Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Win32/Reveton 'Police Central E-Crime Unit' - HitmanPro not working.


  • This topic is locked This topic is locked
29 replies to this topic

#1 matty34

matty34

  • Members
  • 70 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Portsmouth, United Kingdom
  • Local time:05:56 PM

Posted 13 June 2013 - 01:38 PM

Good evening BC; hope all are okay!

Once again, I am unfortunately back after 2 years of no problems. 

 

My father's computer has been infected by the "Police CEntral E-Crime Unit' Ransomware/virus, also goes by 'Win32/Reveton' from what I know. I originally went to the removal guides before coming here, tried to follow the guide until I came across problems around #9. Please note, the picture of the one in the guide is not exact to the one I have. We do not get the webcam type option. If needs be, I can get you a picture if requested.

 

I had HitmanPro/Kickstart ready on two different flash drives (I tried it on one, then tried it on another to make sure) though it was never loading up over the PCeU in the main desktop. I wrote down everything that I was doing to make sure it was 100% correct, which is when I noticed something seemed wrong - after I selected Bypass Master Boot Record; the computer would restart itself (not go straight to the desktop) Please see the following for the steps I have taken.

 

*For note, the motherboard is a Foxconn*

 

  • Esc / F12'd to get me to the Boot Override Menu
  • Selected USB-HDD0 : Generic Flash Disk
  • Computer loads to the Flashdrive - I select *1; Bypass Master Boot Record (Running 2.1v)
  • HitmanPro.Kickstart Booting // MBR-Read
  • Computer automatically restarts - then heads to the desktop screen
  • Just after the welcome screen, you get a quick flash of the desktop screen before it goes white for about 5-10 seconds.
  • Police Central loads up - after waiting 15/20 seconds nothing happens (supposedly how long it takes). I carried on waiting for another 2 minutes to be on the safe side. Nothing came up. I the computer down.

 

I also tried selecting #2 - Regular Boot (When Bypass failed) - I had no luck.

 

 

Does anyone know how I can go about getting the software to load up over the PCeU ransomware so I can start to scan the computer and rid of this problem? If not, any other ideas?

 

 

Thanks to all in advance!

 

 

 

Regards,

M34


Edited by matty34, 13 June 2013 - 01:38 PM.


BC AdBot (Login to Remove)

 


#2 Broni

Broni

    The Coolest BC Computer


  • BC Advisor
  • 42,664 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Daly City, CA
  • Local time:09:56 AM

Posted 13 June 2013 - 06:59 PM

I'll report this topic to appropriate helpers.

Hold on there....


My Website

p4433470.gif

My help doesn't cost a penny, but if you'd like to consider a donation, click p22001735.gif


 


#3 matty34

matty34
  • Topic Starter

  • Members
  • 70 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Portsmouth, United Kingdom
  • Local time:05:56 PM

Posted 14 June 2013 - 07:29 AM

Thanks Broni.
I'll keep an eye out for a update.

 

 

Rgrds



#4 dev00790

dev00790

    Bleeping Chocoholic


  • Members
  • 5,037 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:UK
  • Local time:04:56 PM

Posted 16 June 2013 - 08:59 AM

Hello,

I will be helping you with your problems. Please be patient while I assist you.

Some points for you to keep in mind while I am helping you to make things go easier and faster for both of us

  • Please do NOT run, install or uninstall any programs,  unless instructed to do so.
    • We ask you to run different tools in a specific order to ensure the malware is completely removed from your machine, and running any additional tools may detect false positives, interfere with our tools, or cause unforeseen damage or system instability.
  • Please do not attach logs or use code boxes, just copy and paste the text.
    • Due to the high volume of logs we receive it helps to receive everything in the same format, and code boxes make the logs very difficult to read. Also, attachments require us to download and open the reports when it is easier to just read the reports in your post.
  • Please read every post completely before doing anything.
    • Pay special attention to the NOTE: lines, these entries identify an individual issue or important step in the cleanup process.
  • Please provide feedback about your experience as we go.
    • A short statement describing how the computer is working helps us understand where to go next, for example: I am still getting redirected, the computer is running normally, etc. Please do not describe the computer as "the same", this requires the extra step of looking back at your previous post.

NOTE: At the top of your post, click on the Watch Topic Button, select Immediate Notification, and click on Proceed. This will send you an e-mail as soon as I reply to your topic, allowing us to resolve the issue faster.

NOTE: Backup any files that cannot be replaced. Removing malware can be unpredictable and this step can save a lot of heartaches if things don't go as planed. You can put them on a CD/DVD, external drive or a pen drive, anywhere except on the computer.
- Do NOT backup any unknown files ending in .exe, .com, .scr, .pif, and .bat since files of these types are more likely to be infected.

NOTE: It is good practice to copy and paste the instructions into notepad and print them in case it is necessary for you to go offline during the cleanup process. To open notepad, navigate to Start Menu > All Programs > Accessories > Notepad. Please remember to copy the entire post so you do not miss any instructions.
 
