chk dsk

[t-risk7]

that's everything so far.
Thanks.

[Gary R]

• Copy/Paste the contents of the code box below into Notepad.

Code: Select all

R1 MpKsl68d72050; \??\c:\Documents and Settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{74944F5B-0E16-4A10-B6FE-5B7091463AB4}\MpKsl68d72050.sys [x]

• Save it to your Desktop as fixlist.txt
• Start FRST in a similar manner to when you ran a scan earlier, but this time when it opens ....
  
  • Press the Fix button once and wait.
  • FRST will process fixlist.txt
  • When finished, it will produce a log fixlog.txt on your Desktop.
• Post me the log please.

The analysis of your minidump log is as follows (I've highlighted the interesting bits in red) ....

*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 77, {1, 0, 0, 9cdd4ca0}

Probably caused by : memory_corruption ( nt!MmInPageKernelStack+176 )

Followup: MachineOwner
---------

1: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

KERNEL_STACK_INPAGE_ERROR (77)
The requested page of kernel data could not be read in. Caused by
bad block in paging file or disk controller error.
In the case when the first arguments is 0 or 1, the stack signature
in the kernel stack was not found. Again, bad hardware.
An I/O status of c000009c (STATUS_DEVICE_DATA_ERROR) or
C000016AL (STATUS_DISK_OPERATION_FAILED) normally indicates
the data could not be read from the disk due to a bad
block. Upon reboot autocheck will run and attempt to map out the bad
sector. If the status is C0000185 (STATUS_IO_DEVICE_ERROR) and the paging
file is on a SCSI disk device, then the cabling and termination should be
checked. See the knowledge base article on SCSI termination.
Arguments:
Arg1: 00000001, (page was retrieved from disk)
Arg2: 00000000, value found in stack where signature should be
Arg3: 00000000, 0
Arg4: 9cdd4ca0, address of signature on kernel stack

Debugging Details:
------------------

ERROR_CODE: (NTSTATUS) 0x1 - STATUS_WAIT_1

BUGCHECK_STR: 0x77_1

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: DRIVER_FAULT

PROCESS_NAME: System

LAST_CONTROL_TRANSFER: from 80512e8c to 804f9f8f

STACK_TEXT:
f790ed58 80512e8c 00000077 00000001 00000000 nt!KeBugCheckEx+0x1b
f790ed8c 8053fe86 0027c7e0 00000000 89e49620 nt!MmInPageKernelStack+0x176
f790eda4 80540356 8927c840 805cffbe 00000000 nt!KiInSwapKernelStacks+0x16
f790edac 805cffbe 00000000 00000000 00000000 nt!KeSwapProcessOrStack+0x7c
f790eddc 8054620e 805402da 00000000 00000000 nt!PspSystemThreadStartup+0x34
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16

STACK_COMMAND: kb

FOLLOWUP_IP:
nt!MmInPageKernelStack+176
80512e8c 8a550b mov dl,byte ptr [ebp+0Bh]

SYMBOL_STACK_INDEX: 1

SYMBOL_NAME: nt!MmInPageKernelStack+176

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nt

DEBUG_FLR_IMAGE_TIMESTAMP: 5137e446

IMAGE_NAME: memory_corruption

FAILURE_BUCKET_ID: 0x77_1_nt!MmInPageKernelStack+176

BUCKET_ID: 0x77_1_nt!MmInPageKernelStack+176

Which suggests that your Blue Screen was caused by corrupted data on your Hard Drive due to a faulty sector. Chkdsk should have put that right when you ran it, so hopefully you won't suffer the problem again. If you do, it may be an early sign that your drive is on its way out. As you're using XP, I can only presume that your computer is getting a little long in the tooth now.

[t-risk7]

here is the fix

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x86) Version: 10-06-2013 03
Ran by Administrator at 2013-06-11 07:06:33 Run:1
Running from C:\Documents and Settings\Administrator\desktop
Boot Mode: Normal

==============================================

MpKsl68d72050 => Service deleted successfully.


The system needs a manual reboot.

==== End of Fixlog ====

[Gary R]

If you haven't already done so, please reboot your computer, then let me know how it's behaving now please.

[t-risk7]

rebooted
wife says computer running fine

[Gary R]

In that case, I think we've finished, we just need to remove the programs we've been using on your machine.

please delete the following ...

FSS.exe
FSS.txt
MiniToolBox.exe
Result.txt
FRST.exe
FRST.txt
Addition.txt

From what I've seen, there's no reason to believe that your problem was anything other than a corrupted data sector on your hard drive, and hopefully chkdsk has now repaired it.

If you have no further issues, I think we can close this topic.

Keep safe,

Gary

[t-risk7]

Thank you. I appreciate all of your help.

Tad

[Gary R]

You're welcome, glad we could help.

Since your problem now seems to be resolved ....

This topic is now closed