0x7b after rootkit removal

xxsilk109xx

xxsilk109xx

New Member
Reaction score
1
Location
Savannah, GA
I have a windows xp laptop here, it had the "windows xp fix" virus and i manually removed it. I then restarted the computer, noticed it was acting funny. So I used TDSS killer, it found two items, so i removed them and then restarted.

Problem is I get the bsod, 0x7d. Try to go to safe mode, same thing. I tried to use the windows xp recovery console to fixmbr and such but it says that it cant find the hard drive.

I have hirens and ubcd, can someone tell me how to fix this little issue?
I see some tools in there that might work but before I mess it up any more I would like a little insight.
Thanks!
 
Is the hard drive seen in the BIOS?
Ensure that the partition that the operating system is on is active.
 
I can see it perfect when I use Hirens Boot CD, the seagate utility says its in perfect condition. I will check the bios hard drive self test, but the bios doesnt show much information about the hard drive, its an older HP.
 
If the BIOS sees the drive as does Hirens, then the issue seems to be with the OS and it's drivers.
 
The items that TDSSKiller removed probably were infected system drivers, like atapi.sys, ntfs.sys, etc. Do an offline SFC maybe to replace the drivers, replace the files manually , and/or do a repair install if necessary.
 
Vicenarian said:
The items that TDSSKiller removed probably were infected system drivers, like atapi.sys, ntfs.sys, etc. Do an offline SFC maybe to replace the drivers, replace the files manually , and/or do a repair install if necessary.
Click to expand...

Thats a good point, have a look at the TDSSKiller logs and see what was removed and replace the files with clean copy's.

In order to use SFC offline, you will require ERD commander for XP as SFC cannot be run from within the recovery console.
 
well I have tried to use ms dart and the windows xp setup disk and it tells me that it cant find the hard drive to install it to...

argh!!
 
xxsilk109xx said:
well I have tried to use ms dart and the windows xp setup disk and it tells me that it cant find the hard drive to install it to...

argh!!
Click to expand...

I hate it when they don't recognize the HDD controller without extra drivers.

Kind of a pain in the butt, but in this case I keep a tech bench computer I would hook the HDD up to, where I know the controller is recognized without extra drivers on boot CDs such as MS DaRT.
 
The log file is called TDSSKiller with some numbers after it & it's in your root directory. Find out what files were removed & replace them.

Is this a SATA drive? If so, then your WinXP cd probably doesn't have the SATA controller drivers & that's why it can't see the drive.
 
I tried using the dell cd and I am having the same issues, however when I boot into hirens, windows mini xp, I can see all the files on the drive....

