"problem detected" and Windows XP shuts down, files missing or corrupt

[bswan4]

Hello,
My daughter's Windows XP Home SP3 computer now shuts down to a blue screen quickly after boot up with recent error message "stop: 0x0000008e"  Some programs will appear to load up but then shut down with error messages about missing or corrupt files, sometimes mentioning dll files.  Programs won't run in Safe Mode, when logging in as administrator, or when booting up normally with start-up items disabled.

Re-booting normally again just now resulted in loading to the blue "welcome" screen, then quickly to the BSOD with message "page fault in nonpaged area ... remove newly installed hardware or software ... stop: 0x00000050 ... ntfs.sys - address f748d3a7 ...  physical memory dump complete."  I'm still able to boot up in Safe Mode.

The history of this:
Avast Free last full scan 10 days ago identified "NSIS: Zugo-A (Adw)" and quarantined this and computer seemed fine before and after this.  A few days later a Quick scan was virus-free, though can't be sure this was a valid scan.  Now Avast will not update (despite occasional online connection) while attempts to scan result immediately in "scan complete, no threat found," with run time of 0:00.  Similar problem with MalwareBytes with message that "database is missing or corrupt, please re-install program."

Initial blue screen message reported "stop: c000021a {fatal system error}," advised running chkdsk /f which has run a few times with little, temporary or no improvement to programs running correctly.

System restore to settings of 1 week ago gained access to normal boot-up but still programs didn't run and things quickly shut down to blue screen.  Then tried to system restore to 3 weeks ago (a date before the virus was identified) but the restore process did not complete and a BSOD was encountered, with "stop: 0x00000024, recommending chkdsk /f" which ran yet again.


Thought I'd ask for some expert advice here before proceeding further.  You all, especially Essexboy, were very helpful on a Win 7 virus removal issue I had last year.  Don't know if this is now a virus issue, if this old hard drive is failing, or something else is happening.  I have the original Windows XP Home SP1a disc (2003 version) if needed for SFC though read this checking program may not work as computer was updated to SP3 via download.  Hoping to avoid a clean install of Windows (or buying a new computer).

Firefox and IE won't open or if open will shut down quickly, so anything to be copied/downloaded will be done via transfer from another computer to a flash drive.
Again, your advice will be most appreciated.
thanks in advance,
Bob

[mchain]

hi bswan4,

Big clue as to what is likely going on here is in the following quote:

then quickly to the BSOD with message "page fault in nonpaged area ...

If this is consistent, or happens more often than the other errors, likely a memory stick is on its way out.  Page fault in non-paged area error means Windows is looking for a particular piece of data and cannot find it in memory and does a critical stop as a result.  Run memtest to find out if your memory is defective. 
http://www.memtest.org/
Paged area would be on the hard drive paging (swap) file.  Since it seems to run ok in Safe Mode when far less memory is required, memory card failure could be indicated here.  Use memtest to determine if this is the case.  Run program overnight, preferably two or more complete passes.

How much memory now installed and number of sticks?

[essexboy]

Monitoring if needed

[bswan4]

thanks for this Mchain (and pleased that Essexboy is monitoring).

The computer has 1 GB RAM.  I'm not sure how it's configured but it was invoiced as "1 GB dual channel DDR2 SDRAM."

Having trouble getting MemTest to run.  With a floppy disk, the computer tries to boot from the floppy, but doesn't recognize the disk, asks for a replacement disk and "press any key," when floppy is removed it then boots to normal Windows.  Checking content of this floppy indicates it is "not formatted," which I believe is correct per the MemTest site. 
With a CD-R in place, boots directly to Windows.  Maybe I've not made these bootable disks correctly as when I used the CD-R on my functioning Win 7 laptop, it also booted directly to Windows.  (If I understand correctly, this program should boot directly and run before any Windows is started, rather than run under normal Windows or Safe Mode command prompt.)

