Link to home
Start Free TrialLog in
Avatar of Lomed_Geoff
Lomed_Geoff

asked on

Laptop keeps closing/crashing

I have the Dell 1545 Laptop. Windows 7 Home User.
Some weeks ago I got this Hoaxware from "Security Master AV" which I removed by following virus removal instructions for this from www.bleepingcomputer.com.
At around the same time, on start-up, I got a message saying that my Dell Dock had failed to install - and I again searched the web and loaded a replacement for this and deleted the original dell dock (though on my uninstall programme shows this to be a Dell product version 1.0).
Again at around this time I found that my computer kept shutting down.  But I am not sure that the symptoms I am about to describe themselves, came before during or after the above steps were dealt with:
I noticed that I would come to the computer in the morning and find that it had restarted over night.  Other times I would be using it and after about an hour, the screen would sort of pixilate or freeze in parts of it and pressing the mouse anywhere on teh screen no longer did anything,  Seconds later the screen would go completely black.  The mouse curser remained in the shape of a thick white arrow and I could move it around but nothing else.  Nothing I pressed could bring it out of this "hibernation" and so I would have to do a hard reboot (and it would ask if I wanted to start normally etc).
The last time this happened I was actually in the middle of typing this to you a few minutes ago.  When Windows had restarted it asked me if I wished to restore my last internet browser sessisons and it actually brought me straight back to this screen and my half finished sentence was still there.  I only relate this in case it is significant in telling you about the black screen and how dead the laptop actually was - on the other hand I had done a hard reboot so maybe this is just a feature of windows 7....
When it restarts itself I often (but not always) find a dialogue screen has come up on Windows saying that the PC has blue screened.  Here is the message:
Problem signature:
  Problem Event Name:      BlueScreen
  OS Version:      6.1.7600.2.0.0.768.3
  Locale ID:      2057

Additional information about the problem:
  BCCode:      19
  BCP1:      00000022
  BCP2:      00000000
  BCP3:      00000000
  BCP4:      00000000
  OS Version:      6_1_7600
  Service Pack:      0_0
  Product:      768_1

Files that help describe the problem:
  C:\Windows\Minidump\081410-21793-01.dmp
  C:\Users\Charin\AppData\Local\Temp\WER-43399-0.sysdata.xml

Read our privacy statement online:
  http://go.microsoft.com/fwlink/?linkid=104288&clcid=0x0409

If the online privacy statement is not available, please read our privacy statement offline:
  C:\Windows\system32\en-US\erofflps.txt

I don't know whether the above is connected or not to the Hoax virus I had or to the Dell Dock issue.  I also have McAfee 3 User Licence, and whereas before and during the whole of the Hoax issue it was saying that the scan had passed without identifying any issues, now it says that my PC is at risk because I haven't got Anit-Virus and Spyware cover.  But I used to be able to simply select this/enable it.  Now it is asking me to purchase another McAfee product.  - so now I am also contacting them to find out why this is happening and why I suddenly don't have cover for that despite a valid licence and cover for their other choices eg Firewall Protection, Web Protection, Threats Detected.  I am worried though that this is really part of the problem and that something has control of my laptop...
Thanks
Geoffrey Charin
Avatar of mpkhan
mpkhan

Try to restart in safe mode... ?

See if you can.... ?

& update
Avatar of Lomed_Geoff

ASKER

I can start in safe mode but not clear what you want me to do when I have?
Avatar of Mohammed Basheer
Try to restore to a previous day that you dont expect the problem. Goto Safe Mode, Strat>Programs>Accessories>System TOols>System Restore. Brows through a previous month/date and restore to that day.

Gud luck
Zip the last 3 minidump files and attach them here.

There can be different causes for this, like bad RAM, Problems with the HD or filesystem, or bad drivers etc., and the minidumps could help pinpoint it.

Hi rindi, what is a minidump - are you referring to what Basheerpt has said?  I am confused!
It's a file that gets created by BSOD's, one of them is mentioned in the question you posted:

"Files that help describe the problem:
  C:\Windows\Minidump\081410-21793-01.dmp"

Just pick the latest 3 and zip them.
Found them - there are about 40 going back to 8th August.  Each are 143kb in size.  I tried to zip the last 3 but an error message comes  up saying File not Found or no Read Permission can I send you them without zipping?
Laptop has slowed right down again - can't save anything or close anything so it is about to crash.  Amazingly can still get this out
logged back in now but probably will crash again in 45 mins...
Did you boot into safe mode and do a system restore ?

All so if you want to check your memory go to http://www.memtest86.com/  and get memtest great tool for diagnosing memory.
It is possible that your laptop has accumulated a lot of dust in the fans, and causing your system to freeze up and pixelate. If you got a can of compressed air (can buy at any computer or electronics store), then blow out the air vents on your laptop. Hope that helps.
Open the Windows Explorer as Administrator (Right Click the Explorer Link and select "Run as Administrator", then if necessary input the correct credentials, and then you can copy and zip those files.
ASKER CERTIFIED SOLUTION
Avatar of kkoray
kkoray

Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
Ok - first thing I have done is gone to the memtest website as per Grant1842 and following that link I selected the link down that page: •Download - Pre-Compiled Memtest86 v3.4a installable from Windows and DOS
This then took me to  adirectory some levels dwon from Temporary Internet Files and there are 4 items there in the directory which is called memtest34A[1].  I selected the one called rawrite because it is the application:
This then said it would comment extracting files - but then nothing appeared to happen.  When I clicked it again it no longer gave me any other option than Run.  But when I select Run it says Attempt to Access Invalid Address.  So I am stuck at this point.
I don't (yet) have a compressed air can so have not yet explored that option.
I would like to follow also Kkoray's suggestions - but don't understand the instruction "I would like you to go to safemod with networking and run 2 programs they are free"
How do I go to "safemod with networking"?
Back to Rindi:
I followed your explanations to run as an administrator and then went back to the minidump directory and selected 3 or 4 example files as you suggested.  Having selected them I right clicked.  Then selected Send To which brought up several options.  I again selected "Compressed (zipped) Folder" and the same error message came up as before:  File not found or no read permission.
I tried this several times and I could see it was creating a zip file but then after the error message went away, the zip file disappeared too.  - Except for one occasion only when I selected just one file at random (from 11th Aug) and the zip file remained.  I have not been able to replicate this since even for a single file - so I must be doing something wrong.  But in the meantime I attached the single example I was able to somehow zip.  Is this enough?  Can you tell what I am doing wrong?
sorry clicked on submit too early - here is the attachment for Rindi:

081310-18782-01.zip
Ok. in order you to go to safemod, you need to press f8 before windows logo shows up so

After you power up your computer bios screen shows up press and release f8 button you can press as much as you need in order the catch the menu. When you got to the menu select  safe mod with networking.
if my instructions not clear you can read from here

http://vlaurie.com/computers2/Articles/safemode.htm

"How to Get to Safe Mode"

SOLUTION
Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
download or collect some live OS CDs like Ubuntu linux. Insert the cs in cd/dvd drive and boot. It will boot from the CD and will not install. Keep the machine up running for 1 hr. If the machine crashed/Restarted. Then the problem can be with hardware. You can suspect PC fan, Bad memory,...

If the machine is running fine in the Live CD boot, then problem is with ur WIndows os. In such case install latest service pack( WIndows Update ). Install Microsoft antivirus. It  is free and removes mal wares even in boot time
Thank you all.
I am about to run the safemod as instructed and then will attempt to compy the dmp files again.  Then I will try the memtest86+ - though I still don't know why I am doing this - I guess you can tell me when I have made it that far!
Want to also attempt Bnu Jose's advice but am not sure if this is a new track entirely or whether it is a continuation:  Is "download or collect some live OS CDs like Ubuntu linux" similar to creating the UBCD as instructed by rindi?
Can I for example perform the Live CD boot from the UBCD that I am going to try now to create?  Ok logging off now to restart in Safe....
Actually Rindi, just before logging off, I tried copying those files to another directory like you said and it appears to have worked - should be the most recent 5 DMP files in the zip attached!
081610-31449-01.zip
I have now gone into safemod and created the UBCD.  Then r
http://www.ubuntu.com/desktop/get-ubuntu/download

Once the CD is booted, Use "Try " option.

looks like one of my responses didn't load last night: I did run Spybot and it came up with many issues, fixed most of them but for the ones it couldn't fix it recommended that I reboot to clear memory and run it again. Also, when running the malware it said it had successfully cleared all the issues. So I did reboot and ran spybot - then went to bed.
In the morning two worrying things and maybe one good one:
The good one is that the PC had not crashed - but maybe that is because it is in safe mode?
The bad things were: A message from Mcafee saying that all protection was turned off. I wasn't able to switch anything back on. Again is this because it is in Safe mode?
Then the Spybot reported it still have about 15 issues (down from 147 originally) - but it couldn't fix any of these. When I tried to "fix" them, the following message came up in every case:
Unexpected error in fixing problems (cannot create file c:\windows\system32\drivers\etc\hosts Access is denied)
Rindi:  I have sent you some zip files - don't know if what is on there helps at all?
KKooray:  I think I have done all your suggestions.
Bnu Jose - still not sure whether you are telling me to ignore using the Ultimate Boot CD that I created last night following the steps Rindi outlined, or whether you are suggesting I create a second CD following your links?  Is the Ubuntu different to the CD I created?  Should I use the Ultimate Boot CD and enter "Try"?
I have to go to work now but will restart the computer in normal mode and see if it has crashed when I come back in the evening.   I will still see messages from you on my work computer so please do come back with pointers/advice/clarifications.
Thank you all for your help so far.
 
