Greetings all, I've got a messy one for you, it has me stumped. Windows Vista laptop, a Compaq v6000, presented with an infection that simulated a failed hard drive. Infection has also has modified the hidden attribute on multiple folders and has seemed to screw with permissions as well. - Removed the hard drive from the laptop, scanned with NOD32 in our dedicated scanning machine. Found MBR trojans, and several other Kryptik family trojans - Reconnected HD to he laptop, booted the Starup Repair command prompt and ran FixMBR and FixBoot to eliminate the MBR virus - Booted to Safe Mode, and ran Spybot and MalwareBytes which identified and removed multiple additional infections. - Now the computer BSOD's within 10 seconds of booting to normal mode, every time. I see the desktop icons, and the taskbar, and then poof. BSOD code is 0x0000008e - Safe Mode boots correctly. But it appears that changes I make there aren't being written correctly. ChkDsk /r results in no chkdsk being run at reboot. Changing the MemoryDump settings results in no memory dump being created at the subsequent reboot & BSOD. Using MSConfig to try to force a selective startup doesn't do anything, I can still see non-Microsoft icons in the system try just before the BSOD - I've seen suggestions that this is a rootkit. I try to run Rootkit Revealer, but get an error that the service can't start in safemode. I've also seen someone claim that removing McAfee Security Center has fixed this. I've downloaded the Mcafee uninstaller, but it fails with a service is in use error. - Even though I can't generate new minidumps, I do have one from 2 days ago (before NOD32 / SpyBot / Malwarebytes were run). It seems to suggest an error with NTKRNLPA.EXE. I've renamed that exe from command prompt, it does not have any effect on the BSOD. - System Restore is of no use, the virus apparently wiped out all the restore points. - Memtest has been run, no errors. - Any ideas? The idea here is to avoid a fomat/reinstall if possible.