G
Guest
A customer brought a machine in that had been in the shop a few weeks back
for adware removal. I cleaned up the machine and gave it back to her, all was
well for a while and then she got infected with some variant of the
about:blank hijacker. Since she lives a ways away, I advised her to download,
update and run MS Antispyware, and she did this but it did not remove the
hijacker after multiple scans.
Somewhere during this, the machine started crashing with stop c0000135
referencing winsrv as being corrupt or missing, and this also occurs when
trying to boot safe mode and when "last known good" is tried.
I booted up with BartPE and had a look around. The only adware reference in
machine in the Run key was se.dll, but this file did not exist on the hard
drive. It also does not appear that TV Media ever existed on this machine -
the registry keys referenced in http://support.microsoft.com/?id=885523 were
not found in the registry. It appears that SP2 was installed on this machine
back in March of 2005.
There were no registry references to winsrv.dll or exe that were not
referencing a Microsoft file. The winsrv.dll that is in the \system32
directory is v5.1.2600.1634 / xpsp2.050301-1526. This version appears to be
older than some of the other winsrv.dll files found in the uninstall
directories for XP updates. The newest I found is v5.1.2600.2622, assuming
that the larger minor version number indicates a newer version.
She did not notice any windows update activity going on coincidentally with
this, but it could have been configured to automatically download/install.
Last time I ran into this, it also had nothing to do with TV Media or a
recent install of SP2. Anybody know an easier cure than doing a repair
reinstall? I've already tried renaming the existing version of winsrv.dll and
copying the newer version of winsrv.dll over and get the same message, after
running chkdsk /r numerous times from recovery console.
for adware removal. I cleaned up the machine and gave it back to her, all was
well for a while and then she got infected with some variant of the
about:blank hijacker. Since she lives a ways away, I advised her to download,
update and run MS Antispyware, and she did this but it did not remove the
hijacker after multiple scans.
Somewhere during this, the machine started crashing with stop c0000135
referencing winsrv as being corrupt or missing, and this also occurs when
trying to boot safe mode and when "last known good" is tried.
I booted up with BartPE and had a look around. The only adware reference in
machine in the Run key was se.dll, but this file did not exist on the hard
drive. It also does not appear that TV Media ever existed on this machine -
the registry keys referenced in http://support.microsoft.com/?id=885523 were
not found in the registry. It appears that SP2 was installed on this machine
back in March of 2005.
There were no registry references to winsrv.dll or exe that were not
referencing a Microsoft file. The winsrv.dll that is in the \system32
directory is v5.1.2600.1634 / xpsp2.050301-1526. This version appears to be
older than some of the other winsrv.dll files found in the uninstall
directories for XP updates. The newest I found is v5.1.2600.2622, assuming
that the larger minor version number indicates a newer version.
She did not notice any windows update activity going on coincidentally with
this, but it could have been configured to automatically download/install.
Last time I ran into this, it also had nothing to do with TV Media or a
recent install of SP2. Anybody know an easier cure than doing a repair
reinstall? I've already tried renaming the existing version of winsrv.dll and
copying the newer version of winsrv.dll over and get the same message, after
running chkdsk /r numerous times from recovery console.