he good one is that the PC had not crashed -- means ur hardware is fine , no need to boot from live CD to check your hardware.

So focus to OS. remove all viruses. If your antivirus tools failed, uninstall them and Try http://www.microsoft.com/Security_Essentials/

After that try windows update
SOLUTION
Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
I was pleased to see that the Cmputer hadn't crashed during the whole of today - and it was not in Safe mode even.
Also, I ran the McAfee scan and it came up completely clean - and it hasn't done this for a while!
In light of this do you still advise removing McAfee?
Also, having done that,  do I load instead the Security Essentials from Microsoft, AND also the latest versions from Kaspersky?  Or is one of these enough?
Are you both saying that I should throw away the money I have spent on the 3 user licence for McAfee?  If you think this is worth it then I will do it but just want to be sure I understand...
Thanks
Geoffrey
Geoffrey,
It is my opinion that mcafee or norton is not good. I use kaspersky and I'm very pleased.

If your computer haven't crashed yet. I would like you to go to windows update and do the all the updates.
also do the updates for adobe flash player and java. if you need to know how just ask me i will write it down. After this point.

I would say wait for mcafee to expire and buy a kaspersky  next time and you can email me for coupon codes.

Also run spybot once a month.
SOLUTION
Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
If you can not install updates to the McAfee product then you are only partially protected.  New anti-virus, or anti-malware definitions that are created, are usually created at least once/day. In order to protect yourself from new viruses or malware that come out, you need to be able to download the new definitions put out by your antivirus software. If you are unable to download updates then you need to install one that does work. Before you can install a new antivirus software you need to first unistall the old one. Both McAfee and Norton security products are often hard to remove. Even if you try to remove them using the add/remove program in the control panel, often you get error messages, or the software is not completely removed. You must therefore use the software removal tools that can be downloaded at the respective sites.
SOLUTION
Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
I would like to do all the updates suggested - presumably I get the windows updates from Microsofts website but would be grateful Kkoray, if you could tell me how to get the Java and Adobe flashplayer updates.  Thank you for the tip on Kaspersky and I will do this when the Mcafee expires.
By the way I ran updates on McAfee and it seemed to go okay with no issues being found on the scans I am carrying out either.
So I will retain Mcafee for now but still run the Microsoft Security_Essentials as BnuJose, you have suggestd.  And thanks for the tip on the Admin separation.
Rindi - not sure what to make of the information provided by the dump files.  I do use two banking programmes:  First Direct and Nationwide.  I will try to contact them and ask if they can help.  But if Spybot and Mcafee are not finding anything now and no more dump files are being created, is it possible that these files are now repaired?
No new dmp files created since 16 August...
Regards
Geoffrey
I think you should still try installing the newest version of the trusteer software, it is from the site below:

http://www.trusteer.com/

About the other recommendation you got concerning your AV tools. don't have more than one such tool installed at the same time. So either use mcafee or M$ Security essentials, but not both. Having more than one installed can cause issues between them. also, I can't say whether mcafee is bad or kaspersky good, I don't use either. But I'd think both are better than m$'s security essentials. If mcafee updates fine now I'd probably keep it.

Personally I use only free products, and I've been very happy with Panda Cloud antivirus (this tool runs from the "Cloud", and is always as up-to date as possible, as you don't have to get the definitions yourself), and another tool I used before panda was Avast! Home. I've never had issues on my PC's with those. With Avast! I've seen problems on other PC's, but that was mainly because the users hadn't registered it for another year, so it expired...

