Windows 7 pc. I am infected with the system failure FBI virus. On my iPad, I have browsed for removal instructions and they say to boot into safe mode with networking. When I do and log in, the pc immediately shuts down, so I cannot do anything. Help! I have even tried plain safe mode, Sam results.
Please do the following:
Download the appropriate version for your system of the
Farbar Recovery Scan Tool and save it to a flash drive.
Plug the flashdrive into the infected PC.
Enter
System Recovery Options .
To enter System Recovery Options from the Advanced Boot Options: Restart the computer. As soon as the BIOS is loaded begin tapping the F8 key until Advanced Boot Options appears. Use the arrow keys to select the Repair your computer menu item. Choose your language settings, and then click Next . Select the operating system you want to repair, and then click Next . Select your user account and click Next . To enter System Recovery Options by using Windows installation disc: Insert the installation disc. Restart your computer. If prompted, press any key to start Windows from the installation disc. If your computer is not configured to start from a CD or DVD, check your BIOS settings. Click Repair your computer . Choose your language settings, and then click Next . Select the operating system you want to repair, and then click Next . Select your user account an click Next . On the System Recovery Options menu you will get the following options: Startup Repair Select Command Prompt In the command window type in notepad and press Enter . The notepad opens. Under File menu select Open . Select "Computer" and find your flash drive letter and close the notepad. In the command window type e :\frst.exee :\frst64Enter Note: Replace letter e with the drive letter of your flash drive. The tool will start to run. When the tool opens click Yes to the disclaimer. Place a check next to List Drivers MD5 as well as the default check marks that are already there Press Scan button. type exit and reboot the computer normally FRST will make a log (FRST.txt) on the flash drive, please copy and paste the log in your reply.
Here you go:ATTENTION!:=====> FRST is updated to run from normal or Safe mode to produce a full FRST.txt log and an extra Addition.txt log.
Please run the following:
Open notepad (Start =>All Programs => Accessories => Notepad). Please copy the entire contents of the code box below. (To do this highlight the contents of the box, right click on it and select copy. Right-click in the open notepad and select Paste). Save it on the flashdrive as
fixlist.txt start
HKLM\…D6A79037F57F\InprocServer32: [Default-fastprox] C:\$Recycle.Bin\S-1-5-18\$3c455eff063931c8be55ce5162bb41fb\n. ATTENTION! ====> ZeroAccess
HKU\Rick\…\Winlogon: [Shell] explorer.exe,C:\Users\Rick\AppData\Roaming\skype.dat [162304 2011-11-16] (VamFlax-Software LABS) <==== ATTENTION
C:\$Recycle.Bin\S-1-5-18\$3c455eff063931c8be55ce5162bb41fb
C:\Users\Rick\AppData\Roaming\skype.dat
C:\Users\Rick\AppData\Roaming\skype.ini
C:\ProgramData\hash.dat
DeleteJunctionsIndirectory: C:\Program Files\Windows Defender
end NOTICE: This script was written specifically for this user, for use on this particular machine. Running this on another machine may cause damage to your operating system Now please enter
System Recovery Options then select
Command Prompt Run
FRST (or FRST64 if you have the 64bit version) and press the
Fix button just once and wait.
The tool will make a log on the flashdrive (Fixlog.txt) please post it to your reply.
Reboot Normally.
NEXT
Please download the
ESET services repair tool, extract the file to your desktop.
Double-click ServicesRepair.exe , If security notifications appear, click Continue or Run and then click Yes when asked if you want to proceed. Once the tool has finished, you will be prompted to restart your computer. Click Yes to restart. a log will be saved in the CCSupport folder the tool created on your desktop, please post the content in your next reply
how long does service repair take? It's been going for over a half hour now.
Here is fixlog:
Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 26-05-2013 04
Ran by [removed] at 2013-05-26 15:30:20 Run:1
Running from G:\
Boot Mode: Recovery
==============================================
HKLM\Software\Classes\CLSID\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InprocServer32\\Default => Value was restored successfully.
HKEY_USERS\Rick\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\\Shell => Value deleted successfully.
C:\$Recycle.Bin\S-1-5-18\$3c455eff063931c8be55ce5162bb41fb => Moved successfully.
C:\Users\Rick\AppData\Roaming\skype.dat => Moved successfully.
C:\Users\Rick\AppData\Roaming\skype.ini => Moved successfully.
C:\ProgramData\hash.dat => Moved successfully.
Error: DeleteJunctionsIndirectory: C:\Program Files\Windows Defender => entry should be fixed outside recovery mode.
==== End of Fixlog
Please stop the ESET services repair tool if it is still running,fixlist.txt file and save it to the Desktop. (same location as FRST)NOTE. FRST64 and fixlist.txt are in the same location or the fix will not work.NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system g:\FRST64.exe Fix button just once and wait.[attachment removed]
here it is:
Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 26-05-2013 04
Ran by [removed] at 2013-05-26 18:20:28 Run:2
Running from C:\Users\[removed]\Desktop
Boot Mode: Normal
==============================================
"C:\Program Files\Windows Defender" => Deleting junctions and unlocking files completed successfully.
==== End of Fixlog ====
If you haven't already done so, please try running the ESET Services Repair tool
How did you get along with the ESET Services repair tool?
