Jump to content

Welcome to Geeks to Go - Register now for FREE

Geeks To Go is a helpful hub, where thousands of volunteer geeks quickly serve friendly answers and support. Check out the forums and get free advice from the experts. Register now to gain access to all of our features, it's FREE and only takes one minute. Once registered and logged in, you will be able to create topics, post replies to existing threads, give reputation to your fellow members, get your own private messenger, post status updates, manage your profile and so much more.

Create Account How it Works
Photo

Tidserv Activity 2 - Frequent Norton Warning [Solved]


  • This topic is locked This topic is locked

#16
Kipford

Kipford

    Member

  • Topic Starter
  • Member
  • PipPip
  • 14 posts
I didn't get any indication from Norton on what was deleted, but here is the Stop Code I'm getting:

0x0000007E (0xC0000005, 0xA89114CC, 0xBA4CF494, 0xBA4CF190)
  • 0

Advertisements


#17
Kipford

Kipford

    Member

  • Topic Starter
  • Member
  • PipPip
  • 14 posts
I didn't get any indication from Norton on what was deleted, but here is the Stop Code I'm getting:

0x0000007E (0xC0000005, 0xA89114CC, 0xBA4CF494, 0xBA4CF190)
  • 0

#18
Kipford

Kipford

    Member

  • Topic Starter
  • Member
  • PipPip
  • 14 posts
I can't find any indication of what file(s) might have been deleted. I only have the Stop Code: 0x0000007E (0xC0000005, 0xA89114CC, 0xBA4CF494, 0xBA4CF190)
  • 0

#19
Essexboy

Essexboy

    GeekU Moderator

  • Retired Staff
  • 69,964 posts
Could you go to C:\windows\minidumps please and zip the latest two or three dates that are there
Attach the dumps and I will see if I can determine which driver is causing the problem
  • 0

#20
Kipford

Kipford

    Member

  • Topic Starter
  • Member
  • PipPip
  • 14 posts
I think I found the bad drivers, and, as you suspected, I think MRXSMB.SYS was one of them.

I went to the Events Log in Administrative Tools, and two errors show up around the same time as the RunFix, when Norton says it identified Rooot.ZeroAccess and the system froze (I then had to cold boot, and the endless Blue Screens started). The event errors state:

"File replacement was attempted on the protected system c:\windows\system32\mrxsmb.sys. This file was restored to the original version to maintain system stability. The file version of the system is 5.1.2600.6133" and

"Could not load RDR device driver"

I replaced Mrxsmb.sys and Rdbss.sys, and that Blue Scrren error went away, replaced by a different Blue Screen error (I still can only boot in Safe Mode). The new Blue Screen Stop is a "Page_Fault_In_Nonpaged_Area" error. At this point I'm ready to scrub this and reformat my PC, unless you recommed something else. I have appreciated all of you assistance very much but am starting to come to the realization that even if I get everything up and running again I'm going to have ongoing issues due to the degree of integration with my system that this virus has caused.
  • 0

#21
Essexboy

Essexboy

    GeekU Moderator

  • Retired Staff
  • 69,964 posts
The quickest option would be to reinstall the system as I suspect Norton did not reset the registry entries for that file among other things

Sometimes it is the only way to repair the damage

If you decide to do that and need assistance let me know
  • 0

#22
Kipford

Kipford

    Member

  • Topic Starter
  • Member
  • PipPip
  • 14 posts
Thank you. I'll be all set in reformatting and reinstalling.

I've backed up all my document files this morning in preparation/anticipation of that outcome. I made sure not to backup any executables, sys or dll files, as they may be corrupted.

If I have any trouble, I'll post here.

Thanks for all your time and assistance. It is greatly appreciated, as is the Geekstogo baord as a resource for those of us helpless souls!
  • 0

#23
Essexboy

Essexboy

    GeekU Moderator

  • Retired Staff
  • 69,964 posts
My pleasure :)
  • 0

#24
Essexboy

Essexboy

    GeekU Moderator

  • Retired Staff
  • 69,964 posts
Since this issue appears to be resolved ... this Topic has been closed. Glad we could help. :)

If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.

Everyone else please begin a New Topic.
  • 0






Similar Topics

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

As Featured On:

Microsoft Yahoo BBC MSN PC Magazine Washington Post HP