Author Topic: [InActive K] I get redirected and disk space filling quickly  (Read 2974 times)

0 Members and 1 Guest are viewing this topic.

Offline gshbassplucker

  • Bronze Member
  • Posts: 17
Re: [InActive K] I get redirected and disk space filling quickly
« Reply #15 on: December 27, 2011, 01:56:35 am »
Here is the screen print. Am working nights at present so will not be up for a few hours.

Cheers

Offline kevinf80

  • Malware Removal Staff
  • Diamond Member
  • Posts: 7351
Re: [InActive K] I get redirected and disk space filling quickly
« Reply #16 on: December 27, 2011, 02:48:14 am »
OK, you have TDL4 re-booted infection, this has created its own partition and is controlling your system from there. Do the following:

It maybe beneficial to read through the instructions a couple of times, if you have questions or concerns just ask....

  • Download Gparted Live CD ISO from Here and save where you can easily find it.

  • Create a bootable CD by burning that ISO image to a CD, you can d/l and use ImageBurn for that task.

  • Instructions for ImageBurn Here if required.

  • Boot your system from the GParted Live CD. You should see the following:



  • Press ENTER





  • By default, "do not touch keymap" is highlighted. Leave this setting alone and just press ENTER.





  • Choose your language and press ENTER. English is default





  • Once again, at this prompt, press ENTER   You will now be taken to the main GUI screen below:





  • Right click on the 8 MB Partion and select "Manage Flags"

  • Remove the Ticks from Boot and Hidden (if present) as follows:





  • Right click on the OS Partion, you can recognize it by its size 37.5 GB and select "Manage Flags"

  • Put a tick in the Boot option as follows:





  • You now need to confirm those actions as follows:



  • Recheck each partion under "Flags" make sure the small rogue partiton does not have "Boot" applied, and the OS partion DOES have "Boot applied.

  • If the above is correct double click on the Button.

  • At the next window select "Reboot" then "OK" Boot into Normal Windows, check that all is OK.

[/list]

Try Combofix again if successful, delete any version on your Desktop and d/l fresh version from either of the following links:

Link 1
Link 2

Do not re-name, just double click on the CF icon to run....

Kevin

Offline gshbassplucker

  • Bronze Member
  • Posts: 17
Re: [InActive K] I get redirected and disk space filling quickly
« Reply #17 on: December 27, 2011, 08:13:50 am »
Git all the software and trying to write a CD, but for some reason the CD/DVD driver seems to have disappeared from "My Computer" and the Imageburn software is not finding a destination. Any idea how I can get that back please? I last used it about a week ago, worked fine then.

Offline kevinf80

  • Malware Removal Staff
  • Diamond Member
  • Posts: 7351
Re: [InActive K] I get redirected and disk space filling quickly
« Reply #18 on: December 27, 2011, 12:32:46 pm »
Can you navigate Start > right click "My Computer" > select > manage > device manager > do you see DVD/CD drive listed?

Next,

Please download SystemLook from one of the links below and save it to your Desktop.
Download Mirror #1
Download Mirror #2

  • Double-click SystemLook.exe to run it.
  • Copy the content of the following codebox into the main textfield:

Code: [Select]
:filefind
cdrom.sys
imapi.sys
  • Click the Look button to start the scan.
  • When finished, a notepad window will open with the results of the scan. Please post this log in your next reply.
Note: The log can also be found on your Desktop entitled SystemLook.txt

Offline gshbassplucker

  • Bronze Member
  • Posts: 17
Re: [InActive K] I get redirected and disk space filling quickly
« Reply #19 on: December 27, 2011, 01:25:00 pm »
SystemLook 30.07.11 by jpshortstuff
Log created at 19:23 on 27/12/2011 by Dawn
Administrator - Elevation successful

========== filefind ==========

Searching for "cdrom.sys"
C:\WINDOWS\$NtServicePackUninstall$\cdrom.sys   -----c- 49536 bytes   [13:09 15/01/2009]   [12:00 28/02/2006] AF9C19B3100FE010496B1A27181FBF72
C:\WINDOWS\ServicePackFiles\i386\cdrom.sys   -----c- 62976 bytes   [12:15 15/01/2009]   [18:40 13/04/2008] 1F4260CC5B42272D71F79E570A27A4FE
C:\WINDOWS\system32\backup\cdrom.sys   --a---- 62976 bytes   [09:47 16/12/2011]   [18:40 13/04/2008] 1F983AB32F06AE022C123F7C4EE66E10
C:\WINDOWS\system32\dllcache\cdrom.sys   --a--c- 62976 bytes   [14:57 25/12/2011]   [18:40 13/04/2008] 1F4260CC5B42272D71F79E570A27A4FE
C:\WINDOWS\system32\drivers\cdrom.sys   --a---- 62976 bytes   [14:57 25/12/2011]   [18:40 13/04/2008] 1F4260CC5B42272D71F79E570A27A4FE

Searching for "imapi.sys"
C:\WINDOWS\$NtServicePackUninstall$\imapi.sys   -----c- 41856 bytes   [13:09 15/01/2009]   [12:00 28/02/2006] F8AA320C6A0409C0380E5D8A99D76EC6
C:\WINDOWS\ServicePackFiles\i386\imapi.sys   -----c- 42112 bytes   [12:16 15/01/2009]   [18:40 13/04/2008] 083A052659F5310DD8B6A6CB05EDCF8E
C:\WINDOWS\system32\backup\imapi.sys   --a---- 42112 bytes   [09:47 16/12/2011]   [18:40 13/04/2008] 083A052659F5310DD8B6A6CB05EDCF8E
C:\WINDOWS\system32\dllcache\imapi.sys   --a--c- 42112 bytes   [12:00 28/02/2006]   [18:40 13/04/2008] 083A052659F5310DD8B6A6CB05EDCF8E
C:\WINDOWS\system32\drivers\imapi.sys   --a--c- 42112 bytes   [12:00 28/02/2006]   [18:40 13/04/2008] 083A052659F5310DD8B6A6CB05EDCF8E

-= EOF =-

Offline kevinf80

  • Malware Removal Staff
  • Diamond Member
  • Posts: 7351
Re: [InActive K] I get redirected and disk space filling quickly
« Reply #20 on: December 27, 2011, 01:38:05 pm »
Files are legitimate and correct, does DVD/CD show in device manager?

Offline gshbassplucker

  • Bronze Member
  • Posts: 17
Re: [InActive K] I get redirected and disk space filling quickly
« Reply #21 on: December 27, 2011, 01:50:18 pm »
Device shows in manager, but has an exclamation mark in a yellow circle on it. I have tried to use the troubleshoot for it, but it says that the driver may be corrupt or missing (39). Can not think of anything I have done that may have caused this, unless there was something infected in the driver  that has been zapped by the Trend product or technician (I have not done anything with Trend since joining this forum)

Guy

Offline kevinf80

  • Malware Removal Staff
  • Diamond Member
  • Posts: 7351
Re: [InActive K] I get redirected and disk space filling quickly
« Reply #22 on: December 27, 2011, 02:38:29 pm »
Go into Device Manager again, expand dvd/cd, Right click on the device. Select "update driver software" in the new window choose the option to "Search automatically for updated driver software" does that help?

Offline gshbassplucker

  • Bronze Member
  • Posts: 17
Re: [InActive K] I get redirected and disk space filling quickly
« Reply #23 on: December 27, 2011, 02:46:22 pm »
Tried that - it searches and cannot find a better match. Tried audio CD in the drive - it starts to read the CD by no media system comes up. I am very puzzled.

Thanks very much for all the help so far.

Guy

Offline kevinf80

  • Malware Removal Staff
  • Diamond Member
  • Posts: 7351
Re: [InActive K] I get redirected and disk space filling quickly
« Reply #24 on: December 27, 2011, 03:29:33 pm »
You could try going back to Device Manager expand DVD/CD to device, right click and select "Uninstall" then re-boot. Windows should see the hardware and attribute a driver.

If that does not work we can run GParted from a USB pen drive.....

Do you have USB pen drive? if so we can load GParted to that, set bios to boot from USB pen drive and run GParted that way.

Go here http://gparted.sourceforge.net/liveusb.php and use method D

Offline gshbassplucker

  • Bronze Member
  • Posts: 17
Re: [InActive K] I get redirected and disk space filling quickly
« Reply #25 on: December 29, 2011, 02:20:23 pm »
Tried to get CD/VD working without success. Have got a USB pen drive now. Just waiting for image to load.

Offline kevinf80

  • Malware Removal Staff
  • Diamond Member
  • Posts: 7351
Re: [InActive K] I get redirected and disk space filling quickly
« Reply #26 on: December 29, 2011, 02:25:50 pm »
OK, when you boot from the USB the instructions will still be the same as reply #16

Offline kevinf80

  • Malware Removal Staff
  • Diamond Member
  • Posts: 7351
Re: [InActive K] I get redirected and disk space filling quickly
« Reply #27 on: January 01, 2012, 03:05:27 pm »
Are you still with us....

Offline kevinf80

  • Malware Removal Staff
  • Diamond Member
  • Posts: 7351
Re: [InActive K] I get redirected and disk space filling quickly
« Reply #28 on: January 02, 2012, 06:37:34 pm »
Due to the lack of feedback this topic is closed. If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.

Other members who need assistance please start your own topic in a new thread. Thanks!