Constant BCCode: d1 blue screen

Hi,

Ditch SpyHunter, uninstall it and if you have malware issues see below. Also check

with Norton Support and forums since you are using their antivirus.

We need the minidumps so they can be analyzed - see my previous reply above.

====================================================

If you need to check for malware here are my recommendations - these will allow you to do

a thorough check and removal without ending up with a load of spyware programs running

resident which can cause as many issues as the malware and maybe harder to detect as

the cause.

No one program can be relied upon to detect and remove all malware. Added that often easy

to detect malware is often accompanied by a much harder to detect and remove payload. So

its better to be overly thorough now than to pay the high price later. Check with these to an

extreme overkill point and then run the cleanup only when you are very sure the system is clean.

These can be done in Safe Mode - repeatedly tap F8 as you boot however you should also run 

them in regular Windows when you can.

TDSSKiller.exe. - Download to the Desktop - then go to it and Right Click on it - RUN AS ADMIN

it will show any infections in the report after running - if it will not run change the name from

tdsskiller.exe to tdsskiller.com. Whether it finds anything or not does not mean you should not

check with the other methods below.

http://support.kaspersky.com/viruses/solutions?qid=208280684

Download malwarebytes and scan with it, run MRT, and use the on-line scanners.

Download - SAVE - go to where you put it - Right Click on it - RUN AS ADMIN

Malwarebytes - free

http://www.malwarebytes.org/products/malwarebytes_free

SuperAntiSpyware Portable Scanner - Free

http://www.superantispyware.com/portablescanner.html?tag=SAS_HOMEPAGE

Run the Microsoft Malicious Removal Tool

Start - type in Search box -> MRT  find at top of list - Right Click on it - RUN AS ADMIN.

You should be getting this tool and its updates via Windows Updates - if needed you can

download it here.

Download - SAVE - go to where you put it - Right Click on it - RUN AS ADMIN

(Then run MRT as above.)

Microsoft Malicious Removal Tool - 32 bit

http://www.microsoft.com/downloads/details.aspx?FamilyID=AD724AE0-E72D-4F54-9AB3-75B8EB148356&displaylang=en

Microsoft Malicious Removal Tool - 64 bit

http://www.microsoft.com/downloads/details.aspx?FamilyId=585D2BDE-367F-495E-94E7-6349F4EFFC74&displaylang=en

---

Check with :

Microsoft Safety Scanner

http://www.microsoft.com/security/scanner/en-us/default.aspx

---

Try the trial version of Hitman Pro :

Hitman Pro is a second opinion scanner, designed to rescue your computer from malware

(viruses, trojans, rootkits, etc.) that have infected your computer despite all the security

measures you have taken (such as anti virus software, firewalls, etc.).

http://www.surfright.nl/en/hitmanpro

---

If needed here are some online free scanners to help

http://www.eset.com/onlinescan/

---

http://www.kaspersky.com/virusscanner

Other Free online scans

http://www.google.com/search?hl=en&source=hp&q=antivirus+free+online+scan&aq=f&oq=&aqi=g1

---

After removing any malware :

Also do these to cleanup general corruption and repair/replace damaged/missingsystem files.

Start - type this in Search Box ->  COMMAND   find at top and RIGHT CLICK  -  RUN AS ADMIN

Enter this at the prompt - sfc /scannow

How to Repair Windows 7 System Files with System File Checker

http://www.sevenforums.com/tutorials/1538-sfc-scannow-command-system-file-checker.html

How to analyze the log file entries that the Microsoft Windows Resource Checker (SFC.exe) program

generates in Windows Vista cbs.log

http://support.microsoft.com/kb/928228

Also run CheckDisk so we can rule out corruption as much as possible.

How to Run Disk Check in Windows 7

http://www.sevenforums.com/tutorials/433-disk-check.html

======================================

**For extreme cases :**Windows Defender Offline

What is Windows Defender Offline?

http://windows.microsoft.com/en-US/windows/what-is-windows-defender-offline

Windows Defender Offline : frequently asked questions

http://windows.microsoft.com/en-US/windows/windows-defender-offline-faq

Windows Defender Offline system requirements

http://windows.microsoft.com/en-US/windows/windows-defender-offline-system-requirements

---

Norton Power Eraser - Eliminates deeply embedded and difficult to remove crimeware

that traditional virus scanning doesn't always detect. Because the Norton Power Eraser

uses aggressive methods to detect these threats, there is a risk that it can select some

legitimate programs for removal. You should use this tool very carefully, and only after

you have exhausted other options.

http://us.norton.com/support/DIY/index.jsp

Hope this helps.

