UBCD4Win Forums: Bsod 0X7B - UBCD4Win Forums

Jump to content

Page 1 of 1
  • You cannot start a new topic
  • You cannot reply to this topic

Bsod 0X7B

#1 User is offline   CPUfoo Icon

  • Newbie
  • Pip
    • Group: Members
    • Posts: 16
    • Joined: 22-September 09
    • Gender:Male
    • Location:Fenton, MI

    Posted 16 November 2009 - 11:28 PM

    3weeks ago - PNY 2gb - fat-32-lba with CD Kicker
    built with XP-SP2 on SP2 Machine
    updated Avira, SuperAntiSpyware plugins used UBUSB 1.045

    With in the last week
    Building a new UB4WIN on same system with same XP-SP2 cd, d/l new copy of UBCD4WIN 3.5 create a base Bart PE
    UBUSB v 1.46 - fat-32 LBA 1gb partition "Create CD Kicker.. " selected, "NOP" (no idea what that is) not selected
    Receiving a BSOD 0x7b... just after the WinXP load screen (with CD kicker w/o bios support & (memory mapped))
    Restart and run USB as a HDD in bios, select first option Launch "UBCD4Win" and get
    "The File megasr.SY is corrupted" Press any key then setup failed

    I get this on all 3 of my computers all running XP-SP3 Avira Antivir 9 and Super Anti-Spyware all different makes and models

    last attempt i removed Avira completely before testing.
    Booted USB as a HDD from bios - allows me to get to Pre-Shell then loads get a message "start_gbcheck.cmd timed out"
    then it appears to work

    I believe that the latest Avira Antivir 9 Free edition should be looked at for any boot problems
    and in case a primary HDD can't be accessed to remove an existing installation.
    i am sorry i have limited knowledge on this to explain it any further

    This post has been edited by CPUfoo: 17 November 2009 - 12:04 AM

    0

    #2 User is offline   CPUfoo Icon

    • Newbie
    • Pip
      • Group: Members
      • Posts: 16
      • Joined: 22-September 09
      • Gender:Male
      • Location:Fenton, MI

      Posted 17 November 2009 - 12:16 AM

      On a strange note - I also have 8 anti-spyware 5 application 5 clean up 6 Disk tool etc... connect-to menus under programs most have multiple options further as well
      0

      #3 User is offline   rdsok Icon

      • rdsok
      • PipPipPipPipPipPipPipPip
        • Group: Admin
        • Posts: 6,037
        • Joined: 02-October 05
        • Gender:Male
        • Location:Norman, Ok. USA

        Posted 17 November 2009 - 12:26 AM

        Select either of the compatibility mode options when booting from USB.


        Enable building of the ISO so the post processing ( like menu sorting etc ) can happen.
        Plan A is always more effective when the device you are working on understands that Plan B involves either a large hammer or screwdriver....
        0

        #4 User is offline   CPUfoo Icon

        • Newbie
        • Pip
          • Group: Members
          • Posts: 16
          • Joined: 22-September 09
          • Gender:Male
          • Location:Fenton, MI

          Posted 17 November 2009 - 01:41 AM

          Tested Successful again

          completely removed Avira Free Edition 9.xx (latest version)

          SP2 BartPE UBUSB 1.46 fat-32 lba with no bios kicker on a 100gb maxtor IDE-USB

          no 0x7b... BSOD

          please can the project managers look into this? I will post which files avira is detecting asap
          0

          #5 User is offline   pcuser Icon

          • Project Programmer
          • PipPipPipPipPipPipPip
            • Group: Moderator & Development
            • Posts: 3,889
            • Joined: 20-November 04
            • Gender:Male
            • Location:Kneebrasskee

            Posted 17 November 2009 - 01:55 AM

            Quote

            please can the project managers look into this?


            Look into what??? Many thousands of people use this same software without problems. If you're having issues then you need to be more specific.
            If you're afraid of taking any chances then the chances are great that you will never learn anything

            Multiboot Plugins - UBUSB (Ultimate Boot USB) - EzPcFix - RootKitty - Network Configuration Utility - UnIsoFS - A Small Linux Distro - SELogger - HashME - WSock - My Paypal
            0

            #6 User is offline   KCarney Icon

            • Regular Member
            • PipPipPip
              • Group: BETA Tester
              • Posts: 231
              • Joined: 29-January 07
              • Location:New York

              Posted 17 November 2009 - 11:18 AM

              I get the same BSOD code with my issue
              0

              #7 User is offline   CPUfoo Icon

              • Newbie
              • Pip
                • Group: Members
                • Posts: 16
                • Joined: 22-September 09
                • Gender:Male
                • Location:Fenton, MI

                Posted 17 November 2009 - 02:09 PM

                From Avira: "Rootkits hide and update spyware on your PC. The AntiRootkit feature detects and removes rootkits."

                The rootkit scanning does not involve opening files and reading their contents, as the usual virus scanning. Consequently, you can not specify exceptions.

