Getting Blue Screen System is Busy and BSOD OE Fatal Exceptions

[Nanceel0]

Hi,
I don't know what to pinpoint the problem to, but I'll give a lowdown of what I did and what occurred:
I have Windows 98se, IE6SP1, 256mb ram, 30gb harddrive, AOL5.0 and att.net (at the moment).
I installed IE6SP1 on Feb. 21. Hours later while at desktop, I played solitaire, then looked at Aida32, closed it and clicked on Spybot SSD. Got an hourglass. c/a/d brought up blue screen system is busy, had to shut down with tower button.
(during all of this I was removing and reinstalling the AOL adapter to try to correct an access problem, also removed everything from Network and dial up adapter, etc).
On March 2 I upgraded to EZTrust 6.1.3.1.
On March 6 I installed another IP (att.net) with their software - the registration server froze up my pc - everything froze including the snooze of EZTrust. (afterwards I removed the att.net software)
On March 10 while online with a few windows minimized I clicked on Spybot and got the hourglass - c/a/d brought up blue screen system is busy and I had to use tower button to close down. Later that evening attempting to shut down computer I got a BSOD fatal exception OE 0167:BFF9DFFF. Used tower button, turned pc back on and shut down normally.
On March 16 I removed Spyware Blaster and installed the new one. Before removing it I used Snooze of EZTrust to stop program - when I tried to "wake" EZTrust it wouldn't respond. had to use c/a/d and EZTrust wasn't responding. I rebooted and when I installed SpyWare Blaster EZTrust snooze wouldn't come up, so I used c/a/d to stop it. When rebooting to finish install I got a BSOD fatal exception (same one)
On March 16 I also upgraded Spybot SSD to version 1.2
On March 17 while online I clicked on Spybot and again got an hourglass, everything froze..c/a/d twice and blue screen System is Busy - used tower button again!
Last week I used docmem to test my memory. It ran 7 or 8 loops and showed no errors. Last night, I used disk cleanup, thorough scandisk and defrag. Scandisk showed no errors on the disk.
Does anyone have any idea of what could be causing the problem? I don't know what to do. Or do I just have to live with this?
EZTrust techs have recommended to removed EZTrust and d/l and install the latest. It may have gotten corrupt. What do you think? (That doesn't seem to have anything to do with my system is busy bringing up spybot though.)
Sincerely, Nancee

[Nick Grana]

You can always try what I just recommended to another poster.
If me, I would uncheck all items in my startup group, msconfig,
and just click on the one I want to run. If it runs sucessful, just start adding items until you may find a culprit.
You have done so many upgrades and additions
that it's hard to tell when this whole thing started or exactly what may be causing it.
Good luck.


Nearly all men can stand adversity, but if you want to test a man's character, give him power.
Abraham Lincoln (1809-1865)

[Nanceel0]

Thanks for your reply Nick. Unfortunately, I don't have a lot running in msconfig. I have EZTrust, BOClean, Systray, Scanreg,
Script Sentry and Task Monitor. When I bring up c/a/d there is also msgloop and msg32 (both regarding HP and they're not in msconfig). I really don't want to turn those off.
I agree, I did a lot in a short time, so it's hard to pinpoint anything.
But, the system is busy screen came up offline and online when I clicked on Spybot - although maybe something else was taking up memory.
And one BSOD fatal exception occurred on reboot after installing software, but also when the EZTrust Snooze wasn't responding.
I just did a test and brought up Spybot - it came up, took a few seconds. I checked my resources - they went down to 63%. I closed it and now the resources are 76%. When I boot up the computer my resources start at 92%.
Sincerely, Nancee

[Nanceel0]

I just ran StartUpList and it said my registry check FAILED and it's not normal. Does Script Sentry do this or what does this mean???
Here's the log:

StartupList report, 3/18/03, 8:06:50 PM
StartupList version: 1.34.0
Started from : C:\UTILITIES\STARTUPLIST.EXE
Detected: Windows 98 SE (Win9x 4.10.2222A)
Detected: Internet Explorer v6.00 SP1 (6.00.2800.1106)
* Using default options
==================================================

Running processes:

C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\MSGLOOP.EXE
C:\WINDOWS\SYSTEM\MSG32.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\PROGRAM FILES\NSCLEAN\BOCLEAN\BOCLEAN.EXE
C:\WINDOWS\TASKMON.EXE
C:\PROGRAM FILES\COMPUTER ASSOCIATES\ETRUST EZ ARMOR\ETRUST EZ ANTIVIRUS\VETTRAY.EXE
C:\WINDOWS\SYSTEM\VETMSG9X.EXE
C:\PROGRAM FILES\NSCLEAN\BOCLEAN\BOCSEC.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\UTILITIES\STARTUPLIST.EXE

--------------------------------------------------

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run

ScanRegistry = c:\windows\scanregw.exe /autorun
SystemTray = SysTray.Exe
BOCleanautostart = C:\PROGRA~1\NSCLEAN\BOCLEAN\BOCLEAN.EXE
TaskMonitor = c:\windows\taskmon.exe
VetTray = C:\PROGRA~1\COMPUT~1\ETRUST~1\ETRUST~1\VETTRAY.EXE
Vet Alert = C:\WINDOWS\System\VetMsg9x.exe
ScriptSentry = C:\PROGRAM FILES\SCRIPT SENTRY\SCRIPTSENTRY.exe /check

--------------------------------------------------

File association entry for .HTA:
HKEY_CLASSES_ROOT\htafile\shell\open\command

(Default) = C:\PROGRAM FILES\SCRIPT SENTRY\SCRIPTSENTRY.exe "%1" %*

--------------------------------------------------

Enumerating Active Setup stub paths:
HKLM\Software\Microsoft\Active Setup\Installed Components
(* = disabled by HKCU twin)

[{89820200-ECBD-11cf-8B85-00AA005B4383}] *
StubPath = rundll32.exe advpack.dll,UserInstStubWrapper {89820200-ECBD-11cf-8B85-00AA005B4383}

[>PerUser_MSN_Clean] *
StubPath = c:\windows\msnmgsr1.exe

[PerUser_LinkBar_URLs] *
StubPath = c:\windows\COMMAND\sulfnbk.exe /L

[{44BBA840-CC51-11CF-AAFA-00AA00B6015C}] *
StubPath = rundll32.exe advpack.dll,UserInstStubWrapper {44BBA840-CC51-11CF-AAFA-00AA00B6015C}

[{7790769C-0471-11d2-AF11-00C04FA35D02}] *
StubPath = rundll32.exe advpack.dll,UserInstStubWrapper {7790769C-0471-11d2-AF11-00C04FA35D02}

[>IEPerUser] *
StubPath = RUNDLL32.EXE IEDKCS32.DLL,BrandIE4 SIGNUP

[{9EF0045A-CDD9-438e-95E6-02B9AFEC8E11}] *
StubPath = C:\WINDOWS\SYSTEM\updcrl.exe -e -u C:\WINDOWS\SYSTEM\verisignpub1.crl

[{44BBA851-CC51-11CF-AAFA-00AA00B6015C}]
StubPath = rundll32.exeadvpack.dll

--------------------------------------------------

Load/Run keys from C:\WINDOWS\WIN.INI:

load=
run=

--------------------------------------------------

Shell & screensaver key from C:\WINDOWS\SYSTEM.INI:

Shell=Explorer.exe
SCRNSAVE.EXE=
drivers=mmsystem.dll power.drv

--------------------------------------------------

Checking for EXPLORER.EXE instances:

C:\WINDOWS\Explorer.exe: PRESENT!

C:\Explorer.exe: not present
C:\WINDOWS\Explorer\Explorer.exe: not present
C:\WINDOWS\System\Explorer.exe: not present
C:\WINDOWS\System32\Explorer.exe: not present
C:\WINDOWS\Command\Explorer.exe: not present

--------------------------------------------------

C:\WINDOWS\WININIT.BAK listing:
(Created 16/3/2003, 21:30:12)

[rename]
NUL=c:\windows\TEMP\_iu14D2N.tmp

--------------------------------------------------

C:\AUTOEXEC.BAT listing:

@echo off
REM To make a DOS Boot Diskette; See the file C:\DOSBOOT\DOSBOOT.TXT
path C:\WINDOWS;C:\WINDOWS\COMMAND
@REM SetPower.exe will initialize the USB Keyboard.
@c:\windows\system\setpower.exe
rem - By Windows Setup - mscdex.exe /d:IDECD000 /L:M

