Page fault 1

[itsmystie]

hello everybody.

i have a dell laptop with win xp home edition. recently i had installed spy doctor and kaspersky on it. after a few days of use, i started getting this problem shortly after the system has booted and loaded windows:

I get a black screen with the following message:
A problem has been detected and Windows has been shut down to prevent damage to you rcomputer. The Problem seems to be caused by the following file: srescan.sys. PAGE_FAULT_IN_NONPAGED AREA.

Now i removed both spy doctor and kaspersky from my system, but I'm still getting this problem. It doesn't happen every time. It occurs just out of the blue. Any clue?

 

[wahnula]

Memory issue I'll bet. If running with more than one stick, try using one at a time. Yo test, you can use:

http://www.memtest86.com/

http://oca.microsoft.com/en/windiag.asp

or just use the PC to test each stick of RAM. It's usually located on the bottom of the laptop behind a removable plate. There will be springs on either side of the stick, pull them back to release the RAM. Doubtful either program has anything to do with the error.

Tony

 

[roland63]

I second wahnula (1st reply) - especially with using memtest86 (fyi memtest86 may take a long time to finish)..

 

[wahnula]

I completely missed the srescan.sys part of the error. This is either a part of Zone Alarm or a trojan:

http://www.file.net/process/srescan.sys.html

If you have never installed any Zone Labs software this is an infected file. Ignore the ads on the page above, re-install Kaspersky after booting into Safe Mode, (press F8 during boot), update its definitions, and scan. If your PC won't stay up long enough, go to Tools>Folder Options>View>Show Hidden Files and Folders and go to c:\windows or c:\windows\system32 and manually delete the file.

You may need to stop the process: CTRL+ALT+DEL >Processes> right-click the srescan.sys process and End Process. Report back when you get the chance.

Tony

 

[itsmystie]

I've got NOD32 installed. I'll update its definitions and scan my system as soon as i can. Is it necessary to do the scanning in safe mode?

 

[itsmystie]

I forgot to say. I have ZoneAlarm Pro installed.

 

[wahnula]

OK...no it's not necessary to run in Safe Mode, but if it's a driver bug Safe Mode with Networking will allow the machine to run long enough to update and scan. It's still probably a RAM issue, but I would disable Zone Alarm from startup (Start->Run->type "msconfig" without the quotes->Startup->un-check Zone Alarm) to eliminate it from the equation. But also note this could be by design...a trojan/worm that locks up your PC when it detects that file that says you have Zone Alarm installed, a program that tells the user a worm/trojan is about to "phone home"...

So I would do the following:

As soon as PC boots, update A/V
Disconnect from Internet physically (pull the plug)
Disable Zone Alarm
Run full scan, if it won't finish in normal mode try Safe Mode
Reconnect to Internet (or Safe Mode with Networking) and run HouseCall:

http://housecall.trendmicro.com/

If all that fails it's almost definitely one RAM stick or the other.

If it all works then re-enable Zone Alarm at startup, see if the problem returns.
Best of luck.

Tony

 

[HalComps]

have you recently updated windows? as a few people have reported problems concerning ZA. you could try uninstalling ZA and reinstalling it with the updates, i dont think its a ram problem but i could be wrong

 

[itsmystie]

No i've not updated windows.

I've run the scan with zonealarm shut down. I got the following:

c:\pagefile.sys - error opening [file locked][4]

I got several messages like this with files like NTUSER.DAT, SECURITY, SOFTWARE ERROR, etc...

But the scan completed normally in Normal mode. Did not boot to safe mode.