Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Bloodhound.unknown Code From Norton (deemed Not Malware) Maybe Hardware?


  • Please log in to reply
24 replies to this topic

#1 ForcesUndivided

ForcesUndivided

  • Members
  • 46 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:12:40 PM

Posted 25 August 2008 - 04:10 PM

Howdy All,

They call me Forces and I have a Bloodhound.Unknown detection by Symantec (Norton Anti-Virus) and blue screen system crashing. Snowhite and Shaba of the malware forum (malware helpers) have deemed me clean and free of malware. Animal of the malware forum (as well as Shaba) advised I start a new thread here giving some details. The old thread link is http://www.bleepingcomputer.com/forums/t/157687/bloodhoundunknown/.

My main issue is "crashing to blue screen" stating possible corruption due to software. The only thing I have downloaded as of late is XP Service pack 3 but in my Norton Anti-Virus there was a log of ftp listening and letting in a low level worm, something to that effect. I don't know what that means or if its helpful but thats all I could find on my own. Again, the malware helpers deemed me free and clear.

I noticed in some of the previous malware logs a mention of "Fast Track hardware failure" of some sort. I recently moved and in doing so removed a M-Audio recording HUB, called Fast-Track USB, it is just an interface for recording mic, guitar and MIDI inputs. I have not reattached the unit; it always seemed to cause minor problems and I am considering removing the Fast Track Software to resolve the "hardware issue". I also have SESSIONS software (PC equivalent of GarageBand for MAC) that came with the HUB that I could also remove if necessary. SESSIONS can't run without the Fast-Track USB attached to the tower, the application won't open without it being recognized, that's why I think removing the software may solve the "hardware issue", if that makes sense.

My biggest fear is that my hardrive is just dying. After some of the crashes the system prompts to "check consistency" of the hard disk, and I let it run. So far no consistency issues have been noted after it scans, it just wants to check due to the crashing I suppose (maybe a certain crash code prompts the consistency check). If worst comes to worst I can blast the hard drive but I will lose my Adobe Creative Suite permanently (I don't have the discs anymore).

Another issue of note is that upon each restart my Norton Anti-Virus detects the Bloodhound.Unknown and states it has delt with the issue and my system is secure, but when I click on the link for history details of the issue no new entry is listed. I would assume if something was removed, blocked or quarantined it would be in the history (that is the standard Norton protocal). If I then run a "Full Scan" most times a tracking cookie will be removed as a threat. Now at this point I have not been on the web to gain a cookie so I wonder if the Bloodhound.Unknown is jacking my computer and creating the cookie. I say this because whenever I get off the web I run CCleaner, set to Gutmann (35 passes), deleting all temporary internet files, on and off line, and all cookies/history. I also have my Internet Explorer set to delete all temporary files when the browzer is closed.

Well, I think that about covers my issues A-Z. I hope my babble is helpful in some way. I apologize for being so long winded.

Thank you for any assistance you can offer. I really appreciate all your efforts and the previous efforts of Snowhite, Shaba and Animal from the malware forum. I hope you can help me out, its the not knowing that is killing me more than anything else. There has to be a rational explanation for my issues. Take care, keep the faith! :thumbsup:

I have my account set to shoot me an email once a reply comes through so I will check my Outlook frequently. Thanks again.

Edited by ForcesUndivided, 25 August 2008 - 04:31 PM.


BC AdBot (Login to Remove)

 


#2 garmanma

garmanma

    Computer Masochist


  • Members
  • 27,809 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Cleveland, Ohio
  • Local time:01:40 PM

Posted 25 August 2008 - 05:17 PM

First you have to keep the computer from restarting when a BSOD occurs. Follow these instruction:
http://www.bleepingcomputer.com/forums/t/74644/how-to-disable-automatic-restarts-when-windows-crashes/
Now that, that's done, here's how to read it (post here also, the complete error message)
http://www.bleepingcomputer.com/forums/top...tml#entry409491
When a BSOD occurs, you can also check the Event Viewer
http://www.bleepingcomputer.com/forums/t/40108/how-to-use-event-viewer/

As for the hard drive, if you find out the manufacturer of your drive, you can go to their support site and download their diagnostic utility to check the drive for errors

Edited by garmanma, 25 August 2008 - 05:19 PM.

