Stop: 0x0000008e BSOD

Hello all,

Was attempting to correct an issue on a friend's notebook. The issue was related to audio ads playing at random times when Internet Explorer was either open or closed. I ran AVG, Malwarebytes, Spybot S&D and even AdAware w/o finding anything. Did some reading and thought I'd give Kaspersky AV a try. Kaspersky almost immediately detected a 'rootkit' virus (unfortunately I didn't note the exact name etc.) during the scan. I let Kaspersky what it found. Since then I can only boot the machine in in Safe Mode..the BSOD referencing '0x0000008e' and then a few other '0x' codes in parenthesis occurs. The machine runs Windows Vista. I also have attempted to do a system restore w/o any luck. BSOD each reboot.

I ran as much of the Malware removal procedures I could complete from the tutorial and have attached the logs I could generate. The main problem was with RootRepeal as it would lock up on the 'Windows\winsxs\Manifests' folder. I tried to run it twice - the first time I received the message "Could not read our index block" and the second attempt just caused the entire machine to freeze (I let it run about an hour) and I had to do a hard reset. The other issue was with Combofix. Even though I have closed AdAware and see no references to it running in processes, Combofix states it is up and running - not sure if this would affect things but wanted to let you know. The other Combofix issue is the message "Access denied. Admin permissions are needed to use the selected option...." This appears between stages 38 and 39. The user I am running the program under is set up as an admin.

Thanks for any help you can give.

 

Hi and welcome to Major Geeks, MarkCee!

Whenever you first boot up (in Safe Mode with Networking), does a System Properties window pop up automatically? I am thinking your 0X8E error may be related to a pagefile issue as it looks like your system is currently running off a temporary (temp) pagefile (pf). Let me know.

Do you still have a Kaspersky product installed? I see Lavasoft Ad-Watch Live! Anti-Virus and AVG 2012 but not Kaspersky. We recommend that you only keep one anti-virus, and since you were supposed to uninstall AVG prior to running ComboFix, we will uninstall AVG.

http://img850.imageshack.us/img850/4746/programsandfeatureswin7.gif From Programs and Features (via Control Panel), please uninstall the below:

• AVG 2012 <--should have been done in the Read and run me first
• Java(TM) 6 Update 2 <--outdated

Now download and run the AVG Removal Tool

Now put your PC in Normal Startup with MSconfig >> Use MSconfig to setup for Normal Startup Mode

Once you have rebooted...

http://img685.imageshack.us/img685/3557/tdsskiller.gif Now we need to run TDSSKiller by Kaspersky
Follow the instructions here and attach your log when you are finished. (How to attach items to your post)


Please download MBRCheck by GeeksToGo to your desktop.
See the download links under this icon http://forums.majorgeeks.com/chaslang/images/MGDownloadLoc.gif

• Double click MBRCheck.exe to run (Vista and Win7 right click and select Run as Administrator)
• It will show a Black screen with some information that will contain either the below line if no problem is found:
  • Done! Press ENTER to exit...
• Or you will see more information like below if a problem is found:
  • Found non-standard or infected MBR.
  • Enter 'Y' and hit ENTER for more options, or 'N' to exit:
• Either way, just choose to exit the program at this point since we want to see only the scan results to begin with.
• MBRCheck will create a log named similar to MBRCheck_07.16.10_00.32.33.txt which is random based on date and time.
• Attach this log to your next message. (How to attach items to your post)

http://img38.imageshack.us/img38/7284/yse.gif Run C:\MGtools\analyse.exe by double-clicking it (Vista and Win7 right-click and select Run as Administrator)
Shut down your protection software now to avoid possible conflicts.
Note: This is actually Trend Micro HiJackThis - v2.0.4
Choose Do a system scan only and select the following lines but do not click fix until you exit all explorer windows and all browser sessions including the one you are reading in right now:

After clicking Fix, exit out of Trend Micro HiJackThis - v2.0.4

http://img839.imageshack.us/img839/3005/combofixicon.gif Now we need to make use of ComboFix by sUBs

• Make sure that ComboFix.exe that you downloaded while doing the READ & RUN ME is on your desktop but do not run it!
  • If it is not on your desktop, the below will not work.
• Shut down your protection software now (antivirus, antispyware...etc) to avoid possible conflicts.
• Open Notepad and copy/paste the text in the below code box into Notepad:

Code:

[COLOR="DarkRed"]KillAll::[/COLOR]
[COLOR="DarkRed"]ClearJavaCache::[/COLOR]
[COLOR="DarkRed"]DirLook::[/COLOR]
c:\users\Ebony\AppData\Local\Temp(38)
c:\users\User\AppData\Local\Temp(41)
C:\Users\Ebony\AppData\Local\temp
C:\kleaner.tmp
c:\programdata\Kaspersky Lab
c:\program files\Kaspersky Lab
[COLOR="DarkRed"]Driver::[/COLOR]
Avgldx86
avgwd
AVGIDSAgent
AVGIDSDriver
AVGIDSFilter
AVGIDSShim
AVGIDSEH
Avgrkx86
Avgtdix
[COLOR="DarkRed"]File::[/COLOR]
C:\ProgramData\1kAlMiG2Kb7FzP
C:\ProgramData\~1kAlMiG2Kb7FzP
C:\ProgramData\~1kAlMiG2Kb7FzPr
c:\windows\system32\DRIVERS\avgldx86.sys
c:\windows\system32\DRIVERS\AVGIDSDriver.Sys
c:\windows\system32\DRIVERS\AVGIDSFilter.Sys 
c:\windows\system32\DRIVERS\AVGIDSShim.Sys
c:\windows\system32\DRIVERS\AVGIDSEH.Sys
c:\windows\system32\DRIVERS\avgrkx86.sys
c:\windows\system32\DRIVERS\avgtdix.sys
[COLOR="DarkRed"]FileLook::[/COLOR]
c:\windows\system32\drivers\tcpip.sys
[COLOR="DarkRed"]Folder::[/COLOR]
c:\program files\AVG
C:\$AVG
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVG 2012
[COLOR="DarkRed"]RegLock::[/COLOR]
[HKEY_LOCAL_MACHINE\System\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
"MSCurrentCountry"=dword:000000b5
[COLOR="DarkRed"]Registry::[/COLOR]
[HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Firefox\extensions]
"{1E73965B-8B48-48be-9C8D-68B920ABC1C4}"=-
[-HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AA58ED58-01DD-4d91-8333-CF10577473F7}]
[-HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentVersion\Run]
"QuickTime Task"=-
[-HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\SearchScopes\{41396b1b-447e-473b-a34b-bb583136c7fc}]
[COLOR="DarkRed"]SecCenter::[/COLOR]
AV: AVG Anti-Virus Free Edition 2012 *Disabled/Updated* {5A2746B1-DEE9-F85A-FBCD-ADB11639C5F0}
SP: AVG Anti-Virus Free Edition 2012 *Disabled/Updated* {E146A755-F8D3-F7D4-C17D-96C36DBE8F4D}

• Save the above as CFScript.txt and make sure you save it to the same location (should be on your desktop) as ComboFix.exe
• At this point, you must exit all browsers now before continuing!
• You should have both the ComboFix.exe and CFScript.txt icons on your desktop.
• Now use your mouse to drag CFScript.txt on top of ComboFix.exe.
  http://img.photobucket.com/albums/v666/sUBs/CFScriptB-4.gif
• This shall launch ComboFix.
  Note: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.
• Allow ComboFix to update itself if prompted.
• When it finishes, a log will be produced at C:\ComboFix.txt
  Note: If after running ComboFix you discover none of your programs will open up because you receive the following error: Illegal operation attempted on a registry key that has been marked for deletion then you will need to reboot your computer which will normally fix this problem.
• Attach this log to your next message. (How to attach items to your post)

http://img51.imageshack.us/img51/6489/javaicon.gif Now install the current version of Sun Java from: Sun Java Runtime Environment

http://img822.imageshack.us/img822/6835/baticon.gif Now run C:\MGtools\GetLogs.bat by double-clicking it (Vista and Win7 right-click and select Run as Administrator)
Then attach C:\MGlogs.zip to your next message. (How to attach items to your post)
Note: This will automatically update all the logs inside MGlogs.zip

Let me know how the PC is running after you have completed these steps. Also let me know if you are able to boot into normal mode now.

 

You won't be able to uninstall the old Java version from Safe Mode with Networking (not without a tweak anyways ). You can skip that step.

 

First, thank you very much for responding. I really appreciate it.

