Dumping physical memory to disk

GretyM said:

Update

so, now the laptop seems to work fine, i think it was restored to a previous point in time. i followed the steps in the BSOD instructions, i attached the results, if you still need them, also in the same folder i put the Resource and Performance Monitor, it failed quite a lot of the tests.

i will proceed with installing some antivirus programm, do all my updates and i have made a USB recovery and right now it's performing the SFC /SCANNOW command

and these are the specs i could find through the System Info application:
DELL Inspiron Mini 1012
Win 7 Starter
Intel(R) Atom(TM) CPU N450 @ 1.66GHz
Dell Inc. 0P9MDV
1,00 GB
(1) Intel(R) Graphics Media Accelerator 3150
Realtek High Definition Audio
1024 x 600 x 32 bits (4294967296 colors) @ 60 Hz
ST9250315AS ATA Device
3 Partitions
232,88 GB

when you have some time to take a look over these, let me know what you find out

thanks a lot

Just a short note to let you know I have the zip files, and I 'll be looking them over.

Even if the SFC scan comes back okay run it two more times. Seems redundant, but it is possible to find fixable errors on the second or third runs.

Until we get your system stable again It would be okay to install Microsoft Security Essentials - Free Antivirus for Windows, and then you can change to another security program at a later date. Under the settings page check to make sure Real-Time Protection is turned on.

Here are guidelines for: Windows Update Settings - Change
If you get a lot of updates whittle away at them. Start with the smaller security updates, then the medium, then large.
If unsure post a screen-shot, and I can advise.
Screenshots and Files - Upload and Post in Seven Forums

Thank you for Filling out your System Specs!

I will try to get back on what I found in your zip file about 8-9pm your time.
Hang in there, take your time. You are doing great!

Okay!

Have you preformed any Disk Clean Up's or Defragmentations in the last month or so? If not do so: Disk Clean Up Defragmentation

I would like you to check with Dell to make sure your machine is up to date.
Please go to: https://www.dell.com/support/drivers...oductSelection, You may choose either option.
Yes if you know your service number, No if you would like Dell to check it for you, first option.
Please Re-boot after updating.

If you are unsure what to update from Dell, post screenshot for advice. Stay away from any BIOS updates.

You have these programs that are out of date:
03.10.2011 12:20 Application Error Faulting application name: AcroRd32.exe, version: 8.1.0.137, Adobe - Adobe Reader download - All versions
You will have to drill down to select your preferences.

This is optional to have installed on your system, but if you do, for security sake make sure it is up to date.
Java Runtime Environment (JRE) 1.6 You can go here to check: https://www.java.com/en/download/index.jsp , and make sure.
Click on the Do I Have Java Link. It should say yes, but it may be out of date. Allow it to run the update process.

Is Skype up to date?


Then go to Start/Search box or Run (preferred), and type/copy/paste - services.msc - then scroll down to: Microsoft .NET Framework NGEN v2.0.50727_X8 clr_optimization_v2.0.50727_32 Stopped Disabled
Right click on it, and click on Properties >General Tab >Startup Type, open the drop down menu, and click on Automatic. Apply >OK your way out.


You have been having a lot of problems with Syncables You should consider removing it, and go with a more stable sync program.
It requires 128mb of video ram, and your system only supplies 8 (shared).

If you do not want to remove it as yet, I would like you to go to the Start/Search box or Run (preferred), and type/copy/paste - msconfig - then Startup Tab un-check Syncables, and Adobe Reader Speed Launcher, apply, and OK your way out.
You do not need these to start-up automatically when you power up or re-boot.

Also check this setting in Acrobat reader. This will disable a function of Acrobat reader that once open leaves it open thus robbing your system resources.

• Open Acrobat Reader
• Choose Edit, then Preferences
• Click on Internet, then uncheck Display PDF in browser.
• Click OK

Please Re-boot.

That's it for now there is more, but I want to see how these changes affect your system stability.

