BouncingSoul

Hey,

I while back posted this thread about Dr Watson.

http://forum.osnn.net/showthread.php?t=43675

Basically when my system froze it loaded Watson and just idled for few minutes before Watson crashed. I was convinced there was a problem with the good doctor and disabled him in the registry. Ever since then I get nice quick crashes but crashes all the same. The error I get is this:

The instruction at "0x02ee321f" referenced memory at "0x00000000". The
memory could not be "written".

I get it the same ways I got the Doctor crashes (opening shortcuts, renaming files, etc) but now that I am getting a memory error I thought it might be bad ram. I ran a memory test, not sure which one, all I know is I had to boot from the floppy to let it scan my RAM all night long. I passed all the tests and now I am up against a wall. I simply have no idea what the issue is and would love to hear some ideas.

Thanks

Weasel

Definately sounds like bad ram or maybe your cpu is bad and corrupting the data. Since you can boot in to windows, I suggest giving BIT a try. There's some other freedos based memory tester that I used to use when I worked for an OEM distributer but I can't remember the name of it right now.

---

BouncingSoul

I passed everything. I feel a reformat coming on.

Attached Thumbnails

 

Mastershakes

Whenever my clients start to see this type of crash, I immediately suspect spyware. Could you run a hijackthis on your comp Bounce? Post the log in here.

I disable that good doc all the time.

A sweep with adaware and spybot wouldn't hurt either.

BouncingSoul

Well I use Firefox so I'm not too concerned about spyware. I have Giant (microsoft) AntiSpyware setup to automatically block spyware as well. I ran a hijackthis scan anyway and don't see anything in IE except the google toolbar.

BouncingSoul

I just remembered something else. When the error message pops up, the title of the dialog box is "ActiveMovie Window - Explorer.exe". If that gives anyone an idea as to what my issue is.

*EDIT*

I did a google search for ActiveMovie Window and it seems lots of people have this problem but no one has a valid solution other than reformatting. Almost all of the people I see have a similar setup to mine (XP MCE2005 SP2, some kind of vid cap card) One tip I've seen is to reinstall ActiveMovie but the thing is I don't know how it got installed (or what it even is for that matter) so I don't know how to reinstall it.

Weasel

Hmmm... yeah, your BIT report looks fine. Active Movie is an encoding codec I believe but why it'd making your system freeze is beyond me. Try to remove it from your system by going to control panel, Sound and Audio devices, Hardware tab, Video codec properties, then properties again and see if it's under that list. If so, nuke it and see what happens.

---

lancer

hey bounce just because you have firefox doesn't mean you're immune to spyware....

To be honest whenever i get a serious prob on my pc that takes me more than two hours to figure out, and even then i cant figure out, i just reformat, usually a lot quicker and certainly will let you know if its hardware or not.

---

BouncingSoul

I don't see anything that screams ActiveMovie in the codec box. I attached a pic of it incase it's actually there but I just don't see it. As far as the spyware goes. I don't think I'm immune, I'm just not worried about it. I've got Giant sweeping my machine every night (it's clean every night), hijack this reports nothing but what I put there, adaware shows nothing but the occasional cookie. Spyware is such big concern of people these days that no one even tries to find another solution, it's just your infected, reformat, that'll be $110. I'm sure there is a cause out there, and if I do reformat. Fine. I'm just curious I guess.

Attached Thumbnails

 

American Zombie

Run a few passes with Memtest and see if you get any errors.

Mastershakes

Got an odd hit with that info you posted Bounce, I'm sure you already checked it, but here it is anyways

"Sincom.C"

http://vic.zonelabs.com/tmpl/body/CA....jsp?VId=36874

BouncingSoul

Memtest ... Thats what its called! This was the one I had on all night that I mentioned in the initial post. It never did find anything, real handy program though.

Mastershakes

I also found this tidbit, I imagine you are on SP2:

From http://board.iexbeta.com/lofiversion...hp/t50182.html


I was browsing for a fix for the DIVX 5.2 problem and came across this. It seems to work, I was getting the error every day until I did this, now it's gone

Right click MY COMPUTER select
Properties - Advanced - Start Up & Recovery Settings & Edit under the system start up section
This will open the Boot.ini file in notepad (or your default editor)
Under [operating systems] replace the parameter /NoExecute=xxxxx with /Execute and then save & reboot
That should do the trick. It's an SP2 issue with DIVX 5.2

BouncingSoul

Hey Shakes (nice name btw, love that show)

Thanks for the info but I don't see any of the files listed on my task manager. I'm doing searches for each file just to be safe. I'll post the results if I find anything.

Mastershakes

Keep in mind the little ûûûû virus creates hidden files. Check that start up registry location it notes.

That second one I posted is the oddest solution I've ever seen. Keep me posted on your findings.

BouncingSoul

I'm trying now. Mine says: "/noexecute=optin". Do I want it to say /execute or /execute=optin. Also should I set a restore point before I do this?

American Zombie

It should say: /noexecute=optin /fastdetect

By the way, that setting is for the DEP (Data Execution Prevention) that SP2 added.

Valid switches are:

/NoExecute=OptIn (enables DEP for Windows system files)

/NoExecute=OptOut (enables systemwide DEP)

/NoExecute=AlwaysOn (enables systemwide DEP without possibility of individual application exclusion)

/NoExecute=AlwaysOff (disables DEP completely)

BouncingSoul

Thanks, I don't see how any of that is caused by divx but I'm willing to try something. Any idea which one should be used?

Mastershakes

Further Information on this option:

/EXECUTE
This optionIt disables no-execute protection. See the /NOEXECUTE switch for more information.

/NOEXECUTE
This option is only available on 32-bit versions of Windows when running on AMD64 processors and only when PAE (see the /PAE switch) is also enabled. It enables no-execute protection, which results in the Memory Manager marking pages containing data as no-execute so that they cannot be executed as code. This can be useful for preventing malicious code from exploiting buffer overflow bugs with unexpected program input in order to execute arbitrary code. No-execute protection is always enabled on 64-bit versions of Windows on AMD64 processors.

Mastershakes

Also, the word of Bill

http://www.microsoft.com/technet/pro.../sp2mempr.mspx