jibrilinho Posted July 20, 2015 ID:977632 Share Posted July 20, 2015 hi guys,I'm new to this site, and I could really use some help right now. Since I restarted yesterday my laptop screen went black with only the mouse cursor working. I tried starting in recovery, no chance. windows won't launch, it starts but never gets to the lock screen, just goes black. I tried the power flush by taking out the battery and pressing the power button for 2min, no change. I feel really helpless right now, I can't afford to lose the files I have, and cant afford a new laptop right now. I read about the FRST but i'm not sure how it works.please this is a 911 situation with school deadlines. I am attaching the FRST files I got from the scan, im not sure what to do next...FRST.txt Link to post Share on other sites More sharing options...
kevinf80 Posted July 20, 2015 ID:977638 Share Posted July 20, 2015 Hello and welcome,P2P/Piracy Warning: If you're using Peer 2 Peer software such as uTorrent, BitTorrent or similar you must either fully uninstall them or completely disable them from running while being assisted here.Failure to remove or disable such software will result in your topic being closed and no further assistance being provided.If you have illegal/cracked software, cracks, keygens etc. on the system, please remove or uninstall them now and read the policy on Piracy. Make sure to remove all illegal torrents etc when possible to confirm to forum protocol.... Save the attached file fixlist.txt to your flash drive, same place as FRST.Now please enter System Recovery Options as you did to get the log.Run FRST and press the Fix button just once and wait.The tool will make a log on the flashdrive (Fixlog.txt) please post it to your reply. Next, See if your system will now boot normally, if it does continue: Download Farbar Recovery Scan Tool and save it to your desktop.Note: You need to run the version compatible with your system (32 bit or 64 bit). If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, that will be the right version.Double-click to run it. When the tool opens click Yes to disclaimer.(Windows 8 users will be prompted about Windows SmartScreen protection - click More information and Run.) Press Scan button to run the tool.... It will make a log (FRST.txt) in the same directory the tool is run. Please copy and paste it to your reply. The first time the tool is run, it makes also another log (Addition.txt). Please attach it to your reply.If your system does not boot run another scan via the recovery environment and post that log... Thanks, Kevin.. Fixlist.txt Link to post Share on other sites More sharing options...
jibrilinho Posted July 20, 2015 Author ID:977654 Share Posted July 20, 2015 thanks for answering so quickly.I read your quote, but I don't know how to uninstall anything since I can't access windows. i'm running FRST by pressing F8, then repair, command prompt. here is the fixlog after I ran the fixlist. Fixlog.txt Link to post Share on other sites More sharing options...
jibrilinho Posted July 20, 2015 Author ID:977655 Share Posted July 20, 2015 I'm currently using my sister's computer to communicate with you and try to fix mine. Link to post Share on other sites More sharing options...
kevinf80 Posted July 20, 2015 ID:977658 Share Posted July 20, 2015 Thanks for the update, I guess you`ve noticed that Zeroaccess infection was active on your system.... If the system will still not boot normally run FRST again from recovery as you did initially, post the new log.. Link to post Share on other sites More sharing options...
jibrilinho Posted July 20, 2015 Author ID:977659 Share Posted July 20, 2015 So, I ran the fixlist the first time and after restart it was flickering back and forth between the black screen and the "windows7 homepremium lock screen" for about a min, gave me hope but went back to square one.so should run FRST64 or FRST this time ?? Link to post Share on other sites More sharing options...
kevinf80 Posted July 20, 2015 ID:977660 Share Posted July 20, 2015 Your system is 64 bit, so you run FRST64, run again exactly as you did initially and post the new log.... Link to post Share on other sites More sharing options...
jibrilinho Posted July 20, 2015 Author ID:977662 Share Posted July 20, 2015 Ok mate, I ran it again.this is the new log FRST.txt Link to post Share on other sites More sharing options...
kevinf80 Posted July 20, 2015 ID:977666 Share Posted July 20, 2015 Save the attached file fixlist.txt to your flash drive, same place as FRST.Now please enter System Recovery Options as you did to get the log.Run FRST and press the Fix button just once and wait.The tool will make a log on the flashdrive (Fixlog.txt) please post it to your reply. See if your system will now boot normally...Fixlist.txt Link to post Share on other sites More sharing options...
