FBI Money Pack

[wurman]

Hit with the FBI ransom page. Went to safe mode and clicked on Malwarebytes for a quick scan. FBI Page removed. Went back in safe mode to check removal with full scan.  Safe mode shut down. Googled safe mode shutdown and went to MBAM Chameleon. Installed and ran. Prevented. Re-installed Malwarebytes, opened safe mode, and started full scan. A few minutes in Safe mode shut down. Followed some other instructions to command prompt a new admin. user. Cannot get user profile to open and establish. Followed instructions to check for user profiles and the "new" admin was not in list. Came to this forum and followed instructions, again, from the FAQs and the pinned posts. Downloaded Malwarebytes again. Opened in safe mode. Clicked on Malwarebytes icon. The program would not open and Windows offered to find the problem. Nothing happened. Malwarebytes had been removed. Came here.

[MrCharlie]

What's the operating system???

 

MrC

[wurman]

Windows 7 64-bit on a 5+ year old Fujitsu laptop.

[MrCharlie]

See if you can do this:

Please download Farbar Recovery Scan Tool (FRST) and save it to a folder.

(use correct version for your system.....Which system am I using?)

FRST <----for 32 bit systems

FRST64 <----for 64 bit systems

• Double-click to run it. When the tool opens click Yes to disclaimer.
• Press Scan button.
• It will make a log (FRST.txt) in the same directory the tool is run. Please copy and paste it to your reply.
• The first time the tool is run, it makes also another log (Addition.txt). Please attach it to your reply.

If the logs are large, you can attach them:

To attach a log:

Bottom right corner of this page.

New window that comes up.

MrC

[wurman]

If this worked, FRST and Addition are attached.

FRST.txt

Addition.txt

[MrCharlie]

Unfortunately the logs look OK.

It looks like you have tried all kinds of scanners...you should have come here first, would make it alot easier.

Have you tried system restore, if not please do, you have a bunch of restore points available.

If you already did........

Please download and run ComboFix.

The most important things to remember when running it is to disable all your malware programs and run Combofix from your desktop.

Please visit this webpage for download links, and instructions for running ComboFix

http://www.bleepingcomputer.com/combofix/how-to-use-combofix

Please make sure you click download buttons that look similar to this, not "sponsored ad links":

Ensure you have disabled all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

Information on disabling your malware programs can be found Here.

Make sure you run ComboFix from your desktop.

Give it at least 30-45 minutes to finish if needed.

Please include the C:\ComboFix.txt in your next reply for further review.

 

---------->NOTE<----------

If you get the message Illegal operation attempted on registry key that has been marked for deletion after you run ComboFix....please reboot the computer, this should resolve the problem. You may have to do this several times if needed.

MrC

[wurman]

No, I've not run system restore, but made the restore point "bugout" per instructions with creating new user by command prompt.

 

I'll try to get back before when the FBI Money page popped up.

 

Thanks for the help. It will be a while before  reply here, again.

[wurman]

Good Morning, etc.

Went to bleeping computer & downloaded Combofix. Ran it as per instructions as printed out. The first time, the computer shut down at stage 48. The 2nd time it ran until the log file and stopped--cursor just blinked under the "combofix.txt" line. I uninstalled combofix last night. Sequentially, the malware tries to change my search setting from IE10 to some other thing. This morning, went to history and clicked on bleeping computer and the search will not open--won't even go to the website.

 

I came here through my email--Outlook/Live.

 

I'm going to try system restore . . . way back.

 

No reply to this expected. Will get back to you later after testing various restore points in the past.

[wurman]

The malware prevents system restore. This is the message: "System restore did not complete successfully. Your computer's system files and settings were not change. Details: System Restore failed to extract the file (C:\) from the restore point. An unspecified error occurred during System Restore. (0x8000ffff)"

 

Choose a different restore point, etc. But 3 have not worked.

[wurman]

OK, more. Remembered another login user that was set up on D: with a partition for Fujitsu system recovery. Opened it, went to your email, linked to Bleeping Computer, accessed ComboFix, and ran it. The system worked this time. Log file should be attached.

New Text Document.txt

[MrCharlie]

That looks OK, lets try FRST in recovery mode, info on doing that at the link below:
http://maddoktor2.com/forums/index.php/topic,55928.0.html

Post back the log, MrC

[wurman]

The maddoktor link brings up "this page can't be displayed."

 

I'm on another laptop. My infected Fujitsu can't open google and won't let me even access msn/bing.

[MrCharlie]

Here you go:

For x32 (x86) bit systems download Farbar Recovery Scan Tool and save it to a flash drive.

For x64 bit systems download Farbar Recovery Scan Tool x64 and save it to a flash drive.

Plug the flashdrive into the infected PC.

Enter System Recovery Options.

To enter System Recovery Options from the Advanced Boot Options:

• Restart the computer.
• As soon as the BIOS is loaded begin tapping the F8 key until Advanced Boot Options appears.
• Use the arrow keys to select the Repair your computer menu item.
• Select US as the keyboard language settings, and then click Next.
• Select the operating system you want to repair, and then click Next.
• Select your user account an click Next.

To enter System Recovery Options by using Windows installation disc:

• Insert the installation disc.
• Restart your computer.
• If prompted, press any key to start Windows from the installation disc. If your computer is not configured to start from a CD or DVD, check your BIOS settings.
• Click Repair your computer.
• Select US as the keyboard language settings, and then click Next.
• Select the operating system you want to repair, and then click Next.
• Select your user account and click Next.

On the System Recovery Options menu you will get the following options:

• • Startup Repair

    System Restore

    Windows Complete PC Restore

    Windows Memory Diagnostic Tool

    Command Prompt

• Select Command Prompt
• In the command window type in notepad and press Enter.
• The notepad opens. Under File menu select Open.
• Select "Computer" and find your flash drive letter and close the notepad.
• In the command window type e:\frst.exe (for x64 bit version type e:\frst64) and press Enter

  Note: Replace letter e with the drive letter of your flash drive.

• The tool will start to run.
• When the tool opens click Yes to disclaimer.
• Press Scan button.
• It will make a log (FRST.txt) on the flash drive. Please copy and paste it to your reply.

MrC

[Maurice Naggar]

Due to the lack of feedback this topic is closed to prevent others from posting here. If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.

Other members who need assistance please start your own topic in a new thread. Thanks!