This is a read-only archive. No new posts or registrations. Privacy Page
Software

Husband's computer keeps freezing, blue screen of death....

10 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Hi!  Wondering if you can help.  I initially thought this was a malware problem.  Here is the link for the topic I posted.  Juliet tried to help.  She thinks this might be a hardware problem. (Btw, my husband's OS is Windows 8.1)

 

https://forums.whatthetech.com/index.php?showtopic=131399

 

It all started with a trojan (Kovter) picked up by a Malwarebytes scan.  The Kovter was quarantined and then removed.  Then the computer problems started.  First the mouse stops working, eventually the computer goes to the blue screen of death saying there is a problem and the computer needs to restart.  It shows DPC_WATCHDOG_VIOLATION.  If you go into Safe Mode, the computer works forever but of course, you have no internet access.  If you go into Safe Mode with Networking, it works a long time but eventually the mouse freezes and goes to the blue screen of death.  The Real-Time Protection from Malwarebytes Premium is shut off and I cannot enable it.  This is why I thought it was malware and not hardware.  Everything did work for a short time after a rootkit scan (which said it found nothing) but then reverted to the same problems.

If this is a hard drive going bad, it's the strangest thing I've ever seen.  Why is it messing with the malware software specifically??  It just seems like there are a lot of coincidences following the trojan infection.  It could be that the hard drive is going bad at this particular time, but it's a strange coincidence.  My husband says he's ready to throw the computer off the deck!  lol  Please advise….

It does seem rather odd, however it's good news that the problems goes away when running in safe mode…..that would tend to suggest that something that is loading in normal mode, but absent in safe is a possible culprit..

all we have to do is to find what it is!!    :thumbup:
 
Have you tried a "clean boot" if not then this would be a reasonable place to start (after of course having checked that your "System Restore" is switched on and you have a number of existing restore points and have created a new one!)
 
Here's the information you need:
https://support.microsoft.com/en-gb/help/929135/how-to-perform-a-clean-boot-in-windows

 

You will need to scroll down to find the bits you need.

 

Let us know how you get on

 

Your husband has I take it checked that his backups are all 100% and totally watertight???

 

Regards

paws

Hi.  I followed instructions for a clean boot.  The problem continued so I interpret this to mean that it's not happening because of a background program.  Could it be a Microsoft Services problem??  Please advise.  Thanks!

 

PS  Now my husband says there could be a correlation between a Windows Update and this problem starting.  Could be a coincidence but just thought I would mention it….

Does the lack of response indicate you are stumped or am I just being impatient??  lol  Looking forward to your guidance and advice….

Apologies to you cranmergirl,

For some reason the board software didn't notify me that you had replied to my post … (but I received your pm just fine.)

 

I'll review your topics and get back to you asap.

Regards

paws

Hi cranmergirl,

 

Yes you are right, it could be a Microsoft Service that is causing the problem ,and that's why we provided the linky in post 2….. presumably you managed to eliminate Microsoft Services when you followed step 10…(.Linky in post 2 refers)…..?

 

There could be any number of reasons for the issue so at long range we just try and eliminate the most likely causes and then move on to the less likely causes until we arrive at the culprit.

 

If after following step 10 (in full) it has not helped then let me know and we'll move on to the next step.

Regards

paws

PS if I don't respond within 24 hours then feel free to pm me again! :thumbup:

Hi paws,

I think I isolated the culprit.  I narrowed it down to WLAN AutoConfig.  So when that is the only item NOT checked (ie. it is disabled), the computer works fine all day long (except no internet connection, of course.)   I just want to point out a few things FYI.  My husband says this all started immediately after a  Windows Update.  However, at around the same time, he also detected the trojan malware (Kovter).  Two more strange items:  1)  His Malwarebytes Premium Real-Time Protection CANNOT be enabled; and 2)  I have run Rogue Killer (which I initially downloaded as advised by Juliet from the malware forum) several times today on his computer and each and every time, it detects 2 problems.  I delete them but when I run the next scan, 2 more problems are detected.  It doesn't necessarily look like they are the same items being detected??  Not sure but I did copy the reports and will try sending them from his computer (assuming I can get internet service long enough to do it.)  (I would send them from my computer but I am not about to bring anything from his computer to mine via thumb drive.)  Thanks!  I will try sending the Rogue Killer logs.  Looking forward to your response…. :adios:  

Hi paws,

Here are the logs.  Working fast so I don't lose internet service….

 

RogueKiller V12.12.0.0 (x64) [Jan 15 2018] (Free) by Adlice Software
mail : http://www.adlice.com/contact/
Feedback : https://forum.adlice.com
Website : http://www.adlice.com/download/roguekiller/
Blog : http://www.adlice.com

Operating System : Windows 8.1 (6.3.9600) 64 bits version
Started in : Safe mode
User : Drew [Administrator]
Started from : C:\Users\Drew\Desktop\RogueKiller_portable64.exe
Mode : Delete – Date : 02/09/2018 14:28:05 (Duration : 00:19:18)

¤¤¤ Processes : 0 ¤¤¤

¤¤¤ Registry : 2 ¤¤¤
[PUM.Dns] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Tcpip\Parameters | DhcpNameServer : 10.169.238.110 ([X])  -> Replaced ()
[PUM.Dns] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Tcpip\Parameters\Interfaces\{7811BF76-4FE9-4513-8C7F-CB2200ED30BD} | DhcpNameServer : 10.169.238.110 ([X])  -> Replaced ()

¤¤¤ Tasks : 0 ¤¤¤

¤¤¤ Files : 0 ¤¤¤

¤¤¤ WMI : 0 ¤¤¤

¤¤¤ Hosts File : 0 ¤¤¤

¤¤¤ Antirootkit : 0 (Driver: Not loaded [0xc000035f]) ¤¤¤

¤¤¤ Web browsers : 0 ¤¤¤

¤¤¤ MBR Check : ¤¤¤
+++++ PhysicalDrive0: ST1000DM003-1CH162 +++++
— User —
[MBR] e587d5a90a440265faef102f2dadb844
[BSP] cdaec1772cd648316dc5e44cb2493bba : Empty MBR Code
Partition table:
0 - [SYSTEM][MAN-MOUNT] Basic data partition | Offset (sectors): 2048 | Size: 1023 MB
1 - EFI system partition | Offset (sectors): 2097152 | Size: 360 MB
2 - Microsoft reserved partition | Offset (sectors): 2834432 | Size: 128 MB
3 - Basic data partition | Offset (sectors): 3096576 | Size: 938423 MB
4 - [SYSTEM][MAN-MOUNT]  | Offset (sectors): 1924986880 | Size: 450 MB
5 - [SYSTEM][MAN-MOUNT]  | Offset (sectors): 1925908480 | Size: 450 MB
6 - [SYSTEM] Basic data partition | Offset (sectors): 1926830080 | Size: 13029 MB
User = LL1 … OK
User = LL2 … OK

+++++ PhysicalDrive1: Clikfree Backup Drive USB Device +++++
— User —
[MBR] 309a269ae2bb40dbd7b45a07cba9a4ed
[BSP] 7301e4b6731c25e20e8b0f41109a8fb0 : Unknown MBR Code
Partition table:
0 - [XXXXXX] NTFS (0x7) [VISIBLE] Offset (sectors): 63 | Size: 953647 MB [Windows XP Bootstrap | Windows XP Bootloader]
User = LL1 … OK
Error reading LL2 MBR! ([32] The request is not supported. )

Next log….

 

RogueKiller V12.12.0.0 (x64) [Jan 15 2018] (Free) by Adlice Software
mail : http://www.adlice.com/contact/
Feedback : https://forum.adlice.com
Website : http://www.adlice.com/download/roguekiller/
Blog : http://www.adlice.com

Operating System : Windows 8.1 (6.3.9600) 64 bits version
Started in : Normal mode
User : Drew [Administrator]
Started from : C:\Users\Drew\Desktop\RogueKiller_portable64.exe
Mode : Delete – Date : 02/09/2018 15:41:50 (Duration : 00:18:49)

¤¤¤ Processes : 0 ¤¤¤

¤¤¤ Registry : 2 ¤¤¤
[PUM.Dns] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Tcpip\Parameters | DhcpNameServer : 10.169.238.110 ([X])  -> Replaced ()
[PUM.Dns] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Tcpip\Parameters\Interfaces\{7811BF76-4FE9-4513-8C7F-CB2200ED30BD} | DhcpNameServer : 10.169.238.110 ([X])  -> Replaced ()

