Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Winlogon.exe-application Error


  • Please log in to reply
4 replies to this topic

#1 jesusfreak21787

jesusfreak21787

  • Members
  • 3 posts
  • OFFLINE
  •  
  • Local time:09:54 AM

Posted 23 December 2006 - 11:59 PM

Hello.
I have an error with my winlogon.exe where right after I boot up my laptop it will sometimes come up with an application error saying:

The instruction at "0x00ff73ec" referenced memory at "0x00000000." The memory could not be "read."

This has come up about 4 times today (out of about 6 start ups).

BC AdBot (Login to Remove)

 


#2 jesusfreak21787

jesusfreak21787
  • Topic Starter

  • Members
  • 3 posts
  • OFFLINE
  •  
  • Local time:09:54 AM

Posted 24 December 2006 - 01:40 AM

Oh, one more thing... once I push ok on the pop-up I get the blue screen of death.

#3 usasma

usasma

    Still visually handicapped (avatar is memory developed by my Dad


  • BSOD Kernel Dump Expert
  • 25,091 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Southeastern CT, USA
  • Local time:01:54 PM

Posted 25 December 2006 - 09:19 AM

1) What does the BSOD say? http://www.bleepingcomputer.com/forums/top...tml#entry409491

2) Have you scanned your system for malware? If not, I'd suggest this free, online scan (it's even a good idea to do a "double-check"): http://safety.live.com/
My browser caused a flood of traffic, sio my IP address was banned. Hope to fix it soon. Will get back to posting as soon as Im able.

- John  (my website: http://www.carrona.org/ )**If you need a more detailed explanation, please ask for it. I have the Knack. **  If I haven't replied in 48 hours, please send me a message. My eye problems have recently increased and I'm having difficult reading posts. (23 Nov 2017)FYI - I am completely blind in the right eye and ~30% blind in the left eye.<p>If the eye problems get worse suddenly, I may not be able to respond.If that's the case and help is needed, please PM a staff member for assistance.

#4 jesusfreak21787

jesusfreak21787
  • Topic Starter

  • Members
  • 3 posts
  • OFFLINE
  •  
  • Local time:09:54 AM

Posted 25 December 2006 - 01:24 PM

The BSOD said:

STOP: c000021a {Fatal System Error}
The Windows Logon Process System process terminated unexpectedly with a status of 0xc0000005 (0x00000000 0x00000000).
The system has been shut down.

The application error's description in Event Viewer is:

Fault bucket 253728360

I found one dmp file which, using the how to obtained the following:


Microsoft ® Windows Debugger Version 6.6.0007.5
Copyright © Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Documents and Settings\All Users\Application Data\Microsoft\Dr Watson\user.dmp]
User Mini Dump File: Only registers, stack and portions of memory are available

Comment: 'Dr. Watson generated MiniDump'
Windows XP Version 2600 (Service Pack 2) UP Free x86 compatible
Product: WinNt, suite: SingleUserTS Personal
Debug session time: Sat Dec 23 20:06:18.000 2006 (GMT-8)
System Uptime: not available
Process Uptime: 0 days 0:06:59.000
Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols

Executable search path is:
..................................................................................
This dump file has an exception of interest stored in it.
The stored exception information can be accessed via .ecxr.
(5a8.c4): Access violation - code c0000005 (first/second chance not available)
eax=00000000 ebx=01080004 ecx=011bfed0 edx=011bfef4 esi=00070000 edi=0006f108
eip=00fb73ec esp=011bfef4 ebp=011bff84 iopl=0 nv up ei pl nz ac pe nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000216
*** WARNING: Unable to verify checksum for msupdate32.dll
*** ERROR: Module load completed but symbols could not be loaded for msupdate32.dll
msupdate32+0x73ec:
00fb73ec 803832 cmp byte ptr [eax],32h ds:0023:00000000=??
0:010> !analyse -v
No export analyse found

Also, windows did the whole send an error report thing and then clicking on more information it said that windows detected the Winlogon Trojan/Worm virus on my computer.

Inregards to the scanning, I preformed that exact scan right after getting the BSOD (and once I was able to turn the computer on without the error) and it showed that I had three problem files (I forget exactly what type they were). It wasn't able to delete them so I went into Safety Mode and deleted them and they have not come back yet. They are:

C:\windows\system32\csbdt.exe
C:\windows\system32\dmgdt.exe
C:\windows\system32\dmwvr.exe

I really hope all this helps. Thanks for the help!

#5 usasma

usasma

    Still visually handicapped (avatar is memory developed by my Dad


  • BSOD Kernel Dump Expert
  • 25,091 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Southeastern CT, USA
  • Local time:01:54 PM

Posted 25 December 2006 - 02:18 PM

I've seen a lot of these in the last week or so.

Do these free, online scans (again for the first one) to double and triple check your system:

http://safety.live.com/
http://housecall.trendmicro.com/

You did the right thing - but I don't know if that's all that there is to this bugger! If they reappear, I'd have to suggest posting a HJT log in the HiJack This log forums: http://www.bleepingcomputer.com/forums/f/22/virus-trojan-spyware-and-malware-removal-logs/

From the reports on the web, it's likely that this didn't remove all of the problems - but at least you've made a start!
My browser caused a flood of traffic, sio my IP address was banned. Hope to fix it soon. Will get back to posting as soon as Im able.

- John  (my website: http://www.carrona.org/ )**If you need a more detailed explanation, please ask for it. I have the Knack. **  If I haven't replied in 48 hours, please send me a message. My eye problems have recently increased and I'm having difficult reading posts. (23 Nov 2017)FYI - I am completely blind in the right eye and ~30% blind in the left eye.<p>If the eye problems get worse suddenly, I may not be able to respond.If that's the case and help is needed, please PM a staff member for assistance.




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users