Code:

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 9F, {4, 258, 843aa578, 81f78b24}

Probably caused by : ntkrpamp.exe ( nt!KiSwapContext+26 )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

DRIVER_POWER_STATE_FAILURE (9f)
A driver is causing an inconsistent power state.
Arguments:
Arg1: 00000004, The power transition timed out waiting to synchronize with the Pnp
    subsystem.
Arg2: 00000258, Timeout in seconds.
Arg3: 843aa578, The thread currently holding on to the Pnp lock.
Arg4: 81f78b24

Debugging Details:
------------------


DRVPOWERSTATE_SUBCODE:  4

FAULTING_THREAD:  843aa578

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0x9F

PROCESS_NAME:  System

CURRENT_IRQL:  2

LAST_CONTROL_TRANSFER:  from 81ecf65d to 81ec8766

STACK_TEXT:  
ac3079b8 81ecf65d 843aa578 00000000 81f7bd20 nt!KiSwapContext+0x26
ac3079f0 81ece4b7 81fb7ad0 843aa578 843aa68c nt!KiSwapThread+0x266
ac307a18 81eca484 843aa578 843aa638 00000000 nt!KiCommitThreadWait+0x1df
ac307b90 820106ad 00000003 ac307bc0 00000001 nt!KeWaitForMultipleObjects+0x535
ac307be0 821117df 8aae9c18 81e9bc48 00000000 nt!PnpNotifyUserMode+0x13c
ac307c10 82112457 b68b2850 81e9bc48 00000000 nt!PnpNotifyUserModeDeviceRemoval+0x4c
ac307cc4 820022d2 ac307cf4 00000000 b68b2850 nt!PnpProcessQueryRemoveAndEject+0x89e
ac307cdc 820103d2 00000000 83816f20 843aa578 nt!PnpProcessTargetDeviceEvent+0x38
ac307d00 81ecea6b 83816f20 00000000 843aa578 nt!PnpDeviceEventWorker+0x216
ac307d50 82059fda 80000001 ba148cfe 00000000 nt!ExpWorkerThread+0x10d
ac307d90 81f021f9 81ece95e 80000001 00000000 nt!PspSystemThreadStartup+0x9e
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x19


STACK_COMMAND:  .thread 0xffffffff843aa578 ; kb

FOLLOWUP_IP: 
nt!KiSwapContext+26
81ec8766 8b2c24          mov     ebp,dword ptr [esp]

SYMBOL_STACK_INDEX:  0

SYMBOL_NAME:  nt!KiSwapContext+26

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrpamp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  4ea76eb4

FAILURE_BUCKET_ID:  0x9F_nt!KiSwapContext+26

BUCKET_ID:  0x9F_nt!KiSwapContext+26

Followup: MachineOwner
---------

Code:

..
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1000007E, {c0000005, 82013314, 807868fc, 807864e0}

Probably caused by : ntkrpamp.exe ( nt!PnpIsLegacyDriver+3 )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

SYSTEM_THREAD_EXCEPTION_NOT_HANDLED_M (1000007e)
This is a very common bugcheck.  Usually the exception address pinpoints
the driver/function that caused the problem.  Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003.  This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG.  This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG.  This will let us see why this breakpoint is
happening.
Arguments:
Arg1: c0000005, The exception code that was not handled
Arg2: 82013314, The address that the exception occurred at
Arg3: 807868fc, Exception Record Address
Arg4: 807864e0, Context Record Address

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

FAULTING_IP: 
nt!PnpIsLegacyDriver+3
82013314 83790400        cmp     dword ptr [ecx+4],0

EXCEPTION_RECORD:  807868fc -- (.exr 0xffffffff807868fc)
ExceptionAddress: 82013314 (nt!PnpIsLegacyDriver+0x00000003)
   ExceptionCode: c0000005 (Access violation)
  ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 00000000
   Parameter[1]: 0003e321
Attempt to read from address 0003e321

