Welcome Guest (Log In | Create Account)
New Member? Join for free.

Remove the Complete an Offer infection (Uninstall Guide)

By on December 14, 2012 @ 05:06 PM | Read 15,364 times.
  • Print this page

The Unlock this Page to Continue! or the Complete an Offer infection is a screen locker that locks you out of your computer until you complete an offer or survey. Unlike most ransomware and screen lockers, this infection does not require you to send ransom money in order to get control of your computer again. Instead this infection requires you to select various surveys or promotions and fill them out before it will unlock your computer. It does this because the malware developer will receive a commission for each survey or offer you complete.

 

Complete an Offer to Continue Screen Locker
Complete an Offer to Continue Screen Locker
For more screen shots of this infection click on the image above.
There are a total of 2 images you can view.

 

When you are infected with the Unlock this Page to Continue infection, you will be locked out of your Windows desktop when you login to Windows. If in Windows 8, you will still have access to your Windows Start Screen, but the classic desktop will be locked. Instead of the desktop, you will be shown a screen that contains the following message:

Unlock this Page to Continue!
This page will immediately unlock and restore normal access upon your participation in an offer below. Please use valid information!
Your desktop was locked. Complete an offer below to unlock your desktop.
Complete an offer to continue.

Some of the offers and surveys that you may see include:

  • Shop & Save with this free Toolbar download!
  • Breakfast on Us with a Dunkin' Donuts Gift Card!
  • FREE pair of Studio Beats by Dr. Dre!
  • Take a back to school shopping spree!
  • Get FREE McDonald's!
  • Take this survey & get a Visa gift card!
  • Win a voucher for drinks at Starbucks!

Please note that these brands and surveys are not affiliated with the malware infection or the developer. Instead they are unknowingly being used by this infection. If the offers that are being shown are not ones that you are interested in, the Complete an Offer infection is "kind" enough to let you reload the choices in order to get different ones. When you click on one of these offers, your default web browser will then open and you will be required to fill out the survey or sign up for a promotion. Supposedly the screen locker will be able to detect when you have properly completed the task and then unlock your computer. In our tests, the screen locker never detected our sign ups and did not unlock our screen.

Thankfully, we still have access to the Windows Safe Mode, which we will use to remove this infection. As this is a scam and a computer infection, please do not fill out any surveys, promotions, or provide your real information. To remove the Complete an Offer screen locker, please use the instructions below.

 

Threat Classification:

 

Advanced information:

View Complete an Offer files.
View Complete an Offer Registry Information.

 

Tools Needed for this fix:

 

Symptoms that may be in a HijackThis Log:

O4 - HKCU\..\Run: [Project1] %Temp%\<random>.exe

 

Guide Updates:

12/14/12 - Initial guide creation.

 


Automated Removal Instructions for Complete an Offer using Emsisoft Anti-Malware:

 

  1. Print out these instructions as we will need to reboot your computer into Safe mode with Networking and you may not have access to your web browser for part of this process.

  2. This infection makes it difficult to access your documents and programs because it locks the screen. In order to bypass this locker, we need to reboot into Safe Mode with Networking. To do this, perform the following steps for your version of Windows:

    Windows 8: Please follow the steps in this guide to restart your computer in Windows 8 Safe Mode.

    Windows XP, Vista, and 7: Turn your computer off and then back on and when you see anything on the screen, immediately start tapping the F8 key on your keyboard. Eventually you will be brought to a menu similar to the one below:


    MalwareBytes Anti-Malware Screen

    Using the arrow keys on your keyboard, select Safe Mode with Networking and press Enter on your keyboard. If you are having trouble entering safe mode, then please use the following tutorial:

    How to start Windows in Safe Mode


    Windows will now boot into safe mode with networking and prompt you to login as a user.

  3. When you are prompted to login, please login as the user that is infected with Complete an Offer.

  4. Before we can do anything we must first end the processes that belong to Complete an Offer and other infections so that they does not interfere with the cleaning procedure. To do this please download RKill to your desktop from the following link.

    RKill Download Link - (Download page will open in a new tab or browser window.)

    When at the download page, click on the Download Now button labeled iExplore.exe download link. When you are prompted where to save it, please save it on your desktop.

  5. Once it is downloaded, double-click on the iExplore.exe icon in order to automatically attempt to stop any processes associated with Complete an Offer and other Rogue programs. Please be patient while the program looks for various malware programs and ends them. When it has finished, the black window will automatically close and you can continue with the next step. If you get a message that RKill is an infection, do not be concerned. This message is just a fake warning given by Complete an Offer when it terminates programs that may potentially remove it. If you run into these infections warnings that close RKill, a trick is to leave the warning on the screen and then run RKill again. By not closing the warning, this typically will allow you to bypass the malware trying to protect itself so that RKill can terminate Complete an Offer . So, please try running RKill until the malware is no longer running. You will then be able to proceed with the rest of the guide. Do not reboot your computer after running RKill as the malware programs will start again.

    If you continue having problems running RKill, you can download the other renamed versions of RKill from the RKill download page. Both of these files are renamed copies of RKill, which you can try instead. Please note that the download page will open in a new browser window or tab.