Here is where I stand now:

- Yes, I do receive the System Properties dialog at each safe mode boot, along with an error message related to the location of a restore file. I have attached that to the post after this one (startup.jpg).

- I believe I uninstalled Kaspersky after running it - at least it is not showing up in add/remove programs. As for AVG, I did uninstall that prior to installing Kaspersky (at least I think it was prior) but it still shows in Add/Remove. When I click 'uninstall', Windows states 'a problem has occurred...AVG is not there and may have been already uninstalled....do you wish to remove it from list?'. At this point, I just left it. My apologies regarding the AVG Removal Tool...I did d/l it yesterday but obviously skipped running it. One final note regarding the AV type products - I can't remove AdAware/Watch from add/remove programs. I get the message "The Windows Installer Service could not be accessed....this can occur if the Windows Installer Service is not properly installed." I mention this only because when ComboFix runs, it gets cranky because it sees AdAware. I do not see any processes running related to AdAware, or running services so I don't know what else to do to kill it completely to satisfy ComboFix.

- All of the logs are attached below. As an FYI, while running ComboFix, the machine rebooted and went to BSOD. I wasn't in front of it when it occurred so I don't know what preceded it (if anything). I restarted in Safe Mode. The log file was generated, so presumably it finished correctly.

- I saw your message about skipping the uninstall of the old Java, but I did try to install the new version but was not able to do it from safe mode.

- Finally, the machine still will not boot except into Safe Mode.

Thanks again for all the help

 

Screenshot from safe mode startup attached.

 

Choose yes if this is the case. Also do not worry about installing the latest java or uninstall the old one at this point. We can always do this later.

First, rerun TDSSKiller and when it finds the above, allow TDSSKiller to delete it. Most likely you will not be required to reboot to remove it. If you aren't prompted, do not reboot. Attach the newest TDSSKiller log when you have done this.

Unfortunately it did not create a full log because it was unable to reboot into Normal Mode without BSODing. A trick is to F8 on startup back into to Safe Mode to allow ComboFix to generate a full log. However, according to your latest MGlogs it looks like it deleted everything we wanted it to

 

http://dus.x10.mx/canned/otlicon.gifPlease download OTL by Old Timer to your desktop.

• See the download links under this icon: http://forums.majorgeeks.com/chaslang/images/MGDownloadLoc.gif
• Double-click OTL.exe to run (Vista and Win7 right click and select Run as administrator)
• When the window appears, underneath Output at the top-right, make sure Standard Output is selected.
• Select Scan All Users.
• Under Drivers and Services, choose "All".
• Check the boxes beside LOP Check and Purity Check.
• Copy the text in the code box below and paste it into the http://img14.imageshack.us/img14/66/otlcustomfix.png text-field.
  
  Code:

  netsvcs
  /md5start
  temppf.sys
  pagefile.sys
  /md5stop
  %systemdrive%\*.*
  c:\users\Ebony\AppData\Local\Temp(38)\*.*
  c:\users\User\AppData\Local\Temp(41)\*.*
  C:\Users\Ebony\AppData\Local\temp\*.*
  %systemroot%\*. /mp /s
  %systemroot%\system32\*.sys /90
  %systemroot%\system32\*.exe /lockedfiles
  %systemroot%\system32\drivers\*.sys /lockedfiles
  

• Now click the http://img171.imageshack.us/img171/2405/runscanotl.png button.
• When the scan is complete, Notepad will open with the results of the OTL scan.
• Close Notepad.
• There will be two log files on your desktop entitled OTL.txt and Extras.txt.
• Attach both OTL.txt and Extras.txt to your next message. (How to attach items to your post)

 

OK...logs are attached.

Thanks!

 

Let's clean up the remaining traces of AVG and Kaspersky to rule those out as the culprit. Your logs at this point look malware free so it is becoming a software issue. I will try a few things but this is something our Software forum will be better equipped to deal with.

[[ Important ]]
In the below script, I did not use any commands to restart your computer. This is prevent you from getting a BSOD when the computer attempts to boot back into Normal Mode. However, since we are removing some drivers and services associated with AVG, OTL may want you to reboot anyways. If and when this happens go ahead and reboot, but be ready to reenter Safe Mode with Networking so that we can get a complete log from OTL.

http://dus.x10.mx/canned/otlicon.gifNow we need to make use of OTL by Old Timer.

• Double-click OTL.exe to run (Vista and Win7 right-click and select Run as administrator)
• When OTL opens, copy the text in the code box below and paste it into the http://img14.imageshack.us/img14/66/otlcustomfix.png text-field.
  
  Code:

  [COLOR="DarkRed"]:otl[/COLOR]
  FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{1E73965B-8B48-48be-9C8D-68B920ABC1C4}: C:\Program Files\AVG\AVG2012\Firefox4\
  O2 - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG2012\avgssie.dll File not found
  O2 - BHO: (no name) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - No CLSID value found.
  O3 - HKLM\..\Toolbar: (no name) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - No CLSID value found.
  O3 - HKU\S-1-5-21-2385233481-339068178-3673745931-1001\..\Toolbar\WebBrowser: (no name) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No CLSID value found.
  O4 - HKLM..\Run: [AVG_TRAY] "C:\Program Files\AVG\AVG2012\avgtray.exe" File not found
  O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_02-windows-i586.cab (Java Plug-in 1.6.0_02)
  O16 - DPF: {CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_02-windows-i586.cab (Java Plug-in 1.6.0_02)
  O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_02-windows-i586.cab (Java Plug-in 1.6.0_02)
  [2011/11/10 17:02:06 | 000,000,000 | ---D | C] -- C:\ProgramData\Kaspersky Lab
  [2011/11/10 17:02:06 | 000,000,000 | ---D | C] -- C:\Program Files\Kaspersky Lab
  [2 c:\users\Ebony\AppData\Local\Temp(38)\*.tmp files -> c:\users\Ebony\AppData\Local\Temp(38)\*.tmp -> ]
  [2 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
  [11 C:\Windows\System32\*.tmp files -> C:\Windows\System32\*.tmp -> ]
  [2 C:\Users\Ebony\AppData\Local\temp\*.tmp files -> C:\Users\Ebony\AppData\Local\temp\*.tmp -> ]
  [1 C:\*.tmp files -> C:\*.tmp -> ]
  [2011/10/17 20:01:39 | 000,000,644 | ---- | M] () -- C:\Users\Ebony\Application Data\Microsoft\Internet Explorer\Quick Launch\System Restore.lnk
  [2011/03/14 20:50:40 | 000,000,000 | ---D | M] -- C:\Users\Ebony\AppData\Roaming\AVG2012
  SRV - File not found [Auto | Stopped] --  -- (avgwd)
  SRV - File not found [On_Demand | Stopped] --  -- (AVGIDSAgent)
  DRV - File not found [Kernel | System | Stopped] --  -- (Avgtdix)
  DRV - File not found [File_System | Boot | Stopped] --  -- (Avgrkx86)
  DRV - File not found [File_System | System | Stopped] --  -- (Avgmfx86)
  DRV - File not found [Kernel | System | Stopped] --  -- (Avgldx86)
  DRV - File not found [Kernel | On_Demand | Stopped] --  -- (AVGIDSShim)
  DRV - File not found [Kernel | On_Demand | Stopped] --  -- (AVGIDSFilter)
  DRV - File not found [Kernel | Boot | Stopped] --  -- (AVGIDSEH)
  DRV - File not found [Kernel | On_Demand | Stopped] --  -- (AVGIDSDriver)
  [COLOR="DarkRed"]:files[/COLOR]
  xcopy %temp%\smtmp\1 "%programdata%\start menu" /s /i /h /y /c
  xcopy %temp%\smtmp\2 "%appdata%\microsoft\internet explorer\quick launch" /s /i /h /y /c
  xcopy %temp%\smtmp\3 "%appdata%\microsoft\internet explorer\quick launch\user pinned\taskbar" /s /i /h /y /c
  xcopy %temp%\smtmp\4 "%programdata%\desktop" /s /i /h /y /c
  c:\users\User\AppData\Local\Temp(41)
  

• Now click the http://img3.imageshack.us/img3/407/otlrunfix.png button.
• OTL may ask to reboot the machine. Please do so if asked.
• Click the OK button.
• When complete, Notepad will open.
• Close Notepad.
• A log file will be located at C:\_OTL\MovedFiles\mmddyyyy_hhmmss.log, where mmddyyyy_hhmmss is the date of the tool run.
• Attach this log to your next message. (How to attach items to your post)

Once you attach the "C:\_OTL\MovedFiles\mmddyyyy_hhmmss.log" type log.. retry booting into Normal Mode.

