Vista Giving Me All Sorts Of Errors And BSOD's

[CrucialHoax]

JF

dis you try and move or edit the winsxs folder or its files? there are tons of errors about thefiles in that directory

I don't even know what the winsxs file is so I don't think so. I just did a search for it and it is in the folder C:/window/winsxs and has a bunch of folders called all sorts of things with all sorts of dates. I should mention that I hadn't done anything that I can think of before all this had started happening. Maybe a week prior I had gotten an email from what I thought was eBay and I clicked on the link in it and Firefox told me it was a bad site and I closed it immediately. Just thought I'd throw that out there.

Then definitely follow Frostmournes' instructions in the above post. This will verify your machine isn't infected.

 

[JasonFender]

Run a full malwarebytes and superantispyware scan. Something has corrupted the files. Then run these commands in an administartor command prompt - open up the start menu, type cmd and press ctrl+shift+enter. Press enter after each line:

driverquery /v > %temp%\drivers1.txt

driverquery /si >> %temp%\drivers1.txt & start notepad %temp%\drivers1.txt

Then, in notepad save the files as .txt and upload it.

Alright. Here's my situation. I haven't been able to upgrade to SP2. I'm having all sorts of problems with that. Second, I downloaded both Malwarebytes and SuperAntiSpyware and was able to do a quick scan with Malwarebytes but when I try and do a full scan with either of them, I get a BSOD. Also when I open the CMD and try to type in "driverquery /v > %temp%\drivers1.txt" and then " driverquery /si >> %temp%\drivers1.txt & start notepad %temp%\drivers1.txt" just like that I get BSOD's. I am at a loss of where to go. I'm not going to be up too much more tonight as I'm getting over a cold and have classes tomorrow, but I will get back to this when I get a chance tomorrow or tonight if I'm still up.

Thanks for all the help so far and sorry this is such a mess.

 

[Frostmourne]

Upload the .dmp. Also, do you have a backup of your files? The command didn't complete? You didn't put in the quotes, did you?

 

[JasonFender]

Well... I gave that CMD thing one more shot and it worked. I got one txt file from it (not sure if it was supposed to be more but I got one) and it's attached below.

 

[JasonFender]

Upload the .dmp. Also, do you have a backup of your files? The command didn't complete? You didn't put in the quotes, did you?

I imagine the .dmp file was associated with the Malwarebytes scan I ran. I'm trying to find that file. Here are the results I got from it.

 

[Frostmourne]

Delete everything, you are infected. Hijack.Display Properties can be a false alert though.

 

[JasonFender]

Delete everything, you are infected. Hijack.Display Properties can be a false alert though.

Oh jeez... Not that I don't trust you or anything (so please don't take it that way) but can anyone confirm that I should delete everything and start from scratch? I have all my disks from Gateway but have never done anything like this so I imagine it would be a pretty big task.

 

[Frostmourne]

NO, I meant delete the stuff from malwarebytes. If not try sfc /scannow before a full reinstall. I should be clearer.

 

[archie123]

Upload the .dmp. Also, do you have a backup of your files? The command didn't complete? You didn't put in the quotes, did you?

I imagine the .dmp file was associated with the Malwarebytes scan I ran. I'm trying to find that file. Here are the results I got from it.

its only adware nothing serious , certainly nothing thats causng you issues , so all updated to sp2? all new drivers installed? upload a few dumpfiles now , i have to goto work but im sure somebody else could look at them if not ill take a look later

one more thing , did you do / add anything before this started happening? think really hard , even the smallest of changes?

 

[CrucialHoax]

archie, he couldn't update to SP2. Machine wouldn't allow it. If he posts up a new dump I'll gladly debug it and see whats causing it though

 

[JasonFender]

archie, he couldn't update to SP2. Machine wouldn't allow it. If he posts up a new dump I'll gladly debug it and see whats causing it though

Correct I haven't got SP2 installed. I could barely get my computer on this morning without it giving me the BSOD. Here are all the files in my minidump folder. I've uploaded them to a ZIP file that is attached. I've got some more classes throughout the afternoon but will get back here and work on it as I can.

Thanks

 

[zigzag3143]

Jason

the first five dumps are identical and I suspect the rest will be the same. They all reflect memory corruption. Are you overclocking? Have you run a memory test like memtest?

How much memeory do you have? are they all the same speed, latency, etc?

Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\K\Desktop\Mini100509-05.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*d:\symbols*Symbol information
Executable search path is:
Windows Server 2008/Windows Vista Kernel Version 6001 (Service Pack 1) MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 6001.18226.amd64fre.vistasp1_gdr.090302-1506
Machine Name:
Kernel base = 0xfffff800`02053000 PsLoadedModuleList = 0xfffff800`02218db0
Debug session time: Mon Oct 5 18:53:55.018 2009 (GMT-4)
System Uptime: 0 days 6:52:43.226
Loading Kernel Symbols
...............................................................
................................................................
...........
Loading User Symbols
Loading unloaded module list
....
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck C2, {7, 110b, 0, fffff900c21a59c8}

GetPointerFromAddress: unable to read from fffff8000227c080
GetUlongFromAddress: unable to read from fffff800021e7250
Probably caused by : Unknown_Image ( PAGE_NOT_ZERO )

Followup: MachineOwner
---------

*** Memory manager detected 52 instance(s) of page corruption, target is likely to have memory corruption.

2: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

BAD_POOL_CALLER (c2)
The current thread is making a bad pool request. Typically this is at a bad IRQL level or double freeing the same allocation, etc.
Arguments:
Arg1: 0000000000000007, Attempt to free pool which was already freed
Arg2: 000000000000110b, (reserved)
Arg3: 0000000000000000, Memory contents of the pool block
Arg4: fffff900c21a59c8, Address of the block of pool being deallocated

Debugging Details:
------------------

GetUlongFromAddress: unable to read from fffff800021e7250

POOL_ADDRESS: fffff900c21a59c8

BUGCHECK_STR: 0xc2_7

CUSTOMER_CRASH_COUNT: 5

DEFAULT_BUCKET_ID: COMMON_SYSTEM_FAULT

PROCESS_NAME: firefox.exe

CURRENT_IRQL: 0

BAD_PAGES_DETECTED: 34

LAST_CONTROL_TRANSFER: from fffff80002187f98 to fffff800020a7650

STACK_TEXT:
fffffa60`0973c728 fffff800`02187f98 : 00000000`000000c2 00000000`00000007 00000000`0000110b 00000000`00000000 : nt!KeBugCheckEx
fffffa60`0973c730 fffff960`002b1403 : 00000000`00000000 fffffa80`0a2e63f0 00000000`00000001 fffffa60`0973cad0 : nt!ExDeferredFreePool+0x902
fffffa60`0973c7e0 fffff960`0011e22f : fffff900`c0166970 fffff900`c0096010 fffff900`c000a010 fffff900`c0096010 : win32k!RFONTOBJ::vDeleteRFONT+0x23f
fffffa60`0973c840 fffff960`0011dc63 : fffff900`c069da10 fffffa60`0973c8f0 00000000`00000000 00000000`00000000 : win32k!RFONTOBJ::bMakeInactiveHelper+0x423
fffffa60`0973c8d0 fffff960`0011b238 : fffffa80`0a2fc5d0 fffff900`c0001000 fffffa60`0973cad0 fffffa60`0973cb20 : win32k!RFONTOBJ::vMakeInactive+0xa3
fffffa60`0973c970 fffff960`000fbe71 : 00000000`00000000 fffff960`00166b92 00000000`00000000 00000000`00000002 : win32k!RFONTOBJ::bInit+0x1e8
fffffa60`0973ca80 fffff960`000fbdff : fffff900`c0001000 fffffa60`0973cca0 00000000`70616d63 00000000`0b0a044e : win32k!ulGetFontData2+0x31
fffffa60`0973caf0 fffff960`000fbd09 : 00000000`ffffffff 00000000`ffffffff fffff900`c00dc630 fffff900`c0001000 : win32k!ulGetFontData+0x7f
fffffa60`0973cb40 fffff800`020a70f3 : 00000000`14010cb8 fffffa80`0b569060 00000000`0016df78 00000000`00000000 : win32k!NtGdiGetFontData+0x8d
fffffa60`0973cbb0 00000000`74eaad3a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`0016df58 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x74eaad3a


STACK_COMMAND: kb

SYMBOL_NAME: PAGE_NOT_ZERO

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: Unknown_Module

IMAGE_NAME: Unknown_Image

DEBUG_FLR_IMAGE_TIMESTAMP: 0

BUCKET_ID: PAGE_NOT_ZERO

Followup: MachineOwner
---------

*** Memory manager detected 52 instance(s) of page corruption, target is likely to have memory corruption.

ken

 

[CrucialHoax]

The dumps I analyzed suggested the same thing. I would uninstall firefox or create a new profile and see if that resolves the issue.

