Forum Home
Press F1
 
Thread ID: 95935 2008-12-22 00:41:00 BSOD_0X000000C4; Hunt for the chameleon driver gza (13233) Press F1
Post ID Timestamp Content User
731637 2008-12-22 00:41:00 This thread is a new branch of the thread " Windows Explorer_crashes & freezes com" that I have running at the moment.
These are new developments & I thought posting a separate thread would be best.

After removing a troublesome software driver & and getting computer running smoothly, installing WXP SP3 & then rebooting com brought up a BSOD that we have all seen before but here are the on screen details given as to its happening.

" A device driver attempting to corrupt the system has been caught. The faulty driver currently on the kernal stack must be replaced with a working version.
If this is the first time that you have seen this STOP error screen, restart your computer. If the screen appears again, follow these steps.
Check to make sure any hardware or software is properly installed. If this is a new installation, ask your hardware or software manufacturer for any windows updates you might need.
If problems continue, disable or remove any newly installed hardware or software. Disable BIOS memory options such as caching or shadowing. If you need to use Safe Mode to remove or disable components, restart your computer, press F8 to select advanced startup options and then select safe mode.
Technical information:xxx STOP: 0X000000C4 (0X00000081, 0X82D684D8, 0X00000081, 0X00000000)

Beginning dump of physical memory.
Physical memory dump complete
Contact your system administrator or technical support group for further assistance.
Right-oh then, as I'm the system administrator and I know sweet F_A, and in my opinion, everything stated between the initial reference to the dodgy device driver attempting to corrupt the System up to the Technical information relating to the STOP Error message, is gobbledegook.
That's why I have come to Press f1 Technical support group for assistance. Whoops!! I don't mean to imply that you guys understand/talk gobbledegook :xmouth:
I've had three BSOD's in past 12 hours. First one after installing WXP SP3 and then rebooting com; info given as " A device driver attempting to corrupt the system has been caught. The faulty driver currently on the kernal stack must be replaced with a working version and Technical information:xxx STOP: 0X000000C4 (0X00000081, 0X82D684D8, 0X00000081, 0X00000000)
Rebooted com, Windows opened ok, went searching PF1 forums and Googling the full string of numbers above. Have done it before, always they start with 0X0000000C4 (MS help and support doesn't throw any more light on the subject)
Second BSOD again early hours of this morning, can't recall what I was doing on com @ time, changing an msxml6.exe driver for MS Office 2007 Enterprise, I think.
All alpha-numerals in STOP error were the same except for those in the 3rd group which were (0X0FD0D1518). Rebooted com and Windows opened up. Left come running d-loading went to bed.
Third BSOD 10AM today. first touch of com I went to open an un-rar'd .iso file; ImageBurn was going to open it but com turned blue on me.
The info for the third group of alpha-numerals were (0XF7FB1218)

Anyone out there know of a hitman?? Doesn't need to have a license to kill but probably needs to be prescient.
:thanks
gza (13233)
731638 2008-12-22 00:53:00 Look in device manager. Click on all +'s (if you dont crash that is)

Anything here showing an X? or ! ?

Have you installed any drivers since yesterday? Or any programs that installed some kind of driver?

Uninstall Alcohol, Poweriso and Daemon tools (or disable their startup entries with ccleaner)

These entries

O4 - HKCU\..\Run: [AlcoholAutomount] "C:\Program Files\Alcohol Soft\Alcohol 120\axcmd.exe" /automount

O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun

O4 - HKLM\..\Run: [PWRISOVM.EXE] C:\Program Files\PowerISO\PWRISOVM.EXE

Then reboot then see if it crashes. HOW often does it crash??
Speedy Gonzales (78)
731639 2008-12-22 01:22:00 I was to late to be able to edit thread & add this info;

Compaq Presario S3010AN
FIC 266 MoBo ( AM35)
Bestec 250W PSU
AMD XP2000+ 1.67GHz
Win XP Pro MCE + SP3
Western Digital 80GB EIDE + Bigfoot 30GB IDE HDD's
Asus 1814BL DL Multi Lightscribe DVD (RAM)
768 MB DDR PC2700 RAM
Radeon 9000 Series Graphics
Onboard sound ( Realtek AC'97 Audio for Via)

There are no entries showing in Event Viewer >System or Applications to help the hunt.

