Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Reposting question from superuser:

Hello, A colleague has a laptop that was infected with malware. I cleaned it but the performace is still not 100%. I tried following instructions on Bleepingcomputer and TechGuy to check for hidden malware/rootkit infection and that resulted in BSOD.

I'm posting excerpt from MiniDump, identifying uwtiruog.sys (or it not being there) as most likely cause for BSOD:

*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *

Use !analyze -v to get detailed debugging information.

BugCheck 50, {86208000, 0, 93af4eed, 0}

Unable to load image \??\C:\Users\[USER]\AppData\Local\Temp\uwtiruog.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for uwtiruog.sys
*** ERROR: Module load completed but symbols could not be loaded for uwtiruog.sys

Could not read faulting driver name
Probably caused by : uwtiruog.sys ( uwtiruog+beed )

Followup: MachineOwner

Is there any way to identify the process that called uwtiruog.sys, as this probably is the real cause of BSOD?

By the way, laptop is Packard Bell, Win Vista.

Many thanks!

share|improve this question

migrated from Nov 20 '10 at 11:43

This question came from our site for system and network administrators.

I'm sorry you (apparently) didn't get the answer you wanted from SuperUser, but this question belongs there. The traditional System Admin's answer to this question is always "Nuke from orbit" btw. I doubt you'll get much different advice here than that from Sven which you've disagreed with. – RobM Nov 20 '10 at 11:13

This is off-topic here.

Nevertheless, if you haven't completely re-installed the system from the installation media, you haven't cleaned it up. Virus or malware infection means re-installing Windows. Period.

share|improve this answer
From SF FAQ:"Server Fault is for system administrators and IT professionals [check], people who manage or maintain computers in a professional capacity[check]. If you are in charge of … * servers [check, but not the case here] * networks [check, but not the case here] * many desktop PCs (other than your own) [check] … then you're in the right place to ask your question!" Seems like I am in the right place. – imagodei Nov 20 '10 at 10:02
And, regardless of your high reputation, I must disagree with you on the reinstalling Windows in case of infection. There are some viruses/malware which mess up PC beyond repair - but that is far from saying every infection needs reinstalling. Malware is made up of a finite number of components, cleaning all means effectively cleaning malware. I don't always have time to reinstall Win because of some benign infection. And as far as this case is concerned: who says that the driver mentioned is really malware related? If it is and I can't clean it, only then I may need to reinstall Windows. – imagodei Nov 20 '10 at 10:11
Well, if you are sure you have cleaned up, good for you. I am never sure to have managed this and never trust a system afterwards. But I can reinstall all relevant computers from a known good state quite easily, so this isn't a problem for me. – Sven Nov 20 '10 at 10:39
@imagodei, As a sysadmin, "cleaning" a [suspected] infection, or even a misbehaving OS install means reinstalling. As I make use of images and scripted software installs, this is nearly always a hands-free operation. Troubleshooting issues this minor are a waste of valuable time. Reimage and restore data from back. – jscott Nov 20 '10 at 11:42
Thank you for an honest opinion. In any other case I would tend to agree with you, but you're missing the point here: this is a "pet project" for me. Kind of a learning expedition. It is true that reinstalling would take considerably less time. Much less reimaging. And I would get vanilla clean system. But, then again, this is an opportunity to learn something. In short - maybe you're right and I should reinstall, but that doesn't answer my question: Is there any way to identify the process that called uwtiruog.sys, as this probably is the real cause of BSOD? – imagodei Nov 22 '10 at 0:06

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.