What to do with my computer? (solved)

[Peaches]

I ran the system information program that came with Windows Repair (All in One) & I am sending a attachment of the results I got.  I know just enough about computers to get myself in trouble & that is real close to nothing.  Please tell me what that report means & if I need to do more.   Thank You

P.S.
  What is your thoughts on this program?

[Willy2]

- Can you give a better description of what is wrong ?
- Run Piriform's Speccy and select "file", "Publish snapshot" and post the link that pops up in you next reply.

[Peaches]

I hope this is what you asked for.  & Thank You!!!   

http://speccy.piriform.com/results/vlHn4H0Subz3IZ6RhY5TpVE

I am not sure what happened but my PC all of a sudden said to call this # something bad happen it was Microsoft tec guys they remotely did stuff to "Fix" my PC  "I go look for that report"  Ohh I had just found & cleaned a trogen before this happened.
I found this (attachment) dont say much at least to me anyway.  Today I was online & windows says it is closing & restarting.    Please forgive me for not understanding or remembering many things I have TBI (Tramatic Brain Injury) & it effects most of my cognitive ability's.   

[Boggin]

That report said you had a 30 day warranty on whatever they did, but the fact they say they also added some security things would make me suspicious - they weren't Microsoft Support techs - where did you get their phone number from and why did you contact them in the first place or was that the pop up you got to call their number.

It sounds as if you have fallen victim to a scam so under no circumstances do any online sensitive stuff on that computer.

This includes online banking or anything that requires you to use an username or password such as e-mails.

Did you find that Trojan after they affected the "repairs" ?

It's highly unlikely you will have any restore points to go back to before you let these guys loose on your machine as they probably deleted them, but you could check.

Are you able to boot up into the Advanced Boot options to select Safe Mode with Networking to see if the computer stays on then.

Depending upon the make of computer, tapping F8 as you switch on will bring those options up and you use the cursor keys to select whichever option then press enter.

You can then check to see what restore points you have, but fortunately, if the machine works in Safe Mode then you will be able to use the Windows Repair program.

If you can work in Safe Mode then click on Start - type msconfig and press enter.

Click on the Startup tab then on Disable all then click on the Services tab, check the box to Hide all Microsoft services and then click on Disable all - but you must hide all Microsoft services first before the Disable all.

Click Apply - OK then Restart now to see if it still shuts down in normal mode.

Depending upon which antivirus program you are using, as soon as you click on Apply, its box can auto recheck to reinstate itself so that is nothing to worry  about, but if any other box also does that - then let us know.

While I haven't compared the status of all of your services to my Win 7 ones, the Credentials Manager is showing as Started and Manual on mine but stopped on yours.

This is a security service, so if you are able to use your computer in Safe Mode, go Start - type services.msc and press enter.

Scroll down to Credentials Manger, click on it and then on Start in the upper left pane to see if it will start.

What are you using to post on now ?

 

[Peaches]

I am using my computer to post here.   I looked & the earliest restore point is the 25th, after they did there thing  I will go & try safe mode now & it was a pop up with there number on it. No the trogen was before they did any thing.   

[Boggin]

If you have access to another computer then it would be advisable to change your passwords and if you use online banking, then contact your bank and tell them you think your computer may have been compromised which should alert them to check for any unusual withdrawals.

So how often does it auto shutdown as you are able to use it ?

[Peaches]

Yes I can go to my friends house & use there PC.   since they worked on my PC it only happened that 1 time.  I can not start the internet in safe mode it says ~ error 711 operation can not finish because it could not start Remote Access Connection Manager in time. ~   I have attached Speccy snapshot after doing what was asked by you. && Thank You for trying to help me.

I just went to services & credential manager was stopped again so I started it

I went to friends house (next door) & there hasnt been any withdraws or odd amounts taken out of bank account.

[Boggin]

Just a sec - I just need to reboot to effect a repair following testing a link I had posted but as it removed what I had written, I'll have to do that again

[Boggin]

Don't forget to change your passwords.

What these people do after scamming people to contact them is to put bits onto your computer either to have you call them back to effect other "repairs" or put malware onto the computer such as a key logger so that they can harvest your sensitive info and then sell it on.

They've obviously done something to stop you booting up into Safe Mode as that would have isolated whatever they did and may be listed as an item in msconfig or as a program in Programs and Features.

