?
Solved

Multiple Blue Screens - Stop 0x00000050 and 0x0000008E

Posted on 2010-01-11
79
Medium Priority
?
842 Views
Last Modified: 2012-08-13
I am working on a friend's Gateway PC and he keeps getting multiple BSODs.   It happens just about anywhere, and I have been trying to run McAfee Internet Security full scan for viruses.  I have received errors regarding MCODS.exe (application error), and a message about "Error getting scan progress".   I think it's more than just McAfee giving me a problem.   I have removed one of the multiple HP printers he had on it, and I have run Malwarebytes Anti Malware and CCleaner.  
I am attaching the HiJack log.  Not sure if there is some malware that is not being detected, or if it's something else.
hijackthisJan11.txt
0
Comment
Question by:mat58
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 30
  • 26
  • 17
  • +3
79 Comments
 
LVL 7

Expert Comment

by:Brad Sims, CCNA
ID: 26289721
Make sure System Restore is off and try ComboFix.  If it is malware this will catch it.  It hasn't failed me yet on XP.

http://download.bleepingcomputer.com/sUBs/ComboFix.exe

0
 

Author Comment

by:mat58
ID: 26290163
Well, I ran ComboFix (I was thinking that and was glad you suggested it).  However, after running ComboFix and re-enabling McAfee Security Center, I attempted a full scan and received the following:
STOP 0x0000008E    (0xc0000005, 0xBF801E93, 0xB839BC48, 0x00000000)
    win32k.sys    Address BF801E93 base at BF800000,  Datestamp 4a8564c7

I'm attaching the ComboFix log also:

Just as I was getting ready to send this, I received a message from McAfee about Artemis!Trojan.  Couldn't get the entire message as it cleared as fast as it appeared.
ComboFix.txt
0
 
LVL 27

Expert Comment

by:Jonvee
ID: 26290987
May well be a rootkit that's still infecting the machine.  Please try the Sophos Anti-Rootkit Free rootkit detection and removal tool:
http://www.sophos.com/products/free-tools/sophos-anti-rootkit.html

Also of interest>
"STOP: 0x0000008E (0xC0000005... BSOD / REBOOT":
http://icrontic.com/forum/showthread.php?t=50966
0
Optimize your web performance

What's in the eBook?
- Full list of reasons for poor performance
- Ultimate measures to speed things up
- Primary web monitoring types
- KPIs you should be monitoring in order to increase your ROI

 
LVL 92

Expert Comment

by:nobus
ID: 26291115
can you post the minidumps?
or check them with bluescreenview : http://www.nirsoft.net/utils/blue_screen_view.html
0
 
LVL 27

Expert Comment

by:Jonvee
ID: 26291241
Also recommend running Trend Micro's free online virus scanner:            
http://housecall.trendmicro.com/uk/
Ideal for scanning online, using "Safe Mode with networking".      

Your ComboFix logfile is showing remaining infection(s).   Possibly it's the result of the Rustock rootkit.  Therefore if problem still unresolved, you can remove an apparantly infected folder by running this short script in a ComboFix second scan, as shown here>

1. Open Notepad.
2. Copy & paste all text between the lines below, into Notepad window:
=========================================================

Folder::
C:\7528ecf1dd1f9aacee0c7bd62008

==================================================
3. Now Save the above as CFScript.txt on your desktop.
4. Then drag the CFScript.txt just created into ComboFix.exe. This will re-start ComboFix, & hopefully the problem is removed.
5. Finally, please attach the newComboFix logfile.

Further detail, if required>
A guide and tutorial on using ComboFix:
http://www.bleepingcomputer.com/combofix/how-to-use-combofix
0
 
LVL 17

Expert Comment

by:kadadi_v
ID: 26292033
I think clean re-installation Winxp is better and yes take the backup of that disk by connecting to other PC as a slave .

If do not want to clean reinstall then you can repair winxp operating system or try with system restore option OR RUN command SFC / SCANNOW and insert the winxp CD so it will restore the ordinal system files.

