Solved: stop and blue screen problem

Status
This thread has been Locked and is not open to further replies. Please start a New Thread if you're having a similar issue. View our Welcome Guide to learn how to use this site.

jamgant

Thread Starter
Joined
Jun 29, 2006
Messages
23
hi, everytime i startup it prompts the blue screen with the this problem
stop 0x0000008e (0xc0000005 0xff759b6c 0xeceeba70 0x00000000)
I've cheked microsoft knowledege libraries where it says its a kernel exception but there is no info for my specific stop. this problem disapears in safe mode or when i'm running esential services only... anyone kwnos waht's the problem??
here's my log

thanks

Logfile of HijackThis v1.99.1
Scan saved at 03:23:20 p.m., on 12/07/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Archivos de programa\Filseclab\xfilter\xfilter.exe
C:\ARCHIV~1\BILLPS~1\WINPAT~1\winpatrol.exe
C:\Archivos de programa\Spybot - Search & Destroy\TeaTimer.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\svchost.exe
C:\Archivos de programa\Archivos comunes\Symantec Shared\ccSetMgr.exe
C:\Archivos de programa\Archivos comunes\Symantec Shared\ccEvtMgr.exe
C:\Archivos de programa\Archivos comunes\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Archivos de programa\Norton SystemWorks\Norton AntiVirus\navapsvc.exe
C:\Archivos de programa\Norton SystemWorks\Norton AntiVirus\SAVScan.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\WINDOWS\system32\locator.exe
C:\Archivos de programa\Norton SystemWorks\Norton AntiVirus\IWP\NPFMntor.exe
C:\Archivos de programa\Archivos comunes\Symantec Shared\ccApp.exe
C:\Archivos de programa\ewido anti-spyware 4.0\guard.exe
C:\WINDOWS\system32\ntvdm.exe
C:\Archivos de programa\SpywareBlaster\spywareblaster.exe
C:\Archivos de programa\Internet Explorer\iexplore.exe
C:\Archivos de programa\Internet Explorer\iexplore.exe
C:\Program Files\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://mx.yahoo.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Vínculos
O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
O4 - HKLM\..\Run: [XFILTER] "C:\Archivos de programa\Filseclab\xfilter\xfilter.exe" -a
O4 - HKLM\..\Run: [WinPatrol] C:\ARCHIV~1\BILLPS~1\WINPAT~1\winpatrol.exe
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\ARCHIV~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [hplampc] C:\WINDOWS\system32\hplampc.exe
O4 - HKLM\..\Run: [ccApp] "C:\Archivos de programa\Archivos comunes\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Archivos de programa\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: Acelerador de inicio de AutoCAD.lnk.disabled
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Archivos de programa\Archivos comunes\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Bluetooth Manager.lnk.disabled
O8 - Extra context menu item: E&xportar a Microsoft Excel - res://C:\ARCHIV~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Archivos de programa\Java\jre1.5.0_06\bin\npjpi150_06.dll
O9 - Extra 'Tools' menuitem: Consola de Sun Java - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Archivos de programa\Java\jre1.5.0_06\bin\npjpi150_06.dll
O9 - Extra button: Referencia - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\ARCHIV~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Investigador - {9455301C-CF6B-11D3-A266-00C04F689C50} - C:\Archivos de programa\Archivos comunes\Microsoft Shared\Encarta Researcher\EROPROJ.DLL
O9 - Extra button: (no name) - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Archivos de programa\Archivos comunes\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\WINDOWS\system32\shdocvw.dll
O10 - Unknown file in Winsock LSP: c:\archivos de programa\filseclab\xfilter\xfilter.dll
O10 - Unknown file in Winsock LSP: c:\archivos de programa\filseclab\xfilter\xfilter.dll
O10 - Unknown file in Winsock LSP: c:\archivos de programa\filseclab\xfilter\xfilter.dll
O10 - Unknown file in Winsock LSP: c:\archivos de programa\filseclab\xfilter\xfilter.dll
O10 - Unknown file in Winsock LSP: c:\archivos de programa\filseclab\xfilter\xfilter.dll
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {1F2F4C9E-6F09-47BC-970D-3C54734667FE} (LSSupCtl Class) - http://www.symantec.com/techsupp/asa/ctrl/LSSupCtl.cab
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab
O16 - DPF: {3451DEDE-631F-421C-8127-FD793AFC6CC8} (ActiveDataInfo Class) - http://www.symantec.com/techsupp/asa/ctrl/SymAData.cab
O16 - DPF: {44990200-3C9D-426D-81DF-AAB636FA4345} (Symantec SmartIssue) - http://www.symantec.com/techsupp/asa/ctrl/tgctlsi.cab
O16 - DPF: {44990301-3C9D-426D-81DF-AAB636FA4345} (Symantec Script Runner Class) - http://www.symantec.com/techsupp/asa/ctrl/tgctlsr.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1151963159593
O16 - DPF: {8731163E-77B9-4F91-9122-F112521C28AF} (MMSPlayerX Class) - http://mmbox.itelcel.com/mmawap/jsp/composer/player/mmsPlayer.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O16 - DPF: {EB387D2F-E27B-4D36-979E-847D1036C65D} (QDiagHUpdateObj Class) - http://h30043.www3.hp.com/sj/en/check/qdiagh.cab?326
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Archivos de programa\Archivos comunes\Microsoft Shared\Help\hxds.dll
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\ARCHIV~1\MSNMES~1\msgrapp.dll" (file missing)
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Archivos de programa\Archivos comunes\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Archivos de programa\Archivos comunes\Symantec Shared\ccSetMgr.exe
O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Archivos de programa\ewido anti-spyware 4.0\guard.exe
O23 - Service: Servicio Auto-Protect de Norton AntiVirus (navapsvc) - Symantec Corporation - C:\Archivos de programa\Norton SystemWorks\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Archivos de programa\Norton SystemWorks\Norton AntiVirus\IWP\NPFMntor.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Archivos de programa\Norton SystemWorks\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\ARCHIV~1\ARCHIV~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Archivos de programa\Archivos comunes\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Archivos de programa\Archivos comunes\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Archivos de programa\Archivos comunes\Symantec Shared\CCPD-LC\symlcsvc.exe
 
Joined
Dec 9, 2000
Messages
45,855
Does the Blue Screen include a driver file?


