Windows 7 Forums
Welcome to Windows 7 Forums. Our forum is dedicated to helping you find support and solutions for any problems regarding your Windows 7 PC be it Dell, HP, Acer, Asus or a custom build. We also provide an extensive Windows 7 tutorial section that covers a wide range of tips and tricks.

Windows 7: C:\CI.dll Corrupt file crash - help!

11 Aug 2011   #11

win7 64

Please note. I did have a System Repair disk. It could not start the computer with this rootkit virus - you just get a corrupt ci.dll report for the DVD Rom Drive.
Similarly the computer will not start in SAFE mode, either, so that option is not available.
And looking at the Standalone Sweeper info, you have to create it Before the computer goes wrong!
Not much use after, and as the only Windows 7 machine I have is the one that had gone wrong, I couldn't create one to recover it!
I will check it out now, though.

My System SpecsSystem Spec
11 Aug 2011   #12


You can create MS Standalone Sweeper CD or flash stick on another computer.
My System SpecsSystem Spec
11 Aug 2011   #13

win7 64

I have just read this on the MS Sweeper download site:

""Ordinarily, the bootable media is created on a computer that is not infected. The architecture of Microsoft Standalone System Sweeper Beta does not have to be the same as the Windows operating system of the computer used to create the bootable media. It does need to be the same architecture (32-bit or the 64-bit) as the Windows operating system of the computer infected with a virus or malware.""

So you can create a 64 bit disk on a 32 bit machine. I can't see that a USB stick or external drive is a good format option for this situation.

I have now created a 64 bit Sweeper disk on the laptop that was infected, just in case it (or something else) should happen again.
BUT! as SAFE mode, DOS, Backup Disks and Image File Disks wouldn't work with this infection, and no external drive or USB port worked, and a normal System Repair Boot Disk would not work, will the Sweeper work?
If the Sweeper disk boots using the ci.dll file, it will fail as it cannot open the kernel files.
If it does work, I wish I had known before.
Perhaps somebody who tries Sweeper for this problem can add their findings to this thread.
My System SpecsSystem Spec

11 Aug 2011   #14


You are not booting the CD's correctly so it is trying to start the HD yielding the .dll error which should not occur while booting a disk.

You'll need to correctly boot the Standalone Sweeper disk to clear the HD of infection and then run Startup Repair and possibly SFC manually from the Win7 Repair disk.

Set the BIOS boot order so that the CD drive is first to boot: How to Boot your Computer from a Bootable CD or DVD - Boot to CD

Or use the one-time BIOS Boot Menu key to trigger CD drive to boot: BIOS Boot menu keys (Imported)

Look for the prompt to "Press any key to boot CD drive."
My System SpecsSystem Spec
11 Aug 2011   #15

win7 64

Thanks for that, but I did not have the Sweeper disk at the time as I had not seen it mentioned in any of these threads, and I did load with the Boot Disk several times and each time it went through a Startup Repair Sequence at the end of which it said there was a problem with D:/ci.dll. Before this it said the ci.dll problem was on the C drive.
Basically, no matter what I did it would not boot!
I am sure this virus affects the BIOS as antivirus software told me it had definitely changed the headers of each of the drives and I could not navigate to any drive except "X:\"
The ci.dll report is a symptom of the problem, not the cause.
The computer is now back to normal.
I think we had better see what happens when someone uses Sweeper to try to solve this problem before making any more posts.
My System SpecsSystem Spec
11 Aug 2011   #16


Good work. Moving HD to uninfected computer may be necessary with this infection.

I wish this was posted in Security for their expert opinion and attention.
My System SpecsSystem Spec
11 Aug 2011   #17

win7 64

There are some really evil Trojans going around at the moment. I had another rootkit one on an XP machine.
I couldn't ID it, it just came up as "drive has a rootkit corruption" when i virus scanned it. In both cases the Trojan came in a compressed rar file. So beware!
I managed to kill the XP one with the disk in a caddy by running a virus killer on it from another PC Then I ran Fixboot from the OS. It booted up ok afterwards but it was virtually unusable! There were so many things the Trojan had done, like removing the "display hidden files" and "show filename extensions" options plus lots more, including stopping Internet access, corrupting all virus and spyware killers and blocking them from being updated or deleted. Whoever had created it had thought of every possible wrinkle to stop you removing it! Nasty!
I managed to fix it by editing the Registry by following tips from clever, kind people like the ones on this Forum!
My System SpecsSystem Spec
11 Aug 2011   #18


I've found that more than half the time SFC cannot repair damage from these infections even if they're "cleaned up" but it requires wiping the HD to clean reinstall.
My System SpecsSystem Spec
26 Aug 2011   #19

Windows 7 Ultimate 64-Bit

Just going to be honest here about how I got the infection, detected it, and removed it.