If you want to check the system with an AV tool other than the one you have installed, use one of the onlinetools, like trendmicro's housecall, which doesn't get into troubles with your installed tool, or use one that doesn't do any real-time scanning.
one step forward two steps backward:  Got home tonight to find that there were two dialogue boxes on the desktop:  One was from McAfee saying it had made some updates and that I should restart the computer.  The other was another hoax message telling me that my computer was under attack and that I should protect my machine urgently and there was a button for me to select.  (At the bottom of the screen was a text line saying that McAfee scan had run and no problems found).
I used Alt F4 keys to close down as much as I could but then selected the restart key on the Mcafee.
The computer rebooted - and I can't get back into windows!
It starts to boot with the Dell sign coming up and a blue bar filling up underneath.  Bottom right it says F2 and F12 for boot options and setup.  Tried several times to start the laptop  pressing the F2 and F12 keys but nothing happens.  Also tried F8.  When the blue line fills up the screen goes completely black apart from a flashing cursor in the top left.
I also tried putting in the UBCD created earlier but it ignores it - though I can't swear that the CD has been correctly burned as it has never been tried.
It is possible by the way, that my teenage children have been using the PC during the day, but they are not around to ask.  Maybe they have gone to a website similar to whatever one caused the original issue?  McAfee doesn't seem to be doing its job though!
Frustrating beyone measure...
actually a development:  I got windows to start by detaching all the various connections via the USB ports:  This was a Monitor/TV;  a wireless device for mouse/keyboard; an Ipod; a printer.  So now running Spybot and Alt-F4ing as I feel like it to remove this new hoax message that is coming up all the time.
I have now got back to where I was before the recent two submissions I have made above: I isolated the start up problem to the ipod which presumably needs scanning itself now. My son has also confessed to being the source of the problem with his selection of websites - so things are looking up again :-)

Also, running the malware that I had previously loaded as recommended by Kkoray, removed the pop=up hoaxes. Malware and McAfee now both say that everything is clean - but not spybot!
This still says I have 16 instances - all of "redirected hosts". Originally it came up with a message saynig that I could not fix these until I had elevated to Administrator level. So I closed down spybot and reopened it by first right-clicking on the icon in the start menu and choosing "run as administrator".
Now the message I get for all 16 instances is:
Unexpected error in fixing problems. (Cannot create file "c:\windows\system32\drivers\etc\hosts". Access is denied
How do I get around this problem?
Thank you Rindi for your advice about Rapport which I will update.
My last remainng question before bringing this string to an end would be to ask Rindi about the UBCD which I have created but which doesn't seem to do anything (and  still want to run the memtest but don't know how).  Looking at the disc in Explorer shows that there are the following directories on it:
antivir
boot
pmagic
ubcd
It could be that McAfee is blocking access to the hosts file. Disable it while you are running spybot (disconnect your internet connection during that time so nothing new can come in). If that doesn't help, use windows explorer (open it as Administrator), navigate to the hosts file and right click it, then change it's security settings so the admin has full rights to it. You should probably be able to edit it yourself then and remove the redirections yourself without the help of spybot.

You should have an iso file from your UBCD download. To burn this you need a burning utility like CDBurnerXP, when you start that tool you have an option "Burn Iso Image". Select that and then the UBCD iso image you downloaded, select a the lowest burning speed available and burn the CD. You should then be able to boot your PC from that CD (the BIOS should have an option where you can change the boot priority, make sure the CD drive is first).

http://cdburnerxp.se/
adobe player update

http://get.adobe.com/flashplayer/

java update

http://www.java.com/en/download/index.jsp

do this updates. these programs have many security holes that hackers use to get in to your computer thru internet so do this updates too. you should be good after this.
Sorry for the delay in closing this - was getting help trying to understand how to award points for multiple solutions!
Looking over all of the responses it is clear that the solutions came from:
1) Using Spybot followed by Malware (Kkoray)
2) Advice on setting up an Ultimate Boot CD (although I never did understand the Memtest thing and how I was supposed to run this!) - Rindi
3) Rindi's advice and help on sifting through the minidump and reviewing these for me my have highlighted another issue on banking software (and it might have been an instance of the same virus) - v useful to know about these files and their messages
4) Kkoray's and BnuJose's advice on a more effective anit-virus software.
Really appreciated the time taken on the longer and more detailed but still patient answers!
Dear Tolomir - I don't know what more to do here - my last comment above was a detailed explanation of why I had split the points in the way I had.  I did this on the advice of your support team and I split the points.  This (12th Sept) was the second time that I have split points and believed that the question was complete.  
These guys were really helpful to me and I want them to have their points - but for some reason they are not holding in your system.  Maybe the next stage is for me simply to tell you via a message what points I am trying to award and to whom - and then you can go into the system and allocate for me?
Please advise
Kind Regards
Geoffrey
Yes! This seems to have worked - can you confirm?  Thank you for finally solving this one for me