Solved xbext.sys in bluescreen.. help me!!!

Chrisora13 · Nov 24, 2010

i got the irql_not_less_or_equal bluescreen with the xbext.sys file problem.... can you help me fix this??

richc46 · Nov 24, 2010

Looks like it might be a virus even a rootkit
UPdate your antivirus and make a full scan
Download and run malwarebytes. Make a full scan and update first.

Code:

 icrosoft (R) Windows Debugger Version 6.11.0001.404 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
 
Loading Dump File [C:\Users\richc46\AppData\Local\Temp\Temp3_BSOD[1].zip\Windows_NT6_BSOD_jcgriff2\112210-19297-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7600 MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16617.x86fre.win7_gdr.100618-1621
Machine Name:
Kernel base = 0x83a47000 PsLoadedModuleList = 0x83b8f810
Debug session time: Mon Nov 22 01:55:56.906 2010 (GMT-5)
System Uptime: 0 days 0:09:59.639
Loading Kernel Symbols
...............................................................
................................................................
..............................
Loading User Symbols
Loading unloaded module list
....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck D1, {b10a2000, 2, 0, 8472fccb}
Unable to load image \SystemRoot\System32\Drivers\xbext.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for xbext.sys
*** ERROR: Module load completed but symbols could not be loaded for xbext.sys
Unable to load image \SystemRoot\system32\DRIVERS\Rt86win7.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for Rt86win7.sys
*** ERROR: Module load completed but symbols could not be loaded for Rt86win7.sys
Unable to load image \SystemRoot\system32\drivers\spsys.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for spsys.sys
*** ERROR: Module load completed but symbols could not be loaded for spsys.sys
Probably caused by : xbext.sys ( xbext+4ccb )
Followup: MachineOwner
---------
1: kd> lmtsmn
start    end        module name
8468c000 846d4000   ACPI     ACPI.sys     Mon Jul 13 19:11:11 2009 (4A5BBF0F)
91017000 91071000   afd      afd.sys      Mon Jul 13 19:12:34 2009 (4A5BBF62)
9806c000 9807e000   AgileVpn AgileVpn.sys Mon Jul 13 19:55:00 2009 (4A5BC954)
89a35000 89a3e000   amdxata  amdxata.sys  Tue May 19 13:57:35 2009 (4A12F30F)
94ffa000 94ffb420   ASACPI   ASACPI.sys   Thu Aug 12 22:52:52 2004 (411C2D04)
89a09000 89a12000   atapi    atapi.sys    Mon Jul 13 19:11:15 2009 (4A5BBF13)
89a12000 89a35000   ataport  ataport.SYS  Mon Jul 13 19:11:18 2009 (4A5BBF16)
9ba40000 9ba8d000   ATMFD    ATMFD.DLL    unavailable (00000000)
89e00000 89e07000   Beep     Beep.SYS     Mon Jul 13 19:45:00 2009 (4A5BC6FC)
93412000 934be000   BHDrvx86 BHDrvx86.sys Wed Oct 27 21:19:23 2010 (4CC8CF9B)
921ed000 921fb000   blbdrive blbdrive.sys Mon Jul 13 19:23:04 2009 (4A5BC1D8)
844a1000 844a9000   BOOTVID  BOOTVID.dll  Mon Jul 13 21:04:34 2009 (4A5BD9A2)
8d6c3000 8d6dc000   bowser   bowser.sys   Mon Jul 13 19:14:21 2009 (4A5BBFCD)
9ba20000 9ba3e000   cdd      cdd.dll      unavailable (00000000)