here is what the tdss killer told me

SystemInfo:
2011/07/13 10:35:07.0093
2011/07/13 10:35:07.0093 OS Version: 5.1.2600 ServicePack: 3.0
2011/07/13 10:35:07.0093 Product type: Workstation
2011/07/13 10:35:07.0093 ComputerName: KULIG-65880D536
2011/07/13 10:35:07.0093 UserName: Jay2
2011/07/13 10:35:07.0093 Windows directory: C:\WINDOWS
2011/07/13 10:35:07.0093 System windows directory: C:\WINDOWS
2011/07/13 10:35:07.0093 Processor architecture: Intel x86
2011/07/13 10:35:07.0093 Number of processors: 2
2011/07/13 10:35:07.0093 Page size: 0x1000
2011/07/13 10:35:07.0093 Boot type: Normal boot
2011/07/13 10:35:07.0093 ================================================================================
2011/07/13 10:35:12.0703 Initialize success
2011/07/13 10:35:17.0468 ================================================================================
2011/07/13 10:35:17.0468 Scan started
2011/07/13 10:35:17.0468 Mode: Manual;
2011/07/13 10:35:17.0468 ================================================================================
2011/07/13 10:35:18.0625 Accelerometer (558a0039f0ef634397e1f61055504478) C:\WINDOWS\system32\DRIVERS\Accelerometer.sys
2011/07/13 10:35:18.0750 ACPI (8fd99680a539792a30e97944fdaecf17) C:\WINDOWS\system32\DRIVERS\ACPI.sys
2011/07/13 10:35:18.0843 ACPIEC (9859c0f6936e723e4892d7141b1327d5) C:\WINDOWS\system32\DRIVERS\ACPIEC.sys
2011/07/13 10:35:18.0953 ADIHdAudAddService (7356eff52ad50b8946d346002118ce62) C:\WINDOWS\system32\drivers\ADIHdAud.sys
2011/07/13 10:35:19.0125 AEAudio (fff87a9b1ab36ee4b7bec98a4cb01b79) C:\WINDOWS\system32\drivers\AEAudio.sys
2011/07/13 10:35:19.0546 aec (8bed39e3c35d6a489438b8141717a557) C:\WINDOWS\system32\drivers\aec.sys
2011/07/13 10:35:19.0625 AFD (355556d9e580915118cd7ef736653a89) C:\WINDOWS\System32\drivers\afd.sys
2011/07/13 10:35:19.0781 AgereSoftModem (90456051c422e09bc36e6340dd891f0c) C:\WINDOWS\system32\DRIVERS\AGRSM.sys
2011/07/13 10:35:20.0140 Arp1394 (b5b8a80875c1dededa8b02765642c32f) C:\WINDOWS\system32\DRIVERS\arp1394.sys
2011/07/13 10:35:20.0421 AsyncMac (b153affac761e7f5fcfa822b9c4e97bc) C:\WINDOWS\system32\DRIVERS\asyncmac.sys
2011/07/13 10:35:20.0515 atapi (9f3a2f5aa6875c72bf062c712cfa2674) C:\WINDOWS\system32\DRIVERS\atapi.sys
2011/07/13 10:35:20.0593 Atmarpc (9916c1225104ba14794209cfa8012159) C:\WINDOWS\system32\DRIVERS\atmarpc.sys
2011/07/13 10:35:20.0671 ATSWPDRV (293e8cc3c246a89f4cca75b024ad757f) C:\WINDOWS\system32\DRIVERS\ATSwpDrv.sys
2011/07/13 10:35:20.0750 audstub (d9f724aa26c010a217c97606b160ed68) C:\WINDOWS\system32\DRIVERS\audstub.sys
2011/07/13 10:35:20.0828 b57w2k (74a65415dfaad20f06e7550fa9b6e012) C:\WINDOWS\system32\DRIVERS\b57xp32.sys
2011/07/13 10:35:20.0921 bdfm (2b4257ff280b93e3c503925f61d24cba) C:\WINDOWS\system32\drivers\bdfm.sys
2011/07/13 10:35:21.0000 bdfndisf (4be560b0607620c8e0fe3377935e70e3) C:\WINDOWS\system32\DRIVERS\bdfndisf.sys
2011/07/13 10:35:21.0078 bdfsfltr (9b281f5f673cbc5b9ec886d59e0b4f26) C:\WINDOWS\system32\drivers\bdfsfltr.sys
2011/07/13 10:35:21.0296 bdftdif (bf1088ece2236621aa31d9108afcc53c) C:\Program Files\Common Files\Defender Pro\Defender Pro Firewall\bdftdif.sys
