blue screens and avg

[Guest]

Hi all,

After installing AVG, ADAWARE and a Netgear WG511 wireless laptop card, a
blue screen occurred on my xp home SP2 laptop:-

Product: Windows Operating System
ID: 1003
Source: System Error
Version: 5.2
Symbolic Name: ER_KRNLCRASH_LOG
Message: Error code %1, parameter1 %2, parameter2 %3, parameter3 %4,
parameter4 %5.

Explanation
A blue screen (Stop error) was reported. The message contains details about
the error. A matching event with Event ID 1001
might also appear in the event log. This matching event displays
information about the specific error that occurred.


User Action
No user action is required.

Event Type: Error
Event Source: System Error
Event Category: (102)
Event ID: 1003
Date: 30/03/2005
Time: 23:02:27
User: N/A
Computer:
Description:
Error code 1000008e, parameter1 c0000005, parameter2 f1f11f58, parameter3
f12b8940, parameter4 00000000.


For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 74737953 45206d65 726f7272 72452020
0010: 20726f72 65646f63 30303120 38303030
0020: 50202065 6d617261 72657465 30632073
0030: 30303030 202c3530 31663166 38356631
0040: 3166202c 39386232 202c3034 30303030
0050: 30303030

The microsoft reply indicated that a device driver was the problem.

Can anyone help?

 

[Malke]

Hi all,

After installing AVG, ADAWARE and a Netgear WG511 wireless laptop
card, a blue screen occurred on my xp home SP2 laptop:-

Product: Windows Operating System
ID: 1003
Source: System Error
Version: 5.2
Symbolic Name: ER_KRNLCRASH_LOG
Message: Error code %1, parameter1 %2, parameter2 %3, parameter3 %4,
parameter4 %5.

Explanation
A blue screen (Stop error) was reported. The message contains details
about the error. A matching event with Event ID 1001
might also appear in the event log. This matching event displays
information about the specific error that occurred.


User Action
No user action is required.

Event Type: Error
Event Source: System Error
Event Category: (102)
Event ID: 1003
Date: 30/03/2005
Time: 23:02:27
User: N/A
Computer:
Description:
Error code 1000008e, parameter1 c0000005, parameter2 f1f11f58,
parameter3 f12b8940, parameter4 00000000.


For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 74737953 45206d65 726f7272 72452020
0010: 20726f72 65646f63 30303120 38303030
0020: 50202065 6d617261 72657465 30632073
0030: 30303030 202c3530 31663166 38356631
0040: 3166202c 39386232 202c3034 30303030
0050: 30303030

The microsoft reply indicated that a device driver was the problem.

Can anyone help?

Use System Restore to go back to before you installed everything. Then
physically remove the laptop card before you restart the computer. Make
sure your computer is not connected to the Internet since you won't
have any antivirus in place.

Then make sure your computer is 100% virus and malware-free. Post back
if you need help in doing that.

Then install AVG and test. If OK, install Ad-aware and test. Then
install the Netgear card. Get the most recent drivers from Netgear's
site instead of using the ones on the cd that came with the card.
Obviously, you'll need to get the drivers from a machine with a working
Internet connection and a cd burner.

Let us know what happens and/or if you need more help with the
troubleshooting.

Malke

 

[Guest]

Thanks Malke.

Once I have used system restore, how do I make sure that the laptop is virus
& malware free as I will not have programs to do this and you say not to
connect to the internet?

A little bit more info which may help is that the blue screen (which has
only happened the once) occurred whilst running the ADAWARE program. Is it
worth waiting to see if it happens again before taking any action?

Thanks again,

Phil.

 

[Malke]

Thanks Malke.

Once I have used system restore, how do I make sure that the laptop is
virus & malware free as I will not have programs to do this and you
say not to connect to the internet?

A little bit more info which may help is that the blue screen (which
has only happened the once) occurred whilst running the ADAWARE
program. Is it worth waiting to see if it happens again before taking
any action?

Certainly you can clean up your computer before doing a System Restore
and if you suspect that malware is the issue, that would be wise. I was
under the impression that your computer was basically unworkable. Since
you have an issue with AVG, for Step 1 below (scanning w/av) try using
Dave Lipman's Sysclean_FE from here:

http://www.ik-cs.com/got-a-virus.htm

Obviously, you need to get all the malware removal tools from a
different, known-clean computer that has a good Internet connection and
a cd burner. It is crucial that you do all scanning/repair work in Safe
Mode with updated tools. Here are general malware removal steps:

First delete all Temporary and Temporary Internet Files. Then:

1) Scan in Safe Mode with current version (not earlier than 2004)
antivirus using updated definitions.

Before you remove malware, get LSPFix or WinSockFix for XP - see links
below.

2) Remove spyware with Spybot Search & Destroy and Ad-aware. These
programs are free, so use them both since they complement each other.
There is a new version of CWShredder from Intermute. I would not
install the other Intermute programs, however. Alternately, there are
CoolWebSearch malware removal steps at SilentRunners.

Be sure to update these programs before running, and it is a good idea
to do virus/spyware scans in Safe Mode. Make sure you are able to see
all hidden files and extensions (View tab in Folder Options).

If the malware remains even after you used Ad-aware and Spybot, you can
scan with HijackThis. HijackThis is an excellent tool to discover and
disable hijackers, but it requires expert skill. See below for
HijackThis links, including sites where you can post your HJT logs. A
combination of HijackThis and About:Buster works well in removing the
About:Blank homepage hijacker. Again, this is an expert tool and
novices should get help with it.

3) If you are running Windows ME or XP, you should disable/enable System
Restore after the system is clean because malware will be in the
Restore Points. With ME, you must disable System Restore completely.
With XP, you can delete all but the most recent (presumably clean)
System Restore point from the More Options section of Disk Cleanup
(Run>cleanmgr).

4) Make sure you've visited Windows Update and applied all security
patches. Do not install driver updates from Windows Update.

5) Run a firewall.

Links to help with malware:

Software/Methods:
http://www.safer-networking.org - Spybot Search & Destroy
http://www.lavasoftusa.com - Ad-aware
http://www.intermute.com/products/cwshredder.html
http://www.tomcoyote.com/hjt/ - HijackThis
http://www.intermute.com/spysubtract/cwshredder_download.html
http://www.silentrunners.org/sr_cwsremoval.html. - SilentRunners
http://www.cexx.org/lspfix.htm - Repair Winsock 2 settings after
removing spyware
http://www.spychecker.com/program/winsockxpfix.html - WinsockXPFix.exe

HijackThis:
http://www.aumha.org/a/hjttutor.htm - HijackThis tutorial by Jim
Eshelman
http://aumha.net - forums
http://spywarewarrior.com/viewforum.php?f=5 - Spyware Warrior HijackThis
forum
http://www.wilderssecurity.com/
http://forums.tomcoyote.org/

General:
http://aumha.net - look under "Security" for various forums
http://rgharper.mvps.org/cleanit.htm
http://mvps.org/winhelp2002/unwanted.htm
http://www.aumha.org/a/parasite.htm - The Parasite Fight
http://www.spywarewarrior.com/rogue_anti-spyware.htm

Malke

 

[Guest]

Thanks ever so much Malke for your VERY comprehensive advice!

Phil.

 

[Malke]

Thanks ever so much Malke for your VERY comprehensive advice!

Phil.

You're most welcome, Phil. Don't hesitate to post back if you need more
help.

Malke