Have been battling RAT for over 2 years on every computer with every OS OSx, Windows 7,8,8.1,10 & Ubuntu. Installed PRO version and another software program with email address above onto HP laptop running 64bit Windows 10. Unable to provide screen shot because of violent reaction that sounds like science fiction and would seem unbelievable if I hadn't been watching. Steps in process and actions in numerical (chronological) order below.
1: Have had some - not much -success using the free version. Most other software cannot recognize virus much less remove it. Brief symptomology of trojan takes over machine before OS installed and ready to use. Replaces built-in admin and destroys shortcuts for it then replaces with close (not identical) name.. Will allow owner to create admin accounts but they aren't really admin though they state they are (When I open cmd or cmd.exe admin with user and run chkdsk or system file check will receive message "must be admin to run", cannot apply NET USER to accounts for same reason. Lose permission to access most files. Appears to affect DCOM and Svchost. I am unable to turn of rdp in services.msc and advanced shows user account "replicator, "remote desktop admin" other similar names. Caches cannot be cleared, dns & static ip cannot be set.
With PRO
1: Placed order and tried to copy/paste reg.name & no. to paste to goog. docs. Cursor appears on webpage and replaces reg. numbers and my name with \\\\\\\\\\\\\\\\\\. Could not copy/Paste receipt in time.
2. Managed to copy reg.# by hand just before wiped out only for pro, not second program.
Entered reg number into existing free version though I had to fight multiple windows covering area for entry,
3. rec'd message to "restart pc for free>Pro change.
4. Urgent message in free version telling me to stop everything and reboot into safe mode blocked from closing programs and re-starting by multiple random windows blocking choice
5. Turned PC off using switch, no other alternative.
6. Tried booting into SAFE but BIOS takes over screen flashing boot selection it obviously wants me to use. Other boot options were internet and EFI neither worked so had to use the hard drive boot I was being forced to.
7. PC boots to screen but cannot run program- any program actually. Checked task manager, "system interrupt" is only service running besides task manager. Try Services.msc cannot start any service - most services stopped, notable exceptions "RDP manager" and "dcom *.*" almost every service shown as dependency of rdp. RDP and DCOM options grayed out unable to stop.
8. P.C now has gray screen. I'd like to hear suggestion before trying anything.
Often "My Documents" files are hidden read-only but it is possible that I have 1 or 2 logs free version services generated. Currently can't even get to Windows. I will likely need to reset PC, usually do almost weekly. Hope I can reuse registration code. Can we somehow keep baby but discard bathwater.
Sorry about length, thanks for any help.
Bill S
