Sign in to follow this  
Followers 0
Alley Cat

Unknown Scareware

30 posts in this topic

My laptop is crippled at the moment, when I log in, a window takes over 100% of screen real estate, I cannot open or see TASK MANAGER. It is scareware of some kind.

A picture of hand cuffs, threatening me to pay up or you will lose internet access. My guess is that is the newest version of the fake "Antivirus" family, eg: Antivirus 2007, Antivirus 2008, Antivirus XP.

And system restore, fails, of course.

OS: Windows 7 Starter Edition

Share this post


Link to post
Share on other sites

Best I can suggest is booting your machine into safe mode. It should give you access to your OS and let you try and remove it.

Failing that, formatting is always the best answer with this kind of infection.

Share this post


Link to post
Share on other sites

If I cannot locate the scareware by name, reformatting will come next.

If possible, I just need a name on this scareware. I originally thought the handcuffs image would be a dead giveaway and allow a path to google it, find what the name of the malware.

Share this post


Link to post
Share on other sites

As stated above boot into safemode with networking, download Malwarebytes and have a scan with it, should pick up. After that I'd suggest running TDSS Killer, usually gets rid of any remaining traces.

Also you could try googling some of the text from it.

Share this post


Link to post
Share on other sites

Is it the FBI virus ?

I am having the same exact problem at the moment too with my dads computer.

Also. I am unable to boot into safe mode and I can't seem to find any of my old Live Linux disks.

Share this post


Link to post
Share on other sites

Combofix will remove it. After combofix run Super AntiSpyware and then MalwareBytes

Share this post


Link to post
Share on other sites

This crap usually is located as a single random exe in one of the following locations

c:\users\(username)

c:\users\(username)\appdata\roaming

c:\users\(username)\appdata\local

c:\programdata

Boot into safe mode and unhide system files and hidden files and check those locations for exes. Also do a windows key + R and type msconfig. The nasty is usually listed in there as it starts with the PC. Once you find it in the list it should tell you its location. Go to that location and delete the offending exe file.

Share this post


Link to post
Share on other sites

What about those who can't even boot into safe mode ?

Share this post


Link to post
Share on other sites

What about those who can't even boot into safe mode ?

Then download a linux Live cd and use that instead. Then browse to the locations listed above and delete the offending exes

Share this post


Link to post
Share on other sites

What about those who can't even boot into safe mode ?

You could try Kaspersky's Rescue Disk, boot into it and see if you can remove the infection via it or at least make the OS bootable.

https://support.kaspersky.com/4162

Or as Warwagon suggested grab a Linux distro and try and remove the infection manually.

Share this post


Link to post
Share on other sites

If you cannot boot into Safe mode (ensure you try Safe mode with COMMAND prompt as this generally does still work), you will need a LiveCD (Linux, Hirens, Vista, 7, etc).

For Vista/7 go to %appdata% for the User account that is infected and delete the Skype.ini and Skype.dat files. Then go to %programdata% and delete any .exe/.sys files from the bottom of the list. If there are .sys files you may need to use "attrib" to remove hidden/system file attributes before you can delete them.

For XP: Check %appdata% in the User account that has the infection coming up for the same files/file types as above. If you do not see any here go up one directory and then Local Settings\Application Data and check there. If nothing is still found you can navigate to All Users and go through Application Data there.

Also if Safe mode Command Prompt works you can use:

net user /add useraccountname mypassword

net localgroup administrators useraccountname /add

to create a new account, which generally gets you into the machine from where you can access the above locations to clean out your infected account

1 person likes this

Share this post


Link to post
Share on other sites

I was able to use KRT but didn't find anything.

Just tried Hiren's. Damn that iso has changed since v10. was unsuccessful to run any programs. Need to look at that disk again.

I was about to try Windows Defender Offline Boot disk. But I was booted into desktop with the 100% display. After getting to the shutdown the 100% display went away and SOMEHOW was able to stop the shutdown process. I have now just installed Malwarebyetes and am doing a scan. 2% done and 15 infected files found :|

I am doing the scan NOT in safe mode. Does that matter.

... Sorry. I haven't had a virus for a good 5 years. And this one seems to be hardcore. Its my dads computer with a lot of important stuff. If it were my computer I would have formatted and installed Windows 7 about 4 hours ago :p

Share this post


Link to post
Share on other sites

You could try Kaspersky's Rescue Disk, boot into it and see if you can remove the infection via it or at least make the OS bootable.

https://support.kaspersky.com/4162

Or as Warwagon suggested grab a Linux distro and try and remove the infection manually.

Ive used Kapersky to remove the fake Met police scareware with great success. I use it professionally as its quicker than other methods. Most are a theme on the FBI one.

Trend also do a live rescue cd IIRC failing that avast or Avg do a similar utility.

Burn the iso to disk or even better usb stick and boot from it (via bios boot order) and follow the prompts.

Remember to allow it to update its defs in its live environment if it detects your lan or wifi card

Share this post


Link to post
Share on other sites

Thanks guys.

Finally just removed that crap with a quick scan of Malwarebytes. But now I am doing a deep scan.

1 person likes this

Share this post


Link to post
Share on other sites

Not running in safe mode isn't an issue, that's just to try and get around the screen lock.

After MalwareBytes, I'd run whatever other AV/AM tools you like and just make sure you got everything.

Personally after this kind of infection I always format, I'd just rather not to take the risk. Entirely up to you though >.<

Share this post


Link to post
Share on other sites

I don't know about this malware but I have been able to move the malware screen off to one side of the machine (not completely off) and any other windows that pop up I stack them on top of each other. This gives me access to the start button and an open place on the desktop to work from.

Share this post


Link to post
Share on other sites

Not running in safe mode isn't an issue, that's just to try and get around the screen lock.

After MalwareBytes, I'd run whatever other AV/AM tools you like and just make sure you got everything.

Personally after this kind of infection I always format, I'd just rather not to take the risk. Entirely up to you though >.<

Yeah. My dad should have fixed this himself just to teach him a lesson.

IE8 user, uses random crappy AV and other software, has a TON of files (all of which are located on C: ) .. and hasn't done a Windows update in over a year.

If it were me, I would have formatted C and reinstalled everything. It would have only taken 45mins to do, and I wouldn't have any files lost since everything is stored on my D partition :)

But, it was fun having to deal with a virus for the first time in a few years.

Share this post


Link to post
Share on other sites

Yeah. My dad should have fixed this himself just to teach him a lesson.

IE8 user, uses random crappy AV and other software, has a TON of files (all of which are located on C: ) .. and hasn't done a Windows update in over a year.

If it were me, I would have formatted C and reinstalled everything. It would have only taken 45mins to do, and I wouldn't have any files lost since everything is stored on my D partition :)

But, it was fun having to deal with a virus for the first time in a few years.

why didn't you just LiveCD and pull all his data off, then nuke it?

Share this post


Link to post
Share on other sites

Hello,

Were you able to determine what exact type of ransomware was on the computer?

Regards,

Aryeh Goretsky

Share this post


Link to post
Share on other sites

So pay up!!

Just kidding. :p

Share this post


Link to post
Share on other sites

Hello,

Were you able to determine what exact type of ransomware was on the computer?

Regards,

Aryeh Goretsky

I'm betting it was something John McAfee wrote, whilst on the run in Belize

Share this post


Link to post
Share on other sites

Is it the FBI virus ?

I am not sure, I never heard of this FBI virus before. Another Scam, isn't it ?

I went into safe mode, I seemed to have cleared out the scareware. One further Attempt to restore to a previous state, resulted in a strange BSOD, that had a countdown timer.

Laptop is running again, no clue though, which SCAREWARE stuck. I bet it was a drive by injection/infection.

Share this post


Link to post
Share on other sites

just reformat, boot off linux live cd and do backups if needed. Job done.

Share this post


Link to post
Share on other sites

go in your browser and disable java plugin and acrobat. those are used to infect your machine more than you know.

Share this post


Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!


Register a new account

Sign in

Already have an account? Sign in here.


Sign In Now
Sign in to follow this  
Followers 0

  • Recently Browsing   0 members

    No registered users viewing this page.