However, see if you can download and run the free ESET Online Scanner. http://www.eset.com/us/online-scanner/

Click on Advanced and check all of the boxes and I think there are separate boxes to check for PuPs so that it treats those as malware as well.

Checking all of the boxes will increase its scanning time substantially, but as it's not known what has been put onto your computer, then an in depth scan would be prudent.

Disable your antivirus program immediately before hitting the Scan button.

It has an auto uninstall button on completion as it isn't normally a program that you would keep installed.

When it has done its thing, see if you can boot up into Safe Mode and if not, run this ESET.exe which is designed to repair/reinstate services normally corrupted by infections - sometimes it works and sometimes not, but give it a go if necessary.

http://kb.eset.com/library/ESET/KB%20Team%20Only/Malware/ServicesRepair.exe

This is the one that took out my previous posting and had me reboot

[Peaches]

Before I get side tracked (happens lots)     I can get into safe mode, I just cant get internet when I am in safe mode.  I such a easy target!!    Since wreak (TBI) I trust everybody & be-leave everything  I will download & run the eset program & then come back here & see if you still want me to run the other one.  Again THANK YOU!!!!   

[Boggin]

Once the scan has completed, check to see if you can get Safe Mode with Networking without that 711 error and that will determine if you have to run the ESET.exe - but it won't cause any harm to run it anyway.

I'm still here after running it on a serviceable machine

[Peaches]

lol  Good to know you are still here.  I had 54 Threats Found     It deleted 53 of them & this one C:/users/allusers/Installmate{ bunch of numb & letters}_setupx.dll  it is in quarantine.  OK I of to see about safe mode w/net     THANK YOU!!!!!  Humm I forgot what I attached   

I still can not get internet in safe mode  I looked at the services & for remote procedure call to run Telephony has to be running & it was not    Ok  now I go run that eset program   
Sorry I had wrong thing above I meant Remote Access Connection Manager & it needs Telephony & Secure Socket Tunneling Protocol service to be running & both are still not running after running the service repair from eset.    HUMMMM  A different problem I have is   In Device Manager under network adapters my ~ Microsoft Teredo Tunneling Adapter can not start  error code 10.  Would that be any part of not getting internet in safe mode??    Attached repair notes from eset && I deleted that one they left

[Boggin]

Do you have HitmanPro.Alert v3.0 installed - that is a browser guard.

This has been know to disable the Teredo Tunneling adapter.

If you don't, then do you feel comfortable following the steps in this article to repair Teredo.

http://www.wintips.org/teredo-tunneling-device-cannot-start-code-10-fix/

From a Google, that Installmate is part of WinPatrol's uninstaller - do you have WinPatrol installed ?

The Remote Access Connection Manager and Telephony are on demand items and their default setting is Manual without being started.

However, when you click on Remote Access and then Start, it should also start Telephony.

RPC should be running but not necessarily Telephony.

I'm in the process of checking if disabling Teredo will prevent me from also getting Safe Mode with Networking of if that would affect those other services on another laptop, but I'm having to wait until my Norton 360 brings itself back up to date as it's been a few days since I had that machine on - but thought I'd post something for you to be getting on with.

There is another anti adware program I'd like you to run, but see if you can get Teredo reinstated first.

That ESET log is the same as it produced for me and saw it didn't include the Remote Access, but that other link is a remnant of those "techs" remote hook up to your machine and that should be listed in Programs and Features for you to uninstall.

[Boggin]

Update.

With Teredo disabled I had no problems booting up into Safe Mode with Networking and Remote Access Connection and telephony remained in their default state of Manual but not started - so something else is preventing that for you.

Can you go Start - type msconfig and press enter and under the Boot tab can you check to see if it the same as mine.

[Peaches]

Ok I will toss that one file & check on that other stuff back in a bit    I  did this ~Can you go Start - type msconfig and press enter and under the Boot tab can you check to see if it the same as mine.
It is exactly the same as yours.
No I dont think I have WinPatrol  & Hitmanpro them guys left it & it is a trial version I will look at the link you asked me if I ok with doin it & be back    OMG!!!!!      NO way I would mess that up so fast it scary.   BUT I have a friend that lives next door & he knows a lot more then I do about PC's, I can go ask him to do it for me  "looks at clock"  only it will be a few hours before I dare go over there    Should I let Hitman pro go then?? them guys said I should have a better internet security then what I do "Shame Faced" if i would stop downloading games from certain sites I would have less found threats on my PC.   I attached what services are disabled in normal mode as of now.  I am headed over to ask John to come help me so he may be on here in my acc.

