3

So, I got hit by a virus and it seems while I was trying to clean it, I removed something essential from the list of startup programs.

So, when windows starts, it gets stuck at the "please wait" screen.

If I hit shift 5 times fast, I get that annoying sticky-keys dialoge, and with it I can alt-tab and I see the title of the "Please wait ... O" windows as "Logon window".

I can start in safe mode just fine.

Any clue what could be wrong?

UPDATE

As per David's answer, I tried doing CHKDSK C: /R in safe mode. It said C: is NTFS but it can't check it now and it will have to run after restarting. So, I restarted and started windows normally, CHKDSK ran briefly, and said something like: Drive C: is RAW, can't fix a RAW drive. The windows proceeded booting but again, got stuck at the "please wait" screen.

UPDATE2

I un-installed AnVir Task Manager Free (which I was using to remove things from startup) since it seemed to somehow conflict with controlling startup items from msconfig.

Now, the system is not stuck at "Please Wait" but instead I get a box "An unauthorized change was made to windows". Is that a sign of a rootkit?

Also, when I go to safemode, it works find, but a scan with hijackthis shows that the hosts file has been tampered with, and some obviously-viral .exes are added to the startup list, even though I cleaned all suspecious startup entries before.

UPDATE3

Just so that people know, I gave up and removed windows. I didn't format or anything, I just removed the Windows directory from the windows partition, and I'm trying to free as much space as possible by removing all applications from Program Files and whatnot.

As of now I have no intention of re-installing windows.

2
  • 1
    Why not just delete the partition that windows is on and use GParted to extend your linux volume so you can reclaim all of the space?
    – MDMarra
    Aug 15, 2009 at 3:06
  • @MarkM, yeah that's pretty much what I'm doing :)
    – hasen
    Aug 15, 2009 at 22:02

6 Answers 6

1

Use your Windows Vista install DVD (hopefully it has the latest service pack) and do a repair. If I recall correctly you can actually start like you are going to install, and then when it asks where and notices you already have Vista installed you can tell it to repair. This will copy all the OS files again. You will need to run Windows Update immediately after you boot though, but everything else should be installed and working fine.

0

Start you machine in safe mode and see what happens. But, basically, once your machine is compromised, you can never trust it again. You should back up your data (if safe mode works) and rebuild.

Per your comment (this advice is given without warranty):

Do you have a system restore point that is older than the problem? If so, can you restore to that? If not, you should try last known good.

1
  • I edited the question, safe mode works fine. I know that there are deeper security issues, but for now I just want it to start normally.
    – hasen
    Jul 21, 2009 at 2:15
0

I had something similar happen to me. Try booting into Safe Mode, then performing a CHKDSK C: /R. Restart your system and let the CHKDSK run.

4
  • wow I just tried that, and u know what chkdsk said? drive C: is RAW!
    – hasen
    Jul 21, 2009 at 23:13
  • I haven't used this, but there is an open-source app called TestDisk which might help you recover the drive. cgsecurity.org/wiki/TestDisk Jul 21, 2009 at 23:35
  • Well, the drive works fine, I can read/write to it safe mode and from linux
    – hasen
    Jul 22, 2009 at 5:30
  • If you can read from the drive, it might be best to just copy your important files off of the drive, format the drive, and re-install the OS. Jul 23, 2009 at 3:56
0

Possible solutions:

  1. After going on safe mode, try to reinstall the display drivers. This is often the componant that causes failing a normal boot while safe mode works fine.

  2. Disable as many programs as you can from auto-starting.

  3. If the problem is still probably the HD, Look for UBCD and after running it try some of the tools that might fix your C: drive.

0

The only way to really clean a virus is a format and reinstall. Otherwise you suffer from the "blue pill", you think everything is honky dory but in reality you are being used.

2
  • It is possible to thoroughly clean a virus - all depends on the virus and amount of patience. Kernel Mode and MBR rootkits are an exception, however. Aug 31, 2009 at 21:18
  • Actually security experts agree with me. You can never be sure you have removed everything. Viruses today are designed to carry in multiple infections and the goal is remain undetected to use your machine for bot networks. The days of removing a virus manually are long gone. Sep 4, 2009 at 18:32
0

I had this issue, but not because of a virus (well, so I think. Dang, now I'd better go and check...)

My solution was to boot into safe mode and disable the Network Location Awareness service. Apparently it was hanging up on boot.

Hope this helps a future googler that lands here!

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .