Windows won't start in normal or safe mode

[danwizard208]

I have an Acer laptop, with Windows XP Home Edition, Service Pack 2, and it didn't have anti-spyware for about a year. Then it got infected with spyware and adware. So I put Mcafee on my computer, which seemed to clean up all my viruses (except for some that it only partially removed, but which didn't bug me). Then a week later my laptop crashed (first blue screening and giving me a stop message for 1 second which i didn't have time to read). It rebooted getting as far as telling me to diskcheck which I skipped, and then crashing (with same blue screen as last time). It rebooted again getting to the same place, this time I allowed the diskcheck, and it still crashed. I tried starting with last good configuration and it again got as far as disk check (tried twice, once allowing and once skipping disk check) and it still crashed. I tried starting it in safemode and it started loading drivers, got as far as mup.sys then told me to "press Esc to skip loading Stpd.sys", I did, and it froze. I manually rebooted retried safe mode, it got as far as mup again, asked me same thing as last time, this time I didn't press Escape and it froze again.
I took a picture of the blue screens I was getting on my phone, and downloaded it to another desktop I have at home, and got a stop message of:

*** STOP: 0x0000008E (0xC0000005,0xBF841D43,0xF86A4AEC,0x00000000)
*** win32k.sys - Address BF841D43 base at BF800000, Datestamp 45f013f6

After not managing to boot normally, I tried repairing Windows from the Acer system, and recovery cds, 3 times, and it didn't help.
Reinstalling Windows from that cd would mean total reformatting of the disk and loss of all data, so I tried something else.
I installed a copy of Windows XP Proffesional (not compatible for my laptop of course) which installed, booted, and came up fine.
So now I have a copy of working Windows on my computer but that isn't compatible with my laptop, so I'm trying to use the working version to debug the old one. The working copy of Windows though doesn't recognize my network hardware though, so using a usb pen drive to get data off my laptop, I'm using the desktop as my base of operations.

I put the minidumps from my laptop on to the pen drive, and copied them to the desktop, where I setup Debugging Tools for Windows, and read them.

For the first minidump (the only one in the directory of the original Windows, probably reffering to the first crash that started all my problems) it was having trouble with the symbols, sometimes saying only lzx32.sys couldn't find its symbols and sometimes saying that both lzx32.sys and ntoskrnl.exe couldn't find their symbols. These times the debugger blamed lzx32.sys.
I googled lzx32.sys and found that it was the driver for Rustock Rootkit, but all the tools too remove it require the windows infected with it to be running either in safe or normal mode neither of wich manages to load.
I checked if lzx32.sys existed in the directory it's supposed to be in (even though it's supposed to be hidden) and it was there (probably because I checked using an operating system besides the one that was infected). Exact wording as follows:


Microsoft (R) Windows Debugger Version 6.6.0007.5
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Documents and Settings\Daniel\Desktop\MINIDUMPS\Mini040807-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: C:\Windows\Symbols
Executable search path is: C:\Windows\Symbols
Unable to load image ntoskrnl.exe, Win32 error 2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
Windows XP Kernel Version 2600 (Service Pack 2) UP Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Kernel base = 0x804d7000 PsLoadedModuleList = 0x805533a0
Debug session time: Sun Apr 8 22:53:37.390 2007 (GMT+2)
System Uptime: 0 days 13:22:35.965
Unable to load image ntoskrnl.exe, Win32 error 2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
Loading Kernel Symbols
.................................................................................................................................................
Loading User Symbols
Loading unloaded module list
............
Unable to load image lzx32.sys, Win32 error 2
*** WARNING: Unable to verify timestamp for lzx32.sys
*** ERROR: Module load completed but symbols could not be loaded for lzx32.sys
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1000008E, {c0000005, aafaf5cf, aa591a20, 0}

*** WARNING: Unable to verify timestamp for mssmbios.sys
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: mssmbios!_SMBIOS_DATA_OBJECT ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: mssmbios!_SMBIOS_DATA_OBJECT ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: mssmbios!_SMBIOS_DATA_OBJECT ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: mssmbios!_SMBIOS_DATA_OBJECT ***
*** ***
*************************************************************************
Probably caused by : lzx32.sys ( lzx32+25cf )