More Info:-

http://community.mcafee.com/thread/16871
http://www.geekstogo.com/forum/Windows-XP-Blue-Screen-Death-STOP-Codes-t43519.html

Regards,
vijay


0
 
LVL 27

Expert Comment

by:Jonvee
ID: 26322421
mat58 ....any update please?
0
 

Author Comment

by:mat58
ID: 26331413
I have had limited time to work on this, but I am still having problems.   These are the steps that I've done to date:
1 - Removed McAfee Internet Security
2 - Ran ComboFix with the changes you provided
3 - Ran the Sophs AntiRootkit (showed hidden desktop files but didn't recommend cleaning)
4 - Ran a Successful Malwarebytes Anti Malware scan (removed 3 rootkits)
5 - Installed AVG Free to be able to scan for viruses

Tried to run AVG virus scan. Received another Blue Screen.  This time with 0x000000D1   showing file bcmw15.sys

5 - Removed AVG
6 - Ran cCleaner
7 - Rebooted PC and reran ComboFix (see attached log)

Every time I think I have it fixed, and run a successful scan, I run it again and it blue screens

ComboFix0116.txt
0
 
LVL 27

Expert Comment

by:Jonvee
ID: 26331473
The BSOD could be due to your Network Adapter driver(wireless).
bcmwl5.sys file information:
http://www.file.net/process/bcmwl5.sys.html

Analysing your Combo logfile ...
0
 
LVL 27

Expert Comment

by:Jonvee
ID: 26331493
Your ComboFix log doesn't seem complete, the end-section appears to be missing.  Would you please post another one ...
0
 

Author Comment

by:mat58
ID: 26331683
When I try to rerun ComboFix, I get the following error just as it is Preparing the Log Report:

"sed.cfxxe - Entry Point Not Found"
The procedure entry point CloseHandleaR_GetExitCodeProcess could not be located in the dynamic link library KERNEL32.dll

0
 

Author Comment

by:mat58
ID: 26331705
This the latest log:
ComboFix-2-0116.txt
0
 
LVL 27

Expert Comment

by:Jonvee
ID: 26332102
Thanks.  It seems complete but is going to take a while to analyse ... will get back to you ..

Incidently to remove those rootkits did you run Malwarebytes Anti Malware in Safe mode?
It wouldn't do any harm to run RootkitRevealer v1.71
http://www.microsoft.com/technet/sysinternals/Security/RootkitRevealer.mspx

The 'error' during the last run could conceivably be due to another rootkit.
Therefore if still unresolved, you could download a new ComboFix from here>
http://download.bleepingcomputer.com/sUBs/ComboFix.exe

Before running it please disable any realtime Anti-virus, Anti-spyware, Shields, etc. that you may have running.
Also try renaming ComboFix.exe (to Combo-Fix.exe for example), before saving it to your desktop.  If you have difficulties downloading it, try downloading to another machine, then into a USB memory stick (or equivalent).  Rename it and connect to the infected machine & try another scan.
0
 
LVL 27

Expert Comment

by:Jonvee
ID: 26332267
Although it doesn't prove whether you still have a lurking rootkit, your ComboFix log does appear clean.

One slightly puzzling entry, but i believe harmless>
"3.tmp file information":
http://www.file.net/process/3.tmp.html

Still advisable to run RootkitRevealer, & even ComboFix again as described above.
0
 

Author Comment

by:mat58
ID: 26332327
Here is the RootKit Reveal Log.   Can you let me know what I should do next ?
RootkitReveal.txt
0
 
LVL 27

Expert Comment

by:Jonvee
ID: 26332510
sorry about the delay, still studying the RR log which i'm not so familiar with ...

Located this article although it's a little brief>
"How to Detect Rootkits using RootkitRevealer":
http://staff.kfupm.edu.sa/COE/shafei/index_files/Page552.htm
0
 
LVL 27

Expert Comment

by:Jonvee
ID: 26332598
Far as i'm aware the Rootkit Revealer's log seems clean.
As long as you've read about any special tests(if any) that you have to take before scanning, all should be well.   It would have been prudent to run a 2nd scan if you had located and removed a rootkit, otherwise it would seem ok.

Does the PC still have the same symptom?
If yes, i suggest you re-run ComboFix, but as per above.
0
 
LVL 92

Expert Comment

by:nobus
ID: 26334053
can you post the minidump ?  as asked?
0
 

Author Comment

by:mat58
ID: 26335549
Right now I'm stuck - trying to uninstall AVG antivirus and keep getting error "Uninstall failed - 1 error found (Action failed for registry key KHLM\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\\Windows: creating registry key....)"
0
 
LVL 92

Expert Comment

by:nobus
ID: 26335581
you can copy it if you boot from a live cd, like knoppix : ftp://ftp.kernel.org/pub/dist/knoppix/KNOPPIX_V6.0.1CD-2009-02-08-EN.iso      
0
 
LVL 27

Expert Comment

by:Jonvee
ID: 26336062
Did you try removing AVG AV with the AVG Remover utility, or some other app ?
"AVG Remover":
http://www.avg.com/gb-en/download-tools
0
 
LVL 27

Expert Comment

by:Jonvee
ID: 26336107
The error quoted here is similar to yours.  Here it was suggested using the remover tool again, then download & use the "reset_access_avg9_en.exe" tool.   Scroll to the detail at page bottom>
http://forums.avg.com/us-en/avg-free-forum?sec=thread&act=show&id=54159
0
 

Author Comment

by:mat58
ID: 26336361
OK.  Used the AVG utility to completely remove the software.   Tried again to run MalwareBytes AntiMalware (showed 3 infections).  Towards the end of the scan, it BSOD again.  By the time I got the PC it had already rebooted.   I believe this is the Dump file:
Mini011710-01.dmp
0
 

Author Comment

by:mat58
ID: 26336428
Here is the latest ComboFix Log
ComboFix0117.txt
0
 
LVL 27

Expert Comment

by:Jonvee
ID: 26336446
WinDbg gave the following result, which often indicates a hardware fault>
FAILURE_BUCKET_ID:  IP_MISALIGNED

How many RAM modules have you? A reasonably quick check on possible RAM failures is to remove all RAM modules except one, then reboot the computer.
If it still freezes, remove the one RAM & insert one of the others(or other one), & reboot again.    
If inconclusive run Memtest.

Will study Combo logfile ...
0
 
LVL 27

Expert Comment

by:Jonvee
ID: 26336531
A quick check & Combo log looks fairly clean.  Still investigating as i'm uncertain about these entries>

Files Created from 2009-12-17 to 2010-01-17
C:\$AVG

Reg Loading Points
S3 entries.
0
 
LVL 27

Expert Comment

by:Jonvee
ID: 26336665
Any thoughts, or progress, on the RAM stick (module) suggestion please?

Ref: ComboFix log:
The S3 entries i believe, are harmless.

So .. the one remaining item seems to be related to the AVG family.
If you wish to go ahead & remove it, please run ComboFix for a 3rd(?) time, and use this small script>


1. Open Notepad.
2. Copy & paste all text between the lines below, into Notepad window:
=========================================================

Folder::
C:\$AVG

==================================================
3. Now Save the above as CFScript.txt on your desktop.
4. Then drag the CFScript.txt just created into ComboFix.exe. This will re-start ComboFix, & hopefully the problem is gone.
5. Finally, please attach the newComboFix logfile.
0
 

Author Comment

by:mat58
ID: 26338314
Here is the latest status and files:
 - Reran ComboFix with AVG folder removal
 - removed 512MB of additional memory to see if that was the problem
 - ran AntiMalwareBytes Malware removal
 - Installed AVAST anti-virus
Received another BSOD (dump file included).   This is a different error, but one that has been happening throughout this process.
I will be unavailable until Monday evening
ComboFix0117-2.txt
Mini011710-02.dmp
0
 
LVL 92

Expert Comment

by:nobus
ID: 26338706
The minidump says it is caused by mbam -  so uninstall it .
it also mentions hardware - see the file
mini.TXT
0
 
LVL 27

Expert Comment

by:Jonvee
ID: 26338920
Thanks ...
ComboFix logfile similar to it's previous logfile, looks clean.

