BSOD and xptp24.sys problems!!

ant31

Hi,
Sons computer has just started giving a BSOD and in it is mention of xptp24.sys. Any ideas what this may be?
Only a couple of mentions in Google - 1 in dutch and 1 in german! SO not a lot of help there.
I can boot into safe mode and safe mode with networking. When I have tried IE It sometimes loads and crashes, sometimes doesn't load and sometimes half loads so perhaps something there.
I have tried searching on his PC for the xptp24.sys file but can not find it at all.

Any ideas before I do a restore?

Cheers as ever.

Ant

MercilessKiller

Hiya there Ant. It seems that xptp24.sys is related to a virus/worm whereby .sys files are inconsistent so the file name is going to change between each computers thus hard to google.

If you post a "HiJack this" log I can help you a lot better. First of all get onto the computer and install the following program:
http://www.download.com/HijackThis/3000-8022_4-10227353.html
^^ Thats Hijack this.

What it will do is scan your computer for all current processes. So run it straight after starting up and save the scan into a .txt (there's an option to do this when you scan). Copy the information straight from there into here.

I can then do some more research about whether something's running which it shouldnt be, or if you may have corrupt files on your drive.

Thanks very much

MercilessKiller

Though I don't understand German very well, I read through a german webpage describing a virus of similar traits and uses the filename xptp24.sys or 16.sys etc etc

The fix is a program called haxfix. He gives the link to the .exe which is here:
http://users.telenet.be/marcvn/tools/haxfix.exe

I can't tell you 100% how reliable it is. But it came from the follwoing German forum:
http://users.telenet.be/marcvn/spyware/1997769.htm

It appears to be trusted as the user gives a lot of information about what virus it fixes, and the file name you mentioned is definitely there.

Hope it helps.

Whitefiver

From what I could glean from the foreign messages, I think I might start looking for a variant of the Haxdoor virus? You might like to try the Google Translation service - can often give you the gist of the message

There are various tools around if it is this.

Best of luck.

Regards,

White

ant31

Ta for all that advice and so quick!

Looks like it is haxdoor .. nasty little !!!!!! actually as it is stopping me from running Norton .. not sure how it has got on there but I'll have a little bash at it.

Cheers for the help and I'll be back

ant31

Phew! Managed to get the little blighter. Wasn't easy though - had to edit the registry and get rid of all references. I still think there is something lurking so will have to have a further bash at the weekend.
Many thanks again for the help.

Whitefiver

Good news, and I trust you have advised your son to practice safe hex.

Regards,

White