Major laptop problems and can't start in safe mode!

Mikki

Some help required please!

My daughter's Acer laptop was infected with fake "Win 7 anti-spyware". I managed to remove it by downloading an antispyware removal tool from my laptop onto disc and running it on her laptop, as Microsoft Security Essentials couldn't run on hers.

Anyway, once I got rid of it and restarted the laptop, I've discovered more problems. I tried to run Security Essentials to see if anything was still there but it wouldn't start - I got a message saying which program did I want to run it with and nothing happened. I then tried to get on the net to download it again, but same message when I try to start Firefox and Internet Explorer - "which program do I want to use?"

I decided to restart in safe mode but it won't let me - I'm pressing F8 but it just starts normally, albeit I can't run anything!

Help please as I don't know what I'm doing lol!

Thanks

RussJK

You'll need to restore the registry associations for programs using this site:
http://www.winhelponline.com/blog/file-asso-fixes-for-windows-7/

You want EXE and COM files. Obviously you'll have to unzip them on a working computer.

Once you have made it so programs work, the first thing you'll want to do is run System Restore and restore to a date before all this occurred.

(There are also registry keys to re-enable safemode, and I know Hijack Hunter has tools to restore safe mode as well, but easier to just use system restore)

Afterwards, run scans with MBAM and HijackThis (run in Administrator), and feel free to post the logs and someone will look at them.

Mikki

Thanks for the advice, but not sure how to do it!

On the broken laptop, I cannot get onto the net, using either IE or Firefox, I get the message "open with.." - I click on IE and then a window appears saying "view downloads" and it lists firefox.exe and iexplore.exe.

How do I restore the registry associations? Can I do it via my laptop?

RussJK

Like I said, unzip them on a working computer (such as the computer you are using now). In your original post you said you'd copied files over using a disc, so just use the same method.

stilltheone

Mikki wrote: »

Thanks for the advice, but not sure how to do it!

On the broken laptop, I cannot get onto the net, using either IE or Firefox, I get the message "open with.." - I click on IE and then a window appears saying "view downloads" and it lists firefox.exe and iexplore.exe.

How do I restore the registry associations? Can I do it via my laptop?

Yes, download this and this file on to a working computer and 'extract' the REG files within on to a USB drive or burn them to a CD. Take that medium over to the broken computer and follow the instructions in the link supplied by RussJK.

stilltheone

Alternatively, download and save this Windows 7 Recovery Disc Image to a working computer.
Next, download and install ImgBurn(No need to install the Google Toolbar. Remove the relevant tick). Burn the Image to Disc. Use this guide(skip step 2b)

You can then use these instructions to assist you with an automatic Startup Repair or further to that, System Restore. Further than that we will have access to the Registry via Command Prompt.

RussJK

stilltheone wrote: »

Alternatively, download and save this Windows 7 Recovery Disc Image to a working computer.

I'll have to start using that URL with the direct download instead of the Neowin (bittorrent) link.

stilltheone

RussJK wrote: »

I'll have to start using that URL with the direct download instead of the Neowin (bittorrent) link.

You can list both. People can use whatever is convenient for them.

stilltheone

Neglected to add, if you are using the 64 bit version of Windows 7, use the Windows 7 64 bit Recovery Disc Image .

Mikki

OK, copied to disc and transferred over and it seems to have fixed things - thanks.

Have now downloaded Microsoft Security Essentials and am running a full scan at the moment. Should I still do a system restore? I've no idea when the computer got infected (I'm assuming recently) so no idea when to go back to.

RussJK

You definitely should to do system restore as it would be laborious to manually fix each registry entry that may have been changed. Just set it back to roughly before the problems started, i.e. was it a few days ago, a week ago, two weeks ago, etc...

Afterwards, then start doing scans etc. As you've installed Microsoft Security Essentials, you'll probably find after a system restore that it won't work properly, so it'll need to be reinstalled. You'll also have to ensure that the previous antivirus is uninstalled properly otherwise you'll have conflicts - what was it out of interest?