Bizzare driver(?) [uwtiruog.sys] causes sporadic BSOD - possible malware infection

Question

I have laptop here that was infected with malware. I cleaned it but the performace is still not 100%. I tried following instructions on Bleepingcomputer and TechGuy to check for hidden malware/rootkit infection and that resulted in BSOD.

I'm posting excerpt from MiniDump, identifying uwtiruog.sys (or it not being there) as most likely cause for BSOD:

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 50, {86208000, 0, 93af4eed, 0}

Unable to load image \??\C:\Users\[USER]\AppData\Local\Temp\uwtiruog.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for uwtiruog.sys
*** ERROR: Module load completed but symbols could not be loaded for uwtiruog.sys

Could not read faulting driver name
Probably caused by : uwtiruog.sys ( uwtiruog+beed )

Followup: MachineOwner

Is there any way to identify the process that called uwtiruog.sys, as this probably is the real cause of BSOD?

By the way, laptop in Packard Bell, Win Vista.

Many thanks!

EDIT: Moderators, is this more of a topic for serverfault? I was hoping for some answers :) Should I try posting the same Q there (or could you migrate it)?

Answer 1

That's a PAGE_FAULT_IN_NON_PAGED_AREA, which is caused by the driver attempting to touch memory that isn't mapped. This is usually just a driver bug, but in your case I notice that the driver is being loaded from \??\C:\Users[USER]\AppData\Local\Temp\uwtiruog.sys - a user-writable section of the disk, and not from \windows\system32 as I'd expect.

Are you running any specialist software to do deep inspection of the system, such as a funky version of Process Monitor or a filesystem monitor? If not it might be worth uploading that file to a malware checking site such as virustotal, and be prepared to get out your favourite antivirus software and/or windows install disk.