I can run a debugging utility on the dump files if you do this:

1 > create a new folder on the desktop and call it "dumpcheck" or whatever you like
2 > navigate to c:\windows\minidump and copy the last 2 or 3 minidump files to that folder. They are numbered by date.
3 > close the folder and right click on it and select "Send to (folder name).zip"
4 > use the "manage attachments" in the "advanced" reply window to upload that zip file here as an attachment.

This might point us to a 3rd party driver causing the error, if one exists for it.


You can also try to isolate the problem by using "Clean Boot" troubleshooting:

First, restart in Safe Mode (tap the f8 key promptly on startup and choose the Safe Mode option from the boot menu).

In Safe Mode –

Run msconfig and select the "Services" tab. Check "Hide Microsoft Services" and then disable the rest. Also uncheck "load startup group" on the general page.

See this link for detailed information:

http://support.microsoft.com/default.aspx?scid=kb;EN-US;310353

Now restart and test the issue at hand

If no problems, run msconfig and recheck half the disabled items on the Services tab. Test again. If the problem recurs, UNcheck half the items you just checked to narrow down the culprit.

If the problem didn't occur, check the other half, so all the Services are enabled -- proceed to do this on the startup tab as well.

Get the idea? You want to isolate the problem to a specific startup if possible.

Note: if you already have items unchecked under msconfig > startups and are in “selective” startup mode – you should note what these are before beginning. They will need to be de-selected again.
 
Joined
Dec 9, 2000
Messages
45,855
Two of the 3 bugchecks cannot identify a faulting module. One refers to Rdbss.sys, but I'm not sure what or how that is being used here (http://msdn.microsoft.com/library/d..._50ef26e9-8772-426d-8720-7ac69d7a0dd5.xml.asp)

I suspect a corrupt Symantec module may be involved -- so since this problem does not occur when you boot in diagnostic mode -- you should follow the "clean boot" procedure to see if you can isolate the startup to a particular application or vendor.
 

Attachments

jamgant

Thread Starter
Joined
Jun 29, 2006
Messages
23
welll i've done several startups and i think it is the windows updater service... what can i do to correct this? is some registry problem?
here is the lastest dump.. thanks man
 

Attachments

Joined
Dec 9, 2000
Messages
45,855
What "Windows updater service" are you referring to? Is this something that was disabled in your msconfig scanlog? If so, it's malware.

If you want to upload new minidumps you must do it in .zip format, not .rar.
 
Joined
Dec 9, 2000
Messages
45,855
Are you sure about wauserv? If you followed the directions I gave, that would not have been on your list of services to disable -- since it is a Microsoft service and you should have had those services "hidden" before proceeding?

The last bugcheck was in snpstd2.sys which appears to be a USB video camera driver.

Do you have a USB camera device attached to the system?

Given the variety of stop errors, perhaps you should be testing the ram:

Beginners Guides: Diagnosing Bad Memory

Windows Memory Diagnostic
Memtest86 - A Stand-alone Memory Diagnostic
 
Joined
Dec 9, 2000
Messages
45,855
Well, let's try replacing wuauserv.dll in the system32 folder with a servicepack backup.

Go to Start > run and enter cmd

At the prompt type and enter:

copy c:\windows\servicepackfiles\I386\wuauserv.dll c:\windows\system32

You should get a prompt that the file exists, do you want to overwrite it -- you can accept that.

Also run eventvwr.msc and look at the System log for any errors associated with these blue screens or the Windows Update Agent.

By the way, if the problem is not too old -- you could try using System Restore to return to a date prior to it beginning? Have you tried that?
 

jamgant

Thread Starter
Joined
Jun 29, 2006
Messages
23
done it but no success and there's nothing related on the logs, mmm when i try to reinstall service pack2 it prompts the same error 8e with different arguments. i've also noticed that when i scroll a page down it's done in kind of slow motion,, and the norton antivirus auto-liveupdate does not activate.. any ideas? im out of..
 
Joined
Dec 9, 2000
Messages
45,855
The slow scrolling would be indicative of a Display driver or settings problem. You may need to reinstall or update your display drivers. Also if you open the Display adapter's settings panel you should see a "troubleshoot" tab on it. This will have a slider for adjusting the hardware acceleration -- if it is not at "full" -- that would result in slow scrolling.

With respect to LiveUpdate, are you getting a specific error message? If so you can research it on the Symantec Knowledge base:

http://www.symantec.com/search/

Example: http://service1.symantec.com/SUPPOR...88256e310005abd9?OpenDocument&src=bar_sch_nam

If you are getting new STOP errors, upload the new dump file as before.
 
Status
This thread has been Locked and is not open to further replies. Please start a New Thread if you're having a similar issue. View our Welcome Guide to learn how to use this site.

Users Who Are Viewing This Thread (Users: 0, Guests: 1)

As Seen On
As Seen On...

Welcome to Tech Support Guy!

Are you looking for the solution to your computer problem? Join our site today to ask your question. This site is completely free -- paid for by advertisers and donations.

If you're not already familiar with forums, watch our Welcome Guide to get started.

Join over 807,865 other people just like you!

Latest posts

Members online

Top