Windows Errors Left Behind After PC Was Held for Ransom Online

Hi,

I am running Windows 10 , which was Windows 7, which started off as Windows Vista on a Dell Studio XPS 435MT i7, 6gb Ram PC.

Recently, I have been seeing quite a few Windows 10 issues like error messages when I shutdown, file manager still showing deleted files, errors related to timeouts in event viewer, and others problems.

So, I ran the sfc scannow and restore health utility but the system asked for the source disks and I didn't have them.  Research showed that I needed to get a Windows 10 ISO with matching version and build number.

To cut a long story short, I went the main Microsoft.com Windows 10 ISO download page, which I accessed through the very top link of Google's results and connected to support live chat.

The agent (supposed agent) proceeded to make some windows popup on my screen saying a virus had been put on my PC and I needed to pay money to get control of my PC back. This was on the main Microsoft.com site too.

I went to the Spybot malware forum for help.  A good guy called Ken545 has been helping me with the virus issues, but I have been left with lots of Windows security warning messages popping up about every security app on my PC, as well as the original Windows problems and the fact all my restore points have been deleted by this rogue/ fake Microsoft support agent and we have hit a bit of a wall with sorting them out.

Incidentally, my restore points were there last week because I did a system restore.

So, Ken545 fro Spybot has directed me to you guys for help now.  He is going to kindly keep an eye on the post and chip in if he is needed or can help.

My Spybot malware forum post can be found here if you would like the full story: https://forums.spybot.info/showthread.php?73255-PC-has-been-taken-over-and-held-for-ransom-through-Microsoft-Windows-10-ISO-download

Any help would be appreciated.

Thanks.

First, do you have any image backups of your computer? Macrium Reflect or equivalent software backing up to an external USB hard drive or large flash drive would have been great and a quick and easy way to recover from problems like this.
 
I looked through the Spybot thread and Ken didn't really find anything to fix that I can see.
 
Let's start by taking care of the SFC/DISM source problem. Follow KYHI's directions and use the program he provides (IMAGE_HEALTH.ZIP).

SFC SCANNOW and DISM RESTOREHEALTH - Repair Corrupt Files

That should resolve the errors and the source not found problem.
 
To get a good windows 10 ISO, go here: How to Download a Windows 10 ISO File
Follow the Option One: To Directly Download a Windows 10 ISO from Microsoft TechBench instructions.

Before doing anything else I strongly recommend you do an image backup like I mentioned at the start of my reply.
 
If you are still having problems you can try a Repair Install: How to Do a Repair Install of Windows 10 with an In-place Upgrade

It talks about doing a Refresh or a Reset but don't do that. Instead follow the directions for the Repair Install below the Here's How:

There is also a video on doing this above the Here's How:
Come back with any questions or concerns.

Hi Ztruker,

Thank you, very much, for taking the time to read my previous post and help.

I definitely have a backup of the PC done with the Windows backup utility from when the PC had Windows 7 on it.  I'm not 100% sure if I have a Windows 10 one.

Unfortunately, I don't think I have.  I seem to remember Windows 10 saying that I had to delete the Windows 7 backup image from the external hard drive first when I tried to run a backup - does that sound right, would Windows say that?

I didn't want to delete the backup just in case; so, I was going to buy some new storage to do a Windows 10 backup and I had not got around to buying it before this happened. Argh.

Is there any way to tell if backups are Win7 or Win10 except for me trying to work out from the file date which Windows I had installed please?

Thanks.

Hi Ztruker,

I followed the instructions and the restore seemed to run successfully.  I have included a screenshot taken when the program ended.

The security error messages I have been receiving are all still present though.  To try and remove them, I rebooted a few times like Ken suggested in his post; no change.

I have also attached some images taken from the problem reporting section; there are some new problems since that guy took over my PC - restore problems, Windows defender problems and security update problems.  I have added some red arrows to the image I really want you to look at, it seems particularly concerning as it suggests a virus type behaviour has happened.

Also, I note my clock time is out and it wasn't before the live chat takeover.  I've had that issue in the past when trying to help my dad sort out his PC, but that was a battery issue and mainly caused problems with website security certificates.  It's absolutely pure coincidence if the battery is what's wrong at exactly the same time some guy says he's put a virus on my computer.

There are still issues at start up issues too.  Sometimes the PC hangs on the spinning loader over the Windows icon, sometimes I don't hear the Windows sound.

