Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Stop Error: 0x00000024


  • Please log in to reply
3 replies to this topic

#1 manguy

manguy

  • Members
  • 6 posts
  • OFFLINE
  •  
  • Local time:06:47 AM

Posted 20 January 2010 - 12:50 PM

Well, I tried posting this on the Malwayebytes forum, because I got this error after deleting a virus using it. They don't seem like they're ever gonna help. I figure I'd try it here.

Here's the log of the mbam scan, might not be useful, but i like to make sure

Malwarebytes' Anti-Malware 1.44
Database version: 3573
Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

1/15/2010 9:05:50 PM
mbam-log-2010-01-15 (21-05-50).txt

Scan type: Full Scan (C:\|)
Objects scanned: 287398
Time elapsed: 1 hour(s), 7 minute(s), 56 second(s)

Memory Processes Infected: 2
Memory Modules Infected: 1
Registry Keys Infected: 1
Registry Values Infected: 3
Registry Data Items Infected: 13
Folders Infected: 1
Files Infected: 9

Memory Processes Infected:
C:\Program Files\InternetSecurity2010\IS2010.exe (Rogue.Installer) -> Unloaded process successfully.
C:\WINDOWS\system32\smss32.exe (Trojan.FakeAlert) -> Unloaded process successfully.

Memory Modules Infected:
C:\WINDOWS\system32\helper32.dll (Trojan.FakeAlert) -> Delete on reboot.

Registry Keys Infected:
HKEY_CURRENT_USER\SOFTWARE\IS2010 (Rogue.InternetSecurity2010) -> Quarantined and deleted successfully.

Registry Values Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\internet security 2010 (Rogue.Installer) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\smss32.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Desktop\General\wallpaper (Hijack.Wallpaper) -> Quarantined and deleted successfully.

Registry Data Items Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit (Trojan.FakeAlert) -> Data: c:\windows\system32\winlogon32.exe -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit (Trojan.FakeAlert) -> Data: system32\winlogon32.exe -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit (Hijack.UserInit) -> Bad: (C:\WINDOWS\system32\winlogon32.exe) Good: (userinit.exe) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop\NoChangingWallpaper (Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoActiveDesktopChanges (Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoSetActiveDesktop (Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\activedesktop\NoChangingWallpaper (Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoActiveDesktopChanges (Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoSetActiveDesktop (Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr (Hijack.TaskManager) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

Folders Infected:
C:\Program Files\InternetSecurity2010 (Rogue.InternetSecurity2010) -> Quarantined and deleted successfully.

Files Infected:
C:\Documents and Settings\george\Local Settings\Temp\20.tmp (Rootkit.TDSS) -> Quarantined and deleted successfully.
C:\Documents and Settings\george\Local Settings\Temporary Internet Files\Content.IE5\B707H296\exe[1].exe (Rootkit.TDSS) -> Quarantined and deleted successfully.
C:\Documents and Settings\george\Local Settings\Temporary Internet Files\Content.IE5\L0ITFXBD\SetupIS2010[1].exe (Rogue.Installer) -> Quarantined and deleted successfully.
C:\Program Files\InternetSecurity2010\IS2010.exe (Rogue.Installer) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\smss32.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\helper32.dll (Trojan.FakeAlert) -> Delete on reboot.
C:\WINDOWS\system32\Winlogon32.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\Documents and Settings\george\Start Menu\Internet Security 2010.lnk (Rogue.InternetSecurity2010) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\warning.html (Trojan.FakeAlert) -> Quarantined and deleted successfully.



It was that internet security 2010 virus. At the time, i didn't think of using hijackthis to make a log and post it along with this, but thats a little too late now. So, I finished the scan, it deleted the files, and it had to reboot to completely remove it. So, I do that, I boot up, I get the x24 error. HOWEVER, safe mode AND safe mode with cmd do work. Networking does not, and last good config doesnt. I tried a system restore, and that did nothing. I haven't done much, because of fear of destroying my system. I have a picture i decidded to take with my digital camera, of the bluescreen. The site won't let me upload the picture, ebcause its 2.15 mb's, so i figured it just host it on imageshack

http://img43.imageshack.us/img43/6818/1000005cd.jpg


if the image doesn't last, then this is what it says

"A problem has been detected and Windows has been shut down to prevent damage to your computer.

If this is the first time blahblahblah follow these steps:


Disable or uninstall any anti-virus, disk defragmentation, or backup utilities. Check your hard drive configuration and check for any updated drivers. Run CHKDSK /F to check for hard drive corrutpion, and then restart your computer.

Technical Information:

Stop 0x00000024 (0x001902FE 0xF78C63DC 0xF78C60D8 0x89A93805

I know the numbers following the number are hexidecimal, but i cant exactly interpret them.

I don't have a windows XP CD, and it would be pretty damn hard to get one. I won't be able to check in on this post often, because I don't have a PC at home. Just thought i'd throw those in.

So, any suggestions on what the hell i should do to get rid of this bluescreen error? Because, well, I don't get the error.

BC AdBot (Login to Remove)

 


#2 hamluis

hamluis

    Moderator


  • Moderator
  • 53,859 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:Killeen, TX
  • Local time:06:47 AM

Posted 20 January 2010 - 01:40 PM

STOP 24 errors are generally corrupt (damaged) file systems, IMO.

This is the "official" unofficial spiel, from http://www.aumha.org/a/stop.htm:

"0x00000024: NTFS_FILE_SYSTEM
A problem occurred within NTFS.SYS, the driver file that allows the system to read and write to NTFS file system drives. There may be a physical problem with the disk, or an Interrupt Request Packet (IRP) may be corrupted. Other common causes include heavy hard drive fragmentation, heavy file I/O, problems with some types of drive-mirroring software, or some antivirus software."

As suggested at that site...I would try running the chkdsk /r command from the XP Recovery Console...but I would not be surprised it it does not resolve the issue. If chkdsk /r cannot complete, it will probably be because it has detected a file system problem which it cannot overcome.

How to Create a Bootable XP Recovery Console CD - http://www.bleepingcomputer.com/forums/t/276527/how-to-create-a-bootable-xp-recovery-console-cd/

How to use CHKDSK in the XP Recovery Console - http://pirules3.14.googlepages.com/recovery_console_chkdsk

I would follow that up with running the correct respective hard drive diagnostic (long test), to assure myself that it is NOT a hard drive problem.

Hard Drive Installation and Diagnostic Tools - http://www.bleepingcomputer.com/forums/t/28744/hard-drive-installation-and-diagnostic-tools/ and Bootable Hard Drive Diagnostics - Vox - http://usasma.vox.com/library/post/bootabl...iagnostics.html.

Louis

#3 Jazzgirl

Jazzgirl

  • Members
  • 55 posts
  • OFFLINE
  •  
  • Local time:06:47 AM

Posted 20 January 2010 - 01:41 PM

I went to Microsoft's Knowledgebase and did a search on the error. There are several solutions but you might want to start here.

http://social.answers.microsoft.com/Forums...2-506c42f6ee63/

On edit: Oops...I see Hamlius posted a little more comprehensive help. I think this link pretty much says the same thing about the type of problem you have.

Hi Ham! Long time no see! I remember you from the About site and here as well.....neighbor! :thumbsup:

Edited by Jazzgirl, 20 January 2010 - 01:44 PM.


#4 hamluis

hamluis

    Moderator


  • Moderator
  • 53,859 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:Killeen, TX
  • Local time:06:47 AM

Posted 20 January 2010 - 01:45 PM

I just glanced at the log data you posted...I see mention of TDSS rootkit.

That's your problem, I suspect. From what I see, attempted self-cures are ineffective.

I suggest that you follow the administrative procedures at How to post a HijackThis Log - http://www.bleepingcomputer.com/tutorials/how-to-post-a-hijackthis-log/ and get the assistance you seem to need.

Louis




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users