Browser hijacker has my computer Please help! [Solved]

Thanks for your reply and for your directions. I booted up the computer and it immediately goes to Repair Startup screen. There are 2 choices…try to repair automatically or start normally. When I click on Repair: It goes through the motions of repair and then a screen comes up with (Startup cannot repair this computer automatically) then 2 choices Send info or Don't send. Their is an area below that says view problems this is what it says: Problem Event name: Startup Repair Offline Problem signature 01: 6.1.7600.16385 Problem signature 02: 6.1.7600.16385 Problem signature 03: unknown Problem signature 04: 21200453 Problem signature 05: Auto Fail over Problem signature 06:7 Problem signature 07:No Root Cause OS Version: 6.1.7600.2.0.0.256.1 Local ID 1033 ****************** Then a screen called system recovery options comes up when you close that. It says choose a recovery tool. Startup Repair System Restore System Image Recover Windows memory diagnostic Command Prompt When you reboot normally the dell logo comes on and then it flashes a blue screen and goes back to the windows error screen. I have tried to boot normally- safe without networking-safe with networking…It either takes me to startup screen recovery/repair or flashes blue screen and reboots. I do have a system image on an external hard drive but it is from November 2011. Worse case scenario I could use that to restore to a much earlier time. System restore won't work and not sure what the system image would do but I am sure to lose a lot of info so that is if we cannot fix another way. Not sure how that works…would it get rid of the bug? would I lose all my programs? ( I am far from home and have no program disks here) Let me know what you think…thanks so much for helping me. I would be freaking out at this point without you!!! You are very calming:) Sue

I know you are far from home and this is all a little overwhelming. But the good news is that you have access to another computer and that is going to make this all a lot easier. Since this past week was a patch week for Windows Updates, I really suspect you have some failed updates that have caused a bit of a problem maybe in conjunction with whatever malware is going on. Between the two we have a bit of a mess on our hands. Since we are unable to restore and you don't have your original Windows 7 disks at your disposal, and the repair isn't working, we are going to need to create a repair disk for Windows 7 (so you may need to make a quick run to Office Depot or Staples and buy a pack of DVD's if you don't have any on hand).


BE SURE TO PRINT THESE INSTRUCTIONS OR HAVE THEM AVAILABLE ON YOUR OTHER COMPUTER AS YOU COMPLETE THE STEPS:

How to repair and reboot to Windows 7:

a ) Insert the Windows 7 System Repair DVD or Installation DVD and reboot.

If you do not have access to either disc: Windows 7: ISO download with SP1 included (Be sure to choose the correct download for your Windows 7 version):
http://techdows.com/2011/07/download-windows-7-integrated-with-sp1-iso-official-direct-download-links.html ://http://techdows.com/2011/07/downloa…oad-links.html

Create a Bootable Windows 7 DVD using the .ISO file

Burning a Windows 7 ISO File on a DVD
http://support.microsoft.com/default.aspx/kb/977640

b ) Select the correct keyboard input method and click ‘Next’.
Note: If you are using the Windows7 Install DVD then at the 'Install Now' prompt (Do not pick the Install Now option) instead choose the 'Repair your computer' option located in the lower left of the display.

c ) The System Repair tool will search for a valid operating system and will report that “Windows found problems with your computer’s startup options. Do you want to apply repairs and restart your computer?”

d ) Click ‘Repair and restart’ and reboot again to the Windows 7 System Repair environment.

e ) Click ‘Next’ at the keyboard selection prompt and when the ‘System Recovery Options’ screen appears verify that the “Use recovery tools that can help fix problems starting Windows” is selected.
Note: On a Dual Boot system there may be only one operating system listed if you have removed one of the two versions of Windows 7. Click the ‘Next’ button.

f) Now from the menu list select the ‘Command Prompt’ option.

g ) At the DOS prompt type the following three commands (you will need to hit "enter" after you type each command):

bootrec.exe /fixmbr
bootrec.exe /fixboot (may return an 'Eliment not found' message)
bootrec.exe /RebuildBcd

h ) Close the command prompt window and click the ‘Startup Repair’ option.

i ) The repair process may take some time, so wait until the process completes at which point you will see two messages “Windows cannot repair this computer automatically” and “Startup Repair cannot repair this computer automatically”.
These messages are the result of the radical changes made by removing the other drive. Ignore the Send/Don’t send options.

