kevinf80

Thanks for the update, continue to clean up... Uninstall Sophos AV http://www.askvg.com/how-to-completely-uninstall-remove-a-software-program-in-windows-without-using-3rd-party-software/ Also delete this folder if still present: C:\ProgramData\Sophos Next, Download "Delfix by Xplode" and save it to your desktop. Or use the following if first link is down: "Delfix link mirror" If your security program alerts to Delfix either, accept the alert or turn your security off. Double Click to start the program. If you are using Vista or higher, please right-click and choose run as administrator Make Sure the following items are checked: Remove disinfection tools <----- this will remove tools we may have used. Purge System Restore <--- this will remove all previous and possibly exploited restore points, a new point relative to system status at present will be created. Reset system settings <--- this will reset any system settings back to default that were changed either by us during cleansing or malware/infection Now click on "Run" and wait patiently until the tool has completed. The tool will create a log when it has completed. We don't need you to post this. Any remnant files/logs from tools we have used can be deleted… Next, Run Windows Disk Clean Up Utility - https://neosmart.net/wiki/disk-cleanup/ Read the following links to fully understand PC Security and Best Practices, you may find them useful.... Answers to Common Security Questions and best Practices Do I need a Registry Cleaner? Take care and surf safe Kevin...

Can you run FRST scan once more, I want to see if Bing has returned.. Run FRST one more time, ensure all boxes are checkmarked under "Whitelist" but only Addition.txt under "Optional scan" Select scan, when done post the new logs. "FRST.txt" and "Addition.txt"

There are two replies from unauthorized posters, they may not show in the thread to you. If i`m correct then the file "fixlist.txt" will show in reply #8 to you and reply #10 to me... Yes Kev or Kevin, any one is good..

Apologies, I should have made you aware of the format shown from the Recovery Environment. X:\ is what you see, not C:\ The userinit value in your screenshot is correct. That makes it really difficult. Userinit is not loading, hence it will not boot correctly, as the value is correct it tends to indicate registry damage. That will not be applicable to Malwarebytes, it does not make such changes where damage is possible... Have you tried booting your system to Safemode...? Do you have an Installation DVD or USB for Windows 10...?

Thanks for the update BlueChronicle, Continue to clean up: Uninstall Sophos AV http://www.askvg.com/how-to-completely-uninstall-remove-a-software-program-in-windows-without-using-3rd-party-software/ Also delete this folder if still present: C:\ProgramData\Sophos Next, Download "Delfix by Xplode" and save it to your desktop. Or use the following if first link is down: "Delfix link mirror" If your security program alerts to Delfix either, accept the alert or turn your security off. Double Click to start the program. If you are using Vista or higher, please right-click and choose run as administrator Make Sure the following items are checked: Remove disinfection tools <----- this will remove tools we may have used. Purge System Restore <--- this will remove all previous and possibly exploited restore points, a new point relative to system status at present will be created. Reset system settings <--- this will reset any system settings back to default that were changed either by us during cleansing or malware/infection Now click on "Run" and wait patiently until the tool has completed. The tool will create a log when it has completed. We don't need you to post this. Any remnant files/logs from tools we have used can be deleted… Next, Run Windows Disk Clean Up Utility - https://neosmart.net/wiki/disk-cleanup/ Read the following links to fully understand PC Security and Best Practices, you may find them useful.... Answers to Common Security Questions and best Practices Do I need a Registry Cleaner? Take care and surf safe Kevin...

Thanks for those logs, continue: Download attached fixlist.txt file (end of reply) and save it to the Desktop, or the folder you saved FRST into. "Do not open that file when running FRST fix" NOTE. It's important that both FRST and fixlist.txt are in the same location or the fix will not work. Open FRST and press the Fix button just once and wait. The tool will make a log on the Desktop (Fixlog.txt) or the folder it was ran from. Please post it to your reply. Post that log, also let me know if there are any remaining issues or concerns... Thanks, Kevin fixlist.txt

Yep off to bed, will catch up later..

