Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I have laptop here that was infected with malware. I cleaned it but the performace is still not 100%. I tried following instructions on Bleepingcomputer and TechGuy to check for hidden malware/rootkit infection and that resulted in BSOD.

I'm posting excerpt from MiniDump, identifying uwtiruog.sys (or it not being there) as most likely cause for BSOD:

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 50, {86208000, 0, 93af4eed, 0}

Unable to load image \??\C:\Users\[USER]\AppData\Local\Temp\uwtiruog.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for uwtiruog.sys
*** ERROR: Module load completed but symbols could not be loaded for uwtiruog.sys

Could not read faulting driver name
Probably caused by : uwtiruog.sys ( uwtiruog+beed )

Followup: MachineOwner

Is there any way to identify the process that called uwtiruog.sys, as this probably is the real cause of BSOD?

By the way, laptop in Packard Bell, Win Vista.

Many thanks!

EDIT: Moderators, is this more of a topic for serverfault? I was hoping for some answers :) Should I try posting the same Q there (or could you migrate it)?

share|improve this question
    
Could you do a registry search for uwtiruog.sys? –  kmarsh Nov 17 '10 at 13:21
    
You know you have a unique problem when doing a search for uwtiruog.sys brings only this question! I suggest you do a quick sweep using Spybot Search & Destroy and MalwareBytes Anti Malware –  Sathya Nov 17 '10 at 18:31
    
I suggest you make a Kaspersky Boot CD, boot from it ans scan the drive...techmixer.com/free-bootable-antivirus-rescue-cds-download-list –  Moab Nov 17 '10 at 20:08
    
I did search registry and file search for uwtiruog.sys, no luck. I cleaned the laptop with both SpyBot and MBytes Antimalware. The problem still persists. If you do a search for uwtiruog.sys you may find my posts from BleepingComputer and TechGuy. I will try cleaning with Kaspersky bootcd. In the meanwhile - I'm still hoping there is a way to investigate which process calls the faulty SYS file. –  imagodei Nov 17 '10 at 22:38

1 Answer 1

That's a PAGE_FAULT_IN_NON_PAGED_AREA, which is caused by the driver attempting to touch memory that isn't mapped. This is usually just a driver bug, but in your case I notice that the driver is being loaded from \??\C:\Users[USER]\AppData\Local\Temp\uwtiruog.sys - a user-writable section of the disk, and not from \windows\system32 as I'd expect.

Are you running any specialist software to do deep inspection of the system, such as a funky version of Process Monitor or a filesystem monitor? If not it might be worth uploading that file to a malware checking site such as virustotal, and be prepared to get out your favourite antivirus software and/or windows install disk.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.