89fdf000 89ffe000   cdrom    cdrom.sys    Mon Jul 13 19:11:24 2009 (4A5BBF1C)
844eb000 84596000   CI       CI.dll       Mon Jul 13 21:09:28 2009 (4A5BDAC8)
89f88000 89fad000   CLASSPNP CLASSPNP.SYS Mon Jul 13 19:11:20 2009 (4A5BBF18)
844a9000 844eb000   CLFS     CLFS.SYS     Mon Jul 13 19:11:10 2009 (4A5BBF0E)
89d6d000 89dca000   cng      cng.sys      Mon Jul 13 19:32:55 2009 (4A5BC427)
9805f000 9806c000   CompositeBus CompositeBus.sys Mon Jul 13 19:45:26 2009 (4A5BC716)
9997e000 9998b000   crashdmp crashdmp.sys Mon Jul 13 19:45:50 2009 (4A5BC72E)
92171000 921d5000   csc      csc.sys      Mon Jul 13 19:15:08 2009 (4A5BBFFC)
921d5000 921ed000   dfsc     dfsc.sys     Mon Jul 13 19:14:16 2009 (4A5BBFC8)
92165000 92171000   discache discache.sys Mon Jul 13 19:24:04 2009 (4A5BC214)
8a008000 8a019000   disk     disk.sys     Mon Jul 13 19:11:28 2009 (4A5BBF20)
9995b000 99974000   drmk     drmk.sys     Mon Jul 13 20:36:05 2009 (4A5BD2F5)
99996000 9999f000   dump_atapi dump_atapi.sys Mon Jul 13 19:11:15 2009 (4A5BBF13)
9998b000 99996000   dump_dumpata dump_dumpata.sys Mon Jul 13 19:11:16 2009 (4A5BBF14)
9999f000 999b0000   dump_dumpfve dump_dumpfve.sys Mon Jul 13 19:12:47 2009 (4A5BBF6F)
99974000 9997e000   Dxapi    Dxapi.sys    Mon Jul 13 19:25:25 2009 (4A5BC265)
934f1000 935a8000   dxgkrnl  dxgkrnl.sys  Thu Oct 01 20:48:33 2009 (4AC54DE1)
94fa1000 94fda000   dxgmms1  dxgmms1.sys  Mon Jul 13 19:25:25 2009 (4A5BC265)
920ea000 92148000   eeCtrl   eeCtrl.sys   Fri May 21 17:44:53 2010 (4BF6FED5)
920e5000 920e9900   ElbyCDIO ElbyCDIO.sys Thu Dec 17 17:25:11 2009 (4B2AAFC7)
92148000 92165000   EraserUtilRebootDrv EraserUtilRebootDrv.sys Fri May 21 17:44:53 2010 (4BF6FED5)
935f3000 935fe000   fdc      fdc.sys      Mon Jul 13 19:45:45 2009 (4A5BC729)
89ac9000 89ada000   fileinfo fileinfo.sys Mon Jul 13 19:21:51 2009 (4A5BC18F)
981d9000 981e3000   flpydisk flpydisk.sys Mon Jul 13 19:45:45 2009 (4A5BC729)
89a3e000 89a72000   fltmgr   fltmgr.sys   Mon Jul 13 19:11:13 2009 (4A5BBF11)
89dd8000 89de1000   Fs_Rec   Fs_Rec.sys   Mon Jul 13 19:11:14 2009 (4A5BBF12)
89f56000 89f88000   fvevol   fvevol.sys   Fri Sep 25 22:24:21 2009 (4ABD7B55)
8a16a000 8a19b000   fwpkclnt fwpkclnt.sys Mon Jul 13 19:12:03 2009 (4A5BBF43)
94ff4000 94ff9280   GEARAspiWDM GEARAspiWDM.sys Mon May 18 08:16:53 2009 (4A1151B5)
83a10000 83a47000   hal      halmacpi.dll Mon Jul 13 19:11:03 2009 (4A5BBF07)
92000000 9201f000   HDAudBus HDAudBus.sys Mon Jul 13 19:50:55 2009 (4A5BC85F)
999bb000 999ce000   HIDCLASS HIDCLASS.SYS Mon Jul 13 19:51:01 2009 (4A5BC865)
999ce000 999d4480   HIDPARSE HIDPARSE.SYS Mon Jul 13 19:50:59 2009 (4A5BC863)
999b0000 999bb000   hidusb   hidusb.sys   Mon Jul 13 19:51:04 2009 (4A5BC868)
8d63e000 8d6c3000   HTTP     HTTP.sys     Mon Jul 13 19:12:53 2009 (4A5BBF75)
8a000000 8a008000   hwpolicy hwpolicy.sys Mon Jul 13 19:11:01 2009 (4A5BBF05)
9803a000 98052000   i8042prt i8042prt.sys Mon Jul 13 19:11:23 2009 (4A5BBF1B)
9208a000 920e5000   IDSvix86 IDSvix86.sys Fri Sep 10 17:53:26 2010 (4C8AA8D6)
934df000 934f1000   intelppm intelppm.sys Mon Jul 13 19:11:03 2009 (4A5BBF07)
91192000 911b5000   Ironx86  Ironx86.SYS  Wed Jun 23 20:27:03 2010 (4C22A657)
98052000 9805f000   kbdclass kbdclass.sys Mon Jul 13 19:11:15 2009 (4A5BBF13)
80bb3000 80bbb000   kdcom    kdcom.dll    Mon Jul 13 21:08:58 2009 (4A5BDAAA)
98153000 98187000   ks       ks.sys       Wed Mar 03 22:57:52 2010 (4B8F2FC0)
89d5a000 89d6d000   ksecdd   ksecdd.sys   Mon Jul 13 19:11:56 2009 (4A5BBF3C)
89f04000 89f29000   ksecpkg  ksecpkg.sys  Thu Dec 10 23:04:22 2009 (4B21C4C6)
9961b000 9962b000   lltdio   lltdio.sys   Mon Jul 13 19:53:18 2009 (4A5BC8EE)
99600000 9961b000   luafv    luafv.sys    Mon Jul 13 19:15:44 2009 (4A5BC020)
84418000 84490000   mcupdate_GenuineIntel mcupdate_GenuineIntel.dll Mon Jul 13 21:06:41 2009 (4A5BDA21)
999e2000 999ed000   monitor  monitor.sys  Mon Jul 13 19:25:58 2009 (4A5BC286)
98113000 98120000   mouclass mouclass.sys Mon Jul 13 19:11:15 2009 (4A5BBF13)
999d7000 999e2000   mouhid   mouhid.sys   Mon Jul 13 19:45:08 2009 (4A5BC704)
84400000 84416000   mountmgr mountmgr.sys Mon Jul 13 19:11:27 2009 (4A5BBF1F)
8d6dc000 8d6ee000   mpsdrv   mpsdrv.sys   Mon Jul 13 19:52:52 2009 (4A5BC8D4)
8d6ee000 8d711000   mrxsmb   mrxsmb.sys   Sat Feb 27 02:32:02 2010 (4B88CA72)
8d711000 8d74c000   mrxsmb10 mrxsmb10.sys Sat Feb 27 02:32:21 2010 (4B88CA85)
8d74c000 8d767000   mrxsmb20 mrxsmb20.sys Sat Feb 27 02:32:11 2010 (4B88CA7B)
89bb4000 89bbf000   Msfs     Msfs.SYS     Mon Jul 13 19:11:26 2009 (4A5BBF1E)
846dd000 846e5000   msisadrv msisadrv.sys Mon Jul 13 19:11:09 2009 (4A5BBF0D)
89d2f000 89d5a000   msrpc    msrpc.sys    Mon Jul 13 19:11:59 2009 (4A5BBF3F)
92080000 9208a000   mssmbios mssmbios.sys Mon Jul 13 19:19:25 2009 (4A5BC0FD)
8a1eb000 8a1fb000   mup      mup.sys      Mon Jul 13 19:14:14 2009 (4A5BBFC6)
89e0f000 89ec6000   ndis     ndis.sys     Mon Jul 13 19:12:24 2009 (4A5BBF58)
98096000 980a1000   ndistapi ndistapi.sys Mon Jul 13 19:54:24 2009 (4A5BC930)
980a1000 980c3000   ndiswan  ndiswan.sys  Mon Jul 13 19:54:34 2009 (4A5BC93A)
981e3000 981f4000   NDProxy  NDProxy.SYS  Mon Jul 13 19:54:27 2009 (4A5BC933)
910d2000 910e0000   netbios  netbios.sys  Mon Jul 13 19:53:54 2009 (4A5BC912)
91071000 910a3000   netbt    netbt.sys    Mon Jul 13 19:12:18 2009 (4A5BBF52)
89ec6000 89f04000   NETIO    NETIO.SYS    Mon Jul 13 19:12:35 2009 (4A5BBF63)
89bbf000 89bcd000   Npfs     Npfs.SYS     Mon Jul 13 19:11:31 2009 (4A5BBF23)
92076000 92080000   nsiproxy nsiproxy.sys Mon Jul 13 19:12:08 2009 (4A5BBF48)
83a47000 83e57000   nt       ntkrpamp.exe Fri Jun 18 23:55:24 2010 (4C1C3FAC)
89c00000 89d2f000   Ntfs     Ntfs.sys     Mon Jul 13 19:12:05 2009 (4A5BBF45)
8a019000 8a020000   Null     Null.SYS     Mon Jul 13 19:11:12 2009 (4A5BBF10)
94f9f000 94fa0040   nvBridge nvBridge.kmd Sat Oct 16 13:04:23 2010 (4CB9DB17)
94602000 94f9e5a0   nvlddmkm nvlddmkm.sys Sat Oct 16 13:07:56 2010 (4CB9DBEC)
910b3000 910d2000   pacer    pacer.sys    Mon Jul 13 19:53:58 2009 (4A5BC916)
