Page 1 of 2 12 LastLast
Results 1 to 10 of 16
  1. #1
    Member
    Join Date
    Mar 2009
    Location
    Romford Essex United Kingdom
    Posts
    132
    Points
    1

    Default This has locked my laptop

    Hello

    The following is the title of a site on my laptop "Sin haben sich mit einen windows - verschlusselungs trojaner infiziert"

    It needs a payment to release the unlock code.. i have checked on my iphone and this is a site that cons money out of people, but I am not paying.
    I have tried restarting my laptop in safe mode, command prompt, safe mode with networking etc but all it does it go straight to the page above, the script is all in german language and locks my laptop totally.

    Can anyone please help with this bearing in mind I have no access to my desktop whatsoever.

    Kind Regards
    Tony

  2. #2
    Member Spyware Fighter DonnaB's Avatar
    Join Date
    Apr 2009
    Location
    Illiana, Ill. USA
    Posts
    3,521
    Points
    563

    Default

    Yowsers! You're being held for ransom by scareware!

    Are you able to right click in the taskbar area, choose Task Manager from the list, click on Applications and end it?

    If so, see if you can then at least run Malwarebytes (Step 2) from the link below.

    Help2Go Forums - How to Start Removing Viruses and Spyware from your Computer


    A System Restore might even take you back in time before this was installed..... not sure how aggressive this new scareware is.

    Keep me informed to your progress.
    Last edited by DonnaB; 05-27-2012 at 04:26 PM.
    If you think you might be infected with malware or have recently cleansed your computer of malware without the help of an expert, please read and follow the instructions in How to Start Removing Viruses and Spyware from your Computer. This can alleviate time consumed in trouble shooting your current computer problems.

    If your problem is solved, here's how to say thanks!

    Very proud parent of a U.S. Navy "CB"



    "People may forget what you say,
    People may forget what you did,
    but People will never forget how you made them feel!"

  3. #3
    Member
    Join Date
    Mar 2009
    Location
    Romford Essex United Kingdom
    Posts
    132
    Points
    1

    Default

    Hello Donna
    Thank yopu for replying
    This scareware is very agressive, it wont let me do anything. as soon as i switch on and get the log in screen i log in then it goes straight to the german page as described in my first post. I cannot access anything all i have is the screen with this german item on asking for money. even if i try F8 and try safe mode, command prompt, last knwon config etc it still comes back to that german page.

    My fear is I may have to re install the operating system and have a clean slate

    Regards
    Tony

  4. #4
    Member Spyware Fighter DonnaB's Avatar
    Join Date
    Apr 2009
    Location
    Illiana, Ill. USA
    Posts
    3,521
    Points
    563

    Default

    Hi Tony,

    All hope is not lost just yet. Were you able to access the Task Manager with my instructions above to see if you can end the application after the german page appeared?

    Could you please tell me which Operating System (OS) is installed?

    Do you have a USB Flash drive available?

    Does your computer have a recovery partition or do you have the recovery disks available if they are needed?

    There is another way to work around this scareware to regain access to your computer. We'll save the recovery options as a last ditch effort. Do you have all your personal files backed up just in case a reinstall/reformat is deemed necessary?
    Last edited by DonnaB; 05-28-2012 at 05:55 PM.
    If you think you might be infected with malware or have recently cleansed your computer of malware without the help of an expert, please read and follow the instructions in How to Start Removing Viruses and Spyware from your Computer. This can alleviate time consumed in trouble shooting your current computer problems.

    If your problem is solved, here's how to say thanks!

    Very proud parent of a U.S. Navy "CB"



    "People may forget what you say,
    People may forget what you did,
    but People will never forget how you made them feel!"

  5. #5
    Member
    Join Date
    Mar 2009
    Location
    Romford Essex United Kingdom
    Posts
    132
    Points
    1

    Default

    Hi Donna

    Thanks for replying, I cannot access anything on the laptop all i have a complete black screen with the german scamware inside a white box carrying the microsoft logo. I have right clicked in the bottom of the screen to try and get task bar but nothing, the operating system is windows xp, i have a 1 GB memory stick or flash drive but there is no way of accessing the recovery partition as i cannot access the desktop. I tried sending a photo wioth this but it wont let me load it

    Apologies for the delay in responding.

    KInd Regards
    Tony

  6. #6
    Member Spyware Fighter DonnaB's Avatar
    Join Date
    Apr 2009
    Location
    Illiana, Ill. USA
    Posts
    3,521
    Points
    563

    Default

    Intuition told me that would be your reply though I was hoping for a miracle.

    Do you have a second computer that you can use to transfer files from? If so, what OS?

    I tried sending a photo wioth this but it wont let me load it
    Darn! I would have loved to seen that!
    If you think you might be infected with malware or have recently cleansed your computer of malware without the help of an expert, please read and follow the instructions in How to Start Removing Viruses and Spyware from your Computer. This can alleviate time consumed in trouble shooting your current computer problems.

    If your problem is solved, here's how to say thanks!

    Very proud parent of a U.S. Navy "CB"



    "People may forget what you say,
    People may forget what you did,
    but People will never forget how you made them feel!"

  7. #7
    Member
    Join Date
    Mar 2009
    Location
    Romford Essex United Kingdom
    Posts
    132
    Points
    1

    Default

    Quote Originally Posted by DonnaB View Post
    Darn! I would have loved to seen that!
    [URL="http://i1245.photobucket.com/albums/gg585/knight12u/DSCF1137.jpg[/URL]
    [URL="http://i1245.photobucket.com/albums/gg585/knight12u/DSCF1136jpg[/URL]

    Hi Donna sending the pics via a URL hope you can access them I have a desktop with windows vista home premium OS

    Have a good day, its sunny and warm here in Essex in the UK.
    Also sent the links in a private message

    Kind Regards
    Tony

  8. #8
    Member Spyware Fighter
    Join Date
    Jun 2010
    Location
    Bement,Ill USA
    Posts
    1,340
    Points
    146

    Default

    Download http://unetbootin.sourceforge.net/un...ows-latest.exe & http://noahdfear.net/downloads/boota...xpud-0.9.2.iso to the desktop of your clean computer
    • Insert your USB drive
    • Press Start > My Computer > right click your USB drive > choose Format > Quick format
    • Double click the unetbootin-xpud-windows-387.exe that you just downloaded
    • Press Run then OK
    • Select the DiskImage option then click the browse button located on the right side of the textbox field.
    • Browse to and select the xpud-0.9.2.iso file you downloaded
    • Verify the correct drive letter is selected for your USB device then click OK
    • It will install a little bootable OS on your USB device
    • Once the files have been written to the device you will be prompted to reboot ~ do not reboot and instead just Exit the UNetbootin interface
    • After it has completed do not choose to reboot the clean computer simply close the installer
    • Next download http://noahdfear.net/downloads/xPUD_userinit_fix to your USB
    • Remove the USB and insert it in the sick computer
    • Boot the Sick computer
    • Press F12 and choose to boot from the USB
    • Follow the prompts
    • A Welcome to xPUD screen will appear
    • Press File
    • Expand mnt
    • sda1,2...usually corresponds to your HDD
    • sdb1 is likely your USB
    • Click on the folder that represents your USB drive (sdb1 ?)
    • Confirm that you see userinit_fix that you downloaded there.
    • Double click userinit-fix it will start a little program.
    • The script will complete and prompt you to reboot the computer.
    • Close the Terminal window and shut down your computer. Don't Boot back into Windows We need to have a look at that log so we can see the bad file to delete before we boot back into windows
    • Post the contents of the UserinitReport.txt file that was created on your flash drive.
    " Extinguishing Malware from the world"

    The Spware Help forum is very busy. If I'm helping you and I've not posted back within 24 hrs., send a PM with your topic link. Thank you.
    HELP REQUESTS VIA THE PM SYSTEM WILL BE IGNORED. The Forums are there for a reason!
    Thanks-




  9. #9
    Member
    Join Date
    Mar 2009
    Location
    Romford Essex United Kingdom
    Posts
    132
    Points
    1

    Default

    Hello fireman4it

    I have followed the instructions given in your reply and got as far as putting the USB into sick computer the welcome xpud screen comes up and I click file then expand mnt as instructed but it does not show userinit_fix. All it shows is a number of files with a mix of letters and numbers (15 files with number and letters like (33dd65481cce4bb911085007) then there are 2 files saying recyle bin, 1 file thats saying firefox 1 file saying new software and 1 saying system volume information. these are all on sdb1 but i also have sda1 sda 2 sda 3. (sda3 is empty)
    However when i replace the usb into my clean computer and check contents of usb it says the userinit file is on there.

    Whats my next move please
    Kind Regards
    Tony

  10. #10
    Member
    Join Date
    Mar 2009
    Location
    Romford Essex United Kingdom
    Posts
    132
    Points
    1

    Default

    Hello fireman4it

    Further to last reply after i out in usb with all the downloads on there was a small black box top right hand corner on the sick computer saying "Device found Error:/mnt/sda1 not mounted

    Regards
    tony

Page 1 of 2 12 LastLast