Random BSODs

[Tim696969]

I get the blue screen more often now. Here is a minidump file:

 

[TrainableMan]

Please see all the posts >>HERE<< for how to get BSOD help and how to zip and attach your DMP files.

 

[Tim696969]

File uploading dmp files

I tried to upload a file and it was 1.29 MB and the limit is 1.19. That was just 1 file. I have more.

 

[TrainableMan]

Just zip the more recent 8 to 10 DMP files so that the zip is smaller.

 

[Tim696969]

Uploaded files

I uploaded 3 zip files. I hope that is enough files. Thanks!

 

[TrainableMan]

Well I'm not a BSOD expert and nothing is flagged as the problem except the kernal (which is just a catch all). I can see you have had trouble for quite some time and I also notice almost all the drivers on your computer are very old.

First you should rule out a virus by running a scan in safe mode as explained HERE.

If you provided computer information as explained in the how to get help thread then I could likely point you to where to get drivers but since I have no information to go on all I can suggest is that you visit your computer manufacturer's website to download & install all the latest drivers plus a BIOS update if one is available.

Unless your hardware is failing the things above are the most likely causes of BSODs.

You could also try other forums that may have more active/knowledgeable BSOD experts.

 

[Tim696969]

I downloaded Malwarebytes and it found a threat C:\Windows\svchost.exe trojan agent. I showed results and listed 2 files. I clicked on remove and then I restarted my laptop. Now It keeps sending a message in the lower right corner that it has blocked and quarantined a threat: C:\Windows\svchost.exe Trpjan Agent every 2 seconds. What do I do now?

 

[TrainableMan]

Did you run in safe mode after RKill & TDSSKiller as explained in the link?

There is a real svchost.exe which apparently has been replaced. You will need to get rid of the virus and repair the OS.

 

[Tim696969]

I did run mawarebytes in safe mode and today it is not giving me that message anymore. When I tried to run TDSSkiller yesterday, it asked what application do you want to open it in. There was a bunch of choices, I tried a couple of them and got no where. So running TDSSkiller and Rkill will get rid of the virus? If yes, what do I do to repair the OS?

 

[TrainableMan]

TDSSKiller is an executable. It does not use any other program to run. It is designed to remove rootkits.

To check the OS, open a command prompt (under Accessories) with administrative privileges (right-click and choose run as an Administrator). When the window opens type sfc /scannow.

I would also recommend you run the safe-mode scan explained above every 3 to 7 days (depending how much you use your computer) for a few weeks just to make sure it is gone for good.

So have the BSODs stopped?

 

[Tim696969]

So there are no free TDSSKiller on the intenet to download? Are there companies that have the same execuable for free? I checked the OS and there were no integrity violations. I did have a blue screen yesterday.

 

[TrainableMan]

It is free. Just click the link on the Kaspersky page to download it.


Or try this direct link: TDSSKiller.

 

[Tim696969]

Thanks for that 2nd link to TDSSKiller. It found the virus, I curred it and rebooted. Then I ran it again and found no viruses. Thank you so much!!

 

[TrainableMan]

You should run RKill & your anti-virus in safe mode again, too.

 

[Tim696969]

I ran malwarebytes scan in safe mode today and it still found the same svchost.exe virus. I restarted and that repeating message does not keep showing up that it quarntined the virus. So TDSSkiller did not remove this like I had thought, it just removed other viruses. Any other ideas to remove svchost.exe? Should have TDSSkiller been able to detect svchost.exe?

 

[TrainableMan]

The real svchost.exe is a vital part of the OS, that is why a virus might use that name. And there are many different types of viruses, the worst being rootkits because they slip in as part of the OS and embed themselves extremely well. Once imbedded the best designed of them then hide themselves from detection and could be why Malwarebytes cannot see it.

TDSSKiller is designed to do its best to remove the rootkits but there are new viruses invented every day. Nobody can guarantee they remove every virus. That is why it is best to use a combination of tools: booting in safe mode keeps many services from being loaded, so with luck the compromised service doesn't start up. When a service or program is running it is "In Use" and much harder to remove because it must first be stopped. TDSSKiller is designed to find those bad services and remove them so they don't start. RKill is designed to stop any actively running programs that are often used to mask (hide) or restart the virus programs. And then anti-virus software can hopefully remove the programs.

Many businesses charge lots of money to remove viruses because they can be very complicated and quite persistent; it may be something you need to consider if it constantly returns.

Often the best course of action is to back up all your data to an external hard drive and then disconnect it. Then format your computer and completely reinstall windows 7 and all your software including a good anti-virus program, reconnect the external hard drive, and completely scan your back-up for viruses. Finally restore your data. It is often after this time-consuming process that victims realize they should have been backing up their data regularly.

So what I am suggesting is that you boot to safe mode, run TDSSKiller, run RKill, and run Malwarebytes (or another A/V), then boot up to an original W7 OS disk and do a repair install. Next back up all your data to an external hard drive. And if the virus continues to come back you may need to format and reinstall the OS and software or have it looked at by a professional and pay them to do it.

 

[Tim696969]

I have not seen a blue screen since I ran TDSSKiller, at least so far. So the SVCHost.exe is the cause of my blue sceens, correct?

 

[TrainableMan]

The fake one may have been but you do need a real one. The problem is that the best written viruses are not just a single program; they work in groups to restore each other and regain control, sometimes on the next reboot. Hopefully you are all better now but as I said, it is best you continue to scan from safe mode every few days.

Also, I do recommend you boot to a W7 DVD and run the Installation repair; it should replace any damaged system files.

 

[Tim696969]

malwarebytes

I ran the quick scan on malwarebytes in safe mode today and it found no viruses, not even svchost.exe. This is a better result than the last time I ran malwarebytes where it found svchost.exe. Maybe it finally is gone. I have not gotton a windows 7 DVD yet. I suppose I still should do this.