Random BSOD's

hey,

I'm analyzing a dump file for the first time and would just like somebody to confirm my findings. From what I understand in the debuglog, the bsod was caused by "yv8g67.exe ", a virus no doubt, so a virus scan should solve my problem?

Thanks
-Sean


Opened log file 'c:debuglog.txt'

Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [J:\WERb780.dir00\Mini021310-02.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: C:\WINDOWS;C:\WINDOWS\system32;C:\WINDOWS\system32\drivers
Windows XP Kernel Version 2600 (Service Pack 3) MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 2600.xpsp_sp3_gdr.091208-2036
Machine Name:
Kernel base = 0x804d7000 PsLoadedModuleList = 0x805634c0
Debug session time: Sat Feb 13 09:12:13.015 2010 (GMT-5)
System Uptime: 0 days 0:00:48.718
Loading Kernel Symbols
...............................................................
................................................................
......
Loading User Symbols
Loading unloaded module list
...
Unable to load image LSIPNDS.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for LSIPNDS.sys
*** ERROR: Module load completed but symbols could not be loaded for LSIPNDS.sys
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 100000D1, {7, 2, 0, f6527734}

Probably caused by : LSIPNDS.sys ( LSIPNDS+8734 )

Followup: MachineOwner
---------

0: kd> !analyze -v;r;kv;lmtn;.logclose;q
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: 00000007, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000000, value 0 = read operation, 1 = write operation
Arg4: f6527734, address which referenced memory

Debugging Details:
------------------


READ_ADDRESS: 00000007

CURRENT_IRQL: 2

FAULTING_IP:
LSIPNDS+8734
f6527734 8b10 mov edx,dword ptr [eax]

CUSTOMER_CRASH_COUNT: 2

DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: 0xD1

PROCESS_NAME: yv8g67.exe

LAST_CONTROL_TRANSFER: from f652a65f to f6527734

STACK_TEXT:
WARNING: Stack unwind information not available. Following frames may be wrong.
f793ce3c f652a65f 86aba000 00000000 00000000 LSIPNDS+0x8734
f793ce60 f71b5f5a 00000000 86aba000 00000000 LSIPNDS+0xb65f
f793ce84 804e2b6e 86abe4b0 86abe488 89d83eda NDIS!ndisMTimerDpcX+0x7a
f793cfa0 804e209d 1d09e42c ffdff9c0 ffdff000 nt!KiTimerListExpire+0x14b
f793cfcc 804dcd22 80562320 00000000 00000c2d nt!KiTimerExpiration+0xb1
f793cff4 804dc88d ebf35d44 00000000 00000000 nt!KiRetireDpcList+0x61
f793cff8 ebf35d44 00000000 00000000 00000000 nt!KiDispatchInterrupt+0x2b
804dc88d 00000000 00000009 0081850f bb830000 0xebf35d44


STACK_COMMAND: kb

FOLLOWUP_IP:
LSIPNDS+8734
f6527734 8b10 mov edx,dword ptr [eax]