CONTEXT:  807864e0 -- (.cxr 0xffffffff807864e0)
eax=84a88dd0 ebx=00000000 ecx=0003e31d edx=0000ed34 esi=84a88dd0 edi=84a8e000
eip=82013314 esp=807869c4 ebp=80786b9c iopl=0         nv up ei pl zr na pe nc
cs=0008  ss=0010  ds=0023  es=0023  fs=0030  gs=0000             efl=00210246
nt!PnpIsLegacyDriver+0x3:
82013314 83790400        cmp     dword ptr [ecx+4],0  ds:0023:0003e321=????????
Resetting default scope

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

PROCESS_NAME:  System

CURRENT_IRQL:  0

ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

EXCEPTION_PARAMETER1:  00000000

EXCEPTION_PARAMETER2:  0003e321

READ_ADDRESS: GetPointerFromAddress: unable to read from 81fb8848
Unable to read MiSystemVaType memory at 81f97e20
 0003e321 

FOLLOWUP_IP: 
nt!PnpIsLegacyDriver+3
82013314 83790400        cmp     dword ptr [ecx+4],0

BUGCHECK_STR:  0x7E

LAST_CONTROL_TRANSFER:  from 820123ea to 82013314

STACK_TEXT:  
807869c0 820123ea 87560110 847544a4 87500998 nt!PnpIsLegacyDriver+0x3
80786b9c 8220053d 00000001 00000000 80786bd4 nt!IopLoadDriver+0x8e9
80786be8 822001e0 80814900 80811fe0 00000000 nt!IopInitializeSystemDrivers+0x163
80786c6c 822041de 00811fe0 83920830 839204c0 nt!IoInitSystem+0x6de
80786d48 81fdb448 80786d90 82057fda 80811fe0 nt!Phase1InitializationDiscard+0xced
80786d50 82057fda 80811fe0 963d9055 00000000 nt!Phase1Initialization+0xd
80786d90 81f001f9 81fdb43b 80811fe0 00000000 nt!PspSystemThreadStartup+0x9e
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x19


SYMBOL_STACK_INDEX:  0

SYMBOL_NAME:  nt!PnpIsLegacyDriver+3

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrpamp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  4ea76eb4

STACK_COMMAND:  .cxr 0xffffffff807864e0 ; kb

FAILURE_BUCKET_ID:  0x7E_nt!PnpIsLegacyDriver+3

BUCKET_ID:  0x7E_nt!PnpIsLegacyDriver+3

Followup: MachineOwner
---------

GretyM said:

hey,

thanks for the notes, took me a while to do everything but here goes: i listened to you and have run the SFC three times as you said

Your welcome!

Results on the scan? Errors? No Errors?

GretyM said:

i have installed Avira, but I'll uninstall it and proceed with the MSE installation

Avira would of been okay, but while we are troubleshooting, Windows loves MSE.

GretyM said:

disk cleanup was performed this morning and also, i thought a defragmentation wouldn't hurt so i did that, too
i had some 23 overdue updates, so it had quite a lot to install

Great on the Cleanup, and Defrag, have any troubles with the updates?
I noticed you have UAC turned off, would you mind just bumping it up to the first notch for now?

GretyM said:

the dell site will not recognize my service tag, or at least when hitting the submit button it won't redirect me and the continue button is grey...

We'll let this go for now I noticed an out of date driver, but I can not put my finger on it now. I was hoping the dell updates would take care of it.

If your machine seems okay we'll come back to this later.

GretyM said:

i really hate software updates and only reluctantly install them, that's why i have outdated stuff :P

It is not hard, you just need to develop the habit.

GretyM said:

yes you are right, Java has been bugging for months to do an update, Skype did his own update without me being quick enough to stop it :)
i don't know what syncables is, i think it came with the OS so we lived our parallel lives, i didn't bother him, he didn't bother me...but if you say so, he's out! i have done the disabling of startup applications under msconfig this morning, so syncables was unchecked and i think i have uninstalled the Adobe Reader Speed Launcher in the meantime, plus unchecked the Acrobat Reader Internet function

You'll only need a sync program if you like to do a lot of work with a smart phone etc., and need to dump/sync it back to the 1012

GretyM said:

hope i wasn't supposed to understand the bugcheck analysis because i didn't.

