Trojan

[festustmoldebones 0]

I sent a message to you on 'malware downloads' site? Was told my 1month old HP Stream got infected by a Trojan. Now nothing but blue screen and a movable pointer. HELP!!!

[CeciliaB 468]

Hi festustmoldebones,

Sorry, but which site do you mean with 'malware downloads'?
How could you get to that site if you only has a blue screen?

When do you get the blue screen with only a pointer?

How does the computer work in safe mode?

[LSArtem 6]

Hello @festustmoldebones!   

Try to follow these recommendations  https://www.adaware.com/rescue-USB 

 

 

[festustmoldebones 0]

Hi, was on a different computer. My netbook is infected, just blue? screen w/pointer. Unable to get safe mode, nothing. On your site, was at explanation/malware download. Thanks for assistance. Will try the site suggested and download information and give it a shot!

[CeciliaB 468]

Yes, please inform us of the result of adaware rescure USB.

Sorry, but I don't understand how you can sit on one computer and get information that another computer is infected and not has a faulty device or a corrupt Windows.

Do you mean a page where you can upload malware?
Did you upload a file?
If yes: Which file?

[festustmoldebones 0]

I was on my netbook and inadvertantly touched an ad and my computer froze info to call an 855 #. Did so and they took over my computer and discovered that it had a Trojan. Was told , for hundreds of $$$ they could fix it. Unable to pay, they said bye, and my HP Stream has been locked up ever since. Tried to download program you suggested. No luck, just frustration! Will try again. If successful, will this allow me to get back into my computer to get to safe mode so I can fix it? Sorry for misunderstanding and THANK YOU so much for your help!!!

[CeciliaB 468]

You're welcome

Probably the computer has no trojan but when they took over the computer they did something that "locked" Windows. Unfortunately it's difficult to know what they did.

This is one way of getting into safe mode and doing a system restore to a prior date.

1. Please create a Windows 10 installation USB flash drive on a working computer: https://www.tenforums.com/tutorials/2376-create-bootable-usb-flash-drive-install-windows-10-a.html Not for installation purpose, only to be able to start the computer in safe mode.
2. Use that USB flash drive to boot into Advanced Startup Option: https://www.tenforums.com/tutorials/2294-boot-advanced-startup-options-windows-10-a.html#option5
3. And then you can try to do a system restore to a date before that phone call as described here: https://www.tenforums.com/tutorials/4588-system-restore-windows-10-a.html

Please keep us informed.

 

[festustmoldebones 0]

Will give it a shot. Not real computer savey. Will keep you posted. Thanks again!

[festustmoldebones 0]

Have fshdrv in netbook, power on, HP lites, dotted circle appears, then both disappear, mute lite comes on stays on, pointer moves. Tried f8, f10 nothing.

[festustmoldebones 0]

1 hour ago, festustmoldebones said:

Have fshdrv in netbook, power on, HP lites, dotted circle appears, then both disappear, mute lite comes on stays on, pointer moves. Tried f8, f10 nothing.

Got into system info. Tried to start, got critical process died!

[CeciliaB 468]

Did you enter BIOS/UEFI to change boot device?

[festustmoldebones 0]

Yes no change. Critical process died message. C:\WINDOWS\System32\Logfiles\Srt\SrtTrail.txt message. Unable to system restore, no point. Am currently in cmd. prompt, instead of C:\windows\system32, has X in place of C? Will not go further until your post. 

[CeciliaB 468]

It's probably faster to reinstall Windows that trying to find what the scammer did and how to get control of the computer again. It's also safer since it's impossible to know if they installed a back door that can be accessed if the computer comes back to live. All essential information in the computer may have been copied by the scammer, you might need to change passwords etc. that they might have seen.

https://www.consumer.ftc.gov/articles/how-spot-avoid-and-report-tech-support-scams

Did you start the computer from the adaware Rescue USB flash drive that LSArtem suggested to get adaware antivirus to search through the computer?

[festustmoldebones 0]

Yes no change. Critical process died message. C:\WINDOWS\System32\Logfiles\Srt\SrtTrail.txt message. Unable to system restore, no point. Am currently in cmd. prompt, instead of C:\windows\system32, has X in place of C? Will not go further until your post. 

[CeciliaB 468]

Sorry, but you can't get an error message from Windows if you start the computer from adaware Rescue USB.

X instead of C is normal when starting from a USB flash drive.

[festustmoldebones 0]

Am in advanced options once again. In setup utility, system log; time blank, no data 20 rows? Again what is X doing in place of C at command prompt? Computer just continues to restart only to inform of 'critical process died' and Windows didn't load correctly.

[CeciliaB 468]

Since BIOS/UEFI (Setup) varies between computer models, I don't know what your computer can store in its log.

When the computer starts from another device than C, the device letters can be different from usual.

Please, check these pages for how to start from another device to make sure that you've done the correct changes.
https://www.lifewire.com/change-the-boot-order-in-bios-2624528
https://www.howtogeek.com/129815/beginner-geek-how-to-change-the-boot-order-in-your-computers-bios/
https://support.hp.com/us-en/document/c00364979

[festustmoldebones 0]

Continue to get 'no boot device found' , ' please install operating system'. Guess I messed it up good now! Unable to get safe mode just system info. Unable to locate hot keys info for HP Stream 11 AHOXX. Any help would be much appreciated! Thanks.

[CeciliaB 468]

You haven't mentioned 'no boot device found' in your previous posts. What did you do before that occurred?
Are you sure that you've selected the correct device in Boot order (or what HP calls it in your computer model) i BIOS/UEFI?

Maybe you can get better help in a general purpose Windows forum since this forum is specialized in adaware products and removing virus and other malware.