2011/07/13 10:35:21.0375 BDSelfPr (5eaf583c0b1cc2499761ea3b065f5db2) C:\Program Files\Defender Pro\Defender Pro\bdselfpr.sys
2011/07/13 10:35:21.0515 Beep (da1f27d85e0d1525f6621372e7b685e9) C:\WINDOWS\system32\drivers\Beep.sys
2011/07/13 10:35:21.0640 cbidf2k (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\system32\drivers\cbidf2k.sys
2011/07/13 10:35:21.0828 Cdaudio (c1b486a7658353d33a10cc15211a873b) C:\WINDOWS\system32\drivers\Cdaudio.sys
2011/07/13 10:35:21.0953 Cdfs (c885b02847f5d2fd45a24e219ed93b32) C:\WINDOWS\system32\drivers\Cdfs.sys
2011/07/13 10:35:21.0984 Cdrom (1f4260cc5b42272d71f79e570a27a4fe) C:\WINDOWS\system32\DRIVERS\cdrom.sys
2011/07/13 10:35:22.0093 CmBatt (0f6c187d38d98f8df904589a5f94d411) C:\WINDOWS\system32\DRIVERS\CmBatt.sys
2011/07/13 10:35:22.0250 Compbatt (6e4c9f21f0fae8940661144f41b13203) C:\WINDOWS\system32\DRIVERS\compbatt.sys
2011/07/13 10:35:22.0859 Disk (044452051f3e02e7963599fc8f4f3e25) C:\WINDOWS\system32\DRIVERS\disk.sys
2011/07/13 10:35:22.0984 dmboot (d992fe1274bde0f84ad826acae022a41) C:\WINDOWS\system32\drivers\dmboot.sys
2011/07/13 10:35:23.0078 dmio (7c824cf7bbde77d95c08005717a95f6f) C:\WINDOWS\system32\drivers\dmio.sys
2011/07/13 10:35:23.0203 dmload (e9317282a63ca4d188c0df5e09c6ac5f) C:\WINDOWS\system32\drivers\dmload.sys
2011/07/13 10:35:23.0312 DMusic (8a208dfcf89792a484e76c40e5f50b45) C:\WINDOWS\system32\drivers\DMusic.sys
2011/07/13 10:35:23.0359 drmkaud (8f5fcff8e8848afac920905fbd9d33c8) C:\WINDOWS\system32\drivers\drmkaud.sys
2011/07/13 10:35:23.0421 eabfiltr (b5cb3084046146fd2587d8c9b219feb4) C:\WINDOWS\system32\DRIVERS\eabfiltr.sys
2011/07/13 10:35:23.0484 Fastfat (38d332a6d56af32635675f132548343e) C:\WINDOWS\system32\drivers\Fastfat.sys
2011/07/13 10:35:23.0656 Fdc (92cdd60b6730b9f50f6a1a0c1f8cdc81) C:\WINDOWS\system32\drivers\Fdc.sys
2011/07/13 10:35:23.0687 Fips (d45926117eb9fa946a6af572fbe1caa3) C:\WINDOWS\system32\drivers\Fips.sys
2011/07/13 10:35:23.0703 Flpydisk (9d27e7b80bfcdf1cdd9b555862d5e7f0) C:\WINDOWS\system32\drivers\Flpydisk.sys
2011/07/13 10:35:23.0750 FltMgr (b2cf4b0786f8212cb92ed2b50c6db6b0) C:\WINDOWS\system32\drivers\fltmgr.sys
2011/07/13 10:35:23.0812 Fs_Rec (3e1e2bd4f39b0e2b7dc4f4d2bcc2779a) C:\WINDOWS\system32\drivers\Fs_Rec.sys
2011/07/13 10:35:23.0843 Ftdisk (6ac26732762483366c3969c9e4d2259d) C:\WINDOWS\system32\DRIVERS\ftdisk.sys
2011/07/13 10:35:23.0921 Gpc (0a02c63c8b144bd8c86b103dee7c86a2) C:\WINDOWS\system32\DRIVERS\msgpc.sys
2011/07/13 10:35:24.0062 HBtnKey (4d4d97671c63c3af869b3518e6054204) C:\WINDOWS\system32\DRIVERS\cpqbttn.sys
2011/07/13 10:35:24.0140 HDAudBus (573c7d0a32852b48f3058cfd8026f511) C:\WINDOWS\system32\DRIVERS\HDAudBus.sys
2011/07/13 10:35:24.0187 hidusb (ccf82c5ec8a7326c3066de870c06daf1) C:\WINDOWS\system32\DRIVERS\hidusb.sys
2011/07/13 10:35:24.0281 HP24X (04ebefe45b300a4edee5a38dc2791291) C:\WINDOWS\system32\DRIVERS\HP24X.sys
2011/07/13 10:35:24.0437 hpdskflt (5953c0952e4dd2b25b9adef05ab0285c) C:\WINDOWS\system32\DRIVERS\hpdskflt.sys
