Jump to content

Welcome to Geeks to Go - Register now for FREE

Need help with your computer or device? Want to learn new tech skills? You're in the right place!
Geeks to Go is a friendly community of tech experts who can solve any problem you have. Just create a free account and post your question. Our volunteers will reply quickly and guide you through the steps. Don't let tech troubles stop you. Join Geeks to Go now and get the support you need!

How it Works Create Account
Photo

Memory Dump BSOD Blues

Started by djamrou04 , Jan 14 2005 03:00 AM

  • Please log in to reply

#1
djamrou04
Posted 14 January 2005 - 03:00 AM

djamrou04

    New Member

  • Member
  • Pip
  • 3 posts
I'm not sure if this has been covered or not, but I could really use some help. After getting home from work yesterday my wife told me that she got a BSOD while chatting and browsing. It seems that whenever I try to load IE while not in safe mode I get a hard locking blue screen complaing about a mem dump. I run Ad-Aware SE daily and use Anti-Vir XP for virus protection. At first I thought it might have been an unseated memory card, so I reseated them. That didn't help. Additionally, I downloaded and ran TSD-3, it didn't find anything interesting. As a side note, I had a cmd window pop up and complain about vtd_16.exe

I'm going to reboot back into safe mode, run and post a HKT log.

Thank you in advance for your help.
  • 0

Advertisements

#2
djamrou04
Posted 14 January 2005 - 03:06 AM

djamrou04

    New Member

  • Topic Starter
  • Member
  • Pip
  • 3 posts
Ok, as promised, here's the HJT log.



Logfile of HijackThis v1.99.0
Scan saved at 03:04:31, on 1/14/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Documents and Settings\Administrator\Desktop\hijackthis\HijackThis.exe

O1 - Hosts: 64.91.255.87 www.dcsresearch.com
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Main Class - {9DD4258A-7138-49C4-8D34-587879A5C7A4} - C:\PROGRA~1\MSN\smarttag\MSNBHO.dll (file missing)
O2 - BHO: (no name) - {A5366673-E8CA-11D3-9CD9-0090271D075B} - (no file)
O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\fgiebar.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [AVGCtrl] C:\Program Files\AVPersonal\AVGNT.EXE /min
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [secboot] C:\WINDOWS\System32\vtd_16.exe !!
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe
O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O16 - DPF: {2B323CD9-50E3-11D3-9466-00A0C9700498} (Yahoo! Audio Conferencing) - http://us.chat1.yimg...v45/yacscom.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupd...b?1102850681174
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai...all/xscan53.cab
O16 - DPF: {7D1E9C49-BD6A-11D3-87A8-009027A35D73} (Yahoo! Audio UI1) - http://chat.yahoo.com/cab/yacsui.cab
O16 - DPF: {E504EE6E-47C6-11D5-B8AB-00D0B78F3D48} (Yahoo! Webcam Viewer Wrapper) - http://chat.yahoo.com/cab/yvwrctl.cab
O23 - Service: AntiVir Service - H+BEDV Datentechnik GmbH - C:\Program Files\AVPersonal\AVGUARD.EXE
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: AntiVir Update - H+BEDV Datentechnik GmbH, Germany - C:\Program Files\AVPersonal\AVWUPSRV.EXE


Again, any help regarding this is greatly appreciated.
  • 0

#3
djamrou04
Posted 14 January 2005 - 04:17 AM

djamrou04

    New Member

  • Topic Starter
  • Member
  • Pip
  • 3 posts
I think that I solved my dilemma, 2 files were giving me a hassle:
Klogini.dll and Draw32.dll
I believe that I had aquired Haxdoor. Spybot and Killbox did wonders. Sorry for posting all this garbage for such a simple thing, but then again, my brain isnt working quite well as it's now 4:00... Thanks anyway, and again sorry for posting something that took me 20 mins to figure out.
  • 0

#4
admin
Posted 14 January 2005 - 09:20 AM

admin

    Founder Geek

  • Community Leader
  • 24,639 posts
Sounds like you may have got it! :tazz:

Make sure this entry is gone from your Hijack This log:
O4 - HKLM\..\Run: [secboot] C:\WINDOWS\System32\vtd_16.exe !!

If it reappears, please reply to this topic. ;)
  • 0
Back to Virus, Spyware, Malware Removal · Next Unread Topic →




Similar Topics

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

  1. Geeks to Go Community
  2. → Security
  3. → Virus, Spyware, Malware Removal

As Featured On:

Microsoft Yahoo BBC MSN PC Magazine Washington Post HP