White screen

shawn77 said:

Hi Vistaking

Let me explain to you regarding ransomwares.Ransomware hooks entries in multiple locations.Winlogon and Run keys.Fixing both the keys using recovery console method will fail and user will just have a white screen because the ransomware is active.

If the user can't get into save mode the programs you're mentioning is useless .

Wrong.How did user try the system restore or access MSCONFIG in his previous steps?

Safemode with command prompt gives us a command window.Flash drive can be accessed and any security tools can be used to scan our system without launching the explorer window.

Safemode with command prompt or FRST are best way to fix it.Launching registry in recovery console is time consuming.

Shawn you don't have to explain anything for me. Trust me I know what I am doing. I am not going to argue with you. The reason why she or he isn't allowed to get on to explorer.exe is cause the virus is starting it from when the PC starts up. IF you go to the registry and change the shell from what is on there to explorer.exe he or she will be able to get into safe mode and safe mode with networking. You have a matter of seconds until the virus loads up.

For a user to get to his flash drive he or she would have to know the drive letter of his flash drive.

That is why when I had the user do bcdedit | find "osdevice" it pointed to D .

You could do that or you could use DISKPART . Then type list volume

Mars. That is what is why I said I don't want to argue. Main focus is to get the user working again.

Helping PattieO is the priority!!

However, PattieO has not been here for more than 20 hours, and by now, is probably totally confused.
There is no need for this, even this old dog got confused.

PattieO can boot to Safe Mode with Networking, as seen on Post #22. HitmanPro was suggested, and already run, but, apparently, it did not finish the job.

Boot up the system from USB a flash drive loaded with HitmanPro.KickStart, and bypass the ransomware!

KickStart recognizes files and Registry keys belonging to this ransomware.
There is no need to do this manually.

When finished with KickStart, RogueKiller can be used to remove any remnants, resolve DNS issues, etc.

>>Got instructions ready to roll if PattieO wishes to go this route.<<

Emsisoft can also be used, but, IMO HitmanPro.KickStart is "the kicker".

Cottonball ,

That is what I was trying to do . Is help the user NOT to argue about things .

...help the user NOT to argue about things

I really think that is what we have meant to do, VistaKing.

Just sort of took on an occassional bump on the road...

Let's just hope PattieO has not written us off as a good source of help...

Lets get and help the user out . That is why we are here

She may have left the building with all this squabble ...

My "input" was to flush the DNS cache and restore MS's Hosts file, so she could possibly get back online in safe mode with networking.