Solved

ihimg.sys Blue screen of death

Posted on 2010-11-11
8
365 Views
Last Modified: 2012-05-10
I have a dell that is giving me a blue screen of death i ran whocrashed and it tells me the culprit is ihimg.sys i googled for this file to see if i could find any info on it and found nothing anyone got any ideas? i have run combofix and there was a mbr infection which it seems to have removed.
0
Comment
Question by:smartsystemsinc
  • 4
  • 3
8 Comments
 
LVL 10

Expert Comment

by:Wolfhere
ID: 34116900
Can you boot to safe mode? If not, what file is it hanging on? If you can get into safe mode, consider downloading and running a rootkit cleanersuch as UnHackme and malwarebytes...from within safe mode. It will require a reboot for the unhackme. Rootkit's will install a .sys driver that in turn downloads trojans.
0
 
LVL 66

Accepted Solution

by:
johnb6767 earned 500 total points
ID: 34117533
Probably a randomly created service....If the machine stays up long enough to Remotely access the registry, do the below suggestion there.....

Or locally if you stay in long enough.....

Might need to mount the disk as a slave and load the SYSTEM Hive.....

How to edit the registry offline using BartPE boot CD ?
http://windowsxp.mvps.org/peboot.htm

Just follow the directions in the article, about loading the SYSTEM hive, and navigate to the "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\ihimg" key and set the "Start" value to "4".... Unload the SYSTEM hive, and then pop it back in your system to test......

 Or  you can do it either way, with BartPE, or UBCD4Win.

What is the Ultimate Boot CD for Windows?
http://www.ubcd4win.com/

Bart's Preinstalled Environment (BartPE) bootable live windows CD/DVD
http://www.nu2.nu/pebuilder/ 
0
 
LVL 66

Expert Comment

by:johnb6767
ID: 34117534
If you can get into the machine, you can also use Combofix. (stolen from rpggamergirl's postings...)  :)

Here's the instructions, if it doesn't run at first, then redownload and rename before saving to your desktop.
Please download ComboFix by sUBs:
http://download.bleepingcomputer.com/sUBs/ComboFix.exe 

You must download it to and run it from your Desktop
Now STOP all your monitoring programs (Antivirus/Antispyware, Guards and Shields) as they could easily interfere with ComboFix.
Double click combofix.exe & follow the prompts.
When finished, it will produce a log. Please save that log and attach it in your next reply by pasting it in the "Code Snippet" or "Attach File" window.
Re-enable all the programs that were disabled during the running of ComboFix..

Note:
Do not mouse-click combofix's window while it is running. That may cause it to stall.
CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.

If needed, here's the Combofix tutorial which includes the installation of the Recovery Console:
http://www.bleepingcomputer.com/combofix/how-to-use-combofix

Personally, I wouldnt install the recvovery console.
0
Ransomware-A Revenue Bonanza for Service Providers

Ransomware – malware that gets on your customers’ computers, encrypts their data, and extorts a hefty ransom for the decryption keys – is a surging new threat.  The purpose of this eBook is to educate the reader about ransomware attacks.

 

Author Comment

by:smartsystemsinc
ID: 34121131
I have run combofix already it did find rootkit activity and a mbr infection. both seem to be repaired and this is a remnant perhaps.
0
 

Author Comment

by:smartsystemsinc
ID: 34121133
i will also try the above.
0
 

Author Comment

by:smartsystemsinc
ID: 34122775
wow ok i haven't been able to try any of these steps all i can do is dell utility partition and a black screen imidiatly after dell bios splash screen. I think maybe a hard ware problem
0
 

Author Comment

by:smartsystemsinc
ID: 34124017
Sweet its fixed turns out the reg key was bogus all random letters and numbers i deleted the key from control sets 1,2,and 3 and the blue screen is got so far thanks a bunch.
0
 
LVL 66

Expert Comment

by:johnb6767
ID: 34128322
Glad youre fixed....
0

Featured Post

Use Case: Protecting a Hybrid Cloud Infrastructure

Microsoft Azure is rapidly becoming the norm in dynamic IT environments. This document describes the challenges that organizations face when protecting data in a hybrid cloud IT environment and presents a use case to demonstrate how Acronis Backup protects all data.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Title # Comments Views Activity
uploading CentOS to Azure (no root access) 3 74
Delete Folder and its contents in a batch file 12 74
URL for downloading Google Chrome for Win XP 2 155
Can’t delete a file 14 162
Can you find a fax from a vendor you saved a decade ago in seconds? Have you ever cursed your PC under your breath during an audit because you couldn’t find the requested statement or driver history?  If you answered no to the first question or yes …
If your system is showing symptoms of browser hijacks or 'google search redirects' check out my other article (http://rdsrc.us/u3GP7A) first and run the tool TDSSKiller (http://rdsrc.us/GDBBs4) to get rid of the infection. Once done, and if the …
This Micro Tutorial will teach you how to censor certain areas of your screen. The example in this video will show a little boy's face being blurred. This will be demonstrated using Adobe Premiere Pro CS6.
Two types of users will appreciate AOMEI Backupper Pro: 1 - Those with PCIe drives (and haven't found cloning software that works on them). 2 - Those who want a fast clone of their boot drive (no re-boots needed) and it can clone your drive wh…

773 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question