DT rebots my PC after mounting image

[sicily]

Hi I am having the same issue where DT reboots my PC after i try to mount an image, or uninstall the app, or update to a newer version. it blue screens on me sayin problem with file bmthdk.sys

how can i attch the dump file?

[Copytrooper]

What's that bmthdk.sys? Which application installed it?
Tried to remove or update it yet?

[sicily]

i thought the file bmthdk.sys was installed by DT, also i have tried both uninstall and update and they both reboot my machine

how can i send u y dump file?

[korny]

Are you sure you typed in the correct filename cause checking for a filename bmtdhk.sys gave this output:

http://forum.hijackthis.de/showthread.php?t=15448

Haxdoor: ****hh.dll
All variants from this type:
O20 - Winlogon Notify: ****hh - C:\WINDOWS\SYSTEM32\****hh.dll
which are using the same method of infection.
(**** is the random part.)
Known Variants:
bmtdhh
O20 - Winlogon Notify: bmtdhh - C:\WINDOWS\SYSTEM32\bmtdhh.dll
DVB X11 controller: \??\C:\WINDOWS\System32\bmtdhk.sys (autostart)
DVBa X11 controller: \??\C:\WINDOWS\System32\bmtdhk.sys (system)

Apparently bmthdk.sys isn't a known sysfile on the whole www.
Hopefully this info will help you with your problem :wink:

[Jito463]

That file definitely has nothing to do with DTools, but you can still send them the minidump. The address is support@daemon-tools.cc.

[sicily]

i am sorry i apologize, you are correct. i wrote the file name down wrong, it is in fact bmtdhk.sys. The thing is when i search my entire c drive for this sys file i cannot find it. The reason i was asking if this file is anyway associated with dt is because after mounting any image file my pc blue screens and this is the file that shows up on the blue screen. Thank you i will send my dump to them, because as of right now i can not use the program, obviously, but i can not uninstall it or even update. very frustrating.

thank you

[Jito463]

http://www.bleepingcomputer.com/startups/bmtdhk.sys-15220.html

Read the page in the link above. Apparently it's "A variant of the Troj/Haxdor-Gen rootkit.".