C:\CI.dll Corrupt file crash - help!

Page 2 of 3 FirstFirst 123 LastLast

  1. Posts : 6
    win7 64
       #11

    Please note. I did have a System Repair disk. It could not start the computer with this rootkit virus - you just get a corrupt ci.dll report for the DVD Rom Drive.
    Similarly the computer will not start in SAFE mode, either, so that option is not available.
    And looking at the Standalone Sweeper info, you have to create it Before the computer goes wrong!
    Not much use after, and as the only Windows 7 machine I have is the one that had gone wrong, I couldn't create one to recover it!
    I will check it out now, though.
      My Computer

  2.    #12

    You can create MS Standalone Sweeper CD or flash stick on another computer.
      My Computer


  3. Posts : 6
    win7 64
       #13

    I have just read this on the MS Sweeper download site:

    ""Ordinarily, the bootable media is created on a computer that is not infected. The architecture of Microsoft Standalone System Sweeper Beta does not have to be the same as the Windows operating system of the computer used to create the bootable media. It does need to be the same architecture (32-bit or the 64-bit) as the Windows operating system of the computer infected with a virus or malware.""

    So you can create a 64 bit disk on a 32 bit machine. I can't see that a USB stick or external drive is a good format option for this situation.

    I have now created a 64 bit Sweeper disk on the laptop that was infected, just in case it (or something else) should happen again.
    BUT! as SAFE mode, DOS, Backup Disks and Image File Disks wouldn't work with this infection, and no external drive or USB port worked, and a normal System Repair Boot Disk would not work, will the Sweeper work?
    If the Sweeper disk boots using the ci.dll file, it will fail as it cannot open the kernel files.
    If it does work, I wish I had known before.
    Perhaps somebody who tries Sweeper for this problem can add their findings to this thread.
      My Computer

  4.    #14

    You are not booting the CD's correctly so it is trying to start the HD yielding the .dll error which should not occur while booting a disk.

    You'll need to correctly boot the Standalone Sweeper disk to clear the HD of infection and then run Startup Repair and possibly SFC manually from the Win7 Repair disk.

    Set the BIOS boot order so that the CD drive is first to boot: How to Boot your Computer from a Bootable CD or DVD - Boot to CD

    Or use the one-time BIOS Boot Menu key to trigger CD drive to boot: BIOS Boot menu keys (Imported)

    Look for the prompt to "Press any key to boot CD drive."
      My Computer


  5. Posts : 6
    win7 64
       #15

    Thanks for that, but I did not have the Sweeper disk at the time as I had not seen it mentioned in any of these threads, and I did load with the Boot Disk several times and each time it went through a Startup Repair Sequence at the end of which it said there was a problem with D:/ci.dll. Before this it said the ci.dll problem was on the C drive.
    Basically, no matter what I did it would not boot!
    I am sure this virus affects the BIOS as antivirus software told me it had definitely changed the headers of each of the drives and I could not navigate to any drive except "X:\"
    The ci.dll report is a symptom of the problem, not the cause.
    The computer is now back to normal.
    I think we had better see what happens when someone uses Sweeper to try to solve this problem before making any more posts.
      My Computer

  6.    #16

    Good work. Moving HD to uninfected computer may be necessary with this infection.

    I wish this was posted in Security for their expert opinion and attention.
      My Computer


  7. Posts : 6
    win7 64
       #17

    There are some really evil Trojans going around at the moment. I had another rootkit one on an XP machine.
    I couldn't ID it, it just came up as "drive has a rootkit corruption" when i virus scanned it. In both cases the Trojan came in a compressed rar file. So beware!
    I managed to kill the XP one with the disk in a caddy by running a virus killer on it from another PC Then I ran Fixboot from the OS. It booted up ok afterwards but it was virtually unusable! There were so many things the Trojan had done, like removing the "display hidden files" and "show filename extensions" options plus lots more, including stopping Internet access, corrupting all virus and spyware killers and blocking them from being updated or deleted. Whoever had created it had thought of every possible wrinkle to stop you removing it! Nasty!
    I managed to fix it by editing the Registry by following tips from clever, kind people like the ones on this Forum!
      My Computer

  8.    #18

    I've found that more than half the time SFC cannot repair damage from these infections even if they're "cleaned up" but it requires wiping the HD to clean reinstall.
      My Computer


  9. Posts : 3
    Windows 7 Ultimate 64-Bit
       #19

    Just going to be honest here about how I got the infection, detected it, and removed it.


    I am usually a very careful browser but I got sloppy and picked up the the boo/tdss.m trojan while browsing some of the more dangerous pornsites out there in search of legal but obscure content. While browsing my pc crashed and re-started in Startup Repair tool, kept looping and when I looked in details it was the ci.dll issue.

    Found this thread and did not have a way to open up HD and remove it "remotely" by opening it as a slave drive on another PC.

    I used the Avira Rescue Bootdisk to confirm I had the boo/tdss.m rootkit.

    After searching around how to repair boot records I found out about Bootrec.exe (a built in windows executable)

    After getting into the command prompt via a install disc(you can also access it after the Startup Repair tool "gives up" on trying to remove it "Advanced Tools"), I was able to run 'bootrec /fixmbr' which re-wrote the boot sector.

    That fixed the ci.dll error, allowing me to boot into windows and also apparently completely removed the trojan as I am not getting anymore detections on any scan. I am glad this worked as I have lost my win 7 upgrade disc/key and would of been without a legitimate license if I had to re-install.
    Last edited by Iamien; 26 Aug 2011 at 05:09.
      My Computer

  10.    #20

    I'd install, update and run Full Scan with Malwarebytes
    to be sure infection is gone, as bootrec commands (automated in Startup Repair) cannot clean infection.

    Then I'd uninstall my AV and install Microsoft Security Essential,
    run a full scan with it as well.
      My Computer


 
Page 2 of 3 FirstFirst 123 LastLast

  Related Discussions
Our Sites
Site Links
About Us
Windows 7 Forums is an independent web site and has not been authorized, sponsored, or otherwise approved by Microsoft Corporation. "Windows 7" and related materials are trademarks of Microsoft Corp.

© Designer Media Ltd
All times are GMT -5. The time now is 01:09.
Find Us