maybeadinosaur Posted February 3, 2015 ID:935747 Share Posted February 3, 2015 First of all, thank you to everyone that has been helping with this issue - I have been reading others' posts and responses and doing my best to utilize the information but something went wrong. My laptop's OS is Windows 8 but it will no longer load. Malwarebytes and Windows defender did find malware and removed it but many, many files were already encrypted, though I didn't know what the issue was at the time. After shutting down the computer, I've found that it will no longer load windows properly. It attempts to automatically repair, fails showing error "Critical_Process_Failed", reboots. When using the recovery system, I cannot restore, repair, refresh, etc. It seemed as if all was lost and my only option was a wipe and fresh installation. At the moment, I've found some information about using Windows Defender offline and running a complete scan, as a quick scan found nothing. Id rather not do a fresh install if it can be avoided, so as to save files I have not backed up, but my other concern is that Cryptowall also infected a micro usb drive, which has hundreds of now-encrypted photos. Any help that can be give is appreciated. Thanks Link to post Share on other sites More sharing options...
TwinHeadedEagle Posted February 3, 2015 ID:935748 Share Posted February 3, 2015 Hello,They call me TwinHeadedEagle around here, and I'll be working with you.Before we start please read and note the following:Limit your internet access to posting here, some infections just wait to steal typed-in passwords.Please be patient. I know it is frustrating when your PC isn't working properly, but malware removal takes time.Don't run any scripts or tools on your own, unsupervised usage may cause more harm than good.Do not paste the logs in your posts, attachments make my work easier. There is a More reply options button, that gives you Upload Files option below which you can use to attach your reports. Always attach reports from all tools.Always execute my instructions in given order. If for some reason you cannot completely follow one instruction, inform me about that.Stay with me to the end, the absence of symptoms doesn't mean that your machine is fully operational.Note that we may live in totally different time zones, what may cause some delays between answers.Do not ask for help for your business PC. Companies are making revenue via computers, so it is good thing to pay someone to repair it.If I don't hear from you within 3 days from this initial or any subsequent post, then this thread will be closed. I can't foresee everything, so if anything unexpected happens, please stop and inform me! There are no silly questions. Never be afraid to ask if in doubt! Rules and policiesWe won't support any piracy. That being told, if any evidence of illegal OS, software, cracks/keygens or any other will be revealed, any further assistance will be suspended. If you are aware that there is this kind of stuff on your machine, remove it before proceeding!The same applies to any use of P2P software: uTorrent, BitTorrent, Vuze, Kazaa, Ares... We don't provide any help for P2P, except for their removal. All P2P software has to be uninstalled or at least fully disabled before proceeding!Failure to follow these guidelines will result with closing your topic and withdrawning any assistance.Please download Farbar Recovery Scan Tool and save it to your desktop.Note: You need to run the version compatibale with your system. If you are not sure which version applies to your system download both of them and try to run them.Only one of them will run on your system, that will be the right version. Double-click to run it. When the tool opens click Yes to disclaimer.Press Scan button.It will make a log (FRST.txt) in the same directory the tool is run. Please attach it to your reply.The first time the tool is run, it makes also another log (Addition.txt). Please attach it to your reply. Link to post Share on other sites More sharing options...
maybeadinosaur Posted February 3, 2015 Author ID:935750 Share Posted February 3, 2015 Hey TwinHeadedEagle,Windows will not load, at all, in any mode. So I cant download this to the affected computer's desktop. What might be done as a work around? Link to post Share on other sites More sharing options...
TwinHeadedEagle Posted February 3, 2015 ID:935773 Share Posted February 3, 2015 Please download Farbar Recovery Scan Tool x64 and save it to a flash drive.Plug the flashdrive into the infected PC.Restart your computer and tap F8 to bring up the Advanced Menu, then click Repair your computerFollow the prompt to enter keyboard input method, and then the prompt to enter a password. If the machine does not have a password, simply click Enter.In the Choose Recovery Tool menu select Command Prompt.You will see a big black window with a blinking cursor (command prompt). Access the notepad and identify your USB drive In the Command Prompt please type in:notepadand press Enter.When the notepad opens, go to File menu.Select Open.Go to Computer and search there for your USB drive letter.Note down the letter and close the notepad. Scan with Farbar Recovery Scan Tool Once back in the command prompt window, please do the following:Type in e:\frst64.exe and press Enter.You need to replace e with the letter of your USB drive taken from notepad!FRST will start to run. Give him a minute or so to load itself.Click Yes to Disclaimer.In the main console, please click Scan and wait.When finished it will produce a logfile named FRST.txt in the root of your pendrive and display it. Close that logfile. Transfer it to your clean machine and include it in your next reply. Link to post Share on other sites More sharing options...
maybeadinosaur Posted February 3, 2015 Author ID:935982 Share Posted February 3, 2015 Here is the file. Thanks again! FRST.txt Link to post Share on other sites More sharing options...
