[indigurl]

HELP!!!!!
I got attacked last night by one of the join our internet security things
it turned off my Norton and malwarebytes the installed several porn icons on my desktop. when I tried to shut down and restart it in safe mode nothing will happen now.
Black screen is all I can get now.

 

[pcs365_3]

Can you log in back to the Normal Mode after you restart?

 

[TheGift73]

Hi indigurl,

Can you start in Safe Mode? To do this, reboot your PC and as it is starting up, keep tapping the F8 key. Select to boot without networking and see if you can run Malwarebytes that way.
I would also advise that you post a HJT log file to the Security Centre on this site, as they are great at cleaning up your PC.

Edit: Sorry, didn't realise that you had tried to start in Safe Mode already. Did you try Safe Mode without networking?

 

[indigurl]

I can'tstart in safe mode it won't let me.
I have tried starting in safe mode several different ways and it simply won't do anything.

 

[indigurl]

Sorry,what is an HJT log file?

 

[Receng56]

Have you got access to another desktop PC?

 

[indigurl]

yes I have access to a PC

 

[indigurl]

I have tried to start my computerin safe mode, safe mode with networking and when I do the log starts but only 14 lines show then it stops.
this is what each line says.
multi(0)disk(0)rdisk(0)partition(2)\windows thenall but 2 say \system32\
then as follows on each line but 2
\ntoskrnl.exe
\hal.dll
\KDCOM.DLL
\BOOTVID.dll
\config\system
\_1252.nls
_437.nls
\l_intl.nls
then the one for fonts
then\AppPatch\drvmain.sdb
\DRIVERS\ACPI.sys
\DRIVERS\WMILIB.SYS
\DRIVER\pci.sys
\DRIVER\isapnp.sys


This is all the farther it will go

 

[Receng56]

Is this other PC a laptop or a desktop? Is your infected PC a laptop or a desktop?

 

[indigurl]

the infected one is a Dellinspiron E1705

 

[Receng56]

the infected one is a Dellinspiron E1705

Laptop or desktop? This determines what size the drive is!

 

[indigurl]

Laptop

 

[Receng56]

Could you PM me the service tag no on the bottom Click on my username to do this.

 

[indigurl]

couple of other things I remembered about when the attack happened, first what appeared to be a microsoft aleart popped up, then it told me my firewall was not on so I tried to turn it on. When I did this alll these other things saying i was under attack came up then this virus program came on and I could no longer get to Norton,spybot or malwarebytes.
I also had all these little evevelopes coming up in my sys tray. When that happened I just shut down
I then tried to reboot in safe mode and it wouldn'tlet me so I shut down again then I tried the Last known good configuration and nothing. shut

Now I noticed when I do turn it on and get to the safe mode screen one of the lights that is usually on when I am using the computer goes off and the machine also is much easier to turn off. If i just touch the power button it goes right off.

I know this is serious I just hope there is something we can do to fix it!!

 

[Sexypilgrim]

Obviously it was originally feeding the malware through the internet connection. The "LOLCLICKMEFORGEWDANTIVIRUS" is programmed to stop the initial boot of any type of safe mode or normal mode you go into. The good thing is that it cannot spread to other parts of the computer while the computer is off *correct me if im wrong, please*

What I would do is attempt to go into BIOS and if you have any hunch of what part of your computer got infected disbale it in bios. If the badware doesn't even let you boot, you are prolly **** out of luck.

 

[Receng56]

According to Dell you have a 60 GB SATA drive. You can remove it like this. You need to purchase an USB external drive case like this. Put your laptop hd in this case and connect it to another PC. Make sure the Anti Virus program is up to date. This way you should be able to recover any data that you want and scan it with your AV program an Malwarebytes.