I'm stuck - Windows Stable Work

[Li'l Abner]

This is a Windows 7 laptop. It boots up to a momentary "Safe Boot" screen
which soon goes away and is replaced by "Windows Stable Work".
Control-Alt-Delete + Start Task Manager pops something up which goes away
before you can read it and then it goes bck to the main screen which still
has Windows Stable Work on it. If you let it scan and then tell it to Fix
Errors, then you finally get to the point where you can close it and the
Windows Desktop. Most anything you try to do pops up a "Warning" with the
name of an infection and a choice to Deny or Enable Protection. Of course I
didn't pursue this. That can be closed with Alt-F4. Regedit won't run. A
reg file won't run. Batch files won't run. They're all intercepted by that
warning popup. I can open My Computer and browse everything on the drive
and on my thumb drive. A text file will open in notepad. Pictures will
open. Renaming exe to com doesn't cut it either. And I get the same exact
results in Safe Mode. If it were XP, I could probably log in to the
Administrator account and get around it. But Windows 7 doesn't have an
Administrator account.

What do I do now?

Of course, the restore to factory option is there, but as before I'd like
to avoid that if possible.

--
--- Everybody has a right to my opinion. ---

[David H. Lipman]

From: "Li'l Abner" <blvstk@dogpatch.com>

> This is a Windows 7 laptop. It boots up to a momentary "Safe Boot" screen
> which soon goes away and is replaced by "Windows Stable Work".
> Control-Alt-Delete + Start Task Manager pops something up which goes away
> before you can read it and then it goes bck to the main screen which still
> has Windows Stable Work on it. If you let it scan and then tell it to Fix
> Errors, then you finally get to the point where you can close it and the
> Windows Desktop. Most anything you try to do pops up a "Warning" with the
> name of an infection and a choice to Deny or Enable Protection. Of course I
> didn't pursue this. That can be closed with Alt-F4. Regedit won't run. A
> reg file won't run. Batch files won't run. They're all intercepted by that
> warning popup. I can open My Computer and browse everything on the drive
> and on my thumb drive. A text file will open in notepad. Pictures will
> open. Renaming exe to com doesn't cut it either. And I get the same exact
> results in Safe Mode. If it were XP, I could probably log in to the
> Administrator account and get around it. But Windows 7 doesn't have an
> Administrator account.
>
> What do I do now?
>
> Of course, the restore to factory option is there, but as before I'd like
> to avoid that if possible.
>

Have you tried removing the hard disk from the affected computer and placing on a
surrogate computer ?

Then you can scan the affected hard disk and/or manually cleanout TEMP folders, EXE files
that don't belong in %appdata%, etc....



--
Dave
Multi-AV Scanning Tool - http://www.pctipp.ch/downloads/dl/35905.asp

[Li'l Abner]

"David H. Lipman" <DLipman~nospam~@Verizon.Net> wrote in
news:iu0i4i0plk@news3.newsguy.com:

> From: "Li'l Abner" <blvstk@dogpatch.com>
>
>> This is a Windows 7 laptop. It boots up to a momentary "Safe Boot"
>> screen which soon goes away and is replaced by "Windows Stable Work".
>> Control-Alt-Delete + Start Task Manager pops something up which goes
>> away before you can read it and then it goes bck to the main screen
>> which still has Windows Stable Work on it. If you let it scan and
>> then tell it to Fix Errors, then you finally get to the point where
>> you can close it and the Windows Desktop. Most anything you try to do
>> pops up a "Warning" with the name of an infection and a choice to
>> Deny or Enable Protection. Of course I didn't pursue this. That can
>> be closed with Alt-F4. Regedit won't run. A reg file won't run. Batch
>> files won't run. They're all intercepted by that warning popup. I can
>> open My Computer and browse everything on the drive and on my thumb
>> drive. A text file will open in notepad. Pictures will open. Renaming
>> exe to com doesn't cut it either. And I get the same exact results in
>> Safe Mode. If it were XP, I could probably log in to the
>> Administrator account and get around it. But Windows 7 doesn't have
>> an Administrator account.
>>
>> What do I do now?
>>
>> Of course, the restore to factory option is there, but as before I'd
>> like to avoid that if possible.
>>
>
> Have you tried removing the hard disk from the affected computer and
> placing on a surrogate computer ?
>
> Then you can scan the affected hard disk and/or manually cleanout TEMP
> folders, EXE files that don't belong in %appdata%, etc....

OK. I need to get the drive out of it anyway so I can get the guy's data
backed up anyway.

Actually, I had already planned to slave it, but I never thought about
being able to repair it that way. If getting rid of the offending files
will allow it to run again, then maybe it will allow mr to run regedit
when I put it back.

Thanks for that suggestion. That's what I'll do next!

--
--- Everybody has a right to my opinion. ---

[David H. Lipman]

From: "Li'l Abner" <blvstk@dogpatch.com>

> "David H. Lipman" <DLipman~nospam~@Verizon.Net> wrote in
> news:iu0i4i0plk@news3.newsguy.com:
>
>> From: "Li'l Abner" <blvstk@dogpatch.com>
>>
>>> This is a Windows 7 laptop. It boots up to a momentary "Safe Boot"
>>> screen which soon goes away and is replaced by "Windows Stable Work".
>>> Control-Alt-Delete + Start Task Manager pops something up which goes
>>> away before you can read it and then it goes bck to the main screen
>>> which still has Windows Stable Work on it. If you let it scan and
>>> then tell it to Fix Errors, then you finally get to the point where
>>> you can close it and the Windows Desktop. Most anything you try to do
>>> pops up a "Warning" with the name of an infection and a choice to
>>> Deny or Enable Protection. Of course I didn't pursue this. That can
>>> be closed with Alt-F4. Regedit won't run. A reg file won't run. Batch
>>> files won't run. They're all intercepted by that warning popup. I can
>>> open My Computer and browse everything on the drive and on my thumb
>>> drive. A text file will open in notepad. Pictures will open. Renaming
>>> exe to com doesn't cut it either. And I get the same exact results in
>>> Safe Mode. If it were XP, I could probably log in to the
>>> Administrator account and get around it. But Windows 7 doesn't have
>>> an Administrator account.
>>>
>>> What do I do now?
>>>
>>> Of course, the restore to factory option is there, but as before I'd
>>> like to avoid that if possible.
>>>
>> Have you tried removing the hard disk from the affected computer and
>> placing on a surrogate computer ?
>>
>> Then you can scan the affected hard disk and/or manually cleanout TEMP
>> folders, EXE files that don't belong in %appdata%, etc....
>
> OK. I need to get the drive out of it anyway so I can get the guy's data
> backed up anyway.
>
> Actually, I had already planned to slave it, but I never thought about
> being able to repair it that way. If getting rid of the offending files
> will allow it to run again, then maybe it will allow mr to run regedit
> when I put it back.
>
> Thanks for that suggestion. That's what I'll do next!
>

That's the spirit :-)



--
Dave
Multi-AV Scanning Tool - http://www.pctipp.ch/downloads/dl/35905.asp

[Li'l Abner]

"David H. Lipman" <DLipman~nospam~@Verizon.Net> wrote in
news:iu0q0501rh@news6.newsguy.com:

> From: "Li'l Abner" <blvstk@dogpatch.com>
>
>> "David H. Lipman" <DLipman~nospam~@Verizon.Net> wrote in
>> news:iu0i4i0plk@news3.newsguy.com:
>>
>>> From: "Li'l Abner" <blvstk@dogpatch.com>
>>>
>>>> This is a Windows 7 laptop. It boots up to a momentary "Safe Boot"
>>>> screen which soon goes away and is replaced by "Windows Stable Work".
>>>> Control-Alt-Delete + Start Task Manager pops something up which goes
>>>> away before you can read it and then it goes bck to the main screen
>>>> which still has Windows Stable Work on it. If you let it scan and
>>>> then tell it to Fix Errors, then you finally get to the point where
>>>> you can close it and the Windows Desktop. Most anything you try to do
>>>> pops up a "Warning" with the name of an infection and a choice to
>>>> Deny or Enable Protection. Of course I didn't pursue this. That can
>>>> be closed with Alt-F4. Regedit won't run. A reg file won't run. Batch
>>>> files won't run. They're all intercepted by that warning popup. I can
>>>> open My Computer and browse everything on the drive and on my thumb
>>>> drive. A text file will open in notepad. Pictures will open. Renaming
>>>> exe to com doesn't cut it either. And I get the same exact results in
>>>> Safe Mode. If it were XP, I could probably log in to the
>>>> Administrator account and get around it. But Windows 7 doesn't have
>>>> an Administrator account.
>>>>
>>>> What do I do now?
>>>>
>>>> Of course, the restore to factory option is there, but as before I'd
>>>> like to avoid that if possible.
>>>>
>>> Have you tried removing the hard disk from the affected computer and
>>> placing on a surrogate computer ?
>>>
>>> Then you can scan the affected hard disk and/or manually cleanout TEMP
>>> folders, EXE files that don't belong in %appdata%, etc....
>>
>> OK. I need to get the drive out of it anyway so I can get the guy's data
>> backed up anyway.
>>
>> Actually, I had already planned to slave it, but I never thought about
>> being able to repair it that way. If getting rid of the offending files
>> will allow it to run again, then maybe it will allow mr to run regedit
>> when I put it back.
>>
>> Thanks for that suggestion. That's what I'll do next!
>>
>
> That's the spirit :-)

I got the necessary data files copied, but I couldn't find anything
suspicious in the appdata folder.

So I put the drive back in the laptop and booted up to the now activated
Administrator account. Thanks to From The Rafters for that lead. From there
I was able to clean it up. MBam, then SAS, then I could boot into the users
account where I ran both those again. Uninstalled the already expired
Norton IS, installed Avira, turned off System Restore, am running full scan
with Avira now. And then will turn system restore back on!

Thanks for your much respected advice as usual!

That was one hell of a virus!
©I just Couldn't resist

--
--- Everybody has a right to my opinion. ---

[David H. Lipman]

From: "Li'l Abner" <blvstk@dogpatch.com>

>> That's the spirit :-)
>
> I got the necessary data files copied, but I couldn't find anything
> suspicious in the appdata folder.
>
> So I put the drive back in the laptop and booted up to the now activated
> Administrator account. Thanks to From The Rafters for that lead. From there
> I was able to clean it up. MBam, then SAS, then I could boot into the users
> account where I ran both those again. Uninstalled the already expired
> Norton IS, installed Avira, turned off System Restore, am running full scan
> with Avira now. And then will turn system restore back on!
>
> Thanks for your much respected advice as usual!
>
> That was one hell of a virus!
> ©I just Couldn't resist
>

Bwahahahahahahahas ;-)

BTW: %appdata%, %temp% are a couple of examples. I hoped you SERIOUSLY looked at the
MBAM & SAS logs to see WHERE the files were found so you can use that information in the
future.



--
Dave
Multi-AV Scanning Tool - http://www.pctipp.ch/downloads/dl/35905.asp

[Whoever]

On 6/23/2011 9:18 PM, Li'l Abner wrote:
> "David H. Lipman"<DLipman~nospam~@Verizon.Net> wrote in
> news:iu0i4i0plk@news3.newsguy.com:
>>>
>>> What do I do now?
>>
>> Have you tried removing the hard disk from the affected computer and
>> placing on a surrogate computer ?
>>
>> Then you can scan the affected hard disk and/or manually cleanout TEMP
>> folders, EXE files that don't belong in %appdata%, etc....
>
> OK. I need to get the drive out of it anyway so I can get the guy's data
> backed up anyway.
>
> Actually, I had already planned to slave it, but I never thought about
> being able to repair it that way. If getting rid of the offending files
> will allow it to run again, then maybe it will allow mr to run regedit
> when I put it back.


Since you're going to back up the data anyway, Dave's suggestion is
probably best. For my own part, I'm kind of partial to downloading an
up-to-date Avira Rescue CD and tackling these types with it. Keeping the
regfix for .exe's for XP and Vista/Win7 on hand doesn't hurt either.


http://www.avira.com/en/support-down...-rescue-system
http://www.dougknox.com/xp/file_assoc.htm
http://support.microsoft.com/kb/950505


--
Are we having fun yet?

[Aardvark]

On Thu, 23 Jun 2011 20:18:39 -0500, Li'l Abner wrote:

> OK. I need to get the drive out of it anyway so I can get the guy's data
> backed up anyway.

No, you don't.



--
"Those who do not make human beings the center of their concern soon
lose the capacity to make any ethical choices, for they willingly
sacrifice others in the name of the politically expedient and
practical." - Dwight Macdonald, “The Root Is Man.�

[FromTheRafters]

"Aardvark" <aardvark@youllnever.know> wrote in message
news:iu23jk$78n$5@dont-email.me...
> On Thu, 23 Jun 2011 20:18:39 -0500, Li'l Abner wrote:
>
>> OK. I need to get the drive out of it anyway so I can get the guy's data
>> backed up anyway.
>
> No, you don't.

Indeed, but it is a well known almost sure-fire method of
ensuring that the malware isn't running while you do.

Cryptovirological ransomware could ransom your backups
too.

[Aardvark]

On Fri, 24 Jun 2011 10:32:39 -0400, FromTheRafters wrote:

> "Aardvark" <aardvark@youllnever.know> wrote in message
> news:iu23jk$78n$5@dont-email.me...
>> On Thu, 23 Jun 2011 20:18:39 -0500, Li'l Abner wrote:
>>
>>> OK. I need to get the drive out of it anyway so I can get the guy's
>>> data backed up anyway.
>>
>> No, you don't.
>
> Indeed, but it is a well known almost sure-fire method of ensuring that
> the malware isn't running while you do.
>

I didn't suggest running the OS which is installed on the HD being
examined/cleaned. I just said that it isn't necessary to remove the HD.

Boot CDs come in very handy, you know.

> Cryptovirological ransomware could ransom your backups too.





--
"Those who do not make human beings the center of their concern soon
lose the capacity to make any ethical choices, for they willingly
sacrifice others in the name of the politically expedient and
practical." - Dwight Macdonald, “The Root Is Man.