Exploit:JS/Neclu.M malware

wmb72buckeye · Apr 7, 2014

First my apologies if I am not posting according to a specific rule I have been reading various threads and I'm still not sure of the correct posting procedure. I read the various "read firsts" and "try first" and did not see anything specific to my issue.

I have a brand new Dell XPS8700 and it seems I've managed to catch the malware Exploit:JS/Neclu.M which has locked me out as administrator on my own PC.

After using Windows Defender to diagnose and attempt to correct I made my way to a few web sites including yours. I've downloaded numerous programs such as Microsoft Safety Scanner, RogueKiller, MalwareBytes Anti-Malware and Hitman Pro. I downloaded these from my safe laptop onto a USB flash drive however my infected computer would not allow me to start any of them. Each time it gave me the following message:

Your system administrator has blocked this program. For more information, contact your system administrator.

Any help would be greatly appreciated.

Kestrel13! · Apr 8, 2014

For 32-bit (x86) systems download Farbar Recovery Scan Tool and save it to a flash drive.
For 64-bit (x64) systems download Farbar Recovery Scan Tool x64 and save it to a flash drive.

Plug the flashdrive into the infected PC.

Enter System Recovery Options.

To enter System Recovery Options from the Advanced Boot Options:

Restart the computer.

As soon as the BIOS is loaded begin tapping the F8 key until Advanced Boot Options appears.

Use the arrow keys to select the Repair your computer menu item.

Choose your language settings, and then click Next.

Select the operating system you want to repair, and then click Next.

Select your user account and click Next.

To enter System Recovery Options by using Windows installation disc:

Insert the installation disc.

Restart your computer.

If prompted, press any key to start Windows from the installation disc. If your computer is not configured to start from a CD or DVD, check your BIOS settings.

Click Repair your computer.

Choose your language settings, and then click Next.

Select the operating system you want to repair, and then click Next.

Select your user account an click Next.

On the System Recovery Options menu you will get the following options:

Startup Repair

System Restore

Windows Complete PC Restore

Windows Memory Diagnostic Tool

Command Prompt

Click to expand...

Select Command Prompt

In the command window type in notepad and press Enter.

The notepad opens. Under File menu select Open.

Select "Computer" and find your flash drive letter and close the notepad.

In the command window type e:\frst.exe (for x64 bit version type e:\frst64) and press Enter

Note: Replace letter e with the drive letter of your flash drive.

The tool will start to run.

When the tool opens click Yes to disclaimer.

Press Scan button.

It will make a log (FRST.txt) on the flash drive. Please attach this log to your next reply. (How to attach)

wmb72buckeye · Apr 14, 2014

Sorry for the delay in responding I had a few things going on besides the computer issues.

I've attached the two .txt files which were created after I ran that utility. Just so you are aware I had some other issues which led me to repair/reinstall Windows 8. As a result I was able to restore my ability to not only create user accounts but once again be set as the administrator. I setup a test user however after subsequently running not only MalwareBytes Anti-Malware but also SuperAntiSpyware I discovered that I had things still on my computer. I ran the remove/quarantine features for both but they still reappear each time I run a scan. Is there anyway to permanently remove these files I mean I could permanently delete the user account labeled TEST and it wouldn't matter for me.

Thanks.

Kestrel13! · Apr 14, 2014

On the account you're having problems with, run these procedures and attach the requested logs:

READ & RUN ME FIRST - Malware Removal Guide

Log in or Sign up

Exploit:JS/Neclu.M malware

wmb72buckeye Private E-2

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

wmb72buckeye Private E-2

Attached Files:

FRST.txt

Addition.txt

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

Log in or Sign up

Exploit:JS/Neclu.M malware

wmb72buckeye Private E-2

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

wmb72buckeye Private E-2

Attached Files:

FRST.txt

Addition.txt

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

Useful Searches