Windows shuts down my computer when I run my Norton-Symantec scann

[krazeekat]

Only when I run my Norton scanner and it gets to 'Windows' does this blue
screen pop up with far more sentences than a body could read, telling me it's
to protect my computer, and I can catch something about
kernal_stack_instage_error or something very like it. It happens during the
WINDOWS/svc pk files\i386\ portion, and the last time I tired it awhile ago,
it got hung up on the revert.wmz file...

I've contacted Norton and we figured out it's nothing they are doing. Also,
awhile ago I received a little message from Microsoft that 'the probllem has
been fixed' but it didn't say WHAT problem--I've no idea what prompted that.
'
This PC is custom-built, a bit over 4 years ago, has XP Home Edition on it
and I run only IE 6 for a browser. I've all three service packs and all
updates deemed 'necesary'.

Hope someone has some ideas? This has been going on for 4 days now.

 

[PA Bear [MS MVP]]

Please post ALL replies to your original thread. Always state your full
Windows version (e.g., WinXP SP3) when posting to this newsgroup.

Unexplained computer behavior may be caused by deceptive software
http://support.microsoft.com/kb/827315

Run a /thorough/ check for hijackware, including posting your hijackthis log
to an appropriate forum.

Checking for/Help with Hijackware
http://aumha.org/a/parasite.htm
http://aumha.org/a/quickfix.htm
http://aumha.net/viewtopic.php?t=5878
http://wiki.castlecops.com/Malware_Removal_and_Prevention:_Introduction
http://mvps.org/winhelp2002/unwanted.htm
http://inetexplorer.mvps.org/data/prevention.htm
http://inetexplorer.mvps.org/tshoot.html
http://www.mvps.org/sramesh2k/Malware_Defence.htm
http://defendingyourmachine2.blogspot.com/
http://www.elephantboycomputers.com/page2.html#Removing_Malware

When all else fails, HijackThis v2.0.2
(http://aumha.org/downloads/hijackthis.exe) is the preferred tool to use (in
conjuction with some other utilities). HijackThis will NOT fix anything on
its own, but it will help you to both identify and remove any
hijackware/spyware with assistance from an expert. **Post your log to
http://aumha.net/viewforum.php?f=30,
http://forums.spybot.info/forumdisplay.php?f=22,
http://castlecops.com/forum67.html, or other appropriate forums for review
by an expert in such matters, not here.**

If the procedures look too complex - and there is no shame in admitting this
isn't your cup of tea - take the machine to a local, reputable and
independent (i.e., not BigBoxStoreUSA or Geek Squad) computer repair shop.

 

[krazeekat]

Please post ALL replies to your original thread. Always state your full
Windows version (e.g., WinXP SP3) when posting to this newsgroup.

Sorry, is this what I need to put: XP Home Edition, Version 2002, SP 3..?

Unexplained computer behavior may be caused by deceptive software
http://support.microsoft.com/kb/827315

Run a /thorough/ check for hijackware, including posting your hijackthis log
to an appropriate forum.

I'll check, but it sure isn't showing up on my Norton-Symantec
antivirus-antispyware program.

I now have some more info--every time some application that takes quite
awhile is on, that blue screen witgh lots of white words comes up--and after
it quickly goes away, I've been getting a Microsoft message that a serious
problem has just been avoided. I copied this down awhile ago--this is in that
message, the one in the silver box coming from Microsoft, not from that blue
screen however:

BCCode:77 BCP1:C0000185 BCP2:C0000185 BCP3:00000000 BCP4:01D81000
OSVer:5_1_2600 SP:3_0 Product 768 1

The only 'variation' in this message every time appears to be in the BCP4
numbers.

Hope this gives you some ideas? I need a little something to go on before I
just 'take it to the shop' again.

 

[PA Bear [MS MVP]]

Please quote this entire message in your reply.

I'll check, but it sure isn't showing up on my Norton-Symantec
antivirus-antispyware program.

That does NOT necessarily mean the machine is free of all hijackware.

