Discussion on:

Rootkits 201

A few months ago my main XpPro SP1 box started experiencing a few problems. I had not reinstalled the OS for over a year, so I thought I would do a non destructive re-install. Guess what - it failed and I was informed:
Stop 0x0000007B

After much research microsoft info advised me there was a memory problem or I had a Rootkit infection.

Well Ive tested the memory and the two modules seem ok. I've used a many different pgrms to try and detect the 'rootkit' all with no success.

So my OS is still running ok minus: IE, MSmedia player, Restore points etc.. I get by instead using Nero, Google ,Ghost & various others instead but does anyone else in our community really think (as microsoft suggests), this trouble is due to a rootkit?

BTW.
the PC is always Firewalled/antivir/antispy etc.

Microsoft will blame anything and everything except their crap OS. Not advocating LInux here but I use it and have had very little problem. I suppose it's all a matter of taste.

if i were you i would do a low level format that will zero kill the hard drive, killing off all data,if you wish to go a bit further take the battery out of the mother board which will kill eeprom resident bugs and then reset bios reinstall windows with service pack 2 get all updates and make sure you have good security software installed, that should kill any root kit, be carefull when installing anything you have backed up as that could also be infected.

Stop code 0x0000007B is INACCESSIBLE_BOOT_DEVICE. "The Microsoft Windows operating system has lost access to the system partition during startup."

"Cause:
The INACCESSIBLE_BOOT_DEVICE bug check frequently occurs because of a boot device failure. During I/O system initialization, the boot device driver might have failed to initialize the boot device (typically a hard disk). File system initialization might have failed because it did not recognize the data on the boot device. Also, repartitioning the system partition or installing a new SCSI adapter or disk controller might induce this error.

This error can also occur because of incompatible disk hardware. If the error occurred at the initial setup of the system, the system might have been installed on an unsupported disk or SCSI controller. Some controllers are supported only by drivers that are in the Windows Driver Library (WDL). (These drivers require the user to do a custom installation.)"

Since the problem started after you "thought I would do a non destructive re-install", it seems likely that the problem is related.

Unless you previously had reason to suspect a rootkit, I would not be so quick to point the finger at one. Nor would it seem that the memory would be an issue.

Yes microsoft suggests a number of causes to the above STOP error. However after sifting through the only ones which may be applicable to my box in question, I was left with suggestions of either a memory problem or a rootkit. C drive was not partitioned and was always firewalled (by hardware & software) & the antivir/spyware was updated daily etc..

I am more inclined to believe it is a problem or undocumented vulnerability with XP. And I agree I should just wipe everything and start over however the reason I hesitate to do that is because I have installed a number of pgrms that I'm sure I've lost the CD's or archives for. Yes I can I suppose do a manual/inividual resore from a ghost image but by the time I've completed doing that, Quad core cpu's will be old hat.

Many thanks to all for the comments received.
I guess I'll just live with it. Kind regards.

Encountering an error that is identified as commonly related to problems with the boot device after a failed non-destructive reinstall are almost always a direct result of that failed reinstall. Think about it -- with a non-destructive reinstall, you're trying to overwrite the boot data on your boot device. If something goes wrong with that, you'll have a boot device problem.

Basically, the attempted reinstall screwed up the boot device somehow. That's how it looks to me.

Now . . . why you were having problems in the first place, and why the reinstall didn't work, is another matter entirely. There are a number of possibilities for why both things might have happened, but a possible single explanation for both is a degraded power supply. If you are not using an uninterruptible power supply that provides conditioned power, fluctuations in the electricity you get from the wall socket may well have degraded the integrity of your power supply unit. This, in turn, then provides fluctuating power to the rest of the system, degrading the integrity (the "health", if you will) of the various components of your computer.

This sort of thing leads to weird, intermittent problems that are difficult to diagnose, and it may be that some of the problems you were having with the system in the first place were a result of that, and the failure of the reinstall may have occurred because of some problems with the hard drive electronics, RAM, CD drive electronics, or some other part that doesn't spring immediately to mind at the moment.

That may not be your problem, but it's a possibility. If you have someone handy that knows his way around a multimeter, you may want to have your power supply checked out. Don't try it yourself unless you know what you're doing, though, so you don't electrocute yourself.

Many thanks for your thoughtful reply. Back in the '80's I worked as a Technician for Telecom Australia so I am aware to always treat A/C with the respect it deserves.

The problem on this box started when I was Beta testing Ver2 of Counterspy before it was released. At the time it was pretty bad and so I reported the problems to Sunbelt and uninstalled the pgrm and reinstalled Ver 1.5x which was stable. They advised me to make use of a Windows Install Cleanup utility to completely remove all traces of the beta software I was testing. I did so, however it appears more damage was done by the use of that utility - no matter how carefully it was done. IE & Media Player became unstable & things progressively became worse. It was then I decided to do a non destructive reinstall. That was also when I discovered I received a STOP error (described above) when I tried using my Licensed CD to perform a reinstall. Whatever my motives it appears I am my own worst enemy Nevertheless I appreciate your kind reply. Thanks again & regards - DAve

like there is several things going on here. First, the registry is corrupt from the sunbelt/removal Windows clean up utility. I have had similar products cause this effect in the past. Second, the boot device is corrupt.

I would do the following...1) Boot into Bios, and turn off boot sector protection. Next, boot into recovery console off xp cd, do a fixmbr and fixboot. 2)Then I would install SP2, this can sometimes fix registry errors as it reinstalls a serious chunk of the OS with newer data. You can now turn back on boot sector protection in bios if you want.

Good article, sound advice.

Some years back I received a bland warning from some AV software that a known rootkit had been installed on my XP box and that I'd be well advised to 'restore from trusted backups'. I tried to - only to find out that my backup media had become corrupted and would not restore. Fortunately rootkits do not survive the nuclear option: low level format & reinstallation are the only trustworthy solutions.

Painful, stressful lessons learned: do not trust the integrity of your backup media; keep good, recent backups and test them regularly; use a second, old computer as a functioning work horse for the down-time; keep good, recent backups and test them regularly.

You cannot imagine the time, frustration and stress involved.

Thanks for the compliments about the article.

I agree with everything you said about backups, and have in fact been considering writing about backup procedures for data security in the near future -- at least a quick checklist-type post. We'll see what I feel like writing if/when I get around to it.

As with other such documents, I think it would be EXTREMELY useful if the document were available as a simply downloadable word processor, or plain text file. What I do with virtually all of these such articles is I copy, paste into a Word document, and THEN read them. Easier to read, and fewer distractions.