Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Police Ransomware


  • Please log in to reply
15 replies to this topic

#1 UncleBucketts

UncleBucketts

  • Members
  • 6 posts
  • OFFLINE
  •  
  • Local time:04:07 AM

Posted 25 September 2012 - 10:03 PM

Please Help!

I have been all over the internet and these forums to find a solution to my problem.

I have the POLICE virus. My files are all locked and their file extensions have been changed to .police

For example XXXX.mp3.police

I have followed instructions and I believe I have removed the virus, however I cannot find a way to change the files back so they are unlocked.

I have tried using Kaspersky to decrypt my files - it can not decrypt because "it may be an unknown trojan modification"

HELP!

Edit: Moved topic from Windows 7 to the more appropriate forum. ~ Animal

BC AdBot (Login to Remove)

 


#2 boopme

boopme

    To Insanity and Beyond


  • Global Moderator
  • 73,166 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:NJ USA
  • Local time:05:07 AM

Posted 25 September 2012 - 10:24 PM

Welcome UncleBucketts

This infection family will also hide all the files on your computer from being seen. To make your files visible again, please download the following program to your desktop:

Unhide.exe

Once the program has been downloaded, double-click on the Unhide.exe icon on your desktop and allow the program to run. This program will remove the +H, or hidden, attribute from all the files on your hard drives. If there are any files that were purposely hidden by you, you will need to hide them again after this tool is run.
How do I get help? Who is helping me?For the time will come when men will not put up with sound doctrine. Instead, to suit their own desires, they will gather around them a great number of teachers to say what their itching ears want to hear....Become a BleepingComputer fan: Facebook

#3 UncleBucketts

UncleBucketts
  • Topic Starter

  • Members
  • 6 posts
  • OFFLINE
  •  
  • Local time:04:07 AM

Posted 29 September 2012 - 09:30 AM

Boopme

I tried that earlier. But will try it again tonight

Thanks. I will keep you posted

#4 UncleBucketts

UncleBucketts
  • Topic Starter

  • Members
  • 6 posts
  • OFFLINE
  •  
  • Local time:04:07 AM

Posted 01 October 2012 - 05:56 PM

just tried the unhide.exe and nothing changed, I don't see any additional files... argh!

Anyone tried te94decrypt.exe to see if this would work for me?

Any other ideas?

Please help a new user!

#5 JON99

JON99

  • Members
  • 4 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:UK
  • Local time:10:07 AM

Posted 01 October 2012 - 06:07 PM

I sent you a message re using te94decrypt.exe did you receive it ?

#6 boopme

boopme

    To Insanity and Beyond


  • Global Moderator
  • 73,166 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:NJ USA
  • Local time:05:07 AM

Posted 01 October 2012 - 06:15 PM

Please post ALL fixes in the topic. This is a public forum and help is for ALL readers.

Also we can not assure the safety and accuracy of hidden replies.

Thanks for understanding.
How do I get help? Who is helping me?For the time will come when men will not put up with sound doctrine. Instead, to suit their own desires, they will gather around them a great number of teachers to say what their itching ears want to hear....Become a BleepingComputer fan: Facebook

#7 JON99

JON99

  • Members
  • 4 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:UK
  • Local time:10:07 AM

Posted 01 October 2012 - 06:18 PM

hi i had same problem but have sorted it.

i went to :

drweb site and saved the download file te94decrypt.exe into my c:/ directory.

then i clicked start , run and put in the box :

c:\te94decrypt.exe k 186

and ran the file.

it decrypted my .police files and created a new copy alongside them that opened fine.

wasnt sure if it was ok to post this up , hope it is of use to people.

Edited by JON99, 01 October 2012 - 06:19 PM.


#8 UncleBucketts

UncleBucketts
  • Topic Starter

  • Members
  • 6 posts
  • OFFLINE
  •  
  • Local time:04:07 AM

Posted 01 October 2012 - 07:00 PM

I googled te94decrypt.exe and its coming up as a virus!!! I thought this was a safe environment!

#9 thisisu

thisisu

  • Malware Response Team
  • 2,525 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:USA
  • Local time:04:07 AM

Posted 01 October 2012 - 07:12 PM

I thought this was a safe environment!

It is.

te94decrypt.exe is a decrypting tool by Dr.Web, a legitimate Antivirus company.

#10 boopme

boopme

    To Insanity and Beyond


  • Global Moderator
  • 73,166 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:NJ USA
  • Local time:05:07 AM

Posted 01 October 2012 - 09:58 PM

@ JON99
Thanks for posting it.


@ thisisu
Thanks for clearing that up.
How do I get help? Who is helping me?For the time will come when men will not put up with sound doctrine. Instead, to suit their own desires, they will gather around them a great number of teachers to say what their itching ears want to hear....Become a BleepingComputer fan: Facebook

#11 narenxp

narenxp

  • BC Advisor
  • 16,371 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:India
  • Local time:04:07 AM

Posted 02 October 2012 - 12:40 AM

JON99

How did you know that you had to use 186 switch to decrypt .POLICE extension?

Did Dr web technical support help you on this fix?

I guess you saw this post

http://www.forospyware.com/t440234.html

Edited by narenxp, 02 October 2012 - 12:49 AM.


#12 JON99

JON99

  • Members
  • 4 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:UK
  • Local time:10:07 AM

Posted 02 October 2012 - 03:00 AM

Yes i think thats where i found it.

im trying to post the solution wherever i can so as many people with this problem can get their data back.

#13 RandomPersonAcct

RandomPersonAcct

  • Members
  • 1 posts
  • OFFLINE
  •  
  • Local time:04:07 AM

Posted 02 October 2012 - 08:13 AM

Just wanted to say thanks this solution worked. I found this post through google and it was the only one that mentioned .Police files.

I had to use -k 85 instead of 186 but my files are now decrypted.

#14 UncleBucketts

UncleBucketts
  • Topic Starter

  • Members
  • 6 posts
  • OFFLINE
  •  
  • Local time:04:07 AM

Posted 02 October 2012 - 06:11 PM

I googled it, it says it could be a virus.. that scared me... you guys think its ok?

#15 boopme

boopme

    To Insanity and Beyond


  • Global Moderator
  • 73,166 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:NJ USA
  • Local time:05:07 AM

Posted 02 October 2012 - 07:12 PM

As long as you use the file from here it is safe.

te94decrypt.exe
How do I get help? Who is helping me?For the time will come when men will not put up with sound doctrine. Instead, to suit their own desires, they will gather around them a great number of teachers to say what their itching ears want to hear....Become a BleepingComputer fan: Facebook




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users