---

Rob Brown - Microsoft MVP <- profile - Windows Expert - Consumer : Bicycle <- Mark Twain said it right!

.. lovely, i was almost done typing my response, and it decided "im going to go to a blue screen now... heres the info:

Problem signature:

  Problem Event Name: BlueScreen

  OS Version:      6.1.7601.2.1.0.256.48

  Locale ID:           1033

Additional information about the problem:

  BCCode:             d1

  BCP1:  0000000000000000

  BCP2:  000000000000000A

  BCP3:  0000000000000001

  BCP4:  FFFFF88005A04167

  OS Version:      6_1_7601

  Service Pack:    1_0

  Product:             256_1

Files that help describe the problem:

  C:\Windows\Minidump\011014-32073-01.dmp

  C:\Users\Oliver Ogden\AppData\Local\Temp\WER-85082-0.sysdata.xml

I’m now typing in a word document and saving it every few minutes, like i should have been doing okay, let’s try this again…

I’m not the most tech savvy person, but I know a little, enough to make my way around, so I googled the error message, and it said something was wrong with the software or hardware, thus, I said that without thinking

The malware was PC Optimizer pro… I hope I’m not fined for this or anything, but heres the links where I discovered it was malware:

<Removed>

http://malwaretips.com/blogs/pc-optimizer-pro-virus/

if you want more info, just google it, youll find a bunch of stuff on it, as to how I removed it, I uninstalled it from the control panel… Home>Control Panel>Uninstall a Program, today however, I decided to try SpyHunter which was offered on one of the site

other programs I’ve installed are:

WinZip, which I got for free from their website when I downloaded PC Optimizer pro, otherwise, I would never have gotten it… when I removed PC Optimizer pro, WinZip stopped working, so I got 7 Zip

Facebook Massager from Facebook’s website

Norton 360 (my current virus protection) I had to remove the preinstalled virus protection to get it (removed McAfee LiveSafe)

MATLAB for college

GanttProject (also school)

when I first got the computer, it didn’t have Dell Webcam Central, so I downloaded that

SpyHunter which I just downloaded

Dell system detect (to register my computer)

Epson scan for my printer, along with whatever other printer software

Printer software for my parents Brother printer

Java 7

PhotoScape

Project 64 (Nintendo 64 emulator, and some games to go with it)

Skype

Todoist

……..

I could keep going, but here’s the thing, I’m not really worried about what I know I’ve downloaded, I usually do my research, PC Optimizer pro was a slip up because I just wanted WinZip and was like yeah sure whatever if it makes WinZip free i guess so... but what I’m most worried about is the stuff I don’t know I’ve downloaded, I did the SpyHunter scan, and it came up with 180some threats, some of which do happen to be latent Optimizer pro programs, but it's asking me to purchase SpyHunter to get rid of them, is there a way to do that without having to pay for it, as a college student, I'm tight for money, that's the main reason I didn't pay for Optimizer pro, and I'm glad I didn't

On Tue, 7 Jan 2014 23:50:31 +0000, Oliver Ogden wrote:

i got my computer over the summer, and like any person who uses their computer a lot, i downloaded a bunch of software/hardware

You can download software, but you certainly can't download any
hardware.

onto my computer, including (without knowing what i was doing) a trojan horse program,

What was its name? How do you know that it was a trojan horse?

luckily, i wasn't dumb, and didn't pay for the full version of the program, and it didn't start removing crucial files to running windows like i've seen in reports by people who did buy it... i did remove the program from my computer as soon as i realized it was malware.

How did you remove it?

Any way, my point is, around this time, i also downloaded a bunch of other programs,

What other programs? Please be specific. Did you install the
downloaded programs? Have you run them?

and around this time, i started experiencing blue screens with a restart error code similar to this:

Hi,

References to Vista also apply to Windows 7.

This is my generic how to for proper driver updates :

This utility makes it easy to see which versions are loaded :

DriverView - Free - utility displays the list of all device drivers currently loaded on your system.

For each driver in the list, additional useful information is displayed: load address of the driver,

description, version, product name, company that created the driver, and more.

http://www.nirsoft.net/utils/driverview.html

For Drivers check System Maker as fallbacks and Device Maker's which are the most current.

Control Panel - Device Manager - Display Adapter - write down the make and complete model

of your video adapter - double click - Driver's tab - write down the version info. Now click UPdate

Driver (this may not do anything as MS is far behind certifying drivers) - then Right Click -

Uninstall - REBOOT this will refresh the driver stack.

Repeat that for Network - Network Card (NIC), Wifi, Sound, Mouse and Keyboard if 3rd party

with their own software and drivers and any other major device drivers you have.

Now go to System Maker's site (Dell, HP, Toshiba as examples) (as rollback) and then Device

Maker's site (Realtek, Intel, Nvidia, ATI as examples) and get their latest versions. (Look for

BIOS, Chipset and software updates at System Maker's site while there.)

Download - SAVE - go to where you put them - Right Click - RUN AD ADMIN - REBOOT after

each installation.

Always check in Device Manager - Drivers tab to be sure the version you are installing actually

shows up. This is because some drivers rollback before the latest is installed (sound drivers

particularly do this) so install a driver - reboot - check to be sure it is installed and repeat as

needed.

Repeat at Device Makers - BTW at Device Makers DO NOT RUN THEIR SCANNER - check

manually by model.

Manually look at manufacturer's sites for drivers - and Device Maker's sites.

http://pcsupport.about.com/od/driverssupport/ht/driverdlmfgr.htm

Installing and updating drivers in 7 (updating drivers manually using the methods above is preferred

to ensure the latest drivers from System maker and Device makers are found)

http://www.sevenforums.com/tutorials/43216-installing-updating-drivers-7-a.html

If you update drivers manually then it is a good idea to disable Driver Installations in Windows

Updates, this leaves Windows Updates ON however it will not install drivers which will usually

be older and cause issues. If Updates suggests a new driver then HIDE it (Right Click on it)

and then go look for new ones manually if you wish.

Stop Windows 7 from Automatically Installing Device Drivers

http://helpdeskgeek.com/windows-7/stop-windows-7-from-automatically-installing-device-drivers/

How To Disable Automatic Driver Installation In Windows 7 / Vista

http://www.addictivetips.com/windows-tips/how-to-disable-automatic-driver-installation-in-windows-vista/

Disable Windows Update Device Driver Search Prompt In Windows 7 / Vista (for Professional,

Ultimate, and Enterprise)

http://www.addictivetips.com/windows-tips/disable-windows-update-device-driver-search-prompt/

==========================================

Memory tests do not catch all errors such as mismatched memory (possible even for sticks

that appear to be identical) and when faster memory is placed in system behind slower memory.

So it is best to also swap sticks in and out to check for those even if all memory tests fail to show

a problem.

To test RAM check here - let it run 4+ hours or so.  <-- best methodwww.memtest.org

For the Windows Memory Diagnostic Tool.

Start - type in Search box ->  Memory - find Memory Diagnostics tool at top of list - Right Click -

RUN AS ADMIN follow the instructions

Windows Vista: How to Scan / Test your RAM or Memory with Windows Vista Memory Diagnostic

Tool

http://www.shivaranjan.com/2007/11/01/windows-vista-how-to-scan-test-your-ram-or-memory-with-windows-vista-memory-diagnostic-tool/

How to Run the Memory Diagnostics Tool in Windows 7

http://www.sevenforums.com/tutorials/715-memory-diagnostics-tool.html

Hope this helps.

---

Rob Brown - Microsoft MVP <- profile - Windows Expert - Consumer : Bicycle <- Mark Twain said it right!

Hi,

Resolving stop (blue screen) errors in Windows 7 - has a section for if you can or can't start Windows.

http://windows.microsoft.com/en-us/windows7/Resolving-stop-blue-screen-errors-in-Windows-7 

For BlueScreen troubleshooting methods using BlueScreenView and MyEventViewer see my replies

in this thread - top 3 answers (+1 other).

http://answers.microsoft.com/en-us/windows/forum/windows_7-system/sometimes-i-get-a-blue-screen-when-using-ie-8/c675b7b8-795f-474d-a1c4-6b77b3fcd990

We can analyze the minidumps if you make them available from the SkyDrive or other file

sharing sites (such as MediaFire). If you have problems uploading the minidumps copy

them to the Desktop or the Documents folder and upload them from there.

