Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Stop Error (0X0000007E) after Windows Screen


  • Please log in to reply
30 replies to this topic

#1 Quilt

Quilt

  • Members
  • 18 posts
  • OFFLINE
  •  
  • Local time:05:53 AM

Posted 25 August 2010 - 08:33 AM

Somehow I got malware on my home HP desktop computer (I am currently on a work computer). Everytime I were to open up an internet browser, another tab would open simutaneously with websiteconfirmreq.com and than it would go to someother website.

I searched all over the internet for steps to remove it. I came accross this forum link http://forums.majorgeeks.com/showthread.php?t=218986
I eventually got to the Windows XP cleanup section link: http://forums.majorgeeks.com/showthread.php?t=139313
As you will see the first thing the above thread tells you to run is Super Antispyware. http://forums.majorgeeks.com/showthread.php?t=127217

So I ran that program, and quarantined/removed all of the suspicious files that the program had found. The program than said to reboot, and so I did. When it rebooted it would get passed the windows logo screen, stay black for about ten seconds, and than reboot. The computer just keeps doing this. I even tried safe mode but the same thing occurs.

I ran the Windows Recovery Console and ran chkdsk /r. It came up with found one or more errors. I inserted the windows cd to the drive to repair, and couln't press F12 to get to the CD to repair windows.

II pressed F1 to enter setup. I changed the primary boot from the hard drive to CD-ROM drive. I was able to get to the Windows CD, and went through the process of repairing Windows. When my computer rebooted I got this message on a green screen (picture also attached):


A problem has been detected and windows has been shut down to prevent damage to your computer.

If this is the first time you've seen this stop error screen, restart your computer. If this screen appers again, follow these steps:

Check to be sure you have adequate disk space. If a driver is identified in the Stop message, disable the driver or check with the manufacturere for driver updates. Try changing video adapters.

Check with your hardware vendor for any BIOS updates. Disable BIOS memory options such as chacing or shadowing. If you need to use safe mode to remove or disable components, restart your computer, press F8 to select Advanced Startup Options, and then select Safe Mode.

Technical information:

*** STOP: 0X0000007E (0XC0000005, 0X004D0004, 0XF7A26A8C, 0XF7A2678C)


Any help or directions on how to fix this?

Thank you everyone in advance for you help!

Attached Files


Edited by hamluis, 25 August 2010 - 01:09 PM.
Moved from XP forum to Am I Infected ~ Hamluis.


BC AdBot (Login to Remove)

 


#2 hamluis

hamluis

    Moderator


  • Moderator
  • 56,106 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Killeen, TX
  • Local time:04:53 AM

Posted 25 August 2010 - 09:57 AM

Hi :thumbsup:.

I could be wrong, but...since you started your malware thread in a different forum...at least, I'm assuming that someone told you to do all these things relative to malware...my opinion is that you should continue your thread in that forum.

If you did not start a malware thread there...and just decided to do these things on your own, without supervision or direction...let me know and I will move your thread here to the appropriate BC malware forum.

Louis

#3 Quilt

Quilt
  • Topic Starter

  • Members
  • 18 posts
  • OFFLINE
  •  
  • Local time:05:53 AM

Posted 25 August 2010 - 10:06 AM

Louis,

Currently, my problem is not with malware. My current problem is getting passed this error message (If possible), and logging into my computer. Once I am able to log in, than my problem will be back with malware. This is the reason why I posted in this forum and not the malware forum.

#4 hamluis

hamluis

    Moderator


  • Moderator
  • 56,106 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Killeen, TX
  • Local time:04:53 AM

Posted 25 August 2010 - 10:18 AM

I understand that you think that...but when malware is on a system, any BSOD that occurs is likely to be attributed to the presence of malware. The BSOD is a symptom that can be attributed to the fact that malware is on the system, IMO. The BSOD is not an isolated problem, indistinguishable from the presence of malware.

To attempt to treat it as if it's a Windows problem when there is known malware...is not something I would suggest/advise and I believe that doing so may unnecessarily complicate the neutralization of the malware.

7E STOP errors occur pretty routinely in malware situations, as you can see by glancing at/reading some of the topics Here.

Louis

#5 Quilt

Quilt
  • Topic Starter

  • Members
  • 18 posts
  • OFFLINE
  •  
  • Local time:05:53 AM

Posted 25 August 2010 - 12:57 PM

I understand that you think that...but when malware is on a system, any BSOD that occurs is likely to be attributed to the presence of malware. The BSOD is a symptom that can be attributed to the fact that malware is on the system, IMO. The BSOD is not an isolated problem, indistinguishable from the presence of malware.

To attempt to treat it as if it's a Windows problem when there is known malware...is not something I would suggest/advise and I believe that doing so may unnecessarily complicate the neutralization of the malware.

7E STOP errors occur pretty routinely in malware situations, as you can see by glancing at/reading some of the topics Here.

Louis


Thanks Louis! You learn something new everyday. If you find this would be better moved to the malware section, than so be it.

#6 Synetech

Synetech

  • Members
  • 149 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Canada
  • Local time:05:53 AM

Posted 25 August 2010 - 04:15 PM

Okay, first thing: you said it was a green screen, but the picture looks yellow (Iím guessing thatís just due to color differences of devices). Moreover, the BSOD is supposed to be blue, but yours is not. Furthermore, there appears to be a scrolling progress bar in the bottom center of the BSOD like the kind you see on the bootscreen. Are you sure this indeed Windows XP? If it is in fact Windows XP, then have you modified the Blue-Screen voluntarily? If not, then some software did it for you.

Try booting into Safe Mode. Take a look at the file \Windows\System.ini. In the [386enh] section, there are probably a couple of entries: MessageBackColor and MessageTextColor. If so, then something definitely messed with intrinsic system settings without your consent, and that is something to worry about. You will want to run a full system scan with a good anti-malware software. There are plenty of articles that walk you through that.


As for the BSOD itself, error 0x7E means that a required file was not found. You said that you removed some malware, so what this tells me is that while the files of the malware were deleted, the entries (likely registry) that point to the files were not. So whatís now happening is that your system is trying to load the malware, but the files are no longer there, and so you get a BSOD. Normally when a file is missing, you get regular errors, but since you are getting a BSOD for missing files, it means that the malware is not being loaded from the standard auto-run locations, but rather from either a service, or more likely a driver.

As a result, it will be undesirable to manually delete the entries since it will take you to the depths of your system, so a mistake can not only cause your system to fail, but can also cause rashes, diarrhea, and nightmares. So I again, I recommend using a proper malware scanner. Before running the malware scanner, you could run Sysinternalsí Autoruns. It would scan your system and display services, drivers, etc. that have missing files. However instead of using Autoruns to remove them, you can just note them down, so that when you run the actual malware scanner, you can cross-reference them for further peace of mind. (I was going to say that you could also use ***** to scan your system to find additional missing files, but I donít want to mention it otherwise I could get banned for giving you help on these boards without being authorized to do so, even though I clearly say to only scan and not remove anything. :thumbsup: )
****** *** ****** * ****; * ***** **** ** *** **** ******* *** ****** ************ ****.

-- Synetech

#7 Quilt

Quilt
  • Topic Starter

  • Members
  • 18 posts
  • OFFLINE
  •  
  • Local time:05:53 AM

Posted 25 August 2010 - 06:50 PM

Synetech,

I appreciate all of the info. However when I attempt to run Safe Mode I get "windows xp setup cannot run under safemode. setup will restart now." I imagine it is still trying to repair from the CD.

It appears it would just be easier to reinstall XP. Luckily I have most of my needed files from April saved on a removable hard drive. Loosing 4 months of data is better than loosing it all.

Unless you have another suggestion on someting to try.

Once again your help is very appreciated. Based on your answers and signature, I apologize if this gets you in trouble.

Edited by Quilt, 25 August 2010 - 06:51 PM.


#8 Synetech

Synetech

  • Members
  • 149 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Canada
  • Local time:05:53 AM

Posted 25 August 2010 - 09:10 PM

I appreciate all of the info. However when I attempt to run Safe Mode I get "windows xp setup cannot run under safemode. setup will restart now."

What does that screen look like? Is it graphical or just text (like the kind you see during the BIOS section)? Is it black? blue?

I imagine it is still trying to repair from the CD.

Makes sense; you initiated a repair-install, so it wants to finish. What happens if you let it?

It appears it would just be easier to reinstall XP. Luckily I have most of my needed files from April saved on a removable hard drive. Loosing 4 months of data is better than loosing it all.

Sure, if youíre in a rush to use that system again, otherwiseÖ

Unless you have another suggestion on someting to try.

ÖI do.

Once again your help is very appreciated. Based on your answers and signature, I apologize if this gets you in trouble.

Donít worry about it, itís not your fault. Itís just that theyíre really strict here about people they havenít approved of giving advice on malware (and yet they donít seem to have rules forbidding unauthorized people on giving advice on hardware even though messing things up with hardware can cause permanent, physical damage whereas messing things up with software would at most require a reinstall :thumbsup: ).
****** *** ****** * ****; * ***** **** ** *** **** ******* *** ****** ************ ****.

-- Synetech

#9 Quilt

Quilt
  • Topic Starter

  • Members
  • 18 posts
  • OFFLINE
  •  
  • Local time:05:53 AM

Posted 26 August 2010 - 07:14 AM

The safe mode black screen comes up (with "safe mode" in all 4 corners), and attempts to run in safe mode. Than an error box pops up with that message listed above.

I can't get to the point of letting the repair finish. Like i said I either get the screen pictured in my first post, or the error message noted above (when i run safe mode of course).

I tried using the Last know good configuration, but it gets to the error screen pictured in the first post and just reboots itself.

#10 Synetech

Synetech

  • Members
  • 149 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Canada
  • Local time:05:53 AM

Posted 26 August 2010 - 10:56 AM

The safe mode black screen comes up (with "safe mode" in all 4 corners), and attempts to run in safe mode. Than an error box pops up with that message listed above.

Do you get the prompt that asks you if you want to continue in safe mode or reboot and use System Restore instead?
****** *** ****** * ****; * ***** **** ** *** **** ******* *** ****** ************ ****.

-- Synetech

#11 Quilt

Quilt
  • Topic Starter

  • Members
  • 18 posts
  • OFFLINE
  •  
  • Local time:05:53 AM

Posted 26 August 2010 - 10:59 AM

No, I only have the option to hit OK.

#12 Synetech

Synetech

  • Members
  • 149 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Canada
  • Local time:05:53 AM

Posted 26 August 2010 - 11:20 AM

When you try to run in safe mode, Windows will display a list of drivers that it loads. It should give you the option to press Esc to avoid loading certain third-party/unsigned drivers. Do you see that for any?
****** *** ****** * ****; * ***** **** ** *** **** ******* *** ****** ************ ****.

-- Synetech

#13 Quilt

Quilt
  • Topic Starter

  • Members
  • 18 posts
  • OFFLINE
  •  
  • Local time:05:53 AM

Posted 26 August 2010 - 11:48 AM

I don't see anywhere to hit ESC during safe mode. However, as I loaded safe mode I kept hitting ESC (even during the list of drivers), but the same error message came up.

#14 Synetech

Synetech

  • Members
  • 149 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Canada
  • Local time:05:53 AM

Posted 26 August 2010 - 12:10 PM

What kind of safe mode did you try? There are several options in the list when you press F8 on startup.

You could try safe boot which should not load any third-party stuff (like the broken malware that used to be there).

Thereís also the recovery console if youíre feeling up to dirty work, but I wouldnít recommend it (I find it to be quite limited; I would rather use pure DOS mode to fix my system).

It makes sense that the repair install did not work. A repair install merely fixes all of the Windows related files and registry settings, without removing or resetting the third-party changes you make (thatís why you retain your documents, programs, and settings and such). So whatís happening with your system now is that the repair install is unable to boot to Windows mode to finish the install because every time it does, that malware driver that used to be on your system is unable to find the file and causes a BSOD. However you cannot boot into safe mode to remove the driver either because the repair install is not complete. Itís a bizarre catch-22 that I am surprised has not come up more often.

What you need to do is to somehow scan that drive for malware and remove the remnants so that Windows can boot normally (and finish the repair install). Since you cannot boot into Windows to do so, you will need a separate OS to do it. I suppose the easiest thing to do would be to use one of those PE (portable environment) discs such as Knoppix, PuppyLinux, DSL, etc. and scan the Windows partition with a malware scanner in that. (Unfortunately I doubt that a malware scanner in one of those would be able to read and write the Windows registry files on the drive, so I donít know how it could remove the driver.)

(Though every few years I try out the ďlatest, greatestĒ distro of Linux, I have yet to see one that I like at all, so I donít know much about current PE discs and what they can or cannot do. I have however seen many instances of people instructing others to use them to fix a Windows installation that cannot boot, so youíll need to ask someone who uses them.)
****** *** ****** * ****; * ***** **** ** *** **** ******* *** ****** ************ ****.

-- Synetech

#15 Quilt

Quilt
  • Topic Starter

  • Members
  • 18 posts
  • OFFLINE
  •  
  • Local time:05:53 AM

Posted 26 August 2010 - 12:25 PM

I tried all three safe modes (normal, with networking, and with command prompt) and all three come up with the same error.

If I am reading that link correctly, the "safe boot" would need to be turned on once I am in. Unfortunately, that is looking more and more less likely.

You lost me with the portable environment discs because I have never used them.

I keep thinking that the re-install is going to be the easier appoach. I mean even if I did somehow get into the computer, it could potentially run worse than normal. And its not really a big loss on my part because I can't think of anything that I have on my computer after April that is of importance.

Question before I do the re-install though. The Windows cd I am trying to repair from is from SP1. It is the CD from my old Dell, but am now on a hand me down HP that had no discs when I got it (If that helps). Is that maybe the cause of me having trouble getting in, the disc being pretty old that is?

A guy at work gave me an extra copy of the Windows SP3 cd that he had, but I can't find where to repair from off of the CD. The SP3 CD options have seemed to differ slightly from the SP1 CD.




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users