Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

FBI Ransom Virus, Can't Start in Safe Mode


  • This topic is locked This topic is locked
60 replies to this topic

#1 eelars

eelars

  • Members
  • 53 posts
  • OFFLINE
  •  
  • Local time:08:11 PM

Posted 08 February 2013 - 10:31 AM

Sorry - I meant to post this thread here, but put it in a different place to start:

 

 

I have a version of the FBI ransomware virus; OS is Windows XP. I tried to remove it with Hitman Pro on a USB drive. I was able to get the USB to boot and run Hitman Pro, but it did not remove the virus. (And I think that the USB from Hitman is no longer able to boot.) 

 

I was going to try other techniques that involved starting in Safe Mode (various versions--with networking, with command prompt), but when I attempt to start in safe mode, the computer simply comes back to the various options for starting up (Safe Mode, w/ Networking, Command prompt, Last successful, normally). Only the latter two work and they bring up the ransomware.

 

In the self-help guides, it appears that the options all involve either getting to safe mode or running something from the desktop, neither of which appears to be an option currently.

 

I look forward to your assistance.

 


BC AdBot (Login to Remove)

 


#2 gringo_pr

gringo_pr

    Bleepin Gringo


  • Malware Response Team
  • 136,773 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Puerto rico
  • Local time:10:11 PM

Posted 08 February 2013 - 11:46 AM


Let's try to boot your computer using the Ultimate Boot CD for Windows (UBCD4win).

Please print this guide for future reference!

You will need a blank CD, a clean computer and a flash drive.

Please follow the steps below and let me know if you were successful. If you were unable to create the UBCD4win, please tell me what error messages you got and/or what steps you got hung up on.

step1.gif

1. Download and Run Ultimate Boot CD for Windows
  • Save it to your Desktop.
  • Double-Click on the UBCD4Win.EXE that you just downloaded to your desktop.
  • Follow all of the instructions/prompts that come up.
    NOTES:
    • Do not install to a folder with spaces in it's name.
    • Your Anti-Virus may report viruses or trojans when you extract UBCD4Win, these are "False-Positives." Read HERE for information regarding the files that normally trigger AV software.
  • 2. Insert your XP CD with SP1/SP2/SP3 into a CD Rom drive
    • Double-Click on UBCD4WinBuilder.exe located in your C:\ubcd4win folder.
    • Click "I agree" to the Builders License.
    • Click NO to Search for Windows Installation Files
    • Make the following selections from the Main Screen that pops up:
      • Builder
        • Source:(path to Windows installation files)
          • Enter the path to the drive where your XP CD is located.
          • You can click on the "..." button on the right to navigate to the path as well.
        • Custom: (include files and folders from this directory)
          • No information is necessary, leave blank.
        • Output: (C:\ubcd4win\BartPE)
          • Keep the default BartPE
      • Media output
        • Choose Create ISO image
        • Do not choose Burn to CD/DVD

        Please note: If your XP install disc is SP1 then please .....
        • Disable- DComLaunch Service
        • Enable- LargeIDE Fix

          This can be done by pressing the "Plugin" button and checking or unchecking the appropriate selections
        Also note: If you have a Dell XP install disc you will need to follow the instructions here
        http://www.ubcd4win.com/faq.htm#dell
      3. Click on the "Build" button
      • You will see the Windows EULA message. Click on I Agree
      • You will now see the Build Screen. Let it run it's course
      • When the Build is finished you can click close, then exit
      4. Burn your ISO file to CD
      • Please see HERE on how to burn an ISO to CD.
    ==========

    step2.gif

    Next, from your clean computer:

    Download Farbar Recovery Scan Tool
    and save it to your flash drive.

    Now plug your flashdrive back into your sick computer and follow the next instructions:

    ==========

    step3.gif

    1. Restart Your sick Computer Using the UBCD4Win Disc That You Have Created
    • Insert the UBCD4Win disc in to one of your CD/DVD drives.
    • Restart your computer.
      • The computer should choose to boot from the UBCD4Win CD automatically. If it doesn't and you are asked if you want to boot from CD, then choose that option.
    • In the window that pops up select Launch The Ultimate Boot CD For Windows and press Enter.
      • It may take a little longer for the Desktop to appear than it does when you start your computer normally. Just let the process run itself until the desktop appears.
    • Once the desktop appears, you will receive a message asking: Do you want to start Network support?
      • Click on Yes if you want to use the PE environment to get online post your log and reply by way of an Ethernet connection.
    • You should now have a desktop that looks like this:

      Main.jpg

    ==========

    step4.gif
    • Single click My computer from your UBCD4W desktop to navigate to the Farbar Recovery Scan Tool you saved to your flash drive.
    • Double click on it to begin running the tool.
    • When the tool opens click Yes to disclaimer.
    • Press Scan button.
    • It will make a log (FRST.txt) on the flash drive. Please copy and paste it to your next reply.

I Close My Topics If You Have Not Replied In 5 Days If You Will Be Longer Please Let Me Know

If I Have Not Replied To One Of My Topics In 48 Hrs Please Bump The Topic



My help is free, however, if you wish to make a small donation to show your appreciation or to help me continue the fight against Malware, then click here -->btn_donate_SM.gif<-- Don't worry every little bit helps.

Proud Graduate Of Malware Removal University

#3 eelars

eelars
  • Topic Starter

  • Members
  • 53 posts
  • OFFLINE
  •  
  • Local time:08:11 PM

Posted 08 February 2013 - 12:03 PM

Just to be clear: For step 1, am I creating the UBCD4win on a clean computer? 



#4 gringo_pr

gringo_pr

    Bleepin Gringo


  • Malware Response Team
  • 136,773 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Puerto rico
  • Local time:10:11 PM

Posted 08 February 2013 - 12:16 PM

yes that is correct
I Close My Topics If You Have Not Replied In 5 Days If You Will Be Longer Please Let Me Know

If I Have Not Replied To One Of My Topics In 48 Hrs Please Bump The Topic



My help is free, however, if you wish to make a small donation to show your appreciation or to help me continue the fight against Malware, then click here -->btn_donate_SM.gif<-- Don't worry every little bit helps.

Proud Graduate Of Malware Removal University

#5 eelars

eelars
  • Topic Starter

  • Members
  • 53 posts
  • OFFLINE
  •  
  • Local time:08:11 PM

Posted 08 February 2013 - 12:46 PM

I'm having a problem with creating the CD. When I get to here:

 

Make the following selections from the Main Screen that pops up:

  • Builder
    • Source:(path to Windows installation files)
      • Enter the path to the drive where your XP CD is located.
      • You can click on the "..." button on the right to navigate to the path as well.

I select E (for the CD drive) and get:

Invalid source path

Can not find file E:\i386\setupdlr.bin



#6 eelars

eelars
  • Topic Starter

  • Members
  • 53 posts
  • OFFLINE
  •  
  • Local time:08:11 PM

Posted 08 February 2013 - 12:50 PM

Finding another install disk to start the process - will let you know later how it goes. For now, please ignore previous message.



#7 gringo_pr

gringo_pr

    Bleepin Gringo


  • Malware Response Team
  • 136,773 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Puerto rico
  • Local time:10:11 PM

Posted 08 February 2013 - 01:05 PM

Ok let me know how it goes - I will be offline till later tonight if you have to many problems just let me know and wait for me till I come back
I Close My Topics If You Have Not Replied In 5 Days If You Will Be Longer Please Let Me Know

If I Have Not Replied To One Of My Topics In 48 Hrs Please Bump The Topic



My help is free, however, if you wish to make a small donation to show your appreciation or to help me continue the fight against Malware, then click here -->btn_donate_SM.gif<-- Don't worry every little bit helps.

Proud Graduate Of Malware Removal University

#8 eelars

eelars
  • Topic Starter

  • Members
  • 53 posts
  • OFFLINE
  •  
  • Local time:08:11 PM

Posted 08 February 2013 - 03:07 PM

It still did not work. I tried also on another computer, but it needed admin level to run it.