jibrilinho Posted July 20, 2015 Author ID:977669 Share Posted July 20, 2015 DUUUUUUUUDE !!!!!YOU AARE AAWWWWWWWWSOME!!!!It worked !!! now please tell me the chances of this happening again and how to avoid it. here is the fixlog Fixlog.txt Link to post Share on other sites More sharing options...
kevinf80 Posted July 20, 2015 ID:977673 Share Posted July 20, 2015 Thanks for the update, we now need to run FRST64 normally. First we run Malwarebytes, see if zeroaccess is maybe active.... Please open Malwarebytes Anti-Malware. On the Settings tab > Detection and Protection sub tab, Detection Options, tick the box "Scan for rootkits". Under Non-Malware Protection sub tab Change PUP and PUM entries to Treat detections as Malware Click on the Scan tab, then click on Scan Now >> . If an update is available, click the Update Now button. A Threat Scan will begin. With some infections, you may or may not see this message box. 'Could not load DDA driver' Click 'Yes' to this message, to allow the driver to load after a restart. Allow the computer to restart. Continue with the rest of these instructions. When the scan is complete, click Apply Actions. Wait for the prompt to restart the computer to appear, then click on Yes. After the restart once you are back at your desktop, open MBAM once more.To get the log from Malwarebytes do the following: Click on the History tab > Application Logs. Double click on the scan log which shows the Date and time of the scan just performed. Click Export > From export you have three options: Copy to Clipboard - if seleted right click to your reply and select "Paste" log will be pasted to your reply Text file (*.txt) - if selected you will have to name the file and save to a place of choice, recommend "Desktop" then attach to reply XML file (*.xml) - if selected you will have to name the file and save to a place of choice, recommend "Desktop" then attach to reply Recommend you use "Copy to Clipboard, then Right click to your reply > select "Paste" that will copy the log to your reply…If Malwarebytes is not installed follow these instructions first:Download Malwarebytes Anti-Malware to your desktop.Double-click mbam-setup and follow the prompts to install the program. At the end, be sure a checkmark is placed next to the following: Launch Malwarebytes Anti-Malware A 14 day trial of the Premium features is pre-selected. You may deselect this if you wish, and it will not diminish the scanning and removal capabilities of the program. Click Finish. Follow the instructions above...., Next, Download Farbar Recovery Scan Tool and save it to your desktop.Note: You need to run the version compatible with your system (32 bit or 64 bit). If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, that will be the right version.Double-click to run it. When the tool opens click Yes to disclaimer.(Windows 8 users will be prompted about Windows SmartScreen protection - click More information and Run.) Press Scan button to run the tool.... It will make a log (FRST.txt) in the same directory the tool is run. Please copy and paste it to your reply. The first time the tool is run, it makes also another log (Addition.txt). Please attach it to your reply. let me see those logs in your reply.... Also remember forum protocol, remove any/all P2P software and any torrent downloads. The easiest and quickest way to get your sytem infected is using P2P rubbish.. Thank you, Kevin... Link to post Share on other sites More sharing options...
jibrilinho Posted July 20, 2015 Author ID:977697 Share Posted July 20, 2015 ok so I did everything as instructed..it only took about 2hrs. this the scanlog from MBAM AfterScan1.txt and those are txtfiles after running FRST64 in normal mode FRST.txt Addition.txt what's next ?? Link to post Share on other sites More sharing options...
