the weekly whinge

Scenario: heavily infected machine, drive attached to second machine and scanned; infected files deleted but when drive reinserted windows fails to boot with 0x0000007b blue screen STOP message.

Lots of stuff on the internet about this, mostly suggesting hardware changes or faulty hardware. No-one mentions the virus scan. It turns out the reason is one of the files deleted by the virus scan is loaded during early boot.

I went through the list of files loaded by the machine (I was lucky that this page showed the list of files Windows loads on the machine – a Dell Dimension 2400) and checked the file existed on the target – the only one that was on my working install and not on the target was atapi.sys; copying this from the working machine solved the problem instantly.

I guess the sensible thing to do was to keep a track of the files deleted by the virus scan… but if – like me – you were too blasé to do something so sensible, I hope this helps some.

Edit: Note that on vista (unlike XP) you can run sfc /scannow from the recovery console