Zip or upload the contents of C:\Windows\minidump

Use SkyDrive to upload collected files.

http://social.technet.microsoft.com/Forums/en-US/w7itproui/thread/4fc10639-02db-4665-993a-08d865088d65 

==============================================================

BCCode: D1     0x000000D1Check these KB's

Stop error when you resume a computer that is running Windows 7 or Windows Server 2008 R2

from sleep or from hibernation: "STOP: 0x000000D1"

http://support.microsoft.com/kb/978982

Stop error on a Windows Server 2008 R2-based or Windows 7-based computer when the operating

system uses a virtual storport miniport driver to save a dump file or a hibernation file: "0x000000D1"

http://support.microsoft.com/kb/2320550

Those and 7 other KB Articles are available

http://support.microsoft.com/search/default.aspx?mode=a&query=0x000000D1&spid=14019&catalog=LCID%3D1033&1033comm=1&res=10

---

Think Video drivers mainly though it can be others. See the driver section in my generic

bluescreen troubleshooting methods below. BIOS, low level chipset drivers and

antivirus/antispyway/security programs can also cause this. Check the troubleshooter and

when you get to the driver and memory testing sections refer to the generic methods in next

message and then return to the troubleshooter if needed.

---

BCCode: D1     0x000000D1

Bug Check 0xD1: DRIVER_IRQL_NOT_LESS_OR_EQUALThe DRIVER_IRQL_NOT_LESS_OR_EQUAL bug check has a value of 0x000000D1. This indicates that a kernel-mode driver attempted to access pageable memory at a process IRQL that was too high.

Important Info If You Have Received a STOP Code

If you received a blue screen error, or stop code, the computer has shut down abruptly to protect itself from data loss. A hardware device, its driver, or related software might have caused this error. If your copy of Windows came with your computer, call the manufacturer of your computer. If you purchased Windows separately from your computer, Microsoft provides support. To find contact info for Microsoft or your computer manufacturer, Contact Support.

If you have experience with computers and want to try to recover from this error, follow the steps provided in the Microsoft article Resolving STOP (Blue Screen) Errors in Windows.

These actions might prevent an error like this from happening again:

1. Download and install updates and device drivers for your computer from Windows Update.
2. Scan your computer for computer viruses.
3. Check your hard disk for errors.

DRIVER_IRQL_NOT_LESS_OR_EQUAL Parameters

The following parameters are displayed on the blue screen.

Bug Check 0xD1: DRIVER_IRQL_NOT_LESS_OR_EQUAL <-- read link to see parameters

http://msdn.microsoft.com/en-us/library/ff560244(v=VS.85).aspx 

Cause

A driver tried to access an address that is pageable (or that is completely invalid) while the IRQL was too high.

This bug check is usually caused by drivers that have used improper addresses.

If the first parameter has the same value as the fourth parameter, and the third parameter indicates an execute operation, this bug check was likely caused by a driver that was trying to execute code when the code itself was paged out. Possible causes for the page fault include the following:

• The function was marked as pageable and was running at an elevated IRQL (which includes obtaining a lock).
• The function call was made to a function in another driver, and that driver was unloaded.
• The function was called by using a function pointer that was an invalid pointer.

Resolution

To begin debugging, use a kernel debugger to get a stack trace.

If the problem is caused by the driver that you are developing, make sure that the function that was executing at the time of the bug check is not marked as pageable or does not call any other inline functions that could be paged out.

BCCode: d1   0x000000d1  <-- read this linkhttp://www.faultwire.com/solutions-fatal\_error/DRIVER-IRQL-NOT-LESS-OR-EQUAL-0x000000D1-\*1210.html?order=votes

==========================================

Look in the Event Viewer to see if anything is reported about those.

http://www.computerperformance.co.uk/vista/vista\_event\_viewer.htm

MyEventViewer - Free - a simple alternative to the standard event viewer of Windows.TIP - Options - Advanced Filter allows you to see a time frame instead of the whole file.

http://www.nirsoft.net/utils/my\_event\_viewer.html

---

Here are some methods to possibly fix the blue screen issue. If you could give the Blue Screen

info that would help. Such as the BCC and the other 4 entries on the lower left. And any other

error information such as STOP codes and info such as IRQL_NOT_LESS_OR_EQUAL or PAGE_FAULT_IN_NONPAGED_AREA and similar messages.