 

OK, I've run into a snag. I am unable to get OTL to complete. It gets to the line '034 - HKLM BootExecute....' and then locks up. I've let it sit for about 30 minutes but the program is not responding. I have to kill it thru task manager. I've rebooted and tried it 3 times, but no luck.

Thank you!

 

Thanks for letting me know this. I went ahead and removed that line from the OTL script. Refresh this page and use the script that is there now.

 

OK, OTL runs now and when complete asks to be rebooted to complete. I reboot, go into Safe w/networking, but am then confused as to what I should do. OTL doesn't re-open after boot so I opened it, thinking it may complete and generate the logs. Maybe I am misunderstanding but I don't see any option to hit 'OK' as stated, nor does Notepad open.

Should I just run a scan as instructed the first time I ran OTL to generate the logs after I run the Fix?

Thank you.

 

Yes try this. Also check to make sure there are no log files in C:\_OTL\MovedFiles\

 

OK, four files are attached.

1. Was in the 'MovedFiles' folder with a timestamp from earlier this afternoon. This must have been generated when I posted about the lockup.

2. Was created after I re-ran OTL 'Fix' this evening. It probably has the same info as #1, but I wanted to give you a fresh one, just in case.

3 & 4. Are the OTL logs generated this evening after performing the OTL 'Scan' with the parameters given earlier today.

Hopefully one/all of these will give you something useful.

Thanks yet again.

 

There are still some references to the old AVG drivers stuck. OTL must need to reboot into Normal Mode before being fully able to remove them.

I do not think this is your problem though, so let's try to address the pagefile issue.

Now there are multiple things that this could be based on some of the research I've done.

First, you mentioned before that System Restore is not working for you right? I'd like you to delete any remaining restore points, and then create a brand new one before proceeding.
Read the below for full instructions on how to do this: Disable And Enable System Restore
So now you should only have 1 restore point (the one you just created).

Now install Puran Defrag Free Edition

• See the download links under this icon: http://forums.majorgeeks.com/chaslang/images/MGDownloadLoc.gif
• Open the program when you are finished installing it
• Highlight your C: drive
• Click the Boot Time Defrag button and select "Restart-Defrag-Restart + Disk Check"
• Click OK to restart your computer and begin its process.
  Note: This can take an hour to two, especially for a highly defragmented disk.

 

Good morning,

Here is an update...

I had no luck deleting the old and creating a new restore point because the 'System Protection' tab isn't listed (safe mode?).

I installed Puran anyway and selected the "Restart-Defrag-Restart + Disk Check" option. Upon restart, I used F8 to hop into safe mode+networking (to avoid the alternative: BSOD) but apparently this kills the continuation of Puran as it doesn't resume.

Thank you.

 

Morning.

Try letting Puran run unhindered. Last time I saw this I was able to at least boot into Normal Mode's desktop briefly before I would get the BSOD. Is this not the case for you?

And you're right, you can't flush restore points while in Safe Mode in WinVista/7. I forgot

 

Another program some people in your situation have had success with is Vopt.

Under Drive: > make sure C: is selected
Under Defragmenting > select Defrag Pagefile...

If none of these work, you should try our Software forum.

Just create a new thread there and describe your symptoms. I'm thinking it's a pagefile issue but I could be wrong.

 

Hello there,

No luck with the last suggestions. As for Puran, I can't get into 'normal' mode even briefly. The best that happens is Windows teases me for several seconds now before it BSODs. This is at least an improvement. When this all started it would crash almost immediately when the user choice screen began to load, now it will actually let me choose a user and begin typing a password before the crash.

I ran Vopt and it states the pagefile did not need defragging. I let it run anyway, but same BSOD.

One last note, I did attempt to change the pagefile size, even to the point of selecting 'no page file', or going the opposite way and manually entering a 5000mb size. No matter what, upon reboot, Windows changes it to 16-256mb and gives me that same error screen and System Properties prompt I supplied in a screenshot previously.

Thanks so much for all you tried to do. I will give the Software forum a go and reference this thread ID so they can see what's been tried.

Thanks again for spending so much of your time on this problem.

 

Sounds good. I will follow your thread as that has me interested too. There's some pretty smart people there one of them should be able to solve this for you