SOLVED Virus won't let me do system restore

[kellabella84]

Hi, I'm new here and need help.

I have a Toshiba Satellite L70-B and running Windows 10.


I have a bad virus on my pc after downloading something that I thought was safe (I know, im stupid). I opened the task manager and the file "demerit" was listed multiple times. I tried to get rid of them by ending the task but it didn't help. I also tried deleting the files in safe mode but I got "you don't have permission" or "can't delete bc file is open in another program"

A few hours later a screen saying "configuring updates don't shut down computer" popped up and after that I got a message saying exactly this:

"Microsoft Windows has detected some suspicious activities on this computer. Due to having a Network Security Breach your Microsoft Windows got de-activated, to activate enter the product key".

Then it gives this Error Code:
0x00AEM001489

Then a support phone number to call- 1-855-532-0777

I shut down and restarted the computer a few times. Within a few minutes of being logged in the message about configuring updates would take over and log me out. Very frustrating bc I don't have time to even try and fix anything know.


Please help!! Thank you

 

[Regedit32]

Hi and Welcome to the Forum kellabella84.

It's more than likely the messages you are receiving are completely false - that is the good news.

Nevertheless, you obviously still have an issue to contend with.

Windows 10 comes with Windows Defender, or in the latest OS Build, the Windows Defender Security Center.

That can scan you computer during a reboot, and may well find the problem and resolve it for you.

As you are not being given a lot of time after logging in to do things, here is a quick way to get it to do that scan.

• Start computer and login
• In your Search/Cortana field type power
• In the search results, right-click on Windows PowerShell and select Run as administrator

Sample image

​

• When the User Account Control prompts you, click Yes
• In the Administrator: Windows PowerShell window that opens type or copy & paste the following:

Start-MpWDOScan

Sample image

Press Enter key to execute

After a few seconds this dialog will pop up:

Click Close and shortly your computer will shut down and restart.

During the restart you will see Windows Defender Offline scan run.

Note: It's set to run a Quick Scan that targets key Windows processes and files, so the scan will take around 5 - 10 minutes tops. If issues arise, you can always opt to run a Full scan later when you log back on to Desktop.

When the scan completes the computer will shut down and restart again and you'll be able to log on as usual.​

Another option, should Windows Defender not succeed, is to make use of the Microsoft Malicious Removal Tool that is included each month in the Windows Updates.

To run this, all you need to do is the following:

• Right-click on Start and select Run
• In the Run dialog type MRT then click OK
• When the User Account Control prompts you click Yes

This window will now appear

Click the Next button

In the next window, select Full scan then click Next button

Sample image

The scan will now begin.

Sample image

Note: This scan could take 40 minutes to just over one hour. You can cancel the scan by clicking the Cancel button, but I assume your intention is to rid yourself of the infection you believe you have because of the downloaded file you mentioned.​

Report back on any success or failure trying either of these approaches, as there are other options you can do also, but for now this is the easiest approach given you have both of these utilities all ready on your computer.


Regards,

Regedit32

 

[kellabella84]

Hi and Welcome to the Forum kellabella84.

It's more than likely the messages you are receiving are completely false - that is the good news.

Nevertheless, you obviously still have an issue to contend with.

Windows 10 comes with Windows Defender, or in the latest OS Build, the Windows Defender Security Center.

That can scan you computer during a reboot, and may well find the problem and resolve it for you.

As you are not being given a lot of time after logging in to do things, here is a quick way to get it to do that scan.

• Start computer and login
• In your Search/Cortana field type power
• In the search results, right-click on Windows PowerShell and select Run as administrator

Sample image

View attachment 5603 ​

• When the User Account Control prompts you, click Yes
• In the Administrator: Windows PowerShell window that opens type or copy & paste the following:

Start-MpWDOScan

Sample image

View attachment 5604

Press Enter key to execute

After a few seconds this dialog will pop up:

View attachment 5605

Click Close and shortly your computer will shut down and restart.

During the restart you will see Windows Defender Offline scan run.

Note: It's set to run a Quick Scan that targets key Windows processes and files, so the scan will take around 5 - 10 minutes tops. If issues arise, you can always opt to run a Full scan later when you log back on to Desktop.

When the scan completes the computer will shut down and restart again and you'll be able to log on as usual.​

Another option, should Windows Defender not succeed, is to make use of the Microsoft Malicious Removal Tool that is included each month in the Windows Updates.

To run this, all you need to do is the following:

• Right-click on Start and select Run
• In the Run dialog type MRT then click OK
• When the User Account Control prompts you click Yes

This window will now appear

View attachment 5606

Click the Next button

In the next window, select Full scan then click Next button

Sample image

View attachment 5607

The scan will now begin.

Sample image

View attachment 5608

Note: This scan could take 40 minutes to just over one hour. You can cancel the scan by clicking the Cancel button, but I assume your intention is to rid yourself of the infection you believe you have because of the downloaded file you mentioned.​

Report back on any success or failure trying either of these approaches, as there are other options you can do also, but for now this is the easiest approach given you have both of these utilities all ready on your computer.


Regards,

Regedit32

 

[kellabella84]

Thanks so much for replying! Your advice sounds great but I have a new problem that has to be fixed first. A few hours ago I switched to safe mode then restarted my laptop. My pc started but the usual login option (Windows 10) is gone. There's no way for me to sign in. I tried different keyboard combinations but nothing. I attached an image to show you what I mean, hope it helps.
Thanks!!!

 

[Regedit32]

Hi again,

In the bottom right corner of your screen in that image you posted is your Power icon.

If you press and hold down your shift key while at same time click that power icon and select restart you ought to be able to get your computer to restart to the Recovery Console, where you could choose to try Troubleshoot and Startup repair, or at least get to set the computer to boot back to Safe mode.

You ought to be still able to run the PowerShell command from Safe mode, but if that were not possible, you could type Def in the search box and select Windows Defender, and run a scan while in Safe mode.

You can also run the Microsoft Malicious Repair Tool ( Start > Run > type MRT and click OK) from Safe mode.

If its not possible to get to the Recovery console, or back to Safe mode at all, then you will need to use a working computer to download a Windows 10 ISO image and create a bootable disk from it that you can then insert into your laptop and boot from. Note: The ISO you use must match the current installed version of Windows 10 on your laptop (for example, if laptop has Windows 10, 64-bit, and default language is US English, the ISO image downloaded must be set to those three choices like in image below):

Extra note: As you would be downloading this ISO from another computer, you must not check that tiny box next to Use the recommended options for this PC, which in this image below is checked

The Article section has various comments on using ISOs, as does many posts within this Forum, so for now I wont re-explain that. You can download an ISO here should you require one:

https://www.microsoft.com/en-us/software-download/windows10

Regards,

Regedit32

 

[kellabella84]

I plan on downloading the Windows 10 file to a usb flash drive today. Can you walk me through the steps I need to take once I'm ready to boot from the usb drive I downloaded?
I appreciate it Thanks!!!

 

[Regedit32]

Here is a link on how to download the Window 10 from our Forum's Article section.

https://www.windows10forums.com/articles/how-to-download-windows-10-iso.35/


In terms of booting your Toshiba laptop from the USB thumb drive, if I am correct:

• Insert the USB Thumb drive
• Start laptop and immediately begin tapping you F12 key
• This ought to take you to the Boot menu and depending on the BIOS you have, its likely to be option 5 USB Memory

 

[kellabella84]

I tried that and got to the boot menu but I don't see any option that says USB Memory. This is so frustrating, I downloaded Windows 10 to a usb flash drive another computer. I don't know what I'm doing wrong

 

[Regedit32]

Different BIOS call it various things.

I'm not 100% sure what your BIOS is on your model - I'll need to see if there is a user manual online to check, unless you happen to know off hand.

If its older than 2011, its possible there is no option at all, but I would doubt that.

What is the full model number of your computer. Toshiba L70-B series, but what number after the B?

Some of the SM Bios systems require you to disable the fastboot option in BIOS so you can set up the boot menu and its order of boot too.

I'll be able to confirm if you can either point me to the precise model number.

The other option is when you first turn on laptop, tap the key it tells you to get to Setup. That might be ESC or F2, which would take you to the BIOS Setup, where you ought to see more than just the Boot menu choices.

 

[kellabella84]

I looked on the back of my computer and it says Toshiba Satellite L75-B7270

I hope that helps and I really appreciate you trying to help. I'm going crazy without the use of my computer lol.

 

[Regedit32]

Hi kellabella84,

I looked up your model, and from what I can tell the USB option will not be listed in the Boot menu options unless the USB thumb drive is connected to computer.

Thus with computer turned off, insert the USB thumb drive with your Windows 10 files you made

Now turn on laptop and tap F12 to get to the Boot menu

Then using Up/Down Arrow keys select USB


Apparently, you also have a Recovery Option built into the laptop too.

• With laptop turned off press and hold down the 0 key (Zero key)
• Still holding it down turn laptop on and release the 0 when a splash box appears telling you its about to go to Recovery.
• This will then take you the Windows Recovery Console screen, where you have troubleshoot options, etcetera, which I believe you've used before.

Regards,

Regedit32

 

[Trouble]

I tried that and got to the boot menu but I don't see any option that says USB Memory. This is so frustrating, I downloaded Windows 10 to a usb flash drive another computer. I don't know what I'm doing wrong

It's possible that the computer may require that the USB boot media be prepared in such a fashion as to support booting GPT / UEFI, rather that MBR / Legacy (BIOS).
In which case you might want to employ something like Rufus http://rufus.akeo.ie/
AND configure it as indicated below....

OR it may simply need to be re-done.
I recently had a heck of a time booting a reasonably new Dell laptop from what I believed to be a well prepared USB Thumb Drive.
Turns out after trying everything I could think of including re-doing the boot media a second time, I ended up going back to Microsoft, re-downloading the ISO again and re-doing the Rufus setup to the same thumb drive again with exactly the same configuration / settings and .....
What do you know..... third time was actually " a charm "

 

[kellabella84]

It's possible that the computer may require that the USB boot media be prepared in such a fashion as to support booting GPT / UEFI, rather that MBR / Legacy (BIOS).
In which case you might want to employ something like Rufus http://rufus.akeo.ie/
AND configure it as indicated below....

View attachment 5629
OR it may simply need to be re-done.
I recently had a heck of a time booting a reasonably new Dell laptop from what I believed to be a well prepared USB Thumb Drive.
Turns out after trying everything I could think of including re-doing the boot media a second time, I ended up going back to Microsoft, re-downloading the ISO again and re-doing the Rufus setup to the same thumb drive again with exactly the same configuration / settings and .....
What do you know..... third time was actually " a charm "

Wow! I had no idea about the GPT/UEFI, etc option. I wish I knew that before. I actually just dropped it off at a computer repair service bc I didn't know what else to do. Hopefully they will figure out what you just mentioned and I can move on from this mess!! (fingers crossed)
Thanks!!!

 

[Trouble]

Hopefully you shopped that repair service around and found a local mom and pop with some good reviews and you didn't end up with BestBuy or something similar.

 

[Regedit32]

Sorry it did not work out for you kellabella84.

I'm sure a repair store can reimage it.

Worse case scenario they grab your personal files, use the built in recovery tool, then reinstall windows 10 for you and add the personal files back in.

And of course - rid your laptop of that file you downloaded that began all this!

Many years ago I had a Toshiba laptop, and the thing that stood out for me was their ridiculous User manual that 70% was how to sit properly while using your laptop.

Fortunately, today it appears Toshiba have a panache for posting YouTube tutorials to demonstrate what should have been written in their User manual but still is not!

 

[kellabella84]

Hopefully you shopped that repair service around and found a local mom and pop with some good reviews and you didn't end up with BestBuy or something similar.

That's exactly what I did!! lol. I've heard too many bad things about BestBuy and they seem expensive. I went to Enterprrise (I don't know if it's just around my area) but there a local mom and pop shop. Shorty after dropping my pc off they called. He said they will probably be able to restore the system to an earlier date. I will find out definitely in the morning.