crash in Windows 2000 150.1

[davexnet]

HI all,

received a crash during the scan in Windows 2000.

Here's the diagnostic info:

http://www.mediafire.com/download.php?jq65mwiod061s3k

[AdvancedSetup]

Well not sure why but that link locked up my Firefox for a minute. Please just zip it with Zip or rename it to .zip and upload it here.

[davexnet]

It's 20mb. Can I upload it here?

I've used that file hosting site many, many times and have no problem accessing my link with FF 4 (I have the

noscript extension) installed.

Please retry.

[culona]

any updates on this one?? having the same problem on a work computer where i am unable to install/diagnose easily... i have never had problems with viruses/spyware (since i cleaned it out when started i using this pos), even on my pc at home and do not believe there is any threat on here currently, but not being able to 'full scan' with mb is scary!

[davexnet]

Well I uploaded the dump to a hosting site but for some reason the respondent cannot access it.

If there is a preferred hosting site you'd like me to use, please advise.

[shadowwar]

Attached file for op.

jtemp.7z

[davexnet]

Attached file for op.

I posted this dmp/log so that somebody at Malwarebytes would look at it and diagnose

the crash in Win2k. Will somebody at MBAM review these materials ?

[shadowwar]

I sent ron a message to come back here for you.

I would help you but i have no idea on the support end.

[AdvancedSetup]

Sorry I did not have this topic set to watch. I've had to rebuild my system and I don't currently have the right tools installed to properly look at the dump file but an initial scan with other tools does not show an immediate cause.

Please run the following scanner and post back the logs.

Download

DDS

and save it to your desktop

http://download.bleepingcomputer.com/sUBs/dds.scr

Disable any script blocker if your Anti-Virus/Anti-Malware has it.

Once downloaded you can disconnect from the Internet and disable your Ant-Virus temporarily if needed.

Then double click

dds.scr

to run the tool.

When done, the

DDS.txt

will open.

Click Yes at the next prompt for Optional Scan.

When done, DDS will open two (2) logs:

1. DDS.txt
   
   
2. Attach.txt

• Save both reports to your desktop
• Please include the following logs in your next reply:
  DDS.txt
  and
  Attach.txt

[davexnet]

Here's the file.Desktop.7z

[AdvancedSetup]

Please try the following.

STEP 01

You may have corrupted files on your disk. Please try running the following.

Click on START - RUN and copy / paste the following entry into the box and click OK

CMD /C ECHO Y|CHKDSK C: /R 

Then restart your computer and it should run for a little while and check all the sectors on the drive.

If it does not run a disk check on reboot please let me know.

STEP 02

Please try downloading and installing the following update from Microsoft.

Service Pack 6 for Visual Basic 6.0: Run-Time Redistribution Pack (vbrun60sp6.exe)

Brief Description:

vbrun60sp6.exe is a self-extracting executable file that installs versions of the Microsoft Visual Basic run-time files required by all applications created with Visual Basic 6.0.

Download: vbrun60sp6.exe

There is also a cumulative update for VB6 located here: Microsoft Visual Basic 6.0 Service Pack 6 Cumulative Update

STEP 03

Disable the uTorrent program from running for now.

STEP 04

Please do the following:

• Download and run mbam-clean.exe from here
  
• It will ask to restart your computer, please allow it to do so very important
  
• After the computer restarts, temporarily disable your Anti-Virus and install the latest version of Malwarebytes' Anti-Malware from here
  
  • Note: You will need to reactivate the program using the license you were sent via email if using the Pro version
    
  • Launch the program and set the Protection and Registration. Then go to the UPDATE tab if not done during installation and check for updates.
    Restart the computer again and verify that MBAM is in the task tray if using the Pro version. Now setup any file exclusions as may be required in your Anti-Virus/Internet-Security/Firewall applications and restart your Anti-Virus/Internet-Security applications. You may use the guides posted in the FAQ's here or ask and we'll explain how to do it.
    

STEP 05

Try running another scan and let us know the results or post back the logs if it runs okay this time.

Thanks

[davexnet]

I ran the check disk (all clean), updated visual basic, clean and reinstalled MBAM reran scan

and it still crashes. Do you want the fresh diagnostic material it produced?

[AdvancedSetup]

Let me report this to QC and see if they can take a deeper look.

[Mainard]

Hello DaveXNet,

Let's Create a process Monitor log.

Create a Process Monitor Log:

• Create a new folder on your desktop called Logs
  
• Please download Process Monitor from here and save it to your desktop
  
• Double-click on Procmon.exe to run it
  
• In Process Monitor, click on File at the top and select Backing Files...
  
• Click the circle to the left of Use file named: and click the ... button
  
• Browse to the Logs folder you just created and type MBAM Log in the File name: box and click Save
  
• Exit Process Monitor and open it again so that it starts creating the logs
  
• Re-Create the issue.
  
