I have been infected after visiting malicious website

Question

I looked for an address in Ethiopia through Google.

I got a red screen to say I have been infected with a virus and to call a windows number 1-844 (the rest I lost) ....  meantime hundreds of files were downloading. I did not click anything on any download or Google or the virus warning page.

My laptop (Lenovo) totally locked and crashed. 

I eventually got it going after huge delays and ran some kind of check that came up. All was clear.

I then ran Defender/AVG/Norton/Malwarebytes/AdCleaner and all said I was clean. I deleted 2,400 files in downloads without opening any. 

The laptop was still compromised.

I then decided to recover my HDD back to factory status. This was successful.

Still...it now takes 5 minutes to get to the login screen and I have to turn off anf turn on just to get to this screen.

Is my HDD crashed/thrashed...should I replace it? Can I transfer my Windows 7 (original MS product) to the new HDD? 

What to do, please? 

[Original Title: Bad!]

Answer 1

Hi Sean. I'm Greg, an installation specialist and 8 year Windows MVP, here to help you.

That's a Fake Virus scam which can emanate from a mistyped URL it occupies. If you have a shortcut for Favorite/Bookmark of the site be sure to delete it. It may have also set itself as your Home page or be lodged in your Browser Add-Ons or Extensions so you'll want to check there and run the scanners I give below.

Close the Browser window using whichever method is necessary, as it cannot escape the browser unless you download something from the page.

If you cannot close the browser window, right click the Task Bar or press Ctrl + Alt + Delete keys to open the Task Manager, choose Show Less Details, highlight the browser and choose End Task.

If this fails hold the power button to Shut Down. If you do this Edge may reload the page when it starts back up, but it will also give you an option to Start Fresh to avoid opening the previous tabs.

Also in Edge, if you try to X out of the browser WIndow, it may present a dialogue box to end the session. The webpage is allowed to put text in the box but cannot stop it from closing the Windows when you choose OK, so that is safe to do.

If you called the scammers and they installed anything on your PC, open Settings>Apps & Features, choose Sort by Date, uninstall anything on that date you didn't install yourself. Then run a full scan with Malwarebytes and AdwCleaner. In MB settings tell it to search for rootkits. You can turn off the trial version later in it's Account Settings.

http://filehippo.com/download_malwarebytes_anti...

http://www.bleepingcomputer.com/download/adwcle...

Clean up anything found. If you are seriously infected with Trojans or Rootkits that show up again when you re-run the scan after cleaning, post back for further instructions.

If you paid them anything, notify your bank that you were scammed.

Now as to whatever you did that installed all those files you said you got, it would not be an inert web page that cannot do anything unless you choose it.

What I would do is wipe the drive clean to Clean Install following these illustrated steps in this link which compile the best possible Clean Install of Windows which will stay that way as long as you stick with the tools and methods given, has zero reported problems, and is better than any amount of money could buy: http://answers.microsoft.com/en-us/windows/wiki...

Add to the steps in the tutorial first wiping the drive with Diskpart Clean Command: http://www.sevenforums.com/tutorials/52129-disk... You can access the Command Prompt during install by pressing Shift + F10 at the first screen after booting.

You will get and keep the best possible install to the exact extent you stick with the steps, tools and methods in the linked tutorial. It's a better install than any amount of money could buy and a great learning experience that will make you the master of your PC.

I hope this helps. Feel free to ask back any questions and let us know how it goes. I'll keep working with you until this is resolved.

Answer 2

HI Greg....many thanks for your very prompt reply and offer of help.

I did not call the number as I was suspicious and did not send any money.

I deleted all of the files, unopened, and from the recycle bin.

There is no added extension nor are ( I think)  my browser settings changed. I dod not have any odd site in favorites. 

The search was simply for an address and then this all happened. I did not click any download, or anything at all when the page opened. It just started automatically and all hell happened!

As the laptop was frozen and locked - I reset my laptop back to factory settings with the recovery tool by pressing F11.

I then was able to reload windows OS with the recovery section on my HDD.

If I run the disc cleaner will this also delete my recovery which is listed as "Q" 

Do you have any suggestions on why it takes 5-8 minutes to get to the login screen? The laptop, when logged in, seems to be working fine.

I do not mind doing another full recovery. 

Thanks again....Sean in Dublin

Answer 3

Sean, yes, to wipe the drive to get the best install cleanest will remove the Recovery but that contains the factory bloatware which could very well be the problem since it throttles and causes issue. Most enthusiasts won't even run a Factory install for this reason.

You can go over this checklist to make sure the install is set up correctly, optimized for best performance, and any needed repairs get done: http://answers.microsoft.com/en-us/windows/wiki...

Start with Step 4 to turn off Startup freeloaders which can conflict and cause issues, then Step 7 to check for infection the most thorough way, then step 10 to check for damaged System Files. Then continue with the other steps to go over your install most thoroughly.

Update your drivers from the PC maker's Support Downloads web page, using the full model number, Serial Number or Dell Service Tag on sticker. Compare the latest drivers available for download with the ones presently installed in Device Manager reached by right clicking the Start Menu. Make sure you have the latest BIOS or UEFI firmware, Chipset, Display (Video), Sound, USB3, Bluetooth, Network and all other drivers, or else download and install the latest now.

If nothing else helps then run a Repair Install by installing the Media Creation Tool and choosing from it to Upgrade Now. This solves many problems and will also bring it up to the latest version which you need anyway and by the most stable method. http://windows.microsoft.com/en-us/windows-10/m...

If none of these help then you can do the Clean install or

There is also an automated Fresh Start that reinstalls WIndows while shedding corrupting factory bloatware, saves your files, but doesn't clear the drive to get it cleanest: https://www.howtogeek.com/265054/how-to-easily-...

Answer 4

Greg,

You seriously need to look at a post carefully before responding.

Can't you see that the OP selected Windows 7 as his operating system and indicated in his very first post that he'd already done a factory install of the operating system from the recovery partition on the HDD?

You keep using responses keyed to his initial problems and Windows 10, neither of which were either still the problem or operating system in use since his very first post.

Moral of the story; read before you post.

Sean, Ignore everything posted to this point.  I'd first want to check the system out for hardware issues, but typically this can be skipped, moving directly to the same basic steps Greg has mentioned, but chosen instead to support the Windows 7 operating system.

I'm sure that Greg can help you.  He just needs to stop rushing long enough to actually read what you've written so he can provide the response that's appropriate to your true issue and system specifics.

Rob

Answer 5

Hi Grag...as Rob kindly pointed out my OS is Windows 7 and the previous advice was for Win 10.

I am really reluctant to wipe the HDD with my OS on it.

How do I reinstall Win 7 if I wipe it off the HDD?

Thanks again.

I am off tomorrow, actually to the States, so if you do not mind I will leave this till I return. Can I come back then?

Meantime I will do a factory reset 

best.....Sean