Can't boot to start malwarebytes!

[kaym]

Hi, my computer recently got infected with something called "Virus Protector: new age antivirus" At first I could access my desktop but when I reset my laptop it would not boot fully, instead when I would click on my name on the windows users screen to log in, this "virus scan" would come up. I have run into a similar issue before and malwarebytes solved my problem - but I can't even get my computer fully booted to be able to use malwarebytes..... Is there a bootable disk or another way for me to go about this?

Thanks

Kay

Edited March 7, 2010 by Maurice Naggar
added description

[Maurice Naggar]

What is your Windows version/edition? Please be specific.

Also, do you have the Windows operating system CD/DVD? Please advise.

And, if you can start Windows & login ---- no matter if that rogue window comes up---

do this to close the rogue window. Repeat as needed.

Use ALT+F4 keys to close those rogue pop-up windows. Press and hold the ALT key & then press F4 key.

Let me know if you can do the latter.

There's a lot more that you need to do

[kaym]

Sorry for not being specific. It's Windows Vista, I do have the CD but would prefer not to lose all the data if possible. I have tried ALT + F4 and it leaves me with just a black screen and my mouse pointer. I can't do anything from there.

[Maurice Naggar]

Hello Kaym,

I was not going to have you wipe your system. Only needed to know if you have the o.s. media just in case it may be needed.

You will want to print out or copy these instructions to Notepad for offline reference!

If you are a casual viewer, do NOT try this on your system!

If you are not Kaym and have a similar problem, do NOT post here; start your own topic

Do not run or start any other programs while these utilities and tools are in use!

Do NOT run any other tools on your own or do any fixes other than what is listed here.

If you have questions, please ask before you do something on your own.

But it is important that you get going on these following steps.

=

Close any of your open programs while you run these tools.

Stay in this thread, and make your replies here.

And when starting a reply, only use the ADDReply button at the bottom right of forum window.

I am getting my responses quoted back, which makes for very long view.

Given that this is a Vista system, on most all of the following programs and tools, you will need to do a right-click on the program link or shortcut or desktop icon (as appropriate) and then select "Run as Administrator". Please remember that as you go along and use these tools, each in turn.

Let's have you do the following (in 2 basic parts).

a) Our inestimable (genius) colleague, Grinler has a very handy guide which I want you to use as a guide.

Your system is Vista but the general principles will be the same.

See Grinler's Remove Virus Protector (Uninstall Guide)

Do as much as you can, then return here to this forum.

b)Next,

Show all files:

• Click the Start button, and then click Computer.
  
• On the Organize menu, click Folder and Search Options.
  
• Click the View tab.
  
• Locate and uncheck Hide file extensions for known file types.
  
• Locate and uncheck Hide protected operating system files (Recommended).
  
• Locate and click Show hidden files and folders.
  
• Click Apply > OK.
  

Download GMER Rootkit Scanner from here or here. Unzip it to your Desktop.

========================================================

Before scanning, make sure all other running programs are closed and no other actions like a scheduled antivirus scan will occur while the scan is being performed. Do not use your computer for anything else during the scan.

========================================================

RIGHT-click gmer.exe. and select Run as Administrator. The program will begin to run.

**Caution**

These types of scans can produce false positives. Do NOT take any action on any "<--- ROOKIT" entries unless advised by a trained Security Analyst

If possible rootkit activity is found, you will be asked if you would like to perform a full scan.

• Click Yes.
  
• Once the scan is complete, you may receive another notice about rootkit activity.
  
• Click OK.
  
• GMER will produce a log. Click on the [save..] button, and in the File name area, type in "Gmer.txt".
  
• Save it where you can easily find it, such as your desktop.
  

If you do not receive notice about possible rootkit activity remain on the Rootkit/Malware tab & make sure the 'Show All' button is unticked.

• Click the Scan button and let the program do its work. GMER will produce a log. Click on the [save..] button, and in the File name area, type in "Gmer.txt".
  
• Save it where you can easily find it, such as your desktop.
  

c) Next, Download DDS and save it to your desktop from http://www.techsupportforum.com/sectools/sUBs/dds here or http://download.bleepingcomputer.com/sUBs/dds.scr or

http://www.forospyware.com/sUBs/dds

Disable any script blocker if your antivirus/antimalware has it.

Then double click dds.scr to run the tool.

DDS will run in a command prompt window and will take 3 to 4 minutes or so.

• When done, DDS will open two (2) logs:
  
• DDS.txt
  
• Attach.txt
  
• Save both reports to your desktop.
  

Please include the following logs ( Copy & Paste here) in your next reply:

MBAM scan log

GMER log

DDS.txt

Attach.txt

[kaym]

I tried SafeMode with Networking and got the same issue - the scan popped up anyway. When I did ALT+F4 I got the same thing with the black screen only. I can't move on with the other steps in the link you gave me if I can't get in through safemode...

[Maurice Naggar]

Give it a couple of more good tries.

Press the Escape key and see if that gets around the black screen.

Press CTRL+Escape keys and see if Taskbar shows up

Press CTRL+ALT+DEL keys and wait to see if Task Manager shows up.

If Task bar or Task Manager show up, great. You could try using the RUN option off the Main menu to start one of the tools.

Or by using Task Manager, (New Task Run...) you'd have to guide it to the specific program & it's location to start one.

Let me know if any of these "work". Otherwise, our choices here diminish.

[kaym]

I chose a repair option at startup when your directions didnt work and that worked for me. I'm running malwarebytes now - we'll see if I run into anymore problems.

Thanks a lot for your help!

[Maurice Naggar]

You need to run the tools as per my earlier reply.

Please include the following logs ( Copy & Paste here) in your next reply:

MBAM scan log

GMER log

DDS.txt

Attach.txt

[Maurice Naggar]

@timmyray

Just so you know, in the Malware Removal forum we only help the original topic owner (in this case Kaym) and not those that tag along. This topic is only for member Kaym.

Also note that I posted this at the top of this particular case:

If you are not Kaym and have a similar problem, do NOT post here; start your own topic

Please read, digest and do the steps outlined here http://forums.malwarebytes.org/index.php?showtopic=9573

If at all possible, use the system in "Safe Mode with Networking".

But you must not post in this thread. I will mark your post here for deletion.

[Maurice Naggar]

Due to the lack of feedback this topic is closed to prevent others from posting here. If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.

Other members who need assistance please start your own topic in a new thread. Thanks!