Solved

Laptop keeps closing/crashing

Posted on 2010-08-15
42
597 Views
Last Modified: 2013-11-16
I have the Dell 1545 Laptop. Windows 7 Home User.
Some weeks ago I got this Hoaxware from "Security Master AV" which I removed by following virus removal instructions for this from www.bleepingcomputer.com.
At around the same time, on start-up, I got a message saying that my Dell Dock had failed to install - and I again searched the web and loaded a replacement for this and deleted the original dell dock (though on my uninstall programme shows this to be a Dell product version 1.0).
Again at around this time I found that my computer kept shutting down.  But I am not sure that the symptoms I am about to describe themselves, came before during or after the above steps were dealt with:
I noticed that I would come to the computer in the morning and find that it had restarted over night.  Other times I would be using it and after about an hour, the screen would sort of pixilate or freeze in parts of it and pressing the mouse anywhere on teh screen no longer did anything,  Seconds later the screen would go completely black.  The mouse curser remained in the shape of a thick white arrow and I could move it around but nothing else.  Nothing I pressed could bring it out of this "hibernation" and so I would have to do a hard reboot (and it would ask if I wanted to start normally etc).
The last time this happened I was actually in the middle of typing this to you a few minutes ago.  When Windows had restarted it asked me if I wished to restore my last internet browser sessisons and it actually brought me straight back to this screen and my half finished sentence was still there.  I only relate this in case it is significant in telling you about the black screen and how dead the laptop actually was - on the other hand I had done a hard reboot so maybe this is just a feature of windows 7....
When it restarts itself I often (but not always) find a dialogue screen has come up on Windows saying that the PC has blue screened.  Here is the message:
Problem signature:
  Problem Event Name:      BlueScreen
  OS Version:      6.1.7600.2.0.0.768.3
  Locale ID:      2057

Additional information about the problem:
  BCCode:      19
  BCP1:      00000022
  BCP2:      00000000
  BCP3:      00000000
  BCP4:      00000000
  OS Version:      6_1_7600
  Service Pack:      0_0
  Product:      768_1

Files that help describe the problem:
  C:\Windows\Minidump\081410-21793-01.dmp
  C:\Users\Charin\AppData\Local\Temp\WER-43399-0.sysdata.xml

Read our privacy statement online:
  http://go.microsoft.com/fwlink/?linkid=104288&clcid=0x0409

If the online privacy statement is not available, please read our privacy statement offline:
  C:\Windows\system32\en-US\erofflps.txt

I don't know whether the above is connected or not to the Hoax virus I had or to the Dell Dock issue.  I also have McAfee 3 User Licence, and whereas before and during the whole of the Hoax issue it was saying that the scan had passed without identifying any issues, now it says that my PC is at risk because I haven't got Anit-Virus and Spyware cover.  But I used to be able to simply select this/enable it.  Now it is asking me to purchase another McAfee product.  - so now I am also contacting them to find out why this is happening and why I suddenly don't have cover for that despite a valid licence and cover for their other choices eg Firewall Protection, Web Protection, Threats Detected.  I am worried though that this is really part of the problem and that something has control of my laptop...
Thanks
Geoffrey Charin
0
Comment
Question by:Lomed_Geoff
  • 19
  • 7
  • 5
  • +5
42 Comments
 

Expert Comment

by:mpkhan
ID: 33440371
Try to restart in safe mode... ?

See if you can.... ?

& update
0
 

Author Comment

by:Lomed_Geoff
ID: 33440480
I can start in safe mode but not clear what you want me to do when I have?
0
 
LVL 5

Expert Comment

by:Basheerpt
ID: 33440485
Try to restore to a previous day that you dont expect the problem. Goto Safe Mode, Strat>Programs>Accessories>System TOols>System Restore. Brows through a previous month/date and restore to that day.

Gud luck
0
 
LVL 87

Expert Comment

by:rindi
ID: 33440500
Zip the last 3 minidump files and attach them here.

There can be different causes for this, like bad RAM, Problems with the HD or filesystem, or bad drivers etc., and the minidumps could help pinpoint it.

