[Resolved] Badly Infected computer - can only access via Taskmanager

📎rootrepeal.txtI am posting on here in the hope that somebody may know what has infected my computer ? Upon loading up it stays on wallpaper screen but has lost all icons and taskbar, I can only navigate around via the Taskmanger (alt+crtl+del) explorer.exe is not running and when i type the command in it says windows cannot access the path or file yout may not have the appropriate permission to access the item. i have tried to run malewarebytes anti malware,spybot,windows defender etc but all fail to either run or start to run then just stop I cannot do a system restore and booting in safe more is no different than booting it normally. i have ran sfc \ scannow this finds nothing i have tried to follow your guide lines but again these have been unsuccessful erunt was fine dds runs but produces no report roorrepeal ran but produced a report stating error - see attatched this seems to be a real nasty any ideas before i consider a complete re-install Thanks davids 📎rootrepealerrorlog.txt

[external image: Posted Image]


DO NOT use any TOOLS such as Combofix, SmitfraudFix, MBAM, Vundofix, or HijackThis fixes without supervision.

Doing so could make your pc inoperatible and could require a full reinstall of your OS, losing all your programs and data.



Stay with this topic until I give you the all clean post.

Lets see if we can fix your File Associations

Please download fixAssocations to your desktop.
Double-click on fixAssociations.com to perform the fix.
Please test to see if your executable programs now work - you may have to reboot first.

Now see if MBAM will run.
If not, rename MBAM.exe to MBAM.com.

Hi thank you for taking the time to try and help me. I have followed your instructions but it stil won't run, it starts and runs for 4 seconds then just goes off the screen ? Thanks

1) numberCruncher
Please download numberCruncher by Raktor to your desktop. Make sure you save it with its current filename of explorer.exe.

• Double-click on explorer.exe to start the tool
• A black box will open, and run the fix.
• At the end, be sure to record the information in the window and post it here. No logfile will be saved
• Press any key to close the window
• Note: If the program will not execute, download explorer.com, and follow the above instructions again (but ensure that it is named explorer.com).

Notes: If the downloaded explorer.exe, won't run, remane it to explorer.com
If the file isn't visable on your desktop, run via taskmanager.

Open taskmanager > at the top left, click File> New Task> copy paste this in or type it in:
c:\explorer.com

Downloaded and ran the explorer.exe program It only ran for a few secs this is what it said in the black box window numbercruncher by raktor 09 now searching… did not find numerical process, continuing…… exefile="%1" %* .exe=exefile reset filetype association for .exe comfile = "%1" %* .com=comfile reset filetype association for.com finished. press any key to continue. . .

Now see if MBAM will run. If not, rename MBAM.exe to MBAM.com.

no it will not thanks

NOTE: worksnow is actually Combofix renamed so user is able download and run Combofix

Download worksnow from HERE:


* IMPORTANT !!! Save worksnow to your Desktop

• Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. Note: If you are having difficulty properly disabling your protective programs, or are unsure as to what programs need to be disabled, please refer to the information available through this link : Protective Programs
  
  
• Double click on worksnow & follow the prompts.
  
  Note: worksnow will run without the Recovery Console installed.
  
  Note: Combofix will run without the Recovery Console installed.
  
  
• As part of it's process, combofix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
  
  
• Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

[external image: Posted Image]

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

[external image: Posted Image]

Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.
"copy/paste" a new HijackThis log file into this thread as well.

Notes:

1.Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. ComboFix may reset a number of Internet Explorer's settings, including making I-E the default browser.
3. Combofix prevents autorun of ALL CD, floppy and USB devices to assist with malware removal & increase security. If this is an issue or makes it difficult for you – please tell your helper.
4. CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.

Give it atleast 20-30 minutes to finish if needed.


Also please describe how your computer behaves at the moment.

saved to desktop, launched from taskmanager, small combofix icon came up on screen green bar lit all the way along then application went off and nothing ?

Follow the instructions on the wizard. See if you can find a date the the PC worked. Open taskmanager > at the top left, click File> New Task> copy paste this in or type it in: c:\windows\system32\restore double click on: rstrui.exe run it

the only restore point i can take it back to is 16 hours ago - but the problem has existed for 3 days ?

Open taskmanager > at the top left, click File> New Task> copy paste this in or type it in:
"%userprofile%\desktop\worksnow.exe" /killall

• Click OK and this will start ComboFix in a special way.
• When finished, it will produce a log. Please save that log to a Notepad File to post in your next reply along with a fresh HJT log.

Note:
Do not mouse-click combofix's window while it is running. That may cause it to stall.

* After you have saved the logs, restart your system to re-enable all the programs that were disabled during the running of ComboFix.

* Reconnect to the internet

* Post the following logs/Reports:

• ComboFix.txt
  
[list/]

same as before it looked like it was launching ok but after the green bar loaded it just went off again

should this be run from safe mode ? would it make any difference ?

Lets try it in Safe Mode Restart your computer in Safe Mode. Press F8 after the Power-On Self Test (POST) is done. If the Windows Advanced Options Menu does not appear, try restarting and then pressing F8 several times after the POST screen. Choose the Safe Mode option from the Windows Advanced Options Menu then press Enter. This can take several miniutes to load.