kevinf80 Posted July 21, 2015 ID:977757 Share Posted July 21, 2015 Continue as follows: Download attached fixlist.txt file (end of reply) and save it to the Desktop, or the folder you saved FRST into.NOTE. It's important that both FRST and fixlist.txt are in the same location or the fix will not work.Run FRST and press the Fix button just once and wait.The tool will make a log on the Desktop (Fixlog.txt) or the folder it was ran from. Please post it to your reply. Next, Google Chrome is corrupt and also possibly exploited, we need to complete a clean install to correct setting.... If your Chrome Bookmarks are important do this first:Go to this link: http://www.wikihow.com/Export-Bookmarks-from-Chrome follow the instructions and Export your Bookmarks from Chrome, save to your Desktop or similar. Note the instructions can also be used to Import the bookmarks.....Continue for a clean install:Remove all synced data from Chrome go here: http://www.howtogeek.com/103655/how-to-delete-your-google-chrome-browser-sync-data/ follow those instructions...Uninstall Chrome: https://support.google.com/chrome/answer/95319?hl=en-GB follow those instructions, ensure the option to "Also delete your browsing data" is selected. <<--- Very important!!Install Google Chrome from here: https://www.google.com/intl/en_uk/chrome/browser/desktop/index.htmlInstall Adblock Plus to Chrome: https://chrome.google.com/webstore/detail/adblock-plus/cfhdojbkjhnklbpkdaibdccddilifddbNext, Download AdwCleaner by Xplode onto your Desktop. Double click on Adwcleaner.exe to run the tool. Click on Scan Once the scan is done, click on the Clean button. <<<--- Ensure this option is completed You will get a prompt asking to close all programs. Click OK. Click OK again to reboot your computer. A text file will open after the restart. Please post the content of that logfile in your reply. You can also find the logfile at C:\AdwCleaner[sn].txt. Where n in the scan reference numberNext, Please download Junkware Removal Tool to your desktop.Shut down your protection software now to avoid potential conflicts. (re-enable when done) Run the tool by double-clicking it. If you are using Windows Vista, 7, or 8; instead of double-clicking, right-mouse click JRT.exe and select "Run as Administrator". The tool will open and start scanning your system. Please be patient as this can take a while to complete depending on your system's specifications. On completion, a log (JRT.txt) is saved to your desktop and will automatically open. Post the contents of JRT.txt into your next message.Next, Download Microsoft's " Malicious Software Removal Tool" and save direct to the desktopEnsure to get the correct version for your system....32 Bit version:https://www.microsoft.com/downloads/en/confirmation.aspx?FamilyId=AD724AE0-E72D-4F54-9AB3-75B8EB148356&displaylang=en64 Bit version:https://www.microsoft.com/downloads/en/confirmation.aspx?FamilyId=585D2BDE-367F-495E-94E7-6349F4EFFC74&displaylang=enRight click on the Tool, select “Run as Administrator” the tool will expand to the options WindowIn the "Scan Type" window, select Quick ScanPerform a scan and Click Finish when the scan is done.Retrieve the MSRT log as follows, and post it in your next reply:1) Select the Windows key and R key together to open the "Run" function2) Type or Copy/Paste the following command to the "Run Line" and Press Enter:notepad c:\windows\debug\mrt.log Let me see those logs, also give an update on any remaining issues or concerns..... One point of note, keep well away from P2P software and Torrent downloads. Using such software is a sure fire way of being infected as you`ve just witnessed... Thank you, Kevin.. Fixlist.txt Link to post Share on other sites More sharing options...
jibrilinho Posted July 21, 2015 Author ID:977831 Share Posted July 21, 2015 Good morning mate, I went ahead and did as you asked. Here are the logs. after the fix : Fixlog.txt after adwcleaner : AdwCleanerS02.txt after junkware R Tool : JRT.txt after Microsoft MSRT : mrt.log Link to post Share on other sites More sharing options...
kevinf80 Posted July 21, 2015 ID:977854 Share Posted July 21, 2015 The Fixlog.txt only shows half of the expected log, it shows the fixlist content but no fixlog content. So the log does not indicate if the fixes were actually done?How is your system responding, are there any remaining issues or concerns? Thank you, Kevin.. Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted July 30, 2015 Root Admin ID:980212 Share Posted July 30, 2015 Due to the lack of feedback this topic is closed to prevent others from posting here. If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread. Other members who need assistance please start your own topic in a new thread. Thanks! Link to post Share on other sites More sharing options...
Recommended Posts