HELP! Memory Dump! BSOD! Rebooting ALL the time!

[nan cl]

My Compaq (XP HOME edition SP2) laptop is suddenly going through this whole physical memory dump complete thing. I turned it off just like normal this afternoon. Then tonight when I turned it on, it got to my desktop, seemed normal for less than 1 min, then went to the blue screen that includes the following technical Information:
STOP: 0x0000008E (0xc0000005, 0x85EE90BD, 0xECF62B4C, 0x00000000)
Beginning dump of physical memory
Physical Memory dump complete
Contact your system administrator or technical support group for further assistance.
Then it would reboot, do the same thing, over and over again.

So I googled on my husband's computer and learned about the minidump folder thing. Then I went and started my computer in safe mode and found the folder, but I couldn't read the minidump files. So I googled some more and learned about downloading the debugging tools which I did (on my hubby's computer). I transferred the debugging file to my safe mode computer tried to install and it wouldn't let me. SO silly me, I copied the dump files onto my hubby's computer, hoping to read them there. Then I realized that the debugging tools need more than just the dump file to actually read it, and it would require image path, symbols stuff. Well, now I am totally lost. What do I do?

At first, my hubby thought it was probably because he plugged in the webcam thing before my laptop finished starting...some post did say it would cause the BSOD problem, well, we unplugged our webcam and it still wouldn't work.
I read this link http://forums.techguy.org/windows-nt...debugging.html but couldn't really follow... The following link suggested a similar video cam plug issue but I am not good enough to follow what he did to fix...
http://www.eggheadcafe.com/software/...se-a-stop.aspx

I am now totally stuck!!!! Please help me! What do I do now?

 

[Bob I]

See
http://msdn.microsoft.com/en-gb/library/ms794023.aspx

 

[Nan]

I actually read that link before, but I still can't figure out what to do
next. Any more specific details I can follow? Thanks for your help.

 

[Bob I]

Try booting to Last known good.(pressing F8 following POST)

0xC0000005: STATUS_ACCESS_VIOLATION indicates that a memory access
violation occurred.

 

[Gerry]

Nan

Does the problem occur during the boot process or after? Does it occur
in Safe Mode?

STOP: 0x0000008E (0xc0000005, 0x85EE90BD, 0xECF62B4C, 0x00000000)
What appears on the line below what is above?

0x0000008E: KERNEL_MODE_EXCEPTION_NOT_HANDLED
A kernel mode program generated an exception which the error handler
didn't catch. These are nearly always hardware compatibility issues
(which sometimes means a driver issue or a need for a BIOS upgrade).
Source: http://aumha.org/a/stop.htm

Are there any yellow question marks in Device Manager? Right click on
the My Computer icon on your Desktop and select Properties,
Hardware,Device Manager. If yes what is the Device Error code?

Try Start, Run, type "sigverif.exe" without quotes and hit OK. What
drivers are listed as unsigned? Disregard those which are not
checkedAmarjeet wrote:

"we unplugged our webcam and it still wouldn't work" What software, if
any, did you install?

Please post complete copies of the Error Reports from Event Viewer.

You can access Event Viewer by selecting Start, Control Panel,
Administrative Tools, and Event Viewer. When researching the meaning
of the error, information regarding Event ID, Source and Description
are important.

A tip for posting copies of Error Reports! Run Event Viewer and double
click on the error you want to copy. In the window, which appears is a
button resembling two pages. Click the button and close Event
Viewer.Now start your message (email) and do a paste into the body of
the message. Make sure this is the first paste after exiting from
Event Viewer.

--



Hope this helps.

Gerry
~~~~
FCA
Stourport, England
Enquire, plan and execute
~~~~~~~~~~~~~~~~~~~

 

[Don Phillipson]

Try booting to Last known good.(pressing F8 following POST)

Alternatively if System Restore was enabled (a good idea)
Nan could try that via / Control Panel / Admin Tools / Services.
The System Restore wizard presents a calendar with all
Restore Points (dates) highlighted, and the user can go
back to a date before the trouble began. (Some Sys Res
Points may not work, but most usually do.)

 

[Nan]

Hi, Bob.

I tried booting to last know good. And it still did the BSOD cycle thing
after booting.

 

[Nan]

Hi, Don.

I should have set some restore points in the past. It's a good idea but I
never did.
:-(

Well, right now, I can only access in safe mode. When I click on services,
it said access is denied. (only showing a shortcut sign)

 

[Nan]

Hi,Gerry.
The problem occurs after the booting. It will get to the desktop for a min
or two then goes to the blue screen, then reboots. A constant cycle. I can go
into the safe mode and the problem won't occur. The last know good
configuration setting would still have the problem.

The line above the technical info said: Check to be sure you have adequate
disk space. if a driver is identified in the stop message, disable the driver
or check with the manufacturer for driver update. Try changing video
adapters.
Check with your hardware vendor for any BIOS update. DisableBIOS memory
options such as caching or shadowing. If you need to use safe mode to remove
or disable components, restart your computer, press f8 to select advanced
startup options, and then select safe mode.

