Bugcheck code 0x00000109 after chitka/Adobe Flash HD virus removal

Jeffesmi · 29 May 2013

Hello,

I was going to submit a BSOD, but upon searching the forum, I found a similar incident:

BDSO error 0x00000109 with driver verifier issues

Recommendations on this incident included doing a memory check, a CHKDSK /F /R and a SFC /scannow. The memory check did not show up an issue, but CHKDSK /F /R showed up with the following issue:

Log Name: Application
Source: Microsoft-Windows-Wininit
Date: 5/29/2013 6:17:33 AM
Event ID: 1001
Task Category: None
Level: Information
Keywords: Classic
User: N/A
Computer: DECO-TIM2011.Deco-Sign.local
Description:

Checking file system on C:
The type of the file system is NTFS.
Volume label is OS.

A disk check has been scheduled.
Windows will now check the disk.

CHKDSK is verifying files (stage 1 of 5)...
206848 file records processed.

File verification completed.
Index entries referencing file 34772 will not be validated
because this file contains too many file names.
Index entries referencing file 37182 will not be validated
because this file contains too many file names.
Index entries referencing file 37453 will not be validated
because this file contains too many file names.
Index entries referencing file 37495 will not be validated
because this file contains too many file names.
Index entries referencing file 46544 will not be validated
because this file contains too many file names.
Index entries referencing file 46643 will not be validated
because this file contains too many file names.
Index entries referencing file 46807 will not be validated
because this file contains too many file names.
Index entries referencing file 46809 will not be validated
because this file contains too many file names.
Index entries referencing file 46843 will not be validated
because this file contains too many file names.
Index entries referencing file 46887 will not be validated
because this file contains too many file names.
2959 large file records processed.

0 bad file records processed.

2 EA records processed.

139 reparse records processed.

CHKDSK is verifying indexes (stage 2 of 5)...
262214 index entries processed.

Index verification completed.
0 unindexed files scanned.

0 unindexed files recovered.

CHKDSK is verifying security descriptors (stage 3 of 5)...
206848 file SDs/SIDs processed.

Security descriptor verification completed.
27684 data files processed.

CHKDSK is verifying Usn Journal...
35733088 USN bytes processed.

Usn Journal verification completed.
CHKDSK is verifying file data (stage 4 of 5)...
206832 files processed.

File data verification completed.
CHKDSK is verifying free space (stage 5 of 5)...
58595761 free clusters processed.

Free space verification is complete.
Windows has checked the file system and found no problems.

302179327 KB total disk space.
67396684 KB in 119005 files.
79816 KB in 27685 indexes.
0 KB in bad sectors.
319783 KB in use by the system.
65536 KB occupied by the log file.
234383044 KB available on disk.

4096 bytes in each allocation unit.
75544831 total allocation units on disk.
58595761 allocation units available on disk.

Internal Info:
00 28 03 00 0d 3d 02 00 e0 47 04 00 00 00 00 00 .(...=...G......
67 02 00 00 8b 00 00 00 00 00 00 00 00 00 00 00 g...............
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................

Windows has finished checking your disk.
Please wait while your computer restarts.

SFC /scannow showed up the following problems:

C:\Windows\system32>sfc /scannow

Beginning system scan. This process will take some time.

Beginning verification phase of system scan.
Verification 100% complete.
Windows Resource Protection found corrupt files but was unable to fix some of th
em.
Details are included in the CBS.Log windir\Logs\CBS\CBS.log. For example
C:\Windows\Logs\CBS\CBS.log

I have attached the CBS.log file. Should I still go about collecting the BSOD information or try to address these issues first? I'm unsure how to track back file number to a file name in the CHKDSK log file and the one reference I was able to find for a tool to do this doesn't seem to exist anymore. As for the SFC /scannow, I'm not sure how to proceed. The basic BSOD information is:

On Tue 5/28/2013 9:11:57 PM GMT your computer crashed
crash dump file: C:\Windows\Minidump\052813-12916-01.dmp
This was probably caused by the following module: nt_fffff80000b95000.sys (0xFFFFF80000B96BB0)
Bugcheck code: 0x109 (0xA3A039D896076583, 0xB3B7465EE885A181, 0xFFFFF80000B96BB0, 0x6)
Error: CRITICAL_STRUCTURE_CORRUPTION
Bug check description: This indicates that the kernel has detected critical kernel code or data corruption.
This might be a case of memory corruption. More often memory corruption happens because of software errors in buggy drivers, not because of faulty RAM modules.
A third party driver was identified as the probable root cause of this system error. It is suggested you look for an update for the following driver: nt_fffff80000b95000.sys .
Google query: nt_fffff80000b95000.sys CRITICAL_STRUCTURE_CORRUPTION

This was gathered by WhoCrashed utility.

