BlueScreen

[losingmymind]

Hi,

I am having trouble with my laptop it's a toshiba a100 32 bit with vista home premium.

I don't know much about computers and am generally pretty chilled out when it comes to resolving issues with them but this is REALLY making me lose my cool.

About a month ago my computer started crashing regularly and eventually i couldn't even log on after the welcome screen. it just sat there spinning and would eventually freeze.

After reading a few forums i found a post which said to do a system recovery but i don't have a disk and then i found something that said i need to make a disk but can't for the life of me fugure out how to do that.


i tried 'last known good configuration' and finally passed the welcome screen to find that i had a fake security centre virus. I installed Norton 360 and it got rid of the virus but the computer still crashes regularly.

I also ran a memory diagnostic and that was okay.

I checked details in the event viewer and the only critical one was:

Log name: System
Source: Kernel-Power Logged: 8/08/2009 2:35:10 PM
Event ID: 41 Task Category: None
Level: Critical Keywords: (2)
User: SYSTEM Computer: home-PC
Op-Code: Info

(i don't know what that is)

there are a whole heap of errors aswell.

I tried to look at the minidump files but it says windows can't open them.

i logged on in safe mode and backed up all of my important files on my portable hard drive so everything else can pretty much go.

At the moment it's just sitting there and i can't click on the start menu or anything.

I'd really appreciate any help that you can give me.

 

[alexdagr8est]

are you looking to completely wipe your system and start again or do you want some help in getting rid of that virus? btw dont do any online shopping while you have this problem (i guarantee you the virus is still there just waiting to grab your credit card info)

 

[Frostmourne]

Those backed up files might have the virus so scan them if you transfer them to another pc. Post the .dmp files so they can be analyzed. Otherwise download malwarebytes and superantispyware, update them if you can and scan your pc. If anything comes up, scan again. Then run an online scanner such as F-Secure, followed by Norton 360 again. Lastly download Sophos Anti Rootkit and scan for any last remnants.

 

[losingmymind]

well, i think the virus is gone because i can't see the icon in the task bar anymore.

I'm happy to just completely wipe everything as am sick of stuffing around trying to figure out what's wrong.

will try to get the files uploaded now.

 

[losingmymind]

tried to attatch files but said .dmp were invalid how do i post them?

 

[Ardneh]

Attach as .zip

Use 7zip if you don't have a zip utility.

http://www.7-zip.org/download.html

 

[losingmymind]

:D oh yeah. haha

please find attatched

 

[losingmymind]

i also saw at the last crash that it said:

DRIVER_POWER_STATE_FAILURE

it hasn't said that before

 

[losingmymind]

did the .dmp files help?

 

[Frostmourne]

Shame someone hasn't analysed the .dmp files quickly. Here is the last .dmp you uploaded:

1: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
APC_INDEX_MISMATCH (1)
This is a kernel internal error. The most common reason to see this
bugcheck is when a filesystem or a driver has a mismatched number of
calls to disable and re-enable APCs. The key data item is the
Thread->KernelApcDisable field. A negative value indicates that a driver
has disabled APC calls without re-enabling them. A positive value indicates
that the reverse is true. This check is made on exit from a system call.
Arguments:
Arg1: 81e20a94, address of system function (system call)
Arg2: 00000000, Thread->ApcStateIndex << 8 | Previous ApcStateIndex
Arg3: 0000ffff, Thread->KernelApcDisable
Arg4: 00000000, Previous KernelApcDisable
Debugging Details:
------------------

FAULTING_IP:
nt!NtDeviceIoControlFile+0
81e20a94 8bff mov edi,edi
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
BUGCHECK_STR: 0x1
PROCESS_NAME: ccSvcHst.exe
CURRENT_IRQL: 0
LAST_CONTROL_TRANSFER: from 77410f34 to 81c46567
STACK_TEXT:
a5fd0d64 77410f34 badb0d00 01c2f698 00000000 nt!KiServiceExit2+0x16e
WARNING: Frame IP not in any known module. Following frames may be wrong.
01c2f6f0 00000000 00000000 00000000 00000000 0x77410f34

STACK_COMMAND: .bugcheck ; kb
FOLLOWUP_IP:
nt!NtDeviceIoControlFile+0
81e20a94 8bff mov edi,edi
SYMBOL_NAME: nt!NtDeviceIoControlFile+0
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 4549ad6c
FAILURE_BUCKET_ID: 0x1_nt!NtDeviceIoControlFile+0
BUCKET_ID: 0x1_nt!NtDeviceIoControlFile+0
Followup: MachineOwner
---------

It seems as if drivers are causing your problem. Open up device manager, check for any exclamation points. Then update your sound, audio, wireless drivers, and if possible, the motherboard drivers. PM me if you have further questions.

 

[usasma]

Sorry for not being here sooner, but I've got eye problems that keep me away from the boards at times.

There are a lot of dump files missing from the uploads. Please left click on the first dump file in the folder, then hold down Shift and left click on the last file in the folder. Then zip them all up at once and upload that .zip file with your next post (so we can get a clearer picture of what's happening here).

I've downloaded the files dated below:
080609xxx
080709xxx
080809xxx
081109xxx

And will run the analysis on them next. Information from the header of the analysis is often just as important as the !analyze -v stuff.

 

[usasma]

Looking at the headers of your dump files it seems that the system is extremely out of date:

Windows Vista Kernel Version 6000 MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 6000.16754.x86fre.vista_gdr.080917-1612

-I would strongly suggest that you visit the support website of the PC manufacturer and update all of your drivers.
-Then, update any system protection (antivirus) programs, any disk creating/burning programs, and any other programs that use drivers to access the system.
-Once that is done, then update Windows to Service Pack 1 (at a minimum) - an update to Service Pack 2 is preferred.

The lack of updates is likely to be the cause of your issues, and it may have been made worse by an infection. If the memory dumps continue after the system has been updated - post back and we'll work on them.

The system doesn't have Service Pack 1 or 2 installed.
Listing of older drivers (with date stamps) follows. The Windows stuff will be taken care of by Windows Update, the rest will need to be updated manually from the driver manufacturer's website (NOT through the update drivers function in Device Manager):

win32k.sys                                
TSDDD.dll                                
cdd.dll                                
WmXlCore.sys        4/12/2005 10:21:25 PM                        
WmBEnum.sys        4/12/2005 10:21:27 PM                        
tosrfcom.sys        8/1/2005 3:45:06 AM                        
tifm21.sys        7/6/2006 2:23:30 PM                        
e1e6032.sys        8/21/2006 12:20:47 PM                        
AGRSM.sys        8/30/2006 2:52:55 PM                        
secdrv.SYS        9/13/2006 9:18:32 AM                        
TVALZ_O.SYS        10/5/2006 9:22:13 AM                        
tosporte.sys        10/10/2006 6:33:20 AM                        
tdcmdpst.sys        10/17/2006 10:50:02 PM                        
tosrfec.sys        10/23/2006 3:32:19 AM                        
peauth.sys        10/23/2006 4:55:32 AM                        
spldr.sys        10/25/2006 6:40:44 PM                        
spsys.sys        10/25/2006 6:43:28 PM                        
tcusb.sys        10/28/2006 12:25:50 AM                        
hal.dll        11/2/2006 4:30:18 AM                        
intelppm.sys        11/2/2006 4:30:18 AM                        
cdfs.sys        11/2/2006 4:30:50 AM                        
Msfs.SYS        11/2/2006 4:30:56 AM                        
Npfs.SYS        11/2/2006 4:30:57 AM                        
fltmgr.sys        11/2/2006 4:30:58 AM                        
mup.sys        11/2/2006 4:31:04 AM                        
dfsc.sys        11/2/2006 4:31:04 AM                        
bowser.sys        11/2/2006 4:31:11 AM                        
rdbss.sys        11/2/2006 4:31:24 AM                        
msisadrv.sys        11/2/2006 4:35:08 AM                        
pci.sys        11/2/2006 4:35:13 AM                        
pcmcia.sys        11/2/2006 4:35:13 AM                        
mssmbios.sys        11/2/2006 4:35:13 AM                        
fileinfo.sys        11/2/2006 4:36:47 AM                        
watchdog.sys        11/2/2006 4:37:44 AM                        
Dxapi.sys        11/2/2006 4:38:17 AM                        
ksecdd.sys        11/2/2006 4:43:45 AM                        
msrpc.sys        11/2/2006 4:50:16 AM                        
Beep.SYS        11/2/2006 4:51:03 AM                        
Null.SYS        11/2/2006 4:51:05 AM                        
mountmgr.sys        11/2/2006 4:51:06 AM                        
swenum.sys        11/2/2006 4:51:15 AM                        
ks.sys        11/2/2006 4:51:18 AM                        
CLASSPNP.SYS        11/2/2006 4:51:34 AM                        
dump_dumpata.sys        11/2/2006 4:51:34 AM                        
crashdmp.sys        11/2/2006 4:51:36 AM                        
disk.sys        11/2/2006 4:51:40 AM                        
volmgr.sys        11/2/2006 4:51:44 AM                        
cdrom.sys        11/2/2006 4:51:44 AM                        
storport.sys        11/2/2006 4:51:45 AM                        
partmgr.sys        11/2/2006 4:51:47 AM                        
volmgrx.sys        11/2/2006 4:51:54 AM                        
crcdisk.sys        11/2/2006 4:52:27 AM                        
msiscsi.sys        11/2/2006 4:52:40 AM                        
ecache.sys        11/2/2006 4:52:42 AM                        
vga.sys        11/2/2006 4:53:56 AM                        
VIDEOPRT.SYS        11/2/2006 4:54:07 AM                        
WMILIB.SYS        11/2/2006 4:54:53 AM                        
HIDPARSE.SYS        11/2/2006 4:55:00 AM                        
portcls.sys        11/2/2006 4:55:02 AM                        
1394BUS.SYS        11/2/2006 4:55:12 AM                        
ohci1394.sys        11/2/2006 4:55:16 AM                        
umbus.sys        11/2/2006 4:55:24 AM                        
lltdio.sys        11/2/2006 4:56:48 AM                        
rspndr.sys        11/2/2006 4:56:48 AM                        
HTTP.sys        11/2/2006 4:57:06 AM                        
smb.sys        11/2/2006 4:57:10 AM                        
netbt.sys        11/2/2006 4:57:18 AM                        
ndisuio.sys        11/2/2006 4:57:22 AM                        
fwpkclnt.sys        11/2/2006 4:57:26 AM                        
netbios.sys        11/2/2006 4:57:26 AM                        
nsiproxy.sys        11/2/2006 4:57:30 AM                        
ndis.sys        11/2/2006 4:57:33 AM                        
tdx.sys        11/2/2006 4:57:34 AM                        
tcpipreg.sys        11/2/2006 4:57:46 AM                        
raspppoe.sys        11/2/2006 4:58:12 AM                        
rasl2tp.sys        11/2/2006 4:58:13 AM                        
ndiswan.sys        11/2/2006 4:58:13 AM                        
rasacd.sys        11/2/2006 4:58:13 AM                        
raspptp.sys        11/2/2006 4:58:14 AM                        
ws2ifsl.sys        11/2/2006 4:58:26 AM                        
afd.sys        11/2/2006 4:58:41 AM                        
TDI.SYS        11/2/2006 4:58:46 AM                        
modem.sys        11/2/2006 4:58:52 AM                        
termdd.sys        11/2/2006 5:02:00 AM                        
RDPCDD.sys        11/2/2006 5:02:01 AM                        
rdpencdd.sys        11/2/2006 5:02:01 AM                        
drmk.sys        11/2/2006 5:20:49 AM                        
BOOTVID.dll        11/2/2006 5:39:29 AM                        
kdcom.dll        11/2/2006 5:42:20 AM                        
PSHED.dll        11/2/2006 5:42:51 AM                        
igdkmd32.sys        11/6/2006 2:29:12 PM                        
RTKVHDA.sys        11/17/2006 5:06:26 AM                        
FwLnk.sys        11/19/2006 10:11:12 AM                        
HDAudBus.sys        3/24/2007 2:54:34 PM                        
Fs_Rec.SYS        4/16/2007 9:26:39 PM                        
mcupdate_GenuineIntel.dll        4/23/2007 11:40:05 PM                        
sdbus.sys        4/27/2007 10:15:33 PM                        
mpsdrv.sys        6/6/2007 10:55:55 PM                        
tunmp.sys        6/6/2007 10:56:53 PM                        
tunnel.sys        6/6/2007 10:57:03 PM                        
dxgkrnl.sys        7/2/2007 9:01:10 PM                        
pacer.sys        7/3/2007 9:27:33 PM                        
ndistapi.sys        7/3/2007 9:28:09 PM                        
NDProxy.SYS        7/3/2007 9:28:13 PM                        
wanarp.sys        7/3/2007 9:28:16 PM                        
BATTC.SYS        8/30/2007 8:57:44 PM                        
acpi.sys        8/30/2007 8:57:46 PM                        
compbatt.sys        8/30/2007 8:57:47 PM                        
CmBatt.sys        8/30/2007 8:57:48 PM                        
USBD.SYS        8/30/2007 9:19:54 PM                        
usbuhci.sys        8/30/2007 9:19:58 PM                        
usbehci.sys        8/30/2007 9:19:59 PM                        
USBPORT.SYS        8/30/2007 9:20:03 PM                        
usbhub.sys        8/30/2007 9:20:18 PM                        
NETw4v32.sys        9/26/2007 9:12:18 AM                        
mrxsmb20.sys        10/25/2007 9:40:16 PM                        
mrxsmb.sys        10/25/2007 9:40:17 PM                        
srvnet.sys        10/25/2007 9:40:43 PM                        
srv2.sys        10/25/2007 9:40:47 PM                        
volsnap.sys        10/25/2007 10:04:17 PM                        
CLFS.SYS        12/5/2007 9:55:42 PM                        
mouclass.sys        12/5/2007 10:18:22 PM                        
kbdclass.sys        12/5/2007 10:18:23 PM                        
i8042prt.sys        12/5/2007 10:18:28 PM                        
WDFLDR.SYS        12/5/2007 10:21:19 PM                        
Wdf01000.sys        12/5/2007 10:21:28 PM                        
Ntfs.sys        12/16/2007 5:31:37 AM                        
monitor.sys        12/16/2007 5:56:44 AM