[assaad33]

Hi all,
I am getting an error randomly which causes my XP to restart. The error log is this:

BCCode : 10000050 BCP1 : E5631000 BCP2 : 00000000 BCP3 : 8052A18F
BCP4 : 00000001 OSVer : 5_1_2600 SP : 2_0 Product : 256_1

C:\DOCUME~1\Assaad\LOCALS~1\Temp\WER64ad.dir00\Mini020709-01.dmp
C:\DOCUME~1\Assaad\LOCALS~1\Temp\WER64ad.dir00\sysdata.xml

[shivlal]

Hi
I am also getting same problem and my pc is also crashing frequently.
Its happening since long time but today it happened too often, Can anyone pls help me in this matter

Regards
Shivlal

[Frank4d]

assaad33, look in your C:\Windows\Minidump folder for minixxxxxx-xx.dmp files which are vour crash dump logs. Zip 4 or 5 most recent ones ane post here as a ZIP or RAR attachment. We can run a debug utility to try and find the cause of your errors.

shivlal, you can do the same thing, but start your own thread.

[Jason08]

I didn't even see an option in the poll for 'yes'?!?

[assaad33]

Ok, I have submitted some of these files

[Frank4d]

Your log on 01/30/09 shows a "4E" error caused by memory corruption. All of your errors from 01/31/09 to today are "50" errors caused by ntkrnlpa.exe.

You have two malware files "WINFL32.SYS" and "WINVD32.SYS" that were added to your computer on 01/31/09 (they were not there a day before).

I think malware is the cause of your recent blue screens. We need a malware removal expert to help you further.

I am attaching your debugged logs below.

[dvk01]

Download ComboFix from Here to your Desktop.

**Note: It is important that it is saved directly to your desktop and run from the desktop and not any other folder on your computer**
--------------------------------------------------------------------
1. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

• Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results"
• Click on this link to see instructions on how to temporarily disable many security programs while running combofix. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.
• Remember to re enable the protection again after combofix has finished

--------------------------------------------------------------------
2. Close any open browsers and any other programs you might have running

Double click on combofix.exe & follow the prompts.

If you are using windows XP It might display a pop up saying that "Recovery console is not installed, do you want to install?"
Please select yes & let it download the files it needs to do this
When finished, it will produce a report for you.
Please post the "C:\ComboFix.txt" along with a new HijackThis log for further review


****Note: Do not mouseclick combofix's window while it's running. That may cause it to stall or freeze ****

Note: ComboFix may reset a number of Internet Explorer's settings, including making it the default browser.
Note: Combofix prevents autorun of ALL CDs, floppies and USB devices to assist with malware removal & increase security. If this is an issue or makes it difficult for you -- please tell us when you reply. Read HERE why we disable autoruns

Please do not install any new programs or update anything unless told to do so while we are fixing your problem.

[assaad33]

Thanks guys very much, I really appreciate your helps. I am trying to scan my PC with "malwarebytes Anti-Malware" I will tell you what happens when the scan ends

[assaad33]

I scanned my PC with malware antibytes and I did try the other solution "Combo fix" both didn't work I'm still getting the error Here are some new dump files

[dvk01]

what do you mean didn't work

what happened when you tried to run combofix

[assaad33]

The combo fix finishes running.
And after a while I got the same error massage...

[dvk01]

did combofix make a log

post teh log so we can see what it found

it fixes somethings itself & some need to be scripted

[assaad33]

Ok, thanks anyway... Here the log

[dvk01]

looks a bit like a rustock rootkit infection

Download the attached CFScript.txt and save it to your desktop ( click on the link underneath this post & if you are using internet explorer when the "File download" pop up comes press SAVE and choose desktop in the list of selections in that window & press save)

Disable any antivirus/antimalware/firewall realtime protection or script blocking in the same way you did previously before running combofix & remember to re-enable it when it has finished

Close any open browsers
Then drag the CFScript.txt into the ComboFix.exe as shown in the screenshot below.







This will start ComboFix again. It may ask to reboot. Post the contents of Combofix.txt in your next reply together with a new HijackThis log.


Note: these instructions and script were created specifically for this user. If you are not this user, do NOT follow these instructions or use this script as it could damage the workings of your system and will not fix your problem. If you have a similar problem start your own topic in the malware fixing forum


then

download gmer rootkit detector from http://gmer.net

unzip it & double click the gmer.exe file

select rootkit tab & press scan

when it has finished press copy & post back the log it makes

[assaad33]

This is the new log file,
Thanks again for your help.