Good job!
All sorts of "stuff" still remains, so let's remove some more. We need a clean computer before we start repairing services causing the
Error 1068.
Since you have no Internet connection, please download the following programs to the USB pen drive, move the programs to the
Desktop of the troubled computer, and run them from there.
:info: Download AdwCleaner:
http://www.bleepingcomputer.com/download/adwcleaner/
:info:
Also use the Junkware Removal Tool Download
:info: Please go to the
TDSSKiller Download, and select the
.exe version.
:info:
AdwCleaner:
- Save the program to the Desktop
- Close all open programs and internet browsers.
- Right-click on adwcleaner.exe and select: Run As Administrator
- At the program console, click on: Delete
- When the program is done, the computer is rebooted automatically, and a text file opens after the restart.
:ar: Please post the AdwCleaner report in your reply.
:info:
Junkware Removal Tool:
Save to the Desktop.
Make sure you temporarily disable your AntiVirus, Firewall, and any other AntiSpyware applications.
These programs may interfere with the running of JRT.
Info: How To Temporarily Disable Your Anti-virus, Firewall And Anti-malware Programs - Security Mini-Guides
Right-click JRT.exe and select: Run as Administrator
The tool opens and starts scanning the system. Please be patient as this can take a while...
When done, a report, JRT.txt is saved on the Desktop.
:ar: Please post the contents of JRT.txt in your reply.
:info: TDSSKiller:
Move from the USB pen drive to the Desktop!!
Double-click on TDSSKiller.exe to run the program.
When the TDSSKiller console opens, click on: Change Parameters
Under Additional Options, place a check in the box next to: Detect TDLFS File System
Click: OK
Press: Start Scan
•If a suspicious object is detected by this program, the default action is Skip. Leave this action as is, and click on: Continue
•If malicious objects are found, they show in the Scan results.
Ensure Cure (the default action) is selected, then click: Continue > Reboot now, to finish the cleaning process.
(Note: If Cure is not available, select Skip, >>Do not select: Delete<<)
When done, the tool creates a log on the disk with the Windows Operating System, normally C:\
Logs have a name like:
C:\TDSSKiller.X.X.X_07.31.2013_15.31.43_log.txt
:ar: Please attach the TDSSKiller log in your reply.
:info: Now, let's use
HitmanPro.Kickstart on the troubled computer, scan it for any leftover malware, and remove any infection that may still be present.
Also, you may want to print these instructions, so they are available to follow.
Load the
USB flash drive with
HitmanPro.Kickstart as follows...
Note: the contents of the USB flash drive are
erased during this process!
Use the clean (non-infected) computer, and
download:
HitmanPro.Kickstart - Anti ransomware, politievirus, bundestrojaner, Reveton, BKA, GVU - SurfRight
Under Download (on the right) select the program applicable to the infected system: 64-bit or 32-bit
When HitmanPro opens, click the
KickStart icon at the bottom of the screen.
:ar: Plug in the
USB flash drive.
When the USB flash drive is detected, a selection screen is presented.
Select the USB flash drive from the choices, and press:
Install Kickstart
A warning that all contents of the selected flash drive will erase is presented.
Press:
Yes
As the HitmanPro.Kickstart files are loaded, a progress indicator is shown on the screen.
Once the process is completed a screen is presented with the contents of HitmanPro.Kickstart
:ar: Remove the USB flash drive from the
clean computer and press:
Close
:info: Now, with the problem
computer shut down, plug the USB flash drive into a USB port, and turn on the power.
When the computer starts, press the key that brings up the Boot Menu. (On some machines its F12, F10, or F2)
From there, select to boot from the USB drive. (It may say 'Removable Drive' in the options.)
Info:
How to Remove Ransomware - Select Real Security
Once you select the USB flash drive to boot from, press:
Enter
A
KickStart prompt with USB boot options appears.
Select:
1 (Bypass the Master Boot Record (Default))
The system continues to boot from the hard drive and starts Windows.
If you get a message stating that Windows failed to start, etc., just select:
Start Windows Normally
When Windows boots, you either get a logon screen, or the Desktop is started.
If you see a logon screen with your User name, logon with it.
In the next prompt, to start the program without installing to the local hard disk, select the option to do
: One-time scan to check the computer
To start scanning for malware press:
Next
If malware is detected, the program shows what malware is present on the system using a red framed screen as shown below:
Select
Next to quarantine the malware into a secure storage where it can no longer start.
At the next screen, activate the 30-day free license:
After successful activation (30 days), press:
Next
A screen indicating that the malware was successfully disabled or removed is presented.
Press:
Next
To obtain a report of the scan results, press:
Save log
Save the Notepad log!!
It has a name such as:
HitmanPro_xxxxxxxx_xxxx
Remove the USB drive, and press:
Reboot
If no malware is found, press:
Close
After
HitmanPro.Kickstart is done, you should be back into normal Windows.
:ar: Please post the
HitmanPro log in your reply.
rb: in
