from bluescreen to harddisk stop working

julianjiahui · April 18, 2011

hello,I have a prblem with uTorrent.

After I install the uTorrent,no matter the newest edition or old editons, everytime I use it,it wil alway end up as bluescreen,or BSOD(is it right?I'm not sure).

It was the first several times.Now everytime I use uTorrent,it rarely occure BSOD,but another problem. When the uTorrent is running,the HDD LED would stop flashing unexpectedly and suddenly.And the screen freezes,and the keyboard and mouse cannot work anymore.It is really strange,aha? And I would have to restart forcibly.

Does anyone know how to solve this problem?Thank you!

moogly · April 18, 2011

1/ Post Hijackthis and Process Explorer logs when µT is running.

In PE, select utorrent.exe and enable DLL mode (ctrl+D)

Guide: http://forum.utorrent.com/viewtopic.php?id=29748

2/ Open a recent BSOD minidump (.dmp) with BlueScreenView v1.32 and copy/paste the log here (the program has a function to save the log ast .txt file)

julianjiahui · April 18, 2011

Thanks a lot!

julianjiahui · April 18, 2011

Process: uTorrent.exe Pid: 4872

Name Description Company Name Version

advapi32.dll 高级 Windows 32 基本 API Microsoft Corporation 6.1.7600.16385

apisetschema.dll ApiSet Schema DLL Microsoft Corporation 6.1.7600.16385

C_1252.NLS

clbcatq.dll COM+ Configuration Catalog Microsoft Corporation 2001.12.8530.16385

comctl32.dll 用户体验控件库 Microsoft Corporation 6.10.7600.16661

comdlg32.dll Common Dialogs DLL Microsoft Corporation 6.1.7600.16385

crypt32.dll 加密 API32 Microsoft Corporation 6.1.7600.16385

cryptbase.dll Base cryptographic API DLL Microsoft Corporation 6.1.7600.16385

cryptsp.dll Cryptographic Service Provider API Microsoft Corporation 6.1.7600.16385

dhcpcsvc.dll DHCP 客户端服务 Microsoft Corporation 6.1.7600.16385

dhcpcsvc6.dll DHCPv6 客户端 Microsoft Corporation 6.1.7600.16385

dnsapi.dll DNS 客户端 API DLL Microsoft Corporation 6.1.7600.16772

dwmapi.dll Microsoft 桌面窗口管理器 API Microsoft Corporation 6.1.7600.16385

FirewallAPI.dll Windows 防火墙 API Microsoft Corporation 6.1.7600.16385

FWPUCLNT.DLL FWP/IPsec 用户模式 API Microsoft Corporation 6.1.7600.16385

gdi32.dll GDI Client DLL Microsoft Corporation 6.1.7600.16385

iertutil.dll Run time utility for Internet Explorer Microsoft Corporation 8.0.7600.16766

imm32.dll Multi-User Windows IMM32 API Client DLL Microsoft Corporation 6.1.7600.16385

IPHLPAPI.DLL IP Helper API Microsoft Corporation 6.1.7600.16385

kernel32.dll Windows NT 基本 API 客户端 DLL Microsoft Corporation 6.1.7600.16385

KernelBase.dll Windows NT 基本 API 客户端 DLL Microsoft Corporation 6.1.7600.16385

locale.nls

lpk.dll Language Pack Microsoft Corporation 6.1.7600.16385

msasn1.dll ASN.1 Runtime APIs Microsoft Corporation 6.1.7600.16415

msctf.dll MSCTF 服务器 DLL Microsoft Corporation 6.1.7600.16385

msi.dll Windows Installer Microsoft Corporation 5.0.7600.16385

msimg32.dll GDIEXT Client DLL Microsoft Corporation 6.1.7600.16385

msvcp60.dll Windows NT C++ Runtime Library DLL Microsoft Corporation 7.0.7600.16385

msvcrt.dll Windows NT CRT DLL Microsoft Corporation 7.0.7600.16385

mswsock.dll Microsoft Windows Sockets 2.0 服务提供程序 Microsoft Corporation 6.1.7600.16385