I have 'not' connected the PC to the internet since that guy did whatever, I wanted it right first.  I'm still concerned it's going to try to connect to them for some reason and finish loading whatever he was trying to put on (if anything) before I powered off.

I note the problem report about system restore included in an image above explains why all my restore points disappeared.

I'll wait your instructions.

Thanks again.

[external image: restore-1.png][external image: error-2.png][external image: error-3.png][external image: error-4.png]

[external image: error-1.png]

I think you have two options.

Clean install Windows 10 which means everything on the drive goes so make sure you have you data backed up.

Restore the Windows 7 backup you have then upgrade to Windows 10 after that is done.

With the connection to your PC in mind, I don't think trying to repair it is the right way to go, too uncertain for me.

The Win 7 restore would keep any programs you had installed and all your data intact.

A Clean Install of Win 10 would give you a new slate to start with which can be a plus or a minus depending on how many programs you had installed and if you have the ability to reinstall the ones you want.

Hi,

A clean install would have been a real problem previously, because I got a load of free MS Office software from DreamSpark when I was at university and I don't have the install disks, but I recently joined BizSpark, so I can get them again now.

I build websites for a living, so I have loads of development related software installed. After this happened the other day, I took a screenshot of the programs installed on my PC in case I got to this situation and the list is massive.

It would be good to know what that guy actually did when he was messing around in Windows Services.  It seems as though something was put on the computer and the screen popup said a virus had been installed, so I can't understand why a virus is not showing up.  I feel like I've been beat by some scumbag trying to extort money from me. 

If we can't find out what's up, it looks like the clean install route then.   I'll make sure I have everything I need backed up.

As I said I have an active BizSpark account; I think I might be able to get a copy of Windows 10 Pro on BizSpark.  Would I be better with a Pro version if I can get a copy in your opinion?

Finally, could a flat CMOS battery possibly cause these problem reports and security issues please before I do all this?  It would be a massive coincidence, but it is possible, if a flat battery would trigger the same issues.

Thanks again.

Dan.

I don't see that Pro will gain you anything: Compare Windows 10 Editions but if you can get it for free or cheap then no reason not to.
 

You can give Windows Repair All-In-One a try. It looks a bit intimidating when it's running because it does a lot but it's a very safe program.

Run in Safe Mode for best results. Get the Portable direct download version.

Hi,

I'm running the Windows repairs now - it's taking a long time.  I did some research last night about the start up repair online error and found two posts with very similar issues, one person seemed to sort the issue by changing the graphics drivers and the other by removing some Trojan viruses found with ESET Scanner.

I know graphics drivers were changed by that guy, so I'm going to reinstall the drivers I was using before he changed them.  Would you be happy if I ran ESET Scanner to see if it finds anything too?  I thought I had better ask first.

Thanks.

Eset is a good AV, definitely worth running.

Hi,

I ran the Windows fixes using the Tweaking Windows app.  It took 11 hours and after the first 4.5 hours I suffered a power cut at home and had to start again. I'm still getting some security error messages.

I also ran the ESET Scanner, nothing found.  I had to uninstall McAfee because I could not turn off McAfee real time protection, nothing happened when I clicked to enter that part of the McAfee dashboard or the update section.  That was strange, it was fine before this.  Research said it could be clock and CMOS battery related too.

So, I changed the CMOS battery.  I did everything as per the user manual.  I downloaded the Dell factory BIOS, just in case I needed it and I took screenshots of all my BIOS settings first.

However, my PC has a RAID ARRAY 01 setup and the manual, for some reason doesn't mention anything about RAID BIOS in the default BIOS settings.

After the CMOS battery swap I booted the PC up and went into BIOS to set all my settings back, as per the manual.  I can set everything back how it was except two settings: Hard disk boot settings and Hard Disk Boot Priority.

Before I changed the battery these two settings were like this:

1. Hard disk boot settings:

3rd boot device = [RAID: Intel ARRAY 01]

2. Hard Disk Boot Priority:

1st drive = [RAID: Intel ARRAY 01]

Now, they are:

1. Hard disk boot settings:

3rd boot device = SATA: ST3500620AS  (There's no RAID ARRAY 01 option)

2. Hard Disk Boot Priority:

1st Drive: SATA: ST3500620AS

2nd Drive: SATA: ST3500620AS  (Again there's no RAID options)

The computer is just sat in BIOS burning out the monitor and I don't have a clue what to do.

