[Closed] Your System is Infected wallpaper virus/malware

Hello chaosknight,

I removed the instructions from my post to you about running a MalwareBytes' Anti-Malware scan, but I seemed to have forgotten to remove them from the recap at the bottom of my post. Sorry about that.

For the time being, I'd like for you to hold off on doing anything else. I need to look into a few things, as well as discuss them with my teacher.

While I look into that could you please describe how your computer is running?

Thanks,
SweetTech.

My computer is running fine with the exception that I cant change my wallpaper, it is no longer giving me any warnings about virus scan downloads and stuff(except when i disabled avast) which the malware probably caused.One other thing that bothered me before was that i could not watch videos on youtube. Should i check if I can now?Is it safe enough?

Running ComboFix
Download ComboFix from one of the following locations:
Link 1
Link 2

VERY IMPORTANT !!! Save ComboFix.exe to your Desktop

* IMPORTANT - Disable your Anti-Virus and Anti-Spyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link here

• Double click on ComboFix.exe & follow the prompts.

As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.

• Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

[external image: Posted Image]

• Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

[external image: Posted Image]

• Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.
Notes:
1. Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. Do not "re-run" Combofix. If you have a problem, reply back for further instructions.

Please make sure you include the ComboFix log in your next reply as well as describe how your computer is running now

sorry for the late reply, Im kinda busy with college so i didnt get much of a chance to do the combofix but i will definitely do it tomorrow.

Hello chaosknight, Thanks for letting me know, I'll await your reply. SweetTech.

Hi, For some reason after running combofix and rebooting,it is not allowing me to access without my password(I generally use my fingerprint to unlock it but it is not letting me do so now) but I haven't used it in over 9 months so i forgot the password. Any Ideas on how to unlock it? Or should i just go and get it unlocked in a shop?

We need to do some work in the Recovery Console. This should have been installed by ComboFix when you first ran it. I'll also include instructions for using your Windows XP CD to access the Recovery Console, if it's not already present.

NOTE:

If you have any questions while being in the Recovery Console please STOP and ask me for clarification before you continue.

Accessing the Recovery Console on-board:

• Restart your computer.
• Before Windows loads, you will be prompted to choose which Operating System to start.
• Use the up and down arrow key to select Microsoft Windows Recovery Console
• You must enter which Windows installation to log onto. Type 1 and press 'Enter'.

Accessing Recovery Console via Windows XP disc:

Please Note: You will need your Windows XP disc to perform the next set of instructions below.

Insert the Windows XP CD into your computer and then restart your computer.
Press 'R' to enter the Recovery Console.

The Recovery Console will start and ask you which Windows installation you would like to log on to. If you have multiple Windows installations, it will list each one, and you would enter the number associated with the installation you would like to work on and press enter. If you have just one Windows installation, type 1 and press enter.

You will need to enter the administrator password. If a password was not set then leave the password field blank and press Enter.

Actual instructions to perform in the Recovery Console:

• At the C:\Windows prompt, type the following bolded entries, and press 'Enter' (note the spaces):

chdir c:\
type combofix.txt

Note:

In the first line there is a space after chdir
In the second line there is a space after type

What you should see:

After hitting Enter for the first line you will see that the cursor will go to a new prompt if successful (you should see that it says: c:\> if it is not successfully you will see a message similar to this: "The system cannot find the path specified."
After hitting Enter for the second line you will see that a text log will appear.

SIDE NOTE:

To exit the recovery console and reboot your computer type: exit

Please write down everything that appears between the Other Deletions section and the Files Created section and include post that information back to me in your next reply.

I got the directory cannot be found error.What should I do now?

I managed to log in using a different user account and got the combofix.txt file. Will post in a short while after combofix finishes. EDIT I got Handler license agreement window pop up. Should I accept?

Are there any other specifics that you can give me about the Handler license agreement you are prompted with?

Its a Sysinternals Software license terms.

I need to speak with my teacher before I advise you any further on how you should proceed.

Is it a part of combofix?

I think I should mention that the text file has been created already but i did not want t use it till I know what to do with the Handler agreement

Hello chaosknight, Sorry for the delay in getting back. If the ComboFix.txt log was already created, then please close out of the handler agreement (cancel it/ don't accept agreement) Please post the ComboFix log in your next reply to me. Thanks, ST.