Windows 7 Start Up Repair Loop, Google Redirector Virus

A customer brought in a laptop that was having multiple issues. The laptop was from Dell (N5110) and fairly new with an Intel i3 processor and Windows 7 Home (64bit).

The first thing I noticed was that it was stuck in a Start Up Repair loop. This only happened after the computer was Shut Down, but not on a Restart.

Once the OS was stable and I was at the desktop I had an error come up.

"GfxUI.exe has stopped working."

This was a simple enough fix with an update of the Graphics Card driver from the Intel web site. I first had to find what type of Graphics Card was being used by going to Device Manager and expanding the Graphics selection and looking at the properties. Looking at the description of the Driver gave me a very basic idea of what kind of card I was using, but to my surprise Intel had that exact driver. (Intel HD Graphics)

While searching for the driver I noticed something odd. My Google searches were returning fine, but my links were being redirected to odd places and advertisements. I was able to download Google Chrome from a cached link and that helped in getting the Virus remover tools I needed to fix this problem.

After installing AVG and Malwarebytes and finding no viruses I had to do some digging and found that Kaspersky created a special Redirector Virus Remover for Rootkit.Win32.TDSS. I downloaded, installed and ran it and took care of that problem.

I then installed all Windows updates and shut down the computer to complete the installation. The Start Up Repair Loop was still in effect. After each Start Up Repair all Windows updates were shown to be needed again.

After much research I found a web post talking about a BIOS mismatch with released Microsoft Windows 7 updates. It was with great relief that I found this, because all other information lead to Format/Reinstall Windows. I never want to do this unless absolutely necessary and after I've cloned the disk.

After the machine went through the Repair and came to the desktop I downloaded the new BIOS from Dell that, which coincidentally, was released not long after the User began having problems with the laptop. Problems began on 7/16 and the user did an emergency back up of the drive. Dell released the BIOS update on 7/24. It was easy enough to install with a simple download, run, install, and reboot.

I was then able to do all Windows Updates, Shut Down the computer and bring it back up with no Windows Start Up Repair kicking in.

The user got the virus removed, new BIOS, new Anti Virus Software, Google Chrome, and all Windows Updates installed. I created a restore point in Windows and labeled it so anyone would know that this point is where all problems were fixed and should be used in case of emergency. I also asked the customer to do another back up and keep it in case of emergency.

This particular person had been my customer for years and knew the importance of back ups from other computer problems they have had. I recommend you do a full back up of the drive you are working on before you do any BIOS updates. BIOS updates are light years beyond what they used to be, but they are still known to crash some systems completely.

A virus infected back up is much better than complete data loss.