2011/07/13 10:35:24.0640 HPZid412 (5faba4775d4c61e55ec669d643ffc71f) C:\WINDOWS\system32\DRIVERS\HPZid412.sys
2011/07/13 10:35:24.0656 HPZipr12 (a3c43980ee1f1beac778b44ea65dbdd4) C:\WINDOWS\system32\DRIVERS\HPZipr12.sys
2011/07/13 10:35:24.0703 HPZius12 (2906949bd4e206f2bb0dd1896ce9f66f) C:\WINDOWS\system32\DRIVERS\HPZius12.sys
2011/07/13 10:35:24.0781 HTTP (f80a415ef82cd06ffaf0d971528ead38) C:\WINDOWS\system32\Drivers\HTTP.sys
2011/07/13 10:35:24.0968 i8042prt (4a0b06aa8943c1e332520f7440c0aa30) C:\WINDOWS\system32\DRIVERS\i8042prt.sys
2011/07/13 10:35:25.0421 ialm (200cca76cd0e0f7eec78fa56c29b4d67) C:\WINDOWS\system32\DRIVERS\igxpmp32.sys
2011/07/13 10:35:26.0015 iaStor (997e8f5939f2d12cd9f2e6b395724c16) C:\WINDOWS\system32\DRIVERS\iaStor.sys
2011/07/13 10:35:26.0140 IFXTPM (2cdf483f8fc2bf3f7b93e3bdd734cfbd) C:\WINDOWS\system32\DRIVERS\IFXTPM.SYS
2011/07/13 10:35:26.0281 Imapi (083a052659f5310dd8b6a6cb05edcf8e) C:\WINDOWS\system32\DRIVERS\imapi.sys
2011/07/13 10:35:26.0671 intelppm (8c953733d8f36eb2133f5bb58808b66b) C:\WINDOWS\system32\DRIVERS\intelppm.sys
2011/07/13 10:35:26.0765 Ip6Fw (3bb22519a194418d5fec05d800a19ad0) C:\WINDOWS\system32\drivers\ip6fw.sys
2011/07/13 10:35:26.0875 IpFilterDriver (731f22ba402ee4b62748adaf6363c182) C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys
2011/07/13 10:35:27.0015 IpInIp (b87ab476dcf76e72010632b5550955f5) C:\WINDOWS\system32\DRIVERS\ipinip.sys
2011/07/13 10:35:27.0156 IpNat (cc748ea12c6effde940ee98098bf96bb) C:\WINDOWS\system32\DRIVERS\ipnat.sys
2011/07/13 10:35:27.0281 IPSec (23c74d75e36e7158768dd63d92789a91) C:\WINDOWS\system32\DRIVERS\ipsec.sys
2011/07/13 10:35:27.0375 IRENUM (c93c9ff7b04d772627a3646d89f7bf89) C:\WINDOWS\system32\DRIVERS\irenum.sys
2011/07/13 10:35:27.0500 isapnp (05a299ec56e52649b1cf2fc52d20f2d7) C:\WINDOWS\system32\DRIVERS\isapnp.sys
2011/07/13 10:35:27.0562 Kbdclass (463c1ec80cd17420a542b7f36a36f128) C:\WINDOWS\system32\DRIVERS\kbdclass.sys
2011/07/13 10:35:27.0625 kbdhid (9ef487a186dea361aa06913a75b3fa99) C:\WINDOWS\system32\DRIVERS\kbdhid.sys
2011/07/13 10:35:27.0718 kmixer (692bcf44383d056aed41b045a323d378) C:\WINDOWS\system32\drivers\kmixer.sys
2011/07/13 10:35:27.0843 KSecDD (b467646c54cc746128904e1654c750c1) C:\WINDOWS\system32\drivers\KSecDD.sys
2011/07/13 10:35:28.0234 mnmdd (4ae068242760a1fb6e1a44bf4e16afa6) C:\WINDOWS\system32\drivers\mnmdd.sys
2011/07/13 10:35:28.0343 Modem (dfcbad3cec1c5f964962ae10e0bcc8e1) C:\WINDOWS\system32\drivers\Modem.sys
2011/07/13 10:35:28.0421 Mouclass (35c9e97194c8cfb8430125f8dbc34d04) C:\WINDOWS\system32\DRIVERS\mouclass.sys
2011/07/13 10:35:28.0531 mouhid (b1c303e17fb9d46e87a98e4ba6769685) C:\WINDOWS\system32\DRIVERS\mouhid.sys
2011/07/13 10:35:28.0562 MountMgr (a80b9a0bad1b73637dbcbba7df72d3fd) C:\WINDOWS\system32\drivers\MountMgr.sys
2011/07/13 10:35:28.0734 MRxDAV (11d42bb6206f33fbb3ba0288d3ef81bd) C:\WINDOWS\system32\DRIVERS\mrxdav.sys
2011/07/13 10:35:28.0906 MRxSmb (0dc719e9b15e902346e87e9dcd5751fa) C:\WINDOWS\system32\DRIVERS\mrxsmb.sys
2011/07/13 10:35:29.0062 Msfs (c941ea2454ba8350021d774daf0f1027) C:\WINDOWS\system32\drivers\Msfs.sys
