[navyblue161]

Hello,

  I've used you guys before for my own personal computer and I'd love some help now for a friend's laptop. She brought it to me a couple days ago upon it blue screening. When I looked at the minidump files I could see there was a lot of them; at least a dozen, so I guess it has been going on longer than I thought. I haven't tried much besides some basic elimination. I ran a hardware test and it passed. I also did a disk check, ran several antivirus portable scans, and did some basic cleaning. When trying to connect to the internet it blue screened for me. This could be towards the root of the problem (although I'm not sure that would even be a cause, maybe a symptom instead) as she said it happens with the internet often and I couldn't get it to connect to my network via wireless or ethernet. It's always possible it was just my internet too. Seeing as it is not my computer, I didn't want to try anything extensive without any professional help. If there is any help you could offer us it would be greatly appreciated. Thank you so much in advance!

[Advertisements]

Hello navyblue161,

 

1. Copy any dmp files from C:\Windows\Minidump onto the desktop.

2. Select all of them, right-click on one, and click on Send To> New Compressed (zipped) Folder.

3. Upload the zip folder using the Attach button, bottom left of the dialogue input box 

 

Download then run Speccy (free) and post the resultant url for us, details here,  this will provide us with information about the computer hardware + any software that you is installed that may explain the present issue/s. 

 

NB: If the computer will not connect to the internet try temporarily disabling the AV protection while you download and run Speccy etc, once done disconnect from the internet and re-enable the AV software.

[phillpower2]

Hello navyblue161,

 

1. Copy any dmp files from C:\Windows\Minidump onto the desktop.

2. Select all of them, right-click on one, and click on Send To> New Compressed (zipped) Folder.

3. Upload the zip folder using the Attach button, bottom left of the dialogue input box 

 

Download then run Speccy (free) and post the resultant url for us, details here,  this will provide us with information about the computer hardware + any software that you is installed that may explain the present issue/s. 

 

NB: If the computer will not connect to the internet try temporarily disabling the AV protection while you download and run Speccy etc, once done disconnect from the internet and re-enable the AV software.

[navyblue161]

Thank you so much for your help! So far the internet won't connect whatsoever on the laptop. I can get the minidump files that you asked for and post them a little later today, but the other program isn't working. It's giving me some sort of error when I attempt to use it. What would you suggest I do for that?

[phillpower2]

Not heard from you for a while navyblue161, do you still require assistance or is the issue now resolved, an update would be appreciated.

[navyblue161]

I wrote a reply on the 23rd of April saying I was having troubles with the program you told me to use. Did it not go through? I'm sorry if for some reason my post didn't work. I was on a four day trip before so I haven't had time to get the mini dump files posted, but I'll make sure to get that done tomorrow. Thank you for checking up with me to see what was going on!

Edited by navyblue161, 03 May 2015 - 03:34 PM.

[phillpower2]

Crossed wires as I was waiting on the crash dumps before replying 

 

the other program isn't working. It's giving me some sort of error when I attempt to use it

 

 

Can you tell us what the error was and have you tried temporarily disabling the AV as suggested in reply #2

[navyblue161]

Don't worry about it! Since I was out of town I had my friend trying what you suggested so I'm not exactly sure what the error was (she's not exactly a tech person so the details I'm getting are a little cloudy). I will have the computer back in my possession tomorrow so I can try it for myself and let you know. The internet is still not working on it however. Will it work for me to download the application from my own laptop and transfer it with a USB? I can't think of any other way to try out Speccy without it.

[Plastic Nev]

Hi, till Phillpower gets back to you, yes you can download the installation file for Speccy to your computer, then copy that direct to a USB drive and then copy to the problem laptop. Once copied over a double click on the file should launch the installation.

For ease, here is a direct download link for Speccy (It starts the download once opened, just accept the prompt)

 

http://www.piriform....wnload/standard

 

Nev.

[phillpower2]

Thanks Nev 

 

To add to what Nev has said above, try connecting the notebook direct to an ethernet cable to see if you get internet access.

[navyblue161]

Thanks Nev! I'll make sure to try it again tomorrow.  I really appreciate the help you guys have given me. And sadly Phil I've already tried that and it doesn't work. Be it the Ethernet or the wifi it will say it is connected to the network, but won't have any actual internet connection. The trouble shooter has never been able to identify the problem. I've also tested it on several networks, including my own, to make sure it wasn't the network and it doesn't work no matter where I try and connect it to. My friend said she hasn't been able to connect to the internet in a while.

[Plastic Nev]

Once you have Speccy installed on the laptop, you will not be able to use the "Publish snapshot" feature while on the laptop as that requires an internet connection.

Here is what should work.

Once speccy is opened and gathered all the information (Takes a few seconds)

On top left click on "File"

Select "Save snapshot" and navigate to the flash drive to save it on.

 

Then connect the flash drive to your computer and copy the file over and open it (You will possibly need Speccy to be installed on your computer, it's worth having anyway)

Once the saved snapshot is opened, you should hopefully be able to publish it then. It will give you a URL, just copy and paste it into your reply.

 

Nev.