--------------------------------------------------

C:\CONFIG.SYS listing:

REM To make a DOS Boot Diskette; See the file C:\DOSBOOT\DOSBOOT.TXT
[common]
dos=high,umb
buffers=40
device=c:\windows\himem.sys /testmemff
DEVICE=C:\WINDOWS\EMM386.EXE NOEMS
rem The below DOS CD ROM driver is not required to run Windows 98.
DEVICE=c:\cdrom\OakCdRom.SYS /D:IDECD000

--------------------------------------------------

C:\WINDOWS\DOSSTART.BAT listing:

@echo off
REM To make a DOS Boot Diskette, see the file C:\DosBoot\DosBoot.txt.
set path=c:\windows\command
mscdex.exe /d:IDECD000 /L:M
SET PROMPT=$p$g
SET TEMP=C:\windows\TEMP
SET TMP=C:\windows\TEMP
call c:\dosboot\mousie.bat
c:\windows\smartdrv /q
c:
cd \windows
REM to enable ZIP support in DOS:
REM 1) cd C:\IOMEGA
REM 2) run IOMEGA.EXE
REM 3) then uncomment the following line
REM C:\IOMEGA\GUEST.EXE
REM for DOS Networking including most networked games,
REM read the file IPX.BAT and then uncomment the following
REM CALL C:\DOSBOOT\IPX.BAT

--------------------------------------------------

Checking for superhidden extensions:

.lnk: HIDDEN! (arrow overlay: yes)
.pif: HIDDEN! (arrow overlay: yes)
.exe: not hidden
.com: not hidden
.bat: not hidden
.hta: not hidden
.scr: not hidden
.shs: HIDDEN!
.shb: HIDDEN!
.vbs: not hidden
.vbe: not hidden
.wsh: not hidden
.scf: HIDDEN! (arrow overlay: NO!)
.url: HIDDEN! (arrow overlay: yes)
.js: not hidden
.jse: not hidden

--------------------------------------------------

Verifying REGEDIT.EXE integrity:

- Regedit.exe found in C:\WINDOWS
- .reg open command is NOT normal! (C:\PROGRAM FILES\SCRIPT SENTRY\SCRIPTSENTRY.exe "%1" %*)
- Company name OK: 'Microsoft Corporation'
- Original filename OK: 'REGEDIT.EXE'
- File description: 'Registry Editor'

Registry check FAILED!

--------------------------------------------------

Enumerating Browser Helper Objects:

(no name) - (no file) - {004A5840-FF59-11d2-B50D-0090271D3FD4}

--------------------------------------------------

Enumerating Task Scheduler jobs:

Tune-up Application Start.job

--------------------------------------------------

Enumerating Download Program Files:

[CV3 Class]
InProcServer32 = C:\WINDOWS\SYSTEM\WUV3IS.DLL
CODEBASE = http://windowsupdate.microsoft.com/R...n/actsetup.cab

[Shockwave ActiveX Control]
InProcServer32 = C:\WINDOWS\SYSTEM\MACROMED\DIRECTOR\SWDIR.DLL
CODEBASE = http://download.macromedia.com/pub/s...ctor/swdir.cab

[Shockwave Flash Object]
InProcServer32 = C:\WINDOWS\SYSTEM\MACROMED\FLASH\FLASH.OCX
CODEBASE = http://download.macromedia.com/pub/s...sh/swflash.cab

[Update Class]
InProcServer32 = C:\WINDOWS\SYSTEM\IUCTL.DLL
CODEBASE = http://v4.windowsupdate.microsoft.co...589.8344097222

[ActiveScan Installer Class]
InProcServer32 = C:\WINDOWS\DOWNLOADED PROGRAM FILES\ASINST.DLL
CODEBASE = http://www.pandasoftware.com/activescan/as/asinst.cab

[HouseCall Control]
InProcServer32 = C:\WINDOWS\DOWNLO~1\XSCAN53.OCX
CODEBASE = http://a840.g.akamai.net/7/840/537/2...ll/xscan53.cab

--------------------------------------------------
End of report, 7,733 bytes
Report generated in 0.251 seconds

Command line options:
/verbose - to add additional info on each section
/complete - to include empty sections and unsuspicious data
/force9x - to include Win9x-only startups even if running on WinNT
/forcent - to include WinNT-only startups even if running on Win9x
/forceall - to include all Win9x and WinNT startups, regardless of platform
/history - to list version history only

~~~~~~~

Is this okay?
Thanks.
Nancee

[Nick Grana]

Verifying REGEDIT.EXE integrity:

- Regedit.exe found in C:\WINDOWS
- .reg open command is NOT normal! (C:\PROGRAM FILES\SCRIPT SENTRY\SCRIPTSENTRY.exe "%1" %*)
- Company name OK: 'Microsoft Corporation'
- Original filename OK: 'REGEDIT.EXE'
- File description: 'Registry Editor'

Registry check FAILED!

That's the only thing that really stands out. It seems to
be trying to open your present .reg and it fails.
Can you run scanregw and have it come up initially
with no errors found? I would follow some other posts of late
with a lot of information of the registry.
I'd restore a different registry and try it again although
you may have been backing up a bad registry.

Or you could try a scanreg /fix from dos first and see what happens.

Which ever method, make a backup of your present registry.

Maybe one of the recent registry gurus will chime in on this.
Luck

[Nanceel0]

Hi Nick,
I just went to start>run>regedit and I got there. I made a backup of my registry.
I ran Spybot a while ago and had it do system internals...it said Script Sentry and Cookie jar were in the wrong app path. I left it alone.
I agree that "registry check FAILED" doesn't sound good. I was hoping Script Sentry did that.
I'll wait for more advice.
Thanks.
Sincerely, Nancee

Edit: I re-read your letter and just ran Registry Checker. It said no errors found so I had it back up the registry.

[Nanceel0]

I just wanted to mention that I used an old version of StartUpList and that version cannot read the registry if Script Sentry is running. I installed Startuplist 1.52 and it doesn't mention the registry integrity check.
I also found out that there are some problems with SSD if you installed it from within the program (which I did). I don't have everything showing that should be in the new 1.2 program. And it seems there's is presently a problem with uninstalling it.
I don't know if that is the cause of all my problems or not, but that's where I'm at right now. Also, when I ran SSD before it took 23% resources, I never checked what it used before but that seems excessive to me.
Sincerely, Nancee

[Ridgerunr]

Hi Nancy,,After reading all posts in both of your threads concerning your problems. Sorry to say i don't have a cut n' dried answer for you. But personally,my suspicions lean towards registry entries causing conflicts.
I would use all tools available to clean out all junk files,TIF,cookies(yes,dump them all). Then use two reg cleaners i prefer,i.e. jv's power tool: http://www.vtoy.fi/jv16/shtml/jv16powertools.shtml
And Tony Art's Easy Cleaner: http://www.toniarts.com/ecleane.htm

Read the instructions carefully,and with Easy Cleaner,just use the temp file remover and the registry cleaner. Juoni's tool gives you many options,but just use the reg cleaner for now. Tell it to move items marked "safe to delete"(green) to the top. Review these items carefully. Choose ones you feel safe removing. Post entries it says are safe,but bother you here and lets look them over...

From what i read, BOClean is very intense and doesn't want to be shut down. For many reasons related to trojans,that's fine. But if it's corrupted in some way,it too could be causing probs. I also have suspicions of problems with AOWell. Not a program i use or ever have since way back when i was a newbie and fought a losing battle with it and finally dumped it and never looked back.

Lets hope your problem isn't too entwined among the programs you have installed and can be straightened out fairly straightforward. But,,,if that's not the case,,then you know the answer(moaning to self ) A fresh install of Windoze and careful,planned installation of the programs you need starting with utilities and security. Let's hope it doesn't come to that however...

[Nanceel0]

Hi Ridge,
I read your letter and had to think about all of this. Things seem to be stable for a few days now. Unfortunately I think I complicated matters by renaming Spybot and installing a new version because it carried over some of my settings. I'm waiting to see what fix Pepe comes up with for this. I know jv16 is suppose to be very good but I'm afraid to use it. Maybe I'll get the courage one of these days. (My record with software lately hasn't been too good.)
I don't think there's any problem with my BOClean. If I want to shut it I just click on the systray icon and shut it.
Thanks for your advice.
Sincerely, Nancee