Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Need Help Removing Green Dot Ransomware


  • This topic is locked This topic is locked
41 replies to this topic

#1 NBSChang

NBSChang

  • Members
  • 41 posts
  • OFFLINE
  •  
  • Local time:10:01 PM

Posted 15 August 2012 - 11:59 AM

Hello,
I would like to get some help removing a Ransomware infection. The symptom includes displaying the following image after logging in.
Posted Image
Furthermore, any attempts to bypass, e.g. ctrl+alt+del have been disabled. Task manager has also been disabled.
I have tried the removal procedure detailed on this page without success. Most likely due to the fact that booting to safe mode with cmd prompt only logs in to a local account and not to a domain. Any other boot modes will bring up the "locked" screen or an attempt to bring up the screen. I also noticed that the ransomware will infect other profiles.

I also attempted to start fresh and reinstall XP, but either this computer does not boot from a CD/DVD in a normal fashion or the ransomware is more pervasive than I've previously encountered. In case it is needed the computer I'm working on is a Dell Vostro 230.

Thanks in advance for any help provided.

*Moderator Edit: Moved topic from XP to the more appropriate forum. ~ Queen-Evie*

Chris

Edited by Queen-Evie, 15 August 2012 - 12:10 PM.


BC AdBot (Login to Remove)

 


#2 JSntgRvr

JSntgRvr

    Master Surgeon General


  • Malware Response Team
  • 11,765 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Puerto Rico
  • Local time:02:01 AM

Posted 15 August 2012 - 01:39 PM

Lets give it a try. You will need your XP Install CD to create a Boot CD and a flash drive.

Format the flash drive first.

Attempt to create a Boot CD as follows:

:step1:

1. Download and Run Ultimate Boot CD for Windows
  • Save it to your Desktop.
  • Double-Click on the UBCD4Win.EXE that you just downloaded to your desktop.
  • Follow all of the instructions/prompts that come up.
    NOTES:
  • Do not install to a folder with spaces in it's name.
  • Your Anti-Virus may report viruses or trojans when you extract UBCD4Win, these are "False-Positives." Read HERE for information regarding the files that normally trigger AV software.
2. Insert your XP CD with SP1/SP2/SP3 into a CD Rom drive
  • Double-Click on UBCD4WinBuilder.exe located in your C:\ubcd4win folder.
  • Click "I agree" to the Builders License.
  • Click NO to Search for Windows Installation Files
  • Make the following selections from the Main Screen that pops up:
    • Builder
    • Source:(path to Windows installation files)
    • Enter the path to the drive where your XP CD is located.
    • You can click on the "..." button on the right to navigate to the path as well.
  • Custom: (include files and folders from this directory)
    • No information is necessary, leave blank.
  • Output: (C:\ubcd4win\BartPE)
    • Keep the default BartPE
  • Media output
  • Choose Create ISO image
  • Do not choose Burn to CD/DVD


Please note: If your XP install disc is SP1 then please .....

  • Disable- DComLaunch Service
  • Enable- LargeIDE Fix

    This can be done by pressing the "Plugin" button and checking or unchecking the appropriate selections

Also note: If you have a Dell XP install disc you will need to follow the instructions here
http://www.ubcd4win.com/faq.htm#dell
[/list]
3. Click on the "Build" button
  • You will see the Windows EULA message. Click on I Agree
  • You will now see the Build Screen. Let it run it's course
  • When the Build is finished you can click close, then exit


4. Burn your ISO file to CD
  • Please see HERE on how to burn an ISO to CD.
[/list]
==========

:step2:

Next, from your clean computer:

For x32 (x86) bit systems download Farbar Recovery Scan Tool and save it to a flash drive.
For x64 bit systems download Farbar Recovery Scan Tool x64 and save it to a flash drive.


Now plug your flashdrive back into your sick computer and follow the next instructions:

==========

:step3:

1. Restart Your sick Computer Using the UBCD4Win Disc That You Have Created
  • Insert the UBCD4Win disc in to one of your CD/DVD drives.
  • Restart your computer.
    • The computer should choose to boot from the UBCD4Win CD automatically. If it doesn't and you are asked if you want to boot from CD, then choose that option.
  • In the window that pops up select Launch The Ultimate Boot CD For Windows and press Enter.
    • It may take a little longer for the Desktop to appear than it does when you start your computer normally. Just let the process run itself until the desktop appears.
  • Once the desktop appears, you will receive a message asking: Do you want to start Network support?
    • Click on Yes if you want to use the PE environment to get online post your log and reply by way of an Ethernet connection.
  • You should now have a desktop that looks like this:

    Posted Image


==========

:step4:

  • Single click My computer from your UBCD4W desktop to navigate to the Farbar Recovery Scan Tool you saved to your flash drive.
  • Double click on it to begin running the tool.
  • When the tool opens click Yes to disclaimer.
  • Press Scan button.
  • It will make a log (FRST.txt) on the flash drive. Please copy and paste it to your next reply.

Let me know if you have problems with the above instructions?

No request for help throughout private messaging will be attended.

If I have helped you, consider making a donation to help me continue the fight against Malware!
btn_donate_SM.gif


#3 NBSChang

NBSChang
  • Topic Starter

  • Members
  • 41 posts
  • OFFLINE
  •  
  • Local time:10:01 PM

Posted 15 August 2012 - 01:54 PM

Thanks for responding. I have started on the instruction list you provided.

#4 JSntgRvr

JSntgRvr

    Master Surgeon General


  • Malware Response Team
  • 11,765 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Puerto Rico
  • Local time:02:01 AM

Posted 15 August 2012 - 02:01 PM

:thumbup2:

No request for help throughout private messaging will be attended.

