Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Cannot Read Memory Errors


  • This topic is locked This topic is locked
6 replies to this topic

#1 d4browns

d4browns

  • Members
  • 6 posts
  • OFFLINE
  •  
  • Local time:02:15 PM

Posted 06 August 2010 - 12:57 PM

help. Started having massive slowdowns with comp that then migrated to "cannot read memory errors" associated with mcshield or svchost and then winlogon. eventually got so i could not boot up normally and can only get there in safe mode. (even there get winlogon error). I even deleted the 020 winlogon after first run of hijack this but still same problem. get blue screen of death if I acknowledge the winlogon error with ok or cancel. (fatal error). only other weird thing is a kaqi exe file i found that even google had almost nothing on. thanks for your help in advance!!!!!

EDIT: Removed HJT log, not allowed in XP forum, no evidence of malware issues at this point ~ Hamluis.

Edited by hamluis, 06 August 2010 - 01:58 PM.


BC AdBot (Login to Remove)

 


#2 hamluis

hamluis

    Moderator


  • Moderator
  • 55,248 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:Killeen, TX
  • Local time:02:15 PM

Posted 06 August 2010 - 02:05 PM

Worth reading: Slow Computer-browser Check Here First; It May Not Be Malware - http://www.bleepingcomputer.com/forums/t/87058/slow-computerbrowser-check-here-first;-it-may-not-be-malware/

System manufacturer and model? If custom/self-built...motherboard manufacturer and model?

How large is C: partition, how much free space on C:?

How much RAM installed?

Please post error messages verbatim.

Let's try the following...

Download/install BlueScreenView, http://www.nirsoft.net/utils/blue_screen_view.html.

Double-click BlueScreenView.exe file.

When scanning is done, Edit/Select All.

Then File/Save Selected Items.

Save the report as BSOD.txt.

Open BSOD.txt in Notepad, copy all content and paste it into your next reply.

Louis

#3 d4browns

d4browns
  • Topic Starter

  • Members
  • 6 posts
  • OFFLINE
  •  
  • Local time:02:15 PM

Posted 07 August 2010 - 04:41 AM

Ok - Dell Dimension DIM4600, Intel Pentium 4CPU 2.8 GHz, 2.5 GB Ram. C drive is pretty full. My recollection is its an 80GB hd and there is about 60-65GB used.

Other info: chkdsk seems to run clean.

When I attempt a normal logon now this is the series of events:
- "Winlogon application error, The instruction at "0x00182581" referenced memory at "0x012e0000". The memory could not be read. Select ok to terminate, cancel to debug". [same error happens when i start up in safe mode but the referenced memory changes to "0x00dd0000"]
- if i try either ok or cancel a blue screen appears that says "stop: c000021a (fatal system error) with a status of 0xC0000005"

so i was able to download the blue screen view but it appears not to see any .dmp files. i attempted a search for them on my computer but only found two, one from 2004 and another from 2009 and both weren't in the c:\minidump (i can't find a minidump folder even when i turn on see hidden files/folders). checked my comp properties and confirmed %root sector%\minidump is where they should go. so when i open up blue screen view there is nothing located in either window.

If I leave the winlogon error up on the screen during a normal startup i then also receive:
-Generic Host Process for Win 32 services encountered a prob and needs to close
-Windows Explorer has encountered a problem and needs to close
-winlogon encountered a problem......
and all three offer up the option to send the report to microsoft

I think that is the majority of info to add at the moment. I will go back through the "your comp might be slow" list of recommendations and see if I overlooked something.

#4 d4browns

d4browns
  • Topic Starter

  • Members
  • 6 posts
  • OFFLINE
  •  
  • Local time:02:15 PM

Posted 07 August 2010 - 06:13 AM

attempted a normal bootup and before selecting the user got:
- "svchost application error, The instruction at "0x001a3b57" referenced memory at "0x00000000". The memory could not be read.

Edited by d4browns, 07 August 2010 - 06:17 AM.


#5 Broni

Broni

    The Coolest BC Computer


  • BC Advisor
  • 42,613 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Daly City, CA
  • Local time:12:15 PM

Posted 07 August 2010 - 10:35 PM

Your computer is most likely infected.

With the information you have provided I believe you will need help from the malware removal team. I would like you to start a new thread and post a DDS log HERE and include a link to this thread. Please make sure that you read the information about getting started before you start your thread.

It would be helpful if you post a note here once you have completed the steps in the guide and have started your topic in malware removal. Good luck and be patient. Help is on the way!

My Website

p4433470.gif

My help doesn't cost a penny, but if you'd like to consider a donation, click p22001735.gif


 


#6 d4browns

d4browns
  • Topic Starter

  • Members
  • 6 posts
  • OFFLINE
  •  
  • Local time:02:15 PM

Posted 08 August 2010 - 04:22 AM

http://www.bleepingcomputer.com/forums/t/338081/unknown-infection-discussion-brought-over-from-xp/

This is the link to the new topic. Got all the way through the steps and ran DDS. Really appreciate the help!

#7 hamluis

hamluis

    Moderator


  • Moderator
  • 55,248 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:Killeen, TX
  • Local time:02:15 PM

Posted 08 August 2010 - 07:30 AM

Now that you have posted a DDS log, you should NOT make further changes to your computer (install/uninstall programs, use special fix tools, delete files, edit the registry, etc) unless advised by a MRT Team member, nor should you ask for help elsewhere. Doing so can result in system changes which may not show in the log you already posted.

Further, any modifications you make on your own may cause confusion for the helper assisting you and could complicate the malware removal process which would extend the time it takes to clean your computer.

From this point on, the MRT Team should be the only members that you take advice from, until they have verified your log as clean.

Please be patient. It may take a while to get a response because the MRT Team members are EXTREMELY busy working logs posted before yours. They are volunteers who will help you out as soon as possible. Once you have made your post and are waiting, please DO NOT make another reply until it has been responded to by a member of the MRT Team. Generally the staff checks the forum for postings that have 0 replies as this makes it easier for them to identify those who have not been helped. If you post another response there will be 1 reply. A team member, looking for a new log to work may assume another MRT Team member is already assisting you and not open the thread to respond.

I again urge you please be patient. We have a current backlog of approximately 7 days on malware logs and it may take several days to get a response...but your log will be reviewed and answered as soon as possible. I advise checking your topic once a day for responses as the e-mail notification system is unreliable.

To avoid confusion, I am closing this topic. Good luck with your log :thumbsup:.

Louis




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users