Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Need help trying to recover after riding myself of ransomeware takeover screen


  • Please log in to reply
1 reply to this topic

#1 ImBubba

ImBubba

  • Members
  • 20 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Kissimmee, FL, USA
  • Local time:08:26 PM

Posted 28 March 2014 - 12:33 AM

I had an ransomeware screen that took over my computer a couple of days ago.  It looked very official.  It demanded payment of 300 USD via a MoneyPac.  It provided a countdown clock which started at 48:00:00 (48 hours) to show me how much time I had to make payment before it would encrypt all my files.  I had seen this screen before (even reported it here, I think), but was always able to get it out of my system with ctrl-alt-del to bring up the task manager and kill the task.  Not this time!  This time the malware kept its screen on top.  A ctrl-alt-del DID get me to where I could select the task manager, but as soon as the task manager screen popped up it was gone (pushed to the back, it appeared, by the malware forcing itself to the front.  I could do this repeatedly, but I could never click on the task manager screen because it was gone too fast.

 

I could shut down the system and reboot it, and I did several times.  Each time the system restarted I could see my desktop icon propagating and the early things in my start-up list coming up, but fairly soon there was an error dialog box informing me that some .dll with a name I didn't recognize (and didn't write down) had failed, and immediately the malware reasserted its presence and layed itself over the top of my entire desktop and that was all she wrote.  Interestingly, the countdown clock on the malware's screen started again from 48:00:00.  I did this several times varying the amount of time between reboots and the countdown clock always restarted the countdown at 48:00:00.

 

I WAS able to restart my computer in recovery mode and I chose a restore point one month back.  The recovery restart was somewhat successful ... Windows came up without error and I was able to get back to work on a Word document I had been working on, but I soon discovered that my IE10 could not display any webpages.  I thought that might be a result of the restore /restart as I could vaguely remember having a similar problem after installing IE10 because I had not checked an IE configuration option box regarding the use of hardware assistance for rendering graphics in IE.  I went out t diddle with IE11's configuration options and found them just as I had left them in IE10.  About twenty minutes in to my head scratching, Norton Internet Security popped up a message telling me that it had failed to initialize with an error message 8504, 104.  Now I'm starting to worry.  What else doesn't work.  Well, my Thunderbird (Mozilla) e-mail doesn't connect, for one thing, and I can't seem to print to either of my two local network-attached printers!  The only way I am able to get to Bleeping Computer (and anything else on the Internet is by using the Google Chrome browser which I have had installed but rarely ever used.

 

I do not know if the ransomeware or my attempted checkpoint restore recovery from it is to blame for all this weirdness, but I sure could use some help getting this thing back on track.

 

Anyone?



BC AdBot (Login to Remove)

 


#2 ImBubba

ImBubba
  • Topic Starter

  • Members
  • 20 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Kissimmee, FL, USA
  • Local time:08:26 PM

Posted 28 March 2014 - 12:38 AM

Moderator - I'm sorry I double posted this in error.  I don't know how to delete it.  Please delete one of these duplicate postings.  Thanks you. 

 

Mod Edit:  Dupe already deleted, thanks :) - Hamluis.


Edited by hamluis, 28 March 2014 - 05:50 AM.





0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users