Help please! Stop Error

  • Thread starter Thread starter nybarton
  • Start date Start date
nybarton said:
Nass......

I'll get to your instructions in a moment. I wanted to tell you that I did
run SuperAntispyware in regular mode and it did scan the registry without
problems. It also scanned the memory without problem, and it found some 57
threats (all cookies) when scanning the files. I eliminated those cookies.

Now, to your instructions:

Instruction: "I would like you to perform the following:
Go to Add/Remove programs and see if there is a funny (or unfamiliar to you)
program you can search the net for the ones you don't know."

I did this and there are no unfamiliar programs as far as I can tell.
However, I don't know if there is a way to make a copy of the Program list
for review. There is one program I do want to get rid of, a toolbar, but I
can't remove it. When I click on change/remove, nothing happens. The screen
flickers and the sound I have assigned for program closings is played. There
were a couple of other old programs I no longer use so I did remove them
without a problem. I don't know how to remove the toolbar and the program
does not appear in Start/All Programs.

Instruction: Then about the error, I think spybot is trying to get the
definitions for
the zlob.DNSchanger to protect your machine from any malicious attacker may
in the future change your DNS to a bad one.
Open the Spybot and run the update engine and a pop-up will appear for you
to select from many one of them will be TCP/IP!"

I downloaded the TCP/IPI update and ran Spybot again (in regular mode). That
apparently took care of the zlob problem. The warning message did not appear
again and I got a "congratulations" message that Spybot found no problems
during the scan.

I will attempt the balance of your instructions tomorrow (can't do it
tonight) regarding downloading AVG and uninstalling McAfee, etc.

Thanks and have a great evening. If you're in the UK, then no doubt you're
already asleep as of this writing. I'll communicate with you again tomorrow.
Click to expand...

To delete/remove this toolbar try the following:
Open the windows Explorer locate the path for it and Shift Delete.
The path will look like this:
C:\Program Files\<ToolbarName>
Or download this tool:
http://www.ccleaner.com
Please read the help file comes with it to get the benefit of using and in
the right way, as it can be harmful if you told it to delete a system file.
Also locate the :
C:\WINDOWS\system32\spool\drivers\w32x86\3\WrtMon.exe
and remove it.
Complete the reset of instructions and the system file checker , then the
log file for hijackthis log and compare to see if there is an entry for this
bad entry.
Good luck.
nass
 
Good morning Nass.........

I deleted the toolbar from C:\Program Files\<Toolbar>, but it still resides
on the Program list in Control Panel Add/Remove Programs. I don't know how
to remove it from there. I looked at ccleaner.com but it appears a bit too
complicated right now. The toolbar is inactive, it does not cause any
problems, but for some reason I just can't get rid of it with the Add/Remove
feature.

Before I get rid of the WrtMon.exe file in the
C:\WINDOWS\SYSTEM32\SPOOL\DRIVERS\W32X86\3 folder, there also exists in that
same folder what appears to be a companion file, Wrtproc.exe (has the same
logo). The Wrtproc.exe was created on Sept. 19, 2006 and the WrtMon.exe on
Sept. 20, 2006. Should I delete that file as well?

I'll go forward with the rest of your instructions after I receive your
answer to this post. Thanks.

nybarton (aka legality)
 
nybarton said:
Good morning Nass.........

I deleted the toolbar from C:\Program Files\<Toolbar>, but it still resides
on the Program list in Control Panel Add/Remove Programs. I don't know how
to remove it from there. I looked at ccleaner.com but it appears a bit too
complicated right now. The toolbar is inactive, it does not cause any
problems, but for some reason I just can't get rid of it with the Add/Remove
feature.

Before I get rid of the WrtMon.exe file in the
C:\WINDOWS\SYSTEM32\SPOOL\DRIVERS\W32X86\3 folder, there also exists in that
same folder what appears to be a companion file, Wrtproc.exe (has the same
logo). The Wrtproc.exe was created on Sept. 19, 2006 and the WrtMon.exe on
Sept. 20, 2006. Should I delete that file as well?

