00000000)
b7e7e000 b7ea9000 kmixer.sys Timestamp: unavailable (00000000)
b7e7e000 b7ea9000 kmixer.sys Timestamp: unavailable (00000000)
b7e7e000 b7ea9000 kmixer.sys Timestamp: unavailable (00000000)
b7e7e000 b7ea9000 kmixer.sys Timestamp: unavailable (00000000)
b7e7e000 b7ea9000 kmixer.sys Timestamp: unavailable (00000000)
b7f49000 b7f74000 kmixer.sys Timestamp: unavailable (00000000)
b7f49000 b7f74000 kmixer.sys Timestamp: unavailable (00000000)
b891e000 b8949000 kmixer.sys Timestamp: unavailable (00000000)
f7a89000 f7a8a000 drmkaud.sys Timestamp: unavailable (00000000)
b8bc8000 b8bd5000 DMusic.sys Timestamp: unavailable (00000000)
b8bd8000 b8be6000 swmidi.sys Timestamp: unavailable (00000000)
b8971000 b8994000 aec.sys Timestamp: unavailable (00000000)
f7a36000 f7a38000 splitter.sys Timestamp: unavailable (00000000)
f70df000 f70e3000 kbdhid.sys Timestamp: unavailable (00000000)
f7898000 f789d000 Cdaudio.SYS Timestamp: unavailable (00000000)
f70e7000 f70ea000 Sfloppy.SYS Timestamp: unavailable (00000000)
f75e0000 f75ed000 i8042prt.sys Timestamp: unavailable (00000000)

Finished dump check


----------



## marc5180 (Sep 7, 2007)

devil_himself said:


> Do you have Your XP Disc .. So that You can install the Microsoft Support Tools


Hi yes i think i do. What should i do with it?


----------



## Frank4d (Sep 10, 2006)

You gave a malware infection and should do nothing more until a Malware Removal expert helps you.


----------



## devil_himself (Apr 7, 2007)

Frank4d said:


> You gave a malware infection and should do nothing more until a Malware Removal expert helps you.


Ok.. First Let a 'Malware Expert' Comment on this .. Post a 'HijackThis' Log


----------



## marc5180 (Sep 7, 2007)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 16:29:25, on 08/09/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16512)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
C:\Program Files\Common Files\BitDefender\BitDefender Communicator\xcommsvr.exe
C:\Program Files\Common Files\BitDefender\BitDefender Update Service\livesrv.exe
C:\Program Files\BitDefender\BitDefender 2008\vsserv.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Nokia\Nokia Software Launcher\NSLauncher.exe
C:\Program Files\BitDefender\BitDefender 2008\bdagent.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
C:\Program Files\Interwise\Participant\pull.exe
C:\Program Files\Common Files\PCSuite\Services\ServiceLayer.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\WinRAR\WinRAR.exe
C:\DOCUME~1\marc1\LOCALS~1\Temp\Rar$EX00.359\HijackThis.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O3 - Toolbar: BitDefender Toolbar - {381FFDE8-2394-4f90-B10D-FC6124A40F8C} - C:\Program Files\BitDefender\BitDefender 2008\IEToolbar.dll
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe"
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [PCPitstop Optimize Registration Reminder] C:\Program Files\PCPitstop\Optimize\Reminder.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [NSLauncher] C:\Program Files\Nokia\Nokia Software Launcher\NSLauncher.exe /startup
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [CloneCDTray] "C:\Program Files\SlySoft\CloneCD\CloneCDTray.exe" /s
O4 - HKLM\..\Run: [PC Pitstop Optimize Scheduler] C:\Program Files\PCPitstop\Optimize\PCPOptimize.exe -boot
O4 - HKLM\..\Run: [BDAgent] "C:\Program Files\BitDefender\BitDefender 2008\bdagent.exe"
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [Push Client] C:\Program Files\Interwise\Participant\pull.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\npjpi160_01.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\npjpi160_01.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{71FBB986-05DF-4F39-8AC1-0FB03765BDC8}: NameServer = 85.255.116.124,85.255.112.99
O17 - HKLM\System\CCS\Services\Tcpip\..\{DF366C30-AD13-4428-8C48-C82485E13274}: NameServer = 85.255.116.124,85.255.112.99
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 208.67.220.220,208.67.222.222 
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: NameServer = 208.67.220.220,208.67.222.222 
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 208.67.220.220,208.67.222.222 
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: BitDefender Desktop Update Service (LIVESRV) - BitDefender S.R.L. - C:\Program Files\Common Files\BitDefender\BitDefender Update Service\livesrv.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\Common Files\PCSuite\Services\ServiceLayer.exe
O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
O23 - Service: BitDefender Virus Shield (VSSERV) - BitDefender S.R.L. - C:\Program Files\BitDefender\BitDefender 2008\vsserv.exe
O23 - Service: BitDefender Communicator (XCOMM) - Softwin - C:\Program Files\Common Files\BitDefender\BitDefender Communicator\xcommsvr.exe

--
End of file - 6742 bytes


----------



## cybertech (Apr 16, 2002)

*Please print these instructions for reference, as you will have to restart your computer during the fix.*

Please download FixWareout from *Here* or *Here*.

*Note: You will need to run this tool while having an Internet Connection. The tool will download other files while running.*

Save it to your desktop and run it. Click Next, then Install, make sure "Run fixit" is checked and click Finish.
The fix will begin; follow the prompts.
If your firewall gives an alert, (because this tool will download an additional files from the internet), please don't let your firewall block it, but allow it instead.
You will be asked to reboot your computer; please do so. Your system may take longer than usual to load; this is normal.
Once the desktop loads a text file will open (report.txt).
Please post the C:\fixwareout\*report.txt* ), along with a new HijackThis log into this topic.


----------



## marc5180 (Sep 7, 2007)

Problem solver, i had malware so i used GMER which found 4 root kits. I downloaded AVGs root removal tool which succesfully deleted it. ALL seems to be ok now
Thanks for all your help guys:up:


----------