SYMBOL_STACK_INDEX: 0

SYMBOL_NAME: LSIPNDS+8734

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: LSIPNDS

IMAGE_NAME: LSIPNDS.sys

DEBUG_FLR_IMAGE_TIMESTAMP: 3ef91459

FAILURE_BUCKET_ID: 0xD1_LSIPNDS+8734

BUCKET_ID: 0xD1_LSIPNDS+8734

Followup: MachineOwner
---------

eax=00000007 ebx=86aba080 ecx=86aba6e0 edx=00000004 esi=86aba000 edi=86abe478
eip=f6527734 esp=f793ce34 ebp=f793ce3c iopl=0 nv up ei pl nz na po nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010202
LSIPNDS+0x8734:
f6527734 8b10 mov edx,dword ptr [eax] ds:0023:00000007=????????
ChildEBP RetAddr Args to Child
WARNING: Stack unwind information not available. Following frames may be wrong.
f793ce3c f652a65f 86aba000 00000000 00000000 LSIPNDS+0x8734
f793ce60 f71b5f5a 00000000 86aba000 00000000 LSIPNDS+0xb65f
f793ce84 804e2b6e 86abe4b0 86abe488 89d83eda NDIS!ndisMTimerDpcX+0x7a (FPO: [4,0,4])
f793cfa0 804e209d 1d09e42c ffdff9c0 ffdff000 nt!KiTimerListExpire+0x14b (FPO: [0,62,0])
f793cfcc 804dcd22 80562320 00000000 00000c2d nt!KiTimerExpiration+0xb1 (FPO: [4,6,0])
f793cff4 804dc88d ebf35d44 00000000 00000000 nt!KiRetireDpcList+0x61 (FPO: [0,1,0])
f793cff8 ebf35d44 00000000 00000000 00000000 nt!KiDispatchInterrupt+0x2b (FPO: [Uses EBP] [0,0,1])
804dc88d 00000000 00000009 0081850f bb830000 0xebf35d44
start end module name
804d7000 806ff000 nt ntkrnlmp.exe Tue Dec 08 14:26:04 2009 (4B1EA84C)
806ff000 8071fd00 hal halmacpi.dll Sun Apr 13 14:31:27 2008 (4802517F)
bf000000 bf011600 dxg dxg.sys Sun Apr 13 14:38:27 2008 (48025323)
bf012000 bf3cac40 nv4_disp nv4_disp.dll Mon Jul 28 18:53:44 2003 (3F25A978)
bf800000 bf9c3d00 win32k win32k.sys Fri Aug 14 09:21:11 2009 (4A8564C7)
bffa0000 bffe5c00 ATMFD ATMFD.DLL Sun Apr 13 20:09:55 2008 (4802A0D3)
ebe33000 ebe5d180 kmixer kmixer.sys Sun Apr 13 14:45:07 2008 (480254B3)
ebe5e000 ebe80d00 aec aec.sys Thu May 24 15:53:32 2007 (4655ED3C)
ebe81000 ebe95480 wdmaud wdmaud.sys Sun Apr 13 15:17:18 2008 (48025C3E)
ec05e000 ec06cd80 sysaudio sysaudio.sys Sun Apr 13 15:15:55 2008 (48025BEB)
ec19e000 ec1aae80 DMusic DMusic.sys Sun Apr 13 14:45:00 2008 (480254AC)
ec21e000 ec22bd00 swmidi swmidi.sys Sun Apr 13 14:45:07 2008 (480254B3)
ec266000 ec269900 ndisuio ndisuio.sys Sun Apr 13 14:55:57 2008 (4802573D)
ec8c5000 ec8dc900 dump_atapi dump_atapi.sys Sun Apr 13 14:40:29 2008 (4802539D)
ec97d000 ec9ec300 mrxsmb mrxsmb.sys Fri Dec 04 13:22:20 2009 (4B19535C)
eca15000 eca3fe80 rdbss rdbss.sys Sun Apr 13 15:28:38 2008 (48025EE6)
eca40000 eca61d00 afd afd.sys Thu Aug 14 06:04:35 2008 (48A40333)
eca62000 eca87500 ipnat ipnat.sys Sun Apr 13 14:57:10 2008 (48025786)
eca88000 ecaafc00 netbt netbt.sys Sun Apr 13 15:20:59 2008 (48025D1B)
ecab0000 ecb08480 tcpip tcpip.sys Fri Jun 20 07:51:09 2008 (485B99AD)
ecb09000 ecb1b600 ipsec ipsec.sys Sun Apr 13 15:19:42 2008 (48025CCE)
f5c98000 f5c9a900 Dxapi Dxapi.sys Fri Aug 17 16:53:19 2001 (3B7D843F)
f5c9c000 f5cf9f00 update update.sys Sun Apr 13 14:39:46 2008 (48025372)
