Author Topic: Windows 7 Ult 64 bit trapped by BSD and can not get out. (Read 192251 times)

Boggin · « **Reply #175 on:** March 03, 2018, 09:33:55 am »

I've had a reply back regarding your MBAM report and it would appear that you could have serious infections and the advice is as in the reply I got - they may also be able to determine what is legitimate and not of those PuPs.

I have had a look and mirc32.exe is a Trojan (bottom of second attached screenshot). The rest of them, that I can see (there 627 detections most of which I cannot see) seem to be legitimate PUPs, mostly adware and junk. Given the presence of a Trojan on the computer, I would strongly recommend that the user join Bleeping Computer and follow the instructions at this link to open a topic in the Viruses, Trojans, Spyware, and Malware Removal Logs Forum: https://www.bleepingcomputer.com/forums/t/34773/preparation-guide-for-use-before-using-malware-removal-tools-and-requesting-help/.

With that many detections, it is probable that the computer is seriously infested and the user could be at risk of having a keylogger and other more nefarious malware infecting his/her computer. Unfortunately, I will not be able to assist him, as I have seven open logs over there right now and two Juniors about to start Junior Exercise 1 that I teach. The backlog, as of yesterday, was not that bad and he should receive a reply in two or three days at the most.

FreeCat · « **Reply #176 on:** March 03, 2018, 10:22:06 am »

Ok, I deleted the BAD malware at the bottom of page two and noticed the computer was slow after running MalwareBytes. Before deletion, I saved as text the list of the 627 items. Attached here.

I am not sure if there is another log.

However, MalwareBytes said must restart to complete removal. On restart Windows "desktop" comes back ut it is totally black. Mouse moves around screens. Did restart a second time. Same thing. So, I restarted in Safe Mode. Same thing. mouse moves. Black desktop.

Ut Oh.

FreeCat · « **Reply #177 on:** March 03, 2018, 11:26:37 am »

Boggin, JohnC in Bleeping said: Posted Today, 01:51 PM

Tap F8 for advanced boot options and select Use Last Known Good Configuration. Does that work?

And this worked. I have regular desktop back and it seems to work. But, afraid to try Opera and afraid that black screen stuff may come back.

One thing I may not have mentioned: Windows Backup said "Drive H is not connected" However it is clearly present as seen in Windows explorer and in Disk Management app; I can read and write to it.

Boggin · « **Reply #178 on:** March 03, 2018, 02:38:14 pm »

Using LKGC could have put that Trojan back onto the machine, but I'd stick with Bleeping Computer until your machine is infection free and that may resolve the HDD problem, but one thing at a time.

I'll leave your other thread for the time being.

Boggin · « **Reply #179 on:** March 04, 2018, 04:58:19 am »

It would seem that you have opened a thread in the BSOD section and duplicated your query about system image not recognising your separate internal HDD.

Go back to my Reply #175 and follow the instruction in there where your machine can then be checked for malware.

If your machine is infected then that can have an adverse effect on its running and may/not be the cause of Windows not recognising that internal HDD.

FreeCat · « **Reply #180 on:** March 04, 2018, 06:59:03 am »

Hi Boggin,

Sorry if opening a thread on Windows backup not recognizing H drive was wrong. Seems like a different subject to me. I will delete it if you want.

I did run the MalwareBytes and quarantined the one very bad flag but then could not have windows com up without just a black desktop. JiohnC in Bleeping told me to try F8 with LAST KNOW GOOD CONFIGURATION and that worked. But, now stuck.

I am making a backup with EASEUS which is free and seems to be working. Will let you know how it ends.

Boggin · « **Reply #181 on:** March 04, 2018, 07:09:19 am »

Malware removal is a specialised subject and while MBAM is a good program, it had also snagged other items which could impact your machine.

I don't know if they were the cause of your black screen after MBAM had removed that Trojan, but you would be better served allowing the experts on the Bleeping Computer forum clean up your machine.

Last Known Good Configuration restores your computer back to where it was able to boot but in doing so, could have reinstated that infection.

Read through what I had posted and submit the FRST logs on that forum as requested in the malware removal section.

FreeCat · « **Reply #182 on:** March 05, 2018, 07:45:22 am »

Howdy Boggin,

So, I have made and verified a system image backup to H with EASEUS some; it's free; it ran in a reasonable amount of time; seems to have good ratings; pro version does not cost a lot and has more features like restore to different machine, etc. So, it is painful for me to loose my "friend" AOMEI which I have used for this an many other machines flawlessly in the past (including restoring to a different machine.) But, that is life.

So, now that I have an image backup, I wonder if I should do what you suggested:

Press any key when prompted to boot from CD/DVD and you may be presented with an inverse window with Windows Setup (EMS Enabled) highlighted - just press enter then navigate to the Install screen and click on Repair your computer and select Command Prompt.

Enter bcdedit |find "osdevice" and using that partition letter instead of the X I have exampled, enter -

"sfc /scannow /offbootdir=X:\ /offwindir=X:\Windows

For clarity that is a Pipe symbol before find and is the uppercase of \ and note there is a space before each /

When it's done, it will report as for the same when you do a normal sfc /scannow.

Enter exit to close the cmd window, remove the install disk and select Restart."

I have my Win 7 64b Ultimate distribution disc with SP1. (Or, do I need to ge the download one?)

Should I try it within Windows first?

Also, FWIW since I used the MalwareBytes program I have some annoying ByteFence thing that keeps showing up. I will mention that to Bleeping.

So, last question is: Should I go to Bleeping first or just do the SFC?

Thanks, again, Boggin for your assistance.

Boggin · « **Reply #183 on:** March 05, 2018, 08:50:36 am »

So success at last in creating an image

I would go to Bleeping Computer first to get the machine disinfected as it could resolve any problems and then you could run the offboot sfc /scannow, should the infection have caused any damage.

FreeCat · « **Reply #184 on:** March 05, 2018, 11:06:37 am »

Good, Boggin, that is why I waited to hear from you. Early this morning I posted about removing threat and on re-boot weeing only black desktop in BSOD forum. No replies. Should I go to some other place? Or, do they have a tool like Tweaking (Could not find one.) Thanks, again for your help.

Boggin · « **Reply #185 on:** March 05, 2018, 02:20:38 pm »

No, just wait for a reply - it's a busy forum.

Have you complied with the pre-posting requirements regarding posting the FRST logs ?

FreeCat · « **Reply #186 on:** March 06, 2018, 07:17:39 am »

Boggin, I have no idea. I would really like to delete my posts in Bleeping as they are mixed up and asking the wrong questions. I looked for the FIRST requirements but could not find them.

ALSO, Boggin, are you familiar with cc cleaner: https://www.ccleaner.com/ccleaner

Boggin · « **Reply #187 on:** March 06, 2018, 07:48:13 am »

The instructions for FRST are at Step #6 in https://www.bleepingcomputer.com/forums/t/34773/preparation-guide-for-use-before-using-malware-removal-tools-and-requesting-help/ which is the link I had included in a previous reply.

You need to read through that article and when you get a response after posting, you can ask your helper who will be a Mod, to delete that thread/posts in the BSOD section.

Yes, I am familiar with CCleaner and have it installed, but why do you ask ?

FreeCat · « **Reply #188 on:** March 06, 2018, 08:46:20 am »

Thanks, Boggin, I though that maybe it cleans what I have here infected?

Boggin · « **Reply #189 on:** March 06, 2018, 08:49:01 am »

No, CCleaner has a number of tools but antimalware isn't one of them.

FreeCat · « **Reply #190 on:** March 10, 2018, 10:54:29 am »

Still working with Satchfan on getting out bad stuff. Multiple runs of Rogue Killer and Adware program. Will keep you posted.

Boggin · « **Reply #191 on:** March 10, 2018, 12:41:41 pm »

Can you copy & paste a link to your thread so that I can follow it.

FreeCat · « **Reply #192 on:** March 10, 2018, 01:22:41 pm »

Howdy Boggin,

Happy to do so. Did not realize you wanted to see it.
Here:
https://forums.whatthetech.com/index.php?showtopic=131439&page=2#entry885775

Boggin · « **Reply #193 on:** March 10, 2018, 01:32:18 pm »

Thanks - I looked for it on the BC forum but couldn't ID yours.

Boggin · « **Reply #194 on:** March 10, 2018, 01:39:36 pm »

It's certainly cleaned a lot of stuff out.

I noticed it cleaned out FreeFixer - sometimes these type of programs will be seen as PuPs and although I have that installed on my computers, AdwCleaner has never snagged that yet.

Boggin · « **Reply #195 on:** March 18, 2018, 03:42:07 am »

I've just bumped this thread to keep it active and easier to find.

FreeCat · « **Reply #196 on:** March 18, 2018, 10:00:57 am »

Thanks Boggin. Satchafan is still working with me on this. Machine is much faster. I have learned a great deal. Look at the Bleeping thread when you have time: https://forums.whatthetech.com/index.php?showtopic=131439&page=3

And, THANK YOU SO VERY MUCH, Boggin!

Boggin · « **Reply #197 on:** March 18, 2018, 10:33:53 am »

I had a look at it just before my last post - it's certainly moving on.

FreeCat · « **Reply #198 on:** March 19, 2018, 01:23:47 pm »

Hi can I post a file ghere for Satchafan? 18 MB and limit in Bleeping computer.

Boggin · « **Reply #199 on:** March 19, 2018, 03:40:41 pm »

That's okay but ask him as he may have a means of uploading a file that size - he must have dealt with large uploads before.

You can also tell him that after conferring with garioch7 it was me that sent you to the BC forum and while you are being helped there, there will be no input from me.