Allenmrrill Posted April 6, 2021 ID:1449442 Share Posted April 6, 2021 I am stuck locked out, a virus has taken over the administrator account booted my guest and user account, which deleted my password. I have tried the command promoting don't have a password, I need to save family memories. What do it do? Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted April 6, 2021 Root Admin ID:1449588 Share Posted April 6, 2021 Hello @Allenmrrill Do you have access to another working computer? It depends on what has happened to the computer. We can help you build a USB boot disk if you have a 4GB or larger thumb drive to access the system. If the computer has been infected with a recent encryption ransomware the chance are low of being able to recover your data if it's not been backed up but we won't know until we look. Link to post Share on other sites More sharing options...
Allenmrrill Posted April 6, 2021 Author ID:1449591 Share Posted April 6, 2021 Yes I do. And this whatever it is does delete files but I found a way of saving them. How do I contact you? Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted April 6, 2021 Root Admin ID:1449678 Share Posted April 6, 2021 (edited) Hello @Allenmrrill Sorry for the delay, I was caught up in another project. Please go ahead and create a bootable USB thumb drive with Windows 10 to boot from Use the Media Creation Tool https://www.microsoft.com/en-us/software-download/windows10 Have it burn the image to the USB thumb drive. It will need to be empty as Windows will format it to install the image. Then place the final USB Windows installer into the affected computer and boot from it. Depending on what the system is it may have a hot key such as F2, F11, F12 etc to boot from the USB disk. If not then you may need to go in to the BIOS / UEFI settings and set it to boot from that disk. Once there then Windows should be running enough to look around and we can run a scan to see what we can find with FRST Please download Farbar Recovery Scan Tool and save it to a USB flash drive. Note: You need to run the version compatible with your system. You can check here if you're not sure if your computer is 32-bit or 64-bit Plug the flash drive into the infected PC and start the computer into the Recovery Options for Command Prompt. Windows 10 Please seeHow to Start Windows 10 in Safe Mode with Command Prompt How to Boot to Advanced Startup Options in Windows 10 Once in the Command Prompt: In the command window type in notepad and press Enter. Notepad opens. Under File menu select Open. Select "Computer" and find your flash drive letter and close notepad. In the command window type e:\frst (for x64 bit version type e:\frst64) and press Enter Note: Replace letter e with the drive letter of your flash drive. The tool will start to run. When the tool opens click Yes to the disclaimer. Place a check mark on Addition.txt Press the Scan button. It will make a log (FRST.txt) and (Addition.txt) on the flash drive. Please attach those to your reply. Please be careful switching the USB to the other computer. From the Recovery / Safe Mode it should be very difficult to infect the thumb drive but better safe than sorry. Make sure the other computer is running up-to-date antivirus software and real-time protection. Thanks Edited April 6, 2021 by AdvancedSetup updated information 1 Link to post Share on other sites More sharing options...
Allenmrrill Posted April 7, 2021 Author ID:1449699 Share Posted April 7, 2021 Ahhh.... Have an issue.d:\frst isn't working Link to post Share on other sites More sharing options...
Allenmrrill Posted April 7, 2021 Author ID:1449701 Share Posted April 7, 2021 Can't I just make an admin account and superceded the one in there Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted April 7, 2021 Root Admin ID:1449744 Share Posted April 7, 2021 Not if you can't login. If you open Notepad to view where your have the USB thumb drive and where you copied it to you should be able to find it. Open notepad and File Open then My Computer and show me a screen shot of that Link to post Share on other sites More sharing options...
Allenmrrill Posted April 7, 2021 Author ID:1449754 Share Posted April 7, 2021 Link to post Share on other sites More sharing options...
Allenmrrill Posted April 7, 2021 Author ID:1449755 Share Posted April 7, 2021 Link to post Share on other sites More sharing options...
Allenmrrill Posted April 7, 2021 Author ID:1449756 Share Posted April 7, 2021 Link to post Share on other sites More sharing options...
Allenmrrill Posted April 7, 2021 Author ID:1449758 Share Posted April 7, 2021 An if you could just call 231-564-7945 or I call you. I don't care Link to post Share on other sites More sharing options...
Allenmrrill Posted April 7, 2021 Author ID:1449759 Share Posted April 7, 2021 Link to post Share on other sites More sharing options...
Allenmrrill Posted April 7, 2021 Author ID:1449760 Share Posted April 7, 2021 And that's where I have been all night Link to post Share on other sites More sharing options...
Allenmrrill Posted April 7, 2021 Author ID:1449763 Share Posted April 7, 2021 Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted April 7, 2021 Root Admin ID:1449765 Share Posted April 7, 2021 Please try the following In the X:\Sources> type in the following and press the Enter key DIR D:\*.EXE /S Show me the results. By the way. Your E: drive is almost certainly your Windows installation based on the size of the disk. Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted April 7, 2021 Root Admin ID:1449769 Share Posted April 7, 2021 Are you sure you copied the FRST64.exe program to the USB disk? It doesn't look like you did. Link to post Share on other sites More sharing options...
Allenmrrill Posted April 7, 2021 Author ID:1449771 Share Posted April 7, 2021 Link to post Share on other sites More sharing options...
Allenmrrill Posted April 7, 2021 Author ID:1449772 Share Posted April 7, 2021 I did what was asked, however one screen popped up and I didn't completely catch it. Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted April 7, 2021 Root Admin ID:1449774 Share Posted April 7, 2021 Don't see the program listed there on the D: USB disk. Probably need to pull it out and put into the good computer and copy it to the USB disk. Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted April 7, 2021 Root Admin ID:1449775 Share Posted April 7, 2021 Please download Farbar Recovery Scan Tool and save it to your desktop. Note: You need to run the version compatible with your system. You can check here if you're not sure if your computer is 32-bit or 64-bit Then copy the program to the USB disk so that you can access and use it. Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted April 7, 2021 Root Admin ID:1449778 Share Posted April 7, 2021 Link to post Share on other sites More sharing options...
Allenmrrill Posted April 7, 2021 Author ID:1449779 Share Posted April 7, 2021 Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted April 7, 2021 Root Admin ID:1449781 Share Posted April 7, 2021 Pull the D: drive out of the Bad computer. Place it into the Good computer Copy the FRST64.exe program to the USB thumb drive on the good computer. Pull it out of the good computer and place it back into the bad computer Then run the FRST64.exe program and click on the SCAN button Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted April 7, 2021 Root Admin ID:1449783 Share Posted April 7, 2021 Okay, as I mentioned earlier. I've been off work now for over 7 hours. I'm going to bed. Will check back on you tomorrow. Run the FRST scan and get me these logs please. FRST.TXT ADDITION.TXT Thanks Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted April 7, 2021 Root Admin ID:1449893 Share Posted April 7, 2021 How are things going @Allenmrrill Link to post Share on other sites More sharing options...
Recommended Posts