"pfs3w" <guest@xxxxxx-email.com> wrote in message
news:867b7aebc716540cf737cea2d4a01fc5@xxxxxx-gateway.com...
>
> So, I've had this same problem for about a week now (I lost track). I
> was noticing my computer was acting incredibly slow, much slower than it
> has ever acted since I've owned it for about 8 months. About the same
> time, I was notified by Symantec AntiVirus that I had a BloodHound
> exploit 196. I tried to get rid of it, and finally succeeded when I used
> Symantec to delete the two quarantined files. I thought the issue was
> over, but my computer was still acting slow, so I decided to run a
> System Restore. Bad idea...
>
> After I ran the system restore, I immediately got the
> IRQL_NOT_LESS_OR_EQUAL blue screen. The first time I got it, the Stop
> Code was:
> 0x0000000A (0x00000000 0x00000002 0x00000001 0x8204180C)
> Since then, it seems to have changed to the same except for the last
> code:
> 0x0000000A (0x00000000 0x00000002 0x00000001 0x8208F80C).
>
> Some info on my situation:
>
> - AS FAR AS I AM AWARE, I have not installed any new drivers for
> anything, except maybe my printer updated its drivers. My printer has
> acted strangely, sometimes updating itself constantly, so I am not
> sure if this is the issue. The only thing I can think of besides my
> printer would be installing Malwarebytes tool when I was trying to
> find the bloodhound exploit.
> - I CAN ONLY BOOT UP IN SAFE MODE W/NETWORKING/CMD. I can't boot
> normally, I can't boot with Last Known Good Configuration, I can't
> boot Reapiring the System without it going to BSOD.
> - I have been suggested to try and download the BIOS update from
> Dell.com, but it gived me a Flash error when I try to run the .EXE:
> Windows Error Return: 0x0000043C
> This may mean I cannot run the update while in Safe Mode.
> - I cannot access My Printers and Faxes to uninstall my printer
> driver because I am in Safe Mode.
> - I performed a full System Diagnostics, and it said I didn't have
> any problems.
> I am getting sick of having to run my computer in Safe Mode and having
> limited capabilities, and my IT support hasn't found out what's wrong.
> The last thing I might mention is that *I ran a Windows Update a few
> days before*, and when I System Restored, it might have gone before the
> Windows Update time. Maybe the update had to delete some files to
> update, but when I system resotred, it went before the updates and now
> there is a file missing. I HAVE NO IDEA what's wrong with my system, and
> would like to know if there is any way possible to diagnose it.
>
>
> --
> pfs3w Hi pfs3w--
It's not clear from what you're telling me that you haven't invited the ole
doggie Bloodhound back into your system. You may have cleared it during the
restore, but sometimes you don't. See the MSKB below.
How antivirus software and System Restore work together
http://support.microsoft.com/kb/831829
You said that you restored after you think you removed Bloodhound. When you
restore, you're using a registry snapshot that is the restore point. If a
virus/trojan/blended threat/malware was on there before the restore point,
then you've welcomed it back.
You need to run a viral scan, if you can do this, and if you detect Blood
Hound or anything else, remove and quarantine.
If you can't run a viral scan, and can only get to Windows in Safe Mode,
then I'd try to fix Windows, and then do a viral scan if it's stable enough.
You should always flash the Bios with the latest update, but I doubt that's
your problem now. You can do that if you get back into Windows in a stable
enough situation.
The IRQL stop is not that much help but it generally is cuased by drivers
that attempt to use improper memory addresses and use an interrupt that is
too high which means nothing to most end users.
It's often caused by a device driver incompatible with the OS. Software
can cause the error, particularly antivirus software, backup and multimedia
programs (I'd get rid of Norton and install free Avira--it runs in the
background, is less bloated, less erratic, and every bit as capable as
anything Symantec Norton ever made. It's compatible with Win 7 if you
upgrade when RC1 releases in a couple weeks.
If a driver is your problem, I'd try to get the latest driver from the
device maker's site, and use drivers digitally signed by MSFT in this
situation because of the IRQL BSOD.
To try to recover into Windows and lose the BSOD's and then make sure you
disinfect the system, or aren't infected (whichever) I'd try these:
If you don't have a Vista DVD from MSFT, then download the .iso for a Repair
Disk that has MSFT's Startup Repair tools from the link immediately below.
Download Vista Repair Disk
http://neosmart.net/blog/2008/window...disc-download/
How to Use Startup Repair from the Vista DVD or the Repair Disk you make:
http://www.bleepingcomputer.com/tuto...torial142.html http://windowshelp.microsoft.com/Win...f3f351033.mspx
1) First try 3 options from Startup Repair. If you have a Vista DVD then
restart with it in the drive>press any key to boot from it and run Startup
Repair. From Startup Repair you have 3 good tools with an excellent chance
of fixing your system. If you don't have a Vista DVD from which to boot to
Startup Repair, no problem, Download the .iso from the link below and
burn it, and you'll have the Microsoft Vista Repair Disk with Startup
Repair.
Download Vista Repair Disk
http://neosmart.net/blog/2008/window...disc-download/
How to Use Startup Repair from the Vista DVD or the Repair Disk you make:
http://www.bleepingcomputer.com/tuto...torial142.html http://windowshelp.microsoft.com/Win...f3f351033.mspx
2) If Startup Repair does not get your Vista back, then use the 3 bootrec
commands from the command prompt available on the Statup Repair Menu:
The menu I refer to is in this set of directions with a grey background.
http://vistahomepremium.windowsreins...airstartup.htm
Those are:
bootrec /fixmbr
bootrec /fixboot
bootrec /rebuild BCD
3) If my second option doesn't work, then try System restore from the
Startup Repair list.
1) First try 3 options from Startup Repair. If you have a Vista DVD then
restart with it in the drive>press any key to boot from it and run Startup
Repair. From Startup Repair you have 3 good tools with an excellent chance
of fixing your system. If you don't have a Vista DVD from which to boot to
Startup Repair, no problem, Download the .iso from the link below and
burn it, and you'll have the Microsoft Vista Repair Disk with Startup
Repair.
Download Vista Repair Disk
http://neosmart.net/blog/2008/window...disc-download/
How to Use Startup Repair from the Vista DVD or the Repair Disk you make:
http://www.bleepingcomputer.com/tuto...torial142.html http://windowshelp.microsoft.com/Win...f3f351033.mspx
2) If Startup Repair does not get your Vista back, then use the 3 bootrec
commands from the command prompt available on the Statup Repair Menu:
The menu I refer to is in this set of directions with a grey background.
http://vistahomepremium.windowsreins...airstartup.htm
Those are:
bootrec /fixmbr
bootrec /fixboot
bootrec /rebuild BCD
3) If my second option doesn't work, then try System restore from theStartup
Repair list.
4) If by rare chance you have an actual Vista DVD, you can put it in, boot
from it>choose the Upgrade Option>choose your current broken Vista Drive and
try to do a repair install with the Vista DVD.
How To Perform a Repair Installation For Vista
Repair Install For Vista
5) If the above 3 tools don't work, then use the 4 tools available by
restarting your pc and tapping F8 once per second to get to the Windows
Advanced Options Menu.
From this menu click on 3 Safe Mode links to use System Restore. Make sure
you try all 3 if one doesn't work, because just one of them may work. Tap F8
to Reach Windows Advanced Options Menu Pictured Below:
http://media.photobucket.com/image/v...ot-Options.jpg
Safe Mode
Safe Mode with Networking
Safe Mode with Command: At the prompt you would type the command to use for
system restore at the safe mode cmd prompt is:
%systemroot%\system32\restore\rstrui.exe
If these 3 tools don't work, you have one more you can try which is Last
Known Good Configuration.
Good luck,
CH