Ransomware - PCEU virus

[Fiery]

You got that error during the installation process?

The click Start > Run (Alternatively, you can press the Windows key + R). In the box, type:

sfc /scannow

Then try to run OTL in normal or safe mode.

 

[Fryern]

Hi Again,

Well I downloaded the app again. I go to get my flash drive out of the pc. First I delete the app. I then thought I'll try Word (don't ask me why) and low and behold it is working normally.

So I clicked explorer and it did not make an internet connection.

I can only think totally powering off achieved something. So the question is what should I do now?

I will run some scans while I await you answer.

 

[Fiery]

Applications are opening normally now?

Try the OTL scan now.

Also, did you run the setup.exe for the Windows Repair software from your USB?

 

[Fryern]

"Also, did you run the setup.exe for the Windows Repair software from your USB?"

Yes from the Flash drive as I did't think it would copy to the desktop. I have deleted it which is why I downloaded another new version. I deleted it to the Recycle bin on the PC. It will still be there.

So we don't get out of synch exactly in what order would you like me to continue?

 

[Fiery]

Hi, sorry about the confusion. Let's start over

Download the Window Repair setup.exe, transfer it to the PC's desktop and try to install it. I don't think you can run setup.exe from your USB. If you are able to install the program, follow the instructions in post #74

If you are unable to install the program, The click Start > Run (Alternatively, you can press the Windows key + R). In the box, type:

sfc /scannow

And press Enter.

Next, try to perform an OTL scan with the instructions in post #29.

If the programs don't run in normal mode, try to run it in safemode.

 

[Fryern]

So took the program off the USB onto the Desktop. It got a lot further but had the same problem.

So Start Run sfc/scannow..............can't find the program

Over to you

 

[Fiery]

Hi,

Did you make sure there is a space between the "c" and the "/".

 

[Fryern]

Of course not .....................

Didn't spot the "spirit"

Well of it goes now and nothing ............ at all .........no response..........desktop all still works as though nothing happened.


Tried OTL it hates Firefox no matter where I run it. Desktop functions work (not tried all) except internet ones

 

[Fiery]

Is your PC currently connected to a router or modem at the moment?

Please download Junkware Removal Tool to your desktop from here

• Turn off your antivirus software now to avoid potential conflicts
• Double-click to run the tool. For Windows Vista or 7 users, right-click the file and select Run as Administrator
• The tool will open and start scanning your system
• Please be patient as this can take a while to complete depending on your system's specifications
• On completion, a log (JRT.txt) will be saved to your desktop and will automatically open
• Post the contents of JRT.txt into your next reply

Also, can you uninstall firefox for now and see if OTL can finish it's scan? We can reinstall firefox afterwards

 

[Fryern]

Is your PC currently connected to a router or modem at the moment?

HI

Definition of directly. It is not via any cables. Whether it is or thinks it is wireless is another matter. That is the crux of the problem - it should be.


I'll do your suggestions first thing tomorrow as it is getting late.

Keep

 

[Fiery]

Ok, goodnight

Sorry I didn't quite understand you. Could you establish an connection (wired or wireless) to your router and modem.

 

[Fryern]

The internet connection is a BT Hub which has been running wireless for 12 months. It has ethernet. I have connected the Mac via ethernet which although very slow (age of Mac etc) allows me to communicate with you. So we know the hub works.

The PC is in a different room and I would have to move it to connect it via ethenet - it has 4 ethernet ports, and Bt Infinity (we don't have that here yet - fibre connection).

Now I have tried (fews days ago) to connect the PC via ethernet but I get the same messages - unable to make a connection.

jrt txt attached.

I have uninstalled Firefox and powered off the Pc. It does not show anymore in listings. Power it up and OTL is still looking for it. So I will download a new version and try that.

OTL still looking for Firefox ............new version.......beats me........only possibility is it maybe in favourites as a link to a website and therefore not deleted totally.

 

[Fiery]

Ok, let's try this. Ensure that OTL is on the PC, not on the USB.

Open OTL. Under custom scan/fixes, copy and paste the following:

:Files
ipconfig /flushdns /c

:Commands
[purity]
[EMPTYTEMP]
[RESETHOSTS]

Then click Run Fix. Let your PC reboot to normal mode. A new log will be created automatically, post the content in the next reply.

Next, download a new copy of combofix here and transfer it onto your PC Desktop. Double click it to run it normally.

 

[Fryern]

My version of OTL does not appear to have that feature.

At the bottom half of the page there is a section marked custom files/fixes in blue/green. I don't see how to open it up.

Also if I paste the amendments as a txt file to mac desktop, copy to flash drive, willI I be able to paste them into OTL?

Thanks

 

[Fiery]

"there is a section marked custom files/fixes in blue/green"

Yes, you will be able to transfer the script that way. Click that section, you can type the otl script i gave you into that box there

 

[Fryern]

With love from OTL

 

[Fiery]

Start copying from :files, don't copy the word "quote:"

 

[Fryern]

I spotted it was XXXX

 

[Fiery]

Ok, download a new copy of combofix, transfer ut to the pc and give it a run

 

[Fryern]

I'm doing that. Now I have to disable MSE. I can't see how do turn it off. It says ON but there appears to be no way of switching it off.

Should I uninstal it?