Answer the following questions by number, please:

1. You posted in an IE6-specific newsgroup: Are you running IE6 or a later
version of IE (e.g., IE7; IE8 Beta 2)?

2. Did this behavior only start after you'd installed WinXP SP3?

3. What Norton application is installed (e.g., Norton 360; Norton AntiVirus)
and when does your subscription expire?

4. Was this Norton application running in the background when you installed
WinXP SP3?

5. Do this:

Start | Settings | Control Panel | System | Advanced (tab) | Startup and
Recovery | Settings | System Failure | Automatically restart <=uncheck this
| OK your way out & reboot.

Now your machine will not automatically reboot when you get the BSOD (Blue
Screen of Death) and you will see a STOP error. Please post the STOP error
(e.g., 0x0000007E) in your next reply.

 

[krazeekat]

Answer the following questions by number, please:

1. You posted in an IE6-specific newsgroup: Are you running IE6 or a later
version of IE (e.g., IE7; IE8 Beta 2)?
IE6

2. Did this behavior only start after you'd installed WinXP SP3?

Yes--but not for several weeks after. The troubles began September 2nd,
after Norton did a bunch of updates and reconfigured lots of files, plus
blocked an attack called GLB21E.

3. What Norton application is installed (e.g., Norton 360; Norton AntiVirus)
and when does your subscription expire?

Norton Internet Security 2008 Version 15.0.0.60/Norton Systemworks Basic
bundle, Version 11.0.1 (They came as a package deal). Expiration is in 47
days, 10/24/08

4. Was this Norton application running in the background when you installed
WinXP SP3?

It was 'on' but don't know if it was 'running' Live Update at the time. It
was not installing new updates, that much I do know. Surely something in the
Norton package was running since I didn't turn anything off? Oh--almost
forgot--had to get Norton's help to 'uninstall and reinstall' the downloads,
because there was a glitch where I kept being asked for my 'key' and the data
was not good any longer. Last installation was done 11/24/08. The fool Norton
person 'did' it for me, and she did 'install them backwards' putting the
'wrong' one in first according to my directions. She told me it would not
matter in the least.

5. Do this:

Start | Settings | Control Panel | System | Advanced (tab) | Startup and
Recovery | Settings | System Failure | Automatically restart <=uncheck this
| OK your way out & reboot.

Cool--thank you for showing me how to stop that BSOD from disappearing!

Now your machine will not automatically reboot when you get the BSOD (Blue
Screen of Death) and you will see a STOP error. Please post the STOP error
(e.g., 0x0000007E) in your next reply.

Got this message when I tried running Scan Disk:

Stop: 0X0000007E (0X000005, 0XF7B3751D, 0XF7A26C38, OXF7A26934)

After this, I thought to finally open Norton Systemworks and fund the
'one-click fix' which found 370-some errors, fixed all but 3 of them. They
are temp files:
C:\WINDOWS\Temp\JETC508.tmp, C:\WINDOWS\Temp\Perfdata6b4.dct, and
cookie: Mozilla\Profiles\default\t6rwhdd3.slt\cookies.tit

Only the very first one up there is 'something new' I've never seen before.
These others have never caused a problem, and I have never been able to find
or get rid of them. I don't even have Mozilla downloaded any longer.

Later, I was finally able to Defragment--it was a mess! But I got through
the entire thing. Then, I tried to run a custom scan on 'folders' only. It
went down during the i386 files. Here was the message:

STOP 0X00000077 (0XC0000185, 0XC0000185, 0X00000000, 0X0151B000)

I had previously tried to scan Drivers, and didn't get the message because I
had not configured my PC to not restart when the BSOD came up.

What has helped the most was getting into the Norton Systemworks as opposed
to the Internet Security this time, and running every 'fix' program I could
find there. I had missing files, fragmented files, damaged files, etc...lots
of them. So, this is better now, but I still cannot run Norton's
antivirus/antispyware full scan, or even bits and pieces of the 'Windows'
Files or Folders, or the Disk scans. I can, however, now run Disk Scan fully
IF I only do the 'automatically fix file system errors' part first--the first
3 levels, then go back and run the 'scan for and attempt recovery of bad
sectors' part later--which has 4 levels in it.

This all is surely 'Norton fighting with Windows' again--isn't it? I just
did get a new bunch of Live Updates from Norton. I uninstalled my freeware
AVG antispyware and Adaware 2008 because Norton told me to. A friend told me
to get the spybot program but I've not done it yet--which one should I get?
Also, she told me how to go find updates for my drivers, and I found one from
Microsoft that for some reason I didn't have, so downloaded that, as well.
It's called:
NVIDIA Windows 2000, XP Display Drivers-- and I don't know how it could do
me any good since my system is XP 2002, but, oh well! I've got it anyway.

Thank you for your help so far! Now if I could just learn how to get past
what few files might be causing me the grief...! I'll look for more
information from you!

 

[PA Bear [MS MVP]]

Here's what I'd suggest:

1. After making certain you have a copy of your Product Key(s), uninstall
all Norton software (including LiveUpdate and any Norton Add-ons) via
Add/Remove Programs.

2. Enable the Windows Firewall.

NB: You're "working without a net" now: Don't to ANYTHING else online (e.g.,
browsing; reading email; chatting) except #4 below until your new anti-virus
application has been installed and fully updated!

3. Download/run this removal tool:
http://service1.symantec.com/SUPPORT/tsgeninfo.nsf/docid/2005033108162039

4. Reboot and /immediately/ install Avira AntiVir* (free) using this link:
http://www.free-av.com/

NB: You do NOT want more than one (1) anti-virus application installed and
loading at boot!

5. Manually update your new anti-virus application, reboot into Safe Mode
and then run a full system scan.

6. Reboot into Windows.

Do any of your problems persist now? (Given the 0X00000077 error, I suspect
the machine has a hijackware/virus infection and I very much doubt AntiVir
will detect and remove all of them.)

PS: I would NOT recommend installing any driver or other third-party updates
offered by Windows Update! And I would not recommend installing any Norton
application on any machine.

 

[krazeekat]

Thank you for this information--but I think this is going to be much too
difficult for me to actually do by myself here and not get messed up. I'm not
even sure which Norton product key is which--I had at least two of them since
Norton had to help me uninstall and download their product more than once (at
least I didn't have to pay them for it). I realize that Norton and Windows
aren't always compatible--in general, on my computer, the updates each sends
have always fixed their little 'issues' though, even if it takes a week or
two of those updates to get it right.

That 0X00000077 number and its group isn't the same number or group that
shows up since I ran that Norton 'one-click fix' and got all the registry
goof-ups mended, got rid of all file 'goofs' except the ones I mentioned
before. Interesting--I even went in and found those individual files, and can
scan them individually--Norton's antivirus/antispyware program isn't showing
any problems. Ditto, with each file that makes my system 'stick' and then
finally go down with that BSOD. They show no problems if individually
scanned.

I am now able to accomplish lots more towards cleaning out my computer,
running Scan Disk, Defragmenting, even doing some Norton scanning--I guess
I'll talk to the shop where PAL here was built, probably take it in next
week, money depending, have them look at it, possibly uninstall Norton, put
on whatever they recommend, etc. This silly computer doesn't exactly 'work'
quite the same way the store-built ones do for some reason. In general, the
Norton products DO work very well with the computers built by this shop (and
I love some of its features so much). The fellows who work there will
probably 'kick my butt' for installing Windows Service Pack 3, but doggone
it, PAL worked so much better for awhile there after I did so!

I'll certainly ask about your suggestions when I speak to them. I'd never
even heard of the particular antivirus freeware you are recommending. Who
knows--I may get 'brave' here and try what you suggest after all--gotta think
about it awhile though. It's not that I don't 'want to'...

In the meantime--I still think I need an antispyware program, and since I
was told to uninstall both AVG and Adaware, all I have is the Norton one,
which can't look at quite everything, only most things. So is that spybot
freeware a good idea? If so, how can I be sure I am downloading the 'real
thing' and not 'something else'?

Oh, by the way--the messages I get on that BSOD are all a bit different. I
found this one yesterday and I'd like to know how to implement this
suggestion it gave:

"Disable BIOS memory options such as caching or shadowing."

What is BIOS, and how would I go about doing this? For all I know, it might
even solve the problem!

krazeekat

=====================================================

 

[PA Bear [MS MVP]]

If your Norton subscription's expiring soon, don't worry about the Product
Key(s) and just leave AntiVir installed.

You MUST run the removal tool after uninstalling the Norton stuff to remove
all of the leftovers.