----------------

 

I am reviewing your post and will come back to you with the next steps soon.


Edited by Orange Blossom, 17 June 2013 - 09:59 PM.
Moved to log forum. ~ OB

Regards, dev00790

---------------------------------------

Marge: "Homer, the plant called. They said if you don't show up tomorrow don't bother showing up on Monday." Homer: "Woo-hoo! Four-day weekend!"I do not reply to Private Messages (PMs) asking for assistance - please use the forums instead. If I have been helping you, and I have not replied to your latest post in 48 hours please send me a PM. My Blog


#5 dev00790

dev00790

    Bleeping Chocoholic


  • Members
  • 5,037 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:UK
  • Local time:04:56 PM

Posted 18 June 2013 - 03:39 AM

Hi

 

Which Operating system do you have installed on the computer? - Eg Windows XP / Vista / 7 / 8?


Regards, dev00790

---------------------------------------

Marge: "Homer, the plant called. They said if you don't show up tomorrow don't bother showing up on Monday." Homer: "Woo-hoo! Four-day weekend!"I do not reply to Private Messages (PMs) asking for assistance - please use the forums instead. If I have been helping you, and I have not replied to your latest post in 48 hours please send me a PM. My Blog


#6 matty34

matty34
  • Topic Starter

  • Members
  • 70 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Portsmouth, United Kingdom
  • Local time:05:56 PM

Posted 18 June 2013 - 04:07 AM

Hi, the computer is running Windows XP.

#7 dev00790

dev00790

    Bleeping Chocoholic


  • Members
  • 5,037 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:UK
  • Local time:04:56 PM

Posted 18 June 2013 - 04:58 AM

Hi Do you have a Windows XP disc?


Regards, dev00790

---------------------------------------

Marge: "Homer, the plant called. They said if you don't show up tomorrow don't bother showing up on Monday." Homer: "Woo-hoo! Four-day weekend!"I do not reply to Private Messages (PMs) asking for assistance - please use the forums instead. If I have been helping you, and I have not replied to your latest post in 48 hours please send me a PM. My Blog


#8 matty34

matty34
  • Topic Starter

  • Members
  • 70 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Portsmouth, United Kingdom
  • Local time:05:56 PM

Posted 19 June 2013 - 04:09 PM

Hi, I think I may have one laying around but unfortunately I'm currently out of the country until the 28th, so unable to fully check.

#9 dev00790

dev00790

    Bleeping Chocoholic


  • Members
  • 5,037 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:UK
  • Local time:04:56 PM

Posted 19 June 2013 - 04:18 PM

Ok, try the following when you are ready:

 

Let's try to boot your computer using the Ultimate Boot CD for Windows (UBCD4win).

Please print this guide for future reference!

You will need a blank CD, a clean computer and a flash drive.

Please follow the steps below and let me know if you were successful. If you were unable to create the UBCD4win, please tell me what error messages you got and/or what steps you got hung up on.

:step1:

1. Download and Run Ultimate Boot CD for Windows

  • Save it to your Desktop.
  • Double-Click on the UBCD4Win.EXE that you just downloaded to your desktop.
  • Follow all of the instructions/prompts that come up.
    NOTES:
    • Do not install to a folder with spaces in it's name.
    • Your Anti-Virus may report viruses or trojans when you extract UBCD4Win, these are "False-Positives." Read HERE for information regarding the files that normally trigger AV software.

2. Insert your XP CD with SP1/SP2/SP3 into a CD Rom drive

  • Double-Click on UBCD4WinBuilder.exe located in your C:\ubcd4win folder.
  • Click "I agree" to the Builders License.
  • Click NO to Search for Windows Installation Files
  • Make the following selections from the Main Screen that pops up:
    • Builder
      • Source:(path to Windows installation files)
        • Enter the path to the drive where your XP CD is located.
        • You can click on the "..." button on the right to navigate to the path as well.
      • Custom: (include files and folders from this directory)
        • No information is necessary, leave blank.
      • Output: (C:\ubcd4win\BartPE)
        • Keep the default BartPE
    • Media output
      • Choose Create ISO image
      • Do not choose Burn to CD/DVD
        •  
      Please note: If your XP install disc is SP1 then please .....
      • Disable- DComLaunch Service
      • Enable- LargeIDE Fix

        This can be done by pressing the "Plugin" button and checking or unchecking the appropriate selections
      Also note: If you have a Dell XP install disc you will need to follow the instructions here
      http://www.ubcd4win.com/faq.htm#dell
    3. Click on the "Build" button
    • You will see the Windows EULA message. Click on I Agree
    • You will now see the Build Screen. Let it run it's course
    • When the Build is finished you can click close, then exit
    4. Burn your ISO file to CD
    • Please see HERE on how to burn an ISO to CD.

==========

:step2:

Next, from your clean computer:

Download Farbar Recovery Scan Tool
and save it to your flash drive.