As examples :

BCCode: 116

BCP1: 87BC9510

BCP2: 8C013D80

BCP3: 00000000

BCP4: 00000002

or in this format :

Stop: 0x00000000 (oxoooooooo oxoooooooo oxooooooooo oxoooooooo)

tcpip.sys - Address 0x00000000 base at 0x000000000 DateStamp 0x000000000

This is an excellent tool for posting Blue Screen Error InformationBlueScreenView scans all your minidump files created during 'blue screen of death'crashes, and displays the information about all crashes in one table - Free

http://www.nirsoft.net/utils/blue\_screen\_view.html

Many BlueScreens are caused by old or corrupted drivers, especially video drivers however

there are other causes.

You can do these in Safe Mode if needed or from Command Prompt from Vista DVD or

Recovery Options if your system has that installed by the maker.

How to Boot to the System Recovery Options in Windows 7

http://www.sevenforums.com/tutorials/668-system-recovery-options.html

You can try a System Restore back to a point before the problem started if there is one.

How to Do a System Restore in Windows 7

http://www.sevenforums.com/tutorials/700-system-restore.html

---

Start - type this in Search Box ->  COMMAND   find at top and RIGHT CLICK  -  RUN AS ADMIN

Enter this at the prompt - sfc /scannow

How to Repair Windows 7 System Files with System File Checker

http://www.sevenforums.com/tutorials/1538-sfc-scannow-command-system-file-checker.html

How to analyze the log file entries that the Microsoft Windows Resource Checker (SFC.exe) program

generates in Windows Vista cbs.log (and Windows 7)

http://support.microsoft.com/kb/928228

The log might give you the answer if there was a corrupted driver. (Does not tell all the possible

driver issues).

Also run CheckDisk so we can rule out corruption as much as possible.

How to Run Check Disk at Startup in Windows 7

http://www.sevenforums.com/tutorials/433-disk-check.html

---

Often updating drivers will help, usually Video, Sound, Network Card  (NIC), WiFi, 3rd party

keyboard and mouse, as well as other major device drivers.

Manually look at manufacturer's sites for drivers - and Device Maker's sites.

http://pcsupport.about.com/od/driverssupport/ht/driverdlmfgr.htm

Installing and updating drivers in 7 (updating drivers manually using the methods above is preferred

to ensure the latest drivers from System maker and Device makers are found)

http://www.sevenforums.com/tutorials/43216-installing-updating-drivers-7-a.html

Stop Windows 7 from Automatically Installing Device Drivers

http://helpdeskgeek.com/windows-7/stop-windows-7-from-automatically-installing-device-drivers/

Disable Windows Update Device Driver Search Prompt In Windows 7 / Vista (for Professional, Ultimate, and Enterprise)

http://www.addictivetips.com/windows-tips/disable-windows-update-device-driver-search-prompt/

---

How to fix BlueScreen (STOP) errors that cause Windows Vista to shut down or restart

unexpectedly

http://support.microsoft.com/kb/958233

Troubleshooting Vista Blue Screen, STOP Errors (and Windows 7)

http://www.chicagotech.net/vista/vistabluescreen.htm

Understanding and Decoding BSOD (blue screen of death) Messages

http://www.taranfx.com/blog/?p=692

Windows - Troubleshooting Blue Screen Errors

http://kb.wisc.edu/page.php?id=7033

---

In some cases this might be required.

StartUp Repair from Recovery Options or Windows 7 disk

How to Run a Startup Repair in Windows 7

http://www.sevenforums.com/tutorials/681-startup-repair.html 

How to Boot to the System Recovery Options in Windows 7

http://www.sevenforums.com/tutorials/668-system-recovery-options.html 

How to Create a Windows 7 System Repair Disc

http://www.sevenforums.com/tutorials/2083-system-repair-disc-create.html

Hope this helps.

---

Rob Brown - Microsoft MVP <- profile - Windows Expert - Consumer : Bicycle <- Mark Twain said it right!