Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Winrscmde has stoppped working


  • Please log in to reply
2 replies to this topic

#1 tenclaws

tenclaws

  • Members
  • 1 posts
  • OFFLINE
  •  
  • Local time:08:27 PM

Posted 26 June 2012 - 03:24 PM

Hello. I am also new here and having a nearly identical problem to PastorGeiger.

Windows vista,Studio XPS 1640 64 bit.

two days ago "Winrscmde has stoppped working" popped up. I downloaded PC tools spyware doctor and it removed a few things but the window was still popping up. I did a search and found your site and downloaded TDSSkiller and it found two serious trojan infections which i told it to remove. The box is no longer popping up but I'm having other issues. I'm now having lag and script errors when using firefox, When I restart my computer it does a number of odd things: It will first take me to "Windows error recovery" page. This gives two options "launch startup repair (recommended)" and "start windows normally". I'll click on the startup repair and it will loop right back around to the same screen. When I chose start windows normally it does one of 3 things. 1. starts normally and gives "windows has recovered from and unexpected shutdown" I'll have the details of that below 2. shuts off entirely while processing 3. Blue screen c000021a {fatal system error} and dumps physical memory to disk. which will also take me back to the startup options page.

details of #1

Windows has recovered from an unexpected shutdown

problem event name. Bluescreen
OS Version 6.06002.2.2.0.7683
Locale ID 1033

Additional Information
BCCode C000021a
BCP1 fffff880006477C0
BCP2 00000000000000000
BCP3 FFFFFFFFc0000001
BCP4 00000000001004E8
OS Version 6_0_6002
Service Pack 2_0
Product 768_1

files that help describe the problem
C:\windows\minidump\mini062612-01.dmp
C:\users\Crystal\Appdata\temp\wer-112835-0.sysdata.xml
C:\users\Crystal\appdata\temp\wercbes.tmp.version.txt

I'd really like to avoid un and re- installing my entire system if I can avoid it. HELP!

BC AdBot (Login to Remove)

 


#2 ElFasso

ElFasso

  • Members
  • 229 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Belgium
  • Local time:04:27 AM

Posted 28 June 2012 - 01:51 AM

This could be a sign that some parts of the infection (rootkit) are still there...

We need to analyse the BSOD;

Download BlueScreenView:
==> http://www.nirsoft.net/utils/blue_screen_view.html
  • Unzip downloaded file and double click on BlueScreenView.exe to run the program.
  • When scanning is done, go to EDIT - Select All.
  • Go to FILE - SAVE Selected Items, and save the report as BSOD.txt.
  • Open BSOD.txt in Notepad, copy all of the content, and paste it into your next reply.

Edited by ElFasso, 28 June 2012 - 01:52 AM.


#3 Elise

Elise

    Bleepin' Blonde


  • Malware Study Hall Admin
  • 60,984 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:Romania
  • Local time:06:27 AM

Posted 29 June 2012 - 01:46 AM

Hello, can you use your computer in Safe mode, or does the same problem occur there as well?

regards, Elise


"Now faith is the substance of things hoped for, the evidence of things not seen."

 

Follow BleepingComputer on: Facebook | Twitter | Google+ | lockerdome

 

Malware analyst @ Emsisoft





0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users