 

[krazeekat]

After talking to the guys at my computer shop by phone, I think I'm going to
try what you say, here. I've learned that those 'numbers' I get on the BSOD
screens mean that either: 1) I have a virus or hijack problem like you
suggested, OR, 2) (and this is what I believe, to be honest) two different
applications are trying to use the same file at the same time--that is what I
read when I Googled the KERNAL_STACK_1PAGE_ERROR message.

I did put Spybot on my computer--and ran it. It told me there is a Windows
file where the registry was changed. I think Norton did it--none of this even
happened until they put on all those bazillions of updates last week.

My shop likes the little freeware antivirus program you suggested. They do
highly recommend Panda though, that eventually I get the 'full enchilada pay
version' and use only that, for antivirus, antispyware, etc.

Before I get Panda though--I want to try everything you have recommended
earlier, and if I still get the BSOD screens when I try to run my scanners,
then I have to take PAL here to the shop, before I download Panda. I might
anyway, unless the thing absolutely 'runs like a top' etc.

About the Norton 'keys'--I only have the ones from the first installation
anyway, so, guess I can't reinstall the thing anyhow. But, question: how do I
uninstall all their updates, as you said I should? It's not as though there
is a Norton update list anywhere that I know of. Would running that
'uninstall' software program you gave me as a link, work to do that?

Oh--is it all right to download and 'save' to my Documents (but not run) the
antivirus freeware before I uninstall Norton and do everything else on your
list? I'll wait to see what you say, about what I've put in this latest reply
before doing anything.

Thank you so much for your assistance!

++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

 

[PA Bear [MS MVP]]

A1. Follow my instructions and all remnants of any Norton applications will
be gone.

A2. Yes, you can save the installer for AntiVir to your desktop so that you
can install it as soon as your uninstalled all the Norton stuff, have run
the removal tool, and have rebooted.

You will need to be online to complete the installation (a Product Key will
be sent to your registered email address which you'll then use to activate
the install).

Don't to any browsing or anything with email (other than open the
confirmation email from Avira) until you've got AntiVir installed & have the
current definitions installed! And make certain that the Windows Firewall
is enabled before connecting the machine to the internet.

 

[krazeekat]

I now have all your instructions. But I need you to know something else,
first. I've had 3 more Norton updates and now I can run every single thing
except certain Windows Service Pack Files in the i386 group. Disk cleanup,
Scan disk, Defragment--they all work. And I can scan nearly everything from
Norton so long as I do it 'custom-style' and leave out the part of those i386
files in the Windows Service Pack group causing the trouble. I'ts all manual,
takes awhile, but certainly does work OK.

Interestingly, there are two temporary files in the Windows 'temp' group I
cannot get rid of no matter what. One is a JETC file, the other a
Perflib_Perfdata file (the numbers after both 'change' but I cannot get rid
of them). When I go right TO those individual files and scan them, they do
not 'register' as even being scanned!
Scanning them individually does not take down my system, either. I suspect
they 'share' something with certain files in that i386 group--it's my best
hunch. The messages I get on those BSOD screens, when I look up the
KERNEL_STACK_INSTAGE_ERROR message in Google--it even says that files
'fighting with each other' is one of the things which can cause those very
numbers I get on the BSOD screens.

I am still going to do as you suggest--but am keeping all your remarks in a
Documents folder I've set up, and plan to try doing it just as soon as my
credit card 'turns over' shortly after the first of October. That is--unless
the problems become as big as before. I DO hate to lose sonme of the
wonderful features of my Norton package, such as Identity Safe. I depend on
that thing! I cannot remember ALL my signin information and passwords to
every single site I must sign into!

The point is--once I do as you say, IF I still have any kind of PC problems,
it will definitely mean a trip to the shop and I can't afford that for
another 3 weeks.

I am wondering if the Windows Svc Pck 3 'did something' it shouldn't. Also,
I wonder if perhaps I should not have removed a remaining Scv Pck 2 folder I
found, even though when I opened the thing it said, 'don't download Svc Pck 2
because your computer already has updated information on it'--I thought it
was an extraneous folder I didn't need? Also--I only did this 2 days ago,
well after my problems began.

What do you think of the pay version of Panda antivirus/antispyware etc? My
shop seems totally 'sold' on it...

I cannot thank you enough for all your help! I have virtually lived on this
PC since the troubles began. I've learned a lot, for sure! That is, except
how to finish 'debugging' this problem...

krazeekat

++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++