Computer Hope
Software => Computer viruses and spyware => Topic started by: Robinski on October 14, 2012, 05:45:25 PM
-
First off, I know there is an extremely similar topic ( http://www.computerhope.com/forum/index.php?topic=132377.0 ), but none of these suggestions fixed my problem.
I have an Asus N76VZ with Windows 7 Home Premium 64bit and this problem started just today.
This notebook is only about three months old and never had any issues before.
It probably all started when the trial period of Mcafee run out. I didn't really care about that and so i kept on surfing, watching videos etc. After some time I noticed that my computer got slower. It wouldn't open websites as fast as usual. It started to get annoying after I couldn't watch any videos. I then checked on speedtest.net and my connection downloaded with like 0,01 mbps or so. usually I get 2-5 mbps. It was also strange that more often than not I couldn't connect to speedtest at all. I then checked the same internet connection with my phone and other notebook and they had the usual 2-5 mbps. Moreover It changed my windows to nontransparent and back. I then started to wonder if it could be that my computer was infected.
So I tried activating Windows Defender and Mcafee (They were somehow deactivated) and it wouldn't let me. Windows Defender needed an update, which I started to download and install, but it never finished. That was the part where I raged and just wanted to shut the computer down, but I couldn't. I tried it but finally I just hit the power button.
After restarting it it showed me two options: Windows with startup help (Dont know if translated correctly) or normal mode. it doesn't really matter which mode I choose it always shows me that windows is loading some files and after that it runs the asus preload wizard.
TL;DR: After some odd behaviour (slow internet connection...) I shut my notebook down and now it only starts up with Asus preload wizard.
Things I tried:
1.Restart computer
2.Creating a rescue CD
3.running in safe mode
4.Booting from a downloaded system recovery disc
I don't want to use that preload wizard since it deletes my files. I can't run HijackThis or any other programs since I can't get to the desktop. Also I'm just assuming that this is caused by malware, so I posted it on here.
-
Hello and welcome to Computer Hope Forum. My name is Dave. I will be helping you out with your particular problem on your computer.
1. I will be working on your Malware issues. This may or may not solve other issues you have with your machine.
2. The fixes are specific to your problem and should only be used for this issue on this machine.
3. If you don't know or understand something, please don't hesitate to ask.
4. Please DO NOT run any other tools or scans while I am helping you.
5. It is important that you reply to this thread. Do not start a new topic.
6. Your security programs may give warnings for some of the tools I will ask you to use. Be assured, any links I give are safe.
7. Absence of symptoms does not mean that everything is clear.
If you can't access the internet with your infected computer you will have to download and transfer any programs to the computer you're using now and transfer them to the infected computer with a CD-RW or a USB storage device. I prefer a CD because a storage device can get infected. If you use a storage device hold the shift key down while inserting the USB storage device for about 10 secs. You will also have to transfer the logs you receive back to the good computer using the same method until we can get the computer back on-line.
*************************************************************************
We are going to be using a Windows Recovery Environment to help disinfect the system so it may boot again.
Download the OTLPE Standard REATOGO Windows Recovery Environment. - Place a blank CD-R disc in to your CD burning drive.
- Download OTLPEStd.exe (http://oldtimer.geekstogo.com/OTLPEStd.exe) and double-click on it to burn to a CD using an ISO Burner. One can be found here. (http://www.imgburn.com/index.php?act=download)
- Reboot your system using the boot CD you just created.
- Note : If you do not know how to set your computer to boot from CD follow the steps here (http://www.hiren.info/pages/bios-boot-cdrom)
- Your system should now display a REATOGO-X-PE desktop.
- Double-click on the OTLPE icon.
- When asked "Do you wish to load the remote registry", select Yes
- When asked "Do you wish to load remote user profile(s) for scanning", select Yes
- Ensure the box "Automatically Load All Remaining Users" is checked and press OK
- OTL should now start. Change the following settings
- Change Drivers to Non-Microsoft
- Press Run Scan to start the scan.
- When finished, the file will be saved in drive C:\_OTL\MovedFiles
- Copy this file to your USB drive if you do not have internet connection on this system
- Please post the contents of the OTL.txt file in your reply.
-
Thanks so much for the help.
Ok I burned it to CD and tried to reboot with it. I changed boot mode to CD and it began starting Reatogo-X-PE. Then it changes shortly to a Windows XP startup logo, loads 2 seconds and shows me a BSOD stating the following:
*** STOP: 0x0000007B (0xF78DA528, 0xc0000034, 0x00000000, 0x00000000)
Wouldn't I be better off just using the preload wizard?
-
Ok. Let's try this:
Please Boot to the System Recovery Options (http://www.sevenforums.com/tutorials/668-system-recovery-options.html)
If you have Windows 7 installation disc, just insert a DVD to the drive, restart computer and it should load automatically (option two presented in the article).
It's possible also that your computer has a pre-installed recovery partition instead - in such a case use a method one (by pressing F8 before Windows starts loading)...
NOTE. If none of the above apply you can create System Repair Disc (link in "Option two") and boot from it.
