Blue Screen: NMI

Discussion in 'Malware Help (A Specialist Will Reply)' started by upod, Sep 9, 2008.

  1. upod

    upod Private E-2

    I had been recently having trouble with some NMI error that would hit me right before windows booted, and sometimes right after. I hadn't had any new hardware so my guess was that it was probably a bad driver, I had a new motherboard put in recently and it may have had some compatibility issues. Anyways I come to find out there were a couple of trojan droppers (dropper.bravix.b) hiding in my Dell Support data folders. I had them quarantined and it seemed as if the errors were gone (I rebooted without problems about 3 times). I then cleared my quarantine folder and rebooted again... the error showed up. I believe that the virus may have replicated unpon being exterminated. Something else that leads me to believing that it is malware is that my system restore dosn't work. After running a restore it boots up windows and informs me that it couldn't restore to the point.

    I went through the READ & RUN ME FIRST guide and got all the logs and such. I then proceded to reboot after completing the guide to see if it had fixed my problem, it didn't. I got the blue screen "***Hardware Malfunction*** NMI: Memory Parity error..." and then restarted the computer to boot with last good settings liek I usually do. This time though, my desktop would not show up. I could bring up taskmanager and such but windows explorer is not active.

    Help please?
     
  2. upod

    upod Private E-2

    By the way, I have my logs, but I need to be able to get to them.
     
  3. upod

    upod Private E-2

    I forgot again, sorry.

    I have a Dell XPS 400 with Windows XP Media Edition with SP3.
     
  4. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Welcome to Major Geeks!

    It sounds like the worst of your problems are hardware issues not malware. You really need to resolve your hardware issues. Sounds like you may even have bad RAM or RAM that cannot support the motherboard you just recently installed. See the below:

    http://support.microsoft.com/kb/222973


    If you boot in safe mode, does your Desktop appear?

    See if you can run iexplore.exe which is Internet Explorer. If so, attach your logs; however, your main issues with this PC are hardware related.
     
  5. upod

    upod Private E-2

    Thanks for the help! Your right, it could be a RAM issue, but the two things that make me think otherwise is my inability to successfully run a system restore and whenever I boot windows with "Last known good settings" it works fine. Anyways, I went into Safe Mode and the desktop wasn't there. I went ahead and ran explorer from the run console and it popped up. I booted normally (while encountering the NMI blue screen again, so I actually booted 2 times) and then started explorer the same way and all was well. It seems that something may have taken windows explorer off the startup list.

    Anyways, here are my logs, thanks for your help.

    There is of course the possibility of it being a faulty driver that I can't find, or a virus hiding in my driver folders. By the way, my computer dosen't leave minidumps like it should whee the blue screen occurs during operation.
     

    Attached Files:

  6. upod

    upod Private E-2

    And the MGTools logs.
     

    Attached Files:

  7. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Yes but that does not mean it is malware. And based on your logs, it is not malware. Only minor items were removed. The only remaining questionable files are the below which you can either have scanned at http://www.virustotal.com/ or you can just renamed them to see if anything misses them
    Code:
     
    2008-08-09 23:11 . 2008-04-14 05:41 1,689,088 C:\WINDOWS\system32\707ef78.dll
    2008-08-09 23:11 . 2008-04-14 05:41 1,689,088 C:\WINDOWS\system32\19acea58.dll
    2008-08-09 23:11 . 2008-04-14 05:42 82,432 C:\WINDOWS\system32\2c989149.dll
    2008-08-09 23:11 . 2008-04-14 05:42 82,432 C:\WINDOWS\system32\13f1bb74.dll
    You may have done something to disable the dumps.

    I see you have WinXP SP3 perhaps you had some issues during the update.

    Either way I suggest that you post in the Software Forum ( or Hardware Forum for your RAM issues ) as you are not having malware problems.

    Now we need to cleanup some items from running ComboFix.

    Copy the bold text below to notepad. Save it as fixme.reg to your desktop. Be sure the "Save as" type is set to "all files" Once you have saved it double click it and allow it to merge with the registry.
    Make sure that you tell me if you receive a success message about adding the above
    to the registry. If you do not get a success message, it definitely did not work.


    If you are not having any other malware problems, it is time to do our final steps:
    1. We recommed you keep SUPERAntiSpyware and Malwarebytes Anti-Malware for scanning/removal of malware. Unless you purchase them, they provide no protection. They do not use any significan amount of resources ( except a little disk space ) until you run a scan.
    2. If we had you use ComboFix, uninstall ComboFix (This uninstall will only work as written if you installed ComboFix on your Desktop like we requested.)
      • Click START then RUN and enter the below into the run box and then click OK. Note the quotes are required
      • "%userprofile%\Desktop\combofix" /u
        • Notes: The space between the combofix" and the /u, it must be there.
        • This will uninstall ComboFix and also reset hidden files and folders settings back to Windows defaults.
      • Delete the C:\combofix folder from combofix.
    3. If we had you download any registry patches like fixme.reg or fixWLK.reg (or any others), you can delete these files now.
    4. If running Vista, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.
    5. Go to add/remove programs and uninstall HijackThis.
    6. You can delete the C:\MGtools folder and the C:\MGtools.exe file. You can also delete the C:\MGlogs.zip
    7. If you are running Vista, Windows XP or Windows ME, do the below:
      • Refer to the cleaning steps in the READ ME for your Window version and see the steps to Disable System Restore which will flush your Restore Points.
      • Then reboot and Enable System Restore to create a new clean Restore Point.
    8. After doing the above, you should work thru the below link:
     
    Last edited: Sep 12, 2008
  8. upod

    upod Private E-2

    The regfix worked and all is well. I couldn't find HijackThis in the uninstall menu but I deleted MGTools. I'll bring this issue up in the Hardware section later. Thanks for your help!
     
  9. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    You're welcome.

    I saw it in your uninstall programs list. It showed as HijackThis 2.0.2
     
  10. upod

    upod Private E-2

    Either way I fixed the error. It turned out to be a faulty driver for my webcam. Thanks for your help!
     
  11. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    You're welcome. Surf safely!
     

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds