Getting blue screen of death!?

For the first time in many many years, I've finally got the blue screen. Something happened to my computer in the last few days, and when I got back on it the desktop background had changed to a virus warning, which was just plain weird. I ran all my scans, and found/fixed a fair few problems, or so I thought.

Now this comes up when I havent touched the computer for a while:



It goes away and I can go back to my normal screen when I press the power button on the computer.
Also, I am unable to change the desktop background from right-clicking it. I have to go to the picture and select 'display as desktop background'.
I'll give system restore a go, but I think I may have disabled it due to low disk space.

Any indeas?

Hi watch_the_rocks,

This happened to me a few years ago, and the tech guy said IRP stack locations deal with how packs of information are shuffled between drivers. Have you installed new software or hardware lately? That could be the culprit. He also said on occasion when the ram is going bad, you will get this message. He had me remove and reseat all the ram sticks, and then remove one at a time and reboot in safe mode to see if one of the sticks had gone bad. It turned out in my case that it was a ram stick that had gone bad.

Hmm, thanks very much Toromos. Non-factory RAM is installed, so that could be it.

But also, the message comes up once every 10 minutes, but only when I havent touched the computer for those 10 minutes, like when I'm away from it or watching a movie. Weird.

Better late than never, but this might help out others with the same problem, as this is quite a common infection at the moment.


This is the remenants of the rogue "XP Antivirus 08" type spyware infection.

As well as disabling some of the tags on on your display properties, it installs a fake bluescreen screensaver which pops up with crap like that. If you click your mouse button during that BSOD, you'll get your desktop back.

The cure?

1. www.winhelponline.com...

Download and run the .vbs script upon that page. That'll restore your tabs and allow you to change the screensaver back to normal. If you look through your screensavers, you'll see one with a random "jjk54hthd" type name. That is the rogue BSOD screensaver.

2. Download, run and scan a good anti-spyware programme. I've cleared lots of these problems using one called "SuperAntiSpyware". During the scan, provided you have not deleted the above rogue screensaver already, it will be picked up during the scan as "sysinternals.bluescreen", and whilst not actually marked as being harmful (it's not by itself, it's what put it there in the first place you need to worry about), you might as well mark it for deletion whilst you're there.


HTH

I just had something similar happen to mine.

I got a virus that changed my background like yours and wouldn't let me change it back.

I had an "expert" helping me fix mine and to be honest I don't remember exactly everything we did to fix it. Also I'm not currently on that PC to get the "fix" that was sent to me.

I'll see if a friend is available that might give you some help.

Stand by.

Originally posted by elevatedone
I just had something similar happen to mine.

I got a virus that changed my background like yours and wouldn't let me change it back.

I had an "expert" helping me fix mine and to be honest I don't remember exactly everything we did to fix it. Also I'm not currently on that PC to get the "fix" that was sent to me.

I'll see if a friend is available that might give you some help.

Stand by.

The script in that link I posted before will restore your display properties. You can do it by hand, editing the registry, but that script will do the job just the same, and I promise it's safe. Read the responses to the original post at that link, nothing dodgy.

As before, it's what caused this that you really need to worry about, hence scanning your 'puter with your preferred anti virus/anti spyware software ASAP.

If you want to know what the bluescreen means and what's causing it, then use microsoft windbg.

www.microsoft.com...

Here's a simple tutorial on how to diagnose what the problem is.

forums.majorgeeks.com...

While Lozzo's post may be true, regarding it being the result of remnants of the XP Antivirus 08. I've personally never encountered this particular "error" after having removed that piece of crapware, something I've had to do for clients many times recently. Actually, some of the variants do much more than merely disabling tabs in display settings and adding the desktop background "alert".

One of the worst I've necountered removed access to "C" drive in My Computer. Removed "Control Panel", "Help & Support", and "Run" from the start menu. Disabled access to both Task Manager and Regedit. Added "VIRUS ALERT" to the end of the clock display. As well a myriad of other registry changes intended to prevent it's removal.

ANYWAY... back on topic.

There is a "hotfix" available from Microsoft for this particular issue as well as an MS Support Doc with step-by-step directions of what you'll need to do after having applied the "hotfix".

You can find both the "hotfix" and the step-by-step directions, here:
http://support.microsoft.com/kb/906866

The hotfix link is at the top of the page under "Hotfix Download Available" and the directions specific to Windows XP are further down under the "Hotfix information for Windows XP" heading.

Specifically:

After you install this hotfix, modify the DfsIrpStackSize registry entry. To do this, follow these steps:1. Click Start, click Run, type regedit, and then click OK.
2. Locate and then click the following registry subkey:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Mup\Parameters
3. In the right pane, right-click DfsIrpStackSize, and then click Modify.

Note If the DfsIrpStackSize registry entry does not exist, you must create it. To do this, follow these steps:a. On the Edit menu, point to New, and then click DWORD Value.
b. Type DfsIrpStackSize, and then press ENTER.

4. In the Base box, click Decimal, type 10 in the Value data box, and then click OK.

Notes• A value of 10 allows for a maximum of eight file system filter drivers.
• The default value of the DfsIrpStackSize registry entry is 5. A value of 5 allows for a maximum of three file system filter drivers.
• If you set the value to a number that is greater than 10, the value is automatically set back to 5.
• If you do not apply this hotfix, the DfsIrpStackSize registry value is ignored.

5. Exit Registry Editor.
6. Restart the computer.

While the registry edits may seem a bit overwhelming for those who may not be particularly comfortable making these type changes/edits. Rest assured that as long as you perform each and every step as directed, you should have no problems whatsoever.

Hope this helps. Otherwise, post back and we'll go from there.

 

Originally posted by 12m8keall2c
While Lozzo's post may be true, regarding it being the result of remnants of the XP Antivirus 08. I've personally never encountered this particular "error" after having removed that piece of crapware, something I've had to do for clients many times recently. Actually, some of the variants do much more than merely disabling tabs in display settings and adding the desktop background "alert".

The reason you've not seen it after removing XP Antivirus 08 is that you have (probably) removed that screensaver along with the malware.

Depending on the anti-spyware software you have used to clear it (been using/testing Superantispyware myself for these ones. So far, seems like a nice bit of kit), it may well clear the whole screen saver, or just the "lock" to it on display properties. If it just clears the "lock", you'll still see the screensaver listed in display properties/screen savers as some random gtr534tdg type filename. If so, enable it and enjoy! It's harmless in itself but, as before, it's what put it there you need to worry about.

Again, with the rate of infection that this thing has been hitting computers around here lately, not really had time to research exactly what it does, just on how to get rid of the swine!

Google "Antivirus XP 08 screensaver" in Google, there are tons of links about it, there are even some videos on Youtube showing it.

One of the worst I've necountered removed access to "C" drive in My Computer. Removed "Control Panel", "Help & Support", and "Run" from the start menu. Disabled access to both Task Manager and Regedit. Added "VIRUS ALERT" to the end of the clock display. As well a myriad of other registry changes intended to prevent it's removal.

Nice! On Monday, going by the description I was given earlier, I'll be doing battle with one of those infections. Sounds like it could be a bit of a challenge. Still, least it'll keep me occupied for a while.


Anyway, to get back on topic. The OP's bluescreen certainly appears to be result of this fake BSOD screensaver, but for anyone with a real IRP stack error, the information you posted is the way to sort it.

OK, thanks to everyone that posted! That problem is fixed.

But now Ive got a much much worse one: FF help forums

Absolutely any input into that one would be good. Thank you!