Member Avatar for michellesmith

Yesterday, on my work desktop, the WinPC
Defender stuff popped up. At that point, I could no longer connect to the internet. I am now on our laptop. I can't open the desktop unless in Safe Mode. Regular startup gives me an error about "Loading Personal Settings" and stays there. I have tried to run several virus remover software programs by downloading them via laptop and then to desktop, but they won't run because I don't have internet connection. I have XP. Thanks.

  • 2 Contributors
  • 6 Replies
  • 212 Views
  • 3 Days Discussion Span
  • Latest Post Latest Post by jholland1964

Dani AI

Generated

Brief note tied to the existing troubleshooting: ’s symptoms (WinPC Defender popup, loss of normal boot, “Loading Personal Settings” hang, USB tools failing) are consistent with a rogue anti‑spyware that both blocks normal programs and can corrupt or lock a user profile. ’s suggestion to run offline scanners is sound; if transferred installers won’t run, the next steps focus on safe data recovery and alternative offline cleaning methods before a paid repair.

If the drive contains important documents, image or back up the disk first (boot from a Linux/Rescue USB or remove the desktop’s drive and attach it to another computer as a secondary drive). Scanning the attached drive with a clean, up‑to‑date AV on a separate machine often detects/removes stubborn rogues without risking the infected OS.

When recovery attempts continue on the original machine, try these lower‑risk repairs from Safe Mode or Recovery Console:

  • Create a new local administrator profile (log in as the built‑in Administrator in Safe Mode, add a new account, copy Documents and Desktop files from the old profile).
  • Use System Restore to roll back to a point before the infection (if available).
  • Check and restore the hosts file at C:\Windows\system32\drivers\etc\hosts (remove unfamiliar entries that redirect sites).
  • Inspect Winlogon run keys that rogues often abuse (backup the registry before editing).

Basic repair commands (run from an elevated command prompt; back up first):

chkdsk c: /r
sfc /scannow   (Windows XP may request the installation CD)
netsh winsock reset
ipconfig /flushdns

Always export the registry before changes and keep copies of any logs or quarantined files. If malware prevents any of the above (installers won’t execute, profile remains corrupt, network still blocked), imaging the drive and doing a clean Windows reinstall is often faster and safer than repeated partial fixes. Before returning a machine for repair, ensure personal files are backed up and any saved credentials are changed on another device.

Recommended Answers

All 6 Replies

Member Avatar for jholland1964

Neither of these scans need internet access IF you can transfer them via the laptop to the infected computer. Both can easily be done OFFLINE.

Do the following using the laptop and transferring to infected computer:
Please download Malwarebytes' Anti-Malware (MBA-M) to your Desktop.

* DoubleClick mbam-setup.exe and follow the prompts to install MBA-M.
* Be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
* If an update is found, it will download and install the latest version.

In order to update the program you will also have to download to your laptop and transfer to the infected computer the manual update file which you can get HERE

Now MBA-M is made to be run in NORMAL mode if possible as it doesn't load all of it's drivers in safe mode. However it CAN be run in Safe Mode, it just will not be able to scan everything. But that may be all you need to then be able to boot to normal mode.
If you can run it in Safe Mode do so, following directions below. Once that scan is complete and you reboot, if it can boot to Normal mode then do the same Full System Scan again.

* Once the program has loaded, select Perform full scan, then click Scan.
* When the scan is complete, click OK, then Show Results to view the results.
* Be sure that everything is checked, and click Remove Selected.
* When MBA-M finishes, Notepad will open with the log. Please save it where you can find it easily. The log can also be opened by going to Start > All Programs > Malwarebytes' Anti-Malware > Logs > log-date.txt.

Reboot the computer.

Next download and carry to the infected computer
You will need to run a Full System scan with it also. You will need to save the log.
I will need to see both logs. See if there is a way you can get the logs from the infected computer to the one you are using now and post those in your next post here.

Member Avatar for michellesmith

Thank you! I am trying this now, although my flash drive isn't working in the infected computer. The light is going off and on slowly. I will get back with you. Thanks again.

Member Avatar for michellesmith

Thank you! I am trying this now, although my flash drive isn't working in the infected computer. The light is going off and on slowly. I will get back with you. Thanks again.

Well, I got infected computer to recognize the drive. When I double click on the file I had downloaded, it does nothing! Any suggestions??

Member Avatar for jholland1964

Well, I got infected computer to recognize the drive. When I double click on the file I had downloaded, it does nothing! Any suggestions??

See if you can Send it to the Infected computer.

Member Avatar for michellesmith

See if you can Send it to the Infected computer.

I just did that and when I click on it, it has the hour glass for a few seconds and then stops and does nothing. I appreciate your help. I was able to get my Word documents off that computer and am sending it in for repair. Thanks again.

Member Avatar for jholland1964

Sorry, probably the best idea.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.