f5cfa000 f5d29e80 rdpdr rdpdr.sys Sun Apr 13 14:32:50 2008 (480251D2)
f5d2a000 f5d3ae00 psched psched.sys Sun Apr 13 14:56:36 2008 (48025764)
f5d3b000 f5d51580 ndiswan ndiswan.sys Sun Apr 13 15:20:41 2008 (48025D09)
f60b2000 f60fc000 dtscsi dtscsi.sys Sat Dec 10 09:33:44 2005 (439AE748)
f6135000 f6148900 parport parport.sys Sun Apr 13 14:40:09 2008 (48025389)
f6149000 f616c800 e100b325 e100b325.sys Tue Mar 04 14:56:25 2003 (3E6504E9)
f616d000 f618cb80 ctsfm2k ctsfm2k.sys Sun Sep 21 20:48:04 2003 (3F6E46C4)
f618d000 f61b88e0 ctoss2k ctoss2k.sys Sun Sep 21 20:47:37 2003 (3F6E46A9)
f61b9000 f61dca80 portcls portcls.sys Sun Apr 13 15:19:40 2008 (48025CCC)
f61dd000 f6321b00 P16X P16X.sys Sun Jul 18 23:57:44 2004 (40FB46B8)
f6322000 f63c8300 HSF_CNXT HSF_CNXT.sys Mon Nov 17 08:58:00 2003 (3FB8D3E8)
f63c9000 f64c7800 HSF_DP HSF_DP.sys Mon Nov 17 08:56:13 2003 (3FB8D37D)
f64c8000 f64ea700 ks ks.sys Sun Apr 13 15:16:34 2008 (48025C12)
f64eb000 f651ed00 HSFHWBS2 HSFHWBS2.sys Mon Nov 17 08:59:18 2003 (3FB8D436)
f651f000 f6536400 LSIPNDS LSIPNDS.sys Tue Jun 24 23:17:45 2003 (3EF91459)
f6537000 f655a200 USBPORT USBPORT.SYS Sun Apr 13 14:45:34 2008 (480254CE)
f655b000 f656ef00 VIDEOPRT VIDEOPRT.SYS Sun Apr 13 14:44:39 2008 (48025497)
f656f000 f66a6520 nv4_mini nv4_mini.sys Mon Jul 28 18:48:36 2003 (3F25A844)
f66a7000 f66b5b00 drmk drmk.sys Sun Apr 13 14:45:12 2008 (480254B8)
f66b7000 f66bfe00 intelppm intelppm.sys Sun Apr 13 14:31:31 2008 (48025183)
f70f1000 f70f3780 ndistapi ndistapi.sys Sun Apr 13 14:57:27 2008 (48025797)
f7101000 f7104d80 serenum serenum.sys Sun Apr 13 14:40:12 2008 (4802538C)
f7105000 f7107980 gameenum gameenum.sys Sun Apr 13 14:45:29 2008 (480254C9)
f7119000 f711bf80 mouhid mouhid.sys Fri Aug 17 16:47:57 2001 (3B7D82FD)
f711d000 f711f880 hidusb hidusb.sys Sun Apr 13 14:45:27 2008 (480254C7)
f715e000 f7177b80 Mup Mup.sys Sun Apr 13 15:17:05 2008 (48025C31)
f7178000 f718a000 sfdrv01 sfdrv01.sys Wed Aug 10 08:44:03 2005 (42F9F693)
f718a000 f719d000 sfvfs02 sfvfs02.sys Thu Nov 03 10:40:06 2005 (436A2146)
f719d000 f71c9980 NDIS NDIS.sys Sun Apr 13 15:20:35 2008 (48025D03)
f71ca000 f7256600 Ntfs Ntfs.sys Sun Apr 13 15:15:49 2008 (48025BE5)
f7257000 f726db00 KSecDD KSecDD.sys Wed Jun 24 07:18:40 2009 (4A420B90)
f726e000 f7331400 dmboot dmboot.sys Sun Apr 13 14:44:45 2008 (4802549D)
f7332000 f7343f00 sr sr.sys Sun Apr 13 14:36:50 2008 (480252C2)
f7344000 f7363b00 fltmgr fltmgr.sys Sun Apr 13 14:32:58 2008 (480251DA)
f7364000 f737b880 SCSIPORT SCSIPORT.SYS Sun Apr 13 14:40:29 2008 (4802539D)
f737c000 f7393900 atapi atapi.sys Sun Apr 13 14:40:29 2008 (4802539D)
f7394000 f73b9700 dmio dmio.sys Sun Apr 13 14:44:45 2008 (4802549D)
f73ba000 f73d8880 ftdisk ftdisk.sys Fri Aug 17 16:52:41 2001 (3B7D8419)
f73d9000 f73e9a80 pci pci.sys Sun Apr 13 14:36:43 2008 (480252BB)
f73ea000 f7417d80 ACPI ACPI.sys Sun Apr 13 14:36:33 2008 (480252B1)
f7418000 f742f880 SPTD8285 SPTD8285.SYS Sun Apr 13 14:40:29 2008 (4802539D)
