Member Avatar for hettym

I started up my laptop the other day which is windows xp service pack 2, and when I logged in to windows this cmd.exe black screen thing came up for about a second - not enough time to read what it said?! Then about 3 minutes later the blue screen of death came up but literally for about a second as well, and then the computer restarted. Then 3 mins later the exact same thing happened! It just kept happening like a loop, so I just quickly got the task manager up and deleted any random processes - one of them must have been causing it because after that it didn't happen. But now when I start the laptop up again I can't find out which one it is or why it's happening?!

I did a lavasoft ad-aware full system scan but it didn't stop the blue screen, and right now I'm in safe mode trying to update AVG so I can do a virus scan. But it won't let me update, it won't install avast and whever I try to do a panda online scan or any online scan for that matter, it says 'refused connection' or 'failed to connect' - This is in IE and in firefox. I tried to start up the computer with last good configuration but the blue screen still came up. :(

The stop error code is 0x0000008e i think but it doesn't really give you a chance to read it...

As suggested in another thread I have tried to install rkill but it won't let me, it won't let me install hijackthis either - so basically anything you can install to get rid of it doesn't run or fails to connect.

I'm really not great with computers so if anyone could help me in any way possible it would be greatly appreciated! thankyou!

Hetty

  • 4 Contributors
  • 7 Replies
  • 322 Views
  • 3 Years Discussion Span
  • Latest Post Latest Post by DEBBIELCOLLINS2

Dani AI

Generated

This thread shows a classic pattern: an XP STOP 0x0000008E crash (kernel/page-fault style) together with a stubborn executable named twext.exe that resists normal AV installs and blocks network scans. The STOP code 0x0000008E is often caused by bad RAM, bad drivers, or kernel-level software (including malware that hooks startup and drivers). (learn.microsoft.com) twext.exe is frequently reported in removal logs as a malicious/third‑party executable that lives in System32 and persists via Run/UserInit entries. (file.info)

Practical, safe checklist (apply in order, from a working PC if you need rescue media): back up personal files first; disable System Restore (so infected restore points can’t reintroduce files); boot Safe Mode (no networking) and use msconfig/Autoruns to disable non‑Microsoft services and suspicious startup entries; inspect the Winlogon/UserInit value (HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit) and the Run keys for extra .exe entries and export any key before editing it. If a process is visible in Task Manager, stop it before deleting files/registry entries (export first and be cautious — editing the wrong value can prevent logon).

If in‑Windows tools are blocked, create and boot from a clean, up‑to‑date offline rescue disk (download the ISO on a clean PC, write to USB or CD, boot the infected laptop and run a full scan). Bootable rescue environments (Kaspersky Rescue Disk and similar) run outside Windows so rootkits and blockers can be removed. (support.kaspersky.com)

Also rule out hardware: run a bootable memory test (MemTest86 or memtest86+) for several passes — bad RAM can produce the same BSOD behavior. (memtest.org) Capture and analyze any minidump files in C:\Windows\Minidump (disable automatic restart to read the blue screen). Tools such as BlueScreenView can quickly point to the driver or module implicated by the dump (not 100% definitive, but a useful lead). (nirsoft.net)

Notes of caution: if a backdoor/rootkit is confirmed, change all passwords from a known‑clean device and consider a clean OS reinstall if anything looks persistent. Save and keep the Malwarebytes/HJT/log files that asked for — they’re crucial when deciding whether a repair or reinstall is safer.

Recommended Answers

All 7 Replies

Member Avatar for hettym

update: I managed to run hijackthis and it found a file called twext.exe... apparently this is a really dangerous file! I tried to remove it on hijackthis but it wouldn't do it. Does anyone know how to remove this file even though i can't install or run ANY antivirus programs? Please help! thanks, Hetty

Member Avatar for jholland1964

update: I managed to run hijackthis and it found a file called twext.exe... apparently this is a really dangerous file! I tried to remove it on hijackthis but it wouldn't do it. Does anyone know how to remove this file even though i can't install or run ANY antivirus programs? Please help! thanks, Hetty

That twext.exe is likely the file you were able to stop in the Task Manager. Check there and if you see it turn it off.

HiJackThis is basically a scanner program NOT a fixer program.
Please do the following:
Please download Malwarebytes' Anti-Malware (MBA-M) to your Desktop.

* DoubleClick mbam-setup.exe and follow the prompts to install MBA-M.
* Be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
* If an update is found, it will download and install the latest version.
* Once the program has loaded, select Perform full scan, then click Scan.
* When the scan is complete, click OK, then Show Results to view the results.
* Be sure that everything is checked, and click Remove Selected.
* When MBA-M finishes, Notepad will open with the log. Please save it where you can find it easily. The log can also be opened by going to Start > All Programs > Malwarebytes' Anti-Malware > Logs > log-date.txt.

Reboot the computer. Run the HJT program again, save the log. Post back here with the MBA-M log and the HJT log.

Member Avatar for hettym

Hi, thanks very much for your help, malwarebytes must've deleted whatever it was so it is fixed now. I did have to trick it though by changing the name of the .exe file so the program would actually run!

Thanks, Hetty

Member Avatar for jholland1964

You have not posted the MBA-M log which can be found within the program under the Logs Tab. Open the tab, double click the log. It will open in Notepad. Copy/paste the log back here. One cannot say the problem is solved just by running one scan. Chances are that it is NOT, especially since you had to change the name of the .exe file in order to run the program.
The choice however is yours. If you prefer to assume all is well then click the Mark as Solved listing and consider things done.

Member Avatar for webstar

hey i got the same problem..i cant install any anti-virus..i have installed windows likw 5times LL IN DIFFERENT partitions n all formated installation..when i try to install avg it brings the blue screen..need help ASAP..plz

Member Avatar for jholland1964

webstar, this thread is six months old, the original poster did not return so the thread is closed. You need to begin your own thread, clearly stating your own problems, giving all info about your computer. We ask that you complete as many of the steps as possible in the Read Me sticky http://www.daniweb.com/forums/thread134865.html
before creating your own new thread and posting available logs in that new thread. Then somebody will be able to offer assistance.

Member Avatar for DEBBIELCOLLINS2

ntexcess start runmbam exe

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.