The contents of the MemTest CD-R disc I made are:
ReadMe file and Boot folder containing:
Boot   security catalog  2 KB
MemTest  disc image file 1440 KB
These files are much smaller than what I'd expect, so maybe I've not made the disk correctly.
 
Will work on this more tomorrow.  thanks again.
Bob

[mchain]

Hi,

A couple of steps are needed to be looked at here to ensure your computer will boot from recovery media before Windows is called to boot.

• When your computer is first starting, enter the BIOS (Basic Input/Output System) via hitting the F2 or similar key repeatedly tapping it to access the BIOS setting screen.  This would normally be when the computer manufacturer's screen first displays just before Windows begins to boot.  If the correct key is pressed and you see the settings page, then you are inside the BIOS.
• Navigate to the settings tab where the boot order is set:  Default settings are normally hard drive first, floppy second, CD-ROM third.
• Change the boot order to:  CD-ROM, floppy, hard drive.  Press F10 or similar to save the new settings.

Your computer manufacturer will have the correct F keys listed to enter the BIOS on your system.  Go to the website to find that information, or look at the vendor of the BIOS itself to find this.  There will be a listing of the proper F keys to use within the BIOS itself, so look for that when in there.  Phoenix and American Megatrends are two of the most popular BIOS vendors.  http://pcsupport.about.com/od/fixtheproblem/a/biosaccess_bios.htm

All computers use BIOS to set operating parameters and conduct a self-test, POST (Power On Self-Test), to ensure all hardware is operational and working properly before Windows starts.  So, there always are two operating systems on a computer, the BIOS, and then the OS of choice (in this case, Windows).  BIOS starts the computer for you, and makes it ready for the operating system to load.

Once you have checked the boot order, and set to the correct order if needed, then you can move on to the next step.

An .iso file cannot be used as is.  That is to say, merely copying the .iso file to a CD will not work.  It must be opened and expanded by a third party application to decompress it and make the CD bootable.  See attached below for an iso file that has been properly opened and the CD made bootable.  If, when you look at the CD you made, and you do not see the folders and files within, then a copy of the .iso file has been made, and the CD cannot boot.  A proper burn of the .iso file was not done.

I believe Win7 can natively burn the .iso file to disk, and thus make it bootable.  If not, then go here:  http://www.imgburn.com/  Download this free application and burn the .iso file to CD disk.  View the contents in Explorer when done, if folders/files are present, you are good to go.

Now you should be able to conduct a test of your memory.  Please post back what the results were.  Use only the basic default settings to scan.

[CharleyO]

***

You can continue with mchain's suggestions if possible. It won't hurt if you get it to run.

But, this seems to me to be more of a hard drive problem.

The Stop 0x24 message indicates that a problem occurred within Ntfs.sys, the driver file that allows the system to read and write to NTFS file system drives. The above mentioned driver is on the hard drive.
This is also indicated by "Initial blue screen message reported "stop: c000021a {fatal system error}," advised running chkdsk /f ...."

You may have a damaged sector on the hard drive that might not be repairable.

But, please wait for advice from Essexboy.


***

[bswan4]

thanks Mchain and CharleyO.

I did have the BIOS boot order as CD/USB/floppy/hard drive. Still no success with multiple attempts to make a floppy or a CD "burned as image" as these were never recognized as bootable by the computer.  But, finally downloaded this option  - Auto-installer for USB Key (Win 9x/2k/xp/7) - using an emptied flash drive and the MemTest86 program is now running.  ("Auto-installer" clearly helped me!)  I understand I should let this program run a long time, like overnight.  Then I believe I click "esc" to end the program and it probably then boots to Windows.  This test will result in some kind of useful summary information which I can access and post here (if not obvious how to retrieve this info, further instruction always appreciated).

