Windows 7 Forums
Welcome to Windows 7 Forums. Our forum is dedicated to helping you find support and solutions for any problems regarding your Windows 7 PC be it Dell, HP, Acer, Asus or a custom build. We also provide an extensive Windows 7 tutorial section that covers a wide range of tips and tricks.



Windows 7: Unable to start up after virus problem; Startup Repair keeps going

10 Dec 2011   #1

Windows 7 Professional 64-bit
 
 
Unable to start up after virus problem; Startup Repair keeps going

Short version: I'm having problems starting up after a virus problem. I booted up into Startup Repair, and it's been "Attempting Repairs" for a couple hours now. What next?

I'm running Windows 7 Professional 64-bit on a MacPro through Bootcamp.

Backstory: I had been having problems with a virus that was occasionally redirecting Firefox to commercial sites. On a couple occasions I got popups trying to sell "Win 7 Security" or something bogus. (I did not try to install or register it, obviously.) I ran several different anti-virus programs, including AVG and MSE, but none seemed to stop the re-direction problem.

This morning I got another one of the bogus popups, and it was particularly assertive this time. MSE had been shut down and would not restart. I went into the Task Manager and saw "sik.exe", so I stopped the process, found the file (along with sfl.exe) and deleted it. Then all kinds of problems started to arise.

I could not restart MSE, so I uninstalled it and re-installed it successfully. It was in the process of scanning when it found a couple problems, cleaned them, and asked me to re-start Windows, which I did.

When I restarted, Windows recommended going into Startup Repair mode, which I did. After a minute or so, it asked if I wanted to do a System Restore, so I said Yes. Now it's been going a couple hours, stuck in "attempting repairs" while the blue bar moves left to right.

How long should I wait before trying to reboot, and what should I do when I reboot?

Thanks,
Mike

EDIT: Windows eventually started up normally - so never mind! The patience paid off. It did take a few hours though.

My System SpecsSystem Spec
.

11 Dec 2011   #2

Microsoft Community Contributor Award Recipient

Windows 7 Home Premium x64 SP1
 
 

Welcome to Seven Forums mikenmar. May I suggest you d/l and run Malwarebytes free? It is perhaps the best antimalware program out there. A Guy
My System SpecsSystem Spec
11 Dec 2011   #3

Windows 7 Professional 64-bit
 
 

OK, this morning the same damned virus started with the pop ups again. "Win 7 Security". This time the offending file was "era.exe", which I killed from the Task Manager. I did download Malwarebytes Anti-Malware, which found the virus on a quick scan. I'm now running a full scan.

However, one of the weird things this virus does: When you click on any executable, Windows seems not to recognize that it's a .exe file, and it asks you what program you want to use to open the .exe file....

Anyone know how to fix this?

Am I going to have to reinstall Windows at some point? I have a lot of software from my prior job that I can't reinstall, would really hate to lose all that...

EDIT: I followed these steps and the problem appears to be fixed, for now anyway.
My System SpecsSystem Spec
.


11 Dec 2011   #4

Windows 7 Professional 64-bit
 
 

DAMMIT.

Now I'm right back to where I started...

After running FixNCR.reg, RKill and Malwarebytes and rebooting, I uninstalled and reinstalled MSE. MSE found a couple of infections, and recommended removing them, which I did. Then, on restart, it put me back into Startup Repair AGAIN.

Now I'm stuck waiting the next several hours for the system restore to complete... What the hell? What am I doing wrong here?
My System SpecsSystem Spec
11 Dec 2011   #5

Win 7 32 Home Premium, Win 7 64 Pro, Win 8.1 Pro
 
 

Doubtful you did anything wrong. More then likely there are remnants left of the virus, and they can be hard to remove.

Have a look at this site & follow the steps.

Remove Win 7 Security 2012 (Uninstall Guide)

Although not what you want to hear, bear in mind there is the chance that your PC may be so badly infected, that it might be time to cut your losses, migrate as many files as you can off the HD & reinstall Win 7.

Other tools you can try:

Norton Power Eraser

Norton Rescue Tools

Quote:
Because Norton Power Eraser uses aggressive methods to detect threats, there is a risk that it can select some legitimate programs for removal. You should use this tool very carefully.
SuperAntiSpyware portable. You could try running this from a Flash Drive and see if it can nail the remnants of it.

SUPERAntiSpyware.com - SUPERAntiSpyware Portable Scanner

How to Repair Windows 7 System Files with System File Checker

SFC /SCANNOW Command - System File Checker
My System SpecsSystem Spec
11 Dec 2011   #6

Windows 7 Professional 64-bit
 
 

I got a BSOD during the Malwarebytes scan. Any more advice?
My System SpecsSystem Spec
11 Dec 2011   #7
Microsoft MVP

Windows 7 Ultimate 32bit SP1
 
 

You have a "Backdoor" Trojan. Read this info:
Quote:
Backdoor Trojans provide the author or ‘master’ of the Trojan with remote ‘administration’ of victim machines. Unlike legitimate remote administration utilities, they install, launch and run invisibly, without the consent or knowledge of the user. Once installed, backdoor Trojans can be instructed to send, receive, execute and delete files, harvest confidential data from the computer, log activity on the computer and more.
If your computer was used for online banking or has credit card information on it, all passwords should be changed immediately to include those used for email, eBay and forums.
You should consider them to be compromised.
They should be changed by using a different computer and not the infected one, if not an attacker may get the new passwords and transaction information.
Banking and credit card institutions should be notified of the possible security breech.
More info can be found below:
How Do I Handle Possible Identify Theft, Internet Fraud and CC Fraud?
How to report ID theft, fraud, drive-by installs, hijacking and malware? Security | DSLReports.com, ISP Information
Flush the dirty DNS cache and restore MS's Hosts file:

Copy and paste these lines in Note pad.

@Echo on
pushd\windows\system32\drivers\etc
attrib -h -s -r hosts
echo 127.0.0.1 localhost>HOSTS
attrib +r +h +s hosts
popd
ipconfig /release
ipconfig /renew
ipconfig /flushdns
netsh winsock reset all
netsh int ip reset all
shutdown -r -t 1
del %0

[B]Save as flush.bat to your desktop.
Double click on the flush.bat file to run it.Vista and Windows 7... right click the .bat file and choose to run as Administrator. Your computer will reboot itself.

Next, follow these instructions again! Remove Win 7 Security 2012 (Uninstall Guide)
My System SpecsSystem Spec
12 Dec 2011   #8

Windows 7 Professional 64-bit
 
 

I still can't run Malwarebytes (in Full Scan mode) without getting a BSOD... I've run the Quick Scan (after first running FixNCR.reg and rkill), and it doesn't find anything.

Any other tips?

I got another re-direct in Firefox today, so it appears I still have an infection. Damn this is so frustrating....
My System SpecsSystem Spec
13 Dec 2011   #9

Win 7 32 Home Premium, Win 7 64 Pro, Win 8.1 Pro
 
 

Possible that a rootkit is causing all the problems. Have a look here & try running a rootkit scan or 2 and see what it finds.

Best Free Rootkit Scanner and Remover

Also, look at the link above to Norton Power Eraser, it also features a rootkit scan.

You could also try submitting the BSOD to this thread and see if they could help you find the cause of the problem

Crashes and Debugging - Windows 7 Forums

Another possibility is to try a bootable AV rescue disk

http://www.techmixer.com/free-bootab...download-list/

(Kaspersky has been known to cause some problems in the past, if they have remedied this problem, I do not know, however you may wish to try some of the the other rescue disks)

I know you don't wish to do it, but if the PC is having this many problems, it might be a good idea to migrate as much data as you can off the HD & start over with a clean install. Since it's giving you this many problems, you can never really be sure that you got all of the infection off and it's probably not trustworthy anymore.
My System SpecsSystem Spec
13 Dec 2011   #10
Microsoft MVP

Windows 7 Ultimate 32bit SP1
 
 

Download DDS from one of these links:
Mirror 1 Mirror 2 Mirror 3
  • Disable any script blocking protection
  • Double click the dds icon to run the tool.
  • When done, DDS will open two (2) logs:
    1. DDS.txt
    2. Attach.txt <--- will be minimized in the task tray
  • Save both reports to your desktop.
Include the contents of both logs in your next post.
My System SpecsSystem Spec
Reply

 Unable to start up after virus problem; Startup Repair keeps going





Thread Tools



Similar help and support threads for2: Unable to start up after virus problem; Startup Repair keeps going
Thread Forum
Your computer was unable to start, Startup Repair. General Discussion
Laptop is Unable To Start, Startup Repair General Discussion
Windows unable to start - Startup Repair and System Restore won't work Backup and Restore
Startup Repair - Unable to escape... BSOD Help and Support
unable to system restore from startup repair Backup and Restore
Unable to start- startup repair problem General Discussion
Cannot start Windows - Startup Repair problem BSOD Help and Support

Our Sites

Site Links

About Us

Find Us

Windows 7 Forums is an independent web site and has not been authorized, sponsored, or otherwise approved by Microsoft Corporation. "Windows 7" and related materials are trademarks of Microsoft Corp.

© Designer Media Ltd

All times are GMT -5. The time now is 03:15 PM.
Twitter Facebook Google+



Windows 7 Forums

Seven Forums Android App Seven Forums IOS App
  

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33