Windows 7 Virus Problem Loading Startup Repair File

User downloaded a toolbar to watch football and it gave him a nasty virus that doesn't allow him to boot to the desktop. I had him run some antivirus on it using a bootable DVD antivirus BART PE type thing with some antivirus, but it is still loading this "startup repair file" when it boots.
LVL 1
mrmythAsked:
Who is Participating?
 
davetorresCommented:
Can you start up in safe mode?

My guess is that he has a bootkit. A bootkit is a type of malware that infects the Master Boot Record (MBR).
This infection method allows the malicious program to be executed before the operating system boots. As soon as BIOS (Basic Input Output System) selects the appropriate boot device (it can be a hard disk or a flash drive), the bootkit that resides in the MBR starts executing its code. Once the bootkit receives the control, it usually starts preparing itself (reads and decrypts its auxiliary files in its own file system that it has created somewhere in the unallocated disk space) and returns the control to the legitimate boot loader overseeing all stages of the boot process.

The main feature of a bootkit is that it cannot be detected by standard means of an operating system because all its components reside outside of the standard file systems.
Some types of bootkits hide even the fact that the MBR has been compromised by returning the legitimate copy of the MBR when an attempt to read it has been made.

I would try to use TDSSKiller in safe mode if you can get there. If not, I would slave the hard drive  or attach it as an external HDD and run virus scans using your virus scanner, Malwarebytes, Sophos Anti-Rootkit  and any others that you may have available. (licensed of course)

Good luck
0
 
Thomas Zucker-ScharffSystems AnalystCommented:
Read this article about Malware Fighting Best Practices by younghv, it will give you some tips and advice on why scanning from an alternate boot device may not help.
0
 
IanThCommented:
can you rollback to an earlier system restore point
http://www.howtogeek.com/howto/windows-vista/using-windows-vista-system-restore/
0
 
nobusbiljart fanCommented:
you can try the Kaspersky's Rescue cd : http://support.kaspersky.com/viruses/rescuedisk

note : you find other virus utilities there as well
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.