[JeffMellinge]

So should I physically pull out the ram from my computer? or is there anyway to disable it otherwise? how should I go about doing this test?

[Rollin' Rog]

Assuming you have more than one module, shutdown, open the case, remove the plug, ground your hands momentarily against the case -- then remove one module closest to the CPU -- and move the other module into that position. Replace the plug. Restart. If you still get an error, substitute the module you removed and try again.

Make sure the modules are fully seated. They are keyed so only a bozo like me can manage to insert them backwards (which I've done). The levers should snap into place fairly easily once the module is properly seated.

[JeffMellinge]

Haven't had a chance to check the ram, but I downloaded the rootkit revealer and unzipped it using winzip. However, I double click on rootkitrevealer.exe and it doesn't open. But if I look in task manager, it is listed as one of the processes running. what's going on?

[Rollin' Rog]

I don't know. Are you sure it is fully unzipped in its own folder -- not in a zip container? Try deleting the folder it unzipped to, then unzip it again. If it still fails, try again in Safe Mode.

[JeffMellinge]

Okay, I've downloaded the MemTest and the windiag tools. I can even burn disks in safemode. But what I cannot do is make a backup onto the floppy so that I can use it to create the boot disc thus allowing the diagnostic tools to run when the computer boots. The reason for this is my floppy is not appearing in My Computer. Device Manager says it's working properly. I can put a floppy in and eject it but I cannot get the A:\ drive to show up anywhere. I've tried the hardware troubleshooter to no avail. I've even uninstalled the floppy in device manager and rebooted. It shows up again but there is still no A:\ drive listed in My Computer. do I just need to get a new one?
jeff
p.s. I posted onto the rootkitrevealer site and this is the response: Reports indicate that RKR does not work successfully under safe mode.
i don't understand why programs like that aren't made to work in safemode as a lot of the people needing to use them are stuck in safemode.

[Rollin' Rog]

Keep in mind the floppy doesn't have to be made on the problem computer. It should work no matter what system you create it on.

The same applies if you create a bootable CD from one of the .iso files. For instructions on that it is best to consult your burning software on how to make a CD bootable. You may need to reset the bootorder in the BIOS to have the CD-ROM first if you go that route.

Also, in your first post you say " I have reduced the amount of virtual memory"

Why did you do that? It would be better to increase it (typically it is set at about 1 1/2 installed ram) since Windows will not try to use as much real memory if you do.

[JeffMellinge]

I used roxio cd creator to make the boot disc. I had to do it on a friend's XP computer. I followed the directions and made an emergency boot file onto a floppy first. Then I created the boot disc on cd with roxio. Onto the boot cd, Roxio put the info from the floppy as well as the ISO I created from my computer with the windiag tool.
I put it in my cd drive and booted my computer. It said Invalid System Disk, please replace and retry. Now, is this because I created the emergency boot file from XP and I'm using 2000? I thought you had said it didn't matter what system I created the boot file from.
I think I real close to finding out the problem but these little snags are very irritating.

[Rollin' Rog]

I've forgotten the exact procedure I used to create mine. Looking at the CD it contains an I386 folder with windiag.iso within it. I'll see if i can make another one with Roxio to confirm the procedure.

There is no difference between 2K and XP on this. If you get an invalid system disk using it on your 2K system, you would probably get the same testing it on your friends XP as well.

The "memtest86" checker I have is on floppy and my notes show it works both on XP and on 98. I'm sure I just followed the straight ahead instructions on their page.

Windiag I have on CD and that too will boot both on XP and Win98 as long as the CD is first in the boot order.

edit ok, I had to go back to the basics here to see what I did with Roxio -- and it was simpler than I remembered. Since Roxio already associates itself with .iso files all I did was click on windiag.iso and Roxio came up with its burn procedure. I just selected Record and that was it.

[JeffMellinge]

Ok,
I tried reseating the RAM. I have 2x256 RAM chips. I took one out and reseated the other. Still KMODE. Took that one out and put the other one in a new spot. Still KMODE.
don't know where to go now since all the other stuff you've asked me to try hasn't worked because I'm in safemode or some other reason....

[Rollin' Rog]

Just to review, what current hardware is loading other than the video card and the hard drive?

I don't recall whether the msconfig "diagnostic" option loads normal video drivers.

Try using msconfig to uncheck the startup group, win.ini, and system.ini.

On the SERVICES tab select HIDE all Microsoft services, and then select disable all.

On the Boot.ini tab, put a check in /BaseVideo (this will be a VGA option for the video drivers).

[JeffMellinge]

In the services tab of the MSconfig, this is what is there(non-microsoft): CT by sysinternals
Logical Disk Manager admin services by Veritas Software
G by sysinternals
IQNNWZID by sysinternals
LLLDU by sysinternals
Trend NT realtime service by unknown
Trend Micro Proxy Service by Trend Micro
UOMLT by sysinternals
XJQPNZIXIVBKX by sysinternals
They are all "stopped"
what is all this junk?
I will try what you said and see what happens

[JeffMellinge]

ok, I did everything you said with MSconfig and it came up with the Page fault in non-paged area blue screen
jeff

[Rollin' Rog]

The Trend entries are obviously your antivirus.

Sysinternals is the site from which you downloaded the rootkitrevealer. I don't know why that would install services -- and certainly not the weird names you have there. They should all be set to disabled.

The "Page Fault" error continues to point to either a rootkit infection or a ram issue.

You mentioned posting something on a rootkitrevealer forum. I would go back there and see if you can get any feedback on those entries. Perhaps they are the result of the program being intercepted by the rootkit itself. If I were the author of the program I would be interested if that were the case.

If possible, can you try using only a stick of compatible ram from another system?

[JeffMellinge]

Ok,
I bought this System Mechanic Professional 6 awhile ago and I installed it. The only things I did was to use the System Shield to "clean" the drives. It didn't appear to find anything. However, when trying to access the actual System Mechanic Professional program, it told me I had to restart (even though I already had). So I did. A new BSoD came up:
Stop 0x000000C4 (0x00000000, 0x00000001, 0x00000000, 0x00000001)
A Device Driver attempting to corrupt the system has been caught. The faulty driver currently on the kernel stack must be replaced with a working version.
I checked the Event Viewer and this is the only thing there that looks different than the usual stuff:


Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7026
Date: 10/27/2005
Time: 5:58:13 PM
User: N/A
Computer: FPST-COMPUTER
Description:
The following boot-start or system-start driver(s) failed to load:
tmtdi

[Rollin' Rog]

Interesting, that's a Trend PC-Cillin driver. It must be corrupt.

Driver Verifier must still be running and have caught that -- the C4 error is associated only with it.

0x000000C4: DRIVER_VERIFIER_DETECTED_VIOLATION

This Blue Screen should also have identified the driver.

http://support.microsoft.com/?kbid=298690&sd=RMVP

Uninstall PC-Cillin and see what happens.