f7430000 f7500000 sptd sptd.sys Sat Dec 03 08:59:59 2005 (4391A4DF)
f7521000 f752a180 isapnp isapnp.sys Sun Apr 13 14:36:40 2008 (480252B8)
f7531000 f753b580 MountMgr MountMgr.sys Sun Apr 13 14:39:45 2008 (48025371)
f7541000 f754f000 sfsync03 sfsync03.sys Tue Dec 06 10:11:18 2005 (4395AA16)
f7551000 f755dc80 VolSnap VolSnap.sys Sun Apr 13 14:41:00 2008 (480253BC)
f7561000 f7569e00 disk disk.sys Sun Apr 13 14:40:46 2008 (480253AE)
f7571000 f757d180 CLASSPNP CLASSPNP.SYS Sun Apr 13 15:16:21 2008 (48025C05)
f7581000 f7589b40 PxHelp20 PxHelp20.sys Tue Jun 06 16:08:29 2006 (4485E0BD)
f7591000 f759b580 agp440 agp440.sys Sun Apr 13 14:36:37 2008 (480252B5)
f75b1000 f75bdd00 i8042prt i8042prt.sys Sun Apr 13 15:17:59 2008 (48025C67)
f75c1000 f75d0c00 serial serial.sys Sun Apr 13 15:15:44 2008 (48025BE0)
f75d1000 f75e0600 cdrom cdrom.sys Sun Apr 13 14:40:45 2008 (480253AD)
f75e1000 f75ef100 redbook redbook.sys Sun Apr 13 14:40:27 2008 (4802539B)
f75f1000 f75fb480 imapi imapi.sys Sun Apr 13 14:40:57 2008 (480253B9)
f7601000 f760d880 rasl2tp rasl2tp.sys Sun Apr 13 15:19:43 2008 (48025CCF)
f7611000 f761b200 raspppoe raspppoe.sys Sun Apr 13 14:57:31 2008 (4802579B)
f7621000 f762cd00 raspptp raspptp.sys Sun Apr 13 15:19:47 2008 (48025CD3)
f7631000 f7639900 msgpc msgpc.sys Sun Apr 13 14:56:32 2008 (48025760)
f7641000 f764af00 termdd termdd.sys Sun Apr 13 14:38:36 2008 (4802532C)
f7651000 f765ae80 NDProxy NDProxy.SYS Sun Apr 13 14:57:28 2008 (48025798)
f7661000 f766f880 usbhub usbhub.sys Sun Apr 13 14:45:36 2008 (480254D0)
f7691000 f7699780 netbios netbios.sys Sun Apr 13 14:56:01 2008 (48025741)
f76a1000 f76a9700 wanarp wanarp.sys Sun Apr 13 14:57:20 2008 (48025790)
f76c1000 f76cbe00 Fips Fips.SYS Sun Apr 13 14:33:27 2008 (480251F7)
f76d1000 f76da000 HIDCLASS HIDCLASS.SYS Sun Apr 13 14:45:25 2008 (480254C5)
f76f1000 f7700900 Cdfs Cdfs.SYS Sun Apr 13 15:14:21 2008 (48025B8D)
f77a1000 f77a7180 PCIIDEX PCIIDEX.SYS Sun Apr 13 14:40:29 2008 (4802539D)
f77a9000 f77add00 PartMgr PartMgr.sys Sun Apr 13 14:40:48 2008 (480253B0)
f77b1000 f77b81c0 cercsr6 cercsr6.sys Wed Dec 08 18:31:10 2004 (41B78EBE)
f77b9000 f77c1000 sfhlp02 sfhlp02.sys Mon May 16 09:20:39 2005 (42889E27)
f77c9000 f77cd500 watchdog watchdog.sys Sun Apr 13 14:44:59 2008 (480254AB)
f7899000 f789e080 usbuhci usbuhci.sys Sun Apr 13 14:45:34 2008 (480254CE)
f78a1000 f78a8600 usbehci usbehci.sys Sun Apr 13 14:45:34 2008 (480254CE)
f78a9000 f78b0580 Modem Modem.SYS Sun Apr 13 15:00:18 2008 (48025842)
f78b1000 f78b2000 fdc fdc.sys unavailable (00000000)
f78b9000 f78bf000 kbdclass kbdclass.sys Sun Apr 13 14:39:46 2008 (48025372)
f78c1000 f78c6280 GEARAspiWDM GEARAspiWDM.sys Mon May 18 08:16:53 2009 (4A1151B5)
f78c9000 f78cda80 TDI TDI.SYS Sun Apr 13 15:00:04 2008 (48025834)
f78d1000 f78d5580 ptilink ptilink.sys Fri Aug 17 16:49:53 2001 (3B7D8371)
f78d9000 f78dd080 raspti raspti.sys Fri Aug 17 16:55:32 2001 (3B7D84C4)
f78e1000 f78e6a00 mouclass mouclass.sys Sun Apr 13 14:39:47 2008 (48025373)