2011/07/13 10:35:29.0140 MSKSSRV (d1575e71568f4d9e14ca56b7b0453bf1) C:\WINDOWS\system32\drivers\MSKSSRV.sys
2011/07/13 10:35:29.0234 MSPCLOCK (325bb26842fc7ccc1fcce2c457317f3e) C:\WINDOWS\system32\drivers\MSPCLOCK.sys
2011/07/13 10:35:29.0343 MSPQM (bad59648ba099da4a17680b39730cb3d) C:\WINDOWS\system32\drivers\MSPQM.sys
2011/07/13 10:35:29.0421 mssmbios (af5f4f3f14a8ea2c26de30f7a1e17136) C:\WINDOWS\system32\DRIVERS\mssmbios.sys
2011/07/13 10:35:29.0609 Mup (de6a75f5c270e756c5508d94b6cf68f5) C:\WINDOWS\system32\drivers\Mup.sys
2011/07/13 10:35:29.0796 NDIS (1df7f42665c94b825322fae71721130d) C:\WINDOWS\system32\drivers\NDIS.sys
2011/07/13 10:35:29.0875 NdisTapi (1ab3d00c991ab086e69db84b6c0ed78f) C:\WINDOWS\system32\DRIVERS\ndistapi.sys
2011/07/13 10:35:29.0953 Ndisuio (f927a4434c5028758a842943ef1a3849) C:\WINDOWS\system32\DRIVERS\ndisuio.sys
2011/07/13 10:35:30.0015 NdisWan (edc1531a49c80614b2cfda43ca8659ab) C:\WINDOWS\system32\DRIVERS\ndiswan.sys
2011/07/13 10:35:30.0156 NDProxy (9282bd12dfb069d3889eb3fcc1000a9b) C:\WINDOWS\system32\drivers\NDProxy.sys
2011/07/13 10:35:30.0234 NetBIOS (5d81cf9a2f1a3a756b66cf684911cdf0) C:\WINDOWS\system32\DRIVERS\netbios.sys
2011/07/13 10:35:30.0312 NetBT (74b2b2f5bea5e9a3dc021d685551bd3d) C:\WINDOWS\system32\DRIVERS\netbt.sys
2011/07/13 10:35:30.0640 NETw4x32 (12b0d99865434387f784268b70e23360) C:\WINDOWS\system32\DRIVERS\NETw4x32.sys
2011/07/13 10:35:30.0921 NIC1394 (e9e47cfb2d461fa0fc75b7a74c6383ea) C:\WINDOWS\system32\DRIVERS\nic1394.sys
2011/07/13 10:35:31.0000 Npfs (3182d64ae053d6fb034f44b6def8034a) C:\WINDOWS\system32\drivers\Npfs.sys
2011/07/13 10:35:31.0093 Ntfs (78a08dd6a8d65e697c18e1db01c5cdca) C:\WINDOWS\system32\drivers\Ntfs.sys
2011/07/13 10:35:31.0234 Null (73c1e1f395918bc2c6dd67af7591a3ad) C:\WINDOWS\system32\drivers\Null.sys
2011/07/13 10:35:31.0343 NwlnkFlt (b305f3fad35083837ef46a0bbce2fc57) C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys
2011/07/13 10:35:31.0421 NwlnkFwd (c99b3415198d1aab7227f2c88fd664b9) C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys
2011/07/13 10:35:31.0531 ohci1394 (ca33832df41afb202ee7aeb05145922f) C:\WINDOWS\system32\DRIVERS\ohci1394.sys
2011/07/13 10:35:31.0640 Parport (5575faf8f97ce5e713d108c2a58d7c7c) C:\WINDOWS\system32\DRIVERS\parport.sys
2011/07/13 10:35:31.0703 PartMgr (beb3ba25197665d82ec7065b724171c6) C:\WINDOWS\system32\drivers\PartMgr.sys
2011/07/13 10:35:31.0843 ParVdm (70e98b3fd8e963a6a46a2e6247e0bea1) C:\WINDOWS\system32\drivers\ParVdm.sys
2011/07/13 10:35:31.0921 PCI (a219903ccf74233761d92bef471a07b1) C:\WINDOWS\system32\DRIVERS\pci.sys
2011/07/13 10:35:32.0156 PCIIde (ccf5f451bb1a5a2a522a76e670000ff0) C:\WINDOWS\system32\DRIVERS\pciide.sys
2011/07/13 10:35:32.0187 Pcmcia (9e89ef60e9ee05e3f2eef2da7397f1c1) C:\WINDOWS\system32\DRIVERS\pcmcia.sys
2011/07/13 10:35:32.0562 PersonalSecureDrive (0d8848fbe1765a3e27b69b5bef6d429f) C:\WINDOWS\System32\drivers\psd.sys
2011/07/13 10:35:32.0656 PptpMiniport (efeec01b1d3cf84f16ddd24d9d9d8f99) C:\WINDOWS\system32\DRIVERS\raspptp.sys
2011/07/13 10:35:32.0875 Profos (d90a33660d328a9f587580f0b38c85de) C:\Program Files\Common Files\Defender Pro\Defender Pro Threat Scanner\profos.sys
