Last edited on 21 May 2017 - 06:36 PM by Astounding
Ok my virus has gotten so bad to where I can't even run the installer for malwarebytes without getting the "the requested resource is in use" No anti viruses work and it has gotten so out of hand. I've resorted to kaspersky rescue disk.So first of all when I boot my pc from my USB it just gives me a blank screen and a blinking underscore, like I'm supposed to type something. I've pressed all keys and it does nothing. I have recorded the rescue disk ISO on my USB correctly on another computer and moved the grub folder to my pc. Idk what's happening. If you don't know what I'm talking about, pls refer to kaspersky rescue disk website. My bios mode is legacy (kill me now) and when I boot into bios, it's cmos utility. This is what is looks like: http://2.bp.blogspot.com/-tPYICwcWX8c/TbWWtDzyGXI/AAAAAAAAAEY/EZ-KcMfs6QA/s1600/ADVANCED+CMOS.jpg
I set my first boot device to the USB and then I get the blank screen as described above. Pls help
@Vykz
This sorta looks like what the blank screen looks like, except I have no cursor and when I boot into regular windows this doesn't happen. It just stays like this forever when I boot from USB
https://qph.ec.quoracdn.net/main-qimg-49352bc7e61b021c9912a92c7116e18b
My USB is formatted in FAT32 and it has 14gb on it. Also I'm using windows 10 and my motherboard is a MSI main board. If I need to supply more info, tell me
Posted on 22 May 2017 - 12:34 AM
Do you know which RAT infected you? Im guessing it disabled malwarebytes by policy management? Think you got too ahead of yourself for me to help now. I would be disconnecting my network connection and removing the RAT manually first but now you're in a rescue boot or safe mode Im guessing.Maybe go into safe mode and remove manually? I bet the dropped file might even show right under task managers "Startup" tab. Suspend the process and than delete. Enter safe mode and run a removal scan and or the comet removal tool helps if its the generic darkcomet RAT.
Otherwise wait for someone more skilled to reply. Goodluck.
-Someone from another forum who I tried getting opinions from.
Posted on 22 May 2017 - 07:00 AM
Vykz wrote
Maybe go into safe mode and remove manually? I bet the dropped file might even show right under task managers "Startup" tab. Suspend the process and than delete. Enter safe mode and run a removal scan and or the comet removal tool helps if its the generic darkcomet RAT.
Otherwise wait for someone more skilled to reply. Goodluck.
-Someone from another forum who I tried getting opinions from.
Safe mode doesn't change anything. I can't run anything. Windows defender is useless
Posted on 22 May 2017 - 11:52 AM
But you can however run exe files right? If so, do this:Please download Farbar Recovery Scan Tool and save it to your Desktop.
Note: You need to run the version compatible with your system. If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, that will be the right version.
Right click to run as administrator. When the tool opens click Yes to disclaimer.
Press Scan button.
It will produce logs called FRST.txt and Addition.txt in the same directory the tool is run from.
Please copy and paste the logs back here.
Posted on 22 May 2017 - 11:54 AM
what did you install for this to kill ur PC XDPosted on 22 May 2017 - 12:48 PM
Jarecl wrote
Last edited on 22 May 2017 - 02:31 PM by *deleted-191881
Automatically DeletedLast edited on 22 May 2017 - 02:24 PM by *deleted-191881
Automatically DeletedLast edited on 22 May 2017 - 03:10 PM by Astounding
Vykz wrote
Please download Farbar Recovery Scan Tool and save it to your Desktop.
Note: You need to run the version compatible with your system. If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, that will be the right version.
Right click to run as administrator. When the tool opens click Yes to disclaimer.
Press Scan button.
It will produce logs called FRST.txt and Addition.txt in the same directory the tool is run from.
Please copy and paste the logs back here.
I appreciate your help but, I couldn't even run the kaspersky USB burner… I had to do it on another pc…
About anything that is DISTANTLY related to viruses will be blocked with the message "the requested resource is in use" Farbar will prob not work, but I'll try
Also my pc somehow REINSTALLED VMXCLIENT.EXE GRRRRE AHAHAHHSHHDGGAHHHHHHHHHHHHHHH NOOOOOOOOOOOOOO
gr8, hello 100% CPU usage and I can't even delete the virus no matter what, safe mode doesn't work. I apparently don't have the "permission" even after using the user admin and built in admin acc….
Posted on 22 May 2017 - 03:12 PM
EhhThing wrote
https://www.pendrivelinux.com/downloads/Universal-USB-Installer/Universal-USB-Installer-1.9.7.8.exe
If you need more help, feel free to msg me on discord (EhhThing#3726)
If I start getting ransomware or something, I'll think about it. If it gets so bad I'll get pro help I guess. For now I don't think I'm willing to go that far as resetting my pc, thanks anyways
Last edited on 22 May 2017 - 03:48 PM by *deleted-191881
Automatically DeletedLast edited on 22 May 2017 - 03:50 PM by *deleted-191881
Automatically DeletedPosted on 22 May 2017 - 03:57 PM
Automatically DeletedPosted on 22 May 2017 - 04:55 PM
EhhThing wrote
If I can't run the installer for malwarebytes, I doubt adwcleaner will work without me getting the requested resource is in use message
Posted on 22 May 2017 - 05:04 PM
Automatically DeletedPosted on 22 May 2017 - 05:24 PM
EhhThing wrote
Intimidated wrote...
AdwCleaner doesn't need to install.
Also I can't open any programs related to viruses
Posted on 22 May 2017 - 11:23 PM
You are infected with SmartService. MBAR can take care of the main infection, and then you can run Malwarebytes, AdwCleaner and JRT to take care of the rest.
https://forums.malwarebytes.com/topic/19...warebytes/
Gl, hf, dd, etc.
Posted on 23 May 2017 - 05:56 AM
SirDeqdly wrote
Jarecl wrote...
Ultra HD porn from the dark web
Last edited on 23 May 2017 - 08:12 AM by Astounding
Vykz wrote
You are infected with SmartService. MBAR can take care of the main infection, and then you can run Malwarebytes, AdwCleaner and JRT to take care of the rest.
https://forums.malwarebytes.com/topic/19...warebytes/
Gl, hf, dd, etc.
Thanks for telling me what I was infected with. BTw the link doesn't work, apparently the page doesn't exsit. But the big problem with malwarebytes is I can't even run the anti-rootkit mbar installer. How would I use malwarebytes? Thanks again for helping me out :D
Edit: I found this guide by bleepingcomputer that seems to cover how to get rid of this https://www.bleepingcomputer.com/forums/t/643925/smart-service-trojan-removal/?p=4216399
I just have one problem, I have a legacy bios not a UEFI, what can I do?
Last edited on 23 May 2017 - 12:23 PM by *deleted-191881
Automatically Deleted