TRAP EXCEPTION error in Recovery Console - SOLVED

Prorootect

Level 69
Thread author
Verified
Nov 5, 2011
5,855
In Safe Mode with cmd / Administrator, I see the window 'Hardware Wizard finds: software for: PCI Modem ..' - but I did not do this.

In Normal Mode, with Process Hacker / right click on explorer.exe process/Miscellaneous/'Run As...' command, then click 'Browse' - this opens 'Open' window with Windows folder, I go to C: \ .. and My Documents too ..
I can see all the folders, but not their contents, eg.I see the 'My Pictures' folder, but after click on it, nothing happens - so I'm not able to see the pictures (maybe everything is at its location in my Windows), no possibility to start the contents ..

If I click on the file, I see Process Hacker window: "Unable to start the program - because it is disabled or no enabled devices associated with it .. '

With "C:\Program Files\Internet Explorer\IEXPLORE.EXE" (copied from Properties of iexplore.exe) command in 'Run', (from Process Hacker/Hacker/Run), I'm able to see my true IE browser with all 7 tabs!

------------

There are damaged motherboard, the motherboard failure, I think firmly now.
- I had dusty places on the motherboard, I have not seen before .. and at the end, computer heated much more than usual, fans worked more strongly ..

This has led to this problem, symptom: I can't see a live screen. And processor heatsink is cold.

Possible solutions for damaged motherboard, I found on the Web: Reset the CMOS , Update the BIOS. I did not do these.

---------------

'The most obvious sign that your computer has a damaged motherboard is that it fails to boot up. If your computer refuses to boot up beyond the startup screen, it means that the motherboard is unable to communicate with the small chip that houses the operations necessary to load your operating system. While problems can occur with the chip itself, the chip is so compact and so integrally linked to the motherboard that it is more likely that the motherboard itself is damaged. Even if you do boot the computer up, there are other indications that your motherboard may be damaged. Slow or sluggish performance can be a sign, especially if you have made sure that your CPU is not overtaxed and you have cleared redundant programs. Overheating, or wildly fluctuating temperatures, are also a possible sign of a motherboard that is about to fail, since fluctuating temperatures can be a sign that the motherboard is not sending the correct instructions to components that generate heat. If you have these issues and you think they are the signs of a damaged motherboard, listen for beeping noises. Certain motherboards are actually designed by the manufacturers to emit specific sequences of beeps if they detect problems, like a motherboard Morse code.'
'What types of damage a motherboard can have
Because the motherboard is such a complex piece of equipment, there are many different components that can be damaged, ranging from minor and fixable to totally catastrophic. One of the simplest causes of damage is dirt getting lodged in the circuits, which is not uncommon for computers that are used outside or in dusty environments. Dirt particles can disrupt a motherboard’s circuits and cause it to fail, but the problem is usually fixable with a thorough, careful cleaning. Also common is water damage, which can be caused by anything from being in a humid environment to dropping your laptop into the swimming pool. Water can cause components in the motherboard to corrode, disrupting circuits and stopping the flow of information. Unfortunately, water corrosion is very rarely fixable, and usually requires that the whole motherboard be replaced.
Other causes of damage include warping, which can be caused by temperature fluctuations. Extreme hot and cold causes metal to expand and contract, while plastic parts can actually melt and bend under extreme heat. Minor warping can cause important connections to pop loose, while serious warping can create cracks in the motherboard. Power problems can also cause damage to the motherboard, either by overloading the circuits because of a power surge, or by not providing enough power to the motherboard because of a faulty battery or power supply. While a serious electrical surge can destroy a motherboard completely, minor power issues usually only cause damage to the motherboard’s capacitors, which are one of the few components that a computer repair professional can replace fairly easily.'
'What to do with a damaged motherboard
Because the motherboard is the most important part of your computer, it is very unwise to attempt any repairs yourself. Even simple maintenance like cleaning can damage components and leave fibers behind, which can seriously hamper your motherboard’s performance. If the signs point to you having a damaged motherboard, your first step should be to find an experienced professional to diagnose the problem and to try to fix it.
Unfortunately, many problems with a motherboard simply cannot be repaired. Corrosion, electrical damage, melted components and severe warping damage a motherboard badly enough that getting a new one quickly becomes a cheaper and less complicated option. Although the motherboard is the central nervous system of your computer – and thus the most expensive component to replace – it does not hold any important data, so you won’t lose files if you replace the motherboard. If you take your computer to a professional to replace the motherboard, you can also ask him to back up your data from the damaged computer’s hard drive, so that you can easily transfer your important files if it ends up cheaper just to replace the computer.
Of course, some motherboard damage is very fixable – though, because the components are so small and delicate, it may still be expensive. Broken capacitors can be replaced, dirt can be cleaned out of the circuits, and very minor warping can be fixed with the right tools. Be sure to ask your professional computer technician for a cost estimate before he begins repairing the motherboard: with components this small and delicate, the costs for repair, replacement or even just getting a new computer can start to look very similar very quickly.
Once your motherboard has been fixed or replaced
Unless it’s the direct result of an external electrical surge, electrical damage to the motherboard is usually caused by other faulty components within the computer. Batteries and power sources are frequent culprits: a faulty power source can very easily cause a motherboard’s circuits to become overloaded and fail. Before taking your computer with its new or repaired motherboard home, ask your computer technician to test your battery, power supply, CPU and any other components that could affect the flow of electricity to the motherboard. If faulty components are to blame for the damage to your motherboard, it is worth spending a little extra money to get those components fixed, since the motherboard itself is usually one of the most expensive parts to repair or replace. It is also worth asking to have your computer thoroughly cleaned inside and out, to minimize the risk of dirt getting back into the circuits, and to get your data backed up so that you can transfer it to a new computer if your motherboard fails again.'
- read more here: What to Do If You Have a Damaged Motherboard : https://www.davescomputersinc.com/damaged-motherboard/
 