[navyblue161]

Alrighty sorry it took me so long, but I have everything here. I'm not sure why or how my friend got the error message, but Speccy worked for me. I assume it had to do with what Nev was saying with not being able to publish it without internet. Here is the link you need for my friend's computer and I've also attached the minidump files. Thanks a bunch!

 

http://speccy.pirifo...6bsqDzrGAX55zHh

Attached Files

•  Minidump Files.zip   410.72KB   335 downloads

Edited by navyblue161, 05 May 2015 - 04:46 PM.

[phillpower2]

Best Answer

Having looked at the Speccy log and a couple of the latest dump files (both showed the same culprit**) I strongly suspect the cause of the problem is that there are multiple Firewall/toolbar related softwares installed (but no real time protection AV running) see list below followed by the recommended remedial steps;

 

Running: COMODO Dragon Update Service

Running: Windows Defender

Running: Windows Firewall

Stopped: Norton Security Suite

dragon.exe

Process ID: 2568

User: Hail

Domain: Darkness

Path: C:\Program Files (x86)\Comodo\Dragon\dragon.exe

Memory Usage: 23 MB

Peak Memory Usage: 23 MB

dragon.exe

Process ID: 5748

User: Hail

Domain: Darkness

Path: C:\Program Files (x86)\Comodo\Dragon\dragon.exe

Memory Usage: 23 MB

Peak Memory Usage: 23 MB

dragon.exe

Process ID: 5568

User: Hail

Domain: Darkness

Path: C:\Program Files (x86)\Comodo\Dragon\dragon.exe

Memory Usage: 23 MB

Peak Memory Usage: 23 MB

dragon.exe

Process ID: 5804

User: Hail

Domain: Darkness

Path: C:\Program Files (x86)\Comodo\Dragon\dragon.exe

Memory Usage: 44 MB

Peak Memory Usage: 44 MB

dragon.exe

Process ID: 4992

User: Hail

Domain: Darkness

Path: C:\Program Files (x86)\Comodo\Dragon\dragon.exe

Memory Usage: 22 MB

Peak Memory Usage: 27 MB

dragon.exe

Process ID: 5132

User: Hail

Domain: Darkness

Path: C:\Program Files (x86)\Comodo\Dragon\dragon.exe

Memory Usage: 6.74 MB

Peak Memory Usage: 6.74 MB

dragon_updater.exe

Process ID: 1764

User: SYSTEM

Domain: NT AUTHORITY

Path: C:\Program Files (x86)\Comodo\Dragon\dragon_updater.exe

Memory Usage: 8.42 MB

Peak Memory Usage: 8.68 MB

 

IDVault.exe

Process ID: 3676

User: Hail

Domain: Darkness

Path: C:\Program Files (x86)\Constant Guard Protection Suite\IDVault.exe

Memory Usage: 77 MB

Peak Memory Usage: 89 MB

 

loggingserver.exe

Process ID: 2168

User: SYSTEM

Domain: NT AUTHORITY

Path: C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\18.1.9\loggingserver.exe

Memory Usage: 4.05 MB

Peak Memory Usage: 4.07 MB

 

Raptor.exe

Process ID: 3680

User: Hail

Domain: Darkness

Path: C:\Program Files\McAfee\Raptor\Raptor.exe

Memory Usage: 73 MB

Peak Memory Usage: 79 MB

 

ToolbarUpdater.exe

Process ID: 2056

User: SYSTEM

Domain: NT AUTHORITY

Path: C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\18.1.9\ToolbarUpdater.exe

Memory Usage: 6.88 MB

Peak Memory Usage: 7.01 MB

 

 

vprot.exe

Process ID: 4620

User: Hail

Domain: Darkness

Path: C:\Program Files (x86)\AVG Secure Search\vprot.exe

Memory Usage: 15 MB

Peak Memory Usage: 16 MB

 

Let us know if Comodo is a paid for or free product.

 

Run the Norton removal tool which can be found here

 

Same for AVG removal, details here

 

McAfee removal here

 

Download/install one of the following AVs Avast! free Antivirus to the bottom left here or MSE from here

 

 

The following scheduled tasks need to be uninstalled or disabled as appropriate;

 

Scheduler

5/5/2015 5:21 PM;: Adobe Flash Player Updater

5/5/2015 5:54 PM;: DealPly

5/5/2015 5:54 PM;: DealPlyUpdate

5/5/2015 10:51 PM;: Funmoods

5/6/2015 4:06 PM;: SystemToolsDailyTest

6/1/2015 4:00 PM;: PCDoctorBackgroundMonitorTask

AVG-Secure-Search-Update_JUNE2013_HP_rmv 

AVG-Secure-Search-Update_JUNE2013_TB_rmv

PCDEventLauncherTask

PowerInbox Updater

Uninstaller_SkipUac_Hail

 

Any no longer used printers and/or wireless adapters/access points should also be uninstalled once the above has been addressed, we can come back to this as and when.