                For security reasons, we cannot explain the exact process of rootkit scanning.


                Affected products
                • Avira AntiVir Professional [Windows]
                • Avira Premium Security Suite [Windows]
                • Avira AntiVir Premium [Windows]
                • Avira AntiVir Personal - FREE Antivirus [Windows]

                When creating a BartPE, Avira detects:

                Begin scan in 'C:\UBCD4Win'
                C:\UBCD4Win\BartPE\i386\system32\nircmd.exe
                [DETECTION] Contains recognition pattern of the APPL/NirCmd.D.2 application
                C:\UBCD4Win\BartPE\programs\combofix\ComboFix.exe
                [0] Archive type: RAR SFX (self extracting)
                --> 32788R22FWJFW\psexec.cfexe
                [1] Archive type: RSRC
                --> Object
                [DETECTION] Contains recognition pattern of the APPL/PsExec.E application
                C:\UBCD4Win\BartPE\programs\sdfix\SDFix.exe
                [DETECTION] Contains recognition pattern of the APPL/PrcView.E application
                C:\UBCD4Win\oem1\PEUtils\nircmd.exe
                [DETECTION] Contains recognition pattern of the APPL/NirCmd.D.2 application
                C:\UBCD4Win\plugin\Cleanup Tools\ComboFix\ComboFix.exe
                [0] Archive type: RAR SFX (self extracting)
                --> 32788R22FWJFW\psexec.cfexe
                [1] Archive type: RSRC
                --> Object
                [DETECTION] Contains recognition pattern of the APPL/PsExec.E application
                C:\UBCD4Win\plugin\Cleanup Tools\SDFix\SDFix.exe
                [DETECTION] Contains recognition pattern of the APPL/PrcView.E application

                The anti-root kit tool in Avira must detect one if these, APPL/NirCmd.D.2 most likely, and makes a stop error to protect the computer.

                - My Fix - un install Avira then ubcd4win works

                This post has been edited by CPUfoo: 17 November 2009 - 02:18 PM

                0

                #8 User is offline   pcuser Icon

                • Project Programmer
                • PipPipPipPipPipPipPip
                  • Group: Moderator & Development
                  • Posts: 3,889
                  • Joined: 20-November 04
                  • Gender:Male
                  • Location:Kneebrasskee

                  Posted 17 November 2009 - 06:58 PM

                  I just noticed that you're using v1.0.45 which had a bug that was fixed in v1.0.46
                  If you're afraid of taking any chances then the chances are great that you will never learn anything

                  Multiboot Plugins - UBUSB (Ultimate Boot USB) - EzPcFix - RootKitty - Network Configuration Utility - UnIsoFS - A Small Linux Distro - SELogger - HashME - WSock - My Paypal
                  0

                  #9 User is offline   rdsok Icon

                  • rdsok
                  • PipPipPipPipPipPipPipPip
                    • Group: Admin
                    • Posts: 6,037
                    • Joined: 02-October 05
                    • Gender:Male
                    • Location:Norman, Ok. USA

                    Posted 17 November 2009 - 07:39 PM

                    In addition the items you mentioned were not detected as rootkits... they are called riskware, hacktools or PUP's which we've covered in the forum and the FAQ's... they are not malicious but are considered an possible security risks when a user is unaware of their existance. You really should read the FAQ's
                    Plan A is always more effective when the device you are working on understands that Plan B involves either a large hammer or screwdriver....
                    0

                    #10 User is offline   CPUfoo Icon

                    • Newbie
                    • Pip
                      • Group: Members
                      • Posts: 16
                      • Joined: 22-September 09
                      • Gender:Male
                      • Location:Fenton, MI

                      Posted 17 November 2009 - 11:36 PM

                      In no way was I trying to discredit this great compilation of utilities. I was trying to be as thorough as I could to why I believed my problem was with avira not with the build.
                      Avira does not list what it scans for rootkits as a security reason so I had no idea which file it was stopping. The build is with 1.0.0.46 and it works great on a system without avira installed.
                      I could not find a fix for the 0x7b error i was getting on the forums. Everything suggested just didn't work and removing avira did.

                      I honestly thought this would help others since it was a new take on the 0x7b stop error. Please keep up the good work and next time I post it will be more informed.
                      0

                      #11 User is offline   pcuser Icon

                      • Project Programmer
                      • PipPipPipPipPipPipPip
                        • Group: Moderator & Development
                        • Posts: 3,889
                        • Joined: 20-November 04
                        • Gender:Male
                        • Location:Kneebrasskee

                        Posted 18 November 2009 - 12:01 AM

                        Quote

                        Everything suggested just didn't work and removing avira did.


