Tried Malwarebytes & Avast But Now Cannot Boot Even In Safe Mode

Hi annber

Not being able to boot into Safe Mode complictes matters slightly, but we can still get a look at the system.
As you are able to post here, i take it that you have access to another computer.
We will need to download a program using this system and then transfer the program by way of USB stick.
A quick look at the specs for the infected system seem to show that the system is running a 64bit operating system.
If this is so, please use the instructions for a 64bit system below.
I've also included the download for the 32bit version just in case.....

For x32 (x86) bit systems download Farbar Recovery Scan Tool 32-Bit and save it to a flash drive.
For x64 bit systems download Farbar Recovery Scan Tool 64-Bit and save it to a flash drive.

Plug the flashdrive into the infected PC.

Enter System Recovery Options.

To enter System Recovery Options from the Advanced Boot Options:

• Restart the computer.
• As soon as the BIOS is loaded begin tapping the F8 key until Advanced Boot Options appears.
• Use the arrow keys to select the Repair your computer menu item.
• Select US as the keyboard language settings, and then click Next.
• Select the operating system you want to repair, and then click Next.
• Select your user account an click Next.

To enter System Recovery Options by using Windows installation disc:

• Insert the installation disc.
• Restart your computer.
• If prompted, press any key to start Windows from the installation disc. If your computer is not configured to start from a CD or DVD, check your BIOS settings.
• Click Repair your computer.
• Select US as the keyboard language settings, and then click Next.
• Select the operating system you want to repair, and then click Next.
• Select your user account and click Next.

On the System Recovery Options menu you will get the following options:

• • 
    Startup Repair
    System Restore
    Windows Complete PC Restore
    Windows Memory Diagnostic Tool
    Command Prompt
• Select Command Prompt
• In the command window type in notepad and press Enter.
• The notepad opens. Under File menu select Open.
• Select "Computer" and find your flash drive letter and close the notepad.
• In the command window type e:\frst.exe (for x64 bit version type e:\frst64) and press Enter
  Note: Replace letter e with the drive letter of your flash drive.
• The tool will start to run.
• When the tool opens click Yes to disclaimer.
• Press Scan button.
• It will make a log (FRST.txt) on the flash drive. Please copy and paste it to your reply.

Thanks

 

Hi annber

The report isn't showing any reason for the problems.

I went by the info in your first post:

You say in the first post that Avast threw up about the infections.
Your report is showing entries for Norton.... how many Anti Virus programs do you have installed?

This is why we always say..
P2P Warning
Please note that as long as you're using any form of Peer-to-Peer networking ( Frostwire, Limewire, Bit Torrent etc.) and downloading files from non-documented sources, you can expect infestations of malware to occur.
Once upon a time, P2P file sharing was fairly safe. That is no longer true.
P2P programmes form a direct conduit onto your computer, their security measures are easily circumvented, and Malware writers are increasingly exploiting them to spread their wares onto your computer. Further to that, if your P2P programme is not configured correctly you may be sharing more files than you realise. There have been cases where people's Passwords, Address Books and other personal, private, and financial details have been exposed to the file sharing network by a badly configured programme.

Many of the programmes come bundled with other unwanted programmes, but even the ones free of any bundled software are not safe to use.
When you use them you are downloading software from an unknown source directly onto your computer, bypassing your Firewall and Anti-Virus software. Hardly surprising then that many of these Downloads are being targeted to carry infections.

You may decide to continue P2P sharing, but keep in mind that this practice may be the source of future malware infestation.
If we clean your computer of infection, and you return to us a short time later with an infection contracted by the use of P2P programmes, we may refuse to help you.

If do you do decide (unwisely) to keep these programs, please refrain from using them until we have finished cleaning your system.

I see that there have been no restore points made since late September..... did you turn them off?

If the system won't boot at all, we could try one of these restore points and see if the system will boot up.
If we can't get the system to boot up, getting your pics etc off is not really a problem we can always fall back onto another program that will allow you to retrieve them.

 

Hi annber

Ok, i see where the confusion has arisen now.
Let's just work on one system for now and try and avoid any further confusion.

Because of the running problems, you may be better to download these two programs to another system and them transfer them be way of a usb stick.
By all means try and download them using the infected system, but use the usb stick transfer if you have problems.
You can use Safe Mode with Networking to download them if you can't get the internet to work on the infected system.
Remember not to reboot the system between running RKill and Combofix.

Step 1
Please download RKill.com to your desktop from the following link.:
Rkill download link
Download page will open in a new tab or browser window.
When at the download page, click on the Download Now button to download RKill.com and save it on your desktop.
Once it is downloaded, double-click on the rkill.com icon.
If you get a message that rkill is an infection, do not be concerned. This message is just a fake warning given by the malware when it terminates programs that may potentially remove it. If you run into these infections warnings that close Rkill, a trick is to leave the warning on the screen and then run Rkill again. By not closing the warning, this typically will allow you to bypass the malware trying to protect itself .

If the malware is persistant, you may have to run RKill a number of times.
When it has finished, the black window will automatically close and you can continue with the next step.

If you continue having problems running rkill.com, you can download iExplore or eXplorer.exe from the rkill download page. Both of these files are renamed copies of rkill.com, which you can try instead. Please note that the download page will open in a new browser window or tab.

Note
Please do not reboot your system until you have completed the following step, or the Malware will restart itself:


Step 2
Download Combofix from any of the links below. You must rename it before saving it. Save it to your desktop.

Link 1
Link 2






This is an example, you may rename ComboFix to anything you want.

• Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with the running of ComboFix.
  For more information read:
  How To Temporarily Disable Your Anti-virus, Firewall And Anti-malware Programs
  
  Then:
  
  Double click on Combo-Fix.exe & follow the prompts.
  
  Vista/Win7 users should right click on the icon and select Run as Administrator.
  
• As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
  
  If running Vista/Win7, you will not see the recovery console screens as they are Win XP related
  
• Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.



Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:



Click on Yes, to continue scanning for malware.

Note:
Do not mouseclick combofix's window while it's running. That may cause it to stall

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.

Thanks

 

Hi annber,

No rush, just post the results when you're ready.

 

So the error message was blank? .... unusual.

Ok, let's run this program.
Basically you need to download this program, burn it to a disc and then use this to restart your system.
It will use a different type of Operating system so won't be effected by any malware.
It should give us a good report of your system.
You can use this as well to get any Files, Pics, etc off the system.
It should also give you internet access.
Obviously you will need to use a different computer to download the program.

Please print these instruction out so that you know what you are doing.

• Download OTLPENet.exe to your desktop
• Ensure that you have a blank CD in the drive
• Double click OTLPEStd.exe (the downloaded icon) and this will then open imgburn to burn the file to the CD
• Reboot your bad system using the boot CD you just created.

.
Note : If you do not know how to set your computer to boot from CD follow the steps here

• As the CD needs to detect your hardware and load the operating system, I would recommend a nice cup of tea whilst it loads
  .
  
• Your system should now display a Reatogo desktop.
• Note : as you are running from CD it is not exactly speedy
• Double-click on the OTLPE icon.
• Select the Windows folder of the infected drive if it asks for a location
• When asked "Do you wish to load the remote registry", select Yes
• When asked "Do you wish to load remote user profile(s) for scanning", select Yes
• Ensure the box "Automatically Load All Remaining Users" is checked and press OK
• OTL should now start.
• Press Run Scan to start the scan.
• When finished, the file will be saved in drive C:\OTL.txt
• Copy this file to your USB drive if you do not have internet connection on this system.
• Right click the file and select send to : select the USB drive.
• Confirm that it has copied to the USB drive by selecting it
• You can backup any files that you wish from this OS
• Please post the contents of the C:\OTL.txt file in your next reply.

Thanks

 

Ok annber, thanks for keeping me informed.