Last edited:

Prorootect

Level 69
Thread author
Verified
Nov 5, 2011
5,855
Process Hacker/Run: eventvwr.exe

Then I have the Events Viewer ..

One 'thought', entry seems interesting: from chkdsk - Winlogon:

'It is impossible to write on the first NTFS boot sector.'
 

avast! Protection

Level 2
Verified
Jun 27, 2014
51
By my opinion it just doesn't load the necessary services... I would suggest you to re-install Windows so we can cross off the software part of the issue. If the problem persists after clean install, this will mean it's a hardware problem.
 
  • Like
Reactions: Prorootect

Prorootect

Level 69
Thread author
Verified
Nov 5, 2011
5,855
Well, the crap TRAP Story for you all, this amazing (for you only, NOT for me..) story will be continued, take the look on my notes, please (thank you very much, Process Hacker developer - wj32!) :


PCHunter
/Kernel/Object Hijack:
Object: 0x8random..
Object type: KernelModule
Object Name: C:\Windows\System32\ntkrnlpa.exe
Description: Hijack on Kernel Module File
.. then I look on Ring0 Hooks/Acpi: in red too: IRP_MJ_INTERNAL_DEVICE_CONTROL .. Acpi hook: C:\WINDOWS\system32\ntkrnlpa.exe

Then in Registry: HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce:
Name:
*Restore
Data: C:\WINDOWS\System32\restore\rstrui.exe -c

PowerTool V4.5/Hardware/Hardware Temperature Info:
CPU Temperature: 52 °C .. so it works, it's good my processor!
Motherboard Temperature: 40 °C

.. and PowerTool/Offline/Service: in red:
dmboot Disabled
Image Path: .. \System32\drivers\dmboot.sys - Microsoft, Veritas Software.

.. /Kernel/Kernel File Hijack:
Kernel file, Name: C:\WINDOWS\system32\ntkrnlpa.exe - file has been replaced or infected - in blue!

.. /Kernel Module:
Suspicious: 1 (in red!)
Name:
ntoskrnl.exe
Type: Suspicious driver
Driver Path: C:\WINDOWS\system32\ntkrnlpa.exe
File Corporation: Microsoft Corporation

.. but if I would check PowerTool/Kernel/Kernel Notify Routine - I see big pixellated image on full screen, nothing more .. in Normal Mode, and Safe Mode too!

RogueKiller found in Antirootkit tab:

Filter: API: \Driver\Imapi@Unknown
Module line: \SystemRoot\system32\Drivers\nic1394.sys
..

MBRScan: OK., nothing bad,

Eset SysInspector - would not start, little window with this sad news ..

GMER: in Rootkit/Malware found many Type: IAT:
17 lines: C:\WINDOWS\Explorer.EXE @C:\Windows\Explorer.EXE[ADVAPI32.dll!Reg
22 lines: \Driver\ACPI \Device\0000008e .. 00000062 .. etc


- this story will be continued SOON .. so stay tuned .. :(


PS. Admins please, move this topic on Malware Talk section, please .. Thank you!
 