Thanks,

Jeff

VistaKing · 30 May 2013

jeffesmi

Do you still have the virus ? When you restart the PC and tap F8 on the keyboard do you see Repair Your Computer inside Advanced Boot Options ?

Jeffesmi · 30 May 2013

As far as I can tell the virus is completely removed. I found a specific removal procedure and did the entire thing. I do not see any of the events that let me know there was a virus on the computer at this time. My best guess is that something has been corrupted. I have not tried startup repair because the system starts fine. It runs anywhere from 5 minutes to a couple of hours before it BSODs and restarts. I'll have to be onsite for a startup repair and that could be a couple of days before I'm there. Do you think running startup repair is worth the effort?

VistaKing · 30 May 2013

If possible upload the dmp files . Tutorial below

Blue Screen of Death (BSOD) Posting Instructions

:ADDED:

I sent a PM to tom982 to take a look at your CBS log .

Jeffesmi · 30 May 2013

Also, of note, the file listed in the dump report nt_fffff80000b95000.sys does not appear to exist on the computer and is not referenced in the registry. I'm hoping that there is a way to track back the file number in the chkdsk output to an actual file. Maybe the file(s) listed in chkdsk output is the file(s) that is giving me problems:

Index entries referencing file 37495 will not be validated <== How do you trace this back to an actual file name?
because this file contains too many file names.

VistaKing · 30 May 2013

If you take a look at the Post #4 and take a look at the tutorial to upload the dmp files and other files needed to troubleshoot your issue . Someone will take a look at your dmp files .

Jeffesmi · 30 May 2013

Here it is. Please note that upon completion of the SF tool, I got the following error:

See the end of this message for details on invoking
just-in-time (JIT) debugging instead of this dialog box.

************** Exception Text **************
System.IO.FileNotFoundException: Could not find file 'C:\Windows\msinfo32.nfo'.
File name: 'C:\Windows\msinfo32.nfo'
at Microsoft.VisualBasic.FileIO.FileSystem.CopyOrMoveFile(CopyOrMove operation, String sourceFileName, String destinationFileName, Boolean overwrite, UIOptionInternal showUI, UICancelOption onUserCancel)
at Microsoft.VisualBasic.FileIO.FileSystem.CopyFile(String sourceFileName, String destinationFileName, UIOption showUI, UICancelOption onUserCancel)
at Microsoft.VisualBasic.MyServices.FileSystemProxy.CopyFile(String sourceFileName, String destinationFileName, UIOption showUI, UICancelOption onUserCancel)
at SF_Diagnostic_Tool.Form1.Button1_Click(Object sender, EventArgs e)
at System.Windows.Forms.Control.OnClick(EventArgs e)
at System.Windows.Forms.Button.OnClick(EventArgs e)
at System.Windows.Forms.Button.OnMouseUp(MouseEventArgs mevent)
at System.Windows.Forms.Control.WmMouseUp(Message& m, MouseButtons button, Int32 clicks)
at System.Windows.Forms.Control.WndProc(Message& m)
at System.Windows.Forms.ButtonBase.WndProc(Message& m)
at System.Windows.Forms.Button.WndProc(Message& m)
at System.Windows.Forms.Control.ControlNativeWindow.OnMessage(Message& m)
at System.Windows.Forms.Control.ControlNativeWindow.WndProc(Message& m)
at System.Windows.Forms.NativeWindow.Callback(IntPtr hWnd, Int32 msg, IntPtr wparam, IntPtr lparam)