0
 

Author Comment

by:Lomed_Geoff
ID: 33440511
Hi rindi, what is a minidump - are you referring to what Basheerpt has said?  I am confused!
0
 
LVL 87

Expert Comment

by:rindi
ID: 33440524
It's a file that gets created by BSOD's, one of them is mentioned in the question you posted:

"Files that help describe the problem:
  C:\Windows\Minidump\081410-21793-01.dmp"

Just pick the latest 3 and zip them.
0
 

Author Comment

by:Lomed_Geoff
ID: 33440686
Found them - there are about 40 going back to 8th August.  Each are 143kb in size.  I tried to zip the last 3 but an error message comes  up saying File not Found or no Read Permission can I send you them without zipping?
0
 

Author Comment

by:Lomed_Geoff
ID: 33440696
Laptop has slowed right down again - can't save anything or close anything so it is about to crash.  Amazingly can still get this out
0
 

Author Comment

by:Lomed_Geoff
ID: 33440762
logged back in now but probably will crash again in 45 mins...
0
 
LVL 12

Expert Comment

by:Grant1842
ID: 33440848
Did you boot into safe mode and do a system restore ?

All so if you want to check your memory go to http://www.memtest86.com/  and get memtest great tool for diagnosing memory.
0
 
LVL 18

Expert Comment

by:web_tracker
ID: 33440849
It is possible that your laptop has accumulated a lot of dust in the fans, and causing your system to freeze up and pixelate. If you got a can of compressed air (can buy at any computer or electronics store), then blow out the air vents on your laptop. Hope that helps.
0
 
LVL 87

Expert Comment

by:rindi
ID: 33440863
Open the Windows Explorer as Administrator (Right Click the Explorer Link and select "Run as Administrator", then if necessary input the correct credentials, and then you can copy and zip those files.
0
 
LVL 3

Accepted Solution

by:
kkoray earned 205 total points
ID: 33441187
Ny guess is your laptop is still infected. I would like you to go to safemod with networking and run 2 programs they are free


spybot.info  go this website download spybot install it do the updates and click search and fix the problems after you do this go

http://www.malwarebytes.org/mbam.php

download this install it and update it then search for malware clean it out restart your computer and see if you are still experiencing problems.




0
 

Author Comment

by:Lomed_Geoff
ID: 33442283
Ok - first thing I have done is gone to the memtest website as per Grant1842 and following that link I selected the link down that page: •Download - Pre-Compiled Memtest86 v3.4a installable from Windows and DOS
This then took me to  adirectory some levels dwon from Temporary Internet Files and there are 4 items there in the directory which is called memtest34A[1].  I selected the one called rawrite because it is the application:
This then said it would comment extracting files - but then nothing appeared to happen.  When I clicked it again it no longer gave me any other option than Run.  But when I select Run it says Attempt to Access Invalid Address.  So I am stuck at this point.
I don't (yet) have a compressed air can so have not yet explored that option.
I would like to follow also Kkoray's suggestions - but don't understand the instruction "I would like you to go to safemod with networking and run 2 programs they are free"
How do I go to "safemod with networking"?
Back to Rindi:
I followed your explanations to run as an administrator and then went back to the minidump directory and selected 3 or 4 example files as you suggested.  Having selected them I right clicked.  Then selected Send To which brought up several options.  I again selected "Compressed (zipped) Folder" and the same error message came up as before:  File not found or no read permission.
I tried this several times and I could see it was creating a zip file but then after the error message went away, the zip file disappeared too.  - Except for one occasion only when I selected just one file at random (from 11th Aug) and the zip file remained.  I have not been able to replicate this since even for a single file - so I must be doing something wrong.  But in the meantime I attached the single example I was able to somehow zip.  Is this enough?  Can you tell what I am doing wrong?
0
 

Author Comment

by:Lomed_Geoff
ID: 33442298
sorry clicked on submit too early - here is the attachment for Rindi:

081310-18782-01.zip
0
 
LVL 3

Expert Comment

by:kkoray
ID: 33443438
Ok. in order you to go to safemod, you need to press f8 before windows logo shows up so

After you power up your computer bios screen shows up press and release f8 button you can press as much as you need in order the catch the menu. When you got to the menu select  safe mod with networking.
if my instructions not clear you can read from here

http://vlaurie.com/computers2/Articles/safemode.htm

"How to Get to Safe Mode"

0
 
LVL 87

Assisted Solution

by:rindi
rindi earned 220 total points
ID: 33443478
I can't seem to find any data in that file. Try first copying them to another location, and zip them afterwards. If that can't be done in your normal windows, start windows into "safe-mode". You mention you didn't know how to get into safe mode, so here is how:

When booting the PC, just after the BIOS screen has disappeared, press F8 a couple of times in succession. this should bring up a menu with different ways and modes to start windows in, and one of them should be safe-mode. Just select that. If you don't get that menu just try it again at next boot, sometimes it is a bit of a problem to hit the F8 key at the right time. The try copying those dumps again and zipping them later.

