Facebook Email Attacked Windows 8 Laptop

[REDACTED]

My husband had a facebook friend request email and he forgot to login to Facebook to check the request out.  He clicked on the link in the email and something popped up that a problem was detected with the computer and to click here.  He usually asks me before clicking anything like that and this time he did not.  It said it was shutting down and restarting and I guess it did, then before leaving the house I did manage to start a MalWarebytes scan.  When we returned the scan box had completly dissapeared and nothing would work, mouse would move but not be clickable, undid the mouse to use the touchpad, curser will move but will not point and click.  I forced it to turn off by holding the power button down, and then turned it back on and some sort of message that there was a problem and checking for errors.  Still had same issues, let it sit overnight and everything is the same.  Will not even recognize the mouse now.  I am uploading a photo of the bottom right side of the bar, there is an icon with a yellow triangle with a ! and I do not know what it means.  Also, lists two other issues and one is probably backup needed.  THANKS!

[Pondus]

Instructions  >>  https://forum.avast.com/index.php?topic=194892.0

[REDACTED]

I would do another MalWareBytes, Avast scan etc. but I cannot get the laptop to do anything but let me move the cursor around.  I just got back from being gone for hours and the screen saver did not kick in. Do I push the power button to at least force it to shut down until we figure out what to do?  I cannot even open a webpage to download anything new. 

[dbrisendine]

Do you have access to a working computer to download files and transfer them via a USB stick / drive?

[REDACTED]

Yes, My laptop is running Windows 8.  We also have a desktop that runs Win 7 Professional.  I have several USB I call them Flash Drive.
Thank you!

[REDACTED]

Is there anything we can do?  I know I did the USB from one computer to the other repair for a friend a few years ago.  I hope we can do that now.

[Pondus]

Malware removal experts are volunteers, they have a life outside of this forums, it is weekend so they may be busy with other stuff

[REDACTED]

Thank you!  Very good point!

[dbrisendine]

I have sent you the download links for the ISO images via a PM here.  Please do not share these as they are for your use only.  Only download the ISO you need.  Thanks.




Download the following three programmes to your desktop :

1.  Rufus
 
For 64bit systems
2. Windows 8  64bit RC
For 32bit systems
2. Windows 8 RC


3. Farbar Recovery Scan Tool
 
 
Insert the USB stick Then run Rufus
 


Select the ISO file on the desktop via the ISO icon.
 
Press Start Burn


Then copy FRST to the same USB 
 
 
 
 
 
Insert the USB into the sick computer and start the computer.  First ensuring that the system is set to boot from USB
Note: If you are not sure how to do that follow the instructions Here
 
Windows 8 screen shots
 
When you reboot you will  see this.   
 
Select the language on this screen and keyboard on the next 
 
 
 
Select the Trouble shoot option   
 
 
 
Select Advanced  option  
 
 
 
Select Command prompt   
 
 
 
At the command prompt type the following  : 
 



The notepad opens. Under File menu select Open.
Select "Computer" and find your flash drive letter and close the notepad.
In the command window type e:\frst64.exe and press Enter
Note: Replace letter e with the drive letter of your flash drive.
The tool will start to run.
When the tool opens click Yes to disclaimer.

Press Scan button.
It will make a log (FRST.txt) on the flash drive. Please copy and attach / paste it to your reply.

[REDACTED]

Thank you!  Last time I tried to boot his laptop, it just gave me a grey screen. Do I just try clicking F12 when I see some sort of screen change?  Also, if I am understanding correctly the second program to download is Windows 8 and I will take a guess that it is 64bit RC.  Not sure what RC stands for.  I downloaded both 32 bit and 64bit FRST now looking at the private message and I am not sure which one to do or if it is safe to download both and have them both ready for which ever I need.

Thank you very much!

[dbrisendine]

I would try the 64 bit files first.  So you would build the RUFUS boot stick using the 64 bit Win8 RecoveryConsole file and put the FRST64.exe file on that stick.  Then try starting the PC by inserting the USB stick, power on the system and tap either the ESC key or F12 to enter the Boot Device screen.  (RC stands for Recovery Console.  This is a limited version of the OS that one can use to run some repairs from.)

[REDACTED]

Ran Rufus and I assume it is on the USB disc.  When I click on the Win64 bit it only gives the option to burn it onto a CD Disc.  What did I do wrong?

[dbrisendine]

Steps for RUFUS to make a Bootable USB drive:


Insert the USB drive.


Start RUFUS.


1)  Select the USB drive (if not done for you)


2)  Click on the drop-down list and select ISO image


3)  Choose the ISO image you downloaded (the Win8 64 bit ISO file).





Click START and RUFUS will extract what it needs from the ISO file to create a bootable USB drive for the Win8 Recovery Environment.
You use this USB drive to boot the infected system.  Be sure to copy FRST64.exe onto the USB drive AFTER Rufus has run as Rufus will format the USB drive and erase all existing data on the USB before making it bootable.

[REDACTED]

Well, I cannot seem to get into the boot screen.  I have tried both F12 and ESC several times on several "reboots"  the system goes straight to the Gateway screen, then I can see a little bit of a normal start up then just a grey/black screen.

[dbrisendine]

What model of Gateway computer is this?  There should be a sticker on it somewhere with the model number on it.