2011/07/13 10:35:33.0031 PSched (09298ec810b07e5d582cb3a3f9255424) C:\WINDOWS\system32\DRIVERS\psched.sys
2011/07/13 10:35:33.0171 Ptilink (80d317bd1c3dbc5d4fe7b1678c60cadd) C:\WINDOWS\system32\DRIVERS\ptilink.sys
2011/07/13 10:35:33.0609 RasAcd (fe0d99d6f31e4fad8159f690d68ded9c) C:\WINDOWS\system32\DRIVERS\rasacd.sys
2011/07/13 10:35:33.0671 Rasl2tp (11b4a627bc9614b885c4969bfa5ff8a6) C:\WINDOWS\system32\DRIVERS\rasl2tp.sys
2011/07/13 10:35:33.0718 RasPppoe (5bc962f2654137c9909c3d4603587dee) C:\WINDOWS\system32\DRIVERS\raspppoe.sys
2011/07/13 10:35:33.0781 Raspti (fdbb1d60066fcfbb7452fd8f9829b242) C:\WINDOWS\system32\DRIVERS\raspti.sys
2011/07/13 10:35:33.0859 Rdbss (7ad224ad1a1437fe28d89cf22b17780a) C:\WINDOWS\system32\DRIVERS\rdbss.sys
2011/07/13 10:35:33.0953 RDPCDD (4912d5b403614ce99c28420f75353332) C:\WINDOWS\system32\DRIVERS\RDPCDD.sys
2011/07/13 10:35:34.0062 rdpdr (15cabd0f7c00c47c70124907916af3f1) C:\WINDOWS\system32\DRIVERS\rdpdr.sys
2011/07/13 10:35:34.0218 RDPWD (6728e45b66f93c08f11de2e316fc70dd) C:\WINDOWS\system32\drivers\RDPWD.sys
2011/07/13 10:35:34.0328 redbook (f828dd7e1419b6653894a8f97a0094c5) C:\WINDOWS\system32\DRIVERS\redbook.sys
2011/07/13 10:35:34.0484 RsvLock (0de27c94a562d0360fb520c42068cca0) C:\WINDOWS\system32\drivers\RsvLock.sys
2011/07/13 10:35:34.0562 SafeBoot (4ccee8fcfe54262443bb348adb1f7f52) C:\WINDOWS\system32\drivers\SafeBoot.sys
2011/07/13 10:35:34.0562 Suspicious file (NoAccess): C:\WINDOWS\system32\drivers\SafeBoot.sys. md5: 4ccee8fcfe54262443bb348adb1f7f52
2011/07/13 10:35:34.0562 SafeBoot - detected Locked file (1)
2011/07/13 10:35:34.0625 SbAlg (f6367fb350f8e5d3f6dd8040e4c0e33b) C:\WINDOWS\system32\drivers\SbAlg.sys
2011/07/13 10:35:34.0750 SbFsLock (df4a90b29b878e8cd95a1ac8f94ca954) C:\WINDOWS\system32\drivers\SbFsLock.sys
2011/07/13 10:35:34.0875 Secdrv (90a3935d05b494a5a39d37e71f09a677) C:\WINDOWS\system32\DRIVERS\secdrv.sys
2011/07/13 10:35:34.0921 Serial (cca207a8896d4c6a0c9ce29a4ae411a7) C:\WINDOWS\system32\drivers\Serial.sys
2011/07/13 10:35:35.0046 Sfloppy (8e6b8c671615d126fdc553d1e2de5562) C:\WINDOWS\system32\drivers\Sfloppy.sys
2011/07/13 10:35:35.0265 splitter (ab8b92451ecb048a4d1de7c3ffcb4a9f) C:\WINDOWS\system32\drivers\splitter.sys
2011/07/13 10:35:35.0328 sr (76bb022c2fb6902fd5bdd4f78fc13a5d) C:\WINDOWS\system32\DRIVERS\sr.sys
2011/07/13 10:35:35.0390 Srv (47ddfc2f003f7f9f0592c6874962a2e7) C:\WINDOWS\system32\DRIVERS\srv.sys
2011/07/13 10:35:35.0437 swenum (3941d127aef12e93addf6fe6ee027e0f) C:\WINDOWS\system32\DRIVERS\swenum.sys
2011/07/13 10:35:35.0453 swmidi (8ce882bcc6cf8a62f2b2323d95cb3d01) C:\WINDOWS\system32\drivers\swmidi.sys
2011/07/13 10:35:35.0796 sysaudio (8b83f3ed0f1688b4958f77cd6d2bf290) C:\WINDOWS\system32\drivers\sysaudio.sys
2011/07/13 10:35:35.0937 Tcpip (9aefa14bd6b182d61e3119fa5f436d3d) C:\WINDOWS\system32\DRIVERS\tcpip.sys
2011/07/13 10:35:36.0031 TDPIPE (6471a66807f5e104e4885f5b67349397) C:\WINDOWS\system32\drivers\TDPIPE.sys
2011/07/13 10:35:36.0125 TDTCP (c56b6d0402371cf3700eb322ef3aaf61) C:\WINDOWS\system32\drivers\TDTCP.sys
