Computer lock scam

[Talies R]

I ended up with a "Your computer is locked" virus...
Immediately tried to reboot in safe mode and apply a system restore...suddenly my restore points have been deleted.

I can't actually do anything in safe mode, it goes straight to the lock screen. I'm running out of ideas. Google searches point to different software downloads, to boot straight from recovery iso...not sure what software is legit.

If anyone is an experienced tech here, can I bring you my computer and pay you to fix this?

Or is there a simple'ish soution?

[RNB11]

Does it say your files are locked and you have to pay to decrypt them?

[firebane]

Not going to be a simple task if its gotten to the point where its making safe mode not work properly.

You will probably need to get a bootable cd that has antivirus on it like Avast (http://www.av-soft.ch/bart-cd.html/) but the issue is that if its that infected best to probably get as much of the files off using a Live CD like Hirens or UBCD which has a mini XP so you can grab your files then just format the computer and start fresh.

Any serious infection will always cause grief later.

[revelations]

Is it asking you to send money/bitcoins to be unlocked?

Do you have system or file backups?

[DeeK]

If you don't need to get any files off it, just run a clean format and re-install windows.

If you do need to get files off it, well then, good luck.
http://malwaretips.com/blogs/your-co...ocked-removal/

[snowcat]

Search google this is an easy fix. Happened twice to work computers, no need to reinstall!

[Talies R]

Yea the want $100 to unlock it or decrypt it...'ukash'.

I can't even boot it into safe mode, argh. I have Windows 7 Ultimate 64 preinstalled, can't find the discs anywhere. Do I have to buy windows again?

^yea, just looking to save files and start fresh some how.

[Seth1968]

The Kaspersky Rescue Disk usually nukes it. Just make sure you update it before running it.

http://support.kaspersky.com/4162

[zieg]

It's probably too late to be trying to boot to safe mode, your files are already encrypted

[Seth1968]

Originally posted by ZiG-87
It's probably too late to be trying to boot to safe mode, your files are already encrypted

So it's the Police Ransomeware infection / Ukash?

If so, it doesn't encrypt your files. It just locks you out until you can remove it.

[taemo]

Originally posted by snowcat
Search google this is an easy fix. Happened twice to work computers, no need to reinstall!

is the fix you are referring to any of these?
http://www.f-secure.com/en/web/labs_...ing-ransomware
http://malwaretips.com/blogs/remove-police-trojan/

there are so many guides out there but you will not know which one works unless you use them;
fortunately we haven't had any ransomware issues in our environment yet but it is always good to be aware and ready.

thanks for the Kaspersky Rescue Disk link, will come really handy if needed.

[Seth1968]

Originally posted by taemo
thanks for the Kaspersky Rescue Disk link, will come really handy if needed.

You're welcome.

Lethbridge was targeted with the police ransomeware infection a few months ago. I disinfected about 50 in a 3 month period.

The Kaspersky Rescue Disk will get rid of it about 90% of the time. For the few variants that can't be removed via a bootable antivirus, then a System Restore will work as well.

The OP say's that the infection disabled System Restore, but I've never seen the infection do that.

[Talies R]

Seth, will the Rescue disc work without my ability to restore?
I had a restore point and it somehow got deleted! (Virus related)...like I saw it as I was about to restore, then suddenly I'm prompted that there was an error and there is no restore.

[Seth1968]

It will run.

Download it and burn it as an Image/ISO.

You might have to go into your BIOS to change the boot order to boot from the disk first.

Again, don't forget to update it before running it.

[RNB11]

From what I know the ransom virus encrypts the file, the only way to decrypt it is to pay it as the private key is stored on the remote server. I could be wrong though.

[Unknown303]

This is why I only visit quality porn sites.

[Kloubek]

^ Speaking of which - I've been getting this malware/virus a few times now that claims to be some sort of official (bogus) Canadian protection agency of some sort with official-looking military-style imagery and supposedly official legalize on it. It takes over the screen, and doesn't allow you to do anything even after a reboot. I believe they are also asking for fine payment - though it's pretty obviously a scam.

At least for that, Safe mode and restore works fine.

[eiysa101]

/\ lol, that one turns on your webcam too and shows your face claiming they have your info linked to pedo content.

[Kloubek]

Yeah.... it says something about pedo or beastiality content. I'm like... wtf?

Didn't know about the cam. I don't have one installed so at least I didn't get that shock.

[PaleRider]

It's probably cryptolocker.

If you don't need any files then re-install from a clean OS CD.

If you do, you'll probably need to pay up. I believe they will give you the key to decrypt your files.