No Programs Will Run

[drallab_mas]

I was recently on a website (megavideo) watching a video and a popup came up about something needing to run and I needed to verify it. At the same time a porn popup came up. I closed the porn popup, but clicked allow/run, assuming it was the video that needed to run it. (you know what they say about ASSUMING things!!)

Anyway not long after (5-10 minutes probably) a malware notification came up saying (briefly) that malware was detected. I don't know if it came from malwarebytes, which I already had, or someplace else. But as soon as it came up it disappeared and my computer restarted itself. After this happened, I tried running a scan 3 different times (with restarts in between) because it kept freezing up my computer.

Finally I decided to restart in safe mode. When I restarted my computer in safe mode, my antivirus (avg-free), ad-aware, and advanced system care, and malware bytes all ran fine. I let them all do scans, and everything came up fine, apart from the usual tracking cookies which were removed. So I started my computer up, running windows like normal again.

When I did this (and now) none of my startup programs come up. My firewall, antivirus, and ad-aware are turned off and no matter what I do I cannot turn them back on. Right now I have the regular Windows Firewall turned on blocking everything except Internet Explorer, which I'm using now. None of my programs will start, I can't open any Word files or Word at all, Chrome won't open, of course none of my antivirus, malwarebytes, advanced system care, or ad-aware will open.

I went through the I'm Infected, What Do I Do Now? instructions, and tried downloading all of the things it said to when each step failed. The downloads work, but none of them will run to install it. Following another forum post I read, I tried renaming the downloads, with no success. Nothing will open. I'm not a computer guru so I'm not sure what I'm looking at but from what I read on the services & processes running in task manager, nothing looks unusual. I don't have any mscfg.exe or wscfg.exe or Antivirus 2010 viruses running. Nothing LOOKS unusual, but obviously something is.

I also tried to do a system restore, but it won't let me since I don't have a previous restore point.

PLEASE HELP!!!

[kahdah]

Hello drallab_mas

Welcome to Malwarebytes.

See if these will run.

=====================

• Download OTL to your desktop.
  
• Double click on OTL to run it.
  
• When the window appears, underneath Output at the top change it to Minimal Output.
  
• Under the Standard Registry box change it to All.
  
• Under Custom scan's and fixes section paste in the below in bold
  

  
  

  netsvcs
  
  
  %SYSTEMDRIVE%\*.*
  
  
  %systemroot%\system32\*.dll /lockedfiles
  
  
  %systemroot%\Tasks\*.job /lockedfiles
  
  
  %systemroot%\system32\drivers\*.sys /90
  
  
  %systemroot%\system32\Spool\prtprocs\w32x86\*.dll

  
  

• Check the boxes beside LOP Check and Purity Check.
  
• Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
  
  • When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
    
  • Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post it with your next reply.
    

====================

Please download Rootkit Unhooker and save it to your desktop.

• Double-click RKUnhookerLE.exe to run it.
  
• Click the Report tab, then click Scan
  
• Check Drivers, Stealth Code, Files, and Code Hooks
  
• Uncheck the rest, then click OK
  
• When prompted to Select Disks for Scan, make sure C:\ is checked and click OK
  
• Wait till the scanner has finished then go File > Save Report
  
• Save the report somewhere you can find it, typically your desktop. Click Close
  
• Copy the entire contents of the report and paste it in your next reply.
  

Note - You may get this warning it is ok, just ignore it."Rootkit Unhooker has detected a parasite inside itself!

It is recommended to remove parasite, okay?"

[drallab_mas]

I downloaded both, but as with everything else, it won't let me run them. The security warning that usually pops up saying do you want to run this comes up, I choose run. Nothing happens!!!

[kahdah]

Do it in Safe mode please.

[drallab_mas]

I can't now. I decided to try to restore it to factory defaults, since I won't really lose much since it's a new laptop anyway. When it was installing windows it froze, it stayed on the same screen for over an hour (which IS unusual for what step it was doing - I've done it before). I manually shut it off and then turned it back on and it had disabled my administrator account and I couldn't log on. I finally got in through safe mode, but that's the only way it will work and I can't change any accounts to get on. I can't reinstall windows manually with a disc, either, because one wasn't included with my laptop.

I sent it to someone who might be able to help now. Any idea what to do if he can't help me?

But anyway, thanks for trying to help!

[kahdah]

Well if it comes back fixed then you won't need my help if not then I will assist you in repairing it.

[drallab_mas]

Ok thanks!

[drallab_mas]

I need your help. He's too busy to fix it right now. Please help?

[kahdah]

OK at what point is the computer at now?

What does it do/not do?

Does it boot into Windows?

[drallab_mas]

It goes to the windows start screen, but from there I can not access any user accounts. It says my Administrator account is disabled when I try to get into it. It works in safe mode, but that's it.

[kahdah]

So can you get into the admin account in safe mode?

If so then try to do a system restore let me know any error messages exactly.

[drallab_mas]

Yes, I can get into the administrator account in safe mode. I tried doing a system restore, but it says there's no restore point to restore it to.

[kahdah]

Can you give me a bit more detail what exactly does the system say when you try to log in the Admin account in normal mode?

[drallab_mas]

It says "Your account has been disabled. Please see your system administrator."

[kahdah]

At what point did this happen?

Was it after running some of the tools ,before you gave it to the other person have you made any changes that may have resulted in this such as registry editing?

[drallab_mas]

I didn't do any registry editing. It was after I tried restoring it to factory defaults and it froze. When it froze up, I manually shut it down. Then it apparently disabled my administrator account. I don't know if windows did that or if the malware did it. Either way whatever it was it's fixed now. The guy finally looked at it and the malware was so integrated into the system that he had to do a clean install of windows. But it's okay, it's fixed. Thanks

[kahdah]

Ok you are welcome.

[LDTate]

Since this issue is resolved I will close the thread to prevent others from posting here. If you need assistance please start your own topic and someone will be happy to assist you.