Re: New Info on IRQ BSOD

aldago

Event ID: 1000
Date: 12/12/2008

The Error is mostly caused by whatever programme is running
explorer.exe. What programme is not immediately apparent. However, it
apparent from file version that Windows XP is not being updated in the
normal way. Explorer.exe should have been updated before SP3 and upon
installing SP3. It is not possible to know what affect the failure to
update is having both in terms of security and the proper running of
Windows. Is there a reason for not updating?

Event ID: 5000
Date: 12/12/2008

Windows Defender is complaining about not being updated. Why is this
occurring?

Event ID: 7026
Date: 12/12/2008

You told me earlier that Stopzilla had been removed. You would appear to
have left the start up item in place.

A safer way than msconfig to disable / remove unwanted start up items is
to use Autoruns.
http://www.microsoft.com/technet/sysinternals/ProcessesAndThreads/Autoruns.mspx

With Autoruns you can uncheck an item, which disables it from starting,
or you can can right click an item and then delete it. If you uncheck
you can recheck to re-enable the item. It is a much safer approach than
editing the Registry. Another useful feature of the programme is that
you can right click an item and select Search Online to get information
about the item selected.

Look for a reference to szkg and disable the item.

Event ID: 3004
Date: 12/12/2008

Windows Defender is alerting you to the installation of unclassified
software. This seems to be something related to Star Wars Games. This
warning is probably safely ignored.

Event ID: 20
Date: 12/12/2008

You have either installed a printer or updated drivers. What I do not
understand is why there are two reports? Is there a problem?

Event ID: 3019
Date: 12/12/2008

There are a number of explanations. I suggest we revisit this error
later if it recurs after the problems highlighted above have been
sorted.


--



Hope this helps.

Gerry
~~~~
FCA
Stourport, England
Enquire, plan and execute
~~~~~~~~~~~~~~~~~~~



aldago wrote:
Gerry,
Here are the Application and System Errors Report. There are about 60
warnings

involving MsiInstaller under Applications which I didn't send because
I was afraid a single post would be too

long. There are four Warnings under System so I've tacked those onto
the
end. If you

want the Application Warnings I'll post them.

APPLICATION ERRORS

Event Type: Error
Event Source: Application Error
Event Category: None
Event ID: 1000
Date: 12/12/2008
Time: 4:38:52 AM
User: N/A
Computer: ALSEMACHINE
Description:
Faulting application explorer.exe, version 6.0.2900.2180, faulting
module msvbvm60.dll,

version 6.0.96.90, fault address 0x00015d8a.


Snipped


Event Type: Error
Event Source: MPSampleSubmission
Event Category: None
Event ID: 5000
Date: 12/12/2008
Time: 2:02:21 AM
User: N/A
Computer: ALSEMACHINE
Description:
EventType mptelemetry, P1 80244022, P2 endsearch, P3 search, P4
1.1.1593.0, P5

mpsigdwn.dll, P6 1.1.1593.0, P7 windows defender, P8 NIL, P9 NIL, P10
NIL.

Snipped


SYSTEM ERRORS

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7026
Date: 12/12/2008
Time: 12:02:59 PM
User: N/A
Computer: ALSEMACHINE
Description:
The following boot-start or system-start driver(s) failed to load:
szkg


Snipped

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7026
Date: 12/12/2008
Time: 9:49:09 AM
User: N/A
Computer: ALSEMACHINE
Description:
The following boot-start or system-start driver(s) failed to load:
szkg

Snipped -Four copies of the same report.


Event Type: Warning
Event Source: WinDefend
Event Category: None
Event ID: 3004
Date: 12/12/2008
Time: 11:33:48 AM
User: N/A
Computer: ALSEMACHINE
Description:
Windows Defender Real-Time Protection agent has detected changes.
Microsoft

recommends you analyze the software that made these changes for
potential risks. You

can use information about how these programs operate to choose
whether to allow them

to run or remove them from your computer. Allow changes only if you
trust the program

or the software publisher. Windows Defender can't undo changes that
you allow. For more information please see the following:
http://go.microsoft.com/fwlink/?linkid=74409
Scan ID: {503472D8-B37E-4282-8F79-F91F7B2A1F73}
User: ALSEMACHINE\Owner
Name: Unknown
ID:
Severity: Not Yet Classified
Category: Not Yet Classified
Path Found:

runkey:HKCU@S-1-5-21-3386413868-485311502-1189716786-1003\Software\Microsoft\

Windows\CurrentVersion\Run\\swg
Alert Type: Unclassified software
Detection Type:

For more information, see Help and Support Center at

http://go.microsoft.com/fwlink/events.asp.

Event Type: Warning
Event Source: Print
Event Category: None
Event ID: 20
Date: 12/12/2008
Time: 11:21:17 AM
User: NT AUTHORITY\SYSTEM
Computer: ALSEMACHINE
Description:
Printer Driver HP PSC 1600 series for Windows NT x86 Version-3 was
added or

updated. Files:- hpz2ku12.dll, hpzpm312.dll, hpop1612.dat,
hpfmom12.hlp,

hpzimc12.dll, hpzstw12.exe, hpzslk12.dll, hpzr3212.dll, hpzrm312.dll,
hpzcon12.dll,

hpzcfg12.exe, hpzeng12.exe, hpzflt12.dll, hpzime12.dll, hpzjui12.dll,
hpzpre12.exe,

hpzres12.dll, hpzstc12.exe, hpztbi12.dll, hpztbu12.exe, hpztbx12.exe,
hpzlnt12.dll,

hpzsnt12.dll, hpzcoi12.dll, hpzvip12.dll, hpzims12.dll, hpzpcl12.dll.