I'll go forward with the rest of your instructions after I receive your
answer to this post. Thanks.

nybarton (aka legality)
Click to expand...

Yes delete them as they even if Legit, they are not necessary, here a
tutorial about ccleaner try it, it is step-by-step with Pixs:
http://www.ccleaner.com/help/tour/?2

I found this:
C:\WINDOWS\system32\cidaemon.exe
http://support.microsoft.com/kb/899869

If you are in doubt you can rename the folder to something like this:
Wrtproc.exe Rename to WrtProc.Old and after perform the cleaning, see if
the printer will complain, if it did then rename to Wrtproc.exe, if it didnot
then you need to Remove it completely.
Let us know.
nass
 
Nass.......

As for the Cidaemon.exe file, I'm not exactly certain what an "indexing"
process is, but I did some research on it and apparently it does facilitate
accessing files. The recommendation I found at a couple of sites is to NOT
disable it. See the following:
http://www.processlibrary.com/directory/files/Cidaemon.exe?gclid=COv0oej7n40CFQwzZAod9EIr7Q

I will now remove the WrtMon.exe and WrtProc.exe files (after first renaming
them) and see if that affects the printer. If not, I'll download AVG,
uninstall McAfee and run the scans as per your instructions. I'll report
back.

P.S. The length of this thread is becoming somewhat unwieldy, but I don't
think it's wise to start a new one.

Thanks,
nybarton (aka legality)
 
Nass.........

Well, well, well. Guess what? I can't delete the Wrtmon or Wrtproc files,
either with their original extension of "exe" or after renaming the
extension to "old". When I tried to delete, I got an Error Window saying
"Cannot Delete Wrtmon.exe: Access Denied" The error message said "Make sure
the disk is not full or write-protected and that the file is not currently
in use."

It appears these two files have their tentacles into something else,
probably the printer, but I don't know how to determine that. Since I can't
delete them, I have no idea what my next step would be. Do you think I
should shut down the printer and disconnect its USB cable and then try
deleting those two files again to see if they can be deleted when the
printer is not operational? If so, will my printer work again once those two
files have been deleted? Hmmmmm????

This whole mess has become a real mystery, but it's intriguing.

nybarton (aka legality)
 
nybarton said:
Nass.........

Well, well, well. Guess what? I can't delete the Wrtmon or Wrtproc files,
either with their original extension of "exe" or after renaming the
extension to "old". When I tried to delete, I got an Error Window saying
"Cannot Delete Wrtmon.exe: Access Denied" The error message said "Make sure
the disk is not full or write-protected and that the file is not currently
in use."

It appears these two files have their tentacles into something else,
probably the printer, but I don't know how to determine that. Since I can't
delete them, I have no idea what my next step would be. Do you think I
should shut down the printer and disconnect its USB cable and then try
deleting those two files again to see if they can be deleted when the
printer is not operational? If so, will my printer work again once those two
files have been deleted? Hmmmmm????

This whole mess has become a real mystery, but it's intriguing.

nybarton (aka legality)
Click to expand...

Please stick to your original thread?.
Try in Safe Mode by tapping F8 on Boot and you will get the boot option
select safe mode.
Did you read the crap cleaner tutorial, it does have the Remove on Boot
option it will be easier to use this tool.

If still then try to Use the HijackThis and select it the click Fix Selected.
Or continue with the reset of the steps.

Also download the comboFix from here:
http://download.bleepingcomputer.com/sUBs/ComboFix.exe

Open the run command and type in:
regedit click [Ok] there locate these Keys and see the entries for them:

[-]HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\Toolbar =
look for the extension of the toolbar in the Right Pane/Window.
[-] HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\Toolbar =
The same here.

[-]HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run = look
in the Right Pane?window for an entry called "C:\Program
Files\Wrtmon.exe"
HTH.
nass
 
Nass........

haven't forgotten the rest of your instructions, but have been very busy
with things other than the computer. I will get to ccleaner, downloading AVG
and uninstalling McAfee as soon as possible. Will keep you posted.

nybarton (aka legality)
 
Nass........