Memtest86+ is a utility you boot from a CD or Floppy, and the files they have for download are either floppy or CD images. I don't recommend using the the download from memtest directly though, but rather use the UBCD which is a set of free utilities on one booting CD which already includes memtest86+. This is much more useful as you don't use a CD for just one small tool, but have a collection. The Link below has download links for the UBCD and also instructions on how to burn it:

http://ultimatebootcd.com

What you get is an iso file, and iso files are burnt directly to CD using a burning utility like CDBurnerXP in which you select the "Burn iso" option. Also that burning utility is free and very good:

http://cdburnerxp.se/
0
 

Expert Comment

by:BnuJose
ID: 33443574
download or collect some live OS CDs like Ubuntu linux. Insert the cs in cd/dvd drive and boot. It will boot from the CD and will not install. Keep the machine up running for 1 hr. If the machine crashed/Restarted. Then the problem can be with hardware. You can suspect PC fan, Bad memory,...

If the machine is running fine in the Live CD boot, then problem is with ur WIndows os. In such case install latest service pack( WIndows Update ). Install Microsoft antivirus. It  is free and removes mal wares even in boot time
0
 

Author Comment

by:Lomed_Geoff
ID: 33450221
Thank you all.
I am about to run the safemod as instructed and then will attempt to compy the dmp files again.  Then I will try the memtest86+ - though I still don't know why I am doing this - I guess you can tell me when I have made it that far!
Want to also attempt Bnu Jose's advice but am not sure if this is a new track entirely or whether it is a continuation:  Is "download or collect some live OS CDs like Ubuntu linux" similar to creating the UBCD as instructed by rindi?
Can I for example perform the Live CD boot from the UBCD that I am going to try now to create?  Ok logging off now to restart in Safe....
0
 

Author Comment

by:Lomed_Geoff
ID: 33450241
Actually Rindi, just before logging off, I tried copying those files to another directory like you said and it appears to have worked - should be the most recent 5 DMP files in the zip attached!
081610-31449-01.zip
0
How to run any project with ease

Manage projects of all sizes how you want. Great for personal to-do lists, project milestones, team priorities and launch plans.
- Combine task lists, docs, spreadsheets, and chat in one
- View and edit from mobile/offline
- Cut down on emails

 

Author Comment

by:Lomed_Geoff
ID: 33450772
I have now gone into safemod and created the UBCD.  Then r
0
 

Expert Comment

by:BnuJose
ID: 33450970
http://www.ubuntu.com/desktop/get-ubuntu/download

Once the CD is booted, Use "Try " option.
0
 

Author Comment

by:Lomed_Geoff
ID: 33452239

looks like one of my responses didn't load last night: I did run Spybot and it came up with many issues, fixed most of them but for the ones it couldn't fix it recommended that I reboot to clear memory and run it again. Also, when running the malware it said it had successfully cleared all the issues. So I did reboot and ran spybot - then went to bed.
In the morning two worrying things and maybe one good one:
The good one is that the PC had not crashed - but maybe that is because it is in safe mode?
The bad things were: A message from Mcafee saying that all protection was turned off. I wasn't able to switch anything back on. Again is this because it is in Safe mode?
Then the Spybot reported it still have about 15 issues (down from 147 originally) - but it couldn't fix any of these. When I tried to "fix" them, the following message came up in every case:
Unexpected error in fixing problems (cannot create file c:\windows\system32\drivers\etc\hosts Access is denied)
Rindi:  I have sent you some zip files - don't know if what is on there helps at all?
KKooray:  I think I have done all your suggestions.
Bnu Jose - still not sure whether you are telling me to ignore using the Ultimate Boot CD that I created last night following the steps Rindi outlined, or whether you are suggesting I create a second CD following your links?  Is the Ubuntu different to the CD I created?  Should I use the Ultimate Boot CD and enter "Try"?
I have to go to work now but will restart the computer in normal mode and see if it has crashed when I come back in the evening.   I will still see messages from you on my work computer so please do come back with pointers/advice/clarifications.
Thank you all for your help so far.
 
