White Screen Virus

[Ricky]

I have a customer's company laptop with windows 7 enterprize that has a white screen and a moneypac payment option and a webcam. Not able to open anything. I'm able to boot into safe mode, but I can't open anything without it immediately closing, except task manager and command prompt. I've tried having the harddrive connected to another computer to be scanned. This laptop is not able to be physically connected to a network and can't connect wirelessly. Malwarebytes, Kaspersky, and Hitman Pro couldn't find anything. System restore is not an option and wiping it and reinstalling windows in also not an option.. I don't have the computer with me to be able to use a live disk. It's in a different state and I working with someone who has it. Any help would be greatly appreciated. I need this fix asap. Thanks in advance.

Here's a picture of it in normal view: http://www.bestpcdoc.net/20140821_213943.jpg

 

[ohio_grad_06]

Are you a tech or end user? If you can get command prompt you can probably get further than you think.

 

[Ricky]

I'm a tech. I haven't come across this particular virus yet. The guy I'm assisting is a beginner tech.

 

[citizensmith]

System restore not an option ?
Realy? Try safe mode with command then autoruns to see qhat;s starting up. Otherwise slave drive and use AutoRuns offline reg mode. You're aprentice needs a better toolkit.

 

[LifelineIT]

Start mode with command prompt is the fastest fix here. Alternatively kaspersky rescues unlock feature, but I prefer safe mode with command prompt. New user, add to admin group, reboot to new user, run scan from there, cleanup trivial. Not to sound like a Dick but if you're the senior tech and you don't already know at least three ways to kill this thing, it gives me concerns about your skill set, apprentice in another state or not.

 

[cypress]

Looks like the FBI virus to me. Like mentioned previously, start mode with command prompt will be the quickest fix for this.

 

[ohio_grad_06]

Yep another way to handle it as has been said, safe mode with commands prompt, then you can try to type in explorer to get the desktop to load, our control panel to load control panel, have your tech insert a usb with his tools, and for away. Also maybe you're tech could use a bootable av solution to attack with.

 

[Ricky]

I have only been in bussiness for about 4 1/2 years. I ususlly know at least 3 ways to kill a virus, I just went brain dead on this one. I've only worked on it for a couple of hours. I'm still learning. Yes I do agree that he needs a better toolkit. I have sent hem all the tools he needs. He is just not that good. This is the first job I have done with him. I'm not impressed. I'll have him use command prompt. Thanks again for all of ya'lls help.

 

[Galdorf]

Best way to get in if it is malware would be kickstart -hitmanpro

 

[ohio_grad_06]

Hitman pro could work. If he can do the safe mode with commands prompt then he can probably get in to try and run rogue killer. That usually seems to knock things out quickly.

 

[lcoughey]

I'd start with getting a full sector-by-sector clone of the drive. Then, at the very least, you have the option of a nuke and pave, restoring from backup. But always check the backup before you nuke and pave...and make sure that it is disconnected from the system too.

 

[Galdorf]

Hitman pro could work. If he can do the safe mode with commands prompt then he can probably get in to try and run rogue killer. That usually seems to knock things out quickly.

Kickstart is designed to kill this malware in memory you can boot from usb or cd iso.
it will bypass bootkits/rootkits and force hitmanpro to run once it boots.
https://www.youtube.com/watch?v=vu3VGDpStC0

 

[AndyM]

I have a customer's company laptop with windows 7 enterprize that has a white screen and a moneypac payment option and a webcam.

Here's a picture of it in normal view: http://www.bestpcdoc.net/20140821_213943.jpg

Get them to take it to their IT Department. Windows 7 Enterprise is NOT a consumer product!

If they are a consumer, then they have an illegal copy of Windows. Never seen a COA for Windows 7 Enterprise. Never will.

Andy

 

[ohio_grad_06]

Ah, good catch. Didn't even think about that. Even in corporate environments, some are using volume licensing for Windows 7 pro.