For more

information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.

Event Type: Warning
Event Source: MRxSmb
Event Category: None
Event ID: 3019
Date: 12/12/2008
Time: 11:01:15 AM
User: N/A
Computer: ALSEMACHINE
Description:
The redirector failed to determine the connection type.


Snipped


Snipped -Two copies of same report.






"Gerry" wrote:

Aldago

Leave UPH installed.

Have a look in the System and Application logs in Event Viewer for
Errors and Warnings and post copies here. Don't post any more than 48
hours ago.

You can access Event Viewer by selecting Start, Control Panel,
Administrative Tools, and Event Viewer. When researching the meaning
of the error, information regarding Event ID, Source and Description
are important.

HOW TO: View and Manage Event Logs in Event Viewer in Windows XP
http://support.microsoft.com/kb/308427/en-us

A tip for posting copies of Error Reports! Run Event Viewer and
double click on the error you want to copy. In the window, which
appears is a button resembling two pages. Click the button and close
Event Viewer.Now start your message (email) and do a paste into the
body of the message. Make sure this is the first paste after exiting
from Event Viewer.


--



Hope this helps.

Gerry
~~~~
FCA
Stourport, England
Enquire, plan and execute
~~~~~~~~~~~~~~~~~~~
aldago wrote:
Gerry,
I downloaded the UPHC software and it did something - but I don't
know what. I no longer get the BSOD but perhaps that's because the
machine won't shutdown. When I shut down it hangs for a long time at
the "logging off" screen. It will eventually get to the "Windows is
shutting down" screen where it stays and I finally have to use the
power button to shut it down. Also, bootup takes an inordinately
long time. I could remove the Hive Cleaner and see if I get the
BSOD again but I don't know that it will help.

"aldago" wrote:


Gerry,
Forgot to mention that I removed Stopzilla from my computer some
time ago including registry items.
aldago


"aldago" wrote:

Gerry, sorry for the miscommunication. I did reply and it must
have gotten screwed up somehow. What I replied to you was:

I neglected to answer all the questions in my last post. In
particular, Gerry asked about the make and model of the computer
I'm using. I did list that info at the bottom of my original post
but here it is again:

Emachine T3506
Total Physical Memory: 1.5Gb
Windows XP Home SP2
3.2GHz Intel Celeron
120 Gb Hard Drive

As for Windows CDs I do not have an original for this machine.
I did make a bootable recovery disk using Bart's PE and the I 386
file from the computer. I do have disks for Windows XP Pro.
Ichecked the Device Manager and all looks normal. I had read where
this bsod had occurred with some malware comprimised machines so
just to cover all bets I ran HijackThis and submitted the log file
for analysis. The results indicated a couple of suspicious files
but nothing glaring. I also found that a heck of a lot of the
people who had this IRQ BSOD had emachines. Thanks for the other
info. I will download and run that software and I'll post back
here again.

"Gerry" wrote:

aldago

http://snipurl.com/7qbeo [216_239_59_132]

You never responded to my last post?

Download and install the User Profile Hive Cleanup Service
Download details: User Profile Hive Cleanup Service
http://snipurl.com/5b61

UPHClean v1.5e readme.txt
http://snipurl.com/ko8m

This may resolve the Warning message without the need to
configure services.

What is the status of Stopzilla on your computer?

Is this a possibility?
http://support.microsoft.com/kb/311806

--



Hope this helps.

Gerry
~~~~
FCA
Stourport, England
Enquire, plan and execute
~~~~~~~~~~~~~~~~~~~

aldago wrote:
The original post is "IRQ BSOD" posted 12/5/2008

Since that post, I ran pc diagnostics from Hiren's Boot Disk and
came up with "failed system stress" test. Don't know what that
means. Can anyone help with that??

I also get popups on boot:

The system has recovered from a serious error.

The following files will be included in the error report:
C:\DOCUME~1\Owner\LOCALS~1\Temp\WER616a.dir00\Mini120908-03.dmp
C:\DOCUME~1\Owner\LOCALS~1\Temp\WER616a.dir00\sysdata.xml

Error Signature:
BCCode : a BCP1 : 000000B0 BCP2 : 00000002 BCP3 :
00000000 BCP4 : 804EE061 OSVer : 5_1_2600 SP : 2_0
Product : 768_1

Registry Change: KernalFaultCheck
Old Data: %systemroot%\system32\dumprep 0 -k

Don't know what that means either. But I put it out in case some
MS System guys monitor these posts and can explain it. Also the
machine doesn't boot or shutdown properly. Very very slow. But,
once it's up it runs faster than ever - unless it freezes up. I
have other computers to use but this problem is a bug and I hate
to let it go. Anyone think of any tests I might run? I can run
diagnostics from a boot disk (UBCD, UBCD for Windows, etc.)
rather than from Windows.


.

Loading