Issues logging into Windows.

[GilV37]

ok lets try this one...

 

[VistaKing]

Lets try this make it easier

Type this inside the command prompt

Code:

REG QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings" >%USERPROFILE%\Desktop\InternetSettings.txt

A text file name InternetSettings should be located on your desktop . Upload that file ( if worked right )

 

[GilV37]

i got:

ERROR: INvalid syntax.
Type "REG QUERY /" for usage.

 

[VistaKing]

Lets change from %Userprofile%\Desktop\InternetSettings to C:\InternetSettings.txt

So it should be

REG QUERY "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings" >C:\InternetSettings.txt

 

[GilV37]

no error message, and it didnt create a txt file.

 

[GilV37]

we'll continue tomorrow.

thanks

 

[VistaKing]

Check your C drive

 

[cottonball]

Try these two commands:

reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v ProxyEnable>>"%userprofile%\desktop\check.txt"

"%userprofile%\desktop\check.txt"


Check the Desktop.

 

[cottonball]

GilV37,

Did you install MSE?

Any luck downloading after doing so?

Also, can you download, for example, SystemLook, instead of the .jpg file done previously?
http://www.sevenforums.com/system-security/289521-issues-logging-into-windows-24.html#post2411335

 

[VistaKing]

Lets see if you could run a scan with Surfright's HitmanPro

Download Link :ar: http://dl.surfright.nl/HitmanPro_x64.exe


:ar: Save to a USB Flash Drive then plug the USB Flash Drive to the issue PC and drag the file from the USB Flash Drive to the Desktop

:ar: Right click on HitmanPro.exe and choose Run as administrator

:ar: When HitmanPro opens up click on the Next button

:ar: Click on No, I only want to perform a one-time scan to check this computer on the Setup page . Click Next once done .

:ar: Let it scan the PC once its done Click Next

:ar: Click Activate free license to start the free 30 days trial and remove all the malicious files from your computer then click Next

 

[GilV37]

Hello, i found the file on the C:\. And yes, i installed MSE last night. Tried downloading system lock from the link and it didnt work. i downloaded hitman pro as requested, and got a log file.

 

[Jacee]

Restore IE's default settings ... http://www.sevenforums.com/tutorials/1222-internet-explorer-reset.html

If you don't have CCleaner, download from here: Download CCleaner 4.01.4093 - FileHippo.com
Uncheck any prechecked bundled add-ons!

Check these items in IE and run the analyzer, when finished, click 'run cleaner'.


Next, click on the applications tab, check these items in Firefox and Chrome (if showing) Analyze and run cleaner.

 

[cottonball]

Wouldn't it be something if one of these scans solved the problem?
Will give this up and take up planting various kinds of tomatoes.
Did that one year, and the squirrels ate them all!! The tomatoes were fenced in!!


Please try the following to activate the real Administrator on this computer:
Go to the Command Prompt, right-click and select: Run as Administrator

Once at the Command Prompt type or copy/paste the following, and press Enter:

Net user administrator /active:yes

The Command Prompt tells you whether the command was processed successfully.

Now, log off by going to Start, pressing the arrow to the right of Shutdown, and select: Log off
When the computer boots back up, press the Administrator account.

Find and click the Internet Explorer icon.
You get a notice with 3 choices, one of which is: To continue browsing click Home, etc.
Go to the upper right of IE, and click on the small house icon. If you place the mouse cursor over it tells you what it is.

At whatever webpage you get, you will see a notice at the bottom: The current security settings put your computer at risk.
Please ignore the notice.

Try to download SystemLook:
http://jpshortstuff.247Fixes.com/SystemLook_x64.exe

Does it download, or still the same? Press on with the following before posting here...

Go back to Start, press the arrow to the right of Shutdown, and select: Log off

Once back at your normal Desktop, go back to the Command Prompt, right-click and select: Run as Administrator

At the Command Prompt, type or copy/paste the following, and press Enter:

Net user administrator /active:no

Make sure you see the command was processed successfully message.

Please post back on whether the download got through, or still the same.

 

[VistaKing]

GilV37


The HITMANPro log wasn't displaying correctly on my iPad . Did it locate anything ?

Question : Do you Corel's Word Profect ?

 

[GilV37]

Jacee! I ran that and unfortunately it didn't work.
Cottonball! I was able to download that file as administrator, but have not tried under the other account.
VistaKing! I don't have Word Perfect on this machine.

 

[cottonball]

You did get out of the real Administrator account, and are now on your normal Desktop, right?

Will have to do some more checking...

 

[GilV37]

yes im logged back in as Ferreira Family.

 

[VistaKing]

GilV37

Do you see this file mstsc.exe inside the C:\ drive ? If you do can you upload that file to www.virustotal.com

I noticed that file on your FRST.txt log on page 1 .

 

[GilV37]

I uploaded mstsc.exe and it came back saying that it was already analyzed on 5/9. Reanalyzed again and its fine. I got a 1 on the green angel, and a zero on the devil. GREAT PHOTOS.

 

[VistaKing]

Can you upload the link with the results ?

I don't think that file should be inside the C:\ drive but inside C:\Windows\System32 .

You don't use Remote Desktop Connection

Can you run another scan with FRST . Delete the old FRST exe file and the log files ? I apologize . I am just trying to see what is on the PC after all the stuff we had you run . I do remember seeing TeamViewer in the C:\ drive as well . Do you have TeamViewer installed ?

   Warning

You will need a USB FLASH DRIVE

   Tip

Download the Tool from a non infected PC

Download Farbar Recovery Scan Tool

32-bit Version OS :ar: Farbar Recovery Scan Tool

64-Bit Version OS :ar: Farbar Recovery Scan Tool x64

   Note

Click the rb: button and right-click Computer .Select Properties .Look for System Type: which will say 32-bit Operating System or 64-bit Operating System

Plug the flash drive into the infected PC.

Enter System Recovery Options.

:ar: To enter System Recovery Options from the Advanced Boot Options:
Restart the computer.
As soon as the BIOS is loaded begin tapping the F8 key until Advanced Boot Options appears.
Use the arrow keys to select the Repair your computer menu item.
Select US as the keyboard language settings, and then click Next.
Select the operating system you want to repair, and then click Next.
Select your user account an click Next.

:ar: To enter System Recovery Options by using Windows installation disc:
Insert the installation disc.
Restart your computer.
If prompted, press any key to start Windows from the installation disc. If your computer is not configured to start from a CD or DVD, check your BIOS settings.
Click Repair your computer.
Select US as the keyboard language settings, and then click Next.
Select the operating system you want to repair, and then click Next.
Select your user account and click Next.

:ar: On the System Recovery Options menu you will get the following options:
Startup Repair

System Restore

Windows Complete PC Restore

Windows Memory Diagnostic Tool

Command Prompt

Select Command Prompt

In the command window type e:\frst.exe (for x64 bit version type e:\frst64) and press Enter

   Note

Replace letter e with the drive letter of your flash drive.

   Tip

Type the commands below to see what your letter is for the USB drive and press ENTER after each command

Diskpart
List volume

The tool will start to run.
When the tool opens click Yes to disclaimer.
Press Scan button.
FRST will let you know when the scan is complete and has written the FRST.txt to file
Please copy and paste both logs in your reply.(FRST.txt and Addition.txt)