Ukash ransomware, unable to boot machine

StorkTheBear · May 12, 2013

Hi, hopefully someone can help,

Posting from another machine, My laptop has been infected by a Ukash ransomware software and I am unable to boot the computer in safe mode or safe mode with command prompt without the machine logging off and restarting once I have entered the user password.

There is only one user on the machine and am therefore unable to log on as a different user.

Please help if anyone can

Dom

MrCharlie · May 12, 2013

Welcome to the forum, here's how we deal with that malware:

Please download Farbar Recovery Scan Tool and save it to a flash drive.
Note: You need to run the version compatible with your system. If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, that will be the right version.
Plug the flash drive into the infected PC.
If you are using Windows 8 consult How to use the Windows 8 System Recovery Environment Command Prompt to enter System Recovery Command prompt.
If you are using Vista or Windows 7 enter System Recovery Options.
To enter System Recovery Options from the Advanced Boot Options:
- Restart the computer.
- As soon as the BIOS is loaded begin tapping the F8 key until Advanced Boot Options appears.
- Use the arrow keys to select the Repair your computer menu item.
- Select US as the keyboard language settings, and then click Next.
- Select the operating system you want to repair, and then click Next.
- Select your user account an click Next.

Note: In case you can not enter System Recovery Options by using F8 method, you can use Windows installation disc, or make a repair disc. Any Windows installation disc or a repair disc made on another computer can be used.

To make a repair disk on Windows 7 consult: http://www.sevenforums.com/tutorials/2083-system-repair-disc-create.html

To enter System Recovery Options by using Windows installation disc:

Insert the installation disc.
Restart your computer.
If prompted, press any key to start Windows from the installation disc. If your computer is not configured to start from a CD or DVD, check your BIOS settings.
Click Repair your computer.
Select US as the keyboard language settings, and then click Next.
Select the operating system you want to repair, and then click Next.
Select your user account and click Next.

[*]On the System Recovery Options menu you will get the following options:

- Startup Repair
  System Restore
  Windows Complete PC Restore
  Windows Memory Diagnostic Tool
  Command Prompt
  Select Command Prompt
  Once in the Command Prompt:

[*]In the command window type in notepad and press Enter.

[*]The notepad opens. Under File menu select Open.

[*]Select "Computer" and find your flash drive letter and close the notepad.

[*]In the command window type e:\frst (for x64 bit version type e:\frst64) and press Enter

Note: Replace letter e with the drive letter of your flash drive.

[*]The tool will start to run.

[*]When the tool opens click Yes to disclaimer.

[*]Press Scan button.

[*]It will make a log (FRST.txt) on the flash drive. Please copy and paste it to your reply.

MrC

StorkTheBear · May 12, 2013

Wow, thanks for the quick response,

Now going to try it, post back soon

StorkTheBear · May 12, 2013

Attached text log

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 11-05-2013 01

Ran by SYSTEM on 12-05-2013 20:57:54

Running from Y:\

Windows 7 Home Premium Service Pack 1 (X64) OS Language: English(US)

Internet Explorer Version 9

Boot Mode: Recovery

The current controlset is ControlSet001

ATTENTION!:=====> FRST is updated to run from normal or Safe mode to produce a full FRST.txt log and an extra Addition.txt log.

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [] [x]

HKLM\...\Run: [TPwrMain] %ProgramFiles%\TOSHIBA\Power Saver\TPwrMain.EXE [590256 2011-05-17] (TOSHIBA Corporation)

HKLM\...\Run: [HSON] %ProgramFiles%\TOSHIBA\TBS\HSON.exe [296824 2010-09-25] (TOSHIBA Corporation)

HKLM\...\Run: [TCrdMain] %ProgramFiles%\TOSHIBA\FlashCards\TCrdMain.exe [972672 2011-04-27] (TOSHIBA Corporation)

HKLM\...\Run: [smartAudio] C:\Program Files\CONEXANT\SAII\SAIICpl.exe /t [310912 2011-03-24] (Conexant Systems, Inc.)

HKLM\...\Run: [synTPEnh] %ProgramFiles%\Synaptics\SynTP\SynTPEnh.exe [2679592 2011-02-03] (Synaptics Incorporated)

HKLM\...\Run: [Teco] "%ProgramFiles%\TOSHIBA\TECO\Teco.exe" /r [1544624 2011-05-24] (TOSHIBA Corporation)

HKLM\...\Run: [TosWaitSrv] %ProgramFiles%\TOSHIBA\TPHM\TosWaitSrv.exe [712096 2011-06-27] (TOSHIBA Corporation)

HKLM\...\Run: [TosSENotify] C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosWaitSrv.exe [710560 2011-06-09] (TOSHIBA Corporation)

HKLM\...\Run: [TosVolRegulator] C:\Program Files\TOSHIBA\TosVolRegulator\TosVolRegulator.exe [24376 2009-11-11] (TOSHIBA Corporation)

HKLM\...\Run: [TosNC] %ProgramFiles%\Toshiba\BulletinBoard\TosNcCore.exe [595816 2010-04-23] (TOSHIBA Corporation)

HKLM\...\Run: [TosReelTimeMonitor] %ProgramFiles%\TOSHIBA\ReelTime\TosReelTimeMonitor.exe [38304 2011-03-30] (TOSHIBA Corporation)

HKLM\...\Run: [McPvTray_exe] "C:\Program Files\McAfee\MAT\McPvTray.exe" [436384 2011-04-08] (McAfee, Inc.)

HKLM\...\Run: [AdobeAAMUpdater-1.0] "C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" [497648 2010-07-28] (Adobe Systems Incorporated)

HKLM-x32\...\Run: [startCCC] "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun [336384 2011-05-25] (Advanced Micro Devices, Inc.)

HