Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

White Screen Virus - Locked out of pc


  • This topic is locked This topic is locked
13 replies to this topic

#1 Jen&Rob

Jen&Rob

  • Members
  • 30 posts
  • OFFLINE
  •  
  • Local time:04:13 AM

Posted 09 December 2013 - 03:12 PM

Hi everyone.

 

I'm hoping someone can help me.  I've been reading lots of posts on this forum and trying to follow the instructions but I'm not getting very far.

 

I can't remember what others have said this virus is called, but it's the one with the white screen and it says in the top left hand corner "Please connect to the Internet".  Eventually a window comes up saying that we've been tracked watching pornographic material and to pay a fine of £100 to get the pc unlocked.

 

I've tried to do a system restore and it didn't work.

 

I can get into the computer by pressing F8 and selecting "Safe mode with networking".

 

I made a disk of Emsisoft Emergency Kit and put it in the infected pc.  Managed somehow (not quite sure how!) to run it.  It found 4 things.  I made sure the ticks were in the boxes and clicked quarantine - this only quarantined 3 out of the 4.  The last one that it couldn't do was "HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\SOFTOMATE.IETOOLBAR.1"

 

I re-booted and it went back to the white screen - so I switched it straight off.

 

The pc is running Windows XP.  I'm posting this on my laptop.

 

I'm not sure on what other information is needed.

 

If I've posted this in the wrong place, many apologies and please move to the correct place.

 

Thanks in advance for any help.



BC AdBot (Login to Remove)

 


#2 Roodo

Roodo

  • Members
  • 760 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:10:13 PM

Posted 09 December 2013 - 04:00 PM

Goto safe mode with networking

Download and make Rescue disk:

http://support.kaspersky.com/viruses/rescuedisk

run this then report back



#3 anthonynguyen93

anthonynguyen93

  • Members
  • 3 posts
  • OFFLINE
  •  
  • Local time:10:13 PM

Posted 09 December 2013 - 04:11 PM

Hi Jen & Rob,

 

Based on how you described the issue, its best if you just reformat your entire drive or HDD. At this point, I wouldn't bother removing the virus with any third party programs.

 

Reading through your issue, it sounds to me that you didn't reformat your hard drive correctly or the reformat process failed. 

 

There are a few questions and solutions I would like to propose:

 

- Is your recovery CD an actual Windows XP reformat CD or are you using a recovery CD that came with the computer?

If you have an actual Windows XP CD:

 - Make sure you delete the target partition before formatting it. To be safe, I would delete all partitions and start off fresh.

If you have a recovery CD:

Try using an actual Windows XP CD. Based on my experience, recovery CD's gives the end user a harder time to restore their computer than necessary. 

 

As an end note, I suggest upgrading to Windows 7 since there will no longer be support/patches for system holes and viruses on the Windows XP operating system. 



#4 Jen&Rob

Jen&Rob
  • Topic Starter

  • Members
  • 30 posts
  • OFFLINE
  •  
  • Local time:04:13 AM

Posted 11 December 2013 - 04:55 AM

Hi Roodo

 

I managed to create the Kaspersky rescue CD.  Tried to run it straight from the CD, but it said my drive was disabled.  Managed to copy it from the CD to C: - but when I try to run it nothing happens, no error message, nothing!!!

 

Any ideas?

 

Jen.



#5 Jen&Rob

Jen&Rob
  • Topic Starter

  • Members
  • 30 posts
  • OFFLINE
  •  
  • Local time:04:13 AM

Posted 11 December 2013 - 04:56 AM

Anthony, I haven't tried to reformat my hard drive.  I wouldn't know how to do it and I have too many important files on there at the moment.  I don't have a Windows CD as it was pre-loaded. 



#6 Jen&Rob

Jen&Rob
  • Topic Starter

  • Members
  • 30 posts
  • OFFLINE
  •  
  • Local time:04:13 AM

Posted 11 December 2013 - 06:53 AM

While I was waiting I thought I'd run the Emsisoft Emergency Kit again.  This time it has found nothing.  But the ransom virus is still there!!!!



#7 Roodo

Roodo

  • Members
  • 760 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:10:13 PM

Posted 11 December 2013 - 09:34 AM

go into your bios and make your cd the drive to boot from (No 1 in the boot order)

insert the disk and reboot the computer.



#8 Jen&Rob

Jen&Rob
  • Topic Starter

  • Members
  • 30 posts
  • OFFLINE
  •  
  • Local time:04:13 AM

Posted 11 December 2013 - 10:45 AM

Hi

 

I "think" it already is first.  This is what it says :

 

1.  Onboard or USB CD-ROM Drive

2.  Onboard or USB Floppy Drive (not present)

3.  Onboard SATA Hard Drive (not present)

4.  ST3808110AS

5.  Onboard Network Controller (not present)

6.  USB Device (not present)



#9 Roodo

Roodo

  • Members
  • 760 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:10:13 PM

Posted 11 December 2013 - 11:22 AM

lets try this online scanner

http://www.eset.com/us/online-scanner/



#10 Jen&Rob

Jen&Rob
  • Topic Starter

  • Members
  • 30 posts
  • OFFLINE
  •  
  • Local time:04:13 AM

Posted 11 December 2013 - 11:31 AM

How can I do that?  My pc can't access the internet?



#11 Roodo

Roodo

  • Members
  • 760 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:10:13 PM

Posted 11 December 2013 - 11:40 AM

didn't you have the option of safe mode with networking?

or has that now failed?

How did you get the rescue disk?



#12 boopme

boopme

    To Insanity and Beyond


  • Global Moderator
  • 72,934 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:NJ USA
  • Local time:12:13 AM

Posted 11 December 2013 - 11:42 AM

Hello we can get in here but you will need to repost your topic here.. Virus, Trojan, Spyware, and Malware Removal Logs         


How do I get help? Who is helping me?For the time will come when men will not put up with sound doctrine. Instead, to suit their own desires, they will gather around them a great number of teachers to say what their itching ears want to hear....Become a BleepingComputer fan: Facebook

#13 Jen&Rob

Jen&Rob
  • Topic Starter

  • Members
  • 30 posts
  • OFFLINE
  •  
  • Local time:04:13 AM

Posted 11 December 2013 - 12:42 PM

OK, will do that now.



#14 hamluis

hamluis

    Moderator


  • Moderator
  • 55,416 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Killeen, TX
  • Local time:11:13 PM

Posted 11 December 2013 - 01:47 PM

Reference:  http://www.bleepingcomputer.com/forums/t/517175/ransom-virus/

 

Now that you have properly posted a malware log topic, you should NOT make further changes to your computer (install/uninstall programs, use special fix tools, delete files, edit the registry, etc) unless advised by a MRT Team member, nor should you ask for help elsewhere. Doing so can result in system changes which may not show in the log you already posted. Further, any modifications you make on your own may cause confusion for the helper assisting you and could complicate the malware removal process which would extend the time it takes to clean your computer.

From this point on, the MRT Team should be the only members that you take advice from, until they have verified your log as clean.

Please be patient. It may take a while to get a response because the MRT Team members are EXTREMELY busy working logs posted before yours. They are volunteers who will help you out as soon as possible. Once you have made your post and are waiting, please DO NOT make another reply until it has been responded to by a member of the MRT Team. Generally the staff checks the forum for postings that have 0 replies as this makes it easier for them to identify those who have not been helped. If you post another response there will be 1 reply. A team member, looking for a new log to work may assume another MRT Team member is already assisting you and not open the thread to respond.

It may take several days to get a response but your log will be reviewed and answered as soon as possible. I advise checking your topic once a day for responses as the e-mail notification system is unreliable.

If HelpBot replies to your topic, PLEASE follow Step One so it will report your topic to the team members.

To avoid confusion, I am closing this topic.

Louis






0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users