I have an machine running XP which I need to remove this ransomware from. I can't boot into safe mode and I've tried Avira rescue CD which didn't find anything and after Kaspersky rescue. I cannot boot into windows anymore. I cannot boot into my Hitman Kickstart usb either (it hangs on MBR and I tried Fix MBR with a windows xp disc). My last resort was booting into a Reatogo-PE and running farbar and hoping you fine gentleman can assist. Going by the Farbar log Kaspersky seemed to remove advapi32.dll which is why I can't normal boot anymore.