Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

My PC won't accept my psw after an adware? attack


  • This topic is locked This topic is locked
149 replies to this topic

#1 ecar65

ecar65

  • Members
  • 78 posts
  • OFFLINE
  •  
  • Local time:11:33 PM

Posted 31 July 2017 - 04:52 AM

I am new to this forum so bear with me.   My problem is also new to me and as you can guess I am not very PC literate.

 

My problem is that my PC will no longer accept my password, which to me means that I cannot get passed the first screen and I cannot create a FRST log which I have been adviced to do.

 

Background:   I received a message on my screen saying that I had visited an illicit site and that I should call a telephone no in order not to get into trouble.  I called a local no and was told that they represented Microsoft and that they could help me for a fee.   I refused, hung up and logged off my PC.   Next time I tried to log on my PC refused to accept my password (and yes I am sure I input the right password).

 

I have a 64 bit ASUS PC and Windows 10.

 

Since I can't open my PC I also cannot perform any of the advices that I have seen.

 

I am currently using an old 32 bit HP PC so I can download any necessary files  and transfer them to my "infected"  PC with a memory stick,  but unless the transfer file is automatically self executing I do not know how to get such a file started in my infected PC.

 

I should also mention that I do not have any second user id/password or administrative user id.  I have Bitdefender Total Security installed but that obviously was no help.  When contacted they gave me a number of useless advices or advice which I could not perform.

 

Thanks for any advice.

 

 

 

 



BC AdBot (Login to Remove)

 


#2 Oh My!

Oh My!

    Adware and Spyware and Malware.....


  • Malware Response Instructor
  • 37,967 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:California
  • Local time:02:33 PM

Posted 31 July 2017 - 04:18 PM

Greetings ecar65 and :welcome: to BleepingComputer's Virus/Trojan/Spyware/Malware Removal forum.

My name is Oh My! and I am here to help you! Now that we are "friends" please call me Gary.

If you would allow me to call you by your first name I would prefer to do that.

===================================================

Ground Rules:
  • First, I would like to inform you that most of us here at Bleeping Computer offer our expert assistance out of the goodness of our hearts. Please try to match our commitment to you with your patience toward us. If this was easy we would never have met.
  • Please do not run any tools or take any steps other than those I will provide for you while we work on your computer together. I need to be certain about the state of your computer in order to provide appropriate and effective steps for you to take. Most often "well intentioned" (and usually panic driven!) independent efforts can make things much worse for both of us. If at any point you would prefer to take your own steps please let me know, I will not be offended. I would be happy to focus on the many others who are waiting in line for assistance.
  • Please perform all steps in the order they are listed in each set of instructions. Some steps may be a bit complicated. If things are not clear, be sure to stop and let me know. We need to work on this together with confidence.
  • Please copy and paste all logs into your post unless directed otherwise. Please do not re-run any programs I suggest. If you encounter problems simply stop and tell me.
  • If you do not reply to your topic after 5 days we assume it has been abandoned and I will close it.
  • When your computer is clean I will alert you of such. I will also provide for you detailed information about how you can combat future infections.
  • I would like to remind you to make no further changes to your computer unless I direct you to do so.
===================================================

Now that I am assisting you, you can expect that I will be very responsive to your situation. If you are able, I would request you check this thread at least once per day so that we can try to resolve your issues effectively and efficiently. If you are going to be delayed please be considerate and post that information so that I know you are still with me. Unfortunately, there are many people waiting to be assisted and not enough of us at BleepingComputer to go around. I appreciate your understanding and diligence.

Thank you for your patience thus far.

Did you click on any link on the warning screen?
Did you allow remote access to your computer before logging off?
Please start your computer then after 5 seconds hold down the power button until the computer turns off. Do this twice. The third time you start your computer allow it to try to boot. Do you see a screen that says Preparing Automatic Repair before changing to other screens?
Gary
 
If I do not reply within 24 hours please send me a Personal Message.

"Lord, to whom would we go? You have the words that give eternal life. We believe, and we know you are the Holy One of God."

#3 ecar65

ecar65
  • Topic Starter

  • Members
  • 78 posts
  • OFFLINE
  •  
  • Local time:11:33 PM

Posted 01 August 2017 - 05:12 AM

Gary,  thank you for your interest in my "case".    
 
Regarding your questions:  As far as I can remember I did not click on any link in the warning screen.
I definitely did not allow any remote access before logging off.
 
I have restarted my PC three times as per your instructions and I now have a screen with a headline Restore which gives me two alternatives 
Show advanced repair alternatives 
Restart the PC
 
I am a bit of a loss as to what to do now.   Advice?   In the meantime I will do nothing.
 
Regards,
 
ecar65
 


#4 Oh My!

Oh My!

    Adware and Spyware and Malware.....


  • Malware Response Instructor
  • 37,967 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:California
  • Local time:02:33 PM

Posted 01 August 2017 - 01:59 PM

Greetings and you are quite welcome for the help.

I asked for the steps to see how I could provide a simpler set of instructions for our next task. Sorry for leaving you hanging a bit.

Please do this.

===================================================

Farbar's Recovery Scan Tool in Recovery Environment - Windows 10/8 with Recovery Partition

--------------------
  • From a clean computer download Farbar Recovery Scan Tool for either 64 bit or 32 bit computers and save it to a USB drive. If you are unsure which version you need download both versions. Please note the size of the USB drive, i.e. 8 GB, etc.
  • Remove the USB device and insert it into the compromised computer
  • Start the compromised computer then and after 5-10 seconds hold down the power button until the computer shuts down. Do this step twice
  • Restart the computer and you should then see Preparing Automatic Repair, Diagnosing your PC, then Advanced options
  • Select Advanced options
  • Select Troubleshoot
  • Select Advanced options
  • Select Command Prompt
  • In the command window type in Notepad and press Enter
  • Click This PC on the left hand side
  • Double click on the USB device (if unsure look for the size, i.e. 8 GB)
  • Under Files of type: click the down arrow then select All files
  • Right click on the appropriate FRST version for your computer, either FRST64 or FRST, and select Run as administrator
  • Click Yes to the disclaimer that may appear
  • Click the Scan button
  • When completed a FRST.txt document will be created on the flash drive
  • Copy and paste the contents of the report in your reply
===================================================

Things I would like to see in your next reply. Please be sure to copy and paste the information rather than send an attachment. :thumbsup2:
  • FRST.txt

Gary
 
If I do not reply within 24 hours please send me a Personal Message.

"Lord, to whom would we go? You have the words that give eternal life. We believe, and we know you are the Holy One of God."

#5 ecar65

ecar65
  • Topic Starter

  • Members
  • 78 posts
  • OFFLINE
  •  
  • Local time:11:33 PM

Posted 02 August 2017 - 11:51 AM

Gary;  I have now downloaded the Farbar's Recovery Scan Tool.   However,  isn't there always an however,  I was only able to download to the PC harddisk since my PC is set up to automatically download to a specific folder on the hd.

 

I then tried to send the file FRST64.exe to my memory stick and I received a message saying:  Are you sure you want to copy the file without its properties?    I copied anyway but I am not at all sure that it will execute properly;   What do you say?  The .exe file on my memory stick is 2 326 KB.

 

ecar65



#6 Oh My!

Oh My!

    Adware and Spyware and Malware.....


  • Malware Response Instructor
  • 37,967 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:California
  • Local time:02:33 PM

Posted 02 August 2017 - 12:51 PM

Instead of left clicking on the download link for either the 64 or 32 bit FRST program, right click on it, select Save Link As... and that will allow you select to save it directly to the USB device. Delete any FRST program on the USB before you download it again.
Gary
 
If I do not reply within 24 hours please send me a Personal Message.

"Lord, to whom would we go? You have the words that give eternal life. We believe, and we know you are the Holy One of God."

#7 ecar65

ecar65
  • Topic Starter

  • Members
  • 78 posts
  • OFFLINE
  •  
  • Local time:11:33 PM

Posted 03 August 2017 - 12:00 PM

Hello Gary and thanks for your input.   I am sorry I am so ignorant.   I followed your advice to right click on the download button and received the Save link as... but,  when I selected drive G:  the automatic file name which came up was download.htm and Save as type Chrome HTML document.