I cannot post a Trojan Remover log as it seems that I no longer have a TRLOG book....Hmmmm
I haven't tried Malwarebites or HJT yet. Com was cleaned out thoroughly past two-three days. Will see what I can get but I'm sure that they won't unearth anything.
gza (13233)
731640 2008-12-22 01:24:00 oh, hi speedy; ok, I'will get on to it now. post back later gza (13233)
731641 2008-12-22 01:37:00 FIC 266 MoBo ( AM35)
Bestec 250W PSU



!!!!

OMG!!

Nasty.


Also:
support.microsoft.com
pctek (84)
731642 2008-12-22 01:49:00 Good point lol. Get rid of that PSU as well Speedy Gonzales (78)
731643 2008-12-22 02:42:00 Apart from the msxml6.exe, WXPSP3, Windows updates and the latest version of HJT I haven't installed anything since I started removing items 2+ days back.
Apart from the BSOB tat augered the the problems a week ago, which we cleared up yesterday, Crashes have only begun being regular since that one I mentioned happened early hours this morning, ie. these thre that I mention here.
I haven't d-loaded anything from the net apart from that msxml6.exe and HJT. Have browses a few pages looking up error codes etc.

I have done most of the above, but I am also uninstalling other programs, Droppix Recorder 2, Eyeline, ImageBurn, PowerISO, IsoBuster 2.2, Soundblaster Live 2k, Open Office .org 2.2, @ inputs of Magic Disk (2.5.79 & 2.7.105) & more.
There's no show of Alcohol in the Add/Remove window, I think I removed it 2weeks back, however I went into Program Files and deleted it and a few others from there. Daemon Lite and toolbar won't go, message that they are in use.
as I did with other programs that still show in the scans (VMWare Player & Browser, Tirminal, both went out a year ago yet still shows in scans) the same goes for Droppix and others.
I have to close Firefox to remove the Daemon Lite & Toolbars so I will do that now. back soon.
gza (13233)
731644 2008-12-22 03:28:00 Back, No BSOD @ startup. hope don't get another.
Removed all of Magic Iso Virtual Drives, Freeze.com folder of Screen Savers, Unlocker, BitComet, Daemon Toolbar; Daemon Lite refuses to go, message: Cannot delete daemon.dll, Access Denied.
Ran CCL again, Registry> Scan for issues>backed up then cleared all. ( plethora or unused file extensions and endless paths to empty directories)
Google Desktop won't go, a command prompt window flashes on screen but that's about all.

Without confusing/x'ing two threads, I think that I will uninstall/reinstall MS Office 2007 Enterprise because I may well have created a hybrid of three versions, The free trial of Pro 2007, most probably is a mish-mash of 32 Bit & 64 Bit versions, Probably bought about by my getting the d-load on-screen twice when I had the 'sticky' probs couple weeks back. Seems to work though, well the parts that I use (Publisher, Word). A fresh install while com not sticky won;t go astray.

I am still running com in Normal Startup mode--figure its best to do this so that the problem can be bought to surface. Others go the another way and add progams one @ a time.
No BSOD still. Now to open some files/folders to let the beast out, unless its scarpered :)
Any more advice well and truly welcomed.
gza (13233)
731645 2008-12-22 03:39:00 If you've uninstalled Daemon tools, and that file wont bugger off, get Unlocker (ccollomb.free.fr)

Install it, (untick ebay shortcuts), run my computer / right mouse on daemon.dll

If Daemon tools is running now, kill its process in task manager (ctrl-alt-del) first

Select unlocker, select delete, if it needs to reboot to delete it, reboot

If you cant uninstall Daemon Tools / Google desktop (make sure its not running), delete its folder, then run the registry option in ccleaner, to get rid of it

If Google Desktop's entry is still in add/remove programs (and it doesnt work), Run ccleaner go to tools / uninstall. Highlight it click on delete entry

I wouldnt install too many disk programs (like PowerISO (unless you untick their virtual drives). theyre probably conflicting with each other
Speedy Gonzales (78)
731646 2008-12-22 04:19:00 !!!!

OMG!!

Nasty.


Also:
support.microsoft.com

:thanks
gza (13233)
1 2 3 4