"RansomeWare" Very Deadly MaleWare need help in the removal

Forwarding this topic to the maleware team, all other instances of this thread can be deleted



I need some serous help. This is a very old computer but my sister wants me to fix it by Sunday so she can use it for college work and business. It runs Windows XP professional.

She called me she told me that she went to try and go to firefox to go online and she says every page says "this page is blocked for security" when i told her over the phone to try and reboot the machine and go into safe mode, it stays on the login screen for all accounts and their is no way to access any of the accounts at all. When i click on the account the message "This copy of windows must be activated with Microsoft in order to continue You cannot log on untull you activate windows. Because activation cannot occur in safe mode, you must first restart the computer and login to normal mode in order to activate windows".

Here lies the problem. It says the same thing even when attempting to boot into normal mode. Taking care of the infections is an easy task for me, and doesn't have to be completely void of infections, just enough so she can access the internet, i can use tools and everything to take care of that problem, or back up-format if need be but like i said, no way to login into windows.

I then began to call Microsoft and they said the message bout activating windows displayedon screen is a fake message and also a trap, the moment you reboot into safe mode, it locks you out. They said this was an indication of a new maleware called "ransomware" they were going to charge 100 dollars to get it fixed with their tools. I actually went ahead with the charge, they told me they were not able to continue with the removal process because it locked out the command prompt and that was the only way to run their tools with out the use of an installation disk. I not have a windows XP installation disk at the time so was unable to move ahead with the removal process.

Quite simply this is a very new and deadly maleware that locks you into safe mode and you can't exit it, it also disables many of the windows commands like the command prompt. We tried to reboot safe mode with command prompt and it did the same thing, bottom line is Microsoft could not get to the bottom of it and they refunded my money. If at all possible i need to be able to get logged back in to her account so i can begin removal of this maleware by Sunday, she has alot of work she has to do and she kind of just sprung this up on me at the last moment. I told her she can use another pc but in the mean time i need to start working on trying to fix this machine. I have called HP and avast for their total care support and went through with the charge cause i am very desperate in trying to fix this machine, both of them came to the conclusion that the only way is to take out my HD put it into a clean computer with a IDE port, back up the data safely, reformat the hard drive. If it all possible i would like to fix this with out having to do a reformat. So this is going to be a challenge, see if your tech support is better then what HP, avast was able to do. I have alot of confidence in this forum though and your skills so hopefully you can fix this issue with out having to resort to a formatting.

I do have a windows 7 disk, but this machine is very old and probably not capable of handling it. But as a last resort alternative that may be my only option is to install windows 7 on another back up drive so she can access her work, other wise windows its just completely locked out because of the maleware.


EDIT: So i finally got my hands on the windows install disk so i am ready to work on this pc now. After a bit of research this is a really lethal infection that has challenged quite a few tech experts in trying to fully remove this from the system, because it has a root kit its hard to remove with out professional technical assistance and it also has an executable file that runs the moment you are locked into safe mode that can cause further damage to your data-files so i am definitely staying off of the pc for the time being until some one can help me with this. I have already tried running the windows XP repair, it deleted the original OS and replaced it, but in order for windows set up to begin its process it has to be out of safe mode, thus again it reboots after repair is completed and locks me into safe mode with a message on the screen "You cannot start windows set up in safe mode". The only other option is to do a clean install and partition, but i do NOT want to reformat the drive and loose all of her data, some how i have to find a way to back up her files on the machine. As of right now since i did a repair install, XP does not exist though the data on the drive is still intact. This is going to be a fun one to figure out

If you correctly did a repair install of XP, the OS is on the HD.

http://michaelstevenstech.com/XPrepairinstall.htm
How to Perform a Windows XP Repair Install
http://www.microsoft.com/windowsxp/using/h…ips/doug92.mspx

I have done a correct repair install, after the reboot, it attempts to intall windows, but the problem is the computer is locked into safe mode since i used the MS config utility, their for i am unable to install windows on the disk. The set up screen simply says "preparing for set up…. and then reboots and says windows cannot install in safe mode.

Normally you can boot windows through a normal start up, but the maleware is preventing that. Now i have made matters worse by doing a repair install cause it didn't complete successfully. Their for i have no OS on the system.

This has been a real pain to figure out and i guess the maleware team on here is kind of stumped to. Thanks for replying though. I would really like to remove this maleware at all costs with out having to resort to a reformat, because even though i can back up data if i switch the primary to a slave, i still won't be able to recover my sisters browser history, book marks, etc. On top of that i will have to install windows and all of the old drivers again, but it seems like at this point its really all i can do.

At this point is where it does not complete successfully After it rebooots, set up does not do a clean install, because its in safe mode and it just simply reboots again.
.
Step 6 Setup will copy the necessary files to the hard drive and reboot. Do not press any key to boot from CD when the message appears. Setup will continue as if it were doing a clean install, but your applications and settings will remain intact.

I think the only option you have is to take the hard drive out and put it in another pc as a secondary. Get what you need from it that way.

I think the only option you have is to take the hard drive out and put it in another pc as a secondary.
Get what you need from it that way.

Yeah thats what i figured, Microsoft claims they have the ability to remove it with their tools, but its like a 150 dollar charge. Is their any you know more advanced male ware experts that might possibly know a work around? This is really the first time i have created a topic on here that has actually not be able to solve my issue, every time i have had maleware, 100% of the time i get my pc fixed, i guess this one is just a very complicated issue. Their is no other alternative way to take it out of safe mode? If i can do that, i can install windows properly, and then i can work on removing the maleware.

Well i bought this and hopefully this works because i do not have any compatible motherboards with IDE sockets.

http://www.amazon.com/gp/product/B00CPGYNV…=UTF8&psc=1

If you weren't working with a XP box, there are tools that will boot from a USB device.



Non-booting XP pc's
http://forums.malwarebytes.org/index.php?showtopic=112848
Kaspersky Rescue Disk 10 is designed to scan and disinfect x86 and x64-compatible computers that have been infected. The application should be used when the infection is at such level that it is impossible to disinfect the computer using anti-virus applications or malware removal utilities (such as Kaspersky Virus Removal Tool) running under the operating system. In this case, disinfection is more efficient because malware programs do not gain control when the operating system is being loaded.

If you weren't working with a XP box, there are tools that will boot from a USB device.



Non-booting XP pc's
http://forums.malwarebytes.org/index.php?showtopic=112848
Kaspersky Rescue Disk 10 is designed to scan and disinfect x86 and x64-compatible computers that have been infected. The application should be used when the infection is at such level that it is impossible to disinfect the computer using anti-virus applications or malware removal utilities (such as Kaspersky Virus Removal Tool) running under the operating system. In this case, disinfection is more efficient because malware programs do not gain control when the operating system is being loaded.

That sounds exactly what i need, but that method will not work because i have windows XP OS?

Does it carry any risk of damaging the data like alot of third party databack up software does

Sorry I have never used it myself. The only safe way is to put it another pc.

What bout this?

http://technet.microsoft.com/en-us/magazine/jj649351.aspx

If you follow the directions and create that CD as instructed, you can boot from the CD You should have the option, maybe F12, for boot options.

What bout this?

http://technet.microsoft.com/en-us/magazine/jj649351.aspx

I have never used it so I don't know but I know what I gave you works.

What bout this?

http://technet.microsoft.com/en-us/magazine/jj649351.aspx

I have never used it so I don't know but I know what I gave you works.

I will try them both and see if it can recover windows in any way, if i am able to boot to set up windows, then i can proceed with using normal maleware tools in heping to remove this maleware, hopefully it works, we will see. I am creating a bootable disk right now for Kasp Rescue 10.

Ok so i got Kasp rescue disk 10 to work, the other one did not work. So what are the procedures to running this software? I got run with text mode, run with graphic mode. Then in the main menu it says scan all objects, scan all boot sectors, scan C, scan startup objects, rollback to the previous databases, Their is quite a few options on here, how do i go bout maleware disinfection? I want to make sure i am doing the right thing, i don't want to select the wrong option and end up deleting the HD so ill wait for your response before i continue.