Note: Please perform step j as detailed below, startup repair must be run multiple times (at least 3 times).

J ) Close this message window by clicking on the X in the upper right corner of the Send/Don’t send window. Next click on the ‘View advanced options for system recovery and support’ option and from the main menu once again click ‘Startup Repair’. This time the repair process may only that a few seconds and when prompted “Startup Repair could not detect a problem”, click ‘Finish’ and run the ‘Startup Repair’ option one more time, click ‘Finish’, and then remove the System Repair DVD and click ‘Restart’. Reboot the computer.


Please let me know if you have any trouble. I have not personally had to follow these instructions, and I may need to get additional advice or input from one of our Windows techs if you have any problems on questions in following them. If you have any questions or concerns please stop and ask. Don't do anything you are not comfortable with - I am very happy to get any clarifications we may need along the way. I'm going to cross my fingers for you and hope all goes well - this should repair the system with no loss of data. From many of forum posts I've seen regarding errors very similar to yours, this process has been successful in a large number (but not 100% of) cases.

Even if you have to restore the system image (which will be our last resort), if it is a true system image then it would be programs data and the full operating system - it was created from the system image within Windows 7. It would restore they system to the state it was on the date the image was made and would do so very quickly with a minimum of fuss. I actually make a full system image of my machine on a weekly basis just as a precaution for cases like this. However, you are correct that any data between then and now would be gone - and thus we want to avoid using that option if we can. (You would also have to apply all the Windows updates from that point to now which would be a bit time consuming as well.)

Again, I know this is scary to you. I've been there! But the worst thing you can do is get panicky. You need to keep a clear head. If one thing doesn't work, we will try another. One way or another, we will get you back up and running. Ideally, we will do so with no loss of data or a minimal loss if we must have one. At least you have a system image. It could be worse. You could be facing a complete reinstall of the operating system with no backup of your data at all. Sometimes you have to look on the bright side!

Doris, Thank you for your instructions and your calm nature because I know freaking out won't help me get this fixed. (please…DON'T LEAVE ME THOUGH…OK? ) OK…just a momentary lapse there;) No worries. I am downloading the info to my husbands computer to make the disk with but it says over 3 hours so when I get it and the steps completed i will tell you what happens. I will make it a rule as you have…. In the future…. to make more system images but glad I have one to fall back on. In the end it will all be ok. This is frightening for me but I am sure you will get me back and I won't make a move without you…trust me! Will let you know as soon as I can. Sue

No worries Sue - I'm not going to leave you I'm on Eastern time and I'm usually not far from a computer except when I'm sleeping. I know the Windows 7 download is a biggie and it will take some time. Just relax and have a few cups of coffee….ok maybe decaf would be best…..LOL. We will get you through this. I'm not going anywhere until we have you resolved one way or another I promise. It is not our practice to abandon users on the forums. This really could have happened at any time. We had a computer at work that had issues from Windows updates just the other day right out of the blue and went into the startup repair screens. It's the nature of computers - sometimes things do go wrong. The good thing is that Windows has evolved to a point where they do make it a lot easier to recover from these kinds of things (yes, this is easier than it used to be!). I'll be here if you need me. Let me know if you have any questions.

Ok went through all the steps. Burned the correct file to disk- loaded in the problem computer- went through the steps you suggested- typed in the dos commands with no problem. Went to repair 4 times and it said each time could not be repaired automatically. I restarted with disk in and hit f12 so I could boot directly to disk. It allowed me either install or repair. I chose repair and it went through the steps and said after repairs at the end that it detected no problem….so I did that 4 times more. Took the disk out and tried to reboot and it is still doing the same thing. Flashes blue after dell symbol then goes to repair and says it cannot fix automatically. Should I try to install from the disk instead of repair? Did not want to try without your ok. At least it acknowledges that there is a system 7 installation there.