Mark
Posted Image
why won't my laptop work?

Having grandkids is God's way of giving you a 2nd chance because you were too busy working your butt off the 1st time around
Do not send me PMs with problems that should be posted in the forums. Keep it in the forums, so everyone benefits
Become a BleepingComputer fan: Facebook and Twitter

#3 ForcesUndivided

ForcesUndivided
  • Topic Starter

  • Members
  • 46 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:12:40 PM

Posted 25 August 2008 - 06:40 PM

:thumbsup: Howdy garmanma,

Thanks for the quick reply. Okay, disabled the auto-restart, looked over how to read a BSOD and now know how to us the Event Viewer. I am going to list some of the errors by category below. I will list the last three to be thorough. If you need more info I will be happy to accommodate. The system actually has not crashed yet today so I will post the next BSOD as soon as it occurs. Right on, so here we go:

Event Viewer - Application:

Event Type: Error
Event Source: Microsoft Management Console
Event Category: None
Event ID: 1001
Date: 8/24/2008
Time: 11:38:33 AM
User: N/A
Computer: COMPUTER1
Description:
The description for Event ID ( 1001 ) in Source ( Microsoft Management Console ) cannot be found. The local computer may not have the necessary registry information or message DLL files to display messages from a remote computer. You may be able to use the /AUXSOURCE= flag to retrieve this description; see Help and Support for details. The following information is part of the event: 899310772.
Data:
0000: 42 75 63 6b 65 74 3a 20 Bucket:
0008: 38 39 39 33 31 30 37 37 89931077
0010: 32 0d 0a 2..

Event Type: Error
Event Source: Microsoft Management Console
Event Category: None
Event ID: 1000
Date: 8/24/2008
Time: 11:38:27 AM
User: N/A
Computer: COMPUTER1
Description:
The description for Event ID ( 1000 ) in Source ( Microsoft Management Console ) cannot be found. The local computer may not have the necessary registry information or message DLL files to display messages from a remote computer. You may be able to use the /AUXSOURCE= flag to retrieve this description; see Help and Support for details. The following information is part of the event: mmc.exe, 5.2.3790.4136, mmcndmgr.dll, 5.2.3790.4136, 00034d00.
Data:
0000: 41 70 70 6c 69 63 61 74 Applicat
0008: 69 6f 6e 20 46 61 69 6c ion Fail
0010: 75 72 65 20 20 6d 6d 63 ure mmc
0018: 2e 65 78 65 20 35 2e 32 .exe 5.2
0020: 2e 33 37 39 30 2e 34 31 .3790.41
0028: 33 36 20 69 6e 20 6d 6d 36 in mm
0030: 63 6e 64 6d 67 72 2e 64 cndmgr.d
0038: 6c 6c 20 35 2e 32 2e 33 ll 5.2.3
0040: 37 39 30 2e 34 31 33 36 790.4136
0048: 20 61 74 20 6f 66 66 73 at offs
0050: 65 74 20 30 30 30 33 34 et 00034
0058: 64 30 30 0d 0a d00..

Event Type: Error
Event Source: Application Error
Event Category: None
Event ID: 1001
Date: 8/22/2008
Time: 3:10:15 PM
User: N/A
Computer: COMPUTER1
Description:
Fault bucket 883328886.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 42 75 63 6b 65 74 3a 20 Bucket:
0008: 38 38 33 33 32 38 38 38 88332888
0010: 36 0d 0a 6..


Event Viewer - Security:

Event Type: Failure Audit
Event Source: Security
Event Category: Logon/Logoff
Event ID: 529
Date: 8/25/2008
Time: 7:10:06 PM
User: NT AUTHORITY\SYSTEM
Computer: COMPUTER1
Description:
Logon Failure:
Reason: Unknown user name or bad password
User Name: Jason
Domain: COMPUTER1
Logon Type: 2
Logon Process: Advapi
Authentication Package: Negotiate
Workstation Name: COMPUTER1

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Failure Audit
Event Source: Security
Event Category: Account Logon
Event ID: 680
Date: 8/25/2008
Time: 7:10:06 PM
User: NT AUTHORITY\SYSTEM
Computer: COMPUTER1
Description:
Logon attempt by: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon account: Jason
Source Workstation: COMPUTER1
Error Code: 0xC000006A


For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Failure Audit
Event Source: Security
Event Category: Logon/Logoff
Event ID: 529
Date: 8/25/2008
Time: 7:10:02 PM
User: NT AUTHORITY\SYSTEM
Computer: COMPUTER1
Description:
Logon Failure:
Reason: Unknown user name or bad password
User Name: Jason
Domain: COMPUTER1
Logon Type: 2
Logon Process: Advapi
Authentication Package: Negotiate
Workstation Name: COMPUTER1

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.