And as a further clue, the most recent BSOD shutdown message was "PFN_LIST corrupt ... stop: 0x0000004e ..."  Chkdsk has run several times, once saw that errors were identified but not sure of most chkdsk results because it often goes directly to Windows when it's finished (maybe there are logged text files if that information would be useful here?).  I'll wait for further advice on testing the hard drive if, after MemTest86 is done, that would be the next step.
Bob

[bswan4]

So 1.5 hours into MemTest, it's reading:
Pass 3
Errors  804096
ECC Errors  0
with lots of "failing addresses" in red at the bottom, and constantly adding to these.

Not sure of what numbers are the most informative here, but this does not seem good (actually seems very bad).  Do I need to let this run further, overnight, or is this information (bad) enough to stop now?

[mchain]

So 1.5 hours into MemTest, it's reading:
Pass 3
Errors  804096
ECC Errors  0
with lots of "failing addresses" in red at the bottom, and constantly adding to these.

Not sure of what numbers are the most informative here, but this does not seem good (actually seems very bad).  Do I need to let this run further, overnight, or is this information (bad) enough to stop now?

Hi,

Four things:

1.)  With MemTest, you will know if the memory is failing.   It will produce red addresses where the failures are.  No need to continue the test, with one exception:  If you have two memory sticks, pull one out and place the other in memory bank 0 (zero).  Run MemTest again, this time for only one pass.  Any errors usually show right away.  You want to see if the errors are on the one that was removed.  It is important for the deeper troubleshooting diagnostic to be true, that the remaining stick be in the 0 bank.  Your BIOS will announce a memory size change when you start your system with one stick, this is normal.  To confirm the bad stick, run MemTest again with the original stick in slot 0.  Now you will know which stick needs to be replaced.

If you have four sticks, then two of the same pair must be removed (usually bank 0 and bank 1) and the others placed in the slots just emptied.  One way to tell which are paired is the color of the pair in the memory insertion slot is the same; the other two will have a different matching color.  Example:  one paired bank will be white, and the other black or blue.

2.)  Warning about static electricity:  You need a static wrist band to ground yourself against any static electricity discharges while inside the case.  Google pictures will show you what that is here:  https://www.google.com/search?num=10&hl=en&site=imghp&tbm=isch&source=hp&biw=1280&bih=887&q=static+electricity+ground+strap&oq=static+electricity+ground+strap&gs_l=img.12...2093.18302.0.21229.37.15.3.19.20.0.102.1373.12j3.15.0...0.0...1ac.lwXJ7XaTN70  Electronic components inside your computer are very sensitive to static electricity discharge; only thirty volts is needed to damage any part. 

Static discharge you can feel and hear is around 2,000 volts or more.  So, you cannot feel thirty volts, but it will kill electronic parts.

3.)  Replace the bad memory module with the same exact type and configuration.  Your starting point is "DDR2 SDRAM".  Your computer manufacturer will have the exact specifications you need on their website.  If the manufacturer is different, is ok, but the specifications must be the same.  If you look at the MemTest memory specifications listed for the modules being tested, copy that information down.  That way you will be sure to get the correct replacement stick you need.

4.)  Use canned air to remove all accumulated dust inside; a computer should have this very basic maintenance done at least every six months.  Get the canned air at the same place you get the memory stick.  Here is a guide to cleaning a computer:  http://www.microsoft.com/athome/setup/cleancomputer.aspx#fbid=cqmtHVVWjUS  & http://www.pcworld.com/article/224328/how_to_clean_your_pc_inside_and_out.html  Also consider applying fresh heat-sink compound to the cpu as well. For that, you will need to remove the heat sink very gently and carefully, so as to not dislodge the cpu from the base it sits in.

Hope this helps.

Once the hardware is up to snuff, then we can check out software/malware issues.  Your issues with corrupted file system on the hard drive can be caused by faulty memory; do not run the system until the memory is checked out to be ok with MemTest.  MemTest is a standalone operating system and cannot affect the operation of Windows, as Windows is not running when MemTest is.  So your hard drive is not touched by MemTest.

