Unable to start up after virus problem; Startup Repair keeps going

[mikenmar]

Short version: I'm having problems starting up after a virus problem. I booted up into Startup Repair, and it's been "Attempting Repairs" for a couple hours now. What next?

I'm running Windows 7 Professional 64-bit on a MacPro through Bootcamp.

Backstory: I had been having problems with a virus that was occasionally redirecting Firefox to commercial sites. On a couple occasions I got popups trying to sell "Win 7 Security" or something bogus. (I did not try to install or register it, obviously.) I ran several different anti-virus programs, including AVG and MSE, but none seemed to stop the re-direction problem.

This morning I got another one of the bogus popups, and it was particularly assertive this time. MSE had been shut down and would not restart. I went into the Task Manager and saw "sik.exe", so I stopped the process, found the file (along with sfl.exe) and deleted it. Then all kinds of problems started to arise.

I could not restart MSE, so I uninstalled it and re-installed it successfully. It was in the process of scanning when it found a couple problems, cleaned them, and asked me to re-start Windows, which I did.

When I restarted, Windows recommended going into Startup Repair mode, which I did. After a minute or so, it asked if I wanted to do a System Restore, so I said Yes. Now it's been going a couple hours, stuck in "attempting repairs" while the blue bar moves left to right.

How long should I wait before trying to reboot, and what should I do when I reboot?

Thanks,
Mike

EDIT: Windows eventually started up normally - so never mind! The patience paid off. It did take a few hours though.

 

[A Guy]

Welcome to Seven Forums mikenmar. May I suggest you d/l and run Malwarebytes free? It is perhaps the best antimalware program out there. A Guy

 

[mikenmar]

OK, this morning the same damned virus started with the pop ups again. "Win 7 Security". This time the offending file was "era.exe", which I killed from the Task Manager. I did download Malwarebytes Anti-Malware, which found the virus on a quick scan. I'm now running a full scan.

However, one of the weird things this virus does: When you click on any executable, Windows seems not to recognize that it's a .exe file, and it asks you what program you want to use to open the .exe file....

Anyone know how to fix this?

Am I going to have to reinstall Windows at some point? I have a lot of software from my prior job that I can't reinstall, would really hate to lose all that...

EDIT: I followed these steps and the problem appears to be fixed, for now anyway.

 

[mikenmar]

DAMMIT.

Now I'm right back to where I started...

After running FixNCR.reg, RKill and Malwarebytes and rebooting, I uninstalled and reinstalled MSE. MSE found a couple of infections, and recommended removing them, which I did. Then, on restart, it put me back into Startup Repair AGAIN.

Now I'm stuck waiting the next several hours for the system restore to complete... What the hell? What am I doing wrong here?

 

[Borg 386]

Doubtful you did anything wrong. More then likely there are remnants left of the virus, and they can be hard to remove.

Have a look at this site & follow the steps.

Remove Win 7 Security 2012 (Uninstall Guide)

Although not what you want to hear, bear in mind there is the chance that your PC may be so badly infected, that it might be time to cut your losses, migrate as many files as you can off the HD & reinstall Win 7.

Other tools you can try:

Norton Power Eraser

Norton Rescue Tools

Because Norton Power Eraser uses aggressive methods to detect threats, there is a risk that it can select some legitimate programs for removal. You should use this tool very carefully.

SuperAntiSpyware portable. You could try running this from a Flash Drive and see if it can nail the remnants of it.

SUPERAntiSpyware.com - SUPERAntiSpyware Portable Scanner

How to Repair Windows 7 System Files with System File Checker

http://www.sevenforums.com/tutorials/1538-sfc-scannow-command-system-file-checker.html

 

[mikenmar]

I got a BSOD during the Malwarebytes scan. Any more advice?

 

[Jacee]

You have a "Backdoor" Trojan. Read this info:

Backdoor Trojans provide the author or ‘master’ of the Trojan with remote ‘administration’ of victim machines. Unlike legitimate remote administration utilities, they install, launch and run invisibly, without the consent or knowledge of the user. Once installed, backdoor Trojans can be instructed to send, receive, execute and delete files, harvest confidential data from the computer, log activity on the computer and more.
If your computer was used for online banking or has credit card information on it, all passwords should be changed immediately to include those used for email, eBay and forums.
You should consider them to be compromised.
They should be changed by using a different computer and not the infected one, if not an attacker may get the new passwords and transaction information.
Banking and credit card institutions should be notified of the possible security breech.
More info can be found below:
How Do I Handle Possible Identify Theft, Internet Fraud and CC Fraud?
How to report ID theft, fraud, drive-by installs, hijacking and malware? Security | DSLReports.com, ISP Information

Flush the dirty DNS cache and restore MS's Hosts file:

Copy and paste these lines in Note pad.

@Echo on
pushd\windows\system32\drivers\etc
attrib -h -s -r hosts
echo 127.0.0.1 localhost>HOSTS
attrib +r +h +s hosts
popd
ipconfig /release
ipconfig /renew
ipconfig /flushdns
netsh winsock reset all
netsh int ip reset all
shutdown -r -t 1
del %0

Save as flush.bat to your desktop.
Double click on the flush.bat file to run it.Vista and Windows 7... right click the .bat file and choose to run as Administrator. Your computer will reboot itself.

Next, follow these instructions again! Remove Win 7 Security 2012 (Uninstall Guide)

 

[mikenmar]

I still can't run Malwarebytes (in Full Scan mode) without getting a BSOD... I've run the Quick Scan (after first running FixNCR.reg and rkill), and it doesn't find anything.

Any other tips?

I got another re-direct in Firefox today, so it appears I still have an infection. Damn this is so frustrating....

