Weird blue screen??

I used to get that at work several times a day. Our outside support assured us it was a hard disk failure, and sure enough, replacement with a larger disk solved the problem.

There may be other causes, and this is only what they told me. It's sometimes called the "blue screen of death".

lil_cat_luver, what happened was something caused your machine to crash. The blue screen (the dreaded BSOD, or "Blue Screen of Death") you saw is one of Windows more amusing features

When the blue screen appeared, a buncha text shoulda been scrolling along following the "Beginning Physical Memory Dump" message, indicating Windows was creating a log, or a sorta "data picture" of the system's state at the time of the crash. While, as mentioned by roger, crashes can be a sign of impending hardware failure, far more frequently they indicate a problem with Windows and/or some application running at the time of the crash.

From what you describe, it seems your system has a yuckware problem; if you wish, see THIS TOPIC, read, understand, print out, and follow the procedure detailed there, following the steps as, and in the order, recommended, then return to this topic and post the resultant logs. We might be able to help you out. You might find it convenient to click "Turn on email updates" down at the bottom right of this page; doing so will cause an email to be sent to the email address you used when you registered with A2K when a new reply is posted to this thread.


Oh, and if you never want to see that blue screen again, there's a way to make sure it doesn't show up; with a simple registry edit you can set the background color to anything you prefer

Ahhh yes the infamous BSOD's ^_^

You know, I've always thought the blue screen of death was the screen with a bunch of numbers and description on it and tells you you could (sometimes) bring back to the normal screen with ctrl+alt+del? I used to get that alot back when I was using Windows 98.

As for the applications, I had shareaza (playing music not downloading at the time), firefox, and photoshop open. I don't suppose there's any problem with those programs?

Eek, yuckware problem?? I had just followed those instructions probably a few monthes ago, and I scanned my computer routinely with Microsoft AntiSpyware, Ad-Aware, Spybot, and have regularly updated Spyware Blaster. I can't believe I have yuckeware again but I suppose I'll start it again then...

Oh, and what do you think happened with my antivirus?

And I forgot to ask, in the yuckware removal tips, it says to download Ewido security suite free trial version, but I've downloaded that once already, would it still work?

Any number of ways you coulda got re-infected - if that's the problem. I suspect it is, since you mention your AV apparently has been disabled. That's a not-uncommon symptom of a virus or worm, not so much of a trojan (most adware/spyware is based on trojans).

I suggest you uninstall your resident Antivirus, then immediately visit TrendMicro Housecall and perform the online virus scan. Record the full name and path of any file it reports having a problem with, should such occur. Then perform the online spyware scan available at the same page. Please save the report when it has completed. While there, also download the latest version of CWShredder - just download it to a convenient to find location on your machine, don't do anything else with it.

When you have done all that, disconnect from the internet, reboot, and reinstall/reactivate your own antivirus if possible. Run a full system scan with it, if it will run, then reconnect to the internet and immediately update your antivirus, then run another full system scan with it. If you cannot reinstall/reactivate your antivirus, or if it will not run correctly, uninstall it again, then immediately download, install, update, and scan with one of the recdommended free antivirus programs listed in the Yuckware Removal topic.

When you have done that, uninstall any other tools, apps or fixes you installed the first time you used the tips, then redownload, install, and update where appropriate, everything in the list - start from scratch (there are new versions and/or updates for just about all of them if you last downloaded them more than a few weeks ago).

For Ewido, if you first used it more thantwo weeks ago, it will recognize that your trial period has expired even if, as recommended, you uninstall your resident version and download and reinstall the current version. Thats not a real big deal, as essentially all that will be unavailable will be the real-time Guard, which we won't be using anyway, and the auto-update feature, which you can get around by using the manual update option also listed under the EWIDO section of the Yuckware Removal topic.

Step through the process and post back with the resultant logs. Naturally, if you have any other questions, or if problems crop up, post back here right away. No guarantee (I'm sorta busy with meatworld stuff right now), but I'll try to monitor this thread fairly frequently to see how you're doing.

Actually my antivirus wasn't exactly disabled, it said a file was corrupted, yet the antivirus itself still loads. I reinstalled it right away, and I just couldn't activate it.

Anyways, what I did was follow the yuckware removal guide but before I started it, I called tech support and actived my antivirus. In the removal guide there was a part where I needed to scan with at least 2 online free scans and I chose Housecall as one of them. It found this:

TROJ AGENT.GC
C:\Program Files\HJT\backups\backup-20050809-212304-125.dll

Which is quite strange since it's a HJT backup...I didn't delete it at the time, but later when I did the EWIDO scan, EWIDO deleted it...