f78f1000 f78f6000 flpydisk flpydisk.sys Sun Apr 13 14:40:24 2008 (48025398)
f7901000 f7906200 vga vga.sys Sun Apr 13 14:44:40 2008 (48025498)
f7909000 f790da80 Msfs Msfs.SYS Sun Apr 13 14:32:38 2008 (480251C6)
f7911000 f7918880 Npfs Npfs.SYS Sun Apr 13 14:32:38 2008 (480251C6)
f7919000 f791f000 npptNT2 npptNT2.sys Thu Jan 06 01:43:06 2005 (41DCDDFA)
f7921000 f7927500 usbprint usbprint.sys Sun Apr 13 14:47:37 2008 (48025549)
f7929000 f792f180 HIDPARSE HIDPARSE.SYS Sun Apr 13 14:45:22 2008 (480254C2)
f7931000 f7934000 BOOTVID BOOTVID.dll Fri Aug 17 16:49:09 2001 (3B7D8345)
f79e5000 f79e8c80 mssmbios mssmbios.sys Sun Apr 13 14:36:45 2008 (480252BD)
f79f5000 f79f8f00 MODEMCSA MODEMCSA.sys Fri Aug 17 16:57:37 2001 (3B7D8541)
f79fd000 f79ff280 rasacd rasacd.sys Fri Aug 17 16:55:39 2001 (3B7D84CB)
f7a19000 f7a1c240 OMCI OMCI.SYS Wed Aug 22 12:42:57 2001 (3B83E111)
f7a21000 f7a22b80 kdcom kdcom.dll Fri Aug 17 16:49:10 2001 (3B7D8346)
f7a23000 f7a24100 WMILIB WMILIB.SYS Fri Aug 17 17:07:23 2001 (3B7D878B)
f7a25000 f7a26580 intelide intelide.sys Sun Apr 13 14:40:29 2008 (4802539D)
f7a27000 f7a28700 dmload dmload.sys Fri Aug 17 16:58:15 2001 (3B7D8567)
f7a67000 f7a68100 swenum swenum.sys Sun Apr 13 14:39:52 2008 (48025378)
f7a71000 f7a72280 USBD USBD.SYS Fri Aug 17 17:02:58 2001 (3B7D8682)
f7a73000 f7a74f00 Fs_Rec Fs_Rec.SYS Fri Aug 17 16:49:37 2001 (3B7D8361)
f7a75000 f7a76080 Beep Beep.SYS Fri Aug 17 16:47:33 2001 (3B7D82E5)
f7a77000 f7a78080 mnmdd mnmdd.SYS Fri Aug 17 16:57:28 2001 (3B7D8538)
f7a79000 f7a7a080 RDPCDD RDPCDD.sys Fri Aug 17 16:46:56 2001 (3B7D82C0)
f7a81000 f7a82100 dump_WMILIB dump_WMILIB.SYS Fri Aug 17 17:07:23 2001 (3B7D878B)
f7aaf000 f7ab0880 splitter splitter.sys Sun Apr 13 14:45:07 2008 (480254B3)
f7ae9000 f7ae9d00 pciide pciide.sys Fri Aug 17 16:51:49 2001 (3B7D83E5)
f7b06000 f7b06c00 audstub audstub.sys Fri Aug 17 16:59:40 2001 (3B7D85BC)
f7bb7000 f7bb7b80 drmkaud drmkaud.sys Sun Apr 13 14:45:13 2008 (480254B9)
f7be7000 f7be7b80 Null Null.SYS Fri Aug 17 16:47:39 2001 (3B7D82EB)
f7c63000 f7c63d00 dxgthk dxgthk.sys Fri Aug 17 16:53:12 2001 (3B7D8438)

Unloaded modules:
ec2b6000 ec2b9000 IcRecUsb.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
f78f9000 f78fe000 Cdaudio.SYS
Timestamp: unavailable (00000000)
Checksum: 00000000
f79f9000 f79fc000 Sfloppy.SYS
Timestamp: unavailable (00000000)
Checksum: 00000000
Closing open log file c:debuglog.txt

 

yv8g67.exe was the process which made a call to the driver LSIPNDS.sys which is used by your Linksys Instant Wireless PCI Card ......

as pete says the trojan yv8g67.exe was likely "calling home" and needs removing asap

the driver LSIPNDS.sys may also need updating

 

yes, thanks a lot guys, that's exactly what I was assuming! I'm working on a friends computer, he said it would crash whenever he booted into Windows, so far it's been perfectly stable for me, except I've been using a wired connection. The wireless was the difference!