************** Loaded Assemblies **************
mscorlib
Assembly Version: 2.0.0.0
Win32 Version: 2.0.50727.4984 (win7RTMGDR.050727-4900)
CodeBase: file:///C:/Windows/Microsoft.NET/Framework/v2.0.50727/mscorlib.dll
----------------------------------------
SF Diagnostic Tool
Assembly Version: 5.0.0.6
Win32 Version: 5.0.0.6
CodeBase: file:///C:/Users/tim/Downloads/SF_Diagnostic_Tool.exe
----------------------------------------
Microsoft.VisualBasic
Assembly Version: 8.0.0.0
Win32 Version: 8.0.50727.4927 (NetFXspW7.050727-4900)
CodeBase: file:///C:/Windows/assembly/GAC_MSIL/Microsoft.VisualBasic/8.0.0.0__b03f5f7f11d50a3a/Microsoft.VisualBasic.dll
----------------------------------------
System
Assembly Version: 2.0.0.0
Win32 Version: 2.0.50727.4985 (win7RTMGDR.050727-4900)
CodeBase: file:///C:/Windows/assembly/GAC_MSIL/System/2.0.0.0__b77a5c561934e089/System.dll
----------------------------------------
System.Windows.Forms
Assembly Version: 2.0.0.0
Win32 Version: 2.0.50727.4986 (win7RTMGDR.050727-4900)
CodeBase: file:///C:/Windows/assembly/GAC_MSIL/System.Windows.Forms/2.0.0.0__b77a5c561934e089/System.Windows.Forms.dll
----------------------------------------
System.Drawing
Assembly Version: 2.0.0.0
Win32 Version: 2.0.50727.4985 (win7RTMGDR.050727-4900)
CodeBase: file:///C:/Windows/assembly/GAC_MSIL/System.Drawing/2.0.0.0__b03f5f7f11d50a3a/System.Drawing.dll
----------------------------------------
System.Runtime.Remoting
Assembly Version: 2.0.0.0
Win32 Version: 2.0.50727.4927 (NetFXspW7.050727-4900)
CodeBase: file:///C:/Windows/assembly/GAC_MSIL/System.Runtime.Remoting/2.0.0.0__b77a5c561934e089/System.Runtime.Remoting.dll
----------------------------------------

************** JIT Debugging **************
To enable just-in-time (JIT) debugging, the .config file for this
application or computer (machine.config) must have the
jitDebugging value set in the system.windows.forms section.
The application must also be compiled with debugging
enabled.

For example:

<configuration>
<system.windows.forms jitDebugging="true" />
</configuration>

When JIT debugging is enabled, any unhandled exception
will be sent to the JIT debugger registered on the computer
rather than be handled by this dialog box.

Thanks,

Jeff

Jeffesmi · 30 May 2013

It's 2am here, and I'm exhausted. Thanks for looking at this. This is one of those new class of machines that don't come with an actual Windows installation disk, rather a restore partition.

Whose brilliant idea was that?!?! I'll call HP to see about ordering a real OEM Windows 7 Install disk in case it is needed. Unfortunately, this machine has some customization including an application that is running in Windows XP Virtual Mode that took hours and hours to get tweaked so it would work correctly. I've got to fix this thing one way or another.

Thanks,

Jeff

tom982 · 30 May 2013

Hi Jeff, welcome to SevenForums!

Your CBS log shows the following files are not corrupt, but missing:

Code:

2013-05-28 17:31:43, Info                  CSI    00000335 [SR] Repairing 6 components
2013-05-28 17:31:43, Info                  CSI    00000336 [SR] Beginning Verify and Repair transaction
2013-05-28 17:31:43, Info                  CSI    00000337 [SR] Cannot verify component files for Microsoft-Windows-Content-Filter-Office.Resources, Version = 7.0.7600.16385, pA = PROCESSOR_ARCHITECTURE_AMD64 (9), Culture = [l:10{5}]"en-US", VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral, manifest is damaged (FALSE)
2013-05-28 17:31:43, Info                  CSI    00000338 [SR] Cannot verify component files for Microsoft-Windows-Content-Filter-Office, Version = 7.0.7600.16385, pA = PROCESSOR_ARCHITECTURE_AMD64 (9), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral, manifest is damaged (FALSE)
2013-05-28 17:31:43, Info                  CSI    00000339 [SR] Cannot repair member file [l:26{13}]"office_48.bin" of Microsoft-Windows-Netshell, Version = 6.1.7600.16385, pA = PROCESSOR_ARCHITECTURE_AMD64 (9), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral in the store, file is missing
2013-05-28 17:31:43, Info                  CSI    0000033a [SR] Cannot repair member file [l:26{13}]"office_16.bin" of Microsoft-Windows-Netshell, Version = 6.1.7600.16385, pA = PROCESSOR_ARCHITECTURE_AMD64 (9), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral in the store, file is missing
2013-05-28 17:31:43, Info                  CSI    0000033b [SR] Cannot repair member file [l:26{13}]"office_24.bin" of Microsoft-Windows-Netshell, Version = 6.1.7600.16385, pA = PROCESSOR_ARCHITECTURE_AMD64 (9), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral in the store, file is missing
2013-05-28 17:31:43, Info                  CSI    0000033c [SR] Cannot repair member file [l:26{13}]"office_32.bin" of Microsoft-Windows-Netshell, Version = 6.1.7600.16385, pA = PROCESSOR_ARCHITECTURE_AMD64 (9), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral in the store, file is missing
2013-05-28 17:31:44, Info                  CSI    0000033d [SR] Cannot verify component files for Microsoft-Windows-Content-Filter-Office.Resources, Version = 7.0.7600.16385, pA = PROCESSOR_ARCHITECTURE_INTEL (0), Culture = [l:10{5}]"en-US", VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral, manifest is damaged (FALSE)
2013-05-28 17:31:44, Info                  CSI    0000033e [SR] Cannot verify component files for Microsoft-Windows-Content-Filter-Office, Version = 7.0.7600.16385, pA = PROCESSOR_ARCHITECTURE_INTEL (0), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral, manifest is damaged (FALSE)
2013-05-28 17:31:44, Info                  CSI    0000033f [SR] Cannot repair member file [l:26{13}]"office_48.bin" of Microsoft-Windows-Netshell, Version = 6.1.7600.16385, pA = PROCESSOR_ARCHITECTURE_INTEL (0), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral in the store, file is missing
2013-05-28 17:31:44, Info                  CSI    00000340 [SR] Cannot repair member file [l:26{13}]"office_16.bin" of Microsoft-Windows-Netshell, Version = 6.1.7600.16385, pA = PROCESSOR_ARCHITECTURE_INTEL (0), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral in the store, file is missing
2013-05-28 17:31:44, Info                  CSI    00000341 [SR] Cannot repair member file [l:26{13}]"office_24.bin" of Microsoft-Windows-Netshell, Version = 6.1.7600.16385, pA = PROCESSOR_ARCHITECTURE_INTEL (0), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral in the store, file is missing
2013-05-28 17:31:44, Info                  CSI    00000342 [SR] Cannot repair member file [l:26{13}]"office_32.bin" of Microsoft-Windows-Netshell, Version = 6.1.7600.16385, pA = PROCESSOR_ARCHITECTURE_INTEL (0), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral in the store, file is missing
2013-05-28 17:31:44, Info                  CSI    00000343 [SR] Cannot repair member file [l:26{13}]"office_48.bin" of Microsoft-Windows-Netshell, Version = 6.1.7600.16385, pA = PROCESSOR_ARCHITECTURE_AMD64 (9), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral in the store, file is missing
2013-05-28 17:31:44, Info                  CSI    00000344 [SR] This component was referenced by [l:202{101}]"Microsoft-Windows-Foundation-Package~31bf3856ad364e35~amd64~~6.1.7600.16385.WindowsFoundationDelivery"
