No access to windows 11 login - byproduct of original virus issue

Right now my problem is that I can't login to Windows 11 (fingerprint reader and pin data have been removed it appears) - I have tried holding the shift key down while clicking restart and waiting for reboot - but safe mode does not appear.  So now I am now guessing that I will have to get access maybe from a flash drive,  but I am kind of lost here as to the best way to go...

 

Any help would be appreciated

Greetings and to BleepingComputer's Virus/Trojan/Spyware/Malware Removal forum.

My name is Oh My! and I am here to help you! Now that we are "friends" please call me Gary.

===================================================

Ground Rules:

• First, please keep in mind most of us at BleepingComputer volunteer our assistance for your benefit in your time of need. Please try to match our commitment to you with your patience toward us.
• It is important to not run any tools or take any steps other than those I will provide for you.
• Please perform all steps in the order they are listed. If things are not clear or you experience problems be sure to stop and let me know.
• Please copy and paste all logs into your post unless otherwise requested.
• When your computer is clean I will let you know, provide instructions to remove tools and reports, and offer you information about how you can combat future infections.
• If you do not reply to your topic after 5 days I will assume it has been abandoned and I will close it.

===================================================

Now that I am assisting you, you can expect that I will be very responsive to your situation. If you are able, I would request you check this thread at least once per day so that we can try to resolve your issues effectively and efficiently. If you are going to be delayed please be considerate and let me know.

Thank you for your patience thus far.

See if you can do this. If it doesn't work boot your computer, wait 5 seconds then hold the power key down to shut down the computer. Do this twice. Do it a 3rd time and let it continue. See if you can the get to the Advanced options screen.

===================================================

Farbar Recovery Scan Tool in Recovery Environment

--------------------

• From a clean computer download Farbar Recovery Scan Tool for 64 bit and save it to a USB drive
• Remove the USB device and insert it into the compromised computer
• Holding down the Shift Key click Start, click the power icon, then select Reboot
• Select Advanced options
• Select Troubleshoot
• Select Advanced options
• Select Command Prompt
• In the command window type in Notepad and press Enter
• Click File, then Open
• Click This PC on the left hand side
• Double click on the USB device
• Under Files of type: click the down arrow then select All files
• Right click on FRST64 and select Run as administrator
• Click Yes to the disclaimer that may appear
• Click the Scan button
• When completed a FRST.txt document will be created on the flash drive
• Copy and paste the contents of the report in your reply

===================================================

Things I would like to see in your next reply. Please be sure to copy and paste any requested log information unless you are asked to attach it.

• FRST report

Edited by Oh My!, 22 April 2024 - 04:11 PM.

OK - that worked with the holding down of the power button - you are already getting progress!  Here is the log;

 

Can you provide additional information about what malware was on the system, what was done to remove it, and when the system became unbootable?

The FRST.txt report is incomplete. Please rerun a scan making sure all items under Whitelist are checked.

I can't tell you what virus or malware was on my system - a number of days ago chrome started not connecting to certain websites - and it stopped downloading anything -  it stopped going to google.com - yet I could ping most websites from the CMD prompt - here is where it started to look funny - when I did an nslookup of the ip address for google (from the ping) it didn't resolve to google.com - instead it resolved to come weird named domain.  I had similar problems using Edge as a browser.  While I was investigating - all of a sudden I couldn't login anymore - that's the full strory.

 

Here is the FRST.txt file again - Post 1 of 2 (POST says to long,  that I have to divide into two posts;

 

2nd post of 2 (last line of first post is same as first line of second post);

 

All items in whitelist -were- checked.

I just remembered that I did run Malwarebytes - it found a virus (one line) but the decsription was something like "No description" - which I put into the vault.

I also ran CCleaner but only had it delete old files and disconnected registry entries.  

Edited by debanning, Yesterday, 05:14 PM.

Does Windows appear to load properly all the way to the login screen? What specific error message do you get for the fingerprint reader and PIN?

The login screen appears normally.  It will not read my fingerprint,  and my access PIN does not work. It says "Something happened and  It suggests resetting my PIN,  when I click that option it brings me to a screen to search the app store.  Clicking to connect to the app store brings me back to the PIN error.  Trying that again and now I am getting a popup which states "The system detected an overrun of a stack based buffer in this application. This overrun could potentially allow a malicious user to gain control of this application." 

 

And that's where it ends.

Thanks for the clarification. I am ending for the evening but attempt the below. I don't think you will have the option but try anyway.

===================================================

System Restore from System Recovery Partition

--------------------

• Repeat the power down steps to enter the System recovery options
• Click Troubleshoot
• Click Advanced options
• Click System Restore
• Select Next
• If necessary check Show restore points older than 5 days
• Left click on the most recent Restore Point then click Next
• Click Finish and allow System Restore to run
• Report whether the System Restore was successful

Reports "No restore points have been created on your computer's system drive"

Are you given the option to enter a password?

Did you create a Microsoft account for this computer?

There is no option to enter a password.  I can't remember if I created a Microsoft account. Is there another way?

Do you know the password even though you are not given that option?