Operating system locked [Closed]

Boot to safe mode with networking and run this program please



To Enter Safemode

• Go to Start> Shut off your Computer> Restart
• As the computer starts to boot-up, Tap the F8 KEY somewhat rapidly,
  this will bring up a menu.
• Use the Up and Down Arrow Keys to scroll up to Safemode with Networking
• Then press the Enter Key on your Keyboard

Tutorial if you need it How to boot into Safemode





Please download Malwarebytes from Here or Here

• Double-click mbam-setup.exe and follow the prompts to install the program.
• At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
• If an update is found, it will download and install the latest version.
• Once the program has loaded, select Perform quick scan, then click Scan.
  [external image: Posted Image]
• When the scan is complete, click OK, then Show Results to view the results.
• Be sure that everything is checked, and click Remove Selected .
• When completed, a log will open in Notepad. Please save it to a convenient location and post the results.
• Note: If you receive a notice that some of the items couldn't be removed, that they have been added to the delete on reboot list, please reboot.

Post the report please

That helped. Thank you! This is the result. Malwarebytes Anti-Malware (Trial) 1.60.1.1000 www.malwarebytes.org Database version: v2012.03.29.09 Windows 7 Service Pack 1 x64 NTFS (Safe Mode/Networking) Internet Explorer 9.0.8112.16421 emilyben :: EMILYBEN-PC [administrator] Protection: Disabled 3/29/2012 7:21:10 PM mbam-log-2012-03-29 (19-21-10).txt Scan type: Quick scan Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM Scan options disabled: P2P Objects scanned: 195664 Time elapsed: 2 minute(s), 18 second(s) Memory Processes Detected: 0 (No malicious items detected) Memory Modules Detected: 0 (No malicious items detected) Registry Keys Detected: 0 (No malicious items detected) Registry Values Detected: 4 HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|{2EBA5AA4-0D3A-87EA-3B05-F56A46ACBEE4} (Worm.KoobFace) -> Data: C:\Users\emilyben\AppData\Roaming\Myysi\gyyku.exe -> Quarantined and deleted successfully. HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings|ProxyServer (PUM.Bad.Proxy) -> Data: http=127.0.0.1:8592 -> Quarantined and deleted successfully. HKCU\Software\Microsoft\Windows\CurrentVersion\Run|ibtaumpb (Trojan.FakeAlert.Gen) -> Data: C:\Users\emilyben\AppData\Local\Temp\otjfeusxj\dqixfpusjmo.exe -> Quarantined and deleted successfully. HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run|41864 (Trojan.Agent) -> Data: C:\PROGRA~3\LOCALS~1\Temp\msooiymia.pif -> Delete on reboot. Registry Data Items Detected: 1 HKLM\SOFTWARE\Clients\StartMenuInternet\IEXPLORE.EXE\shell\open\command| (Hijack.StartMenuInternet) -> Bad: ("C:\Users\emilyben\AppData\Local\bdb.exe" -a "C:\Program Files (x86)\Internet Explorer\iexplore.exe") Good: (iexplore.exe) -> Quarantined and repaired successfully. Folders Detected: 0 (No malicious items detected) Files Detected: 10 C:\Users\emilyben\AppData\Roaming\Myysi\gyyku.exe (Worm.KoobFace) -> Quarantined and deleted successfully. C:\ProgramData\andetucratem.dat (Trojan.Agent.RDGen) -> Quarantined and deleted successfully. C:\Users\emilyben\AppData\Local\Temp\00021209.tmp (Worm.KoobFace) -> Quarantined and deleted successfully. C:\Users\emilyben\AppData\Local\Temp\9B74.tmp (Trojan.Downloader.Gen) -> Quarantined and deleted successfully. C:\Users\emilyben\Downloads\IWON(1).exe (PUP.FunWebProducts) -> Quarantined and deleted successfully. C:\Users\emilyben\Downloads\IWON(2).exe (PUP.FunWebProducts) -> Quarantined and deleted successfully. C:\Users\emilyben\Downloads\IWON(3).exe (PUP.FunWebProducts) -> Quarantined and deleted successfully. C:\Users\emilyben\Downloads\IWON.exe (PUP.FunWebProducts) -> Quarantined and deleted successfully. C:\Users\emilyben\Local Settings\dplayx.dll (Trojan.Agent) -> Quarantined and deleted successfully. C:\Users\emilyben\Local Settings\Application Data\dplayx.dll (Trojan.Agent) -> Quarantined and deleted successfully. (end)

Good Morning,

Lets check further as what Malwarebytes removed was pretty nasty. Are you now able to boot into windows normally ? Are you getting any browser redirects to sites that you did not want to go to ?




Download ComboFix from one of these locations:

Link 1
Link 2


* IMPORTANT !!! Save ComboFix.exe to your Desktop

• Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools
• See this Link for programs that need to be disabled and instruction on how to disable them.
• Remember to re-enable them when we're done.
  
  
• Double click on ComboFix.exe & follow the prompts.
  
  
• As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
  
  
• Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

[external image: Posted Image]

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

[external image: Posted Image]

Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.

*If there is no internet connection when Combofix has completely finished then restart your computer to restore back the connections.

Everything seems to be working properly. No redirects. Do I need to do something else?

Hi,

I am looking at some of the garbage that Malwarebytes removed Worm.KoobFace This is just one of them and its nasty, did you run Combofix , is so post the log , if not go ahead and run it. What we run into on the forums are that some people are just in a hurry to get up and running again and dont realize that after the initial fix that there may be more stuff hiding we cant see, so your call on Combofix, let me know what you want to do.

Due to inactivity this topic will be closed.
If you need help please start a new thread.

New members follow the instructions here http://forums.whatthetech.com/you_Infected_t106388.html and start a new topic