On the System Recovery Options menu you will get the following options:
- Startup Repair
- System Restore
- Windows Complete PC Restore
- Windows Memory Diagnostic Tool
- Command Prompt
Choose Command Prompt
You should see X:\SOURCES>...
Execute the following commands in bold.
Press Enter after every one of them.
bootrec /fixmbr (<--- there is a "space" after "bootrec")
bootrec /fixboot (<--- there is a "space" after "bootrec")
exit
Restart computer.
-
Thanks again for the help.
Now the problem is, I it shows me that I have the wrong version of the recovery disc. (This version of System recovery Options is not compatible with the version of Windows you are trying to repair)
I tried it with a downloaded iso file as well as with one that I created from another Windows 7 computer. I even tried using 32 bit ones but they obviously didn't work.
Edit for clarification: Neither do I have a Windows 7 Install disc, nor does my computer have a pre-installed recovery partition. (Using the F8 to repair the computer just leads back to Asus PW)
-
Thanks again for the help.
Now the problem is, I it shows me that I have the wrong version of the recovery disc. (This version of System recovery Options is not compatible with the version of Windows you are trying to repair)
I tried it with a downloaded iso file as well as with one that I created from another Windows 7 computer. I even tried using 32 bit ones but they obviously didn't work.
Edit for clarification: Neither do I have a Windows 7 Install disc, nor does my computer have a pre-installed recovery partition. (Using the F8 to repair the computer just leads back to Asus PW)
Your only hope now is to get the notebook to boot from the OTL rescue disk. Please try the disk you created in another computer. It won't do any harm but if the disk was created correctly, the computer should boot from the disk.
-
Well, it appears that all hope is lost. I tried the System Repair disc on the system it was created and it worked perfectly fine. On the other hand, I tried it on the infected one and it shows me the same error as always; (This version of System recovery Options is not compatible with the version of Windows you are trying to repair)
Note: I created two System repair discs on the working system:
I tried the 1st one on the broken computer first, where it didn't work and after that on the functioning computer, where it oddly didn't work either.
2nd disc was tried first on the functioning computer, where it did work, and after that on the broken computer, where it didn't work.
Is it worth noting that these discs are quite old?
I will try creating some more OTL rescue disks and booting from them, but assuming this is a worst case scenario, which is perfectly possible, I have two questions:
If I need to use Asus PW, which recovery option should I choose?
1.Recover Windows to first partition only
2.Recover Windows to entire HD
3.Recover Windows to entire HD with two partitions
And what should I do afterwards?
-
If I need to use Asus PW, which recovery option should I choose?
1.Recover Windows to first partition only
2.Recover Windows to entire HD
3.Recover Windows to entire HD with two partitions
And what should I do afterwards?
Do you remember if your harddrive was partitioned? If you don't remember you should try a recovery to the first partition only.
-
The notebook has a C and D Partition. I will try the first option, but it would be helpful to know which anti-malware tools I should install, as I'm not up to date.
So which software should I install afterwards and how do I check if the system is still infected?
-
The notebook has a C and D Partition. I will try the first option, but it would be helpful to know which anti-malware tools I should install, as I'm not up to date.
So which software should I install afterwards and how do I check if the system is still infected?
The Recovery console should be on the D drive. If you manage to do a repair then the computer should be clean. As for the anti-malware, it really depends on which AV you are running. Most AV's now come with anti-malware such as MicroSoft Security Essentials.
-
The Recovery console should be on the D drive. If you manage to do a repair then the computer should be clean.
What do you mean by that?
-
What do you mean by that?
Most computers nowdays do not come with the OS disks. The Recovery Console is installed in a separate partition on the harddrive.
-
OK, so I reset my notebook to factory settings and now everything should be fine. Needless to say it isn't.
After I login Windows prompts an error message, saying that Windows has detected a hard disk problem.
I checked the SMART status of my harddrive and found out that everything is ok, but Re-allocated Sector Count.
Is there even a simple fix for this? I wouldn't mind making use of my warranty at this point.
Also, do you have any idea, what could have caused this disaster?
-
Is there even a simple fix for this? I wouldn't mind making use of my warranty at this point.
Also, do you have any idea, what could have caused this disaster?
You could try a harddrive diagnostic but your best bet would be the warranty.
Run hard drive diagnostics: tacktech.com (http://www.tacktech.com/display.cfm?ttid=287)
Make sure, you select tool, which is appropriate for the brand of your hard drive.
Depending on the program, it'll create bootable floppy, or bootable CD.
If downloaded file is of .iso type, use ImgBurn: imgburn (http://www.imgburn.com/) to burn .iso file to a CD (select "Write image file to disc" option), and make the CD bootable.
For Toshiba hard drives, see here: (http://sdd.toshiba.com/main.aspx?Path=ServicesSupport/FujitsuDrivesUSandCanada/SoftwareUtilities#diagnostic)
Note : If you do not know how to set your computer to boot from CD follow the steps here (http://www.hiren.info/pages/bios-boot-cdrom)
-
After another few factory resets I contacted the Asus support.
I just wanted to thank you for your time and advice and even though my problem couldn't be fixed I appreciated your help.
-
You're welcome. I will lock this thread. If you need it re-opened, please send me a pm.