1

Before the login box on my laptop appears I get an error message relating to savedump.exe: The instruction at "0x0..." referenced memory at "0x0...". The memory could not be written.

Then when I login using the proper credentials, It logs me in for a tiny second and then logs me out again and 'saves my settings'.

Any ideas on this one? Is it related to savedump.exe somehow?

All help hugely appreciated.

EDIT: Safe mode hasn't got me any further - same password box and logged back out immediately after login. Any more ideas?

4 Answers 4

3

Have you booted in "Safe Mode" yet? If not, try that. If "Safe Mode" doesn't work, describe what you see when you try to boot in "Safe Mode".

It sounds like you might have either (a) a hardware problem, or (b) malicious software that has screwed up Windows. (It could be that USERINIT.EXE is screwed-up. That's what runs immediately after you logon, and I've heard anecdotal reports of malicious software rendering the machine into a state you describe after toying with USERINIT.EXE.)

"Safe Mode" will probably get you in. If you do get in, copy the data off to a USB memory stick, etc, and plan on leveling and re-building the machine.

"savedump.exe" is a process that runs on the next boot subsequent to a kernel "STOP" (aka "blue screen") to move the memory dump file that was generated during the STOP. "savedump.exe" isn't a malicious program or anything, though it does sound like it's having a problem performing its function (which makes me wonder if there's a hardware problem).

It's sounding more and more like just pluggin the hard disk drive into another machine (via a USB to IDE/SATA adapter, more than likely) would probably be easier than "teching through" this problem.

Edit:

Here are some options:

  • You could attempt a "repair install", but you may get through all of that and find out that you're no better off. This might render Windows working properly again, though, too. (I'd give it 70 / 30 odds against...) This doesn't really put the data at risk, but I'd consider it my least preferred option.

  • You could do a "parallel install" of Windows (i.e. a second install of Windows into a directory named something other than "\WINDOWS") and use that to get at the data files. This will get you to the data and shouldn't put it at risk, but will take awhile.

  • You could boot one of any number of Linux-based recovery CDs (http://www.sysresccd.org is one with a fairly nice GUI) and try to copy the data off that way. If you're comfortable doing that it might be a way to go. Just be sure you select "read only" to any prompts about mounting the hard drive to keep the data safe.

  • Finally, you could pull the drive and attach it to another computer. That would be what I'd do, but I have a USB to IDE/SATA adapter sitting beside me. >smile<

4
  • 1
    I'd start with a good Memtest86 scan just to rule out the memory. It takes just an hour or so for 1 pass (depending on amount of memory), but if you have defective memory it will save a lot of time troubleshooting other problems. Jul 1, 2009 at 14:11
  • Also, try checking out savedump.exe. The name sounds like a debugging utility, and I can't imagine why it'd be running in userland before user login. It might be badware masquerading as goodware and messing with your system. Jul 1, 2009 at 14:14
  • "savedump.exe" is a component of Windows. It runs in as a user-level process on a boot subsequent to a "blue screen". You can see a bit about what it does here: support.microsoft.com/kb/203052 I like Russ Warren's idea of running Memtest86 (though I'd use Memtest86+, available from memtest.org) to make sure there ins't bad RAM in play, too. Jul 1, 2009 at 14:31
  • Safemode hasn't got me in - i am just presented with a login screen. After logging in, I am logged out again. Any more ideas? Thanks for all the input so far.
    – Galwegian
    Jul 1, 2009 at 15:06
1

There was a virus recently that had that as a symptom.

Here is an older example. new window

That isn't the one I was thinking of but I can't seem to find the right one. It was fairly newsworthy about 3-4 months ago.

1

I see this a lot with corrupt NTUSER.DAT files or something else that rightfully corrupts the user profile. Log in as another user with local administrator rights and give that user a new profile, see if that helps.

0

A few months ago i saw a virus that replaced winlogon.exe. LSASS didn't get expected response and simply kicked the user out.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .