Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

MS Removal Tool has completely owned me...


  • Please log in to reply
8 replies to this topic

#1 Aminalful

Aminalful

  • Members
  • 6 posts
  • OFFLINE
  •  
  • Local time:03:29 PM

Posted 12 May 2011 - 07:05 PM

I am running Windows XP Home, and MS Removal tool has completely hi-jacked my computer, If you're not familiar with this virus please keep in mind, it doesn't let you run ANYTHING, not even regedit or msconfig, not a damn thing. I can't Ctrl+Alt+Del, not even at the very beginning of startup. I do have a second user account on my computer, without admin priveleges, but am not able to simply "Switch Users" it requires me to fully log out, or it BSODs me. It's removed all my desktop icons, all my task bar icons, all my start icons/programs, etc. I've tried running Symantec browser scanner.

This computer is a very large part of my life, and I need it to stop being held hostage. I've used combofix to rid of it before, but that was when I was able to Ctrl+Alt+Del at the very beginning of start up, and stop the process from running, This latest MS Removal Tool malware has that approach defended somehow, says that "Task Manager has been disabled by your administrator" and I can't re-enable it because I can't get into the permissions, or anything... Help?!

Edited by Aminalful, 12 May 2011 - 07:14 PM.


BC AdBot (Login to Remove)

 


#2 Aminalful

Aminalful
  • Topic Starter

  • Members
  • 6 posts
  • OFFLINE
  •  
  • Local time:03:29 PM

Posted 12 May 2011 - 07:06 PM

Oh and I can't start in safe mode because for whatever reason, after BIOS in the beginning my keyboard still isn't active, it's one of the reasons this computer sucks...

#3 boopme

boopme

    To Insanity and Beyond


  • Global Moderator
  • 73,331 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:NJ USA
  • Local time:06:29 PM

Posted 12 May 2011 - 07:16 PM

Hello and welcome,I moved this from XP to the Am I Infected forum.


Let us see if we can get Safe mode to run. As we need it for the guide below.
Vista users my need to save it to the desktop first then right-click the icon and choose "Run as Administrator".
Please download and run SafeBootKeyRepair.exe.
Once it has completed, please try booting into Safe Mode.

EDIT:
This infection family will also hide all the files on your computer from being seen. To make your files visible again, please download the following program to your desktop:

Unhide.exe


Once the program has been downloaded, double-click on the Unhide.exe icon on your desktop and allow the program to run. This program will remove the +H, or hidden, attribute from all the files on your hard drives. If there are any files that were purposely hidden by you, you will need to hide them again after this tool is run.



Please follow our Removal Guide here Remove MS Removal Tool .
After reading how the malware is misleading you ...
You will move to the Automated Removal Instructions

After you completed that, post your scan log here,let me know how things are.
The log is automatically saved and can be viewed by clicking the Logs tab in MBAM.
Copy and paste the contents of that report in your next reply. Be sure to post the complete log to include the top portion which shows MBAM's database version and your operating system.

Edited by boopme, 12 May 2011 - 07:24 PM.

How do I get help? Who is helping me?For the time will come when men will not put up with sound doctrine. Instead, to suit their own desires, they will gather around them a great number of teachers to say what their itching ears want to hear....Become a BleepingComputer fan: Facebook

#4 Aminalful

Aminalful
  • Topic Starter

  • Members
  • 6 posts
  • OFFLINE
  •  
  • Local time:03:29 PM

Posted 12 May 2011 - 07:29 PM

boopme, I am greatful for a hastey reply, but that does me no good, as I've already stated in the original post, I can't download anything, I can't touch a darn thing on my computer without the process ending because it's "Infected", and I can't boot into safe mode using the normal boot and press F8 technique, this thing has me at a loss, it wasn't this hard to remove it before.

#5 Aminalful

Aminalful
  • Topic Starter

  • Members
  • 6 posts
  • OFFLINE
  •  
  • Local time:03:29 PM

Posted 12 May 2011 - 07:31 PM

Also, incase you're not familiar with how this works--- The desktop is blacked out with a plain old Blue screen, no icons, nothing.

#6 Aminalful

Aminalful
  • Topic Starter

  • Members
  • 6 posts
  • OFFLINE
  •  
  • Local time:03:29 PM

Posted 12 May 2011 - 07:36 PM

And somehow I also have "Windows Recovery" malware on my computer now, too... But regardless, I still can't save anything to the desktop, because everything is hidden by default.

#7 boopme

boopme

    To Insanity and Beyond


  • Global Moderator
  • 73,331 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:NJ USA
  • Local time:06:29 PM

Posted 12 May 2011 - 07:40 PM

This may be your only hope before a reformat.

AVIRA RESCUE CD
Try creating this disk and boot off of it. You will need another computer to make this disk on.
Avira AntiVir Rescue System
Tutorial for Avira Rescue CD
How do I get help? Who is helping me?For the time will come when men will not put up with sound doctrine. Instead, to suit their own desires, they will gather around them a great number of teachers to say what their itching ears want to hear....Become a BleepingComputer fan: Facebook

#8 Aminalful

Aminalful
  • Topic Starter

  • Members
  • 6 posts
  • OFFLINE
  •  
  • Local time:03:29 PM

Posted 12 May 2011 - 07:47 PM

How can I get my keyboard to work before my computer fully starts up though, is what I'm still missing...

#9 boopme

boopme

    To Insanity and Beyond


  • Global Moderator
  • 73,331 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:NJ USA
  • Local time:06:29 PM

Posted 12 May 2011 - 07:49 PM

When you boot from the Avira CD it should work.

Edited by boopme, 12 May 2011 - 07:50 PM.

How do I get help? Who is helping me?For the time will come when men will not put up with sound doctrine. Instead, to suit their own desires, they will gather around them a great number of teachers to say what their itching ears want to hear....Become a BleepingComputer fan: Facebook




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users