[InActive K] I get redirected and disk space filling quickly

[gshbassplucker]

Here is the screen print. Am working nights at present so will not be up for a few hours.

Cheers

[kevinf80]

OK, you have TDL4 re-booted infection, this has created its own partition and is controlling your system from there. Do the following:

It maybe beneficial to read through the instructions a couple of times, if you have questions or concerns just ask....

• Download Gparted Live CD ISO from Here and save where you can easily find it.
  
  
• Create a bootable CD by burning that ISO image to a CD, you can d/l and use ImageBurn for that task.
  
  
• Instructions for ImageBurn Here if required.
  
  
• Boot your system from the GParted Live CD. You should see the following:

• Press ENTER
  
  
  
  
  
  
• By default, "do not touch keymap" is highlighted. Leave this setting alone and just press ENTER.
  
  
  
  
  
  
• Choose your language and press ENTER. English is default
  
  
  
  
  
  
• Once again, at this prompt, press ENTER   You will now be taken to the main GUI screen below:
  
  
  
  
  
  
• Right click on the 8 MB Partion and select "Manage Flags"
  
  
• Remove the Ticks from Boot and Hidden (if present) as follows:
  
  
  
  
  
  
• Right click on the OS Partion, you can recognize it by its size 37.5 GB and select "Manage Flags"
  
  
• Put a tick in the Boot option as follows:
  
  
  
  
  
  
• You now need to confirm those actions as follows:

• Recheck each partion under "Flags" make sure the small rogue partiton does not have "Boot" applied, and the OS partion DOES have "Boot applied.
  
  
• If the above is correct double click on the Button.
  
  
• At the next window select "Reboot" then "OK" Boot into Normal Windows, check that all is OK.

[/list]

Try Combofix again if successful, delete any version on your Desktop and d/l fresh version from either of the following links:

Link 1
Link 2

Do not re-name, just double click on the CF icon to run....

Kevin

[gshbassplucker]

Git all the software and trying to write a CD, but for some reason the CD/DVD driver seems to have disappeared from "My Computer" and the Imageburn software is not finding a destination. Any idea how I can get that back please? I last used it about a week ago, worked fine then.

[kevinf80]

Can you navigate Start > right click "My Computer" > select > manage > device manager > do you see DVD/CD drive listed?

Next,

Please download SystemLook from one of the links below and save it to your Desktop.
Download Mirror #1
Download Mirror #2

• Double-click SystemLook.exe to run it.
  
• Copy the content of the following codebox into the main textfield:
  
  

Code: [Select]

:filefind
cdrom.sys
imapi.sys


• Click the Look button to start the scan.
  
• When finished, a notepad window will open with the results of the scan. Please post this log in your next reply.

Note: The log can also be found on your Desktop entitled SystemLook.txt

[gshbassplucker]

SystemLook 30.07.11 by jpshortstuff
Log created at 19:23 on 27/12/2011 by Dawn
Administrator - Elevation successful

========== filefind ==========

Searching for "cdrom.sys"
C:\WINDOWS\$NtServicePackUninstall$\cdrom.sys   -----c- 49536 bytes   [13:09 15/01/2009]   [12:00 28/02/2006] AF9C19B3100FE010496B1A27181FBF72
C:\WINDOWS\ServicePackFiles\i386\cdrom.sys   -----c- 62976 bytes   [12:15 15/01/2009]   [18:40 13/04/2008] 1F4260CC5B42272D71F79E570A27A4FE
C:\WINDOWS\system32\backup\cdrom.sys   --a---- 62976 bytes   [09:47 16/12/2011]   [18:40 13/04/2008] 1F983AB32F06AE022C123F7C4EE66E10
C:\WINDOWS\system32\dllcache\cdrom.sys   --a--c- 62976 bytes   [14:57 25/12/2011]   [18:40 13/04/2008] 1F4260CC5B42272D71F79E570A27A4FE
C:\WINDOWS\system32\drivers\cdrom.sys   --a---- 62976 bytes   [14:57 25/12/2011]   [18:40 13/04/2008] 1F4260CC5B42272D71F79E570A27A4FE

Searching for "imapi.sys"
C:\WINDOWS\$NtServicePackUninstall$\imapi.sys   -----c- 41856 bytes   [13:09 15/01/2009]   [12:00 28/02/2006] F8AA320C6A0409C0380E5D8A99D76EC6
C:\WINDOWS\ServicePackFiles\i386\imapi.sys   -----c- 42112 bytes   [12:16 15/01/2009]   [18:40 13/04/2008] 083A052659F5310DD8B6A6CB05EDCF8E
C:\WINDOWS\system32\backup\imapi.sys   --a---- 42112 bytes   [09:47 16/12/2011]   [18:40 13/04/2008] 083A052659F5310DD8B6A6CB05EDCF8E
C:\WINDOWS\system32\dllcache\imapi.sys   --a--c- 42112 bytes   [12:00 28/02/2006]   [18:40 13/04/2008] 083A052659F5310DD8B6A6CB05EDCF8E
C:\WINDOWS\system32\drivers\imapi.sys   --a--c- 42112 bytes   [12:00 28/02/2006]   [18:40 13/04/2008] 083A052659F5310DD8B6A6CB05EDCF8E

-= EOF =-

[kevinf80]

Files are legitimate and correct, does DVD/CD show in device manager?

[gshbassplucker]

Device shows in manager, but has an exclamation mark in a yellow circle on it. I have tried to use the troubleshoot for it, but it says that the driver may be corrupt or missing (39). Can not think of anything I have done that may have caused this, unless there was something infected in the driver  that has been zapped by the Trend product or technician (I have not done anything with Trend since joining this forum)

Guy

[kevinf80]

Go into Device Manager again, expand dvd/cd, Right click on the device. Select "update driver software" in the new window choose the option to "Search automatically for updated driver software" does that help?

[gshbassplucker]

Tried that - it searches and cannot find a better match. Tried audio CD in the drive - it starts to read the CD by no media system comes up. I am very puzzled.

Thanks very much for all the help so far.

Guy

[kevinf80]

You could try going back to Device Manager expand DVD/CD to device, right click and select "Uninstall" then re-boot. Windows should see the hardware and attribute a driver.

If that does not work we can run GParted from a USB pen drive.....

Do you have USB pen drive? if so we can load GParted to that, set bios to boot from USB pen drive and run GParted that way.

Go here http://gparted.sourceforge.net/liveusb.php and use method D

[gshbassplucker]

Tried to get CD/VD working without success. Have got a USB pen drive now. Just waiting for image to load.

[kevinf80]

OK, when you boot from the USB the instructions will still be the same as reply #16

[kevinf80]

Are you still with us....

[kevinf80]

Due to the lack of feedback this topic is closed. If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.

Other members who need assistance please start your own topic in a new thread. Thanks!