Ransomware on my computer please help !

MrBlobby · 26 Jan 2013 at 16:57

I used a live CD and found, but I can't boot in in safe mode and whatever I do reg entry changes back !!

HKEY_local machine/software/microsoft/WindowsNT/Currentversion/winlogon/shell SHOULD have a value of "explorer.exe"

BUT has "cmd.exe /k start cmd.exe"

MrBlobby · 26 Jan 2013 at 16:59

Apparently it's infected with TR/Rogue.KD.836102

anything I don't mind · 26 Jan 2013 at 17:23

What happens when you boot it without safe mode, what does it end up like? can you do ctrl+shift+esc? can you get a cmd up?

Did you try the last known good configuration option?

bignev72 · 26 Jan 2013 at 17:33

Could you boot with live CD and then run malwarebytes and combofix from there?

That would most likely fix it.

MrBlobby · 26 Jan 2013 at 17:47

bignev72 said:
Could you boot with live CD and then run malwarebytes and combofix from there?

That would most likely fix it.

How do I do that ? I've never been able to work out how to run malwarebytes from a boot disk.

KIA · 26 Jan 2013 at 18:32

Use the Kaspersky Rescue Disk. Update the definitions before you scan. https://support.kaspersky.com/4162

There's a tutorial @ http://blog.malwarebytes.org/intelligence/2012/12/ransomware/

MrBlobby · 26 Jan 2013 at 18:43

Hey I've fixed it used http://www.avira.com/en/download/pr...ue-system/product/avira-antivir-rescue-system

boot cd with virus checker

Thought I'd put this here just in case anyone googled it

KIA · 26 Jan 2013 at 18:51

Great. Time for you to update Windows, Flash, Java, Adobe Reader, etc. Secunia PSI will help you keep everything up to date.

JamieH · 26 Jan 2013 at 19:19

MrBlobby said:
Hey I've fixed it used http://www.avira.com/en/download/pr...ue-system/product/avira-antivir-rescue-system

boot cd with virus checker Thought I'd put this here just in case anyone googled it

Looks a good tool and worth burning for those 'just in case' moments.

MrBlobby · 26 Jan 2013 at 21:36

Unfortunately all the files are encrypted arrgghhh ! Apparently Kaspersky RannohDecryptor will decrypt them but I need to find one file that is an original unencrypted version. As it's someone else's computer (not mine really lied ha !) I'll have to wait and see if they have a back up or copy of at least one file !!

kirbz · 26 Jan 2013 at 23:07

MrBlobby said:
How do I do that ? I've never been able to work out how to run malwarebytes from a boot disk.

Hirens boot cd has this on it.

MrBlobby · 27 Jan 2013 at 08:31

kirbz said:
Hirens boot cd has this on it.

Thanks brilliant

http://www.hiren.info/pages/bootcd