Win XP - BSOD after running TDSS Killer

I was trying to clean an XP desktop that was heavily infected. I ran Superantispyware on it and Malwarebytes which helped, but didn't clean out the main problem.

I ran TDSSKiller and selected the additions options it listed. After it rebooted and started the scan, it found a rootkit and four other files. I selected delete on all five files. The four non-rootkit files were marked as locked.

After it rebooted, I received the BSOD on boot. I tried going into safemode, but right after I selected it, the same BSOD appeared.

I'm assuming the four locked files were system files no longer exist and caused the BSOD.

I would normally just do a clean install, but this desktop has an accounting app on it and I don't think there was a backup taken.

What's the safest way to get it running again without messing up the accounting app and other data they may have on it?
LVL 25
Tony GiangrecoAsked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

brendanmeyerCommented:
I would copy the accounting app data to another computer, so that I would test if I could get it working again on the second computer before messing around any more with the XP machine
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
Steven CarnahanNetwork ManagerCommented:
Boot to the CD and do a repair instead of install.
0
Tony GiangrecoAuthor Commented:
It's been a long time since I ran an XP repair. As I remember, I had to reinstal all programs and data. The programs were not listed in the start menu.

Is this what I should expect?

In the repair process, If I enter the user's name as it originally was, will his desktop come up with his icons and shortcuts?

Will the programs still be installed?

Will the start menu still show the programs?
0
Redefine Your Security with AI & Machine Learning

The implications of AI and machine learning in cyber security are massive and constantly growing, creating both efficiencies and new challenges across the board. Check out our on-demand webinar to learn more about how AI can help your organization!

CompProbSolvCommented:
XP repair install shouldn't lose any settings or programs, as long as they are intact now.

What is in the BSOD?

Can you boot in Safe Mode?

Brendanmeyer does make a good point, though.  If there is critical data on this computer, it would be wise to copy it to an external drive before proceeding.
0
nobusCommented:
try a system restore like this   :
windows could not start because the following file is missing or corrupt:  \WINDOWS\SYSTEM32\CONFIG\SYSTEM
http://support.microsoft.com/kb/307545
----------------------------------------------------------------------------------------------
An easier way is to boot from a Bart PE CD (or UBCD4Win CD) and use the file manager for manipulating files. Here  the procedure :
1. rename c:\windows\system32\config\SYSTEM to c:\windows\system32\config\SYSTEM.bak
2. Navigate to the System Volume Information folder.
it contains some restore {GUID} folders such as "_restore{87BD3667-3246-476B-923F-F86E30B3E7F8}".
The restore points are in  folders starting with "RPx under this folder.
3. In such a folder, locate a Snapshot subfolder. This is an example of a folder path to the Snapshot folder:  C:\System Volume Information\_restore{D86480E3-73EF-47BC-A0EB-A81BE6EE3ED8}\RP1\Snapshot
4. From the Snapshot folder, copy the following file to the c:\windows\system32\config folder
 _REGISTRY_MACHINE_SYSTEM
5. Rename _REGISTRY_MACHINE_SYSTEM to SYSTEM
6. Exit Bart PE, reboot and test

Use a fairly recent restore point from at least a day or two prior to problem occurring .

** you can add the other hives also with this procedure

http://www.nu2.nu/pebuilder/       BARTPE
http://www.ubcd4win.com/            UBCD4WIN
0
Steven CarnahanNetwork ManagerCommented:
I agree that you should backup anything that you don't want to lose. There is always the chance that nothing will work and you will have to totaly re-install (perhaps even format the drive).

nobus has offered some alternatives that I suggest you consider.  If you are forced to stay with Microsoft's methods then I suggest reading this Microsoft article before proceding:

http://www.microsoft.com/resources/documentation/windows/xp/all/proddocs/en-us/options_to_use_when_a_system_will_not_start.mspx?mfr=true
0
Tony GiangrecoAuthor Commented:
I ended up being able to select Last Known Good Configuration and git the Pc running again. I  backed up the important data and I'm started a clean install.

Even though I didn't need to use the suggestions provided to me, I'm awarding points because the suggestions will help me if I hit this situation again.

Thanks
0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Anti-Virus Apps

From novice to tech pro — start learning today.