Malware– possible trojan_ owner fell for scam

Hello all! 

 

What a great day, yes? It is here as this problem is not mine! Yeah! 

So the person most like a dad came to me and said please fix my computer. Yet I can't get it to boot into safe mode to check anything. Here is what I know. This is a few years old. A dell Insperion one that should be running windows 7.

He turned on his computer and went to check his gmail. A "problem" screen showed up and told him to give his phone # and sadly he did. He thought it was gmail trying to reach him. I had to laugh myself. 

 

They called him and he gave control for I don't know how long. Now I can seem to boot into safe mode to check it and see if it is clean. I have tried, tap F8, F1, F2, F12, F10. None worked. F12 did get me to boot sector. I will try again F8 and F2 and see if I can get anything one more time and if not I wait for your wisdom. 

 

After that, I really would like help if possible to make this thing right again if anything is wrong. 

 

Tell LD Tate I said hi if he is still around! 

 

Chat soon! And Thanks in advance. 

Let me see if I understand correctly, you cannot boot into safe mode?

Can it connect to the internet?

Will it allow you to download anything?

Has it froze up on welcome screen and from there it stops?

What I think you should do first thing.
If this computer is used for online banking or paypal:

Call all of your banks, credit card companies, financial institutions and inform them that you may be a victim of identity theft and to put a watch on your accounts or change all your account numbers.
* From a clean computer, change ALL your on-line passwords for email, for banks, financial accounts, PayPal, eBay, on-line companies, any on-line forums or groups you belong to.

*****
If you can download a couple of tools:

Please download and run the following tool to help allow other programs to run. (courtesy of BleepingComputer.com)
There are 6 different versions. If one of them won't run then download and try to run the other one.
Vista and Win7 users need to right click and choose Run as Admin
You only need to get one of them to run, not all of them.

• rkill.exe
• rkill.com
• rkill.scr
• rkill.pif
• WiNlOgOn.exe
• uSeRiNiT.exe

******
Please download the Malwarebytes Anti-Malware setup file to your Desktop.

OR from this location Malwarebytes' Anti-Malware

• Open mbam-setup.x.x.xxxx.exe (x represents the version #) and follow the prompts to install the programme.
• On the Dashboard click on Update Now
• Go to the Setting Tab
• Under Setting go to Detection and Protection
• Under PUP and PUM make sure both are set to show Treat Detections as Malware
• Go to Advanced setting and make sure Automatically Quarantine Detected Items is checked
• Then on the Dashboard click on Scan
• Make sure to select THREAT SCAN
• Then click on Scan
• Note: You may see the following message, "Could not load DDA driver". Click Yes, allow your PC to reboot and continue afterwards.
• If threats are detected, click Remove Selected. If you are prompted to reboot, click Yes.
• Upon completion of the scan (or after the reboot), click the History tab.
• Click Application Logs, followed by the first Scan Log.
• Click Export, followed by Copy to Clipboard. Paste the log in your next reply.
  
  

*****
[external image: xlK5Hdb.png]Farbar Recovery Scan Tool (FRST) Scan

• Please download Farbar Recovery Scan Tool (x32) or Farbar Recovery Scan Tool (x64) and save the file to your Desktop.
• Note: Download and run the version compatible with your system (32 or 64-bit). Download both if you're unsure; only one will run.
• Right-Click FRST.exe / FRST64.exe and select [external image: AVOiBNU.jpg]Run as administrator to run the programme.
• Click Yes to the disclaimer.
• Ensure the Addition.txt box is checked.
• Click the Scan button and let the programme run.
• Upon completion, click OK, then OK on the Addition.txt pop up screen.
• Two logs (FRST.txt & Addition.txt) will now be open on your Desktop. Copy the contents of both logs and paste in your next reply.
  
  

please post
Malwarebytes Anti-Malware log
FRST.txt & Addition.txt

If you need to, make multiple post to have room for all logs.

Hi Juliet!

 

Just to give you some more info. I was able to boot into safe mode by signing into the computer which will boot up but I had to use WIN +R and type msconfig.

Once in safe mode I got a screen that came up and said. "This app can't open: Get Started can't be opened using the Built-in Administrator account. Sign in with a different account and try again."

There is but one account. It can connect but they have at&t and I have comcast so I have not connected it at all to internet. I will download from my mac to a thumb drive and transfer logs that way as to not connect and have a greater issue. 

 

I also was able to find this info:

Edition : Windows 10 Home

Version: 1511

OS build: 10586.420

 

I wanted to let you low these things prior to starting what you recommended for it might be important. I will start my work on that computer soon but it will be 11 or so before I can get started. It is 9:17 my time, now. 

 

Im running malbyte now and have to do some other work as its going. Ill get back soon Just fyi couldn't find this part in MB so I clicked scan and it is scanning :

 

• Make sure to select THREAT SCAN 
• Then click on Scan

Sorry the instructions seemed confusing, I promise to do better.

http://www.tenforums.com/tutorials/5440-user-account-add-windows-10-a.html
this is just something to read over that might help, if I'm correct the infection would remain but might work better then while signed in to the built-in Admin account
Sign in with a different local admin account and try again, if the computer would allow that then, have no clue if it will let you attempt to use anything in safe mode.

As per your last note. Im not sure what you are talking about as far as confusing. I believe I followed all but there was a part that wasn't there and I wanted to let you know. Perhaps Im confusing you. 

 

As far as the link, I get that I need to read that. Is that for the 'Get Started app'? Will doing what Im doing not fix the permission automatically? Do I need to make a new account in order to do other work? 

 

I don't really want a new account on this as only one person uses it, my foster dad.

 

Logs to come soon. On the last item

Have a log or two. The first one here is a combo of krill and MB before I told it to fix the issues. The second should be after I told it to fix the issues. –Well, that didn't work out right but here is the rest.

 

Rkill 2.8.4 by Lawrence Abrams (Grinler)

Also. I believe I now understand what you were saying in the post with the other account link. I will read it over but I believe we will have this fixed. I await further instruction. 

 

I liked your sparks BTW on your avatar

 

Why thank you!

 

 

Aso~  There are some chrome extensions I think are bad things but I don't really know. Ill try to list them. Also there is FF and IE on here should I look at those extensions and check them or no?

 

I've seen many and the tools we've run so far have too but, we may end up saving his favorites/bookmarks  then uninstalling and do a reinstall later.

If you see an extension or bookmark your concerned with or think looks suspicious let me know.

 

Did you run JRT?,  how is the computer responding now?

I couldn't. I don't know how to shut down any protection this computer has

Have a walk through. I wale away from windows after XP and decided to call it quits for the Apple products. 

 

Once someone can tell me how to close those apps or show me Ill do the JRT and post a log. 

You can get help on disabling your protection programs here

It might not still run after this, sometimes that happens.

How is the computer?
Windows Live OneCare

Right click system tray icon on main page
Click Change Settings
Click Viruses and Spyware Tab
Tick "Off" radio button
Click Apply and OK.

Also either have to disable Firewall, or approve one of CF's files, or RC won't install for XP otherwise.

Firewall Tab > Off > OK

========================

Windows Security Essentials:

Launch Windows Security Essentials
Click on Settings tab
Uncheck Turn on real- time protection (recommended)
Click on Save changes


Reverse to re-enable.

I can't find spit for protection. I know the windows firewall and such are on but I cannot seem to turn it off. 

 

everyone says stuff like this:

 Right click system tray icon on main page

Click Change Settings
Click Viruses and Spyware Tab
Tick "Off" radio button
Click Apply and OK.

 

 

​What is the sys tray icon?? and solo many other questions. what is "the main page" AHHHHHHHHHHH   I feel solo helpless and I hate this feeling. Curse you windows!!!!  Had to get that off my chest. Remember when windows was simple? I do.

 

 

Ok Something happened and I found it. Must be the Lord letting me learn some of this! Yeah