 

[Borg 386]

Possible that a rootkit is causing all the problems. Have a look here & try running a rootkit scan or 2 and see what it finds.

Best Free Rootkit Scanner and Remover

Also, look at the link above to Norton Power Eraser, it also features a rootkit scan.

You could also try submitting the BSOD to this thread and see if they could help you find the cause of the problem

Crashes and Debugging - Windows 7 Forums

Another possibility is to try a bootable AV rescue disk

http://www.techmixer.com/free-bootable-antivirus-rescue-cds-download-list/

(Kaspersky has been known to cause some problems in the past, if they have remedied this problem, I do not know, however you may wish to try some of the the other rescue disks)

I know you don't wish to do it, but if the PC is having this many problems, it might be a good idea to migrate as much data as you can off the HD & start over with a clean install. Since it's giving you this many problems, you can never really be sure that you got all of the infection off and it's probably not trustworthy anymore.

 

[Jacee]

Download DDS from one of these links:
Mirror 1 Mirror 2 Mirror 3

• Disable any script blocking protection
• Double click the dds icon to run the tool.
• When done, DDS will open two (2) logs:
  1. DDS.txt
  2. Attach.txt <--- will be minimized in the task tray
• Save both reports to your desktop.

Include the contents of both logs in your next post.

 

[mikenmar]

OK, so I ran the following programs:

TDSSKiller.exe (found nothing)
Norton Power Erase (found three items and deleted them)
SuperAntiSpyware (in addition to Adware, found a trojan, deleted it)

Then I ran the DDS script. The logs are here:

http://mikeandersonlaw.com/DDS.txt
http://mikeandersonlaw.com/Attach.txt

Any help is much appreciated.

Thanks

 

[FranzB]

I read somewhere that those viruses recogize TDDSKiller and the advice given was to rename it, to e.g. abc.com
(the .com has to be added!), and run it again.
Have a look at
How To Easily Remove Google Redirect Virus

But Borg386 has a point. Start from scratch if all else fails.

 

[FranzB]

Another thing. An expert once said to always wait 30 seconds after shutting down the computer before rebooting.
I cannot by any means judge this advice but it's easy to follow without any problems, just don't hit the "restart"
button.

 

[mikenmar]

DAMMIT... Still infected... I've tried everything suggested here save for re-installing Windows.

I'm going to give Avast a try -- it seems to have detected a number of files the other programs missed. But if that doesn't work, I guess I've got no choice but to re-install.

This is really depressing. I'd never have thought the virus makers could be so clever as to outwit a dozen different detection/elimination solutions, but it appears that way.

 

[FranzB]

Have a look at
Microsoft Safety Scanner - Free online tool for PC health and safety
You have to download MSERT (about 70MB!) and then run it (full scan). It is not installed but stays in Documents(Downloads) and expires after 10 days.
It may do the trick but..... it seems you've really got a problem. A clean install may be the only option left.

 

[FranzB]

There is also a tutorial on this forum by Brink about this Microsoft Security Scanner.
You may want to read it first.

 

[A Guy]

DAMMIT... Still infected... I've tried everything suggested here save for re-installing Windows.

I'm going to give Avast a try -- it seems to have detected a number of files the other programs missed. But if that doesn't work, I guess I've got no choice but to re-install.

This is really depressing. I'd never have thought the virus makers could be so clever as to outwit a dozen different detection/elimination solutions, but it appears that way.

Run the Avast boot time scan as well.

A Guy

 

[Jacee]

Do you know what these are?
C:\Users\Mike\AppData\Roaming\Wopo
C:\Users\Mike\AppData\Roaming\Hyyd

Copy and paste these lines in Note pad.

@Echo on
pushd\windows\system32\drivers\etc
attrib -h -s -r hosts
echo 127.0.0.1 localhost>HOSTS
attrib +r +h +s hosts
popd
ipconfig /release
ipconfig /renew
ipconfig /flushdns
netsh winsock reset all
netsh int ip reset all
shutdown -r -t 1
del %0

Save as flush.bat to your desktop.
Double click on the flush.bat file to run it.Vista and Windows 7... right click the .bat file and choose to run as Administrator. Your computer will reboot itself.




Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system. Please follow these steps to remove older version Java components and update.
Updating Java:

• Download the latest version of Java Runtime Environment (JRE) 7[/B].
  Java SE Downloads
• Scroll down to where it says "Java Runtime Environment (JRE) 7u1 allows end-users to run Java applications".
• Click the "Download" button to the right.
• Check the box that says: "Accept License Agreement".
• The page will refresh.
• Click on the link to download Windows Offline Installation with or without Multi-language and save to your desktop.
• Close any programs you may have running - especially your web browser.
• Go to Start > Control Panel double-click on Add/Remove programs and remove all older versions of Java.
• Check any item with Java Runtime Environment (JRE or J2SE) in the name.
• Click the Remove or Change/Remove button.
• Repeat as many times as necessary to remove each Java versions.
• Reboot your computer once all Java components are removed.
• Then from your desktop double-click on jre-7u1-windows-i586-p.exe to install the newest version.

After doing the above, let me know if you're still being redirected

 

[mikenmar]

Do you know what these are?
C:\Users\Mike\AppData\Roaming\Wopo
C:\Users\Mike\AppData\Roaming\Hyyd

I have no idea. They were empty, so I just deleted them.

 

[mikenmar]

OKAY....

So I've run Avast scan at boot, and I ran MSERT (took about 10 hours to scan), also the flush.bat file (I did that earlier in the thread, but I just did it again), updated Java, ran Avast scan at boot again, and ran Norton Power Erase one more time (with rootkit scan) for good measure.

All the scans are no longer finding any problem files. Man, I feel like I've done nothing all week except run scans...

I've also switched from Firefox to Chrome.

So we'll see. Will report back.