Followup: MachineOwner
---------

 

[danwizard208]

(continued)

For all the minidumps that were in my working copy of windows (all except the first, probably describing dumps that happened on the failing Windows while my working Windows was installed), it found all the symbols it needed and blamed win32k.sys (just like the stop message, and something about drawing a rectangle, probably to do with graphics). Exact wording as follows:

Microsoft (R) Windows Debugger Version 6.6.0007.5
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Documents and Settings\Daniel\Desktop\MINIDUMPS\Mini041707-02.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: C:\Windows\Symbols
Windows XP Kernel Version 2600 (Service Pack 2) UP Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 2600.xpsp_sp2_gdr.070227-2254
Kernel base = 0x804d4000 PsLoadedModuleList = 0x80557620
Debug session time: Tue Apr 17 07:30:51.343 2007 (GMT+2)
System Uptime: 0 days 0:00:13.890
Loading Kernel Symbols
........................................................................................................................
Loading User Symbols
Loading unloaded module list
......
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1000008E, {c0000005, bf841d43, f8772aec, 0}

Probably caused by : win32k.sys ( win32k!SetTiledRect+1b )

Followup: MachineOwner
---------

kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

KERNEL_MODE_EXCEPTION_NOT_HANDLED_M (1000008e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003. This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG. This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG. This will let us see why this breakpoint is
happening.
Arguments:
Arg1: c0000005, The exception code that was not handled
Arg2: bf841d43, The address that the exception occurred at
Arg3: f8772aec, Trap Frame
Arg4: 00000000

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx". The memory could not be "%s".

FAULTING_IP:
win32k!SetTiledRect+1b
bf841d43 8b4004 mov eax,dword ptr [eax+4]

TRAP_FRAME: f8772aec -- (.trap fffffffff8772aec)
ErrCode = 00000000
eax=00000000 ebx=e17efb00 ecx=00000001 edx=00000000 esi=00008000 edi=bc5d1b48
eip=bf841d43 esp=f8772b60 ebp=f8772b88 iopl=0 nv up ei ng nz na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010286
win32k!SetTiledRect+0x1b:
bf841d43 8b4004 mov eax,dword ptr [eax+4] ds:0023:00000004=????????
Resetting default scope

CUSTOMER_CRASH_COUNT: 2

DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: 0x8E

PROCESS_NAME: winlogon.exe

LAST_CONTROL_TRANSFER: from bf84145e to bf841d43

STACK_TEXT:
f8772b88 bf84145e e17efb00 f8772c2c bc5d1b48 win32k!SetTiledRect+0x1b
f8772c6c bf83eeed 00000000 00000000 e17f5178 win32k!xxxCreateWindowEx+0x5f0
f8772d20 804db7ec 80000000 f8772cec f8772ce0 win32k!NtUserCreateWindowEx+0x1c1
f8772d20 7c90eb94 80000000 f8772cec f8772ce0 nt!KiFastCallEntry+0xf8
WARNING: Frame IP not in any known module. Following frames may be wrong.
004feab4 00000000 00000000 00000000 00000000 0x7c90eb94


STACK_COMMAND: kb

FOLLOWUP_IP:
win32k!SetTiledRect+1b
bf841d43 8b4004 mov eax,dword ptr [eax+4]

SYMBOL_STACK_INDEX: 0

SYMBOL_NAME: win32k!SetTiledRect+1b

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: win32k

IMAGE_NAME: win32k.sys

DEBUG_FLR_IMAGE_TIMESTAMP: 45f013f6

FAILURE_BUCKET_ID: 0x8E_win32k!SetTiledRect+1b

BUCKET_ID: 0x8E_win32k!SetTiledRect+1b

Followup: MachineOwner
---------

My theory:
The first crash was related to mcafee only partly removing this rootkit because it was disguised as a system file, which caused problems with the stack/memory, and caused all the subsequent crashes during startup.

so now I'm asking you if you have any idea how to:
a.deal with this memory/stack problem, or whatever the real problem is

b. remove this Rustock Rootkit from my old edition of Windows using the Windows Proffesional which works but isn't compatible with my laptop.