See the following which I just found at PC Pitstop regarding WrtMon.exe and
WrtProc.exe. Removing either of these files is NOT recommended. WrtMon is
described as a Microsoft Base Class Application (whatever that means) and
Wrtproc is described as a printer driver. Both are considered "safe".

http://pcpitstop.com/spycheck/SWList.asp?pg=77&st=0

I may have failed to mention this before, but each time I recover from the
Page Fault shut down, I always get a popup screen when the desktop appears
that says "System Has Recovered from a Serious Error". The details refer to
driver problems which may have resulted from newly installed software or
hardware.

nybarton (aka legality)
 
nybarton said:
Daave.......

After reading your message, I ran Spybot-SD in Safe mode. It ran all
the way through without causing the Page Fault and found 30 items,
all red. Just before finishing the scan a warning window popped up
that said "There were problems in the include file C:\Program
Files\Spybot-Search_Destroy\Includes\Trojan.sbi. See Include
errors.log for details"

I didn't "fix" anything because I'm not sure if everything there
should be fixed. Most of the items were tracking cookies which I
would gladly eliminate. There were 8 Registry items, one of them
being something called "DyFuCA" which Spybot called malware. Other
registry items deal with various Windows Security matters such as
"FirewallDisableNotify", "AntiVirusDisableNotify", "IEFirewallBypass"
and "InternetExplorer. Registry change". There's an item called
ISearchTechPowerScan (registry value), two items for AdwareAlert (one
is a registry key and the other is a log in Program Files). I thought
I got rid of AdwareAlert, but I guess not. There's also an entry for
180SolutionsAssistant: Data
Click to expand...

You really should fix everything. Even if it turns out you'd like to
undo a particular change, this is easily accomplished.
 
nybarton said:
Nass........

See the following which I just found at PC Pitstop regarding WrtMon.exe and
WrtProc.exe. Removing either of these files is NOT recommended. WrtMon is
described as a Microsoft Base Class Application (whatever that means) and
Wrtproc is described as a printer driver. Both are considered "safe".

http://pcpitstop.com/spycheck/SWList.asp?pg=77&st=0

I may have failed to mention this before, but each time I recover from the
Page Fault shut down, I always get a popup screen when the desktop appears
that says "System Has Recovered from a Serious Error". The details refer to
driver problems which may have resulted from newly installed software or
hardware.

nybarton (aka legality)
Click to expand...

First Try to Look in the Event Viewer for Any Error Messages that can shed
some
light on the causer and post it back in your next Post.
On how to access the Event Viewer do the following:
- Open a run command and type in:
eventvwr click [OK]
There you will see three Options/Folders:
Application
System
Security
By clicking on each and look in the Right Pane/Window you will see a report
Log Double click on the error Message (X) to get more info and you can copy
and paste in your next post.

And on your Device Manger for any malfunctioning Devices, by right click My
Computer and select properties then click on Hardware Tab >> Click on Device
Manager Button >> Click on the [+] beside each device to Expand its tree and
see if there is Yellow Mark or Red (X).

System Has Recovered from a Serious Error:
http://support.microsoft.com/kb/316424
You receive a "System Has Recovered from a Serious Error"
http://support.microsoft.com/kb/317277

Windows XP Patch: System Recovery Error Appears After Every Reboo
http://www.microsoft.com/downloads/...46-0E2C-429F-8F40-F30014ADC3BB&displaylang=en
 
Nass.......



For the event viewer, I purposely ran AdAware because it's scan always
causes the Page Fault shut down screen within a minute into the scan. I
noted the time of the shutdown so I could see if an error was reported in
event viewer. I checked all three categories (application, system and
security). There were NO errors.



I checked the Device Manager. I expanded all items and there were no
problems anywhere.



As for the Error Message screen on startup (the system has recovered from a
serious problem), that ONLY occurs after the Page Fault shutdown. That
message does NOT appear after a normal boot. Interestingly, I did not get
that message this time when I rebooted after I caused the shutdown for the
purpose of studying the event viewer. Since the details of those error
messages always point to a driver problem, then by process of elimination I
feel the problem can be traced to the Canon's drivers since the Page Fault
shutdown problem began concurrently with the printer's installation. I
checked Canon's driver update page for the Pixma MP530, and there are no
updates for its drivers. I will again contact Canon to find out if they're
aware of any driver conflicts with this particular machine.



Everything is working fine EXCEPT for a deep, full scan of my system by
McAfee or AdAware which cause the Page Fault shutdown during the registry
scan. Perhaps other scan programs that I haven't tried would do the same,
but for some reason scans by Spybot and SuperAntispyware complete without
problems. Virus scans complete without problem (even McAfee). There is an
obvious problem within the Registry itself, most likely concerning a certain
driver(s), but I don't know how to determine that because the McAfee and
AdAware scans shut down the computer rather than turning up an error. I'm
beginning to think this problem may not be due to spyware or malware, but
again I can't be certain about that.



Except for the deep scan problem which shuts down the computer with the Page
Fault error, the computer is working normally and is not sluggish. I admit
the problem is an intriguing one, but I'm beginning to wonder if it's worth
digging any further to find it. If there were serious problems with the
computer's operation, then of course it would be necessary to locate the
cause. As I mentioned early on, the computer is four years old (XPS 8300
purchased from Dell in May 2003) and probably will need to be replaced
within another year or so. If it were relatively new, I would call in an
expert service to fix the problem. Having said that, I will still download
AVG, uninstall McAfee and run the AVG scan to see what happens.



One more thing........regarding the following lines from the HJTlog, I know
the first line with WrtMon is in question, but do you see a problem with the
4th line regarding the KernelFaultCheck? That looks a bit ominous to me,
especially with the "system32\dumprep" since a physical dump of memory is
what occurs when the PageFault shutdown occurs.



O4 - HKLM\..\Run: [WrtMon.exe]
C:\WINDOWS\system32\spool\drivers\w32x86\3\WrtMon.exe
O4 - HKLM\..\Run: [ScanSoft OmniPage SE 4.0-reminder] "C:\Program
Files\ScanSoft\OmniPageSE4.0\Ereg\Ereg.exe" -r "C:\Documents and
Settings\All Users\Application Data\ScanSoft\OmniPageSE4.0\Ereg\ereg.ini"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program
Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKCU\..\Run: [Multi Reminders] "C:\Program Files\Multi
Reminders\reminder.exe" -c
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe



Again, my sincere thanks for all your help. I will report back after the
AVG scan.



nybarton (aka legality)
 
Nass and Daave..........

I deleted EVERY antivirus and antispyware program from my computer,
including McAfee. However, in the Registry (HKEY_CURRENT_USER/SOFTWARE), I
can still see remnants of McAfee and Lavasoft's AdAware2007.

I downloaded AVG's free antivirus and antispyware programs and installed
them. Since virus scans generally take quite a while, I ran the AVG
antispyware program first because it's usually during the Registry scans
that the Page Fault error. Sure enough, about 1-1/2 minutes into the
antispyware scan, the Page Fault error occurred. Although I have no way of
knowing for certain, I believe the fault occurs in the following Registry
key:

HKEY_LOCAL MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENT VERSION\RUN where the
following lines are found:
O4 - HKLM\..\Run: [WrtMon.exe]
C:\WINDOWS\system32\spool\drivers\w32x86\3\WrtMon.exe
O4 - HKLM\..\Run: [ScanSoft OmniPage SE 4.0-reminder] "C:\Program
Files\ScanSoft\OmniPageSE4.0\Ereg\Ereg.exe" -r "C:\Documents and
Settings\All Users\Application Data\ScanSoft\OmniPageSE4.0\Ereg\ereg.ini"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program
Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG
Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKCU\..\Run: [Multi Reminders] "C:\Program Files\Multi
Reminders\reminder.exe" -c
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

This seems to bear out what Microsoft has to say about diagnostic programs
causing the Page Fault error. See the following:
http://support.microsoft.com/kb/897079/en-us. I checked the Registry for
the malicious programs described and did not see them.

Any other suggestions? I will now run the AVG virus scan and report back
when it's done. The thought of uninstalling my Canon to see if the problem
is solved really doesn't sit well with me, but if I must I will. I did not
do the printer installation, my son did, but he's out of the country so I
can't call upon him to do it again.......LOL.

nybarton (aka legality)
 
Ran AV virus scan......start to finish, NO problems. I even watched as it
scanned the potentially problematical
"Windows/System32/Drivers/Spool/3/wrtmon.exe" without any problems.

I think I like AVG and will keep it as my virus protection program. The AVG
spyware program is the one that shut down my computer with the Page Fault
error. I believe it is in the Registry key I mentioned in the prior post.

nybarton (aka legality)
 
nybarton said:
Nass and Daave..........

I deleted EVERY antivirus and antispyware program from my computer,
including McAfee. However, in the Registry
(HKEY_CURRENT_USER/SOFTWARE), I can still see remnants of McAfee and
Lavasoft's AdAware2007.
Click to expand...

Remnants of uninstalled programs are commonplace and seldom have any
adverse effects.

That being said, sometimes problems *can* happen, and McAfee is
definitely one of those instances! You really should remove all traces
of McAfee. Again, see:

http://tools.mcafeehelp.com/doc.php?siteid=1&docid=71541
I downloaded AVG's free antivirus and antispyware programs and
installed them. Since virus scans generally take quite a while, I ran
the AVG antispyware program first because it's usually during the
Registry scans that the Page Fault error. Sure enough, about 1-1/2
minutes into the antispyware scan, the Page Fault error occurred.
Although I have no way of knowing for certain, I believe the fault
occurs in the following Registry key:

HKEY_LOCAL MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENT VERSION\RUN
where the following lines are found:
O4 - HKLM\..\Run: [WrtMon.exe]
C:\WINDOWS\system32\spool\drivers\w32x86\3\WrtMon.exe
O4 - HKLM\..\Run: [ScanSoft OmniPage SE 4.0-reminder] "C:\Program
Files\ScanSoft\OmniPageSE4.0\Ereg\Ereg.exe" -r "C:\Documents and
Settings\All Users\Application
Data\ScanSoft\OmniPageSE4.0\Ereg\ereg.ini" O4 - HKLM\..\Run: [Adobe
Reader Speed Launcher] "C:\Program Files\Adobe\Reader
8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG
Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0
-k
O4 - HKCU\..\Run: [Multi Reminders] "C:\Program Files\Multi
Reminders\reminder.exe" -c
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
Click to expand...

These are all startup programs/processes. When you scan in Safe Mode, I
believe your problem goes away. So why not try to narrow down the
problem? Use msconfig and uncheck half of these and see what happens. If
everything is okay, then you've narrowed the problem and now you know
what to check next. Example:

First time, uncheck the top three items. Run the scan. If the problem
goes away, then you know it has to have been from one of those three.
Next time, put checks in only the top 2 boxes and make sure all the
others are unchecked. Run the scan. If the problem occurs, you now know
which ones to narrow it down to. So uncheck everything but the top one.
If you still have a problem during the next scan, then you know the
problem was with WrtMon.exe.
This seems to bear out what Microsoft has to say about diagnostic
programs causing the Page Fault error. See the following:
http://support.microsoft.com/kb/897079/en-us. I checked the Registry
for the malicious programs described and did not see them.
Click to expand...

I'm not sure that Web page is pertinent.
Any other suggestions? I will now run the AVG virus scan and report
back when it's done. The thought of uninstalling my Canon to see if
the problem is solved really doesn't sit well with me, but if I must
I will. I did not do the printer installation, my son did, but he's
out of the country so I can't call upon him to do it again.......LOL.
Click to expand...

Scan for both viruses and spyware in Safe Mode. I'm not asking you to
physically remove the printer. As long as you still have the disc,
you'll be able to reinstall the software.
 
Daave and Nass......

Finally heard from the Coyote people. Not very helpful. They saw nothing
wrong with the HJT log, but said that doesn't necessarily mean anything
since bad stuff can often escape detection. They also think I should
uninstall my Canon MP530 to see if the spyware scans complete without
causing the Page Fault shut down. Assuming that uninstalling the printer
cures the problem, I wanted to know if reinstalling the machine would cause
the problem to recur, but they didn't answer my question.

No one seems to know why spyware scans shut down my computer. It appears to
be a driver problem, most likely from the new multifunction printer and not
spyware or malware. The message I get after rebooting from a shut down which
says the computer has recovered from a serious problem also leads me to the
following Microsoft Windows Error Reporting screen:
http://wer.microsoft.com/responses/...SGD=bc6fc0b2-a9fe-47df-9b5b-fe92ea338477#here

I downloaded and ran the Dell Driver Reset Tool.......it found no problems.
I DON'T want to uninstall my printer unless it's absolutely necessary.
Everything is working fine, computer and printer. The ONLY problem is
running a spyware scan. Virus scans run through without any problems. My
computer is protected from spyware and viruses, I just can't scan for
spyware. I keep getting update messages from AVG that indicate my computer
is protected against viruses and spyware. Actually, if the computer is
protected, why is it necessary to scan at all?

What do you guys think? Is it worth getting to the root of this or just
forget about it? Reminder: my computer just passed its 4th birthday, so
we're talking about maybe another year at the most before a replacement
becomes necessary.

nybarton (aka legality)
 
nybarton said:
Daave and Nass......

Finally heard from the Coyote people. Not very helpful. They saw
nothing
wrong with the HJT log, but said that doesn't necessarily mean
anything
since bad stuff can often escape detection. They also think I should
uninstall my Canon MP530 to see if the spyware scans complete without
causing the Page Fault shut down. Assuming that uninstalling the
printer
cures the problem, I wanted to know if reinstalling the machine would
cause
the problem to recur, but they didn't answer my question.

No one seems to know why spyware scans shut down my computer. It
appears to
be a driver problem, most likely from the new multifunction printer
and not
spyware or malware. The message I get after rebooting from a shut
down which
says the computer has recovered from a serious problem also leads me
to the
following Microsoft Windows Error Reporting screen:
http://wer.microsoft.com/responses/...SGD=bc6fc0b2-a9fe-47df-9b5b-fe92ea338477#here

I downloaded and ran the Dell Driver Reset Tool.......it found no
problems.
I DON'T want to uninstall my printer unless it's absolutely necessary.
Everything is working fine, computer and printer. The ONLY problem is
running a spyware scan. Virus scans run through without any
problems. My
computer is protected from spyware and viruses, I just can't scan for
spyware. I keep getting update messages from AVG that indicate my
computer
is protected against viruses and spyware. Actually, if the computer
is
protected, why is it necessary to scan at all?

What do you guys think? Is it worth getting to the root of this or
just
forget about it? Reminder: my computer just passed its 4th birthday,
so
we're talking about maybe another year at the most before a
replacement
becomes necessary.
Click to expand...

You have some buggy software on your PC. If it were me, I would
uninstall the old Canon driver and install the latest:

http://www.usa.canon.com/consumer/controller?act=ModelInfoAct&fcategoryid=116&modelid=13371

or

http://www.versiontracker.com/dyn/moreinfo/win/96373

IMO, it's very easy to do. If you would rather not do this and don't
mind the error messages (assuming that is the cause--for all we know,
there's nothing wrong at all with the Canon software since you have
neglected to find out, using the msconfig method mentioned earlier), you
might as well leave well enough alone. To each his/her own.

The other possible culprit is the dumprep/KernelFaultCheck issue also
mentioned earlier. Another very easy fix should you choose to give it a
try.
 
Back
Top