Question AdwCleaner removed Cyberlink service and computer now crashes all the time because of high non-paged kernel memory ?

[Stella_0240]

Hi,
I have used Adwcleaner since I have seen in some of your posts that it was a good way to remove something dodgy that was on my PC which both MalwareByte and Norton virus could or did seem to see and stop. So I ran Adwcleaner for the first time in my life and removed that thing that was running in the background that was driving me crazy and was sucking on my CPU, but also removed Cyberlink Service without me noticing.

BTW, the two things are not related, in the sense that while Adwcleaner detected the thing that was up to now undetectable, which was found in a folder called Low also decided to remove some privacy notices from some pre-installed software i had, which according to the description i saw on the day from Adwcleare it was saying it was harmless stuff - I stupidly said yes for the deletion. Among these Cyberlink was listed. As I said, it did not seem that it was going to remove the entire program just the privacy notice. As soon I clicked yes for all of that plus more (the rest in my view was harmless) my computer crashed . For the first time in my life I saw a blue screen and have frozen in terror.

PC did a memory dump and I have the logs from Adwcleaner too (which leave a lot to be desired). The net result is that Cyberlink Service has disappeered and the Kernel memory for non-paged keeps going up all the time whenever I use the VPN from MalwareBytes to watch stuff on the internet (which is basically all the time). Before I could use MalwareBytes VPN with no problems or worry on this non-paged memory business. THAT day I was running Malwarebytes (doing no scans or anything) and there was no VPN in use at the time, it was running in the background like it usually does to catch some malwareware that triggers on the internet on streaming sites sometimes.

I must say that when I used Adwcleaner, Malwarebytes was already installed on my pc and was running fine.

Because of this issue, I decided to uninstall Norton antivurs hoping that it would sort out things, since it sucks a lot of energy, although I must say it never clashed with Malwarebytes. I kept Malwarebytes and let Norton go.

From my observation from the task manager, the kernel memory stays stable for paged and no-paged, if I do any other tasks say work on audio with Audacity or convert audio. Videos do still play in VLC player and Gom Player (although in Gom player does not have really good audio), Pictures can be viewed in Windows photo viewer although for the life of me i cannot find where the program is. BTW, I'm open to suggestions for other sources to see photos, if you know let me know. DVD player still works. I have tried Power DVD to see if it works and it does although I never use it, and Cyberlink is the owner of that program. I did find an application file for PowerDVD in my downloads folder from 2013 it is called v5108_RiTA10(Patch)_Patch_DVD130311-03 and it says it is a Patch in the title - I am not sure whether I should click it, as I do not want to worsen things. maybe I could get Cyberlink service to come back with that? what do you think?

End result is that I can only watch ONE movie with the VPN and then I have to re-start my PC. If I did not, the Kernel for non-paged goes so high that then I get the blue screen crash error saying DRIVER_IRQL_NOT_LESS_OR_EQUAL. Once the memory goes up it does not come down - i have to restart because of it. As said this only happens for when I stream movies, so it seems at this point I can no longer binge watch series.

Does anyone know what I can do to get the kernel non-paged not to go out of control in my Windows 7, now that it seems I no longer have Cyberlink Service to do it for me?
Can you please let me know what can be done?

Thanks,

Stella

 

[Colif]

non paged memory is an area of ram where all the drivers run in.
needing a restart to get memory back shows its likely a memory leak. They caused by drivers asking for memory and not releasing it once they are finished, but asking for more instead, until you run out.

ADW removing a program without uninstalling it wouldn't have helped. Have you tried to run cyberlinks uninstaller? Might help remove some left overs?
https://www.cyberlink.com/stat/company/enu/uninstall-instructions.jsp

then you could install it again if you want.

Can you follow option one on the following link - here - and then do this step below: Small memory dumps - Have Windows Create a Small Memory Dump (Minidump) on BSOD - that creates a file in c windows/minidump after the next BSOD

1. Open Windows File Explore
2. Navigate to C:\Windows\Minidump
3. Copy the mini-dump files out onto your Desktop
4. use something like winzip or winrar to compress the files.
5. Select those files on your Desktop, right click them and choose 'Send to' - Compressed (zipped) folder
6. Upload the zip file to the Cloud (OneDrive, DropBox . . . etc.)
7. Then post a link here to the zip file, so we can take a look for you . . .

 

[Stella_0240]

hi Colif,

thanks for your reply. I went in the system and checked. There were already some things set up so I was not sure whether I needed to change anything. I attach a screenshot of what I currently see. it seems to be set to kernel memory dump. I have also the dump file from the day it fist crashed considering these settings were already there, let me know if you would like to see it. In all honesty, I did not try uninstalling anything, as already this computer was running on very bare bone programs and I cannot find the original power DVD CD used for the installation. I have only found a previous version of PowerDVD saved in my back up external drive but I do not know if it would be any good. As said Power DVD appears to be working. Anyhoo, I attach the screenshot on what I see in the settings first and then I will proceed further with you to find out what to do next.
oh actually i can see that I cannot attach a screenshot image here so I'll describe what I see:

Sustem failure tick marks:
both ticked for "write event to system log" and "automatic restart"
write debugging info:
set to kernel memory dump
dump file tick mark:
ticked for "overwrite any existing file"
Also once I do these changes do i need to restart my PC?
Sorry If I missed anything. I am new to this situation.

I'll wait for further instructions.

thanks,
Stella

 

[Stella_0240]

hi,

My computer crashed again while I was waiting for your answer. I think I worked out the minidump business creation and got the files from the 10 June up to today's one and zipped them in one zip - 5 files overall so far.
Today before it crashed I changed the setting from kernel dump to minidump hopefully this is what you wanted. I attach the link from Google drive. Hopefully it works, I was not sure what type or access or person to set it to. I hope i got it right. minidumps
I look forward to hearing from you.
thanks,

Stella

 

[Colif]

it works, I was not sure what type or access or person to set it to. I hope i got it right. minidumps

can you set it so its shared with anyone with the link? It wants me to ask for access.

Sorry I didn't answer, been busy.

 

[Stella_0240]

hi Colif,

the link is already in shared: try
https://drive.google.com/file/d/1dZkdV9H_tAf5tr92GH9BiBe0l8GT-Czn/view?usp=sharing
I have checked the logs with a program i downloaded: the Volume Shadow Copy driver failed on 10th June and when I was looking at the list of services yesterday that are showing as "stopped" both the volume shadow copy service and Virtual disk service show as stopped. What should I do to get this stuff working again safely? then the days that followed that failure of the Volume shadow copy i.e. volsnap.sys, the NT kernel & System (ntoskrnl.exe) started to fail (would this explain why the non kernel memory keeps going up maybe?). On 16 June the ntoskrnl.exe and NSIproxy.sys appear to have failed. I have includled in the folder the pictures I took yesterday from that program too.
https://drive.google.com/file/d/1jRkOnrFRTlJLWKjlKMUNvT7QJfNciK65/view?usp=sharing
https://drive.google.com/file/d/1Ur-ynx3ZrBbQhny_i1xWa59ei4WCgDaU/view?usp=sharing
I'll await your news.

 

[Colif]

Volume shadow copy & volsnap are both parts of system restore
ntoskrnl is the system kernel, its involved in everything. Often blamed, never actually cause.
One of its jobs is memory management so you could have seeing that. Everything run though windows is managed by it.

spent a few hours yesterday making a new Virtual Machine so I could convert dumps. The one I had, ran out of space and wasn't set to grow if needed


File: 061624-21356-01.dmp (Jun 17 2024 - 03:07:54)
BugCheck: [DRIVER_IRQL_NOT_LESS_OR_EQUAL (D1)]
*** WARNING: Unable to verify timestamp for mwac.sys
Probably caused by: mwac.sys (Process: MBAMService.ex)
Uptime: 0 Day(s), 4 Hour(s), 16 Min(s), and 11 Sec(s)