TwinHeadedEagle Posted February 4, 2015 ID:936079 Share Posted February 4, 2015 Download attached fixlist.txt and save it to your USB flashdrive as fixlist.txt >> Boot into Recovery Environment Start FRST in a similar manner to when you ran a scan earlier, but this time when it opens .... Press the Fix button once and wait. FRST will process fixlist.txt When finished, it will produce a log fixlog.txt on your USB flashdrive.>> Exit out of Recovery Environment and post me the log please. Try to boot Windows normally...fixlist.txt Link to post Share on other sites More sharing options...
maybeadinosaur Posted February 5, 2015 Author ID:936368 Share Posted February 5, 2015 Tried to load windows normally but nothing has changed - first screen to appear is that the Critical_Process_Died, tries to diagnose and automatically repair, etc. Here is the file.Fixlog.txt Link to post Share on other sites More sharing options...
TwinHeadedEagle Posted February 5, 2015 ID:936447 Share Posted February 5, 2015 Can you run Scan again and attach fresh report? Link to post Share on other sites More sharing options...
maybeadinosaur Posted February 5, 2015 Author ID:936760 Share Posted February 5, 2015 I've run the scan again and attached the new file!FRST.txt Link to post Share on other sites More sharing options...
TwinHeadedEagle Posted February 6, 2015 ID:936862 Share Posted February 6, 2015 FRST search Once again we shall use FRST for additional checks. Re-run FRST/FRST64 :Copy User32.dll into the Search: field in FRST then click the Search Files button.FRST will search your computer for files and when finished it will produce a log Search.txt in the same directory the tool is run.Please attach it to your reply. Link to post Share on other sites More sharing options...
maybeadinosaur Posted February 6, 2015 Author ID:936944 Share Posted February 6, 2015 Here is the file.Search.txt Link to post Share on other sites More sharing options...
TwinHeadedEagle Posted February 6, 2015 ID:936945 Share Posted February 6, 2015 Download attached fixlist.txt and save it to your USB flashdrive as fixlist.txt >> Boot into Recovery Environment Start FRST in a similar manner to when you ran a scan earlier, but this time when it opens .... Press the Fix button once and wait. FRST will process fixlist.txt When finished, it will produce a log fixlog.txt on your USB flashdrive.>> Exit out of Recovery Environment and post me the log please. Try to boot Windows normally...fixlist.txt Link to post Share on other sites More sharing options...
maybeadinosaur Posted February 6, 2015 Author ID:937173 Share Posted February 6, 2015 Did not start normally. Here's the log. Should I scan again? Also, I had a memory card in the computer when the infection hit and I'm wondering if there would be a way to decrypt the photos that were encrypted?Fixlog.txt Link to post Share on other sites More sharing options...
TwinHeadedEagle Posted February 7, 2015 ID:937281 Share Posted February 7, 2015 Can you make an exact copy of the message that happens when you try to boot your PC. Picture would be nice. Link to post Share on other sites More sharing options...
maybeadinosaur Posted February 7, 2015 Author ID:937343 Share Posted February 7, 2015 Here are some pictures of the start up screen. I had to change the BIOS boot settings in order to load from the flash drive. Link to post Share on other sites More sharing options...
TwinHeadedEagle Posted February 7, 2015 ID:937364 Share Posted February 7, 2015 When you enter Recovery to run FRST, in Command Prompt type this: sfc /scannow Let it finish and then try to boot. Link to post Share on other sites More sharing options...
maybeadinosaur Posted February 7, 2015 Author ID:937367 Share Posted February 7, 2015 I get the message "Windows Resource Protection could not start the repair service." Link to post Share on other sites More sharing options...
TwinHeadedEagle Posted February 7, 2015 ID:937368 Share Posted February 7, 2015 Let's try this command: sfc /SCANNOW /OFFBOOTDIR=c:\ /OFFWINDIR=c:\windows Link to post Share on other sites More sharing options...
maybeadinosaur Posted February 7, 2015 Author ID:937369 Share Posted February 7, 2015 Here's what shows up Link to post Share on other sites More sharing options...
maybeadinosaur Posted February 7, 2015 Author ID:937370 Share Posted February 7, 2015 Sorry it didn't attach. Link to post Share on other sites More sharing options...
TwinHeadedEagle Posted February 7, 2015 ID:937371 Share Posted February 7, 2015 You didn't put space between commands. _ will represent space. When you type replace _ with space sfc_/SCANNOW_/OFFBOOTDIR=c:\_/OFFWINDIR=c:\windows Link to post Share on other sites More sharing options...
maybeadinosaur Posted February 7, 2015 Author ID:937395 Share Posted February 7, 2015 I get the same message - "Windows Resource Protection could not start the repair service." Link to post Share on other sites More sharing options...
TwinHeadedEagle Posted February 7, 2015 ID:937414 Share Posted February 7, 2015 Then, I am afraid we can't do anything, you'll need to reinstall your system. Link to post Share on other sites More sharing options...
maybeadinosaur Posted February 7, 2015 Author ID:937423 Share Posted February 7, 2015 Do you know of any way to decrypt files that have been encrypted by Cryptowall? I'm ok with a fresh install but I have a memory card that has photos I really need to restore. Link to post Share on other sites More sharing options...
maybeadinosaur Posted February 8, 2015 Author ID:937444 Share Posted February 8, 2015 UPDATE: I was able to recover deleted files with RECUVA! Some were saved over and lost but it worked! Although I have to go with a fresh installation (I like Windows 7 better, anyways) I will make sure to make a donation to you, TwinHeadedEagle, for your efforts. Thanks again! Link to post Share on other sites More sharing options...
Recommended Posts