Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

So, I got hit by a virus and it seems while I was trying to clean it, I removed something essential from the list of startup programs.

So, when windows starts, it gets stuck at the "please wait" screen.

If I hit shift 5 times fast, I get that annoying sticky-keys dialoge, and with it I can alt-tab and I see the title of the "Please wait ... O" windows as "Logon window".

I can start in safe mode just fine.

Any clue what could be wrong?

UPDATE

As per David's answer, I tried doing CHKDSK C: /R in safe mode. It said C: is NTFS but it can't check it now and it will have to run after restarting. So, I restarted and started windows normally, CHKDSK ran briefly, and said something like: Drive C: is RAW, can't fix a RAW drive. The windows proceeded booting but again, got stuck at the "please wait" screen.

UPDATE2

I un-installed AnVir Task Manager Free (which I was using to remove things from startup) since it seemed to somehow conflict with controlling startup items from msconfig.

Now, the system is not stuck at "Please Wait" but instead I get a box "An unauthorized change was made to windows". Is that a sign of a rootkit?

Also, when I go to safemode, it works find, but a scan with hijackthis shows that the hosts file has been tampered with, and some obviously-viral .exes are added to the startup list, even though I cleaned all suspecious startup entries before.

UPDATE3

Just so that people know, I gave up and removed windows. I didn't format or anything, I just removed the Windows directory from the windows partition, and I'm trying to free as much space as possible by removing all applications from Program Files and whatnot.

As of now I have no intention of re-installing windows.

share|improve this question
1  
Why not just delete the partition that windows is on and use GParted to extend your linux volume so you can reclaim all of the space? –  MDMarra Aug 15 '09 at 3:06
    
@MarkM, yeah that's pretty much what I'm doing :) –  hasenj Aug 15 '09 at 22:02

6 Answers 6

Use your Windows Vista install DVD (hopefully it has the latest service pack) and do a repair. If I recall correctly you can actually start like you are going to install, and then when it asks where and notices you already have Vista installed you can tell it to repair. This will copy all the OS files again. You will need to run Windows Update immediately after you boot though, but everything else should be installed and working fine.

share|improve this answer

Start you machine in safe mode and see what happens. But, basically, once your machine is compromised, you can never trust it again. You should back up your data (if safe mode works) and rebuild.

Per your comment (this advice is given without warranty):

Do you have a system restore point that is older than the problem? If so, can you restore to that? If not, you should try last known good.

share|improve this answer
    
I edited the question, safe mode works fine. I know that there are deeper security issues, but for now I just want it to start normally. –  hasenj Jul 21 '09 at 2:15

I had something similar happen to me. Try booting into Safe Mode, then performing a CHKDSK C: /R. Restart your system and let the CHKDSK run.

share|improve this answer
    
wow I just tried that, and u know what chkdsk said? drive C: is RAW! –  hasenj Jul 21 '09 at 23:13
    
I haven't used this, but there is an open-source app called TestDisk which might help you recover the drive. cgsecurity.org/wiki/TestDisk –  David Frautnick Jul 21 '09 at 23:35
    
Well, the drive works fine, I can read/write to it safe mode and from linux –  hasenj Jul 22 '09 at 5:30
    
If you can read from the drive, it might be best to just copy your important files off of the drive, format the drive, and re-install the OS. –  David Frautnick Jul 23 '09 at 3:56

Possible solutions:

  1. After going on safe mode, try to reinstall the display drivers. This is often the componant that causes failing a normal boot while safe mode works fine.

  2. Disable as many programs as you can from auto-starting.

  3. If the problem is still probably the HD, Look for UBCD and after running it try some of the tools that might fix your C: drive.

share|improve this answer

The only way to really clean a virus is a format and reinstall. Otherwise you suffer from the "blue pill", you think everything is honky dory but in reality you are being used.

share|improve this answer
    
It is possible to thoroughly clean a virus - all depends on the virus and amount of patience. Kernel Mode and MBR rootkits are an exception, however. –  CoffeeBean Aug 31 '09 at 21:18
    
Actually security experts agree with me. You can never be sure you have removed everything. Viruses today are designed to carry in multiple infections and the goal is remain undetected to use your machine for bot networks. The days of removing a virus manually are long gone. –  Clifford the Red Sep 4 '09 at 18:32

I had this issue, but not because of a virus (well, so I think. Dang, now I'd better go and check...)

My solution was to boot into safe mode and disable the Network Location Awareness service. Apparently it was hanging up on boot.

Hope this helps a future googler that lands here!

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.