  6. Now download and save the Emsisoft Anti-Malware setup program to your desktop from the link below:

    http://www.bleepingcomputer.com/download/emsisoft-antimalware/

    The download is fairly large, so please be patient while it downloads.

  7. Once the file has been downloaded, double-click on the EmsisoftAntiMalwareSetup.exe icon to start the program. If Windows Smart Screen issues an alert, please allow it to run anyway.

    If the setup program displays an alert about safe mode, please click on the Yes button to continue. You should now see a dialog asking you to agree to a license agreement. Please access the agreement and click on the Install button to continue with the installation.

  8. You will eventually get to a screen asking what type of license you wish to use with Emsisoft Anti-Malware.


    Select License Screen

    If you have an existing license key or want to buy a new license key, please select the appropriate option. Otherwise, select the Freeware or Test for 30 days, free option. If you receive an alert after clicking this button that your trial has expired, just click on the Yes button to enter freeware mode, which still allows the cleaning of infections.

  9. You will now be at a screen asking if you wish to join Emsisoft's Anti-Malware network. Read the descriptions and select your choice to continue.

  10. Emsisoft Anti-Malware will now begin to update it's virus detections.


    Downloading Updates

    Please be patient as it may take a few minutes for the updates to finish downloading.

  11. When the updates are completed, you will be at a screen asking if you wish to enable PUPs detection. We strongly suggest that you select Enable PUPs Detection to protect your computer from nuisance programs such as toolbars and adware.

  12. You will now be at a screen asking what type of scan you would like to perform.



    Scan selection screen

    Please select the Full Scan option to begin scanning your computer for infections. The Full Scan option will take the longest time to scan your computer, but will also be the most thorough. As you are here to clean infections, it is worth the wait to make sure your computer is properly scanned.

  13. Emsisoft Anti-Malware will now start to scan your computer for rootkits and malware. Please note that the detected infections in the image below may be different than what this guide is for.



    Scanning screen

    Please be patient while Emsisoft Anti-Malware scans your computer.

  14. When the scan has finished, the program will display the scan results that shows what infections where found. Please note, due to an updated version of Emsisoft Anti-Malware, the screenshot below may look different than the rest of the guide.



    Scan Results


    Now click on the Quarantine Selected button, which will remove the infections and place them in the program's quarantine. You will now be at the last screen of the Emsisoft Anti-Malware setup program, which you can close. If Emsisoft prompts you to reboot your computer to finish the clean up process, please allow it to do so.

  15. Please reboot your computer into the normal Windows mode and when you are back at your normal Windows desktop or Windows Start Screen please continue with the next step.

  16. As this infection is known to be installed by vulnerabilities in out-dated and insecure programs, it is strongly suggested that you use Secunia PSI to scan for vulnerable programs on your computer. A tutorial on how to use Secunia PSI to scan for vulnerable programs can be found here:

    How to detect vulnerable and out-dated programs using Secunia Personal Software Inspector

Your computer should now be free of the Unlock this Page to Continue! infection. If your current anti-virus solution let this infection through, you may want to consider purchasing the full version of Emsisoft Anti-malware to protect your computer against these types of threats in the future.

If you are still having problems with your computer after completing these instructions, then please follow the steps outlined in the topic linked below:

Preparation Guide For Use Before Using Malware Removal Tools and Requesting Help

 


 

Associated Complete an Offer Files:

%Temp%\<random>.exe
%UserProfile%\AppData\Roaming\Microsoft\Windows\Cookies\<loginname>@www.unlockyourdesktop[1].txt

File Location Notes:

%UserProfile% refers to the current user's profile folder. By default, this is C:\Documents and Settings\<Current User> for Windows 2000/XP, C:\Users\<Current User> for Windows Vista/7/8, and c:\winnt\profiles\<Current User> for Windows NT.

%Temp% refers to the Windows Temp folder. By default, this is C:\Windows\Temp for Windows 95/98/ME, C:\DOCUMENTS AND SETTINGS\<Current User>\LOCAL SETTINGS\Temp for Windows 2000/XP, and C:\Users\<Current User>\AppData\Local\Temp in Windows Vista, Windows 7, and Windows 8.

 

Associated Complete an Offer Windows Registry Information:

HKCU\Software\Microsoft\Windows\CurrentVersion\Run\Project1 " %Temp%\<random>.exe"

 


 

This is a self-help guide. Use at your own risk.

BleepingComputer.com can not be held responsible for problems that may occur by using this information. If you would like help with any of these fixes, you can ask for malware removal assistance in our Virus, Trojan, Spyware, and Malware Removal Logs forum.

If you have any questions about this self-help guide then please post those questions in our Am I infected? What do I do? and someone will help you.


Advertise   |   About Us   |   User Agreement   |   Privacy Policy   |   Contact Us   |   Sitemap   |   Chat   |   Tutorials   |   Uninstall List
Tech Support Forums   |   The Computer Glossary   |   RSS Feeds   |   Startups   |   The File Database   |   Virus Removal Guides   |   Downloads


© 2003-2014 All Rights Reserved Bleeping Computer LLC.
Site Changelog