[essexboy]

How many sticks of RAM ?  If you have two then remove one.. Boot, if it fails then replace that stick and remove the other 

[bswan4]

I shut down MemTest after about 2.5 hours, 5 passes and more than 2,000,000 errors.

Haven't opened up the computer yet.  Dell support online chat tells me this computer has four memory slots each filled with a 256 mb DDR2 SDRAM @400 mhz stick.  Could I MemTest the sticks singly, that is, remove three and have just one stick in what Dell calls the #1 slot closest to the processor (assume this  is "zero" slot mentioned by Mchain)?  Or best to test two at a time in the color-matched slots 1 and 2, and use process of elimination to identify the faulty one?

And assuming I do identify a single faulty memory stick, could the computer than be run, slowly, on just two healthy sticks (512 mb total) in order to run checks on the hard drive, etc, and be sure everything else is working and/or restorable?  If possible, I'd like to do these further tests before replacing the faulty stick or maybe upgrading to more RAM.

Again Mchain, your very informative responses are much appreciated and will be followed (and I even did the canned air cleaning a few months ago, though admittedly that was the first time!).
Bob

[essexboy]

Yes you could test them singly ..  The system will be a bit slow,but the bad ones will fail to boot

[bswan4]

MemTest identified a single failing memory stick (other three tested fine).  Computer now boots normally to Windows running with just two 256 mb sticks.  My guess is that the failing memory is the cause of all the corrupted files and programs not running, and that the "NSIS: Zugo-A (Adw)" identified by Avast 10 days prior was successfully quarantined and so not an issue.  To address some probably corrupted files and check the harddrive (before probably upgrading to two x1 GB memory sticks), what steps and in what order would you suggest?

My very tentative ideas include:
--setup to run chkdsk /f on reboot (though this ran several times on reboot after BSODs).
--run SFC or some other file checking program (SFC may be a problem with SP3 installed as a downloaded update while I have the disk only for Win XP Home SP1a).
--install Avast and Malwarebytes from a flash date, update their definitions, and run full scans of both from Safe Mode.
--assuming all seems to be working, run defrag or something similar to "clean up."

Again, your help is appreciated.  And Mchain, before removing any memory sticks, the computer was completely cleaned via compressed air, though I did not apply fresh heat-sink compound as messing with or around the processor seems risky.
Bob

[essexboy]

My very tentative ideas include:
--setup to run chkdsk /f on reboot (though this ran several times on reboot after BSODs). Good Idea
--run SFC or some other file checking program (SFC may be a problem with SP3 installed as a downloaded update while I have the disk only for Win XP Home SP1a). You could slipstream SP3 onto SP1
--install Avast and Malwarebytes from a flash date, update their definitions, and run full scans of both from Safe Mode. Good Idea
--assuming all seems to be working, run defrag or something similar to "clean up." I would recommend TFC followed by a defrag

[mchain]

@ bswan4,

Absolutely not a problem to help you get through this.  Just remember, static electricity is always present, so safeguard against it while inside your system.  It is more of a problem in the winter months, but nevertheless precautions should be taken.

You could borrow another XP Home disc, but the one I had was SP1a, albeit the full installation disk, not the restore discs that came with the system.  SFC never complained, so it may work for you as long as it is a full installation disk.  It ran even though the system was fully updated to SP3.

To keep an eye on system core temperatures, a simple monitoring program such as Speedfan will let you know if the cpu is running too hot.  Normal operating temperatures for Pentium 4 processors should be somewhere around 60 degrees Celsius.  If higher than 70-75 constant, it is time for fresh heat-paste compound to ensure the system will run another few years.  Mine was running up to 90 degrees peak before I got in there and did the work.  Something you might want to know.  Otherwise you might get random BSOD's like I did, and wonder what the heck was going on.

http://www.almico.com/speedfan.php  Other members here may have better suggestions, though.