Do not choose install. That would wipe out your disk and give you a fresh install of Windows 7. (And might I add, if you don't have your Windows Key available that could cause you some problems if we didn't approach it properly).

Let me just make sure - you do not have anything else like a USB drive, cell phone, external hard drive, or anything else like that plugged into the computer while you are doing any of this right? If so, please unplug them and try rebooting again. The only thing we want is your power supply plugged in. No CD/DVD in the drive. No other accessories plugged in.

Please verify that you are able to get to the System Recovery Options menu. If so, I want you to choose the System Restore Option. When you get there, you should be able to choose not the most recent restore point, but should have a choice to look at earlier restore points. I'd like you to choose one from the weekend (while you were away and the machine seemed to be ok) if possible. Otherwise, please go back at least to a time to last week (at least to a point where I know what we were dealing with). I'm not sure we'll get the restore point to work, but it's worth a shot.

In the mean time, I am going to reach out to the Windows team here to see if I can get another opinion before we move forward with restoring the image from November.

Nothing else is plugged in to the computer…only the power cord. I will try the new restore from the time you said and let you know what happened.

Restored to the weekend but when it rebooted it did the same thing…dell symbols…flash blue…reboots and goes to windows repair.

Can you please get back to that System Recovery Options menu for me? Select Command Prompt this time.

at the X:\sources> prompt type the following

cd /d c:\

You should now be at the c:\> prompt

Type in the following:


chkdsk /r (note: there is a space between the chkdsk and the /r it is very important that you have the space in there)

This could take some time to run so please be patient. You can try restarting the computer after it's done and let me know how this goes.

Ok…typed in the chkdisk /r after the c prompt. This is what it says c:\chkdsk /r The type of the file sydtem is NTFS Cannot lock current drive. Chkdsk cannot run because the volume is in use by another process. Chkdsk may run if this volume is dismounted first. ALL OPEN HANDLES TO THIS VOLUME WOULD BE INVALID. Would you like to force a dismount on this volume (Y/N)

Go ahead and tell it yes. If you tell it no, it would tell you that you could schedule it for the next restart….problem is you can't really restart normally. So let's go ahead with Yes and see what happens.

same…logo…blue flash…boot to repair.

OK, with a little suggestion from some of my mentors, we are going to change tactics a little.


Download Farbar Recovery Scan Tool and save it to a flash drive.

Plug the flashdrive into the infected PC.

Restart your computer and tap F8 to bring up the Advanced Menu, then click Repair your computer

Follow the prompt to enter keyboard input method, and then the prompt to enter a password. If the machine does not have a password, simply click Enter.

In the next menu, use the arrow keys on the keyboard to highlight Command Prompt and press Enter.

• In the command window type in notepad and press Enter.
• The notepad opens. Under File menu select Open.
• Select "Computer" and find your flash drive letter and close the notepad.
• In the command window type e:\frst.exe and press Enter.

Note: Replace letter e with the drive letter of your flash drive.

• The tool will start to run.
• When the tool opens click Yes to disclaimer.
• Place a check next to List Drivers MD5
• Press Scan button.
  When finished, a log (FRST64.txt) will be created on the flash drive. Please copy and paste it to your reply.

By the way - that will just produce a log for me - it won't fix anything - the hope is that I can find what is causing the problem and then we may be able to use the tool to do a fix. I just didn't want you to expect that it was going to "do" something other than create a log

ok…do not own a flash drive but I have a my book external hard drive. I copied the file onto that… I was able to see by using the notepad that it was on f: So I typed in after the prompt of x:\windows\system32> f:\frst.exe It says 'f:\frst.exe' is not recognized as an internal or external command operable program or batch file.