911e5000 911fd000   parport  parport.sys  Mon Jul 13 19:45:34 2009 (4A5BC71E)
8471a000 8472b000   partmgr  partmgr.sys  Mon Jul 13 19:11:35 2009 (4A5BBF27)
8d767000 8d76e000   parvdm   parvdm.sys   Mon Jul 13 19:45:29 2009 (4A5BC719)
846e5000 8470f000   pci      pci.sys      Mon Jul 13 19:11:16 2009 (4A5BBF14)
84600000 84607000   pciide   pciide.sys   Mon Jul 13 19:11:19 2009 (4A5BBF17)
845f1000 845ff000   PCIIDEX  PCIIDEX.SYS  Mon Jul 13 19:11:15 2009 (4A5BBF13)
89dca000 89dd8000   pcw      pcw.sys      Mon Jul 13 19:11:10 2009 (4A5BBF0E)
95202000 95299000   peauth   peauth.sys   Mon Jul 13 20:35:44 2009 (4A5BD2E0)
9992c000 9995b000   portcls  portcls.sys  Mon Jul 13 19:51:00 2009 (4A5BC864)
84490000 844a1000   PSHED    PSHED.dll    Mon Jul 13 21:09:36 2009 (4A5BDAD0)
9807e000 98096000   rasl2tp  rasl2tp.sys  Mon Jul 13 19:54:33 2009 (4A5BC939)
980c3000 980db000   raspppoe raspppoe.sys Mon Jul 13 19:54:53 2009 (4A5BC94D)
980db000 980f2000   raspptp  raspptp.sys  Mon Jul 13 19:54:47 2009 (4A5BC947)
980f2000 98109000   rassstp  rassstp.sys  Mon Jul 13 19:54:57 2009 (4A5BC951)
92035000 92076000   rdbss    rdbss.sys    Mon Jul 13 19:14:26 2009 (4A5BBFD2)
98109000 98113000   rdpbus   rdpbus.sys   Mon Jul 13 20:02:40 2009 (4A5BCB20)
89e07000 89e0f000   RDPCDD   RDPCDD.sys   Mon Jul 13 20:01:40 2009 (4A5BCAE4)
89ba4000 89bac000   rdpencdd rdpencdd.sys Mon Jul 13 20:01:39 2009 (4A5BCAE3)
89bac000 89bb4000   rdprefmp rdprefmp.sys Mon Jul 13 20:01:41 2009 (4A5BCAE5)
89f29000 89f56000   rdyboost rdyboost.sys Mon Jul 13 19:22:02 2009 (4A5BC19A)
999ed000 99a00000   rspndr   rspndr.sys   Mon Jul 13 19:53:20 2009 (4A5BC8F0)
911c0000 911e5000   Rt86win7 Rt86win7.sys Thu Feb 26 04:04:22 2009 (49A65B16)
9962b000 9992b980   RTKVHDA  RTKVHDA.sys  Wed Jul 28 06:00:28 2010 (4C4FFFBC)
9812b000 98151000   SCSIPORT SCSIPORT.SYS Mon Jul 13 19:45:55 2009 (4A5BC733)
93400000 9340a000   serenum  serenum.sys  Mon Jul 13 19:45:27 2009 (4A5BC717)
910e0000 910fa000   serial   serial.sys   Mon Jul 13 19:45:33 2009 (4A5BC71D)
8a1e3000 8a1eb000   spldr    spldr.sys    Mon May 11 12:13:47 2009 (4A084EBB)
952c7000 95331000   spsys    spsys.sys    Mon May 11 12:37:10 2009 (4A085436)
911b5000 911bf980   SRTSPX   SRTSPX.SYS   Tue Jul 27 18:15:42 2010 (4C4F5A8E)
95380000 953d1000   srv      srv.sys      Thu Aug 26 23:31:26 2010 (4C77318E)
95331000 95380000   srv2     srv2.sys     Thu Aug 26 23:30:45 2010 (4C773165)
95299000 952ba000   srvnet   srvnet.sys   Thu Aug 26 23:30:39 2010 (4C77315F)
98151000 98152380   swenum   swenum.sys   Mon Jul 13 19:45:08 2009 (4A5BC704)
89a72000 89ac9000   SYMDS    SYMDS.SYS    Mon May 17 21:12:04 2010 (4BF1E964)
89ada000 89b83000   SYMEFA   SYMEFA.SYS   Thu Jul 22 22:19:19 2010 (4C48FC27)
9116c000 91192000   SYMEVENT SYMEVENT.SYS Fri Jul 30 19:05:03 2010 (4C535A9F)
9111d000 9116c000   SYMNETS  SYMNETS.SYS  Tue Jul 06 23:11:18 2010 (4C33F056)
8a021000 8a16a000   tcpip    tcpip.sys    Sun Jun 13 23:36:59 2010 (4C15A3DB)
