[MetalJordan]

Hey there, so I wasn't thinking and messed up "bad"

I downloaded a trail version of "Photoshop Elements 6.0" I also downloaded a program that said it would unlock the trail. I knew better, but DL'd anyway. I opened it and now I'm royally screwed.

I went into safe mode and did a virus scan. It detected 3 viruses and quar' them. I tried to do a Sys' Restore however the only date/time it has is the date/time when the problems started.

When I try to reboot, it will hault with a blue screen with the message of:

'?'P: c000021a {Fatal Sys Error}
'?' x00000000 (0x00000000 0x00000000)

NOTE- '?' I have no idea what the font/letter is there, its off my compuer screen

Other errors are:

RTDCPL.exe - illegal sys DLL relocation
C:\windows\system32\hhctrl.ocx
- Occupied an address range reserved for windows systems DLLs. The vendow supplying the DLL should be contacted for a new DLL -

etc etc etc

From my understanding, 0x00000000 is very cryptic... is there any hope for my computer? On that note, my computer is running on Windows XP

[artimus]

Did you try last known config on the boot options window? You may want to look at this site if that doesn't work... http://www.bleepingcomputer.com/foru...hp/t87332.html It will give you some ideas..

[MetalJordan]

Yeah, I tried everything.

System Restore = The only time/date that came up was the time/date when the problems started (normally there are a few restore points)

When I shut down or reboot, thats when the blue screen pops up with:

c000021a {fatal system error}
0x00000000 (0x00000000 0x00000000)

[Rollin' Rog]

Make sure you have the latest updates, including this one:

https://www.microsoft.com/downloads/...displaylang=en

http://support.microsoft.com/kb/935448

Since your specfic dll occured in a sound driver -- you may need to update that as well.

This particular error is an old one, and suggests you are quite behind on your updates -- or somehow restored to a date before this was patched.

Since you can boot in Safe Mode, I can look at the minidumps:

I can run a debugging utility on the dump files if you do this:

1 > create a new folder on the desktop and call it "dumpcheck" or whatever you like
2 > navigate to c:\windows\minidump and copy the last few minidump files to that folder. *this assumes 'c' is your boot drive, if it is not, subsitute accordingly
3 > close the folder and right click on it and select Send to Compressed (zipped) Folder.
4 > use the "manage attachments" in the "advanced" reply window to upload that zip file here as an attachment.

This might point us to a 3rd party driver causing the error, if one exists for it.


Also, post a HijackThis scanlog, THEN try doing some "clean boot" troubleshooting >>

Download and install HijackThis. Run it and select "do a system scan and save the log file". Then copy/paste the contents of the log to a reply

http://www.trendsecure.com/portal/en...ols/hijackthis



CLEAN BOOT TROUBLESHOOTING technique

First, restart in Safe Mode if necessary -- (tap the f8 key promptly on startup and choose the Safe Mode option from the boot menu) or Normal mode

Then:

Run msconfig and select the "Services" tab. Check "Hide Microsoft Services" and then disable the rest. Also uncheck "load startup group" on the general page.


http://support.microsoft.com/kb/929135 << written for Vista, but applies equally well to XP

Now restart and test the issue at hand

If no problems, run msconfig and recheck half the disabled items on the Services tab. Test again. If the problem recurs, UNcheck half the items you just checked to narrow down the culprit.

If the problem didn't occur, check the other half, so all the Services are enabled -- proceed to do this on the startup tab as well.

Get the idea? You want to isolate the problem to a specific startup if possible.

Note: if you already have items unchecked under msconfig > startups and are in “selective” startup mode – you should note what these are before beginning. They will need to be de-selected again.

[MetalJordan]

Awesome, I'll do all that once I get outta work. I'll message again with the out come.

[MetalJordan]

Sorry it took me a while to get back to this. (With the holidays, I've been running round a lot) Anyway, here is the dumpfiles.

I tried to download the updates from the links you have sent me. But it wouldnt go through. I'm at work now and I'm going to try and download those files unto a disc and pop it in the comp' at home.


Thanks for being patient!!!

[Rollin' Rog]

You are still infected.

These are just the last two miniudumps:

BugCheck 1000008E, {c0000005, af120b75, a00527ec, 0}


BUGCHECK_STR: 0x8E

PROCESS_NAME: 527.exe >> http://www.prevx.com/filenames/11270.../5272EEXE.html


========================================

Use !analyze -v to get detailed debugging information.

BugCheck 100000CE, {b1d661b4, 8, b1d661b4, 0}

Probably caused by : Beep.SYS ( Beep+21b4 ) >> http://www.threatexpert.com/files/beep.sys.html



If you cannot clean the system yourself, and you cannot do a clean install (which I would recommend), you should post for help in the Security >> Malware forum and include a HijackThis scanlog.