livevil Posted October 12, 2006 Report Share Posted October 12, 2006 Hi !My computer suddenly crashed yesterday evening with a beautiful BSOD. I didn't change anything or install any program. By looking a bit closer in the system log, there was a message of "windows updates ready for installation" right before the time of the crash. The computer seems to work correctly in safe-mode or under linux (it's not hardware thus).I tried to deactivate the automatic update and it seems to be OK now. Then I tried a manual installation of the updates from microsoft windowsupdate website, and the computer crashed again during the install (BSOD).I've been told it could be some kind of security (data prevention execution) which prevent windows from being modified by unauthorized programs.What should I do now ? How to allow the updates to work again ? Quote Link to comment Share on other sites More sharing options...
ɹəuəllıʍ ʇɐb Posted October 13, 2006 Report Share Posted October 13, 2006 Hello, and welcome to the Windows Forum!A good place to start looking is at the end of the C:\WINDOWS\WindowsUpdate.log file. You may see what caused the error that led to the BSOD. Please post back here what you find there at the end. Quote Link to comment Share on other sites More sharing options...
livevil Posted October 13, 2006 Author Report Share Posted October 13, 2006 I got nothing in it:2003-02-25 09:13:22 17:13:22 Success IUCTL Starting2003-02-25 09:13:22 17:13:22 Success IUCTL Shutting downIt's a little bit old for an event log.Meanwhile, I've tried a manual install of the updates, one at a time, followed by a reboot. It seems that they all went well but the last one, which concerns the update of microsoft thing against malware (I can"t recall the name in english). This one makes the computer crash. Quote Link to comment Share on other sites More sharing options...
-pops- Posted October 13, 2006 Report Share Posted October 13, 2006 Your last comment makes me think that you have some malware (perhaps the malware that the update is trying to protect against) in your computer.Try running some comprehensive anti-malware programs. Quote Link to comment Share on other sites More sharing options...
livevil Posted October 13, 2006 Author Report Share Posted October 13, 2006 As I said, I did several scans with several antimalware softwares and it gave no result (as well as scan by norton and Dr Web). It seems there's nothing malware related but this service (which is stopped).Do you know other softwares I could test ?edit: I removed the line concerning Active Common Service with Hijackthis. On contrary to yesterday, it seems the computer seems to work. However I still have the service which is deactivated (and which wouldn't run anyway since the corresponding file is not there anymore). Quote Link to comment Share on other sites More sharing options...
-pops- Posted October 13, 2006 Report Share Posted October 13, 2006 Can you tell us what anti-malware programs you have run?Have you run: a squared click here or avg antispyware click here? Quote Link to comment Share on other sites More sharing options...
livevil Posted October 13, 2006 Author Report Share Posted October 13, 2006 I've run spybot, ad-aware, ewido (avg), Dr Web (cureit), and I'm going to try a-squared. Quote Link to comment Share on other sites More sharing options...
livevil Posted October 13, 2006 Author Report Share Posted October 13, 2006 I just finished the scan. It found nothing relevant for my problem (some cookies and apps that I can identify as being harmless). Quote Link to comment Share on other sites More sharing options...
cozofdeath Posted October 13, 2006 Report Share Posted October 13, 2006 I would try running the Windows System File Checker. Start, run, type SFC /SCANNOW and hit enter. If that didn't work I would turn off Automatic Restart in your system properties (Right-click my computer, properties, Advanced, click Settings in the Startup and Recovery tab and uncheck the Automatic Restart), then if the BSOD doesn't say what caused the error I would run Filemon from sysinternals to find out exactly what file is causing the problem and later replace it. Quote Link to comment Share on other sites More sharing options...
livevil Posted October 13, 2006 Author Report Share Posted October 13, 2006 Thank you for the answer.SFC /scannow is going to be a problem since I'm running winXP SP2 on my laptop (IBM) and it went preinstalled (no install CD, just full recovery). And sfc ask for files on the original CD.Concerning the BSOD, it doesn't give much information, just address codes, but no files, drivers or anything involved in the crash.How would you use filemon ? Run it and provoke the crash ?I have the feeling that the problem has something to do with windows protections against threats (this is the update of the malicious software removal tool that crash the computer), maybe with a little help from Norton Antivirus. I'm going to investigate further in a few hours (it's time to go to bed for me)... Quote Link to comment Share on other sites More sharing options...
cozofdeath Posted October 13, 2006 Report Share Posted October 13, 2006 How about shutting down every running program and process that you can except important ones like explorer, lsass, csrss, smss, etc and then trying to apply the update. Quote Link to comment Share on other sites More sharing options...
livevil Posted October 14, 2006 Author Report Share Posted October 14, 2006 I removed NAV to check for changes. The crash still occurs but I discovered something else: when I try to access to the advanced parameters of the network connections (where it is usually said that firewall is/is not enable), I got a message: "Windows cannot display the Properties of this connection. The Windows Management Instrumentation (WMI) information might be corrupted...."To solve this problem, microsoft tells to come back to an early backup point (which I haven't) or to restore using the install CDs (which I can't since XP was preinstalled).Do you think this could explain my problem ? Quote Link to comment Share on other sites More sharing options...
Recommended Posts
Join the conversation
You can post now and register later. If you have an account, sign in now to post with your account.