strey101 Posted June 4, 2009 Share Posted June 4, 2009 Im recieving the following errors in imgburn when trying to use it: E 22:43:10 CreateFile Failed! - Device: '\\.\CdRom1' (F:) E 22:43:10 Reason: The maximum number of secrets that may be stored in a single system has been exceeded. E 22:43:13 CreateFile Failed! - Device: '\\.\CdRom4' (E:) E 22:43:13 Reason: The maximum number of secrets that may be stored in a single system has been exceeded. Link to comment Share on other sites More sharing options...
mmalves Posted June 4, 2009 Share Posted June 4, 2009 You have a rootkit/virus/malware on your system. Please read this post: http://forum.imgburn.com/index.php?showtop...ost&p=93197 Link to comment Share on other sites More sharing options...
eSkRo Posted June 4, 2009 Share Posted June 4, 2009 (edited) I had this problem and too and this is what i did to fix it! Try it, who knows, it might work for you too! Right-Click on "MY COMPUTER" Choose "Properties" Go to the "HARDWARE" tab Then click on "DEVICE MANAGER" Got to "CD-ROM/DVD-ROM" & Click on the "+" sign to Expend it Now Highlight all u see there ( doesnt matter how much drives u see... i had 2 so i selected the 2 of them) Right-click and choose "Uninstall" Once uninstalled to the top menu you'll see -> "ACTION" Click on "ACTION" Choose "Find Hardware Changes" Now Windows will find your DVD-ROM(s) Now just REBOOT your PC (very important) And VOILA!!! IMGBURN works again!!! Magic!!! Edited June 4, 2009 by eSkRo Link to comment Share on other sites More sharing options...
LIGHTNING UK! Posted June 4, 2009 Share Posted June 4, 2009 eSkRo, There is absolutely no proof that will do anything and I'd like you to refrain from posting it in future please. I've don't recall EVER seeing this problem before all the latest Virus crap came up and obviously what you're saying to do will NOT remove a virus. The thing to do here is remove said virus, not work around it by uninstalling devices (if that even works). Link to comment Share on other sites More sharing options...
eSkRo Posted June 4, 2009 Share Posted June 4, 2009 (edited) Ok then.... But since it worked for me i thought it could work for him too... I mean trying it takes a second and wont harm his system at all... Like me, he maybe doesn't have a virus? Edited June 4, 2009 by eSkRo Link to comment Share on other sites More sharing options...
dontasciime Posted June 4, 2009 Share Posted June 4, 2009 Ok then.... But since it worked for me i thought it could work for him too... I mean trying it takes a second and wont harm his system at all... Like me, he maybe doesn't have a virus? You ran MBAM yet ? Link to comment Share on other sites More sharing options...
LIGHTNING UK! Posted June 4, 2009 Share Posted June 4, 2009 GMER is the one to use. This thing is a rootkit and keeps itself hidden. Link to comment Share on other sites More sharing options...
dontasciime Posted June 4, 2009 Share Posted June 4, 2009 I remember reading about this when it first started to appear.... it's a 2000 issue with 4096 encrypted files being max us law would allow... seems like this code has been left in xp vista etc and is being manipulated by rootkit/malware/spyware/virus. I presumed MBAM had been updated now to remove this as I heard someone mention this. Either way it is def not a normal situation where devices should be removed and advice ignored. Link to comment Share on other sites More sharing options...
LIGHTNING UK! Posted June 4, 2009 Share Posted June 4, 2009 The rootkit is just hooking the calls used to open drives (which in turn messes up far more than burning tools) and returning that error code when anything tries. I'm not sure if mbam works at a low enough level to catch this kinda thing does it? That's why hardly any of the antivirus programs work either. Link to comment Share on other sites More sharing options...
Grave Doren'kal Posted June 12, 2009 Share Posted June 12, 2009 I had this problem and too and this is what i did to fix it! Try it, who knows, it might work for you too!... I would like to point out. I had looked at several of the solutions here, I used gmer, sanitycheck, and Rootrepeal. Every one found a library type file that couldn't be treated in any way, finally I decided to try eSkRo's way of uninstalling my DvD drives, and it did work. His way was legit and doesn't need to be discredited. Link to comment Share on other sites More sharing options...
LIGHTNING UK! Posted June 12, 2009 Share Posted June 12, 2009 As I've told eSkRo, I want to find out why it happens and the root cause before I consider it a valid workaround (it's just the DMA fix anyway). It would have been useful to see the library gmer found (or full scan results in general) and a copy of the filter driver load order too... I guess we're too late for that now unless you care to muck your machine up again? Link to comment Share on other sites More sharing options...
eSkRo Posted June 12, 2009 Share Posted June 12, 2009 i recall installing Deamon Tools too.... wonder if that app corrupted my DVD-RW... hmmmm.... Link to comment Share on other sites More sharing options...
mmalves Posted June 12, 2009 Share Posted June 12, 2009 Potentially, yes, it could cause problems, but not with that specific "maximum number of secrets" error that's known for being used by virus/rootkit/malware... Link to comment Share on other sites More sharing options...
Grave Doren'kal Posted June 12, 2009 Share Posted June 12, 2009 (edited) the library was called MSIVX with a bunch of random letters after it, it said it was hidden and not visible, I right clicked for options and none could be used, I used rootrepeal and attempted to wipe it or force delete, got an error force deleting, and upon wiping said that it didn't exist Sorry I should have remembered to copy the error EDIT: after my sister(who is a dumbass) was on here today, the MSIVX is back, but this time its the service I also found the first time, it has the same name as the library, but luckily the library isn't there, ---- Services - GMER 1.0.15 ---- Service system32\drivers\MSIVXespyxmwrrvalqeavspcbsiyeftirpuwc.sys (*** hidden *** ) [sYSTEM] MSIVXserv.sys <-- ROOTKIT !!! thats the same file path as the library which couldn't be removed Edited June 13, 2009 by Grave Doren'kal Link to comment Share on other sites More sharing options...
eSkRo Posted June 13, 2009 Share Posted June 13, 2009 If you have any problems, try running your anti-rootkit apps in SAFE MODE Link to comment Share on other sites More sharing options...
LIGHTNING UK! Posted June 13, 2009 Share Posted June 13, 2009 As per my thread in the FAQ, you should just disable the service using GMER, then reboot immediately. If you use RootRepeal, you should 'wipe' the main .sys file (after a file scan) and then reboot immediately. Once the machine has rebooted (and the rootkit is basically disabled) your normal AV or Anti-Malware type software should be able to clear up the mess. There isn't much on Google at the moment regarding the MSIVX rootkit but there is this... http://community.norton.com/norton/board/m...ding&page=3 Link to comment Share on other sites More sharing options...
Recommended Posts