- Registry Editor (Regedit.exe)
- Task Manager (Taskmgr.exe)
- System Configuration Utility (Msconfig.exe)
- System Information (Msinfo32.exe)
- The computer automatically restarts.
- After you log on, you receive the following error message:Microsoft WindowsWhen you click the click here link at the bottom of the message box, you see error signature information that may be similar to one of the following data samples:
The system has recovered from a serious error.
A log of this error has been created.
Please tell Microsoft about this problem.
We have created an error report that you can send to help us improve Microsoft Windows. We will treat this report as confidential and anonymous.
To see what data this error report contains, click here.
Data sample 1
BCCode : 00000050 BCP1 : ffffff60 BCP2 : 00000000 BCP3 : 804fa26f
BCP4 : 00000000 OSVer : 5_1_2600 SP : 0_0 Product : 256_1
Data sample 2
BCCode : 0000000A BCP1 : ffffff94 BCP2 : 00000000 BCP3 : 00000000
BCP4 : 804e15ef OSVer : 5_1_2600 SP : 0_0 Product : 256_1
- You receive one of the following Stop error messages:
Message 1A problem has been detected and Windows has been shut down to prevent damage to your computer...
*** STOP: 0x00000050 (0xffffff60, 0x00000000, 0x804fa26f, 0x00000000) PAGE_FAULT_IN_NONPAGED_AREA address 0x804fa26f in 0x50_nt!ObReferenceObjectSafe+e
Message 2A problem has been detected and Windows has been shut down to prevent damage to your computer...
*** STOP: 0x0000000A (0xffffff94, 0x00000000, 0x00000000, 0x804e15ef) IRQL_NOT_LESS_OR_EQUAL address 0x804fa26f in 0xA_nt!ExpCopyThreadInfo+a
- When you view the System log in Event Viewer, you may see an entry that is similar to one of the following:
- The symptoms of a Stop error vary according to your computer's system failure options.
For more information about how to configure system failure options, click the following article number to view the article in the Microsoft Knowledge Base:307973 How to configure system failure and recovery options in Windows
- The four parameters that are inside the parentheses of the Stop error message vary according to the computer's configuration.
- Not all "Stop 0x0000000A" errors are caused by the problem that is described in this article.
For more information about how to troubleshoot Stop 0x0000000A errors in Windows XP, click the following article number to view the article in the Microsoft Knowledge Base:314063 Troubleshooting a Stop 0x0000000A error in Windows XP
The Sdbot virus creates a hidden process. This process closes programs that system administrators use for diagnostic and configuration purposes. The process may also prevent these programs from running.
The file name of the Sdbot virus varies. Many variants of this virus put a driver that is named Msdirectx.sys or Haxdrv.sys on the computer. This driver is used to hide the virus process. The file names that the virus frequently uses include Msdrv.exe and Sdkcore.exe. These virus variants can restore the virus if you delete the files.
To automatically remove some versions of this virus, run the Microsoft Malicious Software Removal Tool.
The April release of this utility can remove some variants of this malware. You can find information and downloads for the Malicious Software Removal Tool at the following locations:
Important The file name of the Sdbot virus varies. You may have to modify these steps according to the file name that the Sdbot virus uses on your computer.
- Follow these steps to start the computer in Safe Mode:
- Restart the computer.
- As the computer starts, press the F8 key repeatedly at a rate of one time per second.
The Microsoft Windows Advanced Startup Menu options display.
- Use the UP ARROW and DOWN ARROW keys to select Safe Mode, and then press ENTER.
- Click Start, click Run, type regedit in the Open box, and then click OK.
- In the following registry subkeys, locate and delete any entries that contain the Msdrv.exe file name or the Sdkcore.exe file name:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunFor example, if an "Ms Sound Drivers" entry has a value of "msdrv.exe," delete the entry.
- In the following registry subkeys, locate and delete any entries that contain Msdirectx or Haxdrv:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\
- Quit Registry Editor.
- Click Start, click Run, type cmd in the Open box, and then click OK.
- At the command prompt, type the following commands. Press ENTER after each command. attrib -r -h -s %systemroot%\system32\msdirectx.sysNote These files may exist in various folders on the computer. For example, the files have been reported in the following folders:
attrib -r -h -s %systemroot%\system32\haxdrv.sys
attrib -r -h -s %systemroot%\system32\msdrv.exe
attrib -r -h -s %systemroot%\system32\sdkcore.exe
- C:\Documents and Settings\UserName\
Perform a search to find all instances of Msdirectx.sys and Haxdrv.sys. Then, type the commands in this step, but replace the %systemroot%\system32\ path with the path of each file that you find.
- Type the following commands to delete the files. Press ENTER after each command.del %systemroot%\system32\msdirectx.sysIf you found other instances of these files in step 7, repeat these commands by using the path of each file that you found.
- Restart the computer.
- Make sure that your antivirus and anti-spyware programs are updated with the latest definitions. Then, perform a complete system scan. As of April 7, 2005, the following files are detected by the following programs:
Program Sdbot virus variant detected Norman AV W32/MEWpacked.gen PandaLabs W32/MEWpacked.gen AVERT Labs No Detection (inconclusive) F-Secure Backdoor.Win32.SdBot.gen Sophos Troj/NtRootK-F (msdirectx.sys), Troj/Rootkit-U (haxdrv.sys), W32/Sdbot-WR, W32/Sdbot-VJ, W32/Sdbot-WK, W32/Sdbot-WD Trend Micro TROJ_ROOTKIT.H (msdirectx.sys), WORM_RBOT.AXU, WORM_SDBOT.BDX Program Sdbot virus variant detected F-Secure Trojan.Win32.Rootkit.h