0
 

Expert Comment

by:BnuJose
ID: 33452607
he good one is that the PC had not crashed -- means ur hardware is fine , no need to boot from live CD to check your hardware.

So focus to OS. remove all viruses. If your antivirus tools failed, uninstall them and Try http://www.microsoft.com/Security_Essentials/

After that try windows update
0
 
LVL 3

Assisted Solution

by:kkoray
kkoray earned 205 total points
ID: 33458988
hold on don't install the anti virus that bnujose show you yet. we have to remove your mcafee first.it is good that you clean all the viruses on  your computer.

you need to remove the mcafee it is probably messed up. you can reinstall it later.

http://download.mcafee.com/products/licensed/cust_support_patches/MCPR.exe
download this and remove the mcafee from your computer.

after you did that. like bnujose said update your windows go to windows update and do all the updates. after that is completed. either reinstall your mcafee but download last version from their website or you can install free anti virus
http://www.microsoft.com/Security_Essentials/

http://www.kaspersky.com/kav_latest_versions   i prefer you to use this one 30 day trial. I use this  one in every company i do support for. i believe it is much better then mcafee.





0
 

Author Comment

by:Lomed_Geoff
ID: 33460062
I was pleased to see that the Cmputer hadn't crashed during the whole of today - and it was not in Safe mode even.
Also, I ran the McAfee scan and it came up completely clean - and it hasn't done this for a while!
In light of this do you still advise removing McAfee?
Also, having done that,  do I load instead the Security Essentials from Microsoft, AND also the latest versions from Kaspersky?  Or is one of these enough?
Are you both saying that I should throw away the money I have spent on the 3 user licence for McAfee?  If you think this is worth it then I will do it but just want to be sure I understand...
Thanks
Geoffrey
0
 
LVL 3

Expert Comment

by:kkoray
ID: 33460186
Geoffrey,
It is my opinion that mcafee or norton is not good. I use kaspersky and I'm very pleased.

If your computer haven't crashed yet. I would like you to go to windows update and do the all the updates.
also do the updates for adobe flash player and java. if you need to know how just ask me i will write it down. After this point.

I would say wait for mcafee to expire and buy a kaspersky  next time and you can email me for coupon codes.

Also run spybot once a month.
0
 

Assisted Solution

by:BnuJose
BnuJose earned 75 total points
ID: 33460796
In my experience,   http://www.microsoft.com/Security_Essentials/ alone is enough.

Generally for reducing the threat.
- Create a user with administrator privilege and have a password for admin
- remove the admin privilege of the user in which you usually login
- Never login as Admin unless you are sure that you are going to install something you need.After that Log off admin immediately.
0
 
LVL 18

Expert Comment

by:web_tracker
ID: 33461800
If you can not install updates to the McAfee product then you are only partially protected.  New anti-virus, or anti-malware definitions that are created, are usually created at least once/day. In order to protect yourself from new viruses or malware that come out, you need to be able to download the new definitions put out by your antivirus software. If you are unable to download updates then you need to install one that does work. Before you can install a new antivirus software you need to first unistall the old one. Both McAfee and Norton security products are often hard to remove. Even if you try to remove them using the add/remove program in the control panel, often you get error messages, or the software is not completely removed. You must therefore use the software removal tools that can be downloaded at the respective sites.
0
 
LVL 87

Assisted Solution

by:rindi
rindi earned 220 total points
ID: 33462079
Sorry I'm a bit late with the results of the crash dump files, but I was busy with other things yesterday. Anyway, I've checked them now, and all except one point to a file "RapportPG.sys" which caused the crash. I don't know what that file is for, but from what I've been able to find it seems to be a software that gets installed into "C:\Program Files\trusteer\rapport......". From what I've found out this seems to be some online banking software. Check if that software can be updated with new versions or if there have been reported issues with it.

The other dump was caused by easyshare, so also check for an update for that software.

If there are no updates for one of the tools above, uninstall them, then if you need them install them again. Maybe the malware you previously had manipulated those tools.
0
 

Author Comment

by:Lomed_Geoff
ID: 33470688
I would like to do all the updates suggested - presumably I get the windows updates from Microsofts website but would be grateful Kkoray, if you could tell me how to get the Java and Adobe flashplayer updates.  Thank you for the tip on Kaspersky and I will do this when the Mcafee expires.
By the way I ran updates on McAfee and it seemed to go okay with no issues being found on the scans I am carrying out either.
So I will retain Mcafee for now but still run the Microsoft Security_Essentials as BnuJose, you have suggestd.  And thanks for the tip on the Admin separation.
Rindi - not sure what to make of the information provided by the dump files.  I do use two banking programmes:  First Direct and Nationwide.  I will try to contact them and ask if they can help.  But if Spybot and Mcafee are not finding anything now and no more dump files are being created, is it possible that these files are now repaired?
No new dmp files created since 16 August...
Regards
Geoffrey
0
 
LVL 87

Expert Comment

by:rindi
ID: 33472379
I think you should still try installing the newest version of the trusteer software, it is from the site below:

http://www.trusteer.com/

About the other recommendation you got concerning your AV tools. don't have more than one such tool installed at the same time. So either use mcafee or M$ Security essentials, but not both. Having more than one installed can cause issues between them. also, I can't say whether mcafee is bad or kaspersky good, I don't use either. But I'd think both are better than m$'s security essentials. If mcafee updates fine now I'd probably keep it.

Personally I use only free products, and I've been very happy with Panda Cloud antivirus (this tool runs from the "Cloud", and is always as up-to date as possible, as you don't have to get the definitions yourself), and another tool I used before panda was Avast! Home. I've never had issues on my PC's with those. With Avast! I've seen problems on other PC's, but that was mainly because the users hadn't registered it for another year, so it expired...

If you want to check the system with an AV tool other than the one you have installed, use one of the onlinetools, like trendmicro's housecall, which doesn't get into troubles with your installed tool, or use one that doesn't do any real-time scanning.
0
 

Author Comment

by:Lomed_Geoff
ID: 33480038
one step forward two steps backward:  Got home tonight to find that there were two dialogue boxes on the desktop:  One was from McAfee saying it had made some updates and that I should restart the computer.  The other was another hoax message telling me that my computer was under attack and that I should protect my machine urgently and there was a button for me to select.  (At the bottom of the screen was a text line saying that McAfee scan had run and no problems found).
I used Alt F4 keys to close down as much as I could but then selected the restart key on the Mcafee.
The computer rebooted - and I can't get back into windows!
It starts to boot with the Dell sign coming up and a blue bar filling up underneath.  Bottom right it says F2 and F12 for boot options and setup.  Tried several times to start the laptop  pressing the F2 and F12 keys but nothing happens.  Also tried F8.  When the blue line fills up the screen goes completely black apart from a flashing cursor in the top left.
I also tried putting in the UBCD created earlier but it ignores it - though I can't swear that the CD has been correctly burned as it has never been tried.
It is possible by the way, that my teenage children have been using the PC during the day, but they are not around to ask.  Maybe they have gone to a website similar to whatever one caused the original issue?  McAfee doesn't seem to be doing its job though!
Frustrating beyone measure...
0
 

Author Comment

by:Lomed_Geoff
ID: 33481376
actually a development:  I got windows to start by detaching all the various connections via the USB ports:  This was a Monitor/TV;  a wireless device for mouse/keyboard; an Ipod; a printer.  So now running Spybot and Alt-F4ing as I feel like it to remove this new hoax message that is coming up all the time.
0
 

Author Comment

by:Lomed_Geoff
ID: 33495822
I have now got back to where I was before the recent two submissions I have made above: I isolated the start up problem to the ipod which presumably needs scanning itself now. My son has also confessed to being the source of the problem with his selection of websites - so things are looking up again :-)