If I have helped you, consider making a donation to help me continue the fight against Malware!
btn_donate_SM.gif


#5 NBSChang

NBSChang
  • Topic Starter

  • Members
  • 41 posts
  • OFFLINE
  •  
  • Local time:10:01 PM

Posted 15 August 2012 - 02:01 PM

Oh an additional note. I tried using other tools similar to UBCD, but when I ask the computer to boot from CD/DVD drive, it ignores my request and boots from the HDD.

#6 JSntgRvr

JSntgRvr

    Master Surgeon General


  • Malware Response Team
  • 11,765 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Puerto Rico
  • Local time:02:01 AM

Posted 15 August 2012 - 03:47 PM

Oh an additional note. I tried using other tools similar to UBCD, but when I ask the computer to boot from CD/DVD drive, it ignores my request and boots from the HDD.

Lets try UBCD4Win this time and see.

No request for help throughout private messaging will be attended.

If I have helped you, consider making a donation to help me continue the fight against Malware!
btn_donate_SM.gif


#7 NBSChang

NBSChang
  • Topic Starter

  • Members
  • 41 posts
  • OFFLINE
  •  
  • Local time:10:01 PM

Posted 15 August 2012 - 04:16 PM

Hit a snag...I clicked "Build" but I cannot find the ISO file.

#8 JSntgRvr

JSntgRvr

    Master Surgeon General


  • Malware Response Team
  • 11,765 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Puerto Rico
  • Local time:02:01 AM

Posted 15 August 2012 - 09:48 PM

Look in the UBCD4Win folder. It should be named UBCD4WinBuilder.iso.

No request for help throughout private messaging will be attended.

If I have helped you, consider making a donation to help me continue the fight against Malware!
btn_donate_SM.gif


#9 NBSChang

NBSChang
  • Topic Starter

  • Members
  • 41 posts
  • OFFLINE
  •  
  • Local time:10:01 PM

Posted 16 August 2012 - 01:42 AM

I looked, but didn't see the ISO. I will look again.

#10 JSntgRvr

JSntgRvr

    Master Surgeon General


  • Malware Response Team
  • 11,765 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Puerto Rico
  • Local time:02:01 AM

Posted 16 August 2012 - 11:25 AM

Please download SystemLook from one of the links below and save it to your Desktop in the working computer.
Download Mirror #1
Download Mirror #2


For 64bits systems, use this link.
  • Double-click SystemLook.exe to run it.
  • Copy and Paste the content of the following quote box into the main textfield:

    :filefind
    *.iso

  • Click the Look button to start the scan.
  • When finished, a notepad window will open with the results of the scan. Please post this log in your next reply.
Note: The log can also be found on your Desktop entitled SystemLook.txt

No request for help throughout private messaging will be attended.

If I have helped you, consider making a donation to help me continue the fight against Malware!
btn_donate_SM.gif


#11 NBSChang

NBSChang
  • Topic Starter

  • Members
  • 41 posts
  • OFFLINE
  •  
  • Local time:10:01 PM

Posted 16 August 2012 - 11:39 AM

Looked in the folder you suggested as well as another folder that I specified on a second build.

#12 JSntgRvr

JSntgRvr

    Master Surgeon General


  • Malware Response Team
  • 11,765 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Puerto Rico
  • Local time:02:01 AM

Posted 16 August 2012 - 03:43 PM

Run SystemLook as requested above and post its report.

No request for help throughout private messaging will be attended.

If I have helped you, consider making a donation to help me continue the fight against Malware!
btn_donate_SM.gif


#13 NBSChang

NBSChang
  • Topic Starter

  • Members
  • 41 posts
  • OFFLINE
  •  
  • Local time:10:01 PM

Posted 16 August 2012 - 03:51 PM

Tried and no program starts. I get the question asking if I want to run the program but nothing shows up after that. Trying again.

Edited by NBSChang, 16 August 2012 - 03:57 PM.


#14 NBSChang

NBSChang
  • Topic Starter

  • Members
  • 41 posts
  • OFFLINE
  •  
  • Local time:10:01 PM

Posted 16 August 2012 - 03:58 PM

Tried a third time and still no window for SystemLook.

#15 JSntgRvr

JSntgRvr

    Master Surgeon General


  • Malware Response Team
  • 11,765 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Puerto Rico
  • Local time:02:01 AM

Posted 16 August 2012 - 04:09 PM

If you build it, it should be there. Lets try a little variation:


:step1:

1. Download and Run Ultimate Boot CD for Windows
  • Save it to your Desktop.
  • Double-Click on the UBCD4Win.EXE that you just downloaded to your desktop.
  • Follow all of the instructions/prompts that come up.
    NOTES:
  • Do not install to a folder with spaces in it's name.
  • Your Anti-Virus may report viruses or trojans when you extract UBCD4Win, these are "False-Positives." Read HERE for information regarding the files that normally trigger AV software.
2. Insert your XP CD with SP1/SP2/SP3 into a CD Rom drive
  • Double-Click on UBCD4WinBuilder.exe located in your C:\ubcd4win folder.
  • Click "I agree" to the Builders License.
  • Click NO to Search for Windows Installation Files
  • Make the following selections from the Main Screen that pops up:
    • Builder
    • Source:(path to Windows installation files)
    • Enter the path to the drive where your XP CD is located.
    • You can click on the "..." button on the right to navigate to the path as well.
  • Custom: (include files and folders from this directory)
    • No information is necessary, leave blank.
  • Output: (C:\ubcd4win\BartPE)
    • Keep the default BartPE
  • Media output
  • Choose Create ISO image
  • At this time, choose Burn to CD/DVD

Edited by JSntgRvr, 16 August 2012 - 04:09 PM.

No request for help throughout private messaging will be attended.

If I have helped you, consider making a donation to help me continue the fight against Malware!
btn_donate_SM.gif





0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users