Have read a suggestion that the excellent Malwarebytes can be difficult to remove, although you should find it straightforward:
http://www.ehow.com/how_4926345_completely-remove-malwarebytes.html
0
 

Author Comment

by:mat58
ID: 26346683
I'm in process of removing the following:
(1) Manwarebytes
(2) Ad-Aware

I ran CCleaner to clean the registry keys and any leftover files
Running AVAST! virus scan

I did have 2 blue screens during the cleaning process: 0x0000008E (there should be a dump file for this if necessary)  and 0x0000007E (this occurred during reboot).  

I will update once I complete the virus scan
0
 

Author Comment

by:mat58
ID: 26346725
It just crashed again (groan!)  Here's the latest dump:
I was in the middle of the Avast! virus scan (full scan)
Mini011810-01.dmp
0
 
LVL 27

Assisted Solution

by:Jonvee
Jonvee earned 450 total points
ID: 26347134
Minidump analysis>   0x8E_win32k!HeavyAllocPool+74

0x0000008E: KERNEL_MODE_EXCEPTION_NOT_HANDLED
<quote> These are nearly always hardware compatibility issues (which sometimes means a driver issue or a need for a BIOS upgrade):
http://aumha.org/a/stop.htm
0
 
LVL 27

Expert Comment

by:Jonvee
ID: 26347221
At an earlier time you removed 512MB of additional memory.  It could still be a RAM issue.  Suggest you remove other RAM stick(s) *except* the 512 MB stick, then reboot.
0
 
LVL 27

Expert Comment

by:Jonvee
ID: 26347325
Some worthwhile checks if/when you look inside the PC ..
Make sure that the CPU fan works properly.  
Is there much dust inside the computer case?
Consider reseating the remaining RAM stick to another slot.
Could check the temperature of the CPU (temp < 60C)?
0
 
LVL 92

Expert Comment

by:nobus
ID: 26347334
did you ever uninstall mbam ?
0
 
LVL 92

Expert Comment

by:nobus
ID: 26347336
or looked at the hardware, like i suggested ?
0
 

Author Comment

by:mat58
ID: 26386733
MBAM was de-installed as requested.  Error occurred after de-installation and reboot.
Need to verify memory.
0
 
LVL 92

Expert Comment

by:nobus
ID: 26387189
ok - post results
0
 

Author Comment

by:mat58
ID: 26394566
Ran MEMTEST for about 1/2 hour - no errors
Latest Blue Screen dump is included:
All of Windows updates have been run;  Bios is from 6/28/2005 but when I go to the Gateway website, there are no BIOS upgrades that I can see (there are others, but all dated in 2005/2006)
I don't have the Windows OS disc to try a possible repair install....
Mini012410-01.dmp
0
 
LVL 92

Expert Comment

by:nobus
ID: 26395845
looks like this one is the cause :   ashSimpl.exe
it as a file from Avast :  http://www.processlibrary.com/directory/files/ashsimpl/
0
 
LVL 92

Expert Comment

by:nobus
ID: 26395859
0
 
LVL 27

Expert Comment

by:Jonvee
ID: 26395972
Another option would be to save the (Remove ashsimpl.exe) file download from this link, run a virus/Malware scan on the download, then run it to remove the ashsimpl file.

ashsimpl file information:
http://www.netcom3.com/processlibrary/ashsimpl
0
 

Author Comment

by:mat58
ID: 26397405
Just an observation, but for every anti-virus/anti-malware software I've loaded, every Blue Screen seems to point to a module within that software.  I've tried the following so far:

McAfee (original software on the PC)
Malwarebytes
Avast
AVG

0
 
LVL 92

Accepted Solution

by:
nobus earned 750 total points
ID: 26398812
aaah- good info.
can you do a system restore, or a repair install ?
0
 

