Every program crashing and getting Blue Screen

OK, let's try a different tool to get the information I need.

Please download MiniToolBox to your Desktop.

• Double click MiniToolBox.exe to launch the program.
• Checkmark the following checkboxes:
  
  • List last 10 Event Viewer Errors
  • List Minidump Files
• Click Go to start the scan.
• When finished a log Result.txt will open.
• Please post it in your next reply.

Hey Gary!

Followed the instructions and used MiniToolbox.


MiniToolBox log:

MiniToolBox by Farbar Version:10-01-2013
Ran by [removed] (administrator) on 20-02-2013 at 23:36:47
Running from "D:\Nedladdat"
Windows 7 Professional Service Pack 1 (X64)
Boot Mode: Normal
***************************************************************************

========================= Event log errors: ===============================

Application errors:
==================
Error: (02/20/2013 02:48:28 PM) (Source: SideBySide) (User: )
Description: Activation context generation failed for "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1".Error in manifest or policy file "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" on line C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.
A component version required by the application conflicts with another component version already active.
Conflicting components are:.
Component 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Component 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.


System errors:
=============
Error: (02/20/2013 08:47:28 PM) (Source: Microsoft-Windows-Kernel-General) (User: NT AUTHORITY)
Description: 0x8000002a171\??\Volume{bed50839-00ef-11e2-a947-806e6f6e6963}\System Volume Information\SPP\SppCbsHiveStore\{cd42efe1-f6f1-427c-b004-033192c625a4}{97584782-E869-45F9-8C33-0098A9FCC491}

Error: (02/20/2013 08:47:10 PM) (Source: Microsoft-Windows-Kernel-General) (User: NT AUTHORITY)
Description: 0x8000002a171\??\Volume{bed50839-00ef-11e2-a947-806e6f6e6963}\System Volume Information\SPP\SppCbsHiveStore\{cd42efe1-f6f1-427c-b004-033192c625a4}{0503C2F5-4416-4E49-A488-209C1CB4A48D}


Microsoft Office Sessions:
=========================
Error: (02/20/2013 02:48:28 PM) (Source: SideBySide)(User: )
Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestC:\Program Files (x86)\ESET\ESET Online Scanner\ESETSmartInstaller.exe

========================= Minidump Files ==================================

No minidump file found


**** End of log ****

Nothing that looks related to your problems with WoW there that I can see.

Try uninstalling World of Warcraft, then reboot your computer, then install a new copy and see if that gives you the same problems.

Hey Gary.

Haven't experienced any issues today, but I've reinstalled World of Warcraft and Chrome, both of which were having issues yesterday. Will report back if it staves of the crashes.

OK, keep an eye on things for today and let me know how things go. If things stay stable for you then I'll post instructions for how to safely remove the tools we've been using on your computer, plus some tips on how to better secure your computer against further infection.

Hey Gary. Haven't been able to use the computer much the last two days, but I've tried rebooting and using everything as much as I can without any crashes. I'm not entirely convinced everything's ok as I've had "good days" before, but I can't deny that things seem stable again!

OK, well we'll assume that we've removed the source of your problems, and therefore we need to remove the programs we've been using to clean your computer. If the problems reccur you can always come back and open a new topic, and we'll proceed from there.

First

Let's clear out OTL and the files and folders it created.

• Double click OTL.exe to launch the programme.
• Click on the CleanUp! button.
• OTL will download a list from the Internet, if your firewall or other defensive programmes alerts you, allow it access.
• You will be prompted to allow the clean up procedure, click Yes
• When finished exit out of OTL
• Now delete OTL.exe (if still present).

Next

Please delete ...

JRT.exe
JRT.txt
Vew.exe
MiniToolBox.exe

Next

Please go to Control Panel > Programs > Uninstall a program and Uninstall the following:

Tweaking.com Registry Backup

Please read the article below which will give you a few suggestions for how to minimise your chances of getting another infection.

