SOLVED Computer won't restart: "Root cause found: Boot critical file D:\CI.dll is corrupt."

[GW7777]

I was using the computer when all of a sudden it shut down. When I turn it back it on, it automatically tries to do a Startup Repair. After several minutes, I get the message: "Startup Repair cannot this repair this computer automatically." When I click on "View problem details," everything looks fine except for "Root cause found: Boot critical file D:\CI.dll is corrupt." This happens every time I try to retart the computer. I've tried System Restore and System Image Recovery to no avail.

Thanks in advance for your help.

 

[Ian]

Can you try using the following tutorial to see if you can use SFC to replace the corrupt dll file?

This tutorial should explain how it works:

http://www.winhelponline.com/blog/run-sfc-offline-windows-7-vista/

 

[GW7777]

Ian,

Turns out the computer had a rootkit virus, and Kaspersky TDSSKiller removed it. Thanks anyway.

 

[dizzle1119]

I'm having the same problem, so could you please tell me how you fixed it? I'm begging you. I've done everything I know how to do.

startup repair does nothing.
system restore does nothing. Actually, system restore will run successfully, but it ultimately doesn't change a thing.

I can't get past startup repair, so how on earth am I going to fix this?

 

[davehc]

As GW7777 found. Do a full scan with your anti virus program and accept any "fixes".
P.S. Some free anti virus programs do not scan for root virus's

 

[TrainableMan]

You might also try RKill and the freeware version of Malwarebytes. Both are listed in our Freeware DB.

 

[dan.smart]

You might also try RKill and the freeware version of Malwarebytes. Both are listed in our Freeware DB.

PMJI

How do you run a rootkit cleaner when the computer won't boot?

-=Dan=-

 

[TrainableMan]

If your machine won't boot from the HD (and I assume you've already ruled out hardware failure) then you set your BIOS to boot from CD and you start-up with the system disk.

 

[olivetty]

Hi,

First of, thank you for taking the time to even read this!

Secound, I saw you had the same problem like me, with the corrupt boot.

So, the Q is: How did you run the TDSSKiller when you can't boot the computer?? Appreciate the help mate!


Sincerly,

Oliver from Sweden!

EDIT: Saw you said to use the start up disk, but how do you run the application??

 

[TrainableMan]

Hopefully the System Repair feature can fix you to a point where you can boot. If not then a complete reinstall or recovery from your back-ups may be necessary. Unfortunately viruses/malware do not play nice, that is why we strongly recommend a regular back-up schedule to an external drive or online storage facility.

 

[olivetty]

Thank you for the answer.

First off, System Repair is not working at all at this moment, just loops.

I know I should've done a backup, but then again, maybe I'll back up the virus as well?

Either way, I am using the Kaspersky Revocery Disc and It found the rootvirus within a few secounds of starting the search. it was the Win/32 TDSS aswell. I'm letting the scan finish right now, though only 1 % after 6 minutes. I have 2 TB to search through though.

It just found another one were the level of danger is high, HEUR: Trojan Win32.Generic, though I think that I've had it before, and it was easy to remove.

Thank you for all the help, and If you have any other pointers (what antivirus to use (obviously Kaspersky if this fixes it ) or something else).

Sincerly,

Oliver

 

[TrainableMan]

Correct, once you have a virus you don't really want to back that up.

I'm glad your Kaspersky was bootable (most AV discs are).

For anyone else reading this ... it should also be possible to create your own bootable disc (if already infected use another machine that is clean) and fill it with AV and recovery scanning tools etc. I haven't done this since upgrading to W7 but I'm sure it's still possible.

 

[olivetty]

That is correct. I remember reading this somewhere.

Isn't it the PE Builder or something? Or maybe Reconstructor? I dunno.

All I have right now is using Linux to boot inte Ubuntu 11 and run TDSSKiller or Hitman Pro to remove the rootkit. Even if I will be able to boot into windows after AV Disc I'll probably run these aswell, starting with the Hitman Pro software.

I'm really crossing my fingers for the Kaspersky Disc though, I can see the light in the tunnel!

 

[TrainableMan]

I have EBCD but I've never had to use it. It's Linux-based so I don't know how I could run apps with it except those supplied though.

 

[olivetty]

Wow, that is a great Boot CD!

Kaspersky is linux based aswell, guess I better start learning Ubuntu, and uninstall windows. I never want to go through this nightmare again!

So far, I am at 83% and it's 35 minutes remaining, it has found 356 viruses (6 with High Risk) so far, so this scan (or crash for that matter) was just a matter of time.

 

[olivetty]

Yes, after 4 hours and 50 minutes of scanning the computer is repaired. It didn't delete TDSS though, only desinfected it. I ran TDSSKiller as soon as it booted into Windows and it found nothing so I think I'm on the safe side.

Installing both KAV and KIS at the moment (only trials though ) and gonna scan just some selected folders of mine, just to be completely safe (which I know I can't really be ). Thank you for the help here, even if I found the solution myself (partly )

 

[TrainableMan]

Now that you seem to have some control back I still suggest you download & run RKill & malwarebytes (the manual scan is freeware) as I mentioned in a post above. Hopefully they find nothing as well.

 

[catilley1092]

Once you get this under control, it may be a good idea to run an online scanner every other week or so, at least once a month. 2TB is a lot of data, so it probably would be best to run at bedtime, or before going to work or school.

One really good one is the ESET Online Scanner. Run it from IE for best results, you can choose a couple of extra options as to how to run the scan.
http://www.eset.com/us/online-scanner

This scanner does an excellent job of keeping your computer infection free, but doesn't take the place of having an AV (free or paid) installed, updated, and ran often. There's so many choices of AV/IS suites that I don't really want to recommend a particular one, but keep in mind that the best one is the one is comfortable to the user, and will actually use.

Cat

 

[olivetty]

Thank you guys for the tip!

I will run the online scanner, was searching for one the other day. IE? Damn, I use Chrome. Well, I'll guess I can make an exception!

Downloading Malwarebytes as we speak. Fingers crossed!

RKill won't download though :S The links appear to be invalid or something.

 

[TrainableMan]

Broken links???
I clicked all 7 links on Bleeping Computer and they each offered to save a file for me.