Event Viewer - System:

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7000
Date: 8/25/2008
Time: 7:10:40 PM
User: N/A
Computer: COMPUTER1
Description:
The M-Audio Fast Track Installer service failed to start due to the following error:
The system cannot find the file specified.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Error
Event Source: Ntfs
Event Category: Disk
Event ID: 55
Date: 8/24/2008
Time: 11:39:41 AM
User: N/A
Computer: COMPUTER1
Description:
The file system structure on the disk is corrupt and unusable. Please run the chkdsk utility on the volume C:.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 00 00 00 00 02 00 4e 00 ......N.
0008: 02 00 00 00 37 00 04 c0 ....7..
0010: 00 00 00 00 32 00 00 c0 ....2..
0018: 40 00 00 00 00 00 00 00 @.......
0020: 00 00 00 00 00 00 00 00 ........

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7023
Date: 8/24/2008
Time: 8:45:21 AM
User: N/A
Computer: COMPUTER1
Description:
The Application Management service terminated with the following error:
The specified module could not be found.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.


Event Viewer - Internet Explorer: There are no items to show in this view.


Wow, now that is some crazy stuff. Just knowing where that Event Viewer is located is worth the price of admission in and of itself. Ah, knowledge is power (School House Rock). I thank you for any assistance you can provide me. You're a prince among mere peasants. I'll check my email frequently so we can sort this out and get me off your plate, so to speak. Have a good night!

Edited by ForcesUndivided, 25 August 2008 - 06:43 PM.


#4 garmanma

garmanma

    Computer Masochist


  • Members
  • 27,809 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Cleveland, Ohio
  • Local time:01:40 PM

Posted 25 August 2008 - 07:24 PM

How did you uninstall M-Audio Fast Track Installer, Add/Remove Programs? That's one of the errors. It's looking for it.
The other one is for the Microsoft Management Console, it cannot be found.
http://www.microsoft.com/downloads/details...;displaylang=en
The third refers to a password failure when attempting to logon.
For the first 2, if you don't want them to run, you can download Autoruns
http://technet.microsoft.com/en-us/sysinte...s/bb963902.aspx
If they're listed in there, check the box by them.
You can also download the Windows Installer Cleanup Utility
http://support.microsoft.com/kb/290301
if there are any references to them check the box and run the app.
Mark
Posted Image
why won't my laptop work?

Having grandkids is God's way of giving you a 2nd chance because you were too busy working your butt off the 1st time around
Do not send me PMs with problems that should be posted in the forums. Keep it in the forums, so everyone benefits
Become a BleepingComputer fan: Facebook and Twitter

#5 Orange Blossom

Orange Blossom

    OBleepin Investigator


  • Moderator
  • 36,963 posts
  • OFFLINE
  •  
  • Gender:Not Telling
  • Location:Bloomington, IN
  • Local time:01:40 PM

Posted 25 August 2008 - 07:43 PM

I also noted this from the error messages:

The file system structure on the disk is corrupt and unusable. Please run the chkdsk utility on the volume C:.


Here is how to do that:

Click on the Start menu, then Run.

In the box that shows up, type cmd then click on Okay

I have quoted the next steps from Microsoft support. Note: substitute the letter 'C' for the word 'volume' in the command you type in. Also, do not include the comma.

To repair errors, locate bad sectors, and recover readable information, at the command prompt, type chkdsk volume:/r, and then press ENTER.

Note If one or more of the files on the hard disk are open, you will receive the following message:
Chkdsk cannot run because the volume is in use by another process. Would you like to schedule this volume to be checked the next time the system restarts? (Y/N)
Type Y, and then press ENTER to schedule the disk check, and then restart your computer to start the disk check.


