Solved Downloaded a file called "install.exe". PC now locked.

[Mirai]

I was on YouTube looking for a certain file, and came across it. I downloaded it and it was a .RAR file. I clicked on it and inside it had an application called "install.exe". I clicked it and it brought up some errors and closed everything that I had opened, including my computer. After this it restarted, but came up with a window similar to the one that pops up when you open an administrator program and it asks for the admin password. This said the following:



Window name: User Account Control



Message: THIS COMPUTER HAS BEEN LOCKED

PROGRAM NAME: INSTALL.EXE

VERIFIED PUBLISHER: UNKNOWN

FILE ORIGIN: HARD DRIVE ON THIS COMPUTER.



To continue, type an administrato password and then click Yes.



(A Windows 7-like profile picture appears with the word admin next to it and a text box under it)



Under the text box there are two buttons.



"Get Password" and "Unlock".



Pressing Unlock will do nothing but pressing Get Password will bring me to a site called "gotlinks.co/2zCz", but since I use a mobile internet modem that needs to be started via a separate program, couldn't even use the internet.



I can't use the computer at all since it just throws that screen there whenever I try to start.

Also I have downloaded the farbar thing but for some reason my computer doesn't show the "repair my computer" selection when I try the F8 advanced menu



Help would be greatly appreciated.



Thanks.

(And yes I did copy this from someone else from this site that had a similiar problem last month and am using my mother's laptop to even post this :I)

 

[TwinHeadedEagle]

Hello,


Before we start please note the following:

Limit your internet access to posting here, some infections just wait to steal typed-in passwords.

Don't run any scripts or tools on your own, unsupervised usage may cause more harm than good.

Do not paste the logs in your posts, attachments make my work easier. There is a Upload a File button which you can use to attach your reports. Attach all reports.

Stay with me to the end, the absence of symptoms doesn't mean that your machine is fully operational.

Note that we may live in totally different time zones, what may cause some delays between answers.

Do not ask for help for your business PC. Companies are making revenue via computers, so it is good thing to pay someone to repair it.

I can't foresee everything, so if anything unexpected happens, please stop and inform me!

There are no silly questions. Never be afraid to ask if in doubt!



What is the versions of your PC and architecture (32/64 bit). Also tell me what happens when you press F8 several times?

 

[Mirai]

Well, I'm running windows 7 home premium and 64 bit. Pressing F8 several times during startup brings up the advanced menu but the "repair my computer" option is always missing no matter how many times I've tried.

 

[TwinHeadedEagle]

Ok, we will burn required tools on your USB.


Please download the following tools on your Desktop:

1. Farbar Recovery Scan Tool x64
2. Rufus
3. Windows 7 RC x64

• Insert your USB and then start Rufus
• Select the ISO file win7 64bit rc.iso on the desktop via the ISO icon.

• Under the Device select your USB Flash.
• Press Start
• When the process is complete, copy Farbar Recovery Scan Tool x64 on this USB

• Insert USB into infected computer and power on the computer. Now you need to set your computer to boot from USB. In order to do that, follow this guide.
• When you boot from USB, you will see image like this:

• Click Repair your computer
• Follow the prompt to enter keyboard input method, and then the prompt to enter a password. If the machine does not have a password, simply click Enter.

In the next menu, use the arrow keys on the keyboard to highlight Command Prompt and press Enter.

• In the command window type in notepad and press Enter.
• When notepad opens, click File and select Open.
• Select "Computer" and find your flash drive letter and close the notepad.
• In the command window type e:\frst64.exe and press Enter.

Note: Replace letter e with the drive letter of your flash drive.

• The tool will start to run. When the tool opens click Yes to disclaimer.
• Press Scan button.

It will make a log (FRST.txt) on the flash drive. Please attach it to your reply.

 

[Mirai]

Ok, heres the log

 

[TwinHeadedEagle]

Download attached fixlist.txt and save it to your USB flashdrive as fixlist.txt

>> Boot into Recovery Environment


Start FRST in a similar manner to when you ran a scan earlier, but this time when it opens ....

• Press the Fix button once and wait.
• FRST will process fixlist.txt
• When finished, it will produce a log fixlog.txt on your USB flashdrive.

>> Exit out of Recovery Environment and post me the log please.



Try to boot Windows normally...

 

[Mirai]

heyy, I was able to boot normally, is there something more I should do?

 

[TwinHeadedEagle]

I would like to see Fixlog report found on your USB.


We also need final check:

Scan with Farbar Recovery Scan Tool

Please download Farbar Recovery Scan Tool x64 and save it to your Desktop.

• Right-click on
  
  icon and select
  
  Run as Administrator to start the tool.
  (XP users click run after receipt of Windows Security Warning - Open File).
• When the tool opens click Yes to disclaimer.
• Make sure that Addition option is checked.
• Press Scan button and wait.
• The tool will produce two logfiles on your desktop: FRST.txt and Addition.txt.

Please attach them into your next reply.

 

[Mirai]

There you go

 

[TwinHeadedEagle]

We need few more steps in order to fully clean your PC.


First go to Control Panel and remove following:
- Advanced System Protector
- GigaClicks Crawler
- HulaToo
- Media Watch
- MyPC Backup
- PC Speed Up
- qone8 uninstaller
- Search Protect
- Software Version Updater
- SupTab
- Wajam

Fix with Farbar Recovery Scan Tool

This fix was created for this user for use on that particular machine.

Running it on another one may cause damage and render the system unstable.

​

Download attached fixlist.txt file and save it to the Desktop:

Both files, FRST and fixlist.txt have to be in the same location or the fix will not work!

• Right-click on
  
  icon and select
  
  Run as Administrator to start the tool.
  (XP users click run after receipt of Windows Security Warning - Open File).
• Press the Fix button just once and wait.
• If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run.
• When finished FRST will generate a log on the Desktop, called Fixlog.txt.

Please attach it to your reply.




Please download AdwCleaner by Xplode and save to your Desktop.

Double click on AdwCleaner.exe to run the tool.

• Click on the Scan button.
• After the scan has finished click on the Clean button.

Press OK when asked to close all programs and follow the onscreen prompts.
Press OK again to allow AdwCleaner to restart the computer and complete the removal process.

• After rebooting, a logfile report (AdwCleaner[S0].txt) will open automatically.
• Post logfile will also be saved in the C:\AdwCleaner folder.

Tell me how is your computer now?

 

[Mirai]

I'd say the computer is running just like it used to so I'll assume it's just fine now?

 

[TwinHeadedEagle]

You were infected with bunch of Adware that made your PC unusable.


Below you will find my thoughts about securing your machine. Go ahead through it, you will benefit from some useful advice about safe computing.

Recommended reading:
​

MUST READ - security tips: Computer Security - a short guide to staying safer online. Simple and easy ways to keep your computer safe and secure on the Internet

MUST READ - general maintenance: What to do if your Computer is running slowly?

Recommended additional software:
​

TFC - to clean unneeded temporary files.

Malwarebytes' Anti-Malware - to scan your system from time to time in search for malware.

Malwarebytes' Anti-Exploit - to prevent plenty of mostly exploited vulnerabilities.

McShield - to prevent infections spread by removable media.

CryptoPrevent - to secure yourself from very severe CryptoLocker infection.

Unchecky - to prevent from installing additional foistware, implemented in legitimate installations.


• The following will implement some post-cleanup procedures:

=> Please download DelFix by Xplode to your Desktop.

Run the tool and check the following boxes below;

Remove disinfection tools

Create registry backup

Purge System Restore
Click Run button and wait a few seconds for the programme completes his work.
At this point all the tools we used here should be gone. Tool will create an report for you (C:\DelFix.txt)

The tool will also record healthy state of registry and make a backup using ERUNT program in %windir%\ERUNT\DelFix
Tool deletes old system restore points and create a fresh system restore point after cleaning.



Stay safe,
TwinHeadedEagle