Jump to content

Welcome to Geeks to Go - Register now for FREE

Geeks To Go is a helpful hub, where thousands of volunteer geeks quickly serve friendly answers and support. Check out the forums and get free advice from the experts. Register now to gain access to all of our features, it's FREE and only takes one minute. Once registered and logged in, you will be able to create topics, post replies to existing threads, give reputation to your fellow members, get your own private messenger, post status updates, manage your profile and so much more.

Create Account How it Works
Photo

Physical memory Dump


  • Please log in to reply

#46
realapp

realapp

    Member

  • Topic Starter
  • Member
  • PipPipPip
  • 338 posts
If it did, it didn't say anything. It just loaded windows afterwards.
  • 0

Advertisements


#47
happyrock

happyrock

    Tech Moderator

  • Retired Staff
  • 9,285 posts
Use the Event Viewer to look in the application log for an event called Winlogon...
look in the control panel...administrative tools...event viewer...double click on winlogon..copy and paste it back here...
  • 0

#48
happyrock

happyrock

    Tech Moderator

  • Retired Staff
  • 9,285 posts

I got the same error again. When I did the run command it didn't do anything after I hit enter. Also, just to make sure I entered it all correctly. Does it matter if those are caps or lower case.

NOPE on the all caps...it would/should have flashed a small black box on the screen for a split second if you got it all typed in correctly..after that you should be able to install things while in safe mode
  • 0

#49
realapp

realapp

    Member

  • Topic Starter
  • Member
  • PipPipPip
  • 338 posts
There was more than one of these. I've included 2.





The shell stopped unexpectedly and Explorer.exe was restarted.

For more information, see Help and Support Center at http://go.microsoft....link/events.asp.






Checking file system on C:
The type of the file system is NTFS.
Cleaning up minor inconsistencies on the drive.
Cleaning up 395 unused index entries from index $SII of file 0x9.
Cleaning up 395 unused index entries from index $SDH of file 0x9.
Cleaning up 395 unused security descriptors.
CHKDSK is verifying Usn Journal...
Usn Journal verification completed.
CHKDSK is verifying file data (stage 4 of 5)...
File data verification completed.
CHKDSK is verifying free space (stage 5 of 5)...
Free space verification is complete.
CHKDSK discovered free space marked as allocated in the volume bitmap.
Windows has made corrections to the file system.

74388982 KB total disk space.
10839500 KB in 59481 files.
26384 KB in 5346 indexes.
0 KB in bad sectors.
256534 KB in use by the system.
65536 KB occupied by the log file.
63266564 KB available on disk.

4096 bytes in each allocation unit.
18597245 total allocation units on disk.
15816641 allocation units available on disk.

Internal Info:
90 49 01 00 46 fd 00 00 ab 48 01 00 00 00 00 00 .I..F....H......
12 17 00 00 00 00 00 00 ad 03 00 00 00 00 00 00 ................
fc 18 e3 02 00 00 00 00 36 3d 86 42 00 00 00 00 ........6=.B....
f4 4a a9 08 00 00 00 00 c4 44 84 48 02 00 00 00 .J.......D.H....
0a ea 4f 13 03 00 00 00 0e d6 b9 b6 05 00 00 00 ..O.............
d0 2b 7b a6 00 00 00 00 88 38 07 00 59 e8 00 00 .+{......8..Y...
00 00 00 00 00 30 97 95 02 00 00 00 e2 14 00 00 .....0..........

Windows has finished checking your disk.
Please wait while your computer restarts.


For more information, see Help and Support Center at http://go.microsoft....link/events.asp.
  • 0

#50
happyrock

happyrock

    Tech Moderator

  • Retired Staff
  • 9,285 posts
it fixed some minor problems....you only posted 1 log though...
how is the rootkit detection going...
give me the link where your being helped with the rootkit...

Edited by happyrock, 03 February 2009 - 06:30 PM.

  • 0

#51
realapp

realapp

    Member

  • Topic Starter
  • Member
  • PipPipPip
  • 338 posts
The first one was just this one.


The shell stopped unexpectedly and Explorer.exe was restarted.

For more information, see Help and Support Center at http://go.microsoft....link/events.asp.



I'm not exactly sure how to direct you to the link but I think this is correct.


http://www.geekstogo...mp-t227631.html

Edited by realapp, 03 February 2009 - 07:31 PM.

  • 0

#52
happyrock

happyrock

    Tech Moderator

  • Retired Staff
  • 9,285 posts
yep... you have a MBR rootkit...good news is its easy to fix...
they will probably have you load the recovery console and type fixmbr
The fixmbr command will write a new boot sector and erase the rootkit.


I didn't have the time to read the whole thread so let me know if it finds any more than that 1

Edited by happyrock, 04 February 2009 - 07:14 PM.

  • 0

#53
realapp

realapp

    Member

  • Topic Starter
  • Member
  • PipPipPip
  • 338 posts
Ok, They got rid of all the junk that was on my computer and it seems to be running great. They told me to come back here, just to see if I was suppose to be doing anything further with you! Thanks so much for your help!!!! :)
  • 0

#54
happyrock

happyrock

    Tech Moderator

  • Retired Staff
  • 9,285 posts
your welcome.... :)
no more errors...no more crashes ...then your done...
  • 0






Similar Topics

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

As Featured On:

Microsoft Yahoo BBC MSN PC Magazine Washington Post HP