 

** Edit to add the following which I forgot to include earlier 

STACK_TEXT:
fffff880`033c40e8 fffff800`0327c169 : 00000000`0000000a 00000000`00000000 00000000`00000002 00000000`00000001 : nt!KeBugCheckEx
fffff880`033c40f0 fffff800`0327ade0 : 00000000`00000010 fffff880`033c4420 00000000`00000003 00000000`00000000 : nt!KiBugCheckDispatch+0x69
fffff880`033c4230 fffff800`03285c3f : 00000000`00000003 00000000`00000001 00000000`00000003 00000000`00000001 : nt!KiPageFault+0x260
fffff880`033c43c0 fffff880`0182b9c7 : 00000000`00000004 fffff880`033c46a0 00000000`00008900 fffffa80`077a17c8 : nt!KeAcquireInStackQueuedSpinLockAtDpcLevel+0x4f
fffff880`033c4410 fffff880`01ae508d : fffffa80`0a434160 fffffa80`0a7acdb0 fffff880`033c46a0 00000000`00008900 : NETIO!WfpExpireEntryLru+0x17
fffff880`033c4460 fffff880`01aac7b7 : 00000000`00000004 fffff880`00000030 fffff8a0`00004850 00000000`00000001 : tcpip!WfpAleCloseRemoteEndpointConnection+0x2d
fffff880`033c4490 fffff880`01b24e5b : fffffa80`0a434160 fffffa80`0a579b3a 00000000`00000001 fffffa80`0a434160 : tcpip! ?? ::FNODOBFM::`string'+0x20f72
fffff880`033c45e0 fffff880`01b251e2 : 00000089`00000000 fffffa80`0a579a70 fffffa80`08359f50 00000000`00000001 : tcpip!WfpAleHandleSendCompletion+0xeb
fffff880`033c4700 fffff880`01b2f6b2 : 00000000`00000000 00000000`00000001 00000000`00000000 fffffa80`081bbd28 : tcpip!WfpAlepAuthorizeSendCompletion+0x32
fffff880`033c4750 fffff880`01891af2 : fffffa80`00000089 fffff800`00000089 fffffa80`0b5c1e50 00000000`00000001 : tcpip!WfpAleCompleteOperation+0x162
fffff880`033c47f0 fffff880`04a327bb : 00000000`00000000 00000000`00000000 fffffa80`0b4c95e0 00000000`00000030 : fwpkclnt!FwpsCompleteOperation0+0x1e
fffff880`033c4820 00000000`00000000 : 00000000`00000000 fffffa80`0b4c95e0 00000000`00000030 00000000`00000089 : SYMNETS+0x1e7bb


STACK_COMMAND: kb

FOLLOWUP_IP:
NETIO!WfpExpireEntryLru+17
fffff880`0182b9c7 488b4310 mov rax,qword ptr [rbx+10h]

SYMBOL_STACK_INDEX: 4

SYMBOL_NAME: NETIO!WfpExpireEntryLru+17

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: NETIO

IMAGE_NAME: NETIO.SYS

DEBUG_FLR_IMAGE_TIMESTAMP: 5294760d

FAILURE_BUCKET_ID: X64_0xA_NETIO!WfpExpireEntryLru+17

BUCKET_ID: X64_0xA_NETIO!WfpExpireEntryLru+17

 

The above that I have highlighted in red suggests that the Symantec/Norton software is the cause of most if not all of the crashes, less likely but not impossible is an out of date or incorrect driver for the wireless device that is presently being used.

[navyblue161]

Ok so I think I got rid of everything you said. If you need to check to make sure I did, let me know and I'll send another snapshot or whatever you need. The only thing I haven't done yet is the printers and wireless adaptors. I want to check with her since I'm not sure which ones she's still using and which ones aren't needed anymore. I also haven't downloaded one of the antiviruses yet because the internet is still not working. Is that something where you want me to download it to my laptop and transfer it again or are we going to try and get the internet working first? About Comodo, it is a free program I believe. She had the internet browser, not the firewall. One more question. I've had a couple people look at the snapshot and we're all noticing the amount of junk on her system. Do you think it would be easier to just wipe it or do you think what we're doing now will be enough to fix it? I'm just wondering if there will be future problems and as much as of a pain as starting over can be, it's good in the sense it's a blank slate.

Edited by navyblue161, 06 May 2015 - 05:12 PM.

[phillpower2]

Apologies for the late reply, not been around for a couple of days due to other commitments

 

Any blue screens since the above has been done.

 

Can you post the exact Dell model name and /or model number for us so that we can find the correct drivers for the wireless and LAN devices.

 

Please put installing an AV on hold for the time being.

 

If not done already uninstall the Comodo software.

 

A fresh installation of the OS is always a last resort unless it is blindingly obvious that it is required, hopefully what we are presently doing will avoid the need for a fresh install.  

 

Start Windows 7 in Safe Mode with Networking

1. Immediately after the computer is powered on or restarted (usually after you hear your computer beep), tap the F8 key in 1 second intervals. 
    
2. After your computer displays hardware information and runs a memory test, the Advanced Boot Options menu will appear.
    
3. Use the arrow keys to select Safe Mode with Networking and press ENTER. 

 

Post back with an update for us when you are ready.