Requesting help please

[TylerDoom]

Another update.. My IE is still crashing and throwing up the DEP info...  So something is still wrong with my PC it seems. Any ideas?? Thanks for your ongoing help Superdave

[SuperDave]

Download WhoCrashed from here
This program checks for any drivers which may have been causing your computer to crash....

Click on the file you just downloaded and run it.
Put a tick in Accept then click on Next
Put a tick in the Don't create a start menu folder then click Next
Put a tick in Create a Desktop Icon then click on Install and make sure there is a tick in Launch Whocrashed before clicking Finish
Click Analyze
It will want to download the Debugger and install it  say Yes

WhoCrashed will create report but you have to scroll down to see it
Copy and paste it into your next reply

[TylerDoom]

Here is the report for WhoCrashed

Thanks for your time and ongoing support with my PC issues SuperDave


--------------------------------------------------------------------------------
Analysis
--------------------------------------------------------------------------------

Crash dump directory: C:\Windows\Minidump

Crash dumps are enabled on your computer.


On Thu 9/9/2010 4:59:07 AM your computer crashed
This was likely caused by the following module: csrss.exe
Bugcheck code: 0xF4 (0x3, 0x88A202E0, 0x88A2042C, 0x82A60710)
Error: CRITICAL_OBJECT_TERMINATION
Dump file: C:\Windows\Minidump\Mini090910-02.dmp
file path: C:\Windows\system32\csrss.exe
product: Microsoft® Windows® Operating System
company: Microsoft Corporation
description: Client Server Runtime Process
The crash took place in a standard Microsoft module. Your system configuration may be incorrect, possibly the culprit is in another driver on your system which cannot be identified at this time.



On Thu 9/9/2010 5:24:06 AM your computer crashed
This was likely caused by the following module: csrss.exe
Bugcheck code: 0xF4 (0x3, 0x88C6EC48, 0x88C6ED94, 0x82A2F710)
Error: CRITICAL_OBJECT_TERMINATION
Dump file: C:\Windows\Minidump\Mini090910-01.dmp
file path: C:\Windows\system32\csrss.exe
product: Microsoft® Windows® Operating System
company: Microsoft Corporation
description: Client Server Runtime Process
The crash took place in a standard Microsoft module. Your system configuration may be incorrect, possibly the culprit is in another driver on your system which cannot be identified at this time.




--------------------------------------------------------------------------------
Conclusion
--------------------------------------------------------------------------------

2 crash dumps have been found and analyzed. Note that it's not always possible to state with certainty whether a reported driver is really responsible for crashing your system or that the root cause is in another module. Nonetheless it's suggested you look for updates for the products that these drivers belong to and regularly visit Windows update or enable automatic updates for Windows. In case a piece of malfunctioning hardware is causing trouble, a search with Google on the bug check errors together with the model name and brand of your computer may help you investigate this further.

[SuperDave]

Re-running ComboFix to remove infections:

• Close any open browsers.
• Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
• Open notepad and copy/paste the text in the quotebox below into it:
  

  
  FileLook::
  
  C:\Windows\system32\csrss.exe
  
  
• Save this as CFScript.txt, in the same location as ComboFix.exe
  
  
  
  
• Referring to the picture above, drag CFScript into ComboFix.exe
• When finished, it shall produce a log for you at C:\ComboFix.txt
  
• Please post the contents of the log in your next reply.

************************************
Please try this even if you don't have the OS disk. If it finds an error it will ask for the disk. If not, we'll know that the files are ok.

Do you have an XP CD?

If so, place it in your CD ROM drive and follow the instructions below:
•Click on Start > Run and type sfc /scannow then press Enter (note the space between scf and /scannow)
*Let this run undisturbed until the window with the blue  progress bar goes away
SFC - Which stands for System File Checker, retrieves the correct version of the file from %Systemroot%\System32\Dllcache or the Windows installation source files, and then replaces the incorrect file.

[TylerDoom]

Hey again, I ran that how you said and nothing popped up but the log afterwards.. So that means that csrss.exe isnt messed up?  I wonder whats causing that DEP.  I will continue doing what you tell me if there is more to try...

     Thanks a million for ur help and time SuperDave


Also here is the log on that "Look"

--- c:\windows\system32\csrss.exe ---
Company: Microsoft Corporation
File Description: Client Server Runtime Process
File Version: 6.0.6000.16386 (vista_rtm.061101-2205)
Product Name: Microsoft® Windows® Operating System
Copyright: © Microsoft Corporation. All rights reserved.
Original Filename: CSRSS.Exe.MUI
File size: 6144
Created time: 2008-01-21 02:24
Modified time: 2008-01-21 02:24
MD5: ABCA209EBA02CB59233614DB83B4F50D
SHA1: F3A49C0D42455DAA097BCFB6455F8F31C20AFBF 8

[SuperDave]

I'm going to consult with my mentor about this problem. If I don't get back to you in a few days please pm me.

[evilfantasy]

Have you been in the control panel and adjusted any of the settings in there?

DEP warnings are not necessarily a bad thing, it could be some software not agreeing with Windows. Many people choose to turn DEP warnings off.

Is there something that you installed around the time these warnings started happening>

[TylerDoom]

No not that I can think of... My IE has been crashing A LOT more in the last 24 hours too... Like every 10 minutes when I click on a lot of stuff.  From the way this sounds would it be unsafe to turn off DEP? 

  I will check over my programs tho to make sure I didnt install anything, but I havent I am almost certin.


 Thanks for ur reply Evilfantasy.

[TylerDoom]

This is happening now.. In the Problems reports and solutions manager.
Is this normal?
 
"Solve a problem with PSIKey
PSIKey has stopped working properly.

An update is available that solves this problem.


Click to download the update from the Protexis Inc. website
Download instructions

In the File Download dialog box, click Run or Open.  If you are prompted for an administrator password or confirmation, type the password or provide confirmation.

Follow the steps in the installation wizard."

 

[evilfantasy]

Have a look here. How to Disable and Uninstall Protexis Licensing Service (PSIService.exe)

Let us know....

[TylerDoom]

This is all I could find with CCleaner and HiJackthis.. Is there some other way to find and delete that item??

[img=http://s2.postimage.org/4pLd0.jpg]

[evilfantasy]

Look in the Protexis folder and see if there is an uninstaller in it.

[TylerDoom]

I don't have a Protexsis folder, I never accepted that update or "Solution".  I declined it both times its popped up because it seems weird..

   Hopin' I get the right words out to explain what I mean.. 

I don't have the protexsis folder tho.

[evilfantasy]

Try this. How do I turn off Data Execution Prevention errors?