The other online scan I did was Panda spyXposer, and here's the report


Incident Status Location

Adware:adware/beginto Reported C:\WINDOWS\SYSTEM32\cache32_rtneg3
Spyware:spyware/betterinet Reported Windows Registry
Spyware:Cookie/BurstNet Reported C:\Documents and Settings\Cathy\Cookies\cathy@burstnet[2].txt
Spyware:Cookie/BurstNet Reported C:\Documents and Settings\Cathy\Cookies\cathy@burstnet[3].txt
Spyware:Cookie/Falkag Reported C:\Documents and Settings\Cathy\Application Data\Mozilla\Firefox\Profiles\aygdhgy6.default\cookies.txt[.as-us.falkag.net/]
Spyware:Cookie/Casalemedia Reported C:\Documents and Settings\Cathy\Application Data\Mozilla\Firefox\Profiles\aygdhgy6.default\cookies.txt[.casalemedia.com/]
Spyware:Cookie/Statcounter Reported C:\Documents and Settings\Cathy\Application Data\Mozilla\Firefox\Profiles\aygdhgy6.default\cookies.txt[.statcounter.com/]
Spyware:Cookie/BurstNet Reported C:\Documents and Settings\Cathy\Application Data\Mozilla\Firefox\Profiles\aygdhgy6.default\cookies.txt[.burstnet.com/]
Spyware:Cookie/RealMedia Reported C:\Documents and Settings\Cathy\Application Data\Mozilla\Firefox\Profiles\aygdhgy6.default\cookies.txt[.realmedia.com/]
Spyware:Cookie/BurstNet Reported C:\Documents and Settings\Cathy\Cookies\cathy@burstnet[2].txt
Spyware:Cookie/BurstNet Reported C:\Documents and Settings\Cathy\Cookies\cathy@burstnet[3].txt
Spyware:Cookie/Falkag Reported C:\Documents and Settings\Cathy\Application Data\Mozilla\Firefox\Profiles\aygdhgy6.default\cookies.txt[.as-us.falkag.net/]
Spyware:Cookie/Casalemedia Reported C:\Documents and Settings\Cathy\Application Data\Mozilla\Firefox\Profiles\aygdhgy6.default\cookies.txt[.casalemedia.com/]
Spyware:Cookie/Statcounter Reported C:\Documents and Settings\Cathy\Application Data\Mozilla\Firefox\Profiles\aygdhgy6.default\cookies.txt[.statcounter.com/]
Spyware:Cookie/Casalemedia Reported C:\Documents and Settings\Cathy\Application Data\Mozilla\Firefox\Profiles\aygdhgy6.default\cookies.txt[.casalemedia.com/]
Spyware:Cookie/Statcounter Reported C:\Documents and Settings\Cathy\Application Data\Mozilla\Firefox\Profiles\aygdhgy6.default\cookies.txt[.statcounter.com/]
Spyware:Cookie/BurstNet Reported C:\Documents and Settings\Cathy\Application Data\Mozilla\Firefox\Profiles\aygdhgy6.default\cookies.txt[.burstnet.com/]
Spyware:Cookie/RealMedia Reported C:\Documents and Settings\Cathy\Application Data\Mozilla\Firefox\Profiles\aygdhgy6.default\cookies.txt[.realmedia.com/]


Here's the first EWIDO report.

---------------------------------------------------------
ewido security suite - Scan report
---------------------------------------------------------

+ Created on: 5:42:31 PM, 10/22/2005
+ Report-Checksum: C9E477EC

+ Scan result:

