Police themed ransomware - removal guides not working

Juuso

Looks like some developed version, which does not allow any writing "redigit" and removal of ctfmon.exe but runs windows anyway. What to do ? Helpless and not any itguru...

Simon

Not sure if it will help, but have you tried http://www.malwarebytes.org ?

NikK

If the malware blocks the Malwarebytes Anti-Malware program, install it with the help of Chameleon:

http://www.malwarebytes.org/chameleon/

 

Rusli

Hi Juuso,

 

Try this link:-

 

http://www.bitdefender.com/tech-assist/self-help/removing-police-themed-ransomware-malware.html

 

Bitdefender tool.

http://download.bitdefender.com/removal_tools/BDRemoval_Trojan_Ransom_IcePol.exe

 

 

http://www.f-secure.com/en/web/labs_global/removal/removing-ransomware

 

 

http://hitmanpro.wordpress.com/2012/04/12/hitmanpro-against-police-themed-ransomware/

 

 

Ben

Hello Juuso,

 

If you think you are facing a new variant, please submit a sample to our Labs if possible.

They should be able to provide guidance.

Juuso

Thank you Simon - problem was not getting any access to the computer any more. This for sure assists to avoid in the future

Juuso

Thank you for your contribution NiKK - I had problem not to get in to the computer at all, could not install or use any assisting software before removing contaminated or virus .exe files

Juuso

Got assistance from my friend - not exactly knowing what was done, thank you Ben. Sample sending was really not possible as I could not get in at all with the common ransomware removal guides - no access to install any help either. Of course start-up disc could have helped to start from there but I did not have it, nor have I got the original windows as everything is installed ready when buying the machine and updates from the net of course. Helpless feeling but got out, thanks to assistance from these pages too

NikK

Even if you don't have the original windows disc, most systems include the files needed to create a system repair disc. If you have a fairly new Windows version and not XP, go to Control Panel - Backup & Restore. From there you can create a "System repair disc".  If it doesn't ask for the windows disc during the process then you're fine.

The system repair disc enables you to boot from it and displays a recovery menu. The safest option if windows stop working one day is to boot from that disc and from the recovery menu choose to restore a system/backup "image".  But to do that you first need to create a system image(exact copy of a drive), also done from Control Panel - Backup & Restore. I wrote more about it here

 

Your computer manufacturer (OEM) might have preinstalled recovery options as you didn't get the original windows disc. More info here, and under option two you'll see how to boot from the System Repair Disc:

http://www.sevenforums.com/tutorials/668-system-recovery-options.html