1. TechSpot is dedicated to computer enthusiasts and power users. Ask a question and give support. Join the community here.
    TechSpot is dedicated to computer enthusiasts and power users.
    Ask a question and give support.
    Join the community here, it only takes a minute.
    Dismiss Notice

Hidden rootkit? BSOD

By Valdr
Dec 15, 2008
  1. I have run into a bit of a snag trying to revive my computer that keeps getting a BSOD ~20 seconds after windows startup.

    I am running XP SP3

    "STOP: 0X0000008E 0Xc0000005 0xA12AFB75 0x9F0F47E8 0x00000000"

    Here is what happened:

    I was browsing the internet lastnight when my start bar and start menu changed from XP default to the 'classic windows' style. I restarted my computer and a few seconds after windows put me at my desktop I got the BSOD as described above. I booted up in Safemode then I attempted to open "Malwarebytes' Anti-Malware" however it would not open. I then opened 'SUPERAntiSpyware' using its alternate start (normal start would not open either) and scanned my computer. It came up with:

    (with 57 entrys for the rootkit)

    I removed them all (+ some tracking cookies) and then restarted. booting back into safemode
    and was then able to open Malwarebytes Anti-Malware which came up with the following:

    1 infected registry key:
    HKEY_LOCAL_MACHINE\SOFTWARE\tdss (trojan.Agent)

    2 infected registry data items:
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\Currentversion\Winlogo\userinit (Trojan.Agent) Data: C:\windows\system32\
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\Currentversion\Winlogo\userinit (Trojan.Agent) Data: system32\

    1 infected file:
    C:\windows\system32 (Trojan.Agent)

    all of which were 'Quarantined and deleted successfully'

    I then rebooted and ran windows and got the same BSOD.

    after some reading online I was told to use the minidump feature of XP to find what was left (I was told most likely a rootkit that I can't find). I was however unable to open the .dmp files. I searched and found I had to download a viewer (Horrible idea Microsoft) which I am unable to do due to the computer BSODing when im not in safe mode.

    I am not sure what to do from here, can anybody help?
  2. Kazi

    Kazi TS Enthusiast Posts: 121

    Please try safe mode with networking

    You can also try to attach the logs of MBAM, SAS, and HJT from a clean scan

    After that just try and see if the bsod is fake or not by pressing ctrl alt delete
    if a task manager shows up, its fake
  3. Valdr

    Valdr TS Rookie Topic Starter

    Here are my logs.

    When this problem started I ran Anti-spyware and stoped it after a few files were found. this is why I have several of them.

    here is the last log.
  4. Kazi

    Kazi TS Enthusiast Posts: 121

    keep scanning until clean
Topic Status:
Not open for further replies.

Similar Topics

Add New Comment

You need to be a member to leave a comment. Join thousands of tech enthusiasts and participate.
TechSpot Account You may also...