• Computer Security - a short guide to staying safer online

Followed the instructions and everything's removed. Checked out the guide and learned a thing or two. Thanks a bunch! And I'll thank your properly in the feedback section when I've made sure I don't need to return : )

And I just got another Blue Screen, and just before that the Ad-block extension in Chrome crashed. Might just be coincidental, but it seems the problems are back.

If you go to C:\Windows\Minidump you should find a file named ... mmddyy_hhmmss.dmp (where mdyhms are replaced by numbers indicating the date and time the file was created) ... which is created by Windows when your computer bluescreens.

Please attach that file to your next reply.

To attach a file ...

• Open the forum's text editor as usual when posting a reply.
• Scroll down below the text field to find a box named Filename
• Click on the Browse button beside it and browse to the file I named above.
• Select the file by clicking on it, then click on Add the file
• Click on Submit

The latest Blue Screen minidump should now be attached.

I zipped it though since the extension .dmp wasn't accepted by the forum board. Hope that doesn't cause any problems.

This is the analysis of the file you've submitted ...

1: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

MEMORY_MANAGEMENT (1a)
# Any other values for parameter 1 must be individually examined.
Arguments:
Arg1: 0000000000041790, The subtype of the bugcheck.
Arg2: fffffa80055a5080
Arg3: 000000000000ffff
Arg4: 0000000000000000

Debugging Details:
------------------

BUGCHECK_STR: 0x1a_41790

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT

PROCESS_NAME: chrome.exe

CURRENT_IRQL: 0

LAST_CONTROL_TRANSFER: from fffff80003100e10 to fffff8000308fc40

STACK_TEXT:
fffff880`09a6e128 fffff800`03100e10 : 00000000`0000001a 00000000`00041790 fffffa80`055a5080 00000000`0000ffff : nt!KeBugCheckEx
fffff880`09a6e130 fffff800`0307c42f : fffffa80`00000000 00000000`0764bfff 00000000`00000000 00000000`00000000 : nt! ?? ::FNODOBFM::`string'+0x35084
fffff880`09a6e2f0 fffff800`0308eed3 : ffffffff`ffffffff fffff880`09a6e5c0 fffff880`09a6e628 00000000`00008000 : nt!NtFreeVirtualMemory+0x61f
fffff880`09a6e3f0 fffff800`0308b490 : fffff960`001170e4 00000000`00000001 00000000`00000000 fffff900`c36f4cc0 : nt!KiSystemServiceCopyEnd+0x13
fffff880`09a6e588 fffff960`001170e4 : 00000000`00000001 00000000`00000000 fffff900`c36f4cc0 00000000`00000001 : nt!KiServiceLinkage
fffff880`09a6e590 fffff960`0011f389 : 00000000`00000000 fffff880`00000001 fffff900`c36f4cc0 fffff900`00000000 : win32k!SURFACE::bDeleteSurface+0x3c8
fffff880`09a6e6e0 fffff960`00116920 : 00000000`00001468 fffff880`09a6ea00 fffff900`c3bfbce0 fffff880`00000000 : win32k!NtGdiCloseProcess+0x2c9
fffff880`09a6e740 fffff960`0011605f : 00000000`00000000 fffff880`09a6eae0 fffffa80`0ef07b50 00000000`00000000 : win32k!GdiProcessCallout+0x200
fffff880`09a6e7c0 fffff800`03367fc1 : 00000000`00000000 00000000`00000000 00000000`00000000 fffffa80`0ef07b00 : win32k!W32pProcessCallout+0x6b
fffff880`09a6e7f0 fffff800`0334e15d : 00000000`c0000005 00000000`c0000001 00000000`78457300 fffffa80`0eb03060 : nt!PspExitThread+0x4d1
fffff880`09a6e8f0 fffff800`0308275a : 00000000`00000100 fffffa80`0ef07c10 00000000`00000001 fffff800`0308585d : nt!PsExitSpecialApc+0x1d
fffff880`09a6e920 fffff800`03082aa0 : 00000000`00000246 fffff880`09a6e9a0 fffff800`0334e0d0 00000000`00000001 : nt!KiDeliverApc+0x2ca
fffff880`09a6e9a0 fffff800`0308ef77 : fffffa80`0ef07b50 00000000`00000138 fffff880`09a6eab8 fffffa80`0dfd4e80 : nt!KiInitiateUserApc+0x70
fffff880`09a6eae0 00000000`73a92e09 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceExit+0x9c
00000000`01bde918 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x73a92e09

STACK_COMMAND: kb

FOLLOWUP_IP:
win32k!SURFACE::bDeleteSurface+3c8
fffff960`001170e4 e9b0010000 jmp win32k!SURFACE::bDeleteSurface+0x57d (fffff960`00117299)

SYMBOL_STACK_INDEX: 5

SYMBOL_NAME: win32k!SURFACE::bDeleteSurface+3c8

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: win32k

IMAGE_NAME: win32k.sys

DEBUG_FLR_IMAGE_TIMESTAMP: 50e64bda

FAILURE_BUCKET_ID: X64_0x1a_41790_win32k!SURFACE::bDeleteSurface+3c8

BUCKET_ID: X64_0x1a_41790_win32k!SURFACE::bDeleteSurface+3c8

Followup: MachineOwner
---------

... which suggests that win32k.sys may be a source of your problem.

1: kd> lmvm win32k
start end module name
fffff960`00050000 fffff960`00366000 win32k (pdb symbols) c:\websymbols\win32k.pdb\8AACB81BDFC94444AEC11154078DDEEE2\win32k.pdb
Loaded symbol image file: win32k.sys
Mapped memory image file: c:\websymbols\win32k.sys\50E64BDA316000\win32k.sys
Image path: \SystemRoot\System32\win32k.sys
Image name: win32k.sys
Timestamp: Fri Jan 04 03:26:18 2013 (50E64BDA)
CheckSum: 003098AB
ImageSize: 00316000
File version: 6.1.7601.18043
Product version: 6.1.7601.18043
File flags: 0 (Mask 3F)
File OS: 40004 NT Win32
File type: 3.7 Driver
File date: 00000000.00000000
Translations: 0409.04b0
CompanyName: Microsoft Corporation
ProductName: Microsoft® Windows® Operating System
InternalName: win32k.sys
OriginalFilename: win32k.sys
ProductVersion: 6.1.7601.18043
FileVersion: 6.1.7601.18043 (win7sp1_gdr.130103-1433)
FileDescription: Multi-User Win32 Driver
LegalCopyright: © Microsoft Corporation. All rights reserved.

Win32k.sys is an essential system file so we need to find out if it is damaged, and the easiest way to do that is as follows ...

• Click start and in the Search programs and files box type Cmd.exe
• Right click on the cmd.exe icon at the top of the resultant search list and select run as administrator
• A command window will open.
  
  • Type SFC /SCANNOW and hit Enter (there is a space between C and / )
  • SFC will now check your system files, and attempt to replace any it finds damaged. If necessary it may ask you to insert your Windows installation disk to enable it to do so.

Please let me know if this resolves the BSOD problem.

Hey Gary.

Did as instructed, and it scanned and repaired the computer, including a needed reboot. Will report back if this solves the problem, but might take day or two to make sure.

Started up WoW again to see if it crashed too, and soon enough it did. I took a picture of the error message, but after googling I found out that it's pretty generic and not sure if it'll help at all.
Error: http://i.imgur.com/4k8wFX9.png

I have the distinct feeling that your problems may be hardware related rather than anything else.

The common theme between your Chrome and WoW problems are an inability to write to memory, which supposes that you may have problems with your computer's memory.

We can run some basic memory checks from within Windows to see if that's a route that's worth pursuing ....

• Click Start, type mdsched.exe in the Search programs and file box, and then press Enter.
• Choose whether to restart the computer and run the tool immediately or schedule the tool to run at the next restart.
• Windows Memory Diagnostics runs automatically after the computer restarts and performs a standard memory test automatically.
• When testing is completed, the computer restarts automatically. You’ll see the test results when you log on.

Please let me know if Windows finds any memory problems.