Malware HELP!! Tried the sticky

GunJack

Rootkit :mad: gotta be. Going to be stuck if you can't boot from a usb stick. Tried a recovery disk like avira or dr web ?? 7/vista shouldn't make any difference...

mercurystar999

No cd drive as it's a netbook. Keyboard works so am using that on it. My wife was watching iplayer and then it turned off because of the battery dying and then when she restarted it, it wouldn't do anything.

RussJK

Is the computer with the infection Windows 7? Or Vista? Since all programs aren't working, then malware has affected the file association for .exe and .com files.

If Windows 7 - to restore programs to working, save both of these to the desktop of the affected computer:
http://www.users.on.net/~russ/exe_fix_w7.reg
http://www.users.on.net/~russ/com_fix_w7.reg

Then right click on each and select Merge. Hopefully programs will work correctly. After you get programs working, I would try system restore and restore to a point before all this happened, and then do Malwarebytes QUICK scan (after updating it).

If the infected computer is Vista, then grab the EXE and COM fixes from this page yourself:
http://www.winhelponline.com/articles/105/1/File-association-fixes-for-Windows-Vista.html

If it IS a rootkit, then system restore won't do much to help other than fix all the associations and maybe give a chance to run some scans including Combofix (will need Alienrik's or Browntoa's input for that program).

mercurystar999

What do i need to do to boot from a usb and why won't any of the programmes on the usb stick load?

mercurystar999

I can't access the internet from the affected computer?

closed

system restore it back further, and run chkdsk on the c: drive.

try all the F8 options at boot

failing that buy a usb sata caddy, copy your data off, and factory restore it

RussJK

You can make bootable antiviruses for USB stick;

1. First format the USB stick with SD Card Formatter (http://www.sdcard.org/consumers/formatter_3/) as it makes them more reliable;
2. Download Unetbootin (http://unetbootin.sourceforge.net/);
3. along with one of the .ISO image files of various bootable antiviruses:
https://forums.moneysavingexpert.com/discussion/comment/41653210#Comment_41653210;
4. then run Unetbootin and follow the prompts, making sure you select the .ISO file you downloaded.

e.g. you can make the netbook start with an Avira scan so you can scan the infected hard drive outside of Windows.

So you have two choices outside of pulling out the hard drive:
a) copy over the reg files with a USB stick to get programs working, and runs scans from inside Windows;
or
b) to make a bootable USB, and scan from outside of Windows.

The quickest way would be the first way, as bootable scans can take ages.

mercurystar999

System restore no longer works or perhaps i was wrong and never did? I can though use an advanced recovery method?

mercurystar999

Downloaded unetbootin. Do i need any thing else?

RussJK

mercurystar999 wrote: »

System restore no longer works or perhaps i was wrong and never did? I can though use an advanced recovery method?

You've already established that you can't run programs on the infected computer - at least until you run the reg files that I uploaded for you. The malware has made it so you can't run programs. Just copy the reg files over, merge them, and then run system restore. If you have trouble, let us know what you've done and what happened.

There are advanced recovery methods, such as making a bootable Windows 7 Recovery disk and running system restore from that. Since your computer is infected, then you'll have to download the system repair disk from your working computer:
http://neosmart.net/blog/2009/windows-7-system-repair-discs/

Then use UNETBOOTIN that I previously mentioned to put it on a USB stick.