npmproxy.dll Network List Manager Proxy Microsoft Corporation 6.1.7600.16385

nsi.dll NSI User-mode interface DLL Microsoft Corporation 6.1.7600.16385

ntdll.dll NT 层 DLL Microsoft Corporation 6.1.7600.16695

ole32.dll 用于 Windows 的 Microsoft OLE Microsoft Corporation 6.1.7600.16624

oleaut32.dll Microsoft Corporation 6.1.7600.16567

profapi.dll User Profile Basic API Microsoft Corporation 6.1.7600.16385

psapi.dll Process Status Helper Microsoft Corporation 6.1.7600.16385

rasadhlp.dll Remote Access AutoDial Helper Microsoft Corporation 6.1.7600.16385

rpcrt4.dll 远程过程调用运行时 Microsoft Corporation 6.1.7600.16385

RpcRtRemote.dll Remote RPC Extension Microsoft Corporation 6.1.7600.16385

rsaenh.dll Microsoft Enhanced Cryptographic Provider Microsoft Corporation 6.1.7600.16385

safemon.dll 360安全卫士网盾防护模块 360.cn 6.8.1.1030

sechost.dll Host for SCM/SDDL/LSA Lookup APIs Microsoft Corporation 6.1.7600.16385

shell32.dll Windows 外壳公用 DLL Microsoft Corporation 6.1.7600.16644

shfolder.dll Shell Folder Service Microsoft Corporation 6.1.7600.16385

shlwapi.dll 外壳简易实用工具库 Microsoft Corporation 6.1.7600.16385

SortDefault.nls

sspicli.dll Security Support Provider Interface Microsoft Corporation 6.1.7600.16385

StaticCache.dat

urlmon.dll Win32 的 OLE32 扩展 Microsoft Corporation 8.0.7600.16766

user32.dll 多用户 Windows 用户 API 客户端 DLL Microsoft Corporation 6.1.7600.16385

userenv.dll Userenv Microsoft Corporation 6.1.7600.16385

usp10.dll Uniscribe Unicode script processor Microsoft Corporation 1.626.7600.16385

uTorrent.exe μTorrent BitTorrent, Inc. 2.2.1.24908

uxtheme.dll Microsoft UxTheme 库 Microsoft Corporation 6.1.7600.16385

version.dll Version Checking and File Installation Libraries Microsoft Corporation 6.1.7600.16385

wininet.dll Win32 的 Internet 扩展 Microsoft Corporation 8.0.7600.16766

winnsi.dll Network Store Information RPC interface Microsoft Corporation 6.1.7600.16385

wow64.dll Win32 Emulation on NT64 Microsoft Corporation 6.1.7600.16385

wow64cpu.dll AMD64 Wow64 CPU Microsoft Corporation 6.1.7600.16385

wow64win.dll Wow64 Console and Win32 API Logging Microsoft Corporation 6.1.7600.16385

ws2_32.dll Windows Socket 2.0 32 位 DLL Microsoft Corporation 6.1.7600.16385

wship6.dll Winsock2 帮助程序 DLL (TL/IPv6) Microsoft Corporation 6.1.7600.16385

WSHTCPIP.DLL Winsock2 帮助程序 DLL (TL/IPv4) Microsoft Corporation 6.1.7600.16385

Thank you!

moogly · April 18, 2011

Where are the other logs (Hijackthis and minidump)?

julianjiahui · April 19, 2011

I found that even when the uTorrent is not running,it also occur BSOD occasionally.But when it is runing,it would surely lead to BSOD.

I remembered that what a big change to my OS recently is the installation of Microsoft Silverlight.During the short period of time after the installation,there is a process called mscorsvw.exe eating up my CPU. I doubt that the BSOD might have a connection with this?

Anyway,the Hijackthis and Process Explorer logs (while uTorrent is running) and the recent three minidump logs are as follows:

********************************************************************************************************************

1.Hijackthis

Logfile of Trend Micro HijackThis v2.0.4

Scan saved at 10:05:21, on 2011/4/19

Platform: Windows 7 (WinNT 6.00.3504)

MSIE: Internet Explorer v8.00 (8.00.7600.16766)

Boot mode: Normal

Running processes:

C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe

C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe

D:\Softwares\360safe\safemon\360tray.exe

C:\Windows\SysWOW64\WatchData\Watchdata CCB CSP v3.2\WDCertM_CCB.exe

C:\Users\Julian\Desktop\BOSD\bluescreenview\BlueScreenView.exe

C:\Program Files (x86)\Internet Explorer\iexplore.exe

C:\Users\Julian\Desktop\BOSD\ProcessExplorer\procexp.exe

C:\Program Files (x86)\Internet Explorer\iexplore.exe

D:\Softwares\360safe\360Safe.exe

D:\Softwares\360safe\softmgr\SoftManager.exe

C:\Program Files (x86)\Internet Explorer\iexplore.exe

C:\Users\Julian\Desktop\BOSD\HijackThis.exe

D:\Softwares\uTorrent\uTorrent.exe

F2 - REG:system.ini: UserInit=userinit.exe

O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~2\MICROS~1\Office12\GR469A~1.DLL

O2 - BHO: XunleiBHO - {889D2FEB-5411-4565-8998-1DD2C5261283} - D:\Softwares\Thunder\BHO\XunleiBHO7.1.4.2104.dll

O2 - BHO: Microsoft Web Test Recorder 10.0 Helper - {DDA57003-0068-4ed2-9D32-4D1EC707D94D} - C:\Program Files (x86)\Microsoft Visual Studio 10.0\Common7\IDE\PrivateAssemblies\Microsoft.VisualStudio.QualityTools.RecorderBarBHO100.dll

O4 - HKLM\..\Run: [ATKMEDIA] C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe

O4 - HKLM\..\Run: [HControlUser] C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe

O4 - HKLM\..\Run: [360Safetray] "D:\Softwares\360safe\safemon\360Tray.exe" /start

O4 - HKLM\..\Run: [wdcertm_ccb] C:\Windows\system32\WatchData\Watchdata CCB CSP v3.2\WDCertM_CCB.exe

O4 - HKUS\S-1-5-19\..\Run: [sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')

O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE')

O4 - HKUS\S-1-5-20\..\Run: [sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')

O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE')

O4 - Global Startup: SRS Premium Sound.lnk = ?SystemRoot%\Installer\{E5CF6B9C-3ABE-43C9-9413-AD5FFC98F049}\NewShortcut5_21C7B668029A47458B27645FE6E4A715.exe

O8 - Extra context menu item: 使用迅雷下载 - D:\Softwares\Thunder\BHO\geturl.htm

O8 - Extra context menu item: 使用迅雷下载全部链接 - D:\Softwares\Thunder\BHO\GetAllUrl.htm

O8 - Extra context menu item: 用【维棠】下载全部链接 - D:\Softwares\ViDown\vd_linkall.htm

O8 - Extra context menu item: 用【维棠】下载视频 - D:\Softwares\ViDown\vd_link.htm

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~1\Office12\REFIEBAR.DLL

O15 - Trusted Zone: http://*.alipay.com

O15 - Trusted Zone: http://*.alisoft.com

O15 - Trusted Zone: http://*.taobao.com

O15 - ESC Trusted Zone: http://*.update.microsoft.com

O16 - DPF: {488A4255-3236-44B3-8F27-FA1AECAA8844} (EditCtrl Class) - https://img.alipay.com/download/2121/aliedit.cab

O16 - DPF: {8D9E0B29-563C-4226-86C1-5FF2AE77E1D2} (AxSubmitControl Class) - https://mybank.icbc.com.cn/icbc/newperbank/AxSafeControls.cab

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://121.193.130.225/download/2981022/3054560/3/cab/135/156/1299231897223_924/swflash.cab

O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://121.193.130.225/download/2987151/3054881/3/cab/59/136/1299375052603_904/gp.cab

O17 - HKLM\System\CCS\Services\Tcpip\..\{B4052C86-D989-41E1-9631-EACD694B4864}: NameServer = 202.113.15.1,202.113.15.2

O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~2\MICROS~1\Office12\GRA32A~1.DLL

O18 - Protocol: mbox - {3050F3DA-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\SysWOW64\mshtml.dll

O18 - Protocol: mboxflash - {3050F3DA-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\SysWOW64\mshtml.dll

O23 - Service: 360 杀毒实时防护服务 (360rp) - 360.cn - D:\Softwares\360sd\360rp.exe

O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)

O23 - Service: AMD External Events Utility - Unknown owner - C:\Windows\system32\atiesrxx.exe (file missing)

O23 - Service: ASLDR Service (ASLDRService) - ASUS - C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\ASLDRSrv.exe

O23 - Service: ATKGFNEX Service (ATKGFNEXSrv) - ASUS - C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\GFNEXSrv.exe

O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)

O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)

O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)

O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)

O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)

O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)

O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)

O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)

O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)

O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)

O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)

O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)

O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)

O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)

O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)

O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)

O23 - Service: WatchData ccb V3.2 (WDMonitorCCB) - Beijing WatchData System Co., Ltd. - C:\Windows\SysWOW64\WatchData\Watchdata CCB CSP v3.2\WDKeyMonitorCCB.exe

O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)

O23 - Service: XLDoctor Services - 深圳市迅雷网络技术有限公司 - D:\Softwares\Thunder\Program\DctSer.exe

O23 - Service: 主动防御 (ZhuDongFangYu) - 360.cn - D:\Softwares\360safe\deepscan\zhudongfangyu.exe

--

End of file - 7282 bytes

**********************************************************************************************************************

2.PE

Process PID CPU Private Bytes Working Set Description Company Name

System Idle Process 0 75.83 K 24 K

System 4 1.28 120 K 4,180 K

Interrupts n/a 4.25 K K Hardware Interrupts and DPCs

smss.exe 288 516 K 828 K Windows 会话管理器 Microsoft Corporation

csrss.exe 420 2,352 K 3,780 K Client Server Runtime Process Microsoft Corporation

wininit.exe 484 1,720 K 4,264 K Windows 启动应用程序 Microsoft Corporation

services.exe 548 5,832 K 6,704 K 服务和控制器应用程序 Microsoft Corporation

svchost.exe 680 4,556 K 7,532 K Windows 服务主进程 Microsoft Corporation

svchost.exe 804 < 0.01 4,188 K 6,780 K Windows 服务主进程 Microsoft Corporation

atiesrxx.exe 872 1,696 K 3,276 K AMD External Events Service Module AMD

atieclxx.exe 1108 < 0.01 2,384 K 4,540 K AMD External Events Client Module AMD

svchost.exe 936 18,720 K 16,880 K Windows 服务主进程 Microsoft Corporation

audiodg.exe 4008 18,048 K 17,584 K Windows 音频设备图形隔离 Microsoft Corporation

svchost.exe 972 0.69 103,676 K 104,172 K Windows 服务主进程 Microsoft Corporation

dwm.exe 1544 0.29 32,948 K 30,576 K 桌面窗口管理器 Microsoft Corporation

svchost.exe 1004 < 0.01 25,132 K 34,952 K Windows 服务主进程 Microsoft Corporation

svchost.exe 696 < 0.01 7,768 K 10,968 K Windows 服务主进程 Microsoft Corporation

ZhuDongFangYu.exe 1096 < 0.01 4,896 K 7,852 K 360主动防御服务模块 360.cn

svchost.exe 1140 < 0.01 12,772 K 12,092 K Windows 服务主进程 Microsoft Corporation

AsLdrSrv.exe 1320 < 0.01 1,112 K 3,408 K ASLDR Service ASUS

HControl.exe 2220 < 0.01 6,296 K 5,764 K HControl ASUS

ATKOSD.exe 2252 948 K 3,104 K ATKOSD ASUS

WDC.exe 2268 1,500 K 4,696 K WDC ASUS

GFNEXSrv.exe 1348 840 K 2,220 K GFNEXSrv ASUS

spoolsv.exe 1428 6,060 K 7,800 K 后台处理程序子系统应用程序 Microsoft Corporation

svchost.exe 1460 < 0.01 12,236 K 10,476 K Windows 服务主进程 Microsoft Corporation

WDKeyMonitorCCB.exe 1604 < 0.01 1,400 K 3,720 K 建行网银盾服务程序v3.2 Beijing WatchData System Co., Ltd.