Now plug your flashdrive back into your sick computer and follow the next instructions:

==========

:step3:

1. Restart Your sick Computer Using the UBCD4Win Disc That You Have Created

  • Insert the UBCD4Win disc in to one of your CD/DVD drives.
  • Restart your computer.
    • The computer should choose to boot from the UBCD4Win CD automatically. If it doesn't and you are asked if you want to boot from CD, then choose that option.
  • In the window that pops up select Launch The Ultimate Boot CD For Windows and press Enter.
    • It may take a little longer for the Desktop to appear than it does when you start your computer normally. Just let the process run itself until the desktop appears.
  • Once the desktop appears, you will receive a message asking: Do you want to start Network support?
    • Click on Yes if you want to use the PE environment to get online post your log and reply by way of an Ethernet connection.
  • You should now have a desktop that looks like this:

    Main.jpg

==========

:step4:

  • Single click My computer from your UBCD4W desktop to navigate to the Farbar Recovery Scan Tool you saved to your flash drive.
  • Double click on it to begin running the tool.
  • When the tool opens click Yes to disclaimer.
  • Press Scan button.
  • It will make a log (FRST.txt) on the flash drive. Please copy and paste it to your next reply.

Regards, dev00790

---------------------------------------

Marge: "Homer, the plant called. They said if you don't show up tomorrow don't bother showing up on Monday." Homer: "Woo-hoo! Four-day weekend!"I do not reply to Private Messages (PMs) asking for assistance - please use the forums instead. If I have been helping you, and I have not replied to your latest post in 48 hours please send me a PM. My Blog


#10 dev00790

dev00790

    Bleeping Chocoholic


  • Members
  • 5,037 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:UK
  • Local time:04:56 PM

Posted 28 June 2013 - 06:38 AM

Hi Are you still with us?


Regards, dev00790

---------------------------------------

Marge: "Homer, the plant called. They said if you don't show up tomorrow don't bother showing up on Monday." Homer: "Woo-hoo! Four-day weekend!"I do not reply to Private Messages (PMs) asking for assistance - please use the forums instead. If I have been helping you, and I have not replied to your latest post in 48 hours please send me a PM. My Blog


#11 matty34

matty34
  • Topic Starter

  • Members
  • 70 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Portsmouth, United Kingdom
  • Local time:05:56 PM

Posted 28 June 2013 - 07:41 AM

Hi, yes sorry. I'm back in my country tomorrow (saturday) and I will make sure its the first thing I do. I will post back tomorrow evening GMT.

sorry for any inconvenience caused.

Regards
m34

#12 dev00790

dev00790

    Bleeping Chocoholic


  • Members
  • 5,037 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:UK
  • Local time:04:56 PM

Posted 28 June 2013 - 08:03 AM

Thanks for letting us know :thumbup2:


Regards, dev00790

---------------------------------------

Marge: "Homer, the plant called. They said if you don't show up tomorrow don't bother showing up on Monday." Homer: "Woo-hoo! Four-day weekend!"I do not reply to Private Messages (PMs) asking for assistance - please use the forums instead. If I have been helping you, and I have not replied to your latest post in 48 hours please send me a PM. My Blog


#13 matty34

matty34
  • Topic Starter

  • Members
  • 70 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Portsmouth, United Kingdom
  • Local time:05:56 PM

Posted 29 June 2013 - 02:54 PM

Hi Dev,
 
I'm back home, and I've found a copy of Windows XP sp 2 (advanced security technologies) that I have used before. Unfortunately, when following step 1.2 to the T - D:\ is where my XP disc currently is. Attached File  ubdc.png   21.45KB   2 downloads

 

I get an error message when I press "build" I get an error message; Invalid Source Path (Cannot find file: D:\i386\setupldr.bin)

 

Any ideas?

 

Rgrds



#14 dev00790

dev00790

    Bleeping Chocoholic


  • Members
  • 5,037 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:UK
  • Local time:04:56 PM

Posted 30 June 2013 - 01:33 AM

Hi Please navigate to D:\i386\ via Explorer. - does the file setupldr.bin exist there?


Regards, dev00790

---------------------------------------

Marge: "Homer, the plant called. They said if you don't show up tomorrow don't bother showing up on Monday." Homer: "Woo-hoo! Four-day weekend!"I do not reply to Private Messages (PMs) asking for assistance - please use the forums instead. If I have been helping you, and I have not replied to your latest post in 48 hours please send me a PM. My Blog


#15 matty34

matty34
  • Topic Starter

  • Members
  • 70 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Portsmouth, United Kingdom
  • Local time:05:56 PM

Posted 30 June 2013 - 06:01 AM

Hi,

 

I've taken a look, and there is no 'i386' folder. Here is a list of what's on the CD.I believe this is a copy from a relative in the IT Industry.

 

 Attached File  xpsp2.jpg   41.62KB   4 downloads


Edited by matty34, 30 June 2013 - 06:05 AM.





0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users