 

Even I can understand that that can't be right.   I tried some alternatives, like writing in file name: FRST64.exe  and Save as type: All files  but with no better result.

 

Again I need some guidance.   Until then:

 

Regards,

 

ecar65

 

 

 

 



#8 Oh My!

Oh My!

    Adware and Spyware and Malware.....


  • Malware Response Instructor
  • 37,967 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:California
  • Local time:02:33 PM

Posted 03 August 2017 - 01:06 PM

No problem we will figure it out.

Attach your USB drive. Go to your downloads folder where FRST.exe was saved. Right click on the file then select Send to. Send it to your USB drive.

Let me know if that works.
Gary
 
If I do not reply within 24 hours please send me a Personal Message.

"Lord, to whom would we go? You have the words that give eternal life. We believe, and we know you are the Holy One of God."

#9 ecar65

ecar65
  • Topic Starter

  • Members
  • 78 posts
  • OFFLINE
  •  
  • Local time:11:33 PM

Posted 04 August 2017 - 04:22 AM

Gary,  sorry.    I downloaded the Recovery Scan Tool to my working PC then right clicked on the FRST64 file and Send to.... and drive G (= memory stick), but with the same message.

 

Are you sure you want to copy this file without its proper ties?   The file FRST64.exe has properties that can't be copied to the new location.

 

?

 

Regards,

ecar65



#10 Oh My!

Oh My!

    Adware and Spyware and Malware.....


  • Malware Response Instructor
  • 37,967 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:California
  • Local time:02:33 PM

Posted 04 August 2017 - 11:03 AM

Click yes, copy the file anyway, and try to run the steps. I think this is an issue with your USB device and it should work anyway.


Edited by Oh My!, 04 August 2017 - 11:05 AM.

Gary
 
If I do not reply within 24 hours please send me a Personal Message.

"Lord, to whom would we go? You have the words that give eternal life. We believe, and we know you are the Holy One of God."

#11 ecar65

ecar65
  • Topic Starter

  • Members
  • 78 posts
  • OFFLINE
  •  
  • Local time:11:33 PM

Posted 07 August 2017 - 04:05 AM

Gary,

 

I am using Chrome.   Be adviced that I am also using an old PC with Windows Vista.

 

Regards,

ecar65

 



#12 Oh My!

Oh My!

    Adware and Spyware and Malware.....


  • Malware Response Instructor
  • 37,967 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:California
  • Local time:02:33 PM

Posted 07 August 2017 - 09:38 AM

Did you try to copy the file to your USB drive even though you got a warning? Do you have another USB you can try?
Gary
 
If I do not reply within 24 hours please send me a Personal Message.

"Lord, to whom would we go? You have the words that give eternal life. We believe, and we know you are the Holy One of God."

#13 Oh My!

Oh My!

    Adware and Spyware and Malware.....


  • Malware Response Instructor
  • 37,967 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:California
  • Local time:02:33 PM

Posted 11 August 2017 - 09:18 AM

Are you still with me?
Gary
 
If I do not reply within 24 hours please send me a Personal Message.

"Lord, to whom would we go? You have the words that give eternal life. We believe, and we know you are the Holy One of God."

#14 ecar65

ecar65
  • Topic Starter

  • Members
  • 78 posts
  • OFFLINE
  •  
  • Local time:11:33 PM

Posted 11 August 2017 - 12:04 PM

Yes Gary I am still with you and thanks for asking.   I thought I would try with another USB just  in case.   I just bought a printer for my sister and included a USB, all will be delivered on Saturday when I will try all alternatives, new USB or go ahead anyway and see what happens.

 

As soon as I have some news I will let you know.   I am rather anxious to get my PC back in working order.

 

Ecar65



#15 Oh My!

Oh My!

    Adware and Spyware and Malware.....


  • Malware Response Instructor
  • 37,967 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:California
  • Local time:02:33 PM

Posted 11 August 2017 - 12:09 PM

Thanks for the update.
Gary
 
If I do not reply within 24 hours please send me a Personal Message.

"Lord, to whom would we go? You have the words that give eternal life. We believe, and we know you are the Holy One of God."




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users