From here: http://support.microsoft.com/kb/315265

Orange Blossom :thumbsup:

Edited by Orange Blossom, 25 August 2008 - 07:44 PM.
Spelling correction. ~ OB

Help us help you. If HelpBot replies, you MUST follow step 1 in its reply so we know you need help.

Orange Blossom

An ounce of prevention is worth a pound of cure

SpywareBlaster, WinPatrol Plus, ESET Smart Security, Malwarebytes' Anti-Malware, NoScript Firefox ext., Norton noscript

#6 ForcesUndivided

ForcesUndivided
  • Topic Starter

  • Members
  • 46 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:12:40 PM

Posted 25 August 2008 - 10:43 PM

Hello All,

I set up the check disk to run on restart. It has actually been automatically running a check after some of the crashes and no issues have been found.

I downloaded both of the apps and the clean up utility does not mention the Microsoft controller or Fast-Track USB, the AutoRuns is confusing and all the items are already checked.

In answer to your question the Fast-Track will not uninstall at the moment in the Add/Remove section. If I request the uninstall it tries to re-install the app, strange. I think if I remove the SESSIONS software it will be removed with it, or at least I will be able to remove it after the fact.

Any ideas about the Microsoft contoller? Where would it be in the AutoRuns, or what would I be looking for?

Thank you both for all your assistance.

#7 ForcesUndivided

ForcesUndivided
  • Topic Starter

  • Members
  • 46 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:12:40 PM

Posted 26 August 2008 - 06:14 AM

Hello Again,

I requested the disk check and it ran overnight, the volume is clean. This check was much longer than the ones I had been seeing after some of the crashes and provided a new screen stating the volume status.

I have decided to just reattach the Fast-Track and see if it is recognized to solve that issue.

The Microsoft issue is still open to suggestion.

Also, what's up with this Bloodhound.Unkown detection by Norton? It finds and resolves it after every reboot/restart. Bloodhound.Unknown is the code Symantec uses for an "issue" that has all the characteristics of a virus but has not yet been identified with a specific name/type. I truly think this is my real issue. If it's there after every reboot/restart then it's not really being resolved as Norton is stating.

If I am in the wrong forum to resolve this issue please advise.

Thank you for all your assistance. Take care.

Edited by ForcesUndivided, 26 August 2008 - 06:16 AM.


#8 garmanma

garmanma

    Computer Masochist


  • Members
  • 27,809 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Cleveland, Ohio
  • Local time:01:40 PM

Posted 26 August 2008 - 08:03 AM

what's up with this Bloodhound.Unkown detection by Norton?

It sees something that it doesn't recognize. I'd recommend different scans but you already did that. The only other thing i can think is to try a different anti-virus program. AVG or Avast are both free, and better in my own opinion
Mark
Posted Image
why won't my laptop work?

Having grandkids is God's way of giving you a 2nd chance because you were too busy working your butt off the 1st time around
Do not send me PMs with problems that should be posted in the forums. Keep it in the forums, so everyone benefits
Become a BleepingComputer fan: Facebook and Twitter

#9 ForcesUndivided

ForcesUndivided
  • Topic Starter

  • Members
  • 46 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:12:40 PM

Posted 30 August 2008 - 07:03 AM

Hello again garmanma,

I think I have made some head way. When I dowloaded SP3 for XP the Fast-Track and SESSIONS software were not supported, so it was causing one of the BSOD issues. I went to the M-Audio site, dowloaded the new drivers and removed the Fast-Track. I actually don't have a DVD drive in my computer so I will "borrow" one from BEST BUY over the next couple days and do the same to remove the SESSIONS program just to be thorough. SESSIONS needs to run the DVD to update/uninstall for some reason. But I have another issue that is more persistent. If you would be so kind, can you tell me your thoughts on...

