cant access safe mode due to a virus/malaware

mambo69

i will check the log file and post the name

RussJK

mambo69 wrote: »

i will check the log file and post the name

Thanks, I'd be quite interested to read the relevant portions of the log!

Kaspersky should have stuck a log somewhere on drive C.

gaming_guy

..............

RussJK

Was it the same as this one?

nijinsky_2

I have been 'hit' with the same screen. Unable to get past this. F8 function appears to be disabled. I tried the Kapersky option provided by santer but even though I told my pc to boot from the cd rom I was prompted with Strike F1 to reboot. I hit the F1 Key but all it did was to give me the same message: Strike F1 to reboot. So annoying. Could anyone help me as all my photos and music are on my computer. Thanks

santer_2

Can you try this unlock code

754-896-324-589-742

Otherwise

http://forums.malwarebytes.org/index.php?showtopic=82829

RussJK

nijinsky wrote: »

I have been 'hit' with the same screen. Unable to get past this. F8 function appears to be disabled. I tried the Kapersky option provided by santer but even though I told my pc to boot from the cd rom I was prompted with Strike F1 to reboot. I hit the F1 Key but all it did was to give me the same message: Strike F1 to reboot. So annoying. Could anyone help me as all my photos and music are on my computer. Thanks

Try another boot disk:
https://forums.moneysavingexpert.com/discussion/comment/41653210#Comment_41653210

Just keep trying until one works. Also make sure you correctly burn the CD - as if you just copy the ISO file onto it then it won't work.

You have all the time in the world to sort it out - your data won't go anywhere.

RussJK

santer wrote: »

Can you try this unlock code
754-896-324-589-742
Otherwise
http://forums.malwarebytes.org/index.php?showtopic=82829

OTLPE is a great program, but in that case it was a Winlocker, i.e. one that runs after Windows loads, executing an alternative shell to effectively lock people out of explorer.

If it's something that starts before Windows, then it's an MBRLock and the malware/ransomware has inserted some code before the legitimate code. Here's an example of one:
http://xylibox.blogspot.com/2011/04/trojanmbrlock-outputexe.html

Xylibox is a great resource for ransomware, but only really for the East European ones that leak here.

OTL/PE does have the option to save the MBR for checking with antivirus companies/virustotal:
http://www.geekstogo.com/forum/topic/277391-otl-tutorial-how-to-use-oldtimer-listit/

But generally it's best to let the antivirus rescue CDs sort things out. Looking around in forums, I've seen people saying that they've lost all their data despite having someone in to try to remove it. The various antivirus blogs warn against a simple 'Fixmbr' approach, and I'm guessing this is what was used.

rhythmsoup

Hi, I would say before you attempt any repair, you should backup your data. I wrote this post a while ago, it might help you:

https://forums.moneysavingexpert.com/discussion/2359753

Thanks

RussJK

rhythmsoup wrote: »

Hi, I would say before you attempt any repair, you should backup your data. I wrote this post a while ago, it might help you:
https://forums.moneysavingexpert.com/discussion/2359753
Thanks

Won't hurt to try, but often the partitions won't be visible until the boot sector is repaired. Just don't want anyone to try, fail, then panic

I do agree in general with what you say though.