Hi , welcome to the forum.
To make cleaning this machine easier
- Please do not uninstall/install any programs unless asked to
It is more difficult when files/programs are appearing in/disappearing from the logs. - Please do not run any scans other than those requested
- Please follow all instructions in the order posted
- All logs/reports, etc.. must be posted in Notepad. Please ensure that word wrap is unchecked. In notepad click format, uncheck word wrap if it is checked.
- Do not attach any logs/reports, etc.. unless specifically requested to do so.
- If you have problems with or do not understand the instructions, Please ask before continuing.
- Please stay with this thread until given the All Clear. A absence of symptoms does not mean a clean machine.
You are not seeing the icons or Start button because something is blocking explorer from running. We will work directly with the infected computer if possible.
We are going to see if we can run Internet Explorer and some tools via the Task Manager so please follow these instructions exactly as posted.
Open Task Manager by presing the
ctrl,alt,del keys at the same time
- In Task Manager, click the Options button
- check mark Always on Top
- This will keep Taskmanager from disappearing when you click on anything else.
- Using your left mouse button, click on the top blue portion of Task Manager and slide it down to the lower part of your screen so these instructions are visible.
In Task Manager
- click file
- click New Task(Run…)
- type the following line into the open: field
iexplore.exe - click ok
Internet Explorer should open.
If Internet Explorer opens, please return to this forum and continue with the next steps.
It is important that you do not minimize you browser, taskmanager or the tool I'm going to have you download. If you do you will loose them and will need to start over.
Note: When you download this tool to the specified location, it will not be visible to you. We will launch it via the run command.
Please download
SystemLook from one of the links below by
- right clicking the link and clicking Save Target As
- In the Save As window, using the dropdown menu set the Save In box to Local disk (C:)
- make sure the filename is SystemLook.exe and the type is Application
- click Save
Download Mirror #1
Download Mirror #2
Open Task Manager with ctrl,alt,del as you have been doing. (if you have closed it)
- In Task Manager, click the Options button
- check mark Always on Top
- This will keep Taskmanager from disappearing when you click on anything else.
- Using your left mouse button, click on the top blue portion of Task Manager and slide it down to the lower part of your screen so these instructions are visible.
Next
- Holding down your left mouse button, highlight all the text in the codebox below.
- Do not copy the word CODE , please note the script starts with the :
- right click the highlighted text and choose copy
:filefind
explorer.ex*
:reg
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe
In Task Manager
- click file
- click New Task(Run…)
- type the following line into the open: field
C:\Systemlook.exe - click ok
SystemLook should appear on your screen.
- Right click anywhere in the white field and choose paste.
- the text you copied earlier should appear
- Click the Look button to start the scan.
- When finished, a notepad window will open with the results of the scan.
Please post this log in your next reply.
If you loose the notepad before you can post the contents, you may retrieve it by copying and pasting this command in the Task Manager open box.
%userprofile%\desktop\SystemLook.txt
Please post back with the
SystemLook.txt.
Thanks