Event Type: Error
Event Source: System Error
Event Category: (102)
Event ID: 1003
Date: 8/30/2008
Time: 7:56:31 AM
User: N/A
Computer: COMPUTER1
Description:
Error code 0000000a, parameter1 03e283c0, parameter2 00000002, parameter3 00000000, parameter4 804eea7b.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 53 79 73 74 65 6d 20 45 System E
0008: 72 72 6f 72 20 20 45 72 rror Er
0010: 72 6f 72 20 63 6f 64 65 ror code
0018: 20 30 30 30 30 30 30 30 0000000
0020: 61 20 20 50 61 72 61 6d a Param
0028: 65 74 65 72 73 20 30 33 eters 03
0030: 65 32 38 33 63 30 2c 20 e283c0,
0038: 30 30 30 30 30 30 30 32 00000002
0040: 2c 20 30 30 30 30 30 30 , 000000
0048: 30 30 2c 20 38 30 34 65 00, 804e
0050: 65 61 37 62 ea7b


Details
Product: Windows Operating System
ID: 1003
Source: System Error
Version: 5.2
Symbolic Name: ER_KRNLCRASH_LOG
Message: Error code %1, parameter1 %2, parameter2 %3, parameter3 %4, parameter4 %5.

Explanation
A blue screen (Stop error) was reported. The message contains details about the error. A matching event with Event ID 1001 might also appear in the event log. This matching event displays information about the specific error that occurred.

User Action
No user action is required.
--------------------------------------------------------------------------------
Currently there are no Microsoft Knowledge Base articles available for this specific error or event message. For information about other support options you can use to find answers online, see http://support.microsoft.com/default.aspx.

Any input would be helpfull. Thank you very much for all your assistance, your a prince. Keep the faith! :thumbsup:

Edited by ForcesUndivided, 30 August 2008 - 07:07 AM.


#10 ForcesUndivided

ForcesUndivided
  • Topic Starter

  • Members
  • 46 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:12:40 PM

Posted 02 September 2008 - 04:05 PM

Just had another crash, details below; the post directly above has not been reviewed yet either (thank you for all your assistance):

Event Type: Error
Event Source: System Error
Event Category: (102)
Event ID: 1003
Date: 9/2/2008
Time: 5:03:00 PM
User: N/A
Computer: COMPUTER1
Description:
Error code 00000019, parameter1 00000020, parameter2 e32cac48, parameter3 e32cb778, parameter4 8b661274.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 53 79 73 74 65 6d 20 45 System E
0008: 72 72 6f 72 20 20 45 72 rror Er
0010: 72 6f 72 20 63 6f 64 65 ror code
0018: 20 30 30 30 30 30 30 31 0000001
0020: 39 20 20 50 61 72 61 6d 9 Param
0028: 65 74 65 72 73 20 30 30 eters 00
0030: 30 30 30 30 32 30 2c 20 000020,
0038: 65 33 32 63 61 63 34 38 e32cac48
0040: 2c 20 65 33 32 63 62 37 , e32cb7
0048: 37 38 2c 20 38 62 36 36 78, 8b66
0050: 31 32 37 34 1274



Details
Product: Windows Operating System
ID: 1003
Source: System Error
Version: 5.2
Symbolic Name: ER_KRNLCRASH_LOG
Message: Error code %1, parameter1 %2, parameter2 %3, parameter3 %4, parameter4 %5.

Explanation
A blue screen (Stop error) was reported. The message contains details about the error. A matching event with Event ID 1001 might also appear in the event log. This matching event displays information about the specific error that occurred.

User Action
No user action is required.
--------------------------------------------------------------------------------
Currently there are no Microsoft Knowledge Base articles available for this specific error or event message. For information about other support options you can use to find answers online, see http://support.microsoft.com/default.aspx.

Edited by ForcesUndivided, 02 September 2008 - 04:09 PM.


#11 ForcesUndivided

ForcesUndivided
  • Topic Starter

  • Members
  • 46 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:12:40 PM

Posted 06 September 2008 - 08:19 AM

Howdy garmanma,

I hope all is well in the land of MyBleepingComputer; I'm sure you're quite busy. I also hope I have not been forgotten. When you have a spare moment can you look at the two posts above and review this one as well. I have completely removed the SESSIONS software and Fast-Track USB from my system, defragged thoroughly, ran the disk check with the fix options selected and it seems to have resolved that particular crash error. The one I am receiving as of late is listed below. The Microsoft site states there are no steps I can take on my end and no knowledge base articles for the code in question. Any assistance you can provide would be greatly appreciated. Take care, keep the faith!

Event Type: Error
Event Source: System Error
Event Category: (102)
Event ID: 1003
Date: 9/5/2008
Time: 9:59:12 PM
User: N/A
Computer: COMPUTER1
Description:
Error code 00000050, parameter1 fce9f0b4, parameter2 00000000, parameter3 f34fb9b4, parameter4 00000000.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 53 79 73 74 65 6d 20 45 System E
0008: 72 72 6f 72 20 20 45 72 rror Er
0010: 72 6f 72 20 63 6f 64 65 ror code
0018: 20 30 30 30 30 30 30 35 0000005
0020: 30 20 20 50 61 72 61 6d 0 Param
0028: 65 74 65 72 73 20 66 63 eters fc
0030: 65 39 66 30 62 34 2c 20 e9f0b4,
0038: 30 30 30 30 30 30 30 30 00000000
0040: 2c 20 66 33 34 66 62 39 , f34fb9
0048: 62 34 2c 20 30 30 30 30 b4, 0000
0050: 30 30 30 30 0000

Details
Product: Windows Operating System
ID: 1003
Source: System Error
Version: 5.2
Symbolic Name: ER_KRNLCRASH_LOG
Message: Error code %1, parameter1 %2, parameter2 %3, parameter3 %4, parameter4 %5.

Explanation
A blue screen (Stop error) was reported. The message contains details about the error. A matching event with Event ID 1001 might also appear in the event log. This matching event displays information about the specific error that occurred.

User Action
No user action is required.
--------------------------------------------------------------------------------
Currently there are no Microsoft Knowledge Base articles available for this specific error or event message. For information about other support options you can use to find answers online, see http://support.microsoft.com/default.aspx.

Edited by ForcesUndivided, 06 September 2008 - 08:22 AM.


#12 ForcesUndivided

ForcesUndivided
  • Topic Starter

  • Members
  • 46 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:12:40 PM

Posted 08 September 2008 - 10:27 AM

Howdy garmanma,

It's been quite a while since I have received a reply from you; I hope all is well and that you are in good health. If a moderator has taken note of my posts and the lack of replies please feel free to step in at any point. Thank you for all your assistance. I will list my latest Event Log below, it was another BSOD:

Event Type: Error
Event Source: System Error
Event Category: (102)
Event ID: 1003
Date: 9/8/2008
Time: 11:23:26 AM
User: N/A
Computer: COMPUTER1
Description:
Error code 1000008e, parameter1 c0000005, parameter2 bf805872, parameter3 f38b0b78, parameter4 00000000.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 53 79 73 74 65 6d 20 45 System E
0008: 72 72 6f 72 20 20 45 72 rror Er
0010: 72 6f 72 20 63 6f 64 65 ror code
0018: 20 31 30 30 30 30 30 38 1000008
0020: 65 20 20 50 61 72 61 6d e Param
0028: 65 74 65 72 73 20 63 30 eters c0
0030: 30 30 30 30 30 35 2c 20 000005,
0038: 62 66 38 30 35 38 37 32 bf805872
0040: 2c 20 66 33 38 62 30 62 , f38b0b
0048: 37 38 2c 20 30 30 30 30 78, 0000
0050: 30 30 30 30 0000


Details
Product: Windows Operating System
ID: 1003
Source: System Error
Version: 5.2
Symbolic Name: ER_KRNLCRASH_LOG
Message: Error code %1, parameter1 %2, parameter2 %3, parameter3 %4, parameter4 %5.

Explanation
A blue screen (Stop error) was reported. The message contains details about the error. A matching event with Event ID 1001 might also appear in the event log. This matching event displays information about the specific error that occurred.

User Action
No user action is required.
--------------------------------------------------------------------------------
Currently there are no Microsoft Knowledge Base articles available for this specific error or event message. For information about other support options you can use to find answers online, see http://support.microsoft.com/default.aspx.
:thumbsup:

Edited by ForcesUndivided, 08 September 2008 - 10:29 AM.


#13 ForcesUndivided

ForcesUndivided
  • Topic Starter

  • Members
  • 46 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:12:40 PM

Posted 10 September 2008 - 10:42 AM

Hello garmanma,

I hope all is well and that you will be able to assist me in the near future. Listed below is my latest error; I created a manual restore per it's suggestion. Thank you for all your assistance:

Event Type: Error
Event Source: sr
Event Category: None
Event ID: 1
Date: 9/10/2008
Time: 11:32:10 AM
User: N/A
Computer: COMPUTER1
Description:
The System Restore filter encountered the unexpected error '0xC0000243' while processing the file 'SrtETmp' on the volume 'HarddiskVolume1'. It has stopped monitoring the volume.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 06 00 00 00 04 00 4e 00 ......N.
0008: 00 00 00 00 01 00 00 c0 .......
0010: 00 00 00 00 00 00 00 00 ........
0018: 00 00 00 00 00 00 00 00 ........
0020: 00 00 00 00 00 00 00 00 ........


Details
Product: Windows Operating System
ID: 1
Source: sr
Version: 5.2
Symbolic Name: EVMSG_DISABLEDVOLUME
Message: The System Restore filter encountered the unexpected error '%2' while processing the file '%3' on the volume '%4'. It has stopped monitoring the volume.

Explanation
System Restore encountered an error when backing up a protected file. This error causes System Restore to stop copying files and purge all existing restore points. System Restore will automatically restart after the next restore point is created.

User Action
System Restore will restart monitoring file changes immediately if you manually create a restore point (if one has not yet been created).

To manually create a restore point

Click the Start button, point to All Programs, point to Accessories, point to System Tools, and then click System Restore.
Click Create a restore point, and then follow the instructions.

#14 usasma

usasma

    Still visually handicapped (avatar is memory developed by my Dad


  • BSOD Kernel Dump Expert
  • 25,091 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Southeastern CT, USA
  • Local time:01:40 PM

Posted 10 September 2008 - 06:09 PM

I'd have to suggest a bunch of tests to ensure that everything is working right followed by analyzing your memory dumps, and then maybe followed with the use of Driver Verifier to further isolate any issues that we may spot.

So, here's how to start:
1) Perform a hard drive diagnostic check using a diagnostic available from the manufacturer of your hard drive. A list of the more common one's is here: http://www.bleepingcomputer.com/forums/t/28744/hard-drive-installation-and-diagnostic-tools/
2) As most of the errors have a memory component, download this memory diagnostic (free): http://www.memtest86.com/
If you don't have an ISO burner program, I'd suggest using this free one to burn the ISO to a CD/DVD: http://isorecorder.alexfeinman.com/v2.htm (you have to use an ISO burner to make the disk bootable).
Once that's done, boot from the disk and let the test run for at least 3 passes (overnight is better). If it starts throwing out errors, stop the test and post back here.
3) Use this link to analyze the last 3 memory dumps: http://forums.majorgeeks.com/showthread.php?t=35246
Copy and paste the results into your next post.

If that doesn't reveal the culprit, then we'll start the Driver Verifier to see if we can force the system to crash out the information that's needed.

BTW - For some reason I'm not doing real good with the notification of replies to topics, so you may have to PM me to get my attention. Or, we could shift this over to the XP forum where I usually hang out.

Edited by usasma, 10 September 2008 - 06:10 PM.
Added all after BTW

My browser caused a flood of traffic, sio my IP address was banned. Hope to fix it soon. Will get back to posting as soon as Im able.

- John  (my website: http://www.carrona.org/ )**If you need a more detailed explanation, please ask for it. I have the Knack. **  If I haven't replied in 48 hours, please send me a message. My eye problems have recently increased and I'm having difficult reading posts. (23 Nov 2017)FYI - I am completely blind in the right eye and ~30% blind in the left eye.<p>If the eye problems get worse suddenly, I may not be able to respond.If that's the case and help is needed, please PM a staff member for assistance.

#15 ForcesUndivided

ForcesUndivided
  • Topic Starter

  • Members
  • 46 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:12:40 PM

Posted 12 September 2008 - 11:22 AM

Howdy,

Thanks for your reply. Before I run through all the tests I am going to give it a week, please leave the thread open for a while. Yesterday I actually ran the disk check in "Safe Mode" with the fix boxes checked. I think it worked this time. Many of my icons flipped back to normal and I have had no crashes. The check always appeared to run in the past but I think Norton Anti-Virus was actually jamming. So far no crashes and my start ups are much faster. Still have the "Bloodhound.Unknown" prompt but the system seems stable. If it crashes again I will be happy to go through all the tests. Thank you for your assistance! I have my account set up to receive an email when a post appears so I will be back with you in a jiff. For some reason I did not receive one for your initial contact, my apologies for the delay.

Edited by ForcesUndivided, 12 September 2008 - 11:25 AM.





0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users