[ultra]

For the last couple of days i have been getting this weird pop up on my desktop and it wont let me open or select anything else. at which time it logs me out of my laptop and takes me to the user selection screen.

The couple of times that it happened I had been just running pandora of a while It hasn't happened while i use it just when i let it sit idle.



Sorry for the huge image. Thank You

[ElfBane]

It appears you have a malware. Update your AV and run it. Also I recommend running a free on-demand malware scanner, MalwareBytes Anti-malware, found here... http://www.malwareby...lwarebytes_free .

Pick the free one.

Hope this helps.

[LiveBrianD]

To add to ElfBane's suggestion - do it in Safe Mode with Networking. (push F8 repeatedly before the Windows boot screen appears)

[ultra]

ElfBane, on 25 June 2012 - 01:34 AM, said:

It appears you have a malware. Update your AV and run it. Also I recommend running a free on-demand malware scanner, MalwareBytes Anti-malware, found here... http://www.malwareby...lwarebytes_free .

Pick the free one.

Hope this helps.

I did a full scan with malwarebytes and it found a couple of things and i thought it was good but it came up again.

i didnt do it in safe mode so ill try that.

[LiveBrianD]

What happens if you open the task manager, find that program, right-click and select 'go to process'?

[ultra]

LiveBrianD, on 25 June 2012 - 04:21 PM, said:

What happens if you open the task manager, find that program, right-click and select 'go to process'?

i tried that but when the pop up comes up i can do no other action other than to press the button. I tried bringing up the task manager but it doesn't work. Neither does ctrl alt del.

and malware wasnt able to find it.

[ElfBane]

ultra, on 28 June 2012 - 06:09 AM, said:

LiveBrianD, on 25 June 2012 - 04:21 PM, said:

What happens if you open the task manager, find that program, right-click and select 'go to process'?

i tried that but when the pop up comes up i can do no other action other than to press the button. I tried bringing up the task manager but it doesn't work. Neither does ctrl alt del.

and malware wasnt able to find it.

Did you try Safe Mode like you mentioned?

[ultra]

i did, the damn pop up even showed up while the scan was happening and still nothing was detected.

[ElfBane]

ultra, on 28 June 2012 - 09:30 PM, said:

i did, the damn pop up even showed up while the scan was happening and still nothing was detected.

My guess is that it's in the Registry. You will need to find out the name of the malware, Google it, and see if there are any manual tutorials on the web about removing the pest from the Registry. Be careful, the web may try to sell you scam "removal tools" that promise to get rid of the pest, but don't actually work. Also, if you're going to work in the Registry, BE CAREFUL, a mistake can brick the PC.

[ultra]

ElfBane, on 29 June 2012 - 12:35 AM, said:

ultra, on 28 June 2012 - 09:30 PM, said:

i did, the damn pop up even showed up while the scan was happening and still nothing was detected.

My guess is that it's in the Registry. You will need to find out the name of the malware, Google it, and see if there are any manual tutorials on the web about removing the pest from the Registry. Be careful, the web may try to sell you scam "removal tools" that promise to get rid of the pest, but don't actually work. Also, if you're going to work in the Registry, BE CAREFUL, a mistake can brick the PC.

Thank You, ill see what I can do.

[ultra]

so i was looking around in the registry and under Windows\Current Version\Run i found

DRtray H:\Data Recovery Kit\DRtray.exe

Does anybody know what that is? I have tried some data recovery tools before but none worked like i wanted so i scraped them.

[LiveBrianD]

If you removed the program, that key is no longer needed and can be removed. Again, also check the hosts file.

[ultra]

the part that bothers me is the H: part. Where the hell is that at?

[LiveBrianD]

Maybe that's a card reader you had connected before?

[ultra]

LiveBrianD, on 29 June 2012 - 10:55 AM, said:

Maybe that's a card reader you had connected before?

i dont remember seeing H: before but i guess. I do have a card reader but I dont use it. Idk what to do now though

[LiveBrianD]

Again, check the hosts file - I'm wondering if something's in there...

[ultra]

LiveBrianD, on 29 June 2012 - 06:02 PM, said:

Again, check the hosts file - I'm wondering if something's in there...

how do i do that? sorry you had me lost when you said that. Thanks

[LiveBrianD]

Never mind - I was thinking of another thread. This is definitely not the first time I've done that. However, can you go into the task manager (when this isn't happening I guess), go to the process tab, take a screenshot and post it? I'm wondering if there are any odd ones in there... (a lot of them have cryptic sounding names though)

[ElfBane]

You can try rolling back to a System Restore created before the malware struck.

[ultra]

LiveBrianD, on 30 June 2012 - 01:23 PM, said:

Never mind - I was thinking of another thread. This is definitely not the first time I've done that. However, can you go into the task manager (when this isn't happening I guess), go to the process tab, take a screenshot and post it? I'm wondering if there are any odd ones in there... (a lot of them have cryptic sounding names though)

these are the process at the moment of posting this

ElfBane, on 01 July 2012 - 03:54 AM, said:

You can try rolling back to a System Restore created before the malware struck.

I dont have any recent restore points before this started happening. I dont want to go there unless I really really have to.