windows failed to start with "ynhif is compressed" error

T

takoateli

New member
A friend who has an Aspire One with Win7 Starter asked me to help, his computer wouldn't boot. It would go through the bios part of the boot and then very quickly it would show an error saying "ynhif is compressed" and stop there. The error would come up so fast it was as if Windows wasn't even trying to boot. There was none of the normal Windows startup screens. There was nothing I could do to boot the machine. I couldn't get to the list of boot options. This problem was happening way before one could get that list in the startup process.

I booted off an AVG antivirus rescue disk cd and checked the system. There were no viruses. That disk allowed me to use a simple file browser and editor. I could see a file named ynhif with no file extension and a file size of around 233kb. It was modified at the same time that win7.ld was modified.

I googled heavily but couldn't find anything about a file named vnhif. I didn't know what to do so on a hunch I just renamed the file to ynhif.old and the system booted right up.

Does anyone have any idea what ynhif might be from and how it got there? I looked into it with a text editor and looked like it was some kind of boot file, with references to linuxey stuff and thing about booting.

I thought I'd post this here as it might help someone else and also to see if anyone had any ideas.

Thanks!
Greg
 

My Computer

OS
NY
takoateli said:
A friend who has an Aspire One with Win7 Starter asked me to help, his computer wouldn't boot. It would go through the bios part of the boot and then very quickly it would show an error saying "ynhif is compressed" and stop there. The error would come up so fast it was as if Windows wasn't even trying to boot. There was none of the normal Windows startup screens. There was nothing I could do to boot the machine. I couldn't get to the list of boot options. This problem was happening way before one could get that list in the startup process.

I booted off an AVG antivirus rescue disk cd and checked the system. There were no viruses. That disk allowed me to use a simple file browser and editor. I could see a file named ynhif with no file extension and a file size of around 233kb. It was modified at the same time that win7.ld was modified.

I googled heavily but couldn't find anything about a file named vnhif. I didn't know what to do so on a hunch I just renamed the file to ynhif.old and the system booted right up.

Does anyone have any idea what ynhif might be from and how it got there? I looked into it with a text editor and looked like it was some kind of boot file, with references to linuxey stuff and thing about booting.

I thought I'd post this here as it might help someone else and also to see if anyone had any ideas.

Thanks!
Greg
Click to expand...


Greg I am highly suspicious of it. I too googled it with no information, the fact that it had no extension (or was it hidden) more so.

The fact that AVG didnt find anything isnt un-usual. I would download malwarebytes and run it against the file before you delete it.
 

My Computer

Computer Manufacturer/Model Number
HP Pavillion dv-7 1005 Tx
OS
Win 8 Release candidate 8400
CPU
[email protected]
Memory
4 gigs
Graphics Card(s)
Nvidia 9600M
Sound Card
HD built-in
Monitor(s) Displays
17" Wxga
Screen Resolution
1440x900
Cooling
none
Internet Speed
45Mb down 5Mb up
ZigZag,

Thanks! I didn't delete the file. I'm going to move a copy of it over to my Mac and send it to the antivirus folks that have a place on the web to submit suspicious files for analysis.

I think installing MalwareBytes is a good idea too! I'm going to do that now. I'll post back what it turns up.

Greg
 

My Computer

OS
NY
takoateli said:
ZigZag,

Thanks! I didn't delete the file. I'm going to move a copy of it over to my Mac and send it to the antivirus folks that have a place on the web to submit suspicious files for analysis.

I think installing MalwareBytes is a good idea too! I'm going to do that now. I'll post back what it turns up.

Greg
Click to expand...


Good luck
 

My Computer

Computer Manufacturer/Model Number
HP Pavillion dv-7 1005 Tx
OS
Win 8 Release candidate 8400
CPU
[email protected]
Memory
4 gigs
Graphics Card(s)
Nvidia 9600M
Sound Card
HD built-in
Monitor(s) Displays
17" Wxga
Screen Resolution
1440x900
Cooling
none
Internet Speed
45Mb down 5Mb up
ZigZag,

Sophos came back with results first. They say the file is clean. I'll see what the others say. I also submitted to Avira, Symantec and another one.

Greg
 

My Computer

OS
NY
takoateli said:
ZigZag,

Sophos came back with results first. They say the file is clean. I'll see what the others say. I also submitted to Avira, Symantec and another one.

Greg
Click to expand...


Good. Better safe than sorry with unknown files.
 

My Computer

Computer Manufacturer/Model Number
HP Pavillion dv-7 1005 Tx
OS
Win 8 Release candidate 8400
CPU
[email protected]
Memory
4 gigs
Graphics Card(s)
Nvidia 9600M
Sound Card
HD built-in
Monitor(s) Displays
17" Wxga
Screen Resolution
1440x900
Cooling
none
Internet Speed
45Mb down 5Mb up
After you renamed the file and got the pc to boot, did your friend's system create a new ynhif file?
 

My Computer

Computer Manufacturer/Model Number
me / #1
OS
windows 7 x64 Home Premium
CPU
intel q6600
Motherboard
gigbyte ga ep45 ud3l
Memory
g.skill 8gb ddr2 1066 (pc2 8500)
Graphics Card(s)
evga geforce 9800 gtx 512 mb
Screen Resolution
1680 x 1050
Hard Drives
wd caviar black 500 gb
wd caviar black 1tb
wd elements 1tb external hd x2
PSU
raidmax 500w
Case
smilodon (yes, t'was the pretty blue lites that got me!)
It's highly likely you've caught some form of pre-boot rootkit that uses a random name for its payload. Googling or looking for another "ynhif" won't help because other installations of the same malware will be named with a different set of five random characters. If you want to check if the computer has been reinfected, use a boot disk to look for the re-appearance of any other files with random names.

Brand-name antivirus software virtually useless against this kind of threat and all 'clean' reports you get should be considered false negatives.

Rootkit malware is extremely difficult to eradicate. Your best option is to copy all data off the system, wipe the hard drive (diskpart clean) and reinstall from a recovery disk or retail DVD.

Make sure your friend gets into the habit of updating all his Internet-facing software (browser, flash, acrobat reader) to reduce the risk of being infected again. Running AV software alone is an inadequate defense.
 

My Computer

OS
Win7Ultimate x64 + x32, Win7Pro x64, XP x32, Win 2003, Ubuntu and OpenIndiana
You must log in or register to reply here.
Back
Top