This is my first visit to your website and I have searched for similar problems and didn't find any, so here it goes (sorry, it's not a short story):
I try to keep our computers running fine by manual updates of all regularly used programs and security, usually on weekends. I would rate my level as perhaps a novice with many hour of hands on maintenance. We are on computers way more than the average user, perhaps 12 hours a day minimum, 7 days a week with almost no virus, malware, etc. issue.
Note: no joke, this was my wife causing the problem, I was at work
Windows 7 Professional Service Pack 1
3.6 GHz 12.0GB
Microsoft Security Essentials
CCleaner used to clean temp files, etc.daily
Network of four similar, not identical computers (all Win 7, 64 bit)
2014-01-08 popup on internet wouldn't close unless a number was called, (two choices - see below)
internet browser was locked up, so the number was called and remote log in by Teamviewer allowed.
Person on line was looking around and said there were untrusted websites my browser was being redirected to, Microsoft Identity Services and Network Access Protection was stopped.
He could fix it, never mentioned a fee, said it would take about two hours, then said $99.99 fee
Company info of on-line help called:
1-800-832-1740 Expert Technical Support
1-800-273-3093 Star Technical Support
He had control for about 30 minutes.
At this point, my wife finally called me and I said hang up,unplug the internet now, I'll fix it.
Control panel>Programs and Features showed all programs, didn't see anything out of the ordinary.
I called Microsoft and the first tech instructed me to connect back to the internet and allow him remote access. No luck, although we could get to the run command, command prompts, etc, did noything. Safe boot allowed use to use iexplore.exe and he eventually did bring the computer back to again show icons and the desktop looked as normal.
He ran Malwarebytes, HitmanPro, and Vipreantivirus said it was all fixed, it found something. He also did a system restore but I do not remember if he did it in safemode or regular mode. Unfortunately he also never told me what the scans found and a call back to Microsoft has no record of what virus or viruses were found.
So all seemed good until I turned the computer on the next day (I shut all computers off every night) and found the icons only showed the programs but either the program wouldn't start at all (Quickbooks) or the computer was trying to re-install the software (Microsoft Office 2010) or install a trial version (Adobe Acrobat) and email (Outlook) has no link to the .pst (which I can't find by searching - but none of these programs worked here or by using the Start>All Programs then choosing a program
Two more Microsoft techs and the scan process was basically repeated but no change; a second level tech also did some disk checks - sfc /scannow and chkdsk with no limiters. I repeated all scans both in safemode and in regular mode and also used Windows Defender Offline Boot disk. Microsoft Safety Scanner, Spybot Search and Destroy, and ESET Online Scanner - nothing at all found.
I can scrap the computer and rebuild everything except the .pst for Outlook but it just seems as I am really close as all standard operating programs such as all internet browsers, Paint, Sype, CCleaner, Notepad, etc. work. It appears only purchased programs requiring a serial number and personal files such as any pictures, docs, and the .pst file are no where to be found.
I'm hoping some registry or other type of user id has been changed.
Phew, that's it for now, any ideas would be greatly appreciated. I realize it may be a while before I get a response.