Solved Help QUICK with HDD swaping blunder (LONGWINDED)

[rubyrubyroo]

eurika!!!!!!!!

CI.DLL is only in the “Approved mode of operation” when Windows is booted normally, meaning​

Debug mode has not been enabled and Driver Signing enforcement has not been disabled.

from the link i posted, driversigning disabled mode worked!!!!!!!!!!!!!!!!!

but thaT just gets me in the front door (windows 7) And quite a glorious front dor it is

soap for sore eyes​

 

[karlsnooks]

Ruby,
Go to a command prompt using your win 7 dvd.

Run SFC /SCANNOW.

I'm including the link to the tutorial about sfc.

Here is how to go to a command prompt using your DVD

GO TO A COMMAND PROMPT USING YOUR WIN 7 DVD

■Boot up from a Windows 7 DVD.
■At the first dialog window, press SHIFT + F10
■You will have a X:> command prompt
X: is a ram drive created by Windows 7.
===========================================
===========================================



SFC /SCANNOW Command - System File Checker
How to Repair Windows 7 System Files with System File Checker

 

[rubyrubyroo]

although i did not have the command written even close to correctly in my post, if you remember a few posts back i did say i did run one ( from command prompt , just the one thats on the HDD not the DVD, do you really think that will make a difference?, it did check out just fine every time i tryed it and I tryed it on both "file size" versions - remember when i said startup repair changes the size of a ci.dll obtained elsewhere and copyed over the "corrupt one"

I'll try the dvd if you want me to...

 

[rubyrubyroo]

first i verifyed it from a WINDOWS 7!!! command prompt w/admin privs, all system files checked fine, and its scannow-ing from the win7 dvd cmdprmpt right now, to satisfy everyone

 

[karlsnooks]

if by disabling driver signed mode worked for you then:

1. must be done each and everytime until the "unsigned" driver is removed.
2. now what did you do whereby you installed a driver which was unsigned?

 

[rubyrubyroo]

win7 wont allow it, without disabling the feature, so i couldnt have installed an unsigned driver.

plus i applied the driver disable mode merely so ci.dll would not be accessed, it does not mean that the CAUSE is an unsigned driver, just a screwed-up function call at boot time maybe, and as i previously mentioned in safe mode it loads 5 drivers the last one listed is CLFS.sys, before quickly stopping and starting loading the startup repair mode

I could have just as easily used kernal debugging mode to bypass the use of the code integrety dynamic link library file: ci.dll according to the quoted statemnet i located in the technical specs in that link, remember?

 

[rubyrubyroo]

and windows resource protection did not find any integrety violations from the dvd prompt environment eather

 

[karlsnooks]

Ruby,
When you are in Win 7, then:

WIN | type SIGVERIF | ENTER

ADVANCED button | Save the... checked | Overwrite ... radio button |
SIGVERIF.TXT in the file name box | OK button

Back at the first dialog, START button | OK button |
ADVANCED button | VIEW LOG button |
under the STATUS column, you are looking for anything that does NOT show Signed.


Oh yes, WIN is the key with the wavy microsoft flag on top.

 

[rubyrubyroo]

most crypto-security is outside of my area of knowlegde, past the public/privat key concepts and ive implemented web based encription teqniques, but the rest would be for you, or someone else cause I dont have the time to research it now i got so backed up at my shop with broken computers working on this one!

 

[rubyrubyroo]

results: 124 signed 0 unsigned (and verified visually down the column as you suggested)

Oh the wavy key I'm starting to rember things like that now!

 

[rubyrubyroo]

heres a basic thought, which might get me lucky... maybe shutting down windows correctly, without event, and restarting he comp/boot normal, it may fix itself in some unknown manner

also waty about the event log.....it's last entrys from pre breakdown day

 

[karlsnooks]

ruby,
Another possibility is maiware.

The best detector/remover of malware is the Microsoft Standalone System Sweeper.

Run a full scan over the entire computer system:

PUT SYSTEM SWEEPER ON A USB STICK
System Sweeper, https://connect.microsoft.com/systemsweeper, allows you to start an infected PC and perform an offline scan to identify and remove viruses, rootkits and other advanced malware. System Sweeper is a free standalone, bootable malware and virus remover from Microsoft.

Safety Scanner, http://www.microsoft.com/security/scanner/en-us/default.aspx, is free, downloadable, provides on-demand scanning and helps remove viruses, spyware, and other malicious software. It works with your existing antivirus software.

If the target computer has a working internet connection, then you may prefer to use the Safety Scanner.

NOTE: A fine tutorial on the System Sweeper is:
How to use the Microsoft Standalone System Sweeper


Download System Sweeper (about 576 kB):
https://connect.microsoft.com/systemsweeper

Insert 256 MB or larger USB stick into a usb port.
Run the downloaded program--mssstool64.exe or mssstool32.exe
Choose the option to install to USB.
Caution: The install program will format the usb stick.

The install program will download about 200 mB more.
After the install is finished, leave the stick in the usb slot.

Run the program you downloaded once again.
This 2nd run, and any subsequent runs, will download the very latest anti-virus definitions (about 60 mB).

To keep System Sweeper up-to-date, simply reinsert the usb stick and run the installation program, mssstool64.exe or mssstool32.exe, again.

The initial, full scan by System Sweeper can easily take several hours, but subsequent quick scans will be shorter.
Remember, your computer is being very thoroughly checked for all types of malware.

The results of System Sweeper will be in:
\Windows\Standalone System Sweeper\Support as one or more files with a LOG extension which can be viewed with Notepad.

 

[rubyrubyroo]

see what you can gather from the events surrounding the gap of the last 5-7 days?

http://indimingo.com/event-log-w-gap.evtx

I agree w/ the malware thing youll see an odd AVG ref in the event log i uploaded

 

[karlsnooks]

I'll await the results of the scan by Microsoft Standalone System Sweeper. Be sure to attach the resulting logs to your next post.

 

[rubyrubyroo]

im sorry but its almost 7am here, which is rathr meaningless when you've been up for 4-5 days sleeping for mini 1hour or so periods here and there.....I am to tired, and happy to have made headway SOO MUCH HEADWAY tonight (or this morning rather) Im going to catch some sleep and maybe eat a meal and then i'll be back tommorrow refreshed and ready!!!

Thank you sooo much for your help and sticking thru the fusteration and whatnot, Im new to the forum and forums in general so i dont know how to thank you with creds or points or whatever, but tell me how tommorrow (or a tutorial as usual) and I'll do whatever i can to thank you, although i know that's not why you did it but still...

thanks
mike

 

[rubyrubyroo]

tommorrow i will post, cause i ned to find a clear usb drive or else copy the address manually to he other computer in the othr room, etc...

ok

 

[Corazon]

Get some rest, soldier. Still hoping you'll get it sorted out - I know you're in good hands in this forum!

 

[seavixen32]

im sorry but its almost 7am here, which is rathr meaningless when you've been up for 4-5 days sleeping for mini 1hour or so periods here and there.....I am to tired, and happy to have made headway SOO MUCH HEADWAY tonight (or this morning rather) Im going to catch some sleep and maybe eat a meal and then i'll be back tommorrow refreshed and ready!!!

Thank you sooo much for your help and sticking thru the fusteration and whatnot, Im new to the forum and forums in general so i dont know how to thank you with creds or points or whatever, but tell me how tommorrow (or a tutorial as usual) and I'll do whatever i can to thank you, although i know that's not why you did it but still...

thanks
mike

If you want to add to a helper's reputation, just hit the scales at the top-right of the comment box.

 

[gregrocker]

We sometimes solve performance problems by having user uninstall AVG, which is now considered bloatware and recommended by no one here. I'd swap it out for MSE or Avast 6 to see the difference.

What I would also do if problems persist is offload your files, plug in only the one target HD and follow these steps to get a perfect reinstall based on hundreds done here: Reinstalling Windows 7.

 

[rubyrubyroo]

Thanks, but I awoke happy and refreshed and yes for the first time had a AVG miss (or rather set of misses!) It's downloader.generic12.NGJ (according to avg nomeclature. While never myself opening a web related utility, each differntly random named file is in a temp dir and detected by the resident sheild, although it for the first time in my 5 years with avg DID NOT stop the infections. Im guessing if they can bypass avg's protection, i think they would also be keyed into their specific removal encryption methods, so I did not touch the window. I fear shutting down win as it or restart could trigger an action, which i am unsure of the specifics of anyway. I am assuming this is related to the ci.dll quasi-infection and from what Ive read boot sector rootkit that "recorrupts" the fixed file at boot time. I cannot find a damn flash USB drive and I have dosens, besides the one I used to back up the system the other day (probibly infected too) and then I in hind site, stupidly coppyed the usb files to my laptop for a more reliable second backup as the files are about as important as a file can be (maybe not CIA level clearence!) What would be your best thoughts on a kill (I hate to be runnig the drive, but I am petrified to move it to another computer because of the past week, (see above....all of it!!!!!ha) I know from a tech point It needs to be worked on from outside the drive, and what should I use (a previously mentioned antimalapp or maybe antimalwarebytes. and any insight into what im dealing with exactly (avoid terms that arn't really helful like thats a nasty bug, rather tell me somethig you might know, or believe like any actions, purpose (open back door, piss me off, key log, etc). Its a lot to ask but I am needy this week!

holy milkman!

and on a side note - i did figure out the credits thing before but just in general, just wondered the edicate, like can i give one to each post a person places on the thread to help them for mucho help, or it that like abuse of the system?

okay I hate to leave it running but I hate to touch it until I hear a reasonable responce theory



sincerely broken heat,
mike




and yea I know its a major preformance hog (AVG) It has saved my clients SOOOOOOOO many times, and every test I think Ive ever read AVG scores near best at killing the most baddies (esp keyloggers Ive heard which it often is the only one to find any of the placed ones on the test system