Ccleaner 2.21 and bsod error 0x0000008e

CCleaner for Windows
1

Hi! Sorry for my English.

I have on my pc CCleaner ver. 2.21. Then I used 1)page "Cleaner"->button"Analyze"->button"Run Cleaner"; 2)page "Regisrtry"->button"Scan for Issues"->button"Fix selected issues..." and after that do standard restart of operation system I have system error "0x0000008e" without any parametrs. In begin I think about RAM, but test of RAM was good/no errors. I tested my RAM with Memtest86+. And I had this BSOD two times after work of CCleaner. I had this bsod with this version of Ccleaner and with version 2.03.

My config is: MB - Gigabyte EP43DS-3L, CPU - Intel Core 2 Duo E8400 3000MHz, RAM - 2Gb SAMSUNG PC6400 DDR II 800 MHz CL6 x2 modules (4Gb summary), Video - Gigabyte nVidia GeForce 9800GT, HDD - WD640Gb, internal audio and LAN, LAN ADSL modem D-link.

My system is MS Windows XP Pro SP3 Rus, corporate licence, my browser is IE8 Rus.

Please, give me answer. Help!

2

You could try running CCleaner using the debug option, then post your debug log which will be saved in the CCleaner installed folder into this topic for the developers too see.

How to run CCleaner in debug mode:

"C:\Program Files\CCleaner\CCleaner.exe" /debug

3

Thanks, Andavari!

I shall start СCleaner in debug mode later one of these days and then I shall write about result, because a computer of the house at the my sister.

Yesterday, standard start of Ccleaner and standart restart of system after its work bsod has not caused.

I have checked up 2 times. Any floating bug (!?).

As I have lead the analysis mini dump by utility of Microsoft (file's name is Mini062909-01.dmp). File Memory.dmp in folder Windows was not. Result of the analysis mini dump below. Probably it will help to find the reason. I ask, briefly state your ideas. Thanks. Wait your post.

