Cannot find disk drives after using daemon tools

[strey101]

Im recieving the following errors in imgburn when trying to use it:

 

E 22:43:10 CreateFile Failed! - Device: '\\.\CdRom1' (F:)

E 22:43:10 Reason: The maximum number of secrets that may be stored in a single system has been exceeded.

E 22:43:13 CreateFile Failed! - Device: '\\.\CdRom4' (E:)

E 22:43:13 Reason: The maximum number of secrets that may be stored in a single system has been exceeded.

[mmalves]

You have a rootkit/virus/malware on your system.

 

Please read this post: http://forum.imgburn.com/index.php?showtop...ost&p=93197

[eSkRo]

I had this problem and too and

this is what i did to fix it!

Try it,

who knows,

it might work for you too!

 

 

Right-Click on "MY COMPUTER"

 

Choose "Properties"

 

Go to the "HARDWARE" tab

 

Then click on "DEVICE MANAGER"

 

Got to "CD-ROM/DVD-ROM" & Click on the "+" sign to Expend it

 

Now Highlight all u see there ( doesnt matter how much drives u see... i had 2 so i selected the 2 of them)

 

Right-click and choose "Uninstall"

 

Once uninstalled

 

to the top menu you'll see -> "ACTION"

 

Click on "ACTION"

 

Choose "Find Hardware Changes"

 

Now Windows will find your DVD-ROM(s)

 

Now just REBOOT your PC (very important)

 

And VOILA!!!

 

IMGBURN works again!!!

 

Magic!!!

Edited June 4, 2009 by eSkRo

[LIGHTNING UK!]

eSkRo,

 

There is absolutely no proof that will do anything and I'd like you to refrain from posting it in future please.

 

I've don't recall EVER seeing this problem before all the latest Virus crap came up and obviously what you're saying to do will NOT remove a virus. The thing to do here is remove said virus, not work around it by uninstalling devices (if that even works).

[eSkRo]

Ok then....

 

But since it worked for me i thought it could work for him too...

 

I mean trying it takes a second and wont harm his system at all...

 

Like me, he maybe doesn't have a virus?

Edited June 4, 2009 by eSkRo

[dontasciime]

Ok then....

 

But since it worked for me i thought it could work for him too...

 

I mean trying it takes a second and wont harm his system at all...

 

Like me, he maybe doesn't have a virus?

 

You ran MBAM yet ?

[LIGHTNING UK!]

GMER is the one to use. This thing is a rootkit and keeps itself hidden.

[dontasciime]

I remember reading about this when it first started to appear.... it's a 2000 issue with 4096 encrypted files being max us law would allow... seems like this code has been left in xp vista etc and is being manipulated by rootkit/malware/spyware/virus.

 

I presumed MBAM had been updated now to remove this as I heard someone mention this. Either way it is def not a normal situation where devices should be removed and advice ignored.

[LIGHTNING UK!]

The rootkit is just hooking the calls used to open drives (which in turn messes up far more than burning tools) and returning that error code when anything tries.

 

I'm not sure if mbam works at a low enough level to catch this kinda thing does it? That's why hardly any of the antivirus programs work either.

[Grave Doren'kal]

I had this problem and too and

this is what i did to fix it!

Try it,

who knows,

it might work for you too!...

 

I would like to point out. I had looked at several of the solutions here, I used gmer, sanitycheck, and Rootrepeal. Every one found a library type file that couldn't be treated in any way, finally I decided to try eSkRo's way of uninstalling my DvD drives, and it did work. His way was legit and doesn't need to be discredited.

[LIGHTNING UK!]

As I've told eSkRo, I want to find out why it happens and the root cause before I consider it a valid workaround (it's just the DMA fix anyway).

 

It would have been useful to see the library gmer found (or full scan results in general) and a copy of the filter driver load order too... I guess we're too late for that now unless you care to muck your machine up again?

[eSkRo]

i recall installing Deamon Tools too....

wonder if that app corrupted my DVD-RW...

 

hmmmm....

[mmalves]

Potentially, yes, it could cause problems, but not with that specific "maximum number of secrets" error that's known for being used by virus/rootkit/malware...

[Grave Doren'kal]

the library was called MSIVX with a bunch of random letters after it, it said it was hidden and not visible, I right clicked for options and none could be used, I used rootrepeal and attempted to wipe it or force delete, got an error force deleting, and upon wiping said that it didn't exist

 

Sorry I should have remembered to copy the error

EDIT:

after my sister(who is a dumbass) was on here today, the MSIVX is back, but this time its the service I also found the first time, it has the same name as the library, but luckily the library isn't there,

 

---- Services - GMER 1.0.15 ----

 

Service system32\drivers\MSIVXespyxmwrrvalqeavspcbsiyeftirpuwc.sys (*** hidden *** ) [sYSTEM] MSIVXserv.sys <-- ROOTKIT !!!

 

thats the same file path as the library which couldn't be removed

Edited June 13, 2009 by Grave Doren'kal

[eSkRo]

If you have any problems, try running your anti-rootkit apps in SAFE MODE

[LIGHTNING UK!]

As per my thread in the FAQ, you should just disable the service using GMER, then reboot immediately.

 

If you use RootRepeal, you should 'wipe' the main .sys file (after a file scan) and then reboot immediately.

 

Once the machine has rebooted (and the rootkit is basically disabled) your normal AV or Anti-Malware type software should be able to clear up the mess.

 

There isn't much on Google at the moment regarding the MSIVX rootkit but there is this...

 

http://community.norton.com/norton/board/m...ding&page=3