 

[JasonFender]

zigzag3143: My memory is as follows: 4 x 2GB DDR2 667. It's the default memory that came with the computer that I bought.

I don't know how to overclock so I guess my answer to that would be no.

And no I haven't run any memory tests. I'll google the one you are talking about and I'll see if I can run it.



CrucialHoax: I can uninstall Firefox but what do you mean create a new profile?

 

[CrucialHoax]

zigzag3143: My memory is as follows: 4 x 2GB DDR2 667. It's the default memory that came with the computer that I bought.

I don't know how to overclock so I guess my answer to that would be no.

And no I haven't run any memory tests. I'll google the one you are talking about and I'll see if I can run it.



CrucialHoax: I can uninstall Firefox but what do you mean create a new profile?

Here you go

memtest 86+: Memtest86.com - Memory Diagnostic [click on the download button, then choose ISO image for creating bootable cd (Windows)]

firefox profile: Creating a new Firefox profile on Windows - MozillaZine Knowledge Base

 

[JasonFender]

zigzag3143: My memory is as follows: 4 x 2GB DDR2 667. It's the default memory that came with the computer that I bought.

I don't know how to overclock so I guess my answer to that would be no.

And no I haven't run any memory tests. I'll google the one you are talking about and I'll see if I can run it.



CrucialHoax: I can uninstall Firefox but what do you mean create a new profile?

Here you go

memtest 86+: Memtest86.com - Memory Diagnostic [click on the download button, then choose ISO image for creating bootable cd (Windows)]

firefox profile: Creating a new Firefox profile on Windows - MozillaZine Knowledge Base

Ok. I uninstalled Firefox. i didn't realize you had said uninstall OR create a profile. I just uninstalled it. I can redo my bookmarks and stuff. It's no biggie.

As far as the memtest, I'm not sure what to do with an ISO file. My computer doesn't seem to know either. Any thoughts?

 

[CrucialHoax]

zigzag3143: My memory is as follows: 4 x 2GB DDR2 667. It's the default memory that came with the computer that I bought.

I don't know how to overclock so I guess my answer to that would be no.

And no I haven't run any memory tests. I'll google the one you are talking about and I'll see if I can run it.



CrucialHoax: I can uninstall Firefox but what do you mean create a new profile?

Your bookmarks should still be saved somewhere unless you chose the 'Remove all personal settings' option during un-installation. An .iso file is a bootable image or kind of like a stand alone program on a disk. But in order to burn that to a disk you'll need to install this: imgburn downloads - Free software downloads and software reviews - CNET Download.com

This will burn the .iso file to the disk so you can boot from it.


Here you go

memtest 86+: Memtest86.com - Memory Diagnostic [click on the download button, then choose ISO image for creating bootable cd (Windows)]

firefox profile: Creating a new Firefox profile on Windows - MozillaZine Knowledge Base

Ok. I uninstalled Firefox. i didn't realize you had said uninstall OR create a profile. I just uninstalled it. I can redo my bookmarks and stuff. It's no biggie.

As far as the memtest, I'm not sure what to do with an ISO file. My computer doesn't seem to know either. Any thoughts?

Your bookmarks should still be somewhere on the harddisk unless you chose the remove all personal settings option during the uninstall process.

An .iso file is a bootable image file format. So in order for you to use that download your going to need to install this burner: imgburn downloads - Free software downloads and software reviews - CNET Download.com

Then after it is burnt, boot the machine from that disk.

P.S. Sorry if your bookmarks are lost

 

[JasonFender]

No worries about the bookmarks (I did select remove personal info in case that was needed knowing it'd probably get rid of my bookmarks). I can redo them no sweat. I'm downloading that software now and going to burn that ISO file.

I have class in a few minutes but when I get back I'll boot my machine from that disk. The question I have is how you do that... If that's here by when I get out of class I'll do it when I get a chance.

Thanks

 

[CrucialHoax]

When the computer starts to boot up, start tapping F9 this will bring up the 'Change Boot Order' Menu then select the proper device --more than likely will say DVD/CD drive-- then hit enter. It will boot from the disk.

 

[JasonFender]

When the computer starts to boot up, start tapping F9 this will bring up the 'Change Boot Order' Menu then select the proper device --more than likely will say DVD/CD drive-- then hit enter. It will boot from the disk.

Ok and one more thing. What results do I need to bring you all from it? Will it throw something on the desktop for me to show you all or something?

Either way, I'm heading to class. I'll do it once I get back from class and (probably) get some dinner.

Thanks