¤¤¤ Tasks : 0 ¤¤¤

¤¤¤ Files : 0 ¤¤¤

¤¤¤ WMI : 0 ¤¤¤

¤¤¤ Hosts File : 0 ¤¤¤

¤¤¤ Antirootkit : 0 (Driver: Loaded) ¤¤¤

¤¤¤ Web browsers : 0 ¤¤¤

¤¤¤ MBR Check : ¤¤¤
+++++ PhysicalDrive0:  +++++
— User —
[MBR] e587d5a90a440265faef102f2dadb844
[BSP] cdaec1772cd648316dc5e44cb2493bba : Empty MBR Code
Partition table:
0 - [SYSTEM][MAN-MOUNT] Basic data partition | Offset (sectors): 2048 | Size: 1023 MB
1 - EFI system partition | Offset (sectors): 2097152 | Size: 360 MB
2 - Microsoft reserved partition | Offset (sectors): 2834432 | Size: 128 MB
3 - Basic data partition | Offset (sectors): 3096576 | Size: 938423 MB
4 - [SYSTEM][MAN-MOUNT]  | Offset (sectors): 1924986880 | Size: 450 MB
5 - [SYSTEM][MAN-MOUNT]  | Offset (sectors): 1925908480 | Size: 450 MB
6 - [SYSTEM] Basic data partition | Offset (sectors): 1926830080 | Size: 13029 MB
User = LL1 … OK
User = LL2 … OK

+++++ PhysicalDrive1:  +++++
— User —
[MBR] 309a269ae2bb40dbd7b45a07cba9a4ed
[BSP] 7301e4b6731c25e20e8b0f41109a8fb0 : Unknown MBR Code
Partition table:
0 - [XXXXXX] NTFS (0x7) [VISIBLE] Offset (sectors): 63 | Size: 953647 MB [Windows XP Bootstrap | Windows XP Bootloader]
User = LL1 … OK
Error reading LL2 MBR! ([32] The request is not supported. )

Third Scan Log….

 

RogueKiller V12.12.0.0 (x64) [Jan 15 2018] (Free) by Adlice Software
mail : http://www.adlice.com/contact/
Feedback : https://forum.adlice.com
Website : http://www.adlice.com/download/roguekiller/
Blog : http://www.adlice.com

Operating System : Windows 8.1 (6.3.9600) 64 bits version
Started in : Normal mode
User : Drew [Administrator]
Started from : C:\Users\Drew\Desktop\RogueKiller_portable64.exe
Mode : Delete – Date : 02/09/2018 16:07:16 (Duration : 00:19:10)

¤¤¤ Processes : 0 ¤¤¤

¤¤¤ Registry : 2 ¤¤¤
[PUM.HomePage] (X64) HKEY_USERS\S-1-5-21-90104672-2584935845-2132657902-1001\Software\Microsoft\Internet Explorer\Main | Start Page : http://www.foxnews.com/ -> Replaced (http://go.microsoft.com/fwlink/p/?LinkId=255141)
[PUM.HomePage] (X86) HKEY_USERS\S-1-5-21-90104672-2584935845-2132657902-1001\Software\Microsoft\Internet Explorer\Main | Start Page : http://www.foxnews.com/ -> Replaced (http://go.microsoft.com/fwlink/p/?LinkId=255141)

¤¤¤ Tasks : 0 ¤¤¤

¤¤¤ Files : 0 ¤¤¤

¤¤¤ WMI : 0 ¤¤¤

¤¤¤ Hosts File : 0 ¤¤¤

¤¤¤ Antirootkit : 0 (Driver: Loaded) ¤¤¤

¤¤¤ Web browsers : 0 ¤¤¤

¤¤¤ MBR Check : ¤¤¤
+++++ PhysicalDrive0:  +++++
— User —
[MBR] e587d5a90a440265faef102f2dadb844
[BSP] cdaec1772cd648316dc5e44cb2493bba : Empty MBR Code
Partition table:
0 - [SYSTEM][MAN-MOUNT] Basic data partition | Offset (sectors): 2048 | Size: 1023 MB
1 - EFI system partition | Offset (sectors): 2097152 | Size: 360 MB
2 - Microsoft reserved partition | Offset (sectors): 2834432 | Size: 128 MB
3 - Basic data partition | Offset (sectors): 3096576 | Size: 938423 MB
4 - [SYSTEM][MAN-MOUNT]  | Offset (sectors): 1924986880 | Size: 450 MB
5 - [SYSTEM][MAN-MOUNT]  | Offset (sectors): 1925908480 | Size: 450 MB
6 - [SYSTEM] Basic data partition | Offset (sectors): 1926830080 | Size: 13029 MB
User = LL1 … OK
User = LL2 … OK

+++++ PhysicalDrive1:  +++++
— User —
[MBR] 309a269ae2bb40dbd7b45a07cba9a4ed
[BSP] 7301e4b6731c25e20e8b0f41109a8fb0 : Unknown MBR Code
Partition table:
0 - [XXXXXX] NTFS (0x7) [VISIBLE] Offset (sectors): 63 | Size: 953647 MB [Windows XP Bootstrap | Windows XP Bootloader]
User = LL1 … OK
Error reading LL2 MBR! ([32] The request is not supported. )

Last scan log….