Also, running the malware that I had previously loaded as recommended by Kkoray, removed the pop=up hoaxes. Malware and McAfee now both say that everything is clean - but not spybot!
This still says I have 16 instances - all of "redirected hosts". Originally it came up with a message saynig that I could not fix these until I had elevated to Administrator level. So I closed down spybot and reopened it by first right-clicking on the icon in the start menu and choosing "run as administrator".
Now the message I get for all 16 instances is:
Unexpected error in fixing problems. (Cannot create file "c:\windows\system32\drivers\etc\hosts". Access is denied
How do I get around this problem?
Thank you Rindi for your advice about Rapport which I will update.
My last remainng question before bringing this string to an end would be to ask Rindi about the UBCD which I have created but which doesn't seem to do anything (and  still want to run the memtest but don't know how).  Looking at the disc in Explorer shows that there are the following directories on it:
antivir
boot
pmagic
ubcd
0
 
LVL 87

Expert Comment

by:rindi
ID: 33495890
It could be that McAfee is blocking access to the hosts file. Disable it while you are running spybot (disconnect your internet connection during that time so nothing new can come in). If that doesn't help, use windows explorer (open it as Administrator), navigate to the hosts file and right click it, then change it's security settings so the admin has full rights to it. You should probably be able to edit it yourself then and remove the redirections yourself without the help of spybot.

You should have an iso file from your UBCD download. To burn this you need a burning utility like CDBurnerXP, when you start that tool you have an option "Burn Iso Image". Select that and then the UBCD iso image you downloaded, select a the lowest burning speed available and burn the CD. You should then be able to boot your PC from that CD (the BIOS should have an option where you can change the boot priority, make sure the CD drive is first).

http://cdburnerxp.se/
0
 
LVL 3

Expert Comment

by:kkoray
ID: 33496169
adobe player update

http://get.adobe.com/flashplayer/

java update

http://www.java.com/en/download/index.jsp

do this updates. these programs have many security holes that hackers use to get in to your computer thru internet so do this updates too. you should be good after this.
0
 

Author Comment

by:Lomed_Geoff
ID: 33656394
Sorry for the delay in closing this - was getting help trying to understand how to award points for multiple solutions!
Looking over all of the responses it is clear that the solutions came from:
1) Using Spybot followed by Malware (Kkoray)
2) Advice on setting up an Ultimate Boot CD (although I never did understand the Memtest thing and how I was supposed to run this!) - Rindi
3) Rindi's advice and help on sifting through the minidump and reviewing these for me my have highlighted another issue on banking software (and it might have been an instance of the same virus) - v useful to know about these files and their messages
4) Kkoray's and BnuJose's advice on a more effective anit-virus software.
Really appreciated the time taken on the longer and more detailed but still patient answers!
0
 

Author Comment

by:Lomed_Geoff
ID: 34080640
Dear Tolomir - I don't know what more to do here - my last comment above was a detailed explanation of why I had split the points in the way I had.  I did this on the advice of your support team and I split the points.  This (12th Sept) was the second time that I have split points and believed that the question was complete.  
These guys were really helpful to me and I want them to have their points - but for some reason they are not holding in your system.  Maybe the next stage is for me simply to tell you via a message what points I am trying to award and to whom - and then you can go into the system and allocate for me?
Please advise
Kind Regards
Geoffrey
0
 

Author Comment

by:Lomed_Geoff
ID: 34080744
Yes! This seems to have worked - can you confirm?  Thank you for finally solving this one for me
0

Featured Post

Free Trending Threat Insights Every Day

Enhance your security with threat intelligence from the web. Get trending threat insights on hackers, exploits, and suspicious IP addresses delivered to your inbox with our free Cyber Daily.

Join & Write a Comment

SHARE your personal details only on a NEED to basis. Take CHARGE and SECURE your IDENTITY. How do I then PROTECT myself and stay in charge of my own Personal details (and) - MY own WAY...
In this article you will get to know about pros and cons of storage drives HDD, SSD and SSHD.
It is a freely distributed piece of software for such tasks as photo retouching, image composition and image authoring. It works on many operating systems, in many languages.
Internet Business Fax to Email Made Easy - With eFax Corporate (http://www.enterprise.efax.com), you'll receive a dedicated online fax number, which is used the same way as a typical analog fax number. You'll receive secure faxes in your email, fr…

747 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

12 Experts available now in Live!

Get 1:1 Help Now