I am usually a very careful browser but I got sloppy and picked up the the boo/tdss.m trojan while browsing some of the more dangerous pornsites out there in search of legal but obscure content. While browsing my pc crashed and re-started in Startup Repair tool, kept looping and when I looked in details it was the ci.dll issue.

Found this thread and did not have a way to open up HD and remove it "remotely" by opening it as a slave drive on another PC.

I used the Avira Rescue Bootdisk to confirm I had the boo/tdss.m rootkit.

After searching around how to repair boot records I found out about Bootrec.exe (a built in windows executable)

After getting into the command prompt via a install disc(you can also access it after the Startup Repair tool "gives up" on trying to remove it "Advanced Tools"), I was able to run 'bootrec /fixmbr' which re-wrote the boot sector.

That fixed the ci.dll error, allowing me to boot into windows and also apparently completely removed the trojan as I am not getting anymore detections on any scan. I am glad this worked as I have lost my win 7 upgrade disc/key and would of been without a legitimate license if I had to re-install.
My System SpecsSystem Spec
26 Aug 2011   #20


I'd install, update and run Full Scan with Malwarebytes
to be sure infection is gone, as bootrec commands (automated in Startup Repair) cannot clean infection.

Then I'd uninstall my AV and install Microsoft Security Essential,
run a full scan with it as well.
My System SpecsSystem Spec

 C:\CI.dll Corrupt file crash - help!

Thread Tools

Similar help and support threads
Thread Forum
Had a hard crash and no have corrupt system files.
Windows 7 Ultimate x64. I had a totally random crash and a handful of system files became corrupt. Mostly .dll's and a few .exe files. I dont know what they all are, I am only aware of them when I try to complete an operation and an error box pops up. All of the directories seem to point back...
General Discussion
BSOD crash 0x80070057 corrupt aswrvrt.sys after Win update, won't boot
Windows 7 BSOD crash 0x80070057 corrupt aswrvrt.sys after Win update. System won't restore, repair or boot. Hi UK user, Dell XPS15 (core i7, 8GB), 500GB NTFS HDD, Win7 (64) Home Premium. Avast AV (free). Problem arose when Win7 updated last week - caused Avast (and Dell...
BSOD Help and Support
Which file is corrupt?
Getting BSOD and am unable to boot into Safe Mode. I ran Startup Repair from Win 7 on USB and this is what it says: Root cause found: Bugcheck c000021a. Parameters = 0xfffff8a00013f650, 0x0, 0xffffffffc0000001, 0x10a68. Boot critical file is corrupt. How can I tell which file is corrupt...
BSOD Help and Support
Windows 7 Fresh Install(s) - Corrupt/Crash/BSoD(?) - Repeated
Hi all, been browsing this forum for a couple days to try and fix my problem based off other posts but I am at a loss. I ordered my PC online from iBuyPower (March 2011) and it came pre-loaded with Windows 7 Home Premium 64bit. My PC ran error-free for 2 months until about 3 days ago, it...
BSOD Help and Support
Corrupt CBS file
SFC /Scannow reports it cannot fix the CBS file. Should I be worried? If so, how can I correct the problem. I did a System Restore to no avail. Attached is a copy of the CBS.log file in hopes it will shed some light on the problem. Thank you.
General Discussion
Crash after Updates this morning - DVD8 corrupt
Hello everyone, My fiance's Sony laptop did a automatic update this morning and since then has not been able to boot. On the first restart it just sat there on the login page thinking. I am unable to boot into Safe Mode, or any mode for that matter. When I try to I receive a message to run...
BSOD Help and Support

Our Sites

Site Links

About Us

Find Us

Windows 7 Forums is an independent web site and has not been authorized, sponsored, or otherwise approved by Microsoft Corporation. "Windows 7" and related materials are trademarks of Microsoft Corp.

Designer Media Ltd

All times are GMT -5. The time now is 03:31.
Twitter Facebook Google+ Seven Forums iOS App Seven Forums Android App