Computer won't boot after running Malwarebytes

[Recon777]

I need help badly! My laptop got infected with SearchProtect, so I ran MalwareBytes and it found about 145 things to remove. I told it to remove them, and then it said it had to reboot the computer.

 

The screen went black, but never rebooted. The white mouse arrow is visible on the screen and responds to the mouse, but other than that, NOTHING works. I waited several minutes and nothing. I've even shut completely down and pulled the battery to make sure it wasn't sleeping. When I try to start up, the manufacturer's logo appears and then the screen goes black and stays that way with the mouse arrow visible. The laptop is completely inoperable!!

 

I am running Windows 8.1 if that helps. Please someone tell me what went wrong and how to fix it.

 

[Maurice Naggar]

Hello Recon77 and welcome aboard Malwarebytes forum.

 

Did you try restarting the machine into SAFE mode ?   Review the 2 articles below.

 

WINdows 8
http://support.microsoft.com/kb/2809468

 

restart the system into Safe mode
http://www.bleepingcomputer.com/tutorials/start-windows-8-in-safe-mode/

 

 

 

Turn off your pc. Wait about a minute.

Restart your pc.  And right away, tap & retap the F8 Function-key on your keyboard.

You should see Windows Advanced Options menu.
Select Safe Mode

 

NOTE: if the F8 function key-method did not prove useable, some systems may use F5 instead.  
And on some systems you may need to press the F2 function key to get hardware boot options.

 

If you go at it methodically  ( even if you repeat it a few more times ) eventually you likely can get to Safe mode and from there you would be able to look at and possibly change some things.

 

Do tell us if you have the Windows 8 operating system DVD or recovery media.

 

Windows 8, 8.1  have a applet to make recovery media  ( but one would have had to make them when Windows was running).

 

Do tell us what sort of backups were made in the past for this system.

[Recon777]

Okay, I tried several of the suggestions. Here are the results.

 

F5 gives the message "To skip disk checking, press key within 1 second". System still boots into a black screen.

 

F2 takes me straight into the BIOS screen just like DELETE.

 

F8 takes me to a blue screen which says "Recovery" in the title. A message says "It looks like Windows didn't load correctly. If you'd like to restart and try again, choose 'Restart my PC' below. Otherwise, choose 'see advanced repair options' for troubleshooting tools and advanced options."

 

There are two buttons to choose from. Clicking "Restart my PC" just takes me back to booting into a black screen. Clicking the other button takes me to options like "Use a device" for using a USB flash drive or windows recovery DVD etc. Or another button that says "Troubleshoot". That button has options like "Refresh your PC" and "Reset your PC" or advanced options. Refresh is meant to fix without losing my files. It doesn't work. Reset is meant to restore the PC to its factory settings, but it complains that there is a missing partition when I try to use it. Advanced options has things like 'use a systme restore point', 'system image recovery', 'automatic repair', 'command prompt', 'UEFI firmware settings', and 'windows startup settings'.

 

I'm picking the final option for windows startup settings.

 

In there, I see a message "Restart to change windows options such as:

Enable low resolution video mode

enable debugging mode

enable boot logging

enable safe mode (is this really how to get into safe mode?)

disable driver signature enforcement

disable early launch anti malware protection

disable automatic restart on system failure

 

Clicking Restart.

 

Aha. Now I get a new screen where I can pick any of those options. Choosing (4) safe mode.

It says "Scanning and repairing drive (C:) xx% complete. Waiting. This is hopeful.

 

Sigh. Okay, that didn't work. It still boots me to a black screen. I have a white mouse arrow and a "busy" animated circle by it. The circle spins for a while then goes away but I am left with a black screen and the arrow.

 

Wait. After a short while, the desktop screen DOES come up! I get a popup which says:

 

DMedia.exe - Bad Image

C:\PROGRA~2\SearchProtect\SearchProtect\bin\VC32Loader.dll is either not designed to run on Windows or it contains an error. Try installing the program again using the original installation media or contact your sysadmin or the vendor for support. Error status 0xc000012F=f.

 

WTF?!!  SearchProtect is the malware that Malwarebytes was supposed to remove when it tried to restart my pc! Why am I getting this message?

 

Clicking Ok brings up repeated popups, where only the title of the popup changes. It cycles through what looks like ordinary startup exe's. SpotifyWebHelper.exe, AsusWSPanel.exe, etc. 

 

Eventually after about 25 clicks they stop and I get windows booted.

 

Well, now that I'm up in safe mode, I'm not really sure what to do. SearchProtect still exists in my Program Files (x86) folder. Should I manually try to delete this and reboot? I think I'll try that.

Hilariously, there's an uninstall.exe under main\bin. I think I'll just rename SearchProtect folder and see what happens.

 

Restarting.

 

Well, well... now it's booting! Seems Malwarebytes didn't finish the job of removing SearchProtect before trying to restart. I wonder why that is.

I'm going to run Malwarebytes once again to see what it detects.

 

 

To answer your questions: I don't have a recovery DVD, but I'm supposed to have a system partition which lets me recover. Not sure why it didn't work. My laptop is an ASUS Republic of Gamers machine. Very high end. As for backups, when I couldn't reboot, I physically pulled both hard drives and mounted them in an external casing so I could transfer ALL the files to my desktop so that a factory reset wouldn't lose anything.

 

Malwarebytes just finished its scan after 20 minutes. Seems like it took much longer this time. Like the computer itself is running slow for some reason.

 

The end result shows 17 potential threats.

 

 

Letting Malwarebytes try to finish the job.

Restarting.

 

windows comes up but it really seems a lot slower than it ought to be. My desktop icons take a while to load now for some reason. Everything seems to take longer by far to come up. Even windows task manager takes about 10 seconds just to pull up the window. More testing will need to be done to find out why everything is so slow.

[Recon777]

Confirmed that everything is taking MUCH longer to run now. Programs take 2 or 3 times as long as they should to load, and when they finally do come up, they are very sluggish compared to before. Why would this be? What's eating my CPU cycles? Task Manager says not much is happening. The fan hasn't kicked in either, so I know the computer isn't working very hard at all. It's just extra slow.

[Recon777]

okay nevermind. I may have found why it was running slow. Testing.

[Recon777]

Scratch that (and why can't we edit our old posts here?)  -  it's still running very slow. I can't seem to fix it.

[Maurice Naggar]

I'm moving your thread to the malware removal sub-forum.

[Maurice Naggar]

Please do the following to get for me the last Threat Scan log report.
and use this image as a guide.

 

 

Start the Malwarebytes Anti-Malware.  Click History icon.  Click the button marked Application logs.
Look at the column headers on the display. Double click the column marked TYPE so that "Scan logs" are at the top.
Double click on the line with the report that we need.

It should be the one with the latest Date and time with a type of Scan log.

 

Once you double click the line, Click the blue Export button.  Pick the TEXT option.  Give it a name & pick the location ( that you can locate again).   Save and then attach into your next reply.

 

Also,  Get the Farbar tool as listed in this article https://forums.malwarebytes.org/index.php?/topic/9573-im-infected-what-do-i-do-now/

save it.

run it.

 

Then attach the 2 report files FRST.txt + Addition.txt in your reply.

[Maurice Naggar]

P.S.   Please remember to always attach reports ( files ) with replies, as we go along here.

 

Also, have lots of patience, as this type of situation does not lend itself to a quick fix.   Also, keep in mind in am not always online.

[Recon777]

Sorry, I'm going to be unable to help troubleshoot this further because I took my laptop to the ASUS repair center today and had them do a factory reset.

 

I did find out why I couldn't do my own factory reset though. The "missing partition" was due to upgrading to Windows 8.1. For these laptops, there is a recovery partition which is set up for Windows 8.0. After upgrading, it made that partition inoperable. I'm not sure if that is related to the problems I was having, but I am very cautious about the idea of using Malwarebytes at this point because last time it caused a huge mess.

 

Thankfully, the new disk image that ASUS put on my laptop is set up for Windows 8.1 now, so if I must do a factory reset, I can do it myself instead of taking it in. If I do happen to contract malware in the future and end up in a similar situation, I'll be sure to come back and explain exactly how it went down.

[Recon777]

Oh, one more thing - I did make a full copy of my drive prior to doing the factory reset. If you can point me to the correct log files, I can put them online for you to examine.

[Maurice Naggar]

We do not need to examine your files, thanks.   You also indicated that the pc was going to be restore to day 1 factory state .

[AdvancedSetup]

Since this issue is resolved I will close the thread to prevent others from posting here. If you need assistance please start your own topic and someone will be happy to assist you.