Ransomware. need assistance please.

[mdgeist88]

I got a ransomware that works on safe mode. I already tried the restore point thing and it didn't work.... I do not know what to do. I use windows 7.

[kevinf80]

What do you mean "I got a ransomware that works on safe mode" do you mean you cannot access safemode? or the system boots ok in safemode. What version of windows 7, 32bit or 64bit....

If you mean you can access safemode then re-boot into safemode with networking and run the following:

Download and save DDS to your Desktop from either of the following links:

http://download.blee...om/sUBs/dds.scr

http://compendiate.n...UBs/dds/dds.scr

Double click DDS to run the scan, Vista or Windows 7 user accept UAC alert.

There will be an alert that two logs will be saved to the Desktop, DDS.txt and Attach.txt

Copy and paste those two logs to your reply when the scan is complete....

[mdgeist88]

I believe 32 bit. The ransomware comes up while I am in safe mode. The screen starts off white then it is up. Because of that I can't access anything.

[Maurice Naggar]

@mdgeist88

Have you resolved your issue? Do you still require help? If so, do as much as possible of the following.

For x32 (x86) bit systems download Farbar Recovery Scan Tool and save it to a flash drive.

For x64 bit systems download Farbar Recovery Scan Tool x64 and save it to a flash drive.

Plug the flashdrive into the infected PC.

Enter System Recovery Options.

To enter System Recovery Options from the Advanced Boot Options:

• Restart the computer.
  
• As soon as the BIOS is loaded begin tapping the F8 key until Advanced Boot Options appears.
  
• Use the arrow keys to select the Repair your computer menu item.
  
• Select English as the keyboard language settings, and then click Next.
  
• Select the operating system you want to repair, and then click Next.
  
• Select your user account an click Next.

To enter System Recovery Options by using Windows installation disc:

• Insert the installation disc.
  
• Restart your computer.
  
• If prompted, press any key to start Windows from the installation disc. If your computer is not configured to start from a CD or DVD, check your BIOS settings.
  
• Click Repair your computer.
  
• Select English as the keyboard language settings, and then click Next.
  
• Select the operating system you want to repair, and then click Next.
  
• Select your user account and click Next.

On the System Recovery Options menu you will get the following options:

• • 
    
  • Startup Repair
    
  • System Restore
    
  • Windows Complete PC Restore
    
  • Windows Memory Diagnostic Tool
    
  • Command Prompt

[*]Select Command Prompt

[*]In the command window type in notepad and press Enter.

[*]The notepad opens. Under File menu select Open.

[*]Select "Computer" and find your flash drive letter and close the notepad.

[*]In the command window type e:\frst.exe (for x64 bit version type e:\frst64) and press Enter

Note: Replace letter e with the drive letter of your flash drive.

[*]The tool will start to run.

[*]When the tool opens click Yes to disclaimer.

[*]Press Scan button.

[*]It will make a log (FRST.txt) on the flash drive. Please copy and paste it to your reply.

[Maurice Naggar]

OP has not been around since 5 Dec. This has been abandoned by OP. I am closing this.