Author Comment

by:mat58
ID: 26403309
Need to get hold of an XP CD first.  
0
 
LVL 27

Expert Comment

by:Jonvee
ID: 26406244
From your observation statement i'm wondering if the Stinger can help;  it's a utility that cleans the system of viruses that block anti-virus software:
http://vil.nai.com/vil/stinger/
0
 

Author Comment

by:mat58
ID: 26436770
Ran Stinger.   There was another blue screen when I checked the PC this morning
Mini012910-01.dmp
0
 

Author Comment

by:mat58
ID: 26436781
Also receiving a message from AVAST:  The AAVM subsystem detected a RPC error -
0
 
LVL 27

Expert Comment

by:Jonvee
ID: 26437097
Minidump analysis>
IMAGE_NAME:  Ntfs.sys
FAILURE_BUCKET_ID:  0x24_Ntfs!NtfsCommonRead+c68

Ntfs.sys is a Microsoft file:  information:
http://www.file.net/process/ntfs.sys.html

Suggest you disconnect from the internet tonight, uninstall your Anti-virus software, then see if you've got a BSOD in the morning.
0
 
LVL 27

Expert Comment

by:Jonvee
ID: 26437247
May be of interest>
RPC Server Unavailable:
http://askbobrankin.com/rpc_server_unavailable.html
0
 
LVL 92

Expert Comment

by:nobus
ID: 26438390
maybe time for a fresh install...
0
 
LVL 92

Expert Comment

by:nobus
ID: 26438400
or to run sfc /scannow from the run box

or do a repair install -
0
 

Author Comment

by:mat58
ID: 26447014
When I try to run sfc /scannow, it keeps asking me for the XP SP3 CD (which I don't have).   I tried to create a bootable CD using the instructions previously suggested, and the CD is not recognized.  

0
 

Author Comment

by:mat58
ID: 26447411
Finally was working my way through sfc /scannow (taking the cancel option when it couldn't find a file and I couldn't get the CD to work), and received another blue screen.  Different codes this time.
Attached is the latest dump file.....
Mini013010-02.dmp
0
 
LVL 92

Expert Comment

by:nobus
ID: 26447608
you should make an xp install cd with sp3 slipstreamed in it : http://www.howtohaven.com/system/slipstream-xp-service-pack-3.shtml
best do it on a WORKING pC!
0
 

Author Comment

by:mat58
ID: 26448928
OK now here's the problem.  I FINALLY got the CD created, and it works on my PC.  When I go to the machine in error, it doesn't recognize the CD AT ALL !     Just realized that the PC is running Windows XP Media Center Edition with Service Pack 3.   Any additional suggestions would be helpful.
0
 
LVL 10

Expert Comment

by:jramsier
ID: 26448975
0
 

Author Comment

by:mat58
ID: 26449064
No instances of drct16 or dwar32 in the registry.  
0
 

Author Comment

by:mat58
ID: 26449210
Attempted sfc /scannow again.  Received FATAL ERROR:  c0000021A; 0xc0000005.  Did not create any dump file.
0
 
LVL 92

Expert Comment

by:nobus
ID: 26449364
0
 

Author Comment

by:mat58
ID: 26491557
Problem is still open - I have been pre-occupied with another project.  Will report back as soon as I can.
0
 

Author Comment

by:mat58
ID: 26559968
I have been able to successfully run Antimalwarebytes and Avast! virus scans.  There are no viruses found with either scan.  
However, I am still getting the BSOD.   Attached is the latest dump file.  