 

I do have a USB that I have with xPUD(?) from when SweeTech helped me 1.5 years ago.



#9 travists

travists

  • Members
  • 11 posts
  • OFFLINE
  •  
  • Local time:07:11 PM

Posted 08 February 2013 - 03:46 PM

I've had luck using Windows Defender Offline, XP is 32bit (generaly) see FBI virus quite a bit.



#10 eelars

eelars
  • Topic Starter

  • Members
  • 53 posts
  • OFFLINE
  •  
  • Local time:08:11 PM

Posted 09 February 2013 - 12:48 AM

I had a friend who is a bit more tech savvy get a UBCD image onto a CD for me. I will need until Monday afternoon/evening to take the rest of the next steps--I'm away from the computer this weekend, unfortunately. Will update when I have completed the next steps or if I encounter any difficulties. 

 

Thanks for your help!



#11 gringo_pr

gringo_pr

    Bleepin Gringo


  • Malware Response Team
  • 136,773 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Puerto rico
  • Local time:10:11 PM

Posted 09 February 2013 - 07:20 AM

Hello


I got in a little later than planed sorry


if you cannot get it working we can try this as you said you did have XPUD so lets try it


Try this please. You will need a USB drive.

Download http://unetbootin.sourceforge.net/unetbootin-xpud-windows-latest.exe & http://noahdfear.net/downloads/bootable/xPUD/xpud-0.9.2.iso to the desktop of your clean computer
  • Insert your USB drive
  • Press Start > My Computer > right click your USB drive > choose Format > Quick format
  • Double click the unetbootin-xpud-windows-387.exe that you just downloaded
  • Press Run then OK
  • Select the DiskImage option then click the browse button located on the right side of the textbox field.
  • Browse to and select the xpud-0.9.2.iso file you downloaded
  • Verify the correct drive letter is selected for your USB device then click OK
  • It will install a little bootable OS on your USB device
  • Once the files have been written to the device you will be prompted to reboot ~ do not reboot and instead just Exit the UNetbootin interface
  • After it has completed do not choose to reboot the clean computer simply close the installer
  • Next download http://noahdfear.net/downloads/driver.sh to your USB
  • Remove the USB and insert it in the sick computer
  • Boot the Sick computer
  • Press F12 and choose to boot from the USB
  • Follow the prompts
  • A Welcome to xPUD screen will appear
  • Press File
  • Expand mnt
  • sda1,2...usually corresponds to your HDD
  • sdb1 is likely your USB
  • Click on the folder that represents your USB drive (sdb1 ?)
  • Confirm that you see driver.sh that you downloaded there
  • Press Tool at the top
  • Choose Open Terminal
  • Type bash driver.sh
  • Press Enter
  • After it has finished a report will be located on your USB drive named report.txt
  • Remove the USB drive and insert back in your working computer and navigate to report.txt

    Please note - all text entries are case sensitive
  • Copy and paste the report.txt for my review

I Close My Topics If You Have Not Replied In 5 Days If You Will Be Longer Please Let Me Know

If I Have Not Replied To One Of My Topics In 48 Hrs Please Bump The Topic



My help is free, however, if you wish to make a small donation to show your appreciation or to help me continue the fight against Malware, then click here -->btn_donate_SM.gif<-- Don't worry every little bit helps.

Proud Graduate Of Malware Removal University

#12 eelars

eelars
  • Topic Starter

  • Members
  • 53 posts
  • OFFLINE
  •  
  • Local time:08:11 PM

Posted 11 February 2013 - 05:04 PM

I first tried the Ultimate Boot CD. To get it to boot, I had to use F12 (otherwise, I would go to the network log-in; the computer is no longer on a network, but had been in the past).

I chose to boot from the CD and got a prompt that said "Press any key to boot from The Ultimate Boot CD for Windows."

When I did, I got a menu and selected "Launch the Ultimate Boot CD for Windows."

I got "Now loading the Ultimate Boot CD..."

The CD was spinning and things seem to be going fine, but then, I got the Blue Screen (and the CD stopped spinning), which read:

"A problem has been detected and windows has been shut down to prevent damage to your computer. If this is the first time you've seen this Stop error screen, restart you computer. If this screen appears again, follow these steps:

Check for viruses on your computer. Remove any newly installed hard drives or hard drive controllers. Check your hard drive to make sure it is properly configured and terminated. Run CHKDSK /F to check for hard drive corruption, and then restart your computer.

Technical information: 

*** STOP: 0x0000007B (0xF78CA528, 0XC0000034, 0x00000000, 0X00000000)"

 

Repeated once and had the same result. 

 

Went to PLAN B

 

F12 to get boot menu, selected USB device and get the xPUD on the USB we prepared.

 

Not finding driver.sh in the sdb1 submenut to mnt (it is not in the boot or opt submenus of sdb1 either); however, I did check and saw it on the usb drive on the clean computer. Attempted to open terminal/bash driver.sh anyhow, but got the message "No such file or directory"

 

Retried with my old boot USB (which has driver.sh on it) and same result/error message.



#13 gringo_pr

gringo_pr

    Bleepin Gringo


  • Malware Response Team
  • 136,773 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Puerto rico
  • Local time:10:11 PM

Posted 11 February 2013 - 05:19 PM

Not finding driver.sh in the sdb1 submenut to mnt (it is not in the boot or opt submenus of sdb1 either); however, I did check and saw it on the usb drive on the clean computer. Attempted to open terminal/bash driver.sh anyhow, but got the message "No such file or directory"

while you are booted into xpud remove the usb and put it back in
I Close My Topics If You Have Not Replied In 5 Days If You Will Be Longer Please Let Me Know

If I Have Not Replied To One Of My Topics In 48 Hrs Please Bump The Topic



My help is free, however, if you wish to make a small donation to show your appreciation or to help me continue the fight against Malware, then click here -->btn_donate_SM.gif<-- Don't worry every little bit helps.

Proud Graduate Of Malware Removal University

#14 eelars

eelars
  • Topic Starter

  • Members
  • 53 posts
  • OFFLINE
  •  
  • Local time:08:11 PM

Posted 11 February 2013 - 05:36 PM

Reconfirmed that driver.sh is on USB on clean computer. Rebooted infected computer with USB to xPUD. 

 

Clicked on file

Exapnded mnt (sda 1 and sdb1 visible)

Expanded sdb 1 (boot and opt visible, no files visible)

Expanded boot and opt; both said "No Sub Folder"

 

Removed USB

Device Removal /mnt/sdb1 Unmounted message shows up on screen.

Waiting about 30 seconds

 

Plugged in - series of messages in the black box (might not be all of them)

mnt/8:16/umnounted

/2-2:1.0/umnounted

mnt/2-2 Unmounted

/mntsg2 Unmounted

/mnt):target0:0:0 Unmounted

/mnt/host0 Unmounted

/mnt/sdb Unmounted

 

/mnd/sdb [mounted? inserted?]

ERROR:/mnt/sdb1 Not mounted

 

Black box goes away.

 

But, still the same in sdb1 folder (no sign of driver.sh)



#15 eelars

eelars
  • Topic Starter

  • Members
  • 53 posts
  • OFFLINE
  •  
  • Local time:08:11 PM

Posted 11 February 2013 - 05:42 PM

I repeated the above to get the sequence of the messages in the black box.

 

On removal (and waiting for the messages to stop). 

All had the title Device Removal and the form /mnt/**** Unmounted the sequence of what was in **** is

7:0:0:0

sg2

8:16

sdb1

host7

7:0:0:0

sdb1

target 7:0:0

sb

host7

2-2

2-2:1.0

sdb

 

After the box went away, I replugged it and got

Device Found

/mnt/sdb1 Mounted

 

followed by

Device found

/mnt/sdb1 Not mounted

 

Clicking on sdb 1 to expand under file gives no sign of the file.






0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users