UPDATE:  John is coming over in a few & he will be on my acc. in here also.  I will make sure he tell's you he is here not me.  Boggin I want to THANK you so much for your ability to put things in wording I understand  I know I not easy to help with the TBI   

[Boggin]

There's just one service there that shouldn't be disabled but set to Manual and that is Internet Explorer ETW etc.

Right click on the service and select Properties then use the dropdown to change it from Disabled to Manual - OK

There's no need to start it.

The bit I did ask you for was in msconfig.

To view this, go Start - type msconfig and press enter.

Click on the Boot tab and then compare yours to mine.

To close it off, just click OK.

I'm going have to shoot off shortly to make my evening meal as it's 6:15pm here in the UK.

[Boggin]

Was your friend able to help you to reinstate the Teredo Tunneling Adapter and have you changed the status of that service ?

[Peaches]

OMG no he got stuck in safe mode & couldnt get out of safe mode no matter what he tried, PC is really acting bad no mater what you told the pc to start in it always started in safe mode w/internet but that still didnt work.  & No he did not do the reinstate.  Even using the Windows 7 disk it wouldnt do anythintg.  I am at his house using his wife's PC so I can let you know I will be taking it to the PC Doc. tomorrow, it needs cleanned anyway & I have learned the hard way that I cant do it I have tried & broke stuff & had to have it replaced    Thanks so much for trying to help me.  I will pop back in when I get my PC back & let ya know what all he had to do to it.  You have a GREAT night.   Peaches

[Boggin]

When you go Start - type msconfig and press enter, under the Boot tab you have options to include with Safe Mode, but you should never check the box to make any of the Boot modes permanent as that setting cannot be undone.

Is this how your friend got the machine to boot up into Safe Mode with Networking ?

It's possible that tapping F8 as you switch on and select Last Known Good Configuration or Repair your Computer to navigate to the Recovery Environment to select Startup Repair may have been able to do something for it, but without having hands on it's difficult to advise what would work.

Given the circumstances, taking it to a repair shop is probably the best thing to do and will look forward to your update when you get it back.

Don't forget to tell the tech everything that has been done done, including that scam.

[Peaches]

As of Friday (when I talked to the pc fix it guy)  it looking like he may have to do a clean reinstall,     Just a quick pop in talk more when I get it back && I do hope that is soon.   OHHH  any suggestions for a antivirus program to use? It looks like I need more than What came with pc.     

[Boggin]

What AV came pre-installed on the computer ?

Those 54 items that ESET found may have been a result of whatever those "techs" put on and some, just unwanted programs that have slipped in with anything you may have installed and an AV program wouldn't have stopped either of those.

Can you remember the type of files ESET said it had found for removal ?

Is the repair tech going to back up your personal stuff for you prior to the clean install ?

If your computer has a recovery partition then it could be factory reset with that and that would normally put things back the way they were.

If he does a clean install then you'll want at least the product key if not an install disk as well should you ever need to perform a repair install and then you won't have to take it back to him for any future repairs.

[Peaches]

Microsoft security Essentials was the only thing I had I think anyway.  No I dont remember how many ESET found, it was over 100 though.  I talked to him this AM & he had backed it up. No my PC dont have that recovery partition. I will Ask him about the product key & install disk when I go back home  at my MOM's right now.  It will be day after tomorrow sometime before I get it back.      Bye till then.

[Peaches]

I got my PC back yesterday &&    It was just like starting all over on settings & things & then windows 10 wanted to download so I did that today.  He added a 2nd drive to my PC  backup goes there. I so lost & I lost my internet lil picture down by the clock  dont know what I did to do that &&& where is the control panel in windows 10???   I dont do change well at all & this windows 10 is really buggin me.   

What do I put in my subject line? to show it isnt a problem any more?? 

[Boggin]

Just put (Solved) next to the thread title.

[Peaches]

OK & thank You very much for everything!