Inactive Suspected Virus Infection

[daz3210]

I am posting this on behalf of a friend.

The situation is that his computer will not allow programs to run, and he cannot access the internet.

When you try to run programs (including Malwarebytes), and/or try to copy items you get a message that suggests that you do not have the correct rights to do the action you are trying to do.

The computer before this problem occurred was running AVG Free Anti-Virus, and he tells me (I can only believe him) that no alerts were given of any infection. AVG will not now run.

When you try to run internet explorer, a prompt box appears that asks which program you wish to use to 'open the file'.

I can start the machine in safe mode, that works, but the only way I can get the machine to do this is to literally cut power to the machine and then switch it back on. F8 on startup doesn't seem to work.

So, my first questions are, how can I start the eight steps to cleaning this machine, can I copy the programs needed using the command prompt if I start in Safe mode with command prompt, or do they need to be installed via windows? Alternatively is there any way I can force windows to allow the file copying?

One last point, when you start in safe mode I get two user accounts available. When starting normally I get only one. Control panel is available in both modes, but when you click user accounts you get the same error message saying you do not have sufficient rights.

 

[Broni]

Welcome aboard

Please, observe following rules:

• Read all of my instructions very carefully. Your mistakes during cleaning process may have very serious consequences, like unbootable computer.
• If you're stuck, or you're not sure about certain step, always ask before doing anything else.
• Please refrain from running tools or applying updates other than those I suggest.
• Never run more than one scan at a time.
• Keep updating me regarding your computer behavior, good, or bad.
• The cleaning process, once started, has to be completed. Even if your computer appears to act better, it may still be infected. Once the computer is totally clean, I'll certainly let you know.
• If you leave the topic without explanation in the middle of a cleaning process, you may not be eligible to receive any more help in malware removal forum.
• I close my topics if you have not replied in 5 days. If you need more time, simply let me know. If I closed your topic and you need it to be reopened, simply PM me.

=========================================================================

Let's see, if we can look at your computer booting from an external source.

Please download OTLPE (filesize 120,9 MB)

• When downloaded double click on OTLPENet.exe and make sure there is a blank CD in your CD drive. This will automatically create a bootable CD.
• Reboot your system using the boot CD you just created.
  • Note : If you do not know how to set your computer to boot from CD follow the steps here
• Your system should now display a REATOGO-X-PE desktop.
• Depending on your type of internet connection, you should be able to get online as well so you can access this topic more easily.
• Double-click on the OTLPE icon.
• When asked Do you wish to load the remote registry, select Yes
• When asked Do you wish to load remote user profile(s) for scanning, select Yes
• Ensure the box Automatically Load All Remaining Users" is checked and press OK
• OTL should now start.
• Press Run Scan to start the scan.
• When finished, the file will be saved in drive C:\OTL.txt
• Copy this file to your USB drive if you do not have internet connection on this system
• Please post the contents of the OTL.txt file in your reply.

 

[daz3210]

Many thanks Broni.

Will try that tonight and respond accordingly.

 

[Broni]

OK.................

 

[daz3210]

Hi Broni,

Thanks for the assistance.

Unfortunately said friend became impatient, and took his machine to the computer store yesterday while I was at work.

They have told him the only way is to reformat the drive (basically thats what they all seem to say round here), so thats what he has let them do. Consequently he has lost all the data he had.

But, thats his loss.

May I say thank you for your brief assistance, and suggest you close the thread.

Regards

Daz

 

[Broni]

You're very welcome and thank you for posting back