That's okay, some members do, and it has become tradition to code the bug-checks into a post.

GretyM said:

well, aren't you a dear, thanks a lot for helping out, i really needed the laptop for university (exam period)
let me know if there is anything else i have to do

When are exams?
If you feel the 1012 is stronger now, we can wait until your done. I did want you to wait a few days now, and have you work with the 1012 to see if is stable.

The only thing I would suggest is to not use it for for working with pictures for now, and you should consider a newer 1x2gb stick of ram.


Some documentation I used for the 1012:
https://support.dell.com/support/edo...2/en/index.htm

GretyM said:

hi again,

no errors on the SFC, when it got to 100% the black window just closed

Good.

GretyM said:

yeah, installation of MSE not really working...see the screenshot - my laptop is a bit weird, half of it is English, the other half German, but it pretty much says that he couldn't install it because of a problem, which it didn't mention, i restarted the laptop and went again, but still the same errorcode so now i'm antivirusless, let me know what to do regarding that

Simple, just remove MSE, and go back to the Avira.

GretyM said:

while were talking antivirus the Action Center wants me to look online for an antivirus, so when i had Avira he didn't recognize it and the same message came up. now that i wanted to install MSE, the message is "Turn on MSE (Important)", although the installation did not complete, so it did recognize it, why?

That error message is ubiquitous on every report that I have seen because there is a coding error in the Action Center program, been going on for for so long I have stopped looking for a fix.

As for why? it probably has to do with the 1012 being multi-lingual. See above, your quote: "my laptop is a bit weird".

GretyM said:

the defrag and disk cleanup went perfect, i think the laptop is a bit faster now but i couldn't notice dramatic change

That is normal.

GretyM said:

i really hate UAC, when i got the laptop i couldn't do anything on it and i found on google it was the UAC so i disabled it completely but I saw in the Health Report that he advised me to turn it on, so i though i'd give it another shot but as soon as it beacme effective nothing worked, i had no permissions on C:, on my personal folders, i couldn't save anything in my folders...could that be maybe something else? only partly related to the UAC?

How did you set up your User account? You could try creating a new Administrator account, and see how that goes.
User Account - Create

GretyM said:

i do have a Blackberry but i don't think i'm smart enough to use it as i should, so if that's what syncables does, i'll just get rid of it

Okay

GretyM said:

well, exams are over, thank God it didn't fail me then, but i still have some papers, which were on my laptop, that i need to work on now and then

yes, i will consider the 2gb ram

Hope you did well! Good on the 2gb.

GretyM said:

sidenote: yesterday while i still had my Avira on, the real-time scanner found a trojan in system32. i've the worst experiences with system32, so how can i get him outta there? this is what i got:

In der Datei 'C:\Windows\Temp\jdjexe\setup.exe'
wurde ein Virus oder unerwünschtes Programm 'TR/Proxy.Sefbov.E.11' [trojan] gefunden.
Ausgeführte Aktion: Zugriff verweigern
what kind of setup file is it? can i just delete it? i manually copied it to quarantine yesterday, but i have removed Avira now so...?

   Information

Google translates that to:
In the file 'C: \ Windows \ Temp \ jdjexe \ setup.exe'
was a virus or unwanted program 'TR/Proxy.Sefbov.E.11' [trojan] found.
Action Taken: Deny

ok, talk to you later

Yes you can just delete from where you quarantined it, but re-run Avira after you have it up and running.

You may also want to consider an on-line scan like ESET.

There is something you will have to realize about the 1012. It was not designed to work as hard as you are asking it to.

With only 1gb of ram, and a 160gb HDD you are going to have to schedule a weekly maintenance routine, and keep in mind that after you have used it at University or for pictures you will need to move the files you created over to a machine that has larger capacity.

Set Windows Updates to Check for Updates, but let me choose whether to download and install them.

If you are using Avira Free, you need to check for updates twice a week and run the full scan once a month, and quick scan once a week.

Try the Dell Updates site again. The site could have been busy.

EDIT:
Have found additional information on that Trojan: Encyclopedia entry: TrojanProxy:Win32/Sefbov.E - Learn more about malware - Microsoft Malware Protection Center

GretyM said:

hi,

well apparently MSE did install some files and Avira is not proceeding with the installation until i manually remove MSE. i can't find it though, neither in Control Panel Uninstall Program, nor in Program Files, i have no idea where the source folder is, i'll keep looking

With your 32bit, they should be here: C:\Program Files (x86)\Microsoft Security Client or you could type/copy/paste - Microsoft Security Client - in the Start/Search box or Run (preferred)
How to manually uninstall Microsoft Security Essentials 1.0.1963 if you cannot uninstall it by using the Add or Remove Programs item

GretyM said:

i can't remember if i set up an admin profile, some folders i can work with, some not, but i know this problem gave me quite a headache, so maybe after i do a system restore with the USB, i'll give it a shot and delete all the profiles and set up a single one

Use that link I posted earlier to guide you.

GretyM said:

well the 1012 is not exposed to slavery work, i do the normal googling and editing pictures in picasa...i think it should handle that

It will...Up to a point, but what if you didn't transfer all what you worked on from a day or so ago, and now the weekend is here, and you want to take it on holiday

You'll end up right back at:

my windows explorer was pretty slow and i have been moving pictures from my camera on my laptop,

Attachment 195169 That is what the two bug checks were about memory, and HDD performance.

GretyM said:

hm, strange, i had Windows updates check for any updates and it came up with the same 20 something i already installed ... well, they're in the attachments

Are you sure they are the same, have you checked the KB's reference numbers?
Reference them with what you see in View Update History were they Successful or Failed?

Please do these two they should help:
Attachment 195164

GretyM said:

i will do the ESET scan and all the weekly and monthly maintainances, provided i get Avira installed

You'll get it!

GretyM said:

nope, Dell site still with the same problem

well, have a nice day/evening

Are you using FireFox? Try your IE or vice versa.

I'll try, you do the same.


EDIT:
I just tried: CheckSite.us - Check to see if a website is down for you or for everyone. | Dell, and it looks like it is working.

GretyM said:

ok, deinstallation did not work, there is no Microsoft Security Client folder and the tutorial on the Microsoft website didn’t help either as the only Appwiz.cpl I get is in system32 which I am not allowed to delete and when it redirects to Add or Remove Programmes the MSE is not in there

I’m no IT-genius but are there registries I can edit or anything else?

I would like stay away from the registry, if possible.

You have two choices:
Do a System Restore to right before you installed MSE.
Depending on the timing you may have to re-install those 23 Updates, or
Run this to see if you have any MSE on your machine: Revo Uninstaller Freeware - Uninstall Programs

GretyM said:

i do have to do something about the ram
well there were 20 something updates so i assumed they were the same but my bad, i checked and the reference numbers are not the same although the names of each update refer to the same programmes. so many updates have piled up in one day?

It is possible, they can pile up if they are not done on a regular basis.

GretyM said:

all the updates were successful yesterday, i'll just let the other two run when i'm finished

Those two were the ones I was trying to remember yesterday, the one for Intel, and Realtek.

GretyM said:

i'm using Firefox, but i thought it might be a browser thing so i switched to IE, but the same
it isn't that the page is down it's just that when i enter the service number, and hit submit it doesn't redirect me, if i go with NO and let him find the number for me, the Continue button is grey (unclickable).

If your successful with those two updates lets wait on this.

When you get time, have you tried to refresh the page before you went to the NO side? Start with a fresh page. You can use either browser for this.
If it still won't work it may be the Trojan you found that is holding it up. We'll have to try, and get the Anti-virus situation straightened out.

GretyM said:

what is the name of the update i have to run, maybe i can find it on the website and install it manually, without the link

ok, good night

Those two were the ones I was trying to remember yesterday, the one for Intel, and Realtek.