Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

STOP 0x0000008E error in normal mode


  • Please log in to reply
10 replies to this topic

#1 coiol

coiol

  • Members
  • 31 posts
  • OFFLINE
  •  
  • Local time:01:50 PM

Posted 04 January 2009 - 01:11 AM

A few weeks ago, I opened an unsafe .exe file (dumb move on my part, I know) and Norton popped up with these virus detected messages. A day or two later, I couldn't boot my computer properly. Here's the first thread I posted in the malware forum - the problem hasn't been resolved yet but Buckeye_Sam suggested that I post here to try to address the STOP error. http://www.bleepingcomputer.com/forums/t/187725/windows-update-redirecting-to-msn-homepage-stop0x0000008e-error-with-normal-mode/

Basically, at the beginning, if I tried to boot into normal mode, I would get a STOP: 0x0000008E (0xC0000005, 0xEE887B8A, 0xEBCDA724, 0x00000000) error less than 1 minute after typing in my password. After trying all of the scans in the other thread (I have posted a lot of logs if they are of any help), the problem has now changed a tiny bit.

The first time I booted into safe mode, an "Administrator" username appeared with the same password as my normal username (let's call it "Name"). Originally they both had the same STOP: 0x0000008E (0xC0000005, 0xEE887B8A, 0xEBCDA724, 0x00000000) error 1 minute after booting into normal mode, but now "Name" doesn't even get that far. It freezes and is completely unresponsive other than the mouse cursor moving around before the icons even load (so it's just the desktop background). "Administrator" now loads programs for about a minute, and right as MSN Messenger is finishing to load, I get a slightly different STOP error. It's now STOP: 0x0000008E (0xC0000005, 0xEE2F2B8A, 0xEBF0E7E8, 0x00000000).

I'm on a Dell Inspiron 9400, and I can't connect to Windows Update because of another issue that is detailed in the other thread. I'm also in Korea so I don't have access to English Windows XP discs at the moment but I might be able to track them down if it's necessary.

Any help would be greatly appreciated :flowers: This is my only computer and I'm stuck in a foreign country and all of that :thumbsup:

BC AdBot (Login to Remove)

 


#2 Budapest

Budapest

    Bleepin' Cynic


  • Moderator
  • 23,573 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:04:50 AM

Posted 04 January 2009 - 02:42 AM

You can make your own Recovery Console CD with this file:

http://www.thecomputerparamedic.com/files/rc.iso

If you're not sure how to do this write back for more instructions.

Insert the Recovery Console CD into the CD drive, and then restart the computer. Click to select any options that are required to start the computer from the CD drive if you are prompted. When the "Welcome to Setup" screen appears, press R to start the Recovery Console. If you have a dual-boot or multiple-boot computer, select the installation that you must access from the Recovery Console. When you are prompted, type the Administrator password. If the administrator password is blank, just press ENTER.

Type: chkdsk /r

It's important to have a space before the "/".

To exit the Recovery Console and restart the computer, type exit at the command prompt, and then press ENTER.
The power of accurate observation is commonly called cynicism by those who haven't got it.

—George Bernard Shaw

#3 coiol

coiol
  • Topic Starter

  • Members
  • 31 posts
  • OFFLINE
  •  
  • Local time:01:50 PM

Posted 04 January 2009 - 04:35 AM

Sorry, I don't know how to burn an .iso file. Are there any good freeware programs that can do it?

#4 usasma

usasma

    Still visually handicapped (avatar is memory developed by my Dad


  • BSOD Kernel Dump Expert
  • 25,089 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Southeastern CT, USA
  • Local time:02:50 PM

Posted 04 January 2009 - 08:58 AM

A nice, free powertoy for ISO burning: http://isorecorder.alexfeinman.com/isorecorder.htm
My browser caused a flood of traffic, sio my IP address was banned. Hope to fix it soon. Will get back to posting as soon as Im able.

- John  (my website: http://www.carrona.org/ )**If you need a more detailed explanation, please ask for it. I have the Knack. **  If I haven't replied in 48 hours, please send me a message. My eye problems have recently increased and I'm having difficult reading posts. (23 Nov 2017)FYI - I am completely blind in the right eye and ~30% blind in the left eye.<p>If the eye problems get worse suddenly, I may not be able to respond.If that's the case and help is needed, please PM a staff member for assistance.

#5 coiol

coiol
  • Topic Starter

  • Members
  • 31 posts
  • OFFLINE
  •  
  • Local time:01:50 PM

Posted 04 January 2009 - 09:48 AM

Unfortunately I can't install that application in Safe Mode. Is there another program that might work in Safe Mode, or do I have to burn the .iso on another computer?

#6 usasma

usasma

    Still visually handicapped (avatar is memory developed by my Dad


  • BSOD Kernel Dump Expert
  • 25,089 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Southeastern CT, USA
  • Local time:02:50 PM

Posted 04 January 2009 - 09:51 AM

Check our freeware replacements thread for some options: http://www.bleepingcomputer.com/forums/topic3616.html
You may have to try several until you find one that'll install in Safe Mode.
My browser caused a flood of traffic, sio my IP address was banned. Hope to fix it soon. Will get back to posting as soon as Im able.

- John  (my website: http://www.carrona.org/ )**If you need a more detailed explanation, please ask for it. I have the Knack. **  If I haven't replied in 48 hours, please send me a message. My eye problems have recently increased and I'm having difficult reading posts. (23 Nov 2017)FYI - I am completely blind in the right eye and ~30% blind in the left eye.<p>If the eye problems get worse suddenly, I may not be able to respond.If that's the case and help is needed, please PM a staff member for assistance.

#7 coiol

coiol
  • Topic Starter

  • Members
  • 31 posts
  • OFFLINE
  •  
  • Local time:01:50 PM

Posted 05 January 2009 - 02:04 AM

I burned the disc and tried to boot up Recovery Console, but while the blue DOS-looking screen and various things were loading (before I could press R to do anything), I got hit with another blue screen. This time it's STOP: 0x0000007E (0xC0000005, 0xF786A0BF, 0xF7CB6208, 0xF7CB5F08) pci.sys - Address F786A0BF base at F7863000 Datestamp 3b7d855c

#8 Budapest

Budapest

    Bleepin' Cynic


  • Moderator
  • 23,573 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:04:50 AM

Posted 05 January 2009 - 02:12 AM

If you can boot into Safe Mode try this:

Right click on the C drive in Explorer and go Properties > Tools > Check Now (under Error Checking). Check both boxes then click "Start Now". A message will pop up saying that Error Checking will run after you restart the computer. Restart the computer and Error Checking will run automatically after the restart. After it’s finished it will restart into Windows automatically.
The power of accurate observation is commonly called cynicism by those who haven't got it.

—George Bernard Shaw

#9 coiol

coiol
  • Topic Starter

  • Members
  • 31 posts
  • OFFLINE
  •  
  • Local time:01:50 PM

Posted 05 January 2009 - 03:30 AM

If I check either or both of those options, it says "Windows is unable to complete the disk check."

By the way, I can't do System Restore either. Could all of these Windows/Microsoft-related problems (inc. Windows Update and Hotmail too) be due to the malware?

#10 Budapest

Budapest

    Bleepin' Cynic


  • Moderator
  • 23,573 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:04:50 AM

Posted 05 January 2009 - 04:30 AM

Try running this scan:

http://www.bleepingcomputer.com/forums/t/131299/how-to-use-sdfix/
The power of accurate observation is commonly called cynicism by those who haven't got it.

—George Bernard Shaw

#11 coiol

coiol
  • Topic Starter

  • Members
  • 31 posts
  • OFFLINE
  •  
  • Local time:01:50 PM

Posted 06 January 2009 - 03:08 AM

No progress on the Recovery Console, but my "Name" account is back to crashing with a STOP: 0x0000008E error, so I suppose that's progress ;)

Here's the SDFix log:


SDFix: Version 1.240
Run by Glenn on Tue 01/06/2009 at 03:56 PM

Microsoft Windows XP [Version 5.1.2600]
Running From: C:\SDFix

Checking Services :


Restoring Default Security Values
Restoring Default Hosts File

Rebooting


Checking Files :

No Trojan Files Found






Removing Temp Files

ADS Check :



Final Check :

catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-01-06 16:25:05
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden services & system hive ...

disk error: C:\WINDOWS\system32\config\system, 0
scanning hidden registry entries ...

disk error: C:\WINDOWS\system32\config\software, 0
disk error: C:\Documents and Settings\Glenn\ntuser.dat, 0
scanning hidden files ...

disk error: C:\WINDOWS\

please note that you need administrator rights to perform deep scan

Remaining Services :




Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"="C:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe:*:Enabled:AOL Application Loader"
"C:\\Program Files\\Common Files\\AolCoach\\en_en\\player\\AOLNySEV.exe"="C:\\Program Files\\Common Files\\AolCoach\\en_en\\player\\AOLNySEV.exe:*:Enabled:AOL"
"C:\\Program Files\\Dell\\MediaDirect\\PCMService.exe"="C:\\Program Files\\Dell\\MediaDirect\\PCMService.exe:*:Enabled:CyberLink PowerCinema Resident Program"
"C:\\Program Files\\uTorrent\\uTorrent.exe"="C:\\Program Files\\uTorrent\\uTorrent.exe:*:Enabled:æTorrent"
"C:\\Program Files\\SopCast\\adv\\SopAdver.exe"="C:\\Program Files\\SopCast\\adv\\SopAdver.exe:*:Enabled:SopCast Adver"
"C:\\Program Files\\SopCast\\SopCast.exe"="C:\\Program Files\\SopCast\\SopCast.exe:*:Enabled:SopCast Main Application"
"C:\\Program Files\\Mozilla Firefox\\firefox.exe"="C:\\Program Files\\Mozilla Firefox\\firefox.exe:*:Enabled:Firefox"
"C:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe"="C:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe:*:Enabled:Logitech Desktop Messenger"
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"="C:\\Program Files\\Windows Live\\Messenger\\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"
"C:\\Program Files\\NATEON\\BIN\\NateOnMain.exe"="C:\\Program Files\\NATEON\\BIN\\NateOnMain.exe:*:Enabled:NATE ON"
"C:\\WINDOWS\\system32\\skcbgm.exe"="C:\\WINDOWS\\system32\\skcbgm.exe:*:Enabled:SK Communications Cyworld BGM Player"
"C:\\Program Files\\Messenger\\msmsgs.exe"="C:\\Program Files\\Messenger\\msmsgs.exe:*:Enabled:Windows Messenger"
"C:\\Program Files\\Bonjour\\mDNSResponder.exe"="C:\\Program Files\\Bonjour\\mDNSResponder.exe:*:Enabled:Bonjour"
"C:\\Program Files\\iTunes\\iTunes.exe"="C:\\Program Files\\iTunes\\iTunes.exe:*:Enabled:iTunes"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe"="C:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe:*:Enabled:Logitech Desktop Messenger"
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"="C:\\Program Files\\Windows Live\\Messenger\\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"

Remaining Files :



Files with Hidden Attributes :

Wed 22 Oct 2008 949,072 A.SHR --- "C:\Program Files\Spybot - Search & Destroy\advcheck.dll"
Mon 15 Sep 2008 1,562,960 A.SHR --- "C:\Program Files\Spybot - Search & Destroy\SDHelper.dll"
Tue 29 Jan 2008 1,404,240 A.SHR --- "C:\Program Files\Spybot - Search & Destroy\SDUpdate.exe"
Tue 29 Jan 2008 5,146,448 A.SHR --- "C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe"
Tue 16 Sep 2008 1,833,296 A.SHR --- "C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe"
Wed 22 Oct 2008 962,896 A.SHR --- "C:\Program Files\Spybot - Search & Destroy\Tools.dll"
Wed 30 Apr 2008 88 ..SHR --- "C:\WINDOWS\system32\E98FE3C18F.sys"
Wed 30 Apr 2008 2,828 A.SH. --- "C:\WINDOWS\system32\KGyGaAvL.sys"
Fri 25 Jul 2008 351 ...H. --- "C:\Program Files\Daum\DaumIE\CreateIEShortcut.reg"
Thu 29 May 2008 106,496 ...H. --- "C:\Program Files\Daum\DaumIE\DaumBho2.dll"
Wed 6 Aug 2008 138,648 ...H. --- "C:\Program Files\Daum\DaumIE\DaumIEi.exe"
Wed 14 May 2008 53,248 ...H. --- "C:\Program Files\Daum\DaumIE\DaumIEHistory.exe"
Fri 9 May 2008 1,301 ...H. --- "C:\Program Files\Daum\DaumIE\DaumShortcut.reg"
Thu 15 May 2008 351 ...H. --- "C:\Program Files\Daum\DaumIE\RemoveIEShortcut.reg"
Fri 7 Oct 2005 1,847,296 ...HR --- "C:\Program Files\Microsoft Works Suite 2006\Setup\LAUNCHER.EXE"
Fri 7 Oct 2005 62,464 ...HR --- "C:\Program Files\Microsoft Works Suite 2006\Setup\MNYINSTA.DLL"
Fri 7 Oct 2005 95,232 ...HR --- "C:\Program Files\Microsoft Works Suite 2006\Setup\RMVSUITE.EXE"
Fri 7 Oct 2005 36,864 ...HR --- "C:\Program Files\Microsoft Works Suite 2006\Setup\SETUPLNG.DLL"
Fri 7 Oct 2005 20,480 ...HR --- "C:\Program Files\Microsoft Works Suite 2006\Setup\UNREGWTR.EXE"
Sun 12 Aug 2007 0 A.SH. --- "C:\Documents and Settings\All Users\DRM\Cache\Indiv01.tmp"
Sat 30 Jun 2007 103,538 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\972f9ceb5c3be430fe6cdcb43653d74d\BIT16.tmp"
Sat 30 Jun 2007 490,736 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\c23140ab2b4cffaee396a230df8b1229\BIT13.tmp"
Sat 7 Jun 2008 40,960 ...H. --- "C:\Documents and Settings\Glenn\Desktop\thesis\saving face\~WRL1414.tmp"
Sun 17 Jun 2007 8 A..H. --- "C:\Documents and Settings\All Users\Application Data\GTek\GTUpdate\AUpdate\Channels\ch1\lock.tmp"
Sun 17 Jun 2007 8 A..H. --- "C:\Documents and Settings\All Users\Application Data\GTek\GTUpdate\AUpdate\Channels\ch2\lock.tmp"
Sun 17 Jun 2007 8 A..H. --- "C:\Documents and Settings\All Users\Application Data\GTek\GTUpdate\AUpdate\Channels\ch3\lock.tmp"
Sun 17 Jun 2007 8 A..H. --- "C:\Documents and Settings\All Users\Application Data\GTek\GTUpdate\AUpdate\Channels\ch4\lock.tmp"
Sun 17 Jun 2007 8 A..H. --- "C:\Documents and Settings\All Users\Application Data\GTek\GTUpdate\AUpdate\Channels\ch5\lock.tmp"
Sun 17 Jun 2007 8 A..H. --- "C:\Documents and Settings\All Users\Application Data\GTek\GTUpdate\AUpdate\Channels\ch6\lock.tmp"

Finished!




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users