[JeffF73]

Hello I have windows 7 64bit that got infected. I used several free online antivirus tools to remove the infection. suddenly after installing zonealarm firewall + antivirus and doing a scan my computer will not boot up, but keeps going into a continuous loop of startup repairs.
Please help thank you.

[Advertisements]

Hi what was the infection that you had ?

Download the following three programmes to your desktop :


1. Rufus

For 64bit systems
2. Windows 7 64bit RC
3. Farbar Recovery Scan Tool x64


Insert the USB stick Then run Rufus

Select the ISO file on the desktop via the ISO icon.

Press Start Burn

Then copy FRST to the same USB





Insert the USB into the sick computer and start the computer. First ensuring that the system is set to boot from USB
Note: If you are not sure how to do that follow the instructions Here


When you reboot you will see this.
Click repair my computer


Select your operating system

Select Command prompt


At the command prompt type the following :

notepad and press Enter.
The notepad opens. Under File menu select Open.
Select "Computer" and find your flash drive letter and close the notepad.
In the command window type e:\frst64.exe and press Enter
Note: Replace letter e with the drive letter of your flash drive.
The tool will start to run.
When the tool opens click Yes to disclaimer.

Press Scan button.
It will make a log (FRST.txt) on the flash drive. Please copy and paste it to your reply.
The first time the tool is run, it makes also another log (Addition.txt). Please attach it to your reply.

[Essexboy]

Hi what was the infection that you had ?

Download the following three programmes to your desktop :


1. Rufus

For 64bit systems
2. Windows 7 64bit RC
3. Farbar Recovery Scan Tool x64


Insert the USB stick Then run Rufus

Select the ISO file on the desktop via the ISO icon.

Press Start Burn

Then copy FRST to the same USB





Insert the USB into the sick computer and start the computer. First ensuring that the system is set to boot from USB
Note: If you are not sure how to do that follow the instructions Here


When you reboot you will see this.
Click repair my computer


Select your operating system

Select Command prompt


At the command prompt type the following :

notepad and press Enter.
The notepad opens. Under File menu select Open.
Select "Computer" and find your flash drive letter and close the notepad.
In the command window type e:\frst64.exe and press Enter
Note: Replace letter e with the drive letter of your flash drive.
The tool will start to run.
When the tool opens click Yes to disclaimer.

Press Scan button.
It will make a log (FRST.txt) on the flash drive. Please copy and paste it to your reply.
The first time the tool is run, it makes also another log (Addition.txt). Please attach it to your reply.

[JeffF73]

Hello Essexboy, the infection was a fake antivirus that prevented installing any thing what so ever and executing any exe files.

ok following your steps now

[Essexboy]

Ta that gives me an idea of the area to look in

[JeffF73]

I did the scan just like you mentioned above, It how ever did not create an Addition.txt but did how ever create a FRST.txt here is the results

Attached Files

•  FRST.txt   25.85KB   305 downloads

[Essexboy]

OK that was a zero access hit as well. Lets try to fix it

Download the attached fixlist.txt to the same USB location as FRST

Run FRST as before and press Fix
On completion a log will be saved on the USB
Please post that.

Then restart to normal mode

Download OTL to your Desktop
Secondary link

• Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
  
  
  
• Select All Users
• Under the Custom Scan box paste this in
  
  netsvcs
  BASESERVICES
  %SYSTEMDRIVE%\*.exe
  /md5start
  services.*
  explorer.exe
  winlogon.exe
  Userinit.exe
  svchost.exe
  /md5stop
  dir "%systemdrive%\*" /S /A:L /C
  CREATERESTOREPOINT
  
• Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
  
• When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
• Post both logs

[JeffF73]

I did as follows with your fix and then restarted but unavailable and still having the startup repair loop

[JeffF73]

oops thought I attached the log here it is

Attached Files

•  Fixlog.txt   2.49KB   318 downloads

[Essexboy]

You installed ZA antivirus and then the reboot failed. Did you have one good reboot after ZA was installed or was this the first reboot ?

You have several restore points available, from the repair my computer option could you select the following restore point and see if that enables a reboot

Restore point made on: 2013-08-28 19:14:47

[JeffF73]

I had installed ZA and found out SUPERantispyware was installed on the system and removed that. but some files of SUPERantispyware where left over, preventing my network connection to work. I restarted the computer to no available internet connection. Uninstalled ZA and so I continued to using Glarysoft utility to remove the rest of what was left over of SUPERantispyware then followed to reinstall ZA and I had internet and everything working than went to scan with ZA and after it removed some files I could not restart the computer

Edited by JeffF73, 07 September 2013 - 06:58 AM.

[Essexboy]

Thanks, that means that ZA removed a system file (possibly)

When you try and start the computer are any files referenced or does it go straight to start up repair ?

[JeffF73]

It goes to a screen with the two options of startup repair or normal startup. if I choose either option It goes right to startup repair

[Essexboy]

OK if the restore fails then :

Reboot the computer and immediately press and hold F8
On the menu that appears select
Disable automatic reboot
Reboot the computer and we should get a blue screen with a stop code and maybe a file reference note that down for me please

Also is safe mode available (on the same menu)

[JeffF73]

disabled auto restart and it goes right to startup repair again. no safe mode is not available.

[Essexboy]

OK from the recovery console on the USB select command prompt
At the prompt type the following command followed by enter :

sfc /scannow /offbootdir=c:\ /offwindir=c:\windows

This will take a while as windows will attempt to repair/replace files