Microsoft ® Windows Debugger Version 6.11.0001.404 X86Copyright © Microsoft Corporation. All rights reserved.Loading Dump File [C:\Dmp\n\Mini062909-01.dmp]Mini Kernel Dump File: Only registers and stack trace are availableSymbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbolsExecutable search path is: Windows XP Kernel Version 2600 (Service Pack 3) MP (2 procs) Free x86 compatibleProduct: WinNt, suite: TerminalServer SingleUserTSBuilt by: 2600.xpsp.080413-2111Machine Name:Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055d720Debug session time: Mon Jun 29 18:31:16.781 2009 (GMT+4)System Uptime: 0 days 4:01:52.515Loading Kernel Symbols..........................................................................................................................Loading User SymbolsLoading unloaded module list..............********************************************************************************																			 **						Bugcheck Analysis									**																			 ********************************************************************************Use !analyze -v to get detailed debugging information.BugCheck 1000008E, {c0000005, 8064ce4d, b65afb14, 0}Unable to load image sfc.SYS, Win32 error 0n2*** WARNING: Unable to verify timestamp for sfc.SYS*** ERROR: Module load completed but symbols could not be loaded for sfc.SYSProbably caused by : sfc.SYS ( sfc+11aa )Followup: MachineOwner---------0: kd> !analyze -v********************************************************************************																			 **						Bugcheck Analysis									**																			 ********************************************************************************KERNEL_MODE_EXCEPTION_NOT_HANDLED_M (1000008e)This is a very common bugcheck.  Usually the exception address pinpointsthe driver/function that caused the problem.  Always note this addressas well as the link date of the driver/image that contains this address.Some common problems are exception code 0x80000003.  This means a hardcoded breakpoint or assertion was hit, but this system was booted/NODEBUG.  This is not supposed to happen as developers should never havehardcoded breakpoints in retail code, but ...If this happens, make sure a debugger gets connected, and thesystem is booted /DEBUG.  This will let us see why this breakpoint ishappening.Arguments:Arg1: c0000005, The exception code that was not handledArg2: 8064ce4d, The address that the exception occurred atArg3: b65afb14, Trap FrameArg4: 00000000Debugging Details:------------------EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - <Unable to get error code text>FAULTING_IP: nt!MiUnmapLockedPagesInUserSpace+1f8064ce4d 8b4818		  mov	 ecx,dword ptr [eax+18h]TRAP_FRAME:  b65afb14 -- (.trap 0xffffffffb65afb14)ErrCode = 00000000eax=00000000 ebx=00000000 ecx=0000001c edx=00000081 esi=8937f820 edi=8989f8b0eip=8064ce4d esp=b65afb88 ebp=b65afbb4 iopl=0		 nv up ei pl zr na pe nccs=0008  ss=0010  ds=0023  es=0023  fs=0030  gs=0000			 efl=00010246nt!MiUnmapLockedPagesInUserSpace+0x1f:8064ce4d 8b4818		  mov	 ecx,dword ptr [eax+18h] ds:0023:00000018=????????Resetting default scopeCUSTOMER_CRASH_COUNT:  1DEFAULT_BUCKET_ID:  DRIVER_FAULTBUGCHECK_STR:  0x8EPROCESS_NAME:  explorer.exeLAST_CONTROL_TRANSFER:  from 80509499 to 8064ce4dSTACK_TEXT:  b65afbb4 80509499 00000000 00000000 b65afb56 nt!MiUnmapLockedPagesInUserSpace+0x1fb65afbc8 b63741aa 00000000 00000000 8989f8b0 nt!MmUnmapLockedPages+0x7bWARNING: Stack unwind information not available. Following frames may be wrong.b65afbfc b6375691 000002a4 8989f8b0 80563a50 sfc+0x11aab65afc28 805d1b22 000001c0 000002a4 00000000 sfc+0x2691b65afc4c 805d2634 00000001 00000004 897de548 nt!PspExitProcess+0x5eb65afcf0 805d27e9 40010004 b65afd4c 804ff93f nt!PspExitThread+0x5aeb65afcfc 804ff93f 897de548 b65afd48 b65afd3c nt!PsExitSpecialApc+0x23b65afd4c 80541687 00000001 00000000 b65afd64 nt!KiDeliverApc+0x1afb65afd4c 7c90e4f4 00000001 00000000 b65afd64 nt!KiServiceExit+0x59035bff6c 00000000 00000000 00000000 00000000 0x7c90e4f4STACK_COMMAND:  kbFOLLOWUP_IP: sfc+11aab63741aa ??			  ???SYMBOL_STACK_INDEX:  2SYMBOL_NAME:  sfc+11aaFOLLOWUP_NAME:  MachineOwnerMODULE_NAME: sfcIMAGE_NAME:  sfc.SYSDEBUG_FLR_IMAGE_TIMESTAMP:  4a393a95FAILURE_BUCKET_ID:  0x8E_sfc+11aaBUCKET_ID:  0x8E_sfc+11aaFollowup: MachineOwner---------0: kd> lmvm sfcstart	end		module nameb6373000 b63760c0   sfc	  T (no symbols)		   Loaded symbol image file: sfc.SYSImage path: sfc.SYSImage name: sfc.SYSTimestamp:		Wed Jun 17 22:48:53 2009 (4A393A95)CheckSum:		 0000A52DImageSize:		000030C0Translations:	 0000.04b0 0000.04e4 0409.04b0 0409.04e4

Mini062909_01.zip

Mini062909_01.zip

4

My problem was in a virus. Its name Trojan.Win.Spy with any number in name, has not remembered. The infected file c:\windows\system32\sfcfiles.dll and generated by it c:\windows\system32\drivers\sfc.sys which caused bsod, that has confirmed the analysis mini-dump, have been found out and removed by free utility CureIt! of Dr. Web Company. The removed file sfcfiles.dll has been replaced same from other computer by me. CCleaner above suspicion. All thanks. It's ok.