I have not booted to get as far as Windows yet.  I need to know what to do in order to get these RAID settings how they were first.

I can't find anything on these specific settings online. 

I have posted in the Dell forum with images, but I've had no replies; please see: http://en.community.dell.com/support-forums/desktop/f/3514/t/19676672?rfsh=1456395942716

Is this something you know about/ could help with please?  I'm really stuck.

Thanks.

I took a risk and got into Windows.  The system seems OK regarding the BIOS settings.  I'll update you on the other issues tomorrow when I've had chance to check it out.

I know nothing about RAID, sorry. I could never see the point of them, especially with faster hard drives now days and doing image backups on a regular basis. Just seems like added complexity to me.

Hi.

Everything is looking up; thanks. Therefore, I’m going to sum all this up.  Sorry it’s a bit long.

Re: The CMOS battery/ RAID issue

After doing more research yesterday, as per the manual I entered all the BIOS settings from before the battery change I could and then chose SATA: ST3500620AS as the 3rd bootable device, because RAID ARRAY 0 wasn't an option.

I then pressed F10 to save the settings and exit.  As the system restarted I immediately pressed 'control' and 'I' at the same time to get into the RAID setup to see if there were any errors; there weren’t.  So, I took a photo of that screen.  Then, I crossed my fingers and exited to see if the system would boot into Windows - it did!

After I booted into Windows today, I restarted the PC and went back into BIOS using F2, the BIOS RAID ARRAY 0 boot device settings had gone back to exactly how they were before the battery replacement; so, Windows must change the Boot device settings from the disk number to RAID ARRAY 0 for you.

Re: The live chat issue

I have written to Microsoft.com Support to try to track down the Anthony or Ian that I was online with to discover what exactly happened during my live chat session with them. 

Was I online with a hacker, or did the engineer navigate to a bad download page that contained the virus a message while trying to find me the correct Windows ISO for me?

Did the agent run the mouse pointer underneath the popup window words, “A virus has been put on your PC …” and “Pay on this number …” to help him read the message, as opposed to letting me know what I had to do (pay money) - which is what I thought?

Why was no actual virus put on my computer when I was told one had?   Why could I access my files?

Who knows?  Hopefully, MS Support will be able to tell me more.

Whether it was a dodgy page the Microsoft live chat engineer navigated to during my session or whether it was a hacker who intercepted the chat, I was very surprised it happened and it’s caused me massive headaches, as much as anything because it was a huge red herring.  It looks like ‘no virus’ was put on my computer, just like Ken said.

After research showed that similar symptoms were resolved using ESET scanner I wanted to run it for my own peace of mind.  I apologise to Ken for wanting to run ESET.  From past experience on Spybot, Ken knows his stuff and I should have known that if Ken thought running ESET was worthwhile he would have recommended it. 

Re: What the whole situation looks like now

By an absolute, total freak (1/ big number) coincidence my PC CMOS battery seems to have run out of charge a few days after the live chat virus incident and caused all the security issues.

Thinking back, the Windows security popup messages weren’t happening immediately after the live chat incident, hence I did not mention them in my first Spybot forum post.  It was a good few days after posting before a Spybot forum member managed to get back to me and in that time the CMOS battery must have lost power.

Also, a flat CMOS battery must lose the Windows restore points; research indicates this could be a possibility anyway.  If not, who knows what happened to those.

My PC seems absolutely fine now.  The security error messages ‘appear’ to have gone and everything seems fine in Windows Security and Maintenance Centre.  I have installed McAfee again and now I can access the real time protection and update settings.

I haven’t run another sfc scan; but, I’m going to.  Hopefully, the DISM and the Tweaking Windows scans sorted out any corrupted files.  I’m now going to do a full backup.

How do I uninstall the Windows All in One Repair please?  Likewise: Ken, do you have any advice on removing the log software and Malwarebytes please?  I note the Spybot thread has been archived, so I’ll ask you here.

Hey, big thanks to Ken from Spybot and Ztruker for staying with me on this and providing for your expertise.

Re: clean up tools,

I did an advanced search in the Spybot Safer Networking forum for 'clean up desktop' and found an old post that recommended OTC. Thanks anyway.