 

RogueKiller V12.12.0.0 (x64) [Jan 15 2018] (Free) by Adlice Software
mail : http://www.adlice.com/contact/
Feedback : https://forum.adlice.com
Website : http://www.adlice.com/download/roguekiller/
Blog : http://www.adlice.com

Operating System : Windows 8.1 (6.3.9600) 64 bits version
Started in : Normal mode
User : Drew [Administrator]
Started from : C:\Users\Drew\Desktop\RogueKiller_portable64.exe
Mode : Delete – Date : 02/09/2018 16:44:31 (Duration : 00:20:28)

¤¤¤ Processes : 0 ¤¤¤

¤¤¤ Registry : 2 ¤¤¤
[PUM.Dns] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Tcpip\Parameters | DhcpNameServer : 10.169.238.110 ([X])  -> Replaced ()
[PUM.Dns] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Tcpip\Parameters\Interfaces\{7811BF76-4FE9-4513-8C7F-CB2200ED30BD} | DhcpNameServer : 10.169.238.110 ([X])  -> Replaced ()

¤¤¤ Tasks : 0 ¤¤¤

¤¤¤ Files : 0 ¤¤¤

¤¤¤ WMI : 0 ¤¤¤

¤¤¤ Hosts File : 0 ¤¤¤

¤¤¤ Antirootkit : 0 (Driver: Loaded) ¤¤¤

¤¤¤ Web browsers : 0 ¤¤¤

¤¤¤ MBR Check : ¤¤¤
+++++ PhysicalDrive0: ST1000DM003-1CH162 +++++
— User —
[MBR] e587d5a90a440265faef102f2dadb844
[BSP] cdaec1772cd648316dc5e44cb2493bba : Empty MBR Code
Partition table:
0 - [SYSTEM][MAN-MOUNT] Basic data partition | Offset (sectors): 2048 | Size: 1023 MB
1 - EFI system partition | Offset (sectors): 2097152 | Size: 360 MB
2 - Microsoft reserved partition | Offset (sectors): 2834432 | Size: 128 MB
3 - Basic data partition | Offset (sectors): 3096576 | Size: 938423 MB
4 - [SYSTEM][MAN-MOUNT]  | Offset (sectors): 1924986880 | Size: 450 MB
5 - [SYSTEM][MAN-MOUNT]  | Offset (sectors): 1925908480 | Size: 450 MB
6 - [SYSTEM] Basic data partition | Offset (sectors): 1926830080 | Size: 13029 MB
User = LL1 … OK
User = LL2 … OK

+++++ PhysicalDrive1: Clikfree Backup Drive USB Device +++++
— User —
[MBR] 309a269ae2bb40dbd7b45a07cba9a4ed
[BSP] 7301e4b6731c25e20e8b0f41109a8fb0 : Unknown MBR Code
Partition table:
0 - [XXXXXX] NTFS (0x7) [VISIBLE] Offset (sectors): 63 | Size: 953647 MB [Windows XP Bootstrap | Windows XP Bootloader]
User = LL1 … OK

 

Whew!  lol  :banana:   Thanks!
Error reading LL2 MBR! ([32] The request is not supported. )

Hi cranmergirl,
We don't analyse logs from Virus and Spyware removal applications like Rogue Killer here on this forum.
 
If you want someone to take a look at them then you will need to post them in your previous topic where Juliet was assisting you …..
 
Some general comments for you before you post the logs for Juliet to take a look at.
 
The strategy I was adopting in this forum here to assist you was to use the clean boot linky that I gave you earlier in order to help eliminate "the good things" from our suspicions and to help us focus on the possible culprit… now you have identified  WLAN autoconfig as a potential culprit, our next step would have been to recommend that you utilise a System Restore Point created before the problem started, as the inception of the problem with the Microsoft update is too much of a coincidence for my liking!  
 
Next if the above did not remedy the situation then  a Refresh of Win 8.1 (see below) might be wise.
https://support.microsoft.com/en-gb/help/17085/windows-8-restore-refresh-reset-pc


However if you post your logs for Juliet to take a look at in your previous topic (with a link to this topic here)
so she is aware of what has been going on it will be helpful as the malware you refer to does not seem to have been positively identified. when posting them it would be wise I think for you to mention why you ran them 4 times.
Regards
paws

PS as soon as you have posted your logs in the correct forum I will roll them up and remove the text from this forum

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI