A warning, ransomware varient on the loose...

Discussion in 'Serious Discussion' started by QuantumBug, Jul 14, 2012.

  1. QuantumBug

    QuantumBug MDL Developer

    Mar 7, 2012
    1,485
    1,322
    60
    #1 QuantumBug, Jul 14, 2012
    Last edited: Jul 14, 2012
    New ransomware varient on the loose,

    Says your PC has been blocked by the metropolitan police and demands GBP(£) usually £75-£100, is different in some cases, usually depending on your country and language.

    Information(s) here

    For the varient affecting UK residents, look here for more elaborate information and removal.

    I removed this from a customers machine simply, not sure if it will be so easy if you've been infected.

    1. Start up in safe mode (no networking or cmd)
    2. Start MSCONFIG and head to the 'Startup' tab.
    3. Search for the infected startup item, in my case 'fest0r_ot.exe', and UNCHECK IT, then hit ok. (You can also view the Registry key in msconfig, which you can manually delete, look under 'Location')
    4. Restart your machine normally
    5. Download and install any reputable antimalware scanner, I use malwarebytes anti-malware from here.
    6. Run a FULL system scan including any drives that were attatched around the time of infection
    7. Once the scan is complete remove all infections and restart your PC.


    Optional: Download and run a rootkit scanner just in case of hidden infection, I used TDSSKiller.

    Under NO CIRCUMSTANCES pay the money it demands, it will not let you back into your PC.

    Thanks, Dave.
     
  2. nodnar

    nodnar MDL Addicted

    Oct 15, 2011
    973
    664
    30
    on the preventive side, dave,
    if you run winpatrol http://www.winpatrol.com/
    those thingies do not have a snowball`s chance in hell
    to get into startup in the first place..
    ;)
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
  3. QuantumBug

    QuantumBug MDL Developer

    Mar 7, 2012
    1,485
    1,322
    60
    Never been infected myself, nod. My Computer is more secure than a hybrid vault. I study viruses all the time and have a massive collection to review :)

    Good post for people to view though, thanks :D
     
  4. SOCRATE_MMXII

    SOCRATE_MMXII MDL Expert

    Jan 25, 2012
    1,034
    315
    60
    :haha::haha::haha:

    That was a good one. Scamers desperate of making some money. :haha:
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
  5. roirraW "edor" ehT

    roirraW "edor" ehT MDL Addicted

    Sep 1, 2007
    616
    215
    30
    Someone quick wire me a million bucks or I'm going to shoot myself! *BANG* :D
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
  6. QuantumBug

    QuantumBug MDL Developer

    Mar 7, 2012
    1,485
    1,322
    60
    Paha, was desperate. You've been looking at p*rn and zoophilia please give money to the Police. Probably is the Police accepting bribes =/
     
  7. Michaela Joy

    Michaela Joy MDL Crazy Lady

    Jul 26, 2012
    3,648
    3,950
    120
    250px-Natlamp73.jpg

    I remember seeing this magazine on a newsstand.

    Sometimes, I feel -real- old.:eek:
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
  8. nodnar

    nodnar MDL Addicted

    Oct 15, 2011
    973
    664
    30
    just hope you did not buy it..;)
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
  9. QuantumBug

    QuantumBug MDL Developer

    Mar 7, 2012
    1,485
    1,322
    60
    Quick buy it before the dog gets merked :D
     
  10. Michaela Joy

    Michaela Joy MDL Crazy Lady

    Jul 26, 2012
    3,648
    3,950
    120
    Where I grew up (Brooklyn, New York), we would go to the neighborhood lunchonette and buy an egg cream (my favorite was chocolate). We would then pick a magazine and read it. This was one of my favorite magazines, along with Analog and Fantasy and Sci Fi. Popular Electronics and Radio & Electronics were two more favorites for me.

    I remember the owner (Sid) saying "If you get chocolate on the pages, you're buyin' it!"

    Those were great times. It seemed like anything was possible. :)
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
  11. bcjoji

    bcjoji MDL Novice

    Mar 5, 2010
    1
    0
    0
    That doesnt work now...

    Tried safe mode, safe-mode with networking and safe mode with command prompt and before it can display my desktop, warning pop up screens up again....
     
  12. @962fm@

    @962fm@ MDL Novice

    Mar 5, 2011
    1
    0
    0