2011/07/13 10:35:36.0171 TermDD (88155247177638048422893737429d9e) C:\WINDOWS\system32\DRIVERS\termdd.sys
2011/07/13 10:35:36.0406 Trufos (b16d66a71de03285e14e9f165b59eda4) C:\Program Files\Common Files\Defender Pro\Defender Pro Threat Scanner\trufos.sys
2011/07/13 10:35:36.0500 Udfs (5787b80c2e3c5e2f56c2a233d91fa2c9) C:\WINDOWS\system32\drivers\Udfs.sys
2011/07/13 10:35:36.0796 Update (402ddc88356b1bac0ee3dd1580c76a31) C:\WINDOWS\system32\DRIVERS\update.sys
2011/07/13 10:35:36.0921 usbccgp (173f317ce0db8e21322e71b7e60a27e8) C:\WINDOWS\system32\DRIVERS\usbccgp.sys
2011/07/13 10:35:36.0953 usbehci (65dcf09d0e37d4c6b11b5b0b76d470a7) C:\WINDOWS\system32\DRIVERS\usbehci.sys
2011/07/13 10:35:36.0984 usbhub (1ab3cdde553b6e064d2e754efe20285c) C:\WINDOWS\system32\DRIVERS\usbhub.sys
2011/07/13 10:35:37.0062 usbprint (a717c8721046828520c9edf31288fc00) C:\WINDOWS\system32\DRIVERS\usbprint.sys
2011/07/13 10:35:37.0156 usbscan (a0b8cf9deb1184fbdd20784a58fa75d4) C:\WINDOWS\system32\DRIVERS\usbscan.sys
2011/07/13 10:35:37.0312 USBSTOR (a32426d9b14a089eaa1d922e0c5801a9) C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS
2011/07/13 10:35:37.0437 usbuhci (26496f9dee2d787fc3e61ad54821ffe6) C:\WINDOWS\system32\DRIVERS\usbuhci.sys
2011/07/13 10:35:37.0484 VgaSave (0d3a8fafceacd8b7625cd549757a7df1) C:\WINDOWS\System32\drivers\vga.sys
2011/07/13 10:35:37.0578 VolSnap (4c8fcb5cc53aab716d810740fe59d025) C:\WINDOWS\system32\drivers\VolSnap.sys
2011/07/13 10:35:37.0671 Wanarp (e20b95baedb550f32dd489265c1da1f6) C:\WINDOWS\system32\DRIVERS\wanarp.sys
2011/07/13 10:35:37.0828 wdmaud (6768acf64b18196494413695f0c3a00f) C:\WINDOWS\system32\drivers\wdmaud.sys
2011/07/13 10:35:38.0000 WmiAcpi (c42584fd66ce9e17403aebca199f7bdb) C:\WINDOWS\system32\DRIVERS\wmiacpi.sys
2011/07/13 10:35:38.0156 WudfPf (f15feafffbb3644ccc80c5da584e6311) C:\WINDOWS\system32\DRIVERS\WudfPf.sys
2011/07/13 10:35:38.0281 WudfRd (28b524262bce6de1f7ef9f510ba3985b) C:\WINDOWS\system32\DRIVERS\wudfrd.sys
2011/07/13 10:35:38.0593 \HardDisk0 - detected Rootkit.Win32.BackBoot.gen (1)
2011/07/13 10:35:38.0718 ================================================================================
2011/07/13 10:35:38.0718 Scan finished
2011/07/13 10:35:38.0718 ================================================================================
2011/07/13 10:35:38.0750 Detected object count: 2
2011/07/13 10:35:55.0062 HKLM\SYSTEM\ControlSet001\services\SafeBoot - will be deleted after reboot
2011/07/13 10:35:55.0093 HKLM\SYSTEM\ControlSet002\services\SafeBoot - will be deleted after reboot
2011/07/13 10:35:55.0093 HKLM\SYSTEM\ControlSet005\services\SafeBoot - will be deleted after reboot
2011/07/13 10:35:55.0093 C:\WINDOWS\system32\drivers\SafeBoot.sys - will be deleted after reboot
2011/07/13 10:35:55.0093 Locked file(SafeBoot) - User select action: Delete
2011/07/13 10:35:55.0125 \HardDisk0 - will be restored after reboot
2011/07/13 10:35:55.0125 Rootkit.Win32.BackBoot.gen(\HardDisk0) - User select action: Restore
2011/07/13 10:35:59.0140 Deinitialize success
 
I also just hooked it up to another windows xp computer with only this hard drive connected and when booting to erd commander, it tells me there is no windows installation on the disk.
 
I rather suspect the key line is: \HardDisk0 - detected Rootkit.Win32.BackBoot.gen (1) not safeboot.sys which is a McAfee file according to google.

So you had a bootkit and probably TDSSKiller tried to fix it but cocked up the MBR. So you need to go through the usual 7b stop error fixing process.

http://support.microsoft.com/kb/324103
 
MobileTechie said:
I rather suspect the key line is: \HardDisk0 - detected Rootkit.Win32.BackBoot.gen (1) not safeboot.sys which is a McAfee file according to google.

So you had a bootkit and probably TDSSKiller tried to fix it but cocked up the MBR. So you need to go through the usual 7b stop error fixing process.

http://support.microsoft.com/kb/324103
Click to expand...


Im looking on that site, but dont really see any processes to fix the MBR.

Most of them tell me to boot to recovery console, which I can not get to. Is there any other boot disks or tools that I can download or use in order to fix the MBR offline?
 
sorry didn't see you mention the not seeing the disk in recovery console

Paragon does MBR repairs on slaved disks. Various boot CDs have mbr fixes on them.
 
Last edited:
xxsilk109xx said:
Im looking on that site, but dont really see any processes to fix the MBR.

Most of them tell me to boot to recovery console, which I can not get to. Is there any other boot disks or tools that I can download or use in order to fix the MBR offline?
Click to expand...

I would suggest Hiren's Boot CD since you're already using it.Look for "MBRFIX".I have never used it but the reviews are positive.
 
When I try to go to recovery console, boot to erd commander, or try to do a repair install, whether with a retail disk or a dell oem disk, it tells me that "Setup did not find any hard disk drives attached to this computer"

However, when I go to hirens boot cd, and load up mini xp, I can see and navigate the drive, along with all folders. So I know the drive works. I can see it when I slave it to another computer to. It just wont boot.

Any instructions on how to use MBRFIX?
 
You must log in or register to reply here.

Similar threads

Blue House Computer Help
Rootkit scanning and removal
2
Replies
20
Views
597
Sky-Knight
Sky-Knight
Appletax
AVG hosed the OS - BSODs, bootrec/fixboot "Access is Denied"
2
Replies
25
Views
2K
britechguy
britechguy
britechguy
Is it any wonder that we have these problems with laptop lids/hinges?!!!
2
Replies
24
Views
1K
Philippe
Philippe
Tech Savvy
[SOLVED] GPO deployed printers not printing.
Replies
1
Views
2K
bitznpcz
bitznpcz
CaliZ
Word could not create the work file
Replies
8
Views
4K
trevm999
trevm999
Back
Top