[Lonette]

After running SFC I got the following message. Also, every site, IE, Foxfire that I go to closes out of it. I was referred to this forum by Azarl who helped me clean up virus, spyware, rootkit.

"Please wait while Windows verifies that all protected Windows files are intact and in their original versions"

A little while later I got the blue screen

RQL_NOT_LESS_OR_EQUAL

STOP: 0X0000000A (0XFFFFFFF0, 0X00000002, 0X00000000, 0X804EFC2C)

and my computer shut down.

When I rebooted it the follow box apeared

"The system has recovered from a serious error"

This doesn't sound good.

[Advertisements]

Do you only get this error when running sfc /scannow?

Edited by tuxmaster, 18 January 2010 - 07:53 AM.

[anzenketh]

Do you only get this error when running sfc /scannow?

Edited by tuxmaster, 18 January 2010 - 07:53 AM.

[Techextreme]

Were any system files ( ntfs.sys atapi.sys ) replaced during the process of removing your malware issues?

[Lonette]

Tuxmaster,
Yes. That was the only time I got the message.

Techextreme,
Honestly, I'm not sure. I think Azarl can answer that. Sorry.

Thanks you guys for responding.

Lonette

[Lonette]

Techextreme,
This is the link to my Malware post. Hope this helps. Sorry, I'm not very good at this.

http://www.geekstogo...he-t263409.html

[Techextreme]

Lonette,

I noticed azarl had you remove a file here.

Can you tell us the make and model of your computer please?

[Lonette]

Sure, it's a Dell Dimension 2400.

Thank you.

Lonette

[Techextreme]

Lonette,

Please go here and download the Intel Application Accelerator. You will click Download to the right of English: iaa23_enu.exe. On the following page, click accept to the Intel License agreement. On the next page click on "Download Performance Software - Intel® Application Accelerator".

If you are using Internet Explorer, you will possibly see a yellow bar at the top of your screen stating files were blocked. Click on the yellow bar and then click on Download file. Save the file to your Desktop. The file that will be on your desktop will be iaa23_enu.exe. Double click on this file and this will replace the file that was removed and should stop the IRQL_NOT_LESS_OR_EQUAL Blue Screen.

Hope this helps,

[Lonette]

Techextreme,
I followed your instructions. Thank you.

Lonette

[azarl]

Were any system files ( ntfs.sys atapi.sys ) replaced during the process of removing your malware issues?

C:\WINDOWS\system32\drivers\IdeChnDr.sys was infected and replaced with a clean copy from C:\Program Files\Intel\Intel Application Accelerator\Driver\IdeChnDr.sys

[Lonette]

I just ran SFC and didn't get the blue screen and message. Thank you so much for your help.

Have a wonderful day!

Lonette

[Techextreme]

You're welcome.

Good Luck in your quest for final cleaning.

[Lonette]

Thank you.... I must praise you guys and the website. I've referred a lot of people to it.

[azarl]

Thanks Techextreme

[Techextreme]

Glad I could help