                        Was it removing Avira from your UBCD4Win build, from the system you're building on or the system you're booting on?
                        If you're afraid of taking any chances then the chances are great that you will never learn anything

                        Multiboot Plugins - UBUSB (Ultimate Boot USB) - EzPcFix - RootKitty - Network Configuration Utility - UnIsoFS - A Small Linux Distro - SELogger - HashME - WSock - My Paypal
                        0

                        #12 User is offline   CPUfoo Icon

                        • Newbie
                        • Pip
                          • Group: Members
                          • Posts: 16
                          • Joined: 22-September 09
                          • Gender:Male
                          • Location:Fenton, MI

                          Posted 18 November 2009 - 01:23 PM

                          The build worked with Avira updated and enabled but would get 0x7b when booting on a system with Avira installed on the main drive.

                          It seems odd that it would affect UBCD since it boots before windows does but I keep going back to the rootkit tool in Avira, since it is fairly new to the program.

                          This post has been edited by CPUfoo: 18 November 2009 - 01:26 PM

                          0

                          #13 User is offline   CPUfoo Icon

                          • Newbie
                          • Pip
                            • Group: Members
                            • Posts: 16
                            • Joined: 22-September 09
                            • Gender:Male
                            • Location:Fenton, MI

                            Posted 18 November 2009 - 03:20 PM

                            At every turn I seem to be more and more misguided.

                            test
                            3.5 HDD Connected IDE-USB
                            UBCD v. 3.5 XP-SP2 boot with UBUSB 1.0.0.46 w/ Kicker iso

                            result
                            installed Avira Personal while drive was connected in windows
                            restart system to load UBCD using the kicker cd
                            ...(memory mapped) works with error d:\xpsp\base\boot\setup\setup.c. press any key
                            Windows XP load screen
                            STOP: 0x7b (0xF78CE528, 0xC0000034, ...)

                            test
                            3.5 HDD Connected IDE-USB
                            UBCD v. 3.5 XP-SP2 boot with UBUSB 1.0.0.46 w/ Kicker iso

                            result
                            load on a new system without Avira installed
                            ...(memory mapped) works with error d:\xpsp\base\boot\setup\setup.c. press any key
                            Windows XP load screen
                            STOP: 0x7b (0xF78CE528, 0xC0000034, ...)

                            test
                            PNY 2GB Flash Drive USB
                            UBCD v. 3.5 XP-SP2 boot with UBUSB 1.0.0.46 w/ Kicker iso

                            result
                            was not connected to a system when Avira was installed
                            load UBCD using the kicker cd
                            ...(memory mapped) works with error d:\xpsp\base\boot\setup\setup.c. press any key
                            Windows XP load screen
                            Pre-Shell then working well

                            When Avira installs a new patch/update to the program itself(not .vdf), it appears that the program will place a 32-bit disk signature on each device that is connected to the computer. I believe that the Nov. 11 update to the Avira program is putting these signatures on the drives and when the UBCD is unpacked it detects the SPR/Appl that werent there previously and forces a BSOD.

                            Can a work around be made for this? Should it be? Hope this helps.
                            0

                            #14 User is offline   pcuser Icon

                            • Project Programmer
                            • PipPipPipPipPipPipPip
                              • Group: Moderator & Development
                              • Posts: 3,889
                              • Joined: 20-November 04
                              • Gender:Male
                              • Location:Kneebrasskee

                              Posted 18 November 2009 - 05:12 PM

                              Quote

                              When Avira installs a new patch/update to the program itself(not .vdf), it appears that the program will place a 32-bit disk signature on each device that is connected to the computer.

                              That will definately cause a 0x7B BSOD if the physical disk MBR checksum no longer matches the kicker image MBR checksum.

                              Quote

                              Can a work around be made for this? Should it be?

                              If Avira constantly monitors it's own custom disk signature and automatically changes it back when you modify it then the best course of action would be to contact Avira support and ask them how to make it ignore changes to a specific drive. If it doesn't constantly monitor it then you might be able to run UBUSB and go to "Tools -> Create Kicker CD Only" which will write a new matching set of MBR's between your usb drive and kicker images.
                              If you're afraid of taking any chances then the chances are great that you will never learn anything

                              Multiboot Plugins - UBUSB (Ultimate Boot USB) - EzPcFix - RootKitty - Network Configuration Utility - UnIsoFS - A Small Linux Distro - SELogger - HashME - WSock - My Paypal
                              0

                              #15 User is offline   CPUfoo Icon

                              • Newbie
                              • Pip
                                • Group: Members
                                • Posts: 16
                                • Joined: 22-September 09
                                • Gender:Male
                                • Location:Fenton, MI

                                Posted 18 November 2009 - 07:31 PM

                                Quote

                                you might be able to run UBUSB and go to "Tools -> Create Kicker CD Only" which will write a new matching set of MBR's between your usb drive and kicker image


                                This is a confirmed fix for this problem. Only other option would be to disconnect your UBUSB after use so Avira doesn't change the MBR
                                0

                                Page 1 of 1
                                • You cannot start a new topic
                                • You cannot reply to this topic

                                1 User(s) are reading this topic
                                0 members, 1 guests, 0 anonymous users