I checked the device manager, no yellow question marks. I tried
sigverif.exe, it said everything was digitally signed.
Our webcam is a CREATIVE brand. We had it installed a couple of years ago
and never had a problem with it.
As for error reports, I can't access it at this moment....
Well, yesterday I took it to a computer shop and they refused to fix it.
Their only option for me is to reinstall the whole system! Ah, I didnt' allow
that to happen. I took my computer to work anyways, after a few cycles, it
miracally worked normally! The problem is, this morning, when I turned it on,
it happened again. Then I got lucky and it was normal and I was able to work
for a few hours. Right now I am back home, and my laptop is completely
failing me. I have done tons of cycles and it wouldn't work for me. I did
notice that when the two times it actually worked, the startup program list
showed this Chinese download software was loaded, then it was safe. All these
times it went in cycles, that program didn't run, neither did Norton...So,
here I am, stuck!! Help! Help! I also noticed that other than the C0000005
error code, the following error codes/numbers seem to have changed...

 

[Nan]

I rebooted my computer again, that chinese software did start, so did Norton,
but it still went to the blue screen....SOOOOOOOO frustrating!

 

[Gerry]

Nan

What Chinese software? Name? Is it something you installed?

Have you tried running Norton in safe mode? What version of Norton is
installed?

What is your computer make and model?

What do you have by way of a Windows XP? How is it described on the face
of the CD?

What happens when you try to access Event Viewer eror reports?

Can you identify your webcam in this link? Model?


--



Hope this helps.

Gerry
~~~~
FCA
Stourport, England
Enquire, plan and execute
~~~~~~~~~~~~~~~~~~~

 

[Nan]

Hi, Gerry. I bought my Compaq laptop from Bestbuy and it came with XP Home
edition, only C Drive. It was never partitioned.
The Chinese software was a software for downloading but it might not matter.
When I tried to start Norton, it said it couldn't run in safe mode. It was
Norton 360.
I couldn't access Event Viewer error either under safe mode
My webcam is CE (Creative Labs, Inc), Model No PD1170.
Thanks for your help.

 

[Nan]

I tried repair installation which took a LONG time, and afterwards, it went
straight into the blue screen. Instead of dumping complete, now it says
dumping physical memory to disk: then a number that keeps going up???

 

[Gerry]

Nan

Disable automatic restart on system failure. This should help by
allowing time to write down the STOP code properly. Keep pressing the F8
key during Start-Up and select option - Disable automatic restart on
system failure. Do not re-enable automatic restart on system failure.
Check for variants of the Stop Error message.

What is the Compaq model number? Is it still in warranty?

Can you identify the Chinese software in Add / Remove Programs -Start,
Control Panel, Add / Remove Programs?

Does the Compaq have a floppy or CD drive?

What is the computer you are posting from? Desktop or Laptop? Does it
have a floppy or CD drive?

Have you backed any important data files on the Compaq laptop?

--



Hope this helps.

Gerry
~~~~
FCA
Stourport, England
Enquire, plan and execute
~~~~~~~~~~~~~~~~~~~

 

[Nan]

Hi, Gerry.
I have good news. With the help from techguy.org, I found webthunder.exe on
my computer. I went to msconfig and unchecked that. Now my computer seems to
be working fine. Claymore from that site analyzed my minidump files and said
the faulting application is ntoskrnl, a basic system process required for the
computer to run.
I did identify a few softwares I downloaded which took up a lot of my space.
SO I uninstalled a few things and did a complete virus scan, which got rid of
3 risks, one including backdoor.bot. So far the computer seems to be normal!
Thank god!
Thank you so much for your help!

 

[Gerry]

Nan

I located your exchanges with Claymore. Have you sent him the HijackThis
log as he suggested. Also at some point you need to turn System Restore
off, reboot and turn it back on to remove infected restore points.

Researching Webthunder suggest it is not something you want on your
computer. Disabling it may have enabled you to regain access to your
computer but you need to remove it and complete the clean up process.
See what Claymore has to say. This is important.

This seems to have been the original status of Web Thunder
http://vil.nai.com/vil/content/v_142372.htm

However, more recently this has been posted:
http://www.prevx.com/filenames/1625396152047293054-0/WEBTHUNDER2EEXE.html

There are many conflicting reports on Web Thunder. Given the your
experience I would say it is best removed.


--



Hope this helps.

Gerry
~~~~
FCA
Stourport, England
Enquire, plan and execute
~~~~~~~~~~~~~~~~~~~

 

[Nan]

Hi, Gerry. Yes, I just uploaded the hijackthis log. I think I removed the
webthunder thing, but then when I was trying to figure out why my system
restore choice is completely turned off, greyed out(by group policy?), I am
certain I still saw it registered in the registry! Does that mean it is not
completely removed?

I googled a whole bunch on my system restore greyed out thing but couldn't
find a solution! Any suggestions? Maybe I have to restart a thread or
something.

Thanks for all your help.
Nancy

 

[Gerry]

Nan

"by group policy?" Do you know that or is it you guessing?

Malware will target System Restore. You could try reinstalling System
Restore once your system is clean:
http://bertk.mvps.org/html/reinstall.html

If webthunder is a start up item it can be removed using Autoruns
(freeware). However I would see what results from the posting of your
HijackThis report to the other forum.
http://www.microsoft.com/technet/sysinternals/ProcessesAndThreads/Autoruns.mspx

With Autoruns you can uncheck an item, which disables it from starting,
or you can can right click an item and then delete it. If you uncheck
you can recheck to re-enable the item. It is a much safer approach than
editing the Registry. Another useful feature of the programme is that
you can right click an item and select Search Online to get information
about the item selected.

--



Hope this helps.

Gerry
~~~~
FCA
Stourport, England
Enquire, plan and execute
~~~~~~~~~~~~~~~~~~~

 

[Nan]

Hi, Gerry.
The group policy thing is shown in brackets. Anyway, I will wait on the HJT
log analysis result then figure out the System Restore thing

Thanks again for all your help.

Nancy