Possibly infected

[theatregal86]

I was directed here after posting a topic in the general forum: http://forums.malwarebytes.org/index.php?showtopic=87773&st=0&p=443535entry443535

Unfortunately, the instructions given here, http://forums.malwarebytes.org//index.php?showtopic=9573 I could not perform. Whether I've tried to load the computer into safe mode or normally, the Startup Repair (the potentially infected computer is Windows Vista) runs, which shuts down the computer after it's unable to fix any problems (even when I try to load into safe mode and select "safe mode with networking," this startup repair loads without ever going into safe mode or to a desktop at all). Not sure what to do, please help! and thank you in advance

[screen317]

Hi and welcome to Malwarebytes.

Your hard drive could be going bad. Try this though please:

These are links to Anti-virus vendors that offer free LiveCD or Rescue CD files that are used to boot from for repair of unbootable and damaged systems, rescue data, scan the system for virus infections. Burn it as an image to a disk to get a bootable CD. All (except Avira) are in the ISO Image file format. Avira uses an EXE that has built-in CD burning capability.

• Avira AntiVir Rescue System - Tutorial for Avira Rescue CD.
  If you encounter problems running the Rescue Disk, you can get further assistance at the Avira Support Forum.
  
• Dr Web LiveCD. Be sure to print out and follow the instructions provided in the User Manual.
  
• F-Secure Rescue CD - Rescue CD 3.01 released.
  Video: How to Remove Malware with F-Secure Rescue CD
  If you encounter problems running the Rescue CD, you can get further assistance at the F-Secure Support Forum.
  
• BitDefender LiveCD - Index of /rescue_cd
  If you encounter problems running the Rescue CD, you can get further assistance at the BitDefender Support Forum.
  
• Kaspersky RescueDisk - Index of /devbuilds/RescueDisk/
  If you encounter problems running the RescueDisk, you can get further assistance at the Kaspersky Support Forum.
  

If you are not sure how to burn an image, please read How to write a CD/DVD image or ISO. If you need a FREE utility to burn the ISO image, download and use ImgBurn.

Let me know how it goes.

[theatregal86]

Hi there, thanks! Sorry for the delay, but I've tried Avira and F-secure so far with no luck. When the computer restarted after the F-Secure, a screen reported that there was an I/O error that occurred. I still am going to try the other options you gave me, I just wanted to keep you updated

[theatregal86]

I tried each option listed, so here's a quick summary of what happened with each:

Avira: was able to run a scan, but upon restart, a black screen appeared, reporting an I/O error occurred

F-Rescue: able to run as well, but received same I/O error message upon restart attempt

BitDefender: no threats detected during scan, but received same I/O error message

Kaspersky: during the scan (which ran overnight, so not entirely sure exactly when during the scan), a reported malfunction occurred, so when I tried to run the scan again, it reported a malfunction and didn't run a scan again. Same I/O error upon computer restart

Dr. Web: tried to run it in default mode and advanced mode, but for both a message saying "job control turned off" came up

Unfortunately, I still can't restart the computer or boot it up normally without receiving the black screen with the I/O error message, even after the respective CDs were removed from the drives each time. Let me know if there's anything else I need to do or include.

[screen317]

Looks like your hard drive is failing if that's the case.

I would back up your data then get a new hard drive.

We are going to try to salvage your data using PuppyLinux. You will need a blank CD or flash drive, as well as software to burn .iso images, such as FreeISOBurner or BurnCDCC.

Download PuppyLinux from here and save it to your Desktop.

Open FreeISOBurner. Configure it as follows:

1) Click Open and navigate to puppy-4.2-k2.6.25.16-seamonkey.iso on your Desktop.

2) Change the Drive to reflect the drive letter of your CD or USB drive.

3) Change the Burn Speed to as slow as possible (4x or lower preferred).

4) Click Burn

When it finishes, eject the CD and put it in the computer that will not boot.

If not already done so, configure that computer to boot from CD or USB first. To do so, restart your computer. Carefully read what appears on the screen to see which key need to be pressed to enter Setup.

From there, navigate using the keyboard to the Boot section, then use the Page Up and Page Down keys to move the CDROM or USB option first. Afterward, press F10 to save and exit setup. When the computer restarts, it will boot from your CD or USB drive instead of the damaged hard drive, and you will be presented with PuppyLinux.

It will say Linux will boot automatically in 8 seconds. Let it. It will proceed to "boot the kernel." You will be presented with a number of options. Select the default option for everything and you will see an interface with several icons on it.

Click (only once) on mount and the Pmount Puppy Drive Mounter menu will open. Click MOUNT next to the hard drive that contains your Windows installation. Also mount any removable media you have inserted to transfer your data to.

A window will open titled /mnt/sda1 (or something similar).

You will now have access to all of your files in a familiar folder format. Right-click anything you wish to salvage, place your mouse over Dir '[foldername]', click Copy..., then click on the window containing your removable media. Right click empty space, and select Dir '[foldername]' then Paste...

When finished, click menu on the bottom left-hand corner of the screen, and click Shutdown.

[screen317]

Due to the lack of feedback this topic is closed to prevent others from posting here. If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.

Other members who need assistance please start your own topic in a new thread. Thanks!