2013-05-28 17:31:44, Info                  CSI    00000345 [SR] Cannot repair member file [l:26{13}]"office_16.bin" of Microsoft-Windows-Netshell, Version = 6.1.7600.16385, pA = PROCESSOR_ARCHITECTURE_AMD64 (9), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral in the store, file is missing
2013-05-28 17:31:44, Info                  CSI    00000346 [SR] This component was referenced by [l:202{101}]"Microsoft-Windows-Foundation-Package~31bf3856ad364e35~amd64~~6.1.7600.16385.WindowsFoundationDelivery"
2013-05-28 17:31:44, Info                  CSI    00000347 [SR] Cannot repair member file [l:26{13}]"office_24.bin" of Microsoft-Windows-Netshell, Version = 6.1.7600.16385, pA = PROCESSOR_ARCHITECTURE_AMD64 (9), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral in the store, file is missing
2013-05-28 17:31:44, Info                  CSI    00000348 [SR] This component was referenced by [l:202{101}]"Microsoft-Windows-Foundation-Package~31bf3856ad364e35~amd64~~6.1.7600.16385.WindowsFoundationDelivery"
2013-05-28 17:31:44, Info                  CSI    00000349 [SR] Cannot repair member file [l:26{13}]"office_32.bin" of Microsoft-Windows-Netshell, Version = 6.1.7600.16385, pA = PROCESSOR_ARCHITECTURE_AMD64 (9), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral in the store, file is missing
2013-05-28 17:31:44, Info                  CSI    0000034a [SR] This component was referenced by [l:202{101}]"Microsoft-Windows-Foundation-Package~31bf3856ad364e35~amd64~~6.1.7600.16385.WindowsFoundationDelivery"
2013-05-28 17:31:44, Info                  CSI    0000034b [SR] Cannot repair member file [l:26{13}]"office_48.bin" of Microsoft-Windows-Netshell, Version = 6.1.7600.16385, pA = PROCESSOR_ARCHITECTURE_INTEL (0), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral in the store, file is missing
2013-05-28 17:31:44, Info                  CSI    0000034c [SR] This component was referenced by [l:202{101}]"Microsoft-Windows-Foundation-Package~31bf3856ad364e35~amd64~~6.1.7600.16385.WindowsFoundationDelivery"
2013-05-28 17:31:44, Info                  CSI    0000034d [SR] Cannot repair member file [l:26{13}]"office_16.bin" of Microsoft-Windows-Netshell, Version = 6.1.7600.16385, pA = PROCESSOR_ARCHITECTURE_INTEL (0), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral in the store, file is missing
2013-05-28 17:31:44, Info                  CSI    0000034e [SR] This component was referenced by [l:202{101}]"Microsoft-Windows-Foundation-Package~31bf3856ad364e35~amd64~~6.1.7600.16385.WindowsFoundationDelivery"
2013-05-28 17:31:44, Info                  CSI    0000034f [SR] Cannot repair member file [l:26{13}]"office_24.bin" of Microsoft-Windows-Netshell, Version = 6.1.7600.16385, pA = PROCESSOR_ARCHITECTURE_INTEL (0), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral in the store, file is missing
2013-05-28 17:31:44, Info                  CSI    00000350 [SR] This component was referenced by [l:202{101}]"Microsoft-Windows-Foundation-Package~31bf3856ad364e35~amd64~~6.1.7600.16385.WindowsFoundationDelivery"
2013-05-28 17:31:44, Info                  CSI    00000351 [SR] Cannot repair member file [l:26{13}]"office_32.bin" of Microsoft-Windows-Netshell, Version = 6.1.7600.16385, pA = PROCESSOR_ARCHITECTURE_INTEL (0), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral in the store, file is missing
2013-05-28 17:31:44, Info                  CSI    00000352 [SR] This component was referenced by [l:202{101}]"Microsoft-Windows-Foundation-Package~31bf3856ad364e35~amd64~~6.1.7600.16385.WindowsFoundationDelivery"
2013-05-28 17:31:44, Info                  CSI    00000353 Repair results created:

I'm going to be late for work at this rate, so I'll have to post a fix for this when I get back :)

Tom

tom982 · 30 May 2013

Also, just noticed the manifest error in your CBS log. Can you download and install the System Update Readiness Tool please:

Download System Update Readiness Tool for Windows 7 for x64-based Systems (KB947821) [May 2013] from Official Microsoft Download Center

When finished, post the log:

C:\Windows\Logs\CBS\CheckSUR.persist.log

Tom