Main Area and Open Discussion > General Software Discussion
Feb 9, 2010: Windows Patch Leaves Many XP Users With Blue Screens?
f0dder:
Many thanks, CleverCat, f0dder, and Bamse, for your helpful and reassuring replies. The explanation about the patch causing havoc only on systems already infected makes some sense and would also explain why not everyone is affected. I hope it turns out to be true.
-cyberdiva (February 12, 2010, 07:49 AM)
--- End quote ---
Do note that a poster on a blog from one of Bamses links says he got the BSOD even though atapi.sys wasn't infected... so there might be problems on clean systems as well. Or that poster could have some other driver infected, or have pesky antivirus :)
Bamse:
True but for what it is worth I can reproduce problem in a VM :) Evil loop of rebooting. I first installed rootkit, then all updates except 977165. Reboot, everything worked. After 977165 it is game over.
f0dder:
True but for what it is worth I can reproduce problem in a VM :) Evil loop of rebooting.-Bamse (February 12, 2010, 08:11 AM)
--- End quote ---
Hm? What does that screenshot tell? What's the app, and does "suspicious modification" mean rootkit? etc.
Bamse:
It is GMER, one of the best rootkit scanners. Atapi.sys is modified, show no sign of being from MS etc. when looking at properties. All tabs are gone. Generic file now. Startpage in IE was changed as well btw. Porn... I can pm you the link I used for rootkit if you like. There are tons of them but this works on atapi.sys like the blogger hinted was a problem - or one of them. There could be more to this.
f0dder:
It is GMER, one of the best rootkit scanners. Atapi.sys is modified, show no sign of being from MS etc. when looking at properties. Startpage in IE was changed as well btw. Porn...
-Bamse (February 12, 2010, 08:15 AM)
--- End quote ---
Ah, I thought you could reproduce BSODs without infected driver :)
Navigation
[0] Message Index
[#] Next page
[*] Previous page
Go to full version