952ba000 952c7000   tcpipreg tcpipreg.sys Mon Jul 13 19:54:14 2009 (4A5BC926)
89be4000 89bef000   TDI      TDI.SYS      Mon Jul 13 19:12:12 2009 (4A5BBF4C)
89bcd000 89be4000   tdx      tdx.sys      Mon Jul 13 19:12:10 2009 (4A5BBF4A)
9110d000 9111d000   termdd   termdd.sys   Mon Jul 13 20:01:35 2009 (4A5BCADF)
9bde0000 9bde9000   TSDDD    TSDDD.dll    unavailable (00000000)
934be000 934df000   tunnel   tunnel.sys   Mon Jul 13 19:54:03 2009 (4A5BC91B)
98187000 98195000   umbus    umbus.sys    Mon Jul 13 19:51:38 2009 (4A5BC88A)
999d5000 999d6700   USBD     USBD.SYS     Mon Jul 13 19:51:05 2009 (4A5BC869)
94fe5000 94ff4000   usbehci  usbehci.sys  Mon Jul 13 19:51:14 2009 (4A5BC872)
98195000 981d9000   usbhub   usbhub.sys   Mon Jul 13 19:52:06 2009 (4A5BC8A6)
935a8000 935f3000   USBPORT  USBPORT.SYS  Mon Jul 13 19:51:13 2009 (4A5BC871)
94fda000 94fe5000   usbuhci  usbuhci.sys  Mon Jul 13 19:51:10 2009 (4A5BC86E)
98120000 9812b000   VClone   VClone.sys   Sun Aug 09 17:25:56 2009 (4A7F3EE4)
8470f000 8471a000   vdrvroot vdrvroot.sys Mon Jul 13 19:46:19 2009 (4A5BC74B)
89de1000 89ded000   vga      vga.sys      Mon Jul 13 19:25:50 2009 (4A5BC27E)
89b83000 89ba4000   VIDEOPRT VIDEOPRT.SYS Mon Jul 13 19:25:49 2009 (4A5BC27D)
8a19b000 8a1a3380   vmstorfl vmstorfl.sys Mon Jul 13 19:28:44 2009 (4A5BC32C)
84596000 845a6000   volmgr   volmgr.sys   Mon Jul 13 19:11:25 2009 (4A5BBF1D)
845a6000 845f1000   volmgrx  volmgrx.sys  Mon Jul 13 19:11:41 2009 (4A5BBF2D)
8a1a4000 8a1e3000   volsnap  volsnap.sys  Mon Jul 13 19:11:34 2009 (4A5BBF26)
910fa000 9110d000   wanarp   wanarp.sys   Mon Jul 13 19:55:02 2009 (4A5BC956)
89ded000 89dfa000   watchdog watchdog.sys Mon Jul 13 19:24:10 2009 (4A5BC21A)
8460d000 8467e000   Wdf01000 Wdf01000.sys Mon Jul 13 19:11:36 2009 (4A5BBF28)
8467e000 8468c000   WDFLDR   WDFLDR.SYS   Mon Jul 13 19:11:25 2009 (4A5BBF1D)
910ac000 910b3000   wfplwf   wfplwf.sys   Mon Jul 13 19:53:51 2009 (4A5BC90F)
9bb80000 9bdcb000   win32k   win32k.sys   unavailable (00000000)
846d4000 846dd000   WMILIB   WMILIB.SYS   Mon Jul 13 19:11:22 2009 (4A5BBF1A)
910a3000 910ac000   ws2ifsl  ws2ifsl.sys  Mon Jul 13 19:55:01 2009 (4A5BC955)
98000000 9801a000   WudfPf   WudfPf.sys   Mon Jul 13 19:50:13 2009 (4A5BC835)
8472b000 847fe000   xbext    [B]xbext.sys    Fri Oct 01 23:06:32 2010[/B] (4CA6A1B8)
Unloaded modules:
89fad000 89fba000   crashdmp.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
89fba000 89fc5000   dump_ataport
    Timestamp: unavailable (00000000)
    Checksum:  00000000
89fc5000 89fce000   dump_atapi.s
    Timestamp: unavailable (00000000)
    Checksum:  00000000
89fce000 89fdf000   dump_dumpfve
    Timestamp: unavailable (00000000)
    Checksum:  00000000

Look at exbext above. It has a new date and there is no Google on it.
Take those scans as I suggested.
If you do come up negative, I will reanalyze and tell you how to prevent BSOD in the future

Solved xbext.sys in bluescreen.. help me!!!

Chrisora13

New member

My Computer

richc46

Moderator

My Computer