• Close Process Monitor
  
• Right-click on the Logs folder on your desktop and hover your mouse over Send To and select Compressed (zipped) Folder
  
• Please attach the Logs.zip file you just created to your next reply
  

Thank you!

[davexnet]

Hello DaveXNet,

Let's Create a process Monitor log.

Create a Process Monitor Log:

• Create a new folder on your desktop called Logs
  
• Please download Process Monitor from here and save it to your desktop
  
• Double-click on Procmon.exe to run it
  
• In Process Monitor, click on File at the top and select Backing Files...
  
• Click the circle to the left of Use file named: and click the ... button
  
• Browse to the Logs folder you just created and type MBAM Log in the File name: box and click Save
  
• Exit Process Monitor and open it again so that it starts creating the logs
  
• Re-Create the issue.
  
• Close Process Monitor
  
• Right-click on the Logs folder on your desktop and hover your mouse over Send To and select Compressed (zipped) Folder
  
• Please attach the Logs.zip file you just created to your next reply
  

Thank you!

Hello procmon fails to start. It gives an error box with the message, "unable to load process monitor device driver".

According to http://technet.microsoft.com/en-us/sysinternals/bb896645 it needs XP sp2 or higher. (I have Win2k sp4).

I'll have a look round to see if I can find an older version of procmon. I'm sure I had one from a couple of years ago somewhere...

[davexnet]

Unable to find a version of Procmon that works on Windows 2000, so unable to get a trace.

However I uninstalled and reinstalled MBAM, ran a new scan, and this time it ran to completion.

Something odd about that.

[Mainard]

Ok, evidently the download states it's Windows 2000 compatible but it is not. My apologies, it is missing a .dll that is with Windows XP. Unfortunately that .dll is no longer support by Microsoft. To make a short story long, my apologies; I have a substitute.

If this occurs again let's get a full crash dump of MBAM.

Replicate the Crash, and then do the BELOW Directions. Do not close any of the dialog boxes (MBAM or the Windows Error)

To create a userdump on Windows XP/2003, please do the following:

You must first reproduce the issue and get the software to pop up with an error message. You must not close the error message. Instead, leave it open until you have created the userdump.

1. Download and extract the Microsoft Userdump Utility

2. After the utility is installed, identify the PID (Process ID) of the process of which you need to create the userdump:

* Open Windows Task Manager (Ctrl-Alt-Del);

* Go to the Processes tab;

* Go to View -> Select Columns:

* Check PID (Process Identifier):

* Next to the Image Name, you will see PID:

The PID is MBAM.exe

3. Once you have noted down the PID of the process, open Windows Command Line (Start-Run -> cmd) and navigate to the userdump.exe file by issuing the following command:

Windows 32 bit: cd /d C:\kktools\userdump8.1\x86

Windows 64 bit: cd /d C:\kktools\userdump8.1\x64

4. Then issue the following command:

Userdump xxxx

where xxxx is the PID that you have noted down previously.

In the C:\kktools\userdump8.1\xxx folder, you will see a PROCCESSNAME.dmp. For example, Agent.dmp

5. ZIP the dump file;

6. Upload the dump file to RapidShare and post the link in your response Please.

Thank you!

[davexnet]

OK Mainard,

I'll keep an eye on it - and if I can reproduce, I'll gather the dump.

Dave

[davexnet]

OK Mainard,

I'll keep an eye on it - and if I can reproduce, I'll gather the dump.

Dave

I am unable to get the dump the way you asked for.

The message box comes up saying there was a problem and within 3 seconds it's gone,

mbam.exe is no longer running, no time to issue the command to get the dump.

The utility you mentioned gives you the option to monitor the task and it

will capture the dump when it crashes. This worked, but the dump was 100MB,

almost exactly the same size as it was before I installed the utility and Drwatson

created the dump.

Sometimes it crashes and sometimes it works even on identical runs (no update in between).

Could it be sensitive to memory timing? I don't have a problem anywhere else

(that I'm aware of).

[Mainard]

Hello davexnet,

Are you able to replicate the crash while in safe mode?

Please let me know if safe mode still has the crash occur.

How to Boot in Safe Mode:

• Restart your computer.
  
• When the Boot menu appears, press F8.
  
• Under the boot options select 'Safe Mode'
  

Thank you!

[davexnet]

Hello - it still crashes in safe mode.

[Mainard]

Hello Dave,

Please zip up the crash dump you are able to get (the 100MB one) and please upload it to rapidshare and provide the link for further diagnoses.

Thank you very much!

[davexnet]

Here's the dump -

https://rapidshare.com/files/457491560/mbam668.7z

[Mainard]

Hey dave,

I am having the dump getting looked over I will let you know where to go from here.

Thank you very much!

[Mainard]

Hello dave,

Lets run the SFC scannow tool.

This tool will require you to have your Windows 2000 CD.

Please click on Start->Run.

Type inside the run box:

sfc.exe /scannow

Please let me know if you have that CD so you can then check the integrity of the files within your system.

Thank you!