when ransomware is slick enough to log you off in safe mode

[DavidHalitsky]

I recently encountered a piece of ransomware that is sharp enough to log you off whenever you start windows in safe mode, even without networking.

At the time, I didn't have Malwarebytes installed, so my problem was how to get it onto the machine and run it.

So I bought a copy and downloaded it to another machine and put it on an external drive.

Then I went back to the machine with the problem and started Windows with Command Prompt.

Fortunately, Windows 7 is able to recognize external drives from the command promot.

So I installed Malwarebytes from the Command Prompt and then ran it.

Sure enough, it found the bad boys in the Roaming directory of AppData under very obscure files.

Once I deleted these four files, I was able to boot normally again.

Congratulations to Malwarebytes for a truly GREAT product.

David Halitsky

Edited January 29, 2013 by Mainard
Removed contact number

[MAM]

Well, try this on for the first,

Use Chameleon to run Malwarebytes Anti-Malware on infected systems ---> http://helpdesk.malwarebytes.org/entries/20872371-Use-Chameleon-to-run-Malwarebytes-Anti-Malware-on-infected-systems

http://helpdesk.malwarebytes.org/entries/21452626-Use-Malwarebytes-Chameleon-to-install-Malwarebytes-Anti-Malware-on-an-already-infected-system

Or read carefully this, ---> http://helpdesk.malwarebytes.org/home

MAM