HKLM\SOFTWARE\HbTools -> Spyware.HotBar : Cleaned with backup
HKLM\SOFTWARE\HbTools\HbTools -> Spyware.HotBar : Cleaned with backup
C:\Program Files\HJT\backups\backup-20050809-212304-125.dll -> TrojanDownloader.Small : Cleaned with backup
C:\Documents and Settings\Cathy\Cookies\cathy@burstnet[2].txt -> Spyware.Cookie.Burstnet : Cleaned with backup
C:\Documents and Settings\Cathy\Cookies\cathy@burstnet[3].txt -> Spyware.Cookie.Burstnet : Cleaned with backup
:mozilla.14:C:\Documents and Settings\Cathy\Application Data\Mozilla\Firefox\Profiles\aygdhgy6.default\cookies.txt -> Spyware.Cookie.Falkag : Cleaned with backup
:mozilla.15:C:\Documents and Settings\Cathy\Application Data\Mozilla\Firefox\Profiles\aygdhgy6.default\cookies.txt -> Spyware.Cookie.Falkag : Cleaned with backup
:mozilla.16:C:\Documents and Settings\Cathy\Application Data\Mozilla\Firefox\Profiles\aygdhgy6.default\cookies.txt -> Spyware.Cookie.Falkag : Cleaned with backup
:mozilla.17:C:\Documents and Settings\Cathy\Application Data\Mozilla\Firefox\Profiles\aygdhgy6.default\cookies.txt -> Spyware.Cookie.Falkag : Cleaned with backup
:mozilla.18:C:\Documents and Settings\Cathy\Application Data\Mozilla\Firefox\Profiles\aygdhgy6.default\cookies.txt -> Spyware.Cookie.Falkag : Cleaned with backup
:mozilla.21:C:\Documents and Settings\Cathy\Application Data\Mozilla\Firefox\Profiles\aygdhgy6.default\cookies.txt -> Spyware.Cookie.Casalemedia : Cleaned with backup
:mozilla.22:C:\Documents and Settings\Cathy\Application Data\Mozilla\Firefox\Profiles\aygdhgy6.default\cookies.txt -> Spyware.Cookie.Statcounter : Cleaned with backup
:mozilla.23:C:\Documents and Settings\Cathy\Application Data\Mozilla\Firefox\Profiles\aygdhgy6.default\cookies.txt -> Spyware.Cookie.Casalemedia : Cleaned with backup
:mozilla.24:C:\Documents and Settings\Cathy\Application Data\Mozilla\Firefox\Profiles\aygdhgy6.default\cookies.txt -> Spyware.Cookie.Casalemedia : Cleaned with backup
:mozilla.25:C:\Documents and Settings\Cathy\Application Data\Mozilla\Firefox\Profiles\aygdhgy6.default\cookies.txt -> Spyware.Cookie.Statcounter : Cleaned with backup
:mozilla.33:C:\Documents and Settings\Cathy\Application Data\Mozilla\Firefox\Profiles\aygdhgy6.default\cookies.txt -> Spyware.Cookie.Burstnet : Cleaned with backup
:mozilla.35:C:\Documents and Settings\Cathy\Application Data\Mozilla\Firefox\Profiles\aygdhgy6.default\cookies.txt -> Spyware.Cookie.Burstnet : Cleaned with backup


::Report End

The second EWIDO report found nothing.

And the HJT report:

Logfile of HijackThis v1.99.1
Scan saved at 7:32:07 PM, on 10/22/2005
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Command Software\dvpapi.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\WINDOWS\system32\MSTask.exe
C:\WINDOWS\System32\WBEM\WinMgmt.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Microsoft AntiSpyware\gcasServ.exe
C:\Program Files\TELUS\TELUS Security service\Freedom.exe
C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
C:\Program Files\HJT\HijackThis.exe

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = dynhost.inetcam.com;register.inetcam.com;
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: Pop-Up Blocker BHO - {3C060EA2-E6A9-4E49-A530-D4657B8C449A} - C:\Program Files\TELUS\TELUS Security service\pkR.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Form Filler BHO - {56071E0D-C61B-11D3-B41C-00E02927A304} - C:\Program Files\TELUS\TELUS Security service\FreeBHOR.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKLM\..\Run: [Tweak UI] RUNDLL32.EXE TWEAKUI.CPL,TweakMeUp
O4 - HKLM\..\Run: [TELUS Security service] "C:\Program Files\TELUS\TELUS Security service\Freedom.exe"
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {17D72920-7A15-11D4-921E-0080C8DA7A5E} (AimSp32 Class) - http://www.makeoversolutions.com/save/makeover.cab
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab28578.cab
O16 - DPF: {2B323CD9-50E3-11D3-9466-00A0C9700498} - http://us.chat1.yimg.com/us.yimg.com/i/chat/applet/v45/yacscom.cab
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1122924237437
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061001/housecall.trendmicro.com/housecall/xscan53.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab28578.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {9AA73F41-EC64-489E-9A73-9CD52E528BC4} (ZoneAxRcMgr Class) - http://zone.msn.com/binGame/ZAxRcMgr.cab
O16 - DPF: {9FC5238F-12C4-454F-B1B5-74599A21DE47} - http://community.webshots.com/html/WSPhotoUploader.CAB
O16 - DPF: {A8F2B9BD-A6A0-486A-9744-18920D898429} (ScorchPlugin Class) - http://www.sibelius.com/download/software/win/ActiveXPlugin.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://zone.msn.com/binFramework/v10/ZIntro.cab33902.cab
O16 - DPF: {D27CDB6E-0000-0000-0000-000000000000} - https://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O16 - DPF: {D54160C3-DB7B-4534-9B65-190EE4A9C7F7} (SproutLauncherCtrl Class) - http://download.games.yahoo.com/games/web_games/gamehouse/frenzy/SproutLauncher.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} - http://www.popcap.com/games/popcaploader_v6.cab
O16 - DPF: {EDFCDAF5-95D9-40E9-BBE6-10C33190C3EF} (cGameControl Class) - http://zone.msn.com/bingame/rmcb/default/RumbleCube.cab
O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcafee.com/molbin/iss-loc/vso/en-us/tools/mcfscan/2,0,0,4608/mcfscan.cab
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINDOWS\System32\dmadmin.exe
O23 - Service: DvpApi (dvpapi) - Command Software Systems, Inc. - C:\Program Files\Common Files\Command Software\dvpapi.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe

The only problem I had was that I couldn't download AboutBuster, I can't remember exactly the message, but it said something like the document has no data, or cannot be displayed (I was using firefox by the way).

All in all, the final logs look clean, and I wouldn't worry over the glitch you had re AboutBuster; I doubt its necessary in this case. Thanks for the feedback though; I'll check the link myself to see whats up.

One item in the HJT log bothers me a bit though:

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = dynhost.inetcam.com;register.inetcam.com

There is no reason your start page should be the registration site for an internet camera, whether or not you have one.

I suggest you run HJT again, place a check next to that item only, then click "Fix Checked". Then launch Microsoft Antispyware, select "Advanced Tools", then "Browser Restore". Place a checkmark in the "Select All" box at the bottom of the left-hand panel, then click "Restore" and confirm. This should reset your Start Page and Search Assistants to Microsoft defaults; you can always reset them to your own preferences if you wish, but its good to start from a known-safe point.

When that's been done, launch CCleaner, select "Issues" (the blue stacked blocks icon), and make sure everything in the "Issue Scanning Settings" is selected, then click the "Scan for Issues" button. This could take a while. When it completes, check through the list in the righthand panel to make sure there's nothing there you want to keep, otherwise make sure everything else found is selcted. Click "Fix selected issues ... " down at the bottom right of the page. Confirm, and when prompted to create a backup, do so, and note where the backup will be saved. Another "Fix all issues?" box then will pop up, select "Fix all issues", and confirm.

When that has completed, select "Cleaner" (the whiskbroom icon at the top). In the "Windows" tab, make sure everything is selected, then click the "Analyze" button down at the bottom left of that page. Be patient, this may take a while. When that has completed, click the "Run Cleaner" button down at the bottom righthand side of the page, and confirm.

Now boot into safe mode, and run full system scan-and-fixes with Ad-Aware SE, EWIDO, Microsoft Antispyware, and Spybot S&D (before booting into safe mode, update all if you have not done so in the past few days).

When that has been done, boot normally and repeat full scan-and fixes with all, followed by an "Issues" scan-and-fix then a final cleanup with CCleaner.

Make sure your resident antivirus and firewall are up to date and properly configured.

Following all of that, you oughtta be good to go.

Thanks so much timberlandko, I will follow these steps as soon as possible.

Just one thing about the camera, I have an Intel webcam, and I remember you told me the same thing about this back when you helped me get rid of Aurora (thank god), only that you said it wasn't necessary to fix because my homepage for IE is not the page for the registration. It is strange though, that it still shows up because I ran the browser restore tool in AntiSpyware at least 3 times before...

Oh, and is it okay if I delete/uninstall DelDomains.inf, nailfix, cwshredder, and ewido (after I finish these last steps)?

Sure, you can delete the no-longer-needed apps, tools, and fixes. Now that you mention it, I recall that Intel Create&Share/iNetCam deal. Don't lose any sleep over it as long as your start page and your search functions are working to your satisfaction. And on the AboutBuster thing - that turned out to be a problem with the website hosting the file; I changed the URL in the link to one that does work - or at least one which worked when I checked it just now :wink: - I really appreciate hearing about stuff like that. Unless somebody tells me a link is broken or there is some other glitch, I have no idea I should be trying to figure out how to fix it.

Hi timberlandko,

I followed those steps but I'm still seeing the UIPopupHidden thing when I shut down or restart the computer. In fact, it hapened once during the steps, before I reboot to safe mode.

None of the scans turned up anything, and my antivirus found nothing either. Why do you think it's still happening?