taskhost.exe 1856 7,816 K 8,784 K Windows 任务的主机进程 Microsoft Corporation

svchost.exe 2536 2,368 K 4,444 K Windows 服务主进程 Microsoft Corporation

SearchIndexer.exe 2208 < 0.01 31,076 K 26,980 K Microsoft Windows Search 索引器 Microsoft Corporation

SearchProtocolHost.exe 2732 < 0.01 3,024 K 8,780 K Microsoft Windows Search Protocol Host Microsoft Corporation

SearchFilterHost.exe 3404 3,196 K 7,200 K Microsoft Windows Search Filter Host Microsoft Corporation

svchost.exe 2500 4,448 K 7,048 K Windows 服务主进程 Microsoft Corporation

svchost.exe 4040 70,492 K 28,676 K Windows 服务主进程 Microsoft Corporation

lsass.exe 580 4,524 K 8,768 K Local Security Authority Process Microsoft Corporation

lsm.exe 588 2,476 K 3,416 K 本地会话管理器服务 Microsoft Corporation

csrss.exe 504 0.32 3,360 K 14,884 K Client Server Runtime Process Microsoft Corporation

winlogon.exe 728 3,380 K 5,684 K Windows 登录应用程序 Microsoft Corporation

explorer.exe 2012 0.04 37,212 K 59,272 K Windows 资源管理器 Microsoft Corporation

RAVCpl64.exe 2412 9,276 K 7,152 K Realtek高清晰音频管理器 Realtek Semiconductor

SRSPremiumPanel_64.exe 2436 17,816 K 8,792 K SRS Premium Panel SRS Labs, Inc.

BlueScreenView.exe 1264 4,676 K 8,524 K BlueScreenView NirSoft

iexplore.exe 2992 < 0.01 12,156 K 27,340 K Internet Explorer Microsoft Corporation

iexplore.exe 2080 0.05 23,600 K 43,712 K Internet Explorer Microsoft Corporation

iexplore.exe 3532 0.01 31,996 K 49,692 K Internet Explorer Microsoft Corporation

iexplore.exe 428 0.01 25,100 K 40,356 K Internet Explorer Microsoft Corporation

procexp.exe 3352 1,976 K 6,288 K Sysinternals Process Explorer Sysinternals - www.sysinternals.com

procexp64.exe 3368 1.98 21,788 K 41,216 K Sysinternals Process Explorer Sysinternals - www.sysinternals.com

notepad.exe 3860 2,036 K 7,448 K 记事本 Microsoft Corporation

HijackThis.exe 2800 < 0.01 5,504 K 14,568 K HijackThis Trend Micro Inc.

uTorrent.exe 3316 14.49 82,892 K 90,888 K μTorrent BitTorrent, Inc.

DMedia.exe 2824 1,168 K 3,728 K ATK Media ASUS

HControlUser.exe 2836 948 K 3,016 K HControlUser ASUS

360tray.exe 2852 0.06 27,592 K 3,216 K 360安全卫士木马防火墙模块 360.cn

360Safe.exe 3300 0.51 16,708 K 27,828 K 360安全卫士主程序 360.cn

SoftManager.exe 2776 0.15 25,516 K 34,764 K 360软件管家 360.cn

WDCertM_CCB.exe 2860 2,960 K 6,544 K 建行网银盾后台管理程序v3.2 Beijing WatchData System Co., Ltd.

Process: uTorrent.exe Pid: 3316