BSOD error with iastor.sys - Page 8

mac1981 · #**106** April 24th, 2012, 01:25 AM

Well did the System Engineer and it said the system repair engineer core module failed. Saying something like it was broken down into separate modules and couldn't work.

**Jintan** · #**107** April 24th, 2012, 01:51 AM

Go to Start Search, type cmd.exe in the Start Search box. Cmd.exe will appear at the top of the Menu. Rightclick on it and choose "Run as administrator". At the prompt copy/paste the following, pressing Enter after each:

net user administrator /active:yes

You should get a confirmation that succeeded. Then type exit and press Enter to close that Window.

Reboot to Safe Mode. At startup tap the F8 key about once per half-second, then select Safe Mode with Networking from the menu that will appear.

You should now see the icon to log in to the Administrator account. Do that, then right click Computer, left click Explore/Open, and navigate to the Users folder - your normal user account, locate and try to run Gmer's normal scan then (Desktop, Downloads or wherever you have been running it from).

mac1981 · #**108** April 24th, 2012, 02:24 AM

Nope. It ran for a little while then a problem arose. This is one bad malware if that is the problem. Smh

**Jintan** · #**109** April 24th, 2012, 02:28 AM

Earlier you said "Windows" said the file was "corrupt"? Can you provide exact details on what just occurred please?

mac1981 · #**110** April 24th, 2012, 02:34 AM

Whenever I do a GMER scan a window will come up and say Windows has to close the scan because a problem has occurred. Then it says a solution is being looked for. I press okay, the scan is closed. Sometimes that happens, other times in normal mode, an icon in the bottom right hand corner will come up and say the file GMER is a corrupt file.

**Jintan** · #**111** April 24th, 2012, 02:43 AM

Let's check if active unseen malware is calling out there. Have active Internet access to do the following.

Go here and download TCPView, unzip that downloaded file and click the Tcpview.exe from that to run TCPView. Before doing that close all browsers.

Once TCPView opens, click Options - Always On Top. The open whatever browser you use, and watch the TCPView display. What you are looking for is multiple obvious connections to various websites. Not yming (Yahoo) or just IP addresses (example - 257.09.223.187), but a bunch of activity that seems to be hitting many web sites all at once.

mac1981 · #**112** April 24th, 2012, 03:02 AM

If I am understanding this right. Nothing is coming up like that. I might be wrong. I am confused. Sorry. Are mcciservicehost.exe and hnm_svc.exe good things to have running?

**Jintan** · #**113** April 24th, 2012, 03:25 AM

I sense you are understanding it right. It's busy list, but when TDL4/ZAcess is active there, the activity would jump out like a neon sign. So it's at least neutralized.

Try SRENg2 from Admin Safe Mode. Also run Gmer, by this time before clicking Scan, uncheck Services.

mac1981 · #**114** April 24th, 2012, 04:19 AM

Tried to run both in safe mode, same messages cam up. Says Since System Engineer Repair 2.6, System Engineer Repair has broken down into SREngLdr module and SREngCore module. SREngCore Module will automatically generated by SREngLdr module when System Repair Engineer running.

GMER Scan still same message as well.

**Jintan** · #**115** April 24th, 2012, 04:23 AM

Late where I am, but one other thing to check please. Run SREng2 again. Where the actual SREngLdr.exe is located, running it should then create a second .exe file in the same location. Once you see it, click on that and see if SREng runs then.

mac1981 · #**116** April 24th, 2012, 04:38 AM

Did that and it says the version I have is out of date and I need a product key or something like that. Sorry for keeping you up so late.

**Jintan** · #**117** April 25th, 2012, 12:13 AM

So Check Disk won't run, and Windows says Gmer is corrupted.

Delete your existing copies of Gmer and SREng2, download fresh copies and try some of those procedures again please.

mac1981 · #**118** April 25th, 2012, 10:56 PM

Redid the SREng2 scan, and nothing came up in the right corner that was detected. Did a scan and everything looked alright. It was a lot to read. Haven't done the GMER scan yet.

mac1981 · #**119** April 25th, 2012, 11:01 PM

Redownloaded the GMER scan and Windows said a problem was encountered while the program was running and had to shut it down. Same message.

**Jintan** · #**120** April 26th, 2012, 01:21 AM

I believe we did it already, but do need to locate this one hold-out.

Open Gmer again. Once it has completed it's opening scan, this time just right click in the white space in the display and select Options - Only non MS files. Then click Scan and allow Gmer to run a different scan. Once that completes click on the Copy button and rightclick on your Desktop, choose "New" > Text document. Once the file is created, open it and rightclick again and choose Paste. Copy the information and post it here please.