Last edited:

Prorootect

Level 69
Thread author
Verified
Nov 5, 2011
5,855
Checked another day:
Process Hacker/explorer.exe/Properties/Modules tab: Advapi32.dll highlighted in Relocated DLLs color .. hmmm ..
PCHunter/Kernel/Notify Routine:
CreateProcess C:\WINDOWS\system32\ntkrnlpa.exe
LoadImage C:\WINDOWS\system32\ntkrnlpa.exe

TrendMicro HijackThis:
04 - HKLM\ .. \RunOnce: [*Restore] C:\Windows\system32\restore\rstrui.exe -c
- I see that with this command the malware infects Restore Points ..

PowerTool/Offline/Service: in red:
Service Name: 9Kdp9K
Image Path: C:\Documents and Settings\MyName and my PowerTool folder ..\9Kdp9K.sys - 'file does not exist'.
- I found in Registry
:
HKLM\System\CurrentControlSet\Services\9Kdp9K - 9Kdp9K.sys - which points to PowerTool - to infect PowerTool ..
PowerTool/Offline/Startup link:
*Restore in HKLM RunOnce
CTFMON.EXE in HKCU Run: \USER\S-1- ..\Software\Microsoft\Windows\CurrentVersion\Run.
Kernel/Kernel Notify Routine:
CreateProcess Path: C\Windows\system32\ntkrnlpa.exe - create and close process monitor
LoadImage Path: idem, - Load Image monitor.
I had problems in checking System/VBR bootkit tab .. responding no more ..

- PowerTool folder are infected with these two files: erawtfos.hiv and metsys.hiv

Radix AntiRootkit/Modules: ' Function CcWaitForCurrentLazyWriterActivity was patched' .. then Radix stopped responding ..


MBAM free (MalwareBytes' Anti-Malware) Quick Scan:
Objects detected: 1
Trojan.Reveton : C:\Documents and Settings\All Users\Application Data\6A05CC0.cpp - but I don't see it in Application Data folder!
- so now, I had the name of this malware! Clicked on 'Remove selected', reboot ..but still this same problem: nothing on the screen, no desktop!
Tried Restore Points .. but no joy - still no desktop!
.. after delete (force delete and reboot) CTFMON.EXE from system32 (and Registry) - my Restore Points became blue, finally ..
Trojan.Reveton screenshot in MBAM.jpg
kp5SvRa.jpg

Ransomware Reveton Trojan detected by Malwarebytes' Anti-Malware Free

I remember catching this ransomware there a few weeks, but I thought to eradicate it quickly ..
Surely, he left invisible files or invisible Registry commands, waiting for the payload time, I think.
This payload time is happened, when I clicked on the little cross in Debka website, wanting to get rid of annoying docked window of 'SPECIAL NOTICE', yes very special. DEBKAfile website has realized that his window was infected, because they changed the location of their declaration by placing it directly on the page, without separate docked window .. now we can no longer click on the little cross, it's away .. not present, absent! Hopefully!

SkyboundSteven wrote: 'Maybe your computer was infected with domestic virus first, then the website triggered the payload.' - thank you Steven, exactly!

Debkafile website recent screenshot.jpg - of SPECIAL NOTICE - called before (in the separate window): 'Debka News Updates' ..
eNeM0mq.jpg


Beware - don't click on anything on Debka website - have always redirections problems!

PS. I had done full Factory Recovery of my Windows, all is good (for now)!
 
Last edited:

Prorootect

Level 69
Thread author
Verified
Nov 5, 2011
5,855
No, sadly .. don't click on Debka website ..

Thank you!

- for now, I'm malware free!

.. says Malwarebytes Anti-Rootkit Beta, latest version v1.07.0.1012 (the exe to download is portable!):
MBAR scan result No malware found.jpg
Vt3LS3r.jpg


MBAR Scan time (of my disk and Registry): 7 minutes.
 
Last edited:

About us

  • MalwareTips is a community-driven platform providing the latest information and resources on malware and cyber threats. Our team of experienced professionals and passionate volunteers work to keep the internet safe and secure. We provide accurate, up-to-date information and strive to build a strong and supportive community dedicated to cybersecurity.

User Menu

Follow us

Follow us on Facebook or Twitter to know first about the latest cybersecurity incidents and malware threats.

Top