Mini021110-01.dmp
0
 
LVL 27

Expert Comment

by:Jonvee
ID: 26560578
Minidump points to yet another module, the IDesktopInstanceManager.  Do you recognise it, please?
FAILURE_BUCKET_ID:  0x8E_win32k!GetDesktopView+10
0
 
LVL 27

Expert Comment

by:Jonvee
ID: 26560596
More details on a 0x8E_ error>
0x0000008E: KERNEL_MODE_EXCEPTION_NOT_HANDLED:
http://www.aumha.org/a/stop.php

<quote> A kernel mode program generated an exception which the error handler didn’t catch. These are nearly always hardware compatibility issues (which sometimes means a driver issue or a need for a BIOS upgrade) <unquote>
0
 
LVL 27

Expert Comment

by:Jonvee
ID: 26560613
The application CCleaner is mentioned in the minidump analysis, here>
PROCESS_NAME:  CCleaner.exe
Still investigating....
0
 
LVL 27

Expert Comment

by:Jonvee
ID: 26560764
If you're running CCleaner.exe, try uninstalling it.   Maybe a link between your BSODs from AV products, & CCleaner.   If problems uninstalling, suggest you use Process Explorer v11.33:
http://technet.microsoft.com/en-gb/sysinternals/bb896653.aspx
0
 

Author Comment

by:mat58
ID: 26816109
Trying to obtain the original XP Media Center discs to do a repair install.  Will update as soon as I can.
0
 
LVL 10

Expert Comment

by:jramsier
ID: 26816124
Did you try to uninstall MCafee yet?
0
 

Author Comment

by:mat58
ID: 27224485
Still working this problem.  Original disks are not available, so working on alternative
0
 
LVL 92

Expert Comment

by:nobus
ID: 27248632
0
 

Author Comment

by:mat58
ID: 27329581
I have the slipstreamed XP disks - they work on other PCs but not this one.   Anyway, I did find a very old XP CD to work from.  
Working based on corrupt NTOSKRNL.EXE file.   I was referred to this link:
http://www.computerhope.com/issues/ch000646.htm

First attempt to copy from the XP CD worked for a while, but I'm getting the BSOD again.
0
 
LVL 92

Assisted Solution

by:nobus
nobus earned 750 total points
ID: 27335542
>>   to copy from the XP CD worked for a while,   <<   is that during install  ?
then your options are :
-bad cd or cd drive, or cable - replace them, or test on other PC
-bad ram  test with memtest86+ from www.memtest.org
-bad onboard controller (ide or sata)
0
 

Author Comment

by:mat58
ID: 28416006
Could be a bad hard disk - I think my friend is going to take his PC back to the technician that originally worked with him.  Other than rebuild the hard disk, I don't think there is anything else that can be done.
0
 
LVL 92

Expert Comment

by:nobus
ID: 28425564
post results!
0
 

Author Comment

by:mat58
ID: 31052920
I have done everything I could for this PC other than re-install Windows Media Center.  My friend has all of his CDs in North Dakota, and is taking the PC back home with him the end of this month.
0
 

Author Closing Comment

by:mat58
ID: 31675888
All comments provided were excellent suggestions.  Other than a complete repair install using the original disks, not sure what else to do.  Thank you for all comments  
0
 
LVL 17

Expert Comment

by:kadadi_v
ID: 31170883
But My Answer is also same...Pls check

Regards,
vijay
0

Featured Post

Get 15 Days FREE Full-Featured Trial

Benefit from a mission critical IT monitoring with Monitis Premium or get it FREE for your entry level monitoring needs.
-Over 200,000 users
-More than 300,000 websites monitored
-Used in 197 countries
-Recommended by 98% of users

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

As hardware bugs go, this is a strange one! I upgraded a laptop in December 2011 with a 512GB Crucial m4 2.5-inch/9.5mm SATA Solid State Drive (SSD), Crucial part number CT512M4SSD2: http://www.crucial.com/store/partspecs.aspx?IMODULE=CT512M4SSD2 …
In this article you will get to know about pros and cons of storage drives HDD, SSD and SSHD.
Two types of users will appreciate AOMEI Backupper Pro: 1 - Those with PCIe drives (and haven't found cloning software that works on them). 2 - Those who want a fast clone of their boot drive (no re-boots needed) and it can clone your drive wh…
Finding and deleting duplicate (picture) files can be a time consuming task. My wife and I, our three kids and their families all share one dilemma: Managing our pictures. Between desktops, laptops, phones, tablets, and cameras; over the last decade…
Suggested Courses

800 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question