File: 061424-25443-01.dmp (Jun 15 2024 - 05:35:15)
BugCheck: [DRIVER_IRQL_NOT_LESS_OR_EQUAL (D1)]
*** WARNING: Unable to verify timestamp for mwac.sys
Probably caused by: mwac.sys (Process: MBAMService.ex)
Uptime: 0 Day(s), 11 Hour(s), 29 Min(s), and 24 Sec(s)

File: 061324-33228-01.dmp (Jun 13 2024 - 12:08:46)
BugCheck: [DRIVER_IRQL_NOT_LESS_OR_EQUAL (D1)]
*** WARNING: Unable to verify timestamp for mwac.sys
Probably caused by: mwac.sys (Process: MBAMService.ex)
Uptime: 0 Day(s), 16 Hour(s), 16 Min(s), and 58 Sec(s)

File: 061324-31621-01.dmp (Jun 14 2024 - 08:40:02)
BugCheck: [DRIVER_IRQL_NOT_LESS_OR_EQUAL (D1)]
*** WARNING: Unable to verify timestamp for mwac.sys
Probably caused by: mwac.sys (Process: MBAMService.ex)
Uptime: 0 Day(s), 8 Hour(s), 34 Min(s), and 02 Sec(s)

File: 061024-23805-01.dmp (Jun 10 2024 - 22:55:37)
BugCheck: [SYSTEM_THREAD_EXCEPTION_NOT_HANDLED_M (1000007E)]
Probably caused by: volsnap.sys (Process: System)
Uptime: 0 Day(s), 4 Hour(s), 32 Min(s), and 11 Sec(s)

report

4 of them caused by

Dec 14 2023

mwac.sys

Malwarebytes Web Access Control http://www.malwarebytes.org/

So i would uninstall malwarebytes or update it.

its possible adwcleaner removed part of it as well, repair install could fix malewarebytes (I mean repair application, not windows)

 

[Stella_0240]

Hi,

I have already uninstalled and installed MalwareBytes again - I have a paid subscription with them. I have used Malwarebytes without issues for months.

As I said, when I opened this ticket, the issue came when I used a separate program called ADwcleaner which belong to the Malwarebytes company on 10th June, which after I ran for the first time caused the blue screen and the volsnap.sys to fail.

Malwarebytes still works well, the only problem is when I turn on the VPN, the kernel memory - non paged goes up and up. It did not use to do this before I used AdwCleaner.
Can you please tell me how to fix the volsnap.sys issue and the non paged kernel memory issue?

thanks,

Stella

 

[Colif]

this isn't a ticket, its just a request for help.
I am just a volunteer, just answering in my own free time.

the last 4 crashes were Malwarebytes. It will continue to crash unless you fix it.

Open command prompt (admin)_

type sfc /scannow and press enter
that will scan windows file system and fix any problems it finds. If it does fix anything, a restart is needed to make the fixes.
Might fix system restore

you can look to see if its disabled in settings: https://www.ubackup.com/windows-7/turn-on-system-restore-windows-7.html

 

[Stella_0240]

Hi Colif,

sorry for using the wrong term. I did not mean to offend you. Thanks for sending me that link. I will try and see if that does the trick.

thanks,

Stella

 

[Colif]

just explaining I didn't have to do this. I don't mind helping. Its why I am here

 

[Stella_0240]

Hi Colif,

sorry for using the wrong term. I did not mean to offend you. Thanks for sending me that link. I will try and see if that does the trick.

thanks,

Stella

sorry follow up question: if I set up the system restore now, does it mean it will go back to the very early days of Windows 7 or it will go back to an earlier version before 10th June? looking via the registry it seems that there is no System restore in my PC. It is possible that it was never set up?

 

[Stella_0240]

just explaining I didn't have to do this. I don't mind helping. Its why I am here

I'm happy we have sorted out this misunrstanding. I have opened a number of tickets with MalwareBytes, which have chosen to ignore (and with Godaddy for another thing), so the term "ticket"was very present in my mind and came up first in our conversation. Apologies again.

Stella

 

[Stella_0240]

i do have the original Windows 7 Disk though. I fear I might lose all my other installed programs and also the Windows 7 security updates that came after installating the disk throughout the years.
Regards,
Stella

 

[Colif]

sorry follow up question: if I set up the system restore now, does it mean it will go back to the very early days of Windows 7 or it will go back to an earlier version before 10th June? looking via the registry it seems that there is no System restore in my PC. It is possible that it was never set up?

if you set up system restore, it shouldn't run the process. All it should do is enable the functions that create restore points, it shouldn't run one.

it not being enabled ever would explain why its not running now.

 

[Colif]

i had win 7, I would hate to reinstall it now. Too many updates. I think they changed it a little so they are combined now.

Win 10 & 11 make it easier. Cumulative update of everything before. I installed windows 10 on a virtual machine last night. Took a few hours but I had a few restarts of the process. Only an hour to get all updates. It used to take all day on Vista.

 

[Stella_0240]

i had win 7, I would hate to reinstall it now. Too many updates. I think they changed it a little so they are combined now.

Win 10 & 11 make it easier. Cumulative update of everything before. I installed windows 10 on a virtual machine last night. Took a few hours but I had a few restarts of the process. Only an hour to get all updates. It used to take all day on Vista.

you are lucky that you know what you are doing. I am out of my depth with this thing. Windows 7 served me well until now and it does seem to work for all of the programs that i use for audio recording like Audacity and my astrology programs, which I installed throughout the years. With Windows stopping support, it just makes the whole thing very consumeristic, as not only you have to upgrade their system but also have to search and hope you find updated versions of the other programs you were using within the Windows environment and hope you find them. To my previous disappointment I have seen that this is often what happens, programs that were avaialble before are no longer available or in use. They essentially die with that OS version, when in fact they still are alive and working well in this environment. For security I use Malwarebytes instead of the Defender since it does not obviously work anymore. But aside from that Google works and all the rest works. If it had been for my stupidity in using Adwcleaner I would not have found myself in this predicament and would have carried on for years with this machine. I am going to try the sfc scan and checkdisk facilities and see if i get some luck and resolve this.
BTW, I was reading somewhere yesterday to back up also my system files and explerer.exe if are themed before running the sfc scan as it will put them to default. Since it seems I have to do a major back up here of my PC in one of my external drives before I run sfc scan how can i do a back up so that it is an exact replica of what I am currently seeing and using on this pc? is there a link you can send me? I do not even know what a themed version of system files looks like and cannot tell if I already have the default one or not but want to make sure that all I am currently seeing is what I am going to see after running those 2 checks.
BTW, how does one learn about of the things needed to know to watch out for so that these machines with windows 7, 10 or 11 for what that matter run for the longest time possible? I do not know which things I should we watching out for that could signal issues with these machines.

Regards,

Stella

 

[Colif]

You might want to uninstall malwarebytes, restart PC and reinstall malwarebytes, its possible its missing some files. You might want to grab a new version from their site. That should fix your BSOD problem.

I might grab some help from people that know 7 better, its been 8 years since I ran it. they can show you how to backup - all of the windows guides assume you want to move it to a win 10 PC now.
this shows how: https://www.wikihow.com/Back-Up-Windows-7

BTW, how does one learn about of the things needed to know to watch out for so that these machines with windows 7, 10 or 11 for what that matter run for the longest time possible? I do not know which things I should we watching out for that could signal issues with these machines.

I guess it just comes with using them. Also helps to start with good hardware as then it will last. Older they get the more likely something will go wrong.

Windows 10 and 11 are different to 7 in one way... well, more than one, but this helps. Every year there was a new version released that would replace current one. Windows would download it and replace the current install with new files. So the chances of you having problems from windows is reduced a little. As windows is only 2 years old in Win 10's case and 1 in Win 11's case - version updates have stopped for win 10 now.
So the OS tries to keep itself alive now more than 7 could. There are tools available for them that aren't on 7. I would have suggested one otherwise.

 

[Stella_0240]

Hi Colif,
thanks for the url link on the back up, so you say this will also save the themed files systems if i have those too, right? (i'm not sure if I have them but just in case...)

I wish I had know about this thing before I would have been able to revert to the back prioir 10th june and would resolved everything instantly. I feel doubly stupid for that.

If I send the back up of Windows 7 to an external hard drive can I call the folder for the back up with a name of my choosing? reason I am saying this is that I already have other stuff in the hard drive I am thinking of using for this exercise and to do not want to get confused next time I have to do a back up using that drive.
I have Windows 11 in my work machine so I am familar with Word,excel and those programs, but I have not installed the fun stuff that I have on this windows 7 machine so that I could keep avoid getting virus and or malware on like I got on the windows 7 machine. I have no viruses on the Windows 7 machine, but I do have currently some malware in Chrome that Malwarebytes seems to keep at bay, it might be related to my bookmarks, but I have not tried to resolve it yet as this blue screen issue has taken precendence.
thanks,

Stella

 

[Stella_0240]

sorry me again
I have a friend who built this very machine, I could ask him to replace some parts, which parts do you think i should get so that the machine can still run for longer?
thanks,

Stella

 

[Colif]

It should save all the files that are in the folders it covers. You should be able to use the backup to roll back win 7 to how it was when you ran it.
judging by link I gave you, it makes the names for the files.

I really don't know what parts you should replace.
I can only see so much from your report
CPU - i5-4670S
Motherboard - Gigabyte H87-HD3
Ram - 8gb corsair

That is all I can see.
If the power supply is the same age as the rest, it probably needs to be replaced as they wear out fastest and if they die in a bad way, can take other parts with them.

its about 10 years old? Depending how much you use it, I would think about getting a new one soon as you will notice a difference, Obviously need to make sure the programs you use have versions for 11. But you less likely to run into programs that don't work anymore.

 

[Stella_0240]

Hi,

From what I saw from the invoice for the Windows 7 purchase I bought it in Sept 2013 so you are about right. The graphic card installed would have been from that same timeline, but then again if I understand correctly those work with only certain types of OS versions, so I am not even sure wherther there would be a graphic card that works with Windows 7
I did not think of the power supply, good thing you brought that one up.
Do you consider it being worth buying an SSD too?
I will consider the cost and make an assessment.

Again consumerism.... damn!
thanks again for all your help.

Stella

 

[Colif]

graphics cards aren't operating system specific. What one do you have?

I am not sure if the new ones would care about being on 7 - Nvidia still have drivers for 7 that work with their new cards. Not sure about AMD.

10 years is a good age for a GPU though. If you don't really use it for much, I would keep using it until it stops. Most of the GPU I have had ended up dying on me... or maybe half. Its 24 years, so I didn't keep count.

SSD would make boot faster, that is for sure. I wouldn't go back to hdd if you paid me. Its impossible.

If you were to get a new GPU you would for sure want a new PSU anyway.

 

[Stella_0240]

ok, I thought that the graphic cards worked on a given version and that's it . Good news about the Nvidia tip.
I appear to have a Intel (R) HD Graphics 4600 and I can see HD movies perfectly fine.
yes, I am rea,lly proud of this PC it never gave me problems so it is a real treat to use. I use it every day. Mostly I watch movies online with it and work on Word docs, obviously e-mails stuff and record audio on Audacity and some astrology programs, but then again I would say movies and Word 90% of the time.
thanks,

Stella

 

[Stella_0240]

If I send the back up of Windows 7 to an external hard drive can I call the folder for the back up with a name of my choosing? reason I am saying this is that I already have other stuff in the hard drive I am thinking of using for this exercise and to do not want to get confused next time I have to do a back up using that drive.

Sorry Colif,

I do not seem to have received your answer on the above since I need to get cracking with the back up. Can you confirm if I can send the Windows 7 back up to a folder name of my choosing? This hard drive I am going to use does not have partitions and there is some little stuff I have already put it in, so I would like to be able to access that other stuff and not have Windows trying to back up the drive everytime I use it.
I'm reading about the SSDs advantages - I did not know of their existance up to this last week so unfortunately, I have to work with what I have and use an HHD. I will buy some SSDs for the future.
Cheers,
Stella