Yes time is late for me, i`m in the UK and local time for me is 20 after midnight... Continue with the following... Boot sick PC to Recovery Environment, if you are unsure of that action have a read at the following link, maybe bookmark for future reference... https://www.tenforums.com/tutorials/2294-boot-advanced-startup-options-windows-10-a.html Next, From the Windows 10 Tutorial you should get access to the Advanced Startup Options at boot for Windows 10 From that window select "Troubleshoot" From the next window select "Advance Options" From that Window select "Command Prompt" In the command window type in regedit and press Enter. The registry editor opens. Expand the following key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Double click direct on Winlogon Look to the right pane you will see the entry "Userinit" you should see this value under the "Data" column C:\Windows\System32\Userinit, Note the comma after Userinit If the value is different "Right" click on "Userinit" and select "modify" In the new box change value to C:\Windows\System32\Userinit, select ok and close out regedit (Make sure to include the comma after Userinit) You should now be back to Command Prompt.... type exit, hit enter then reboot...

Thanks for that log, we are back to same place. All entries correct except for Useinit, that cannot be restored. I want you to access regedit via recovery environment, process is similar to what you have been doing so I think you will be ok.... Back shortly, need to compile the correct script for you to follow....

Thanks for that log, continue: From your spare PC Save the attached file fixlist.txt to your flash drive, same place as FRST. Plug Flashdrive back into Sick PC, Run System Recovery Options as you did to get the log. Run FRST and press the Fix button just once and wait. The tool will make a log on the flashdrive (Fixlog.txt) please post it to your reply. fixlist.txt

Thanks...

Can you run a scan again, same as reply #4, need to have look at a fresh log see why your system will not boot...

Does your system boot correctly now..?

You`ve used the first fixlist not the second one I attached to reply #8...

There are no guarantees unfortunately...

Yes run this fix exactly as you did with the first fix. The current problem is "Userinit" key could not be restored, hence still not booting correctly. This current fix should correct that problem... Also for the record you are definitely not dumb, you`ve managed ok in my opinion...

Your system is 64bit, you should be using FRST64

Thanks for that log, continue: From your spare PC Save the attached file fixlist.txt to your flash drive, same place as FRST. Plug Flashdrive back into Sick PC, Run System Recovery Options as you did to get the log. Run FRST and press the Fix button just once and wait. The tool will make a log on the flashdrive (Fixlog.txt) please post it to your reply. Re-boot sick PC, any change...? fixlist.txt

Thanks for that log, continue: From your spare PC Save the attached file fixlist.txt to your flash drive, same place as FRST. Plug Flashdrive back into Sick PC, Run System Recovery Options as you did to get the log. Run FRST and press the Fix button just once and wait. The tool will make a log on the flashdrive (Fixlog.txt) please post it to your reply. Re-boot sick PC, any change...? fixlist.txt

Thanks for the update, continue: On spare PC downoad and save FRST to the Flash drive, make sure to get the correct version, if you are unsure d/l and save both, only the correct one will run. Do not plug Flash Drive into sick PC until booted to Recovery Environment. http://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/ Next, Boot sick PC to Recovery Environment, if you are unsure of that action have a read at the following link, maybe bookmark for future reference... https://www.tenforums.com/tutorials/2294-boot-advanced-startup-options-windows-10-a.html Next, From the Windows 10 Tutorial you should get access to the Advanced Startup Options at boot for Windows 10 From that window select "Troubleshoot" From the next window select "Advance Options" From that Window select "Command Prompt" Ensure to plug the flash drive into a USB port... You should now be in Recovery Environment with the Command Prompt Window open...... Continue with the following: Select Command Prompt In the command window type in notepad and press Enter. The notepad opens. Under File menu select Open. Select "Computer" or "My PC" and find your flash drive letter and close the notepad. In the command window type E:\frst64 or E:\frst depending on your version. Press Enter Note: Replace letter E with the drive letter of your flash drive. The tool will start to run. When the tool opens click Yes to disclaimer. Press Scan button. It will make a log (FRST.txt) on the flash drive. Please copy and paste it to your reply. Leave the infected PC in Recovery mode, post the produced log from your flash drive via the spare PC.... Thank you, Kevin..

Thanks for the update...

Hello shanhendo and welcome to Malwarebytes, Which version of Windows do you have installed, do you have access to a spare PC and USB flashdrive 4gb or above.. Thank you, Kevin..

Can you run FRST and post fresh logs...

Did you also run Microsoft's " Malicious Software Removal Tool"

Is attached to reply #10