• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 634
  • Last Modified:

Win XP - BSOD after running TDSS Killer

I was trying to clean an XP desktop that was heavily infected. I ran Superantispyware on it and Malwarebytes which helped, but didn't clean out the main problem.

I ran TDSSKiller and selected the additions options it listed. After it rebooted and started the scan, it found a rootkit and four other files. I selected delete on all five files. The four non-rootkit files were marked as locked.

After it rebooted, I received the BSOD on boot. I tried going into safemode, but right after I selected it, the same BSOD appeared.

I'm assuming the four locked files were system files no longer exist and caused the BSOD.

I would normally just do a clean install, but this desktop has an accounting app on it and I don't think there was a backup taken.

What's the safest way to get it running again without messing up the accounting app and other data they may have on it?
Tony Giangreco
Tony Giangreco
5 Solutions
I would copy the accounting app data to another computer, so that I would test if I could get it working again on the second computer before messing around any more with the XP machine
Boot to the CD and do a repair instead of install.
Tony GiangrecoAuthor Commented:
It's been a long time since I ran an XP repair. As I remember, I had to reinstal all programs and data. The programs were not listed in the start menu.

Is this what I should expect?

In the repair process, If I enter the user's name as it originally was, will his desktop come up with his icons and shortcuts?

Will the programs still be installed?

Will the start menu still show the programs?
We Need Your Input!

WatchGuard is currently running a beta program for our new macOS Host Sensor for our Threat Detection and Response service. We're looking for more macOS users to help provide insight and feedback to help us make the product even better. Please sign up for our beta program today!

XP repair install shouldn't lose any settings or programs, as long as they are intact now.

What is in the BSOD?

Can you boot in Safe Mode?

Brendanmeyer does make a good point, though.  If there is critical data on this computer, it would be wise to copy it to an external drive before proceeding.
try a system restore like this   :
windows could not start because the following file is missing or corrupt:  \WINDOWS\SYSTEM32\CONFIG\SYSTEM
An easier way is to boot from a Bart PE CD (or UBCD4Win CD) and use the file manager for manipulating files. Here  the procedure :
1. rename c:\windows\system32\config\SYSTEM to c:\windows\system32\config\SYSTEM.bak
2. Navigate to the System Volume Information folder.
it contains some restore {GUID} folders such as "_restore{87BD3667-3246-476B-923F-F86E30B3E7F8}".
The restore points are in  folders starting with "RPx under this folder.
3. In such a folder, locate a Snapshot subfolder. This is an example of a folder path to the Snapshot folder:  C:\System Volume Information\_restore{D86480E3-73EF-47BC-A0EB-A81BE6EE3ED8}\RP1\Snapshot
4. From the Snapshot folder, copy the following file to the c:\windows\system32\config folder
6. Exit Bart PE, reboot and test

Use a fairly recent restore point from at least a day or two prior to problem occurring .

** you can add the other hives also with this procedure

http://www.nu2.nu/pebuilder/       BARTPE
http://www.ubcd4win.com/            UBCD4WIN
I agree that you should backup anything that you don't want to lose. There is always the chance that nothing will work and you will have to totaly re-install (perhaps even format the drive).

nobus has offered some alternatives that I suggest you consider.  If you are forced to stay with Microsoft's methods then I suggest reading this Microsoft article before proceding:

Tony GiangrecoAuthor Commented:
I ended up being able to select Last Known Good Configuration and git the Pc running again. I  backed up the important data and I'm started a clean install.

Even though I didn't need to use the suggestions provided to me, I'm awarding points because the suggestions will help me if I hit this situation again.

Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

Join & Write a Comment

Featured Post

The 14th Annual Expert Award Winners

The results are in! Meet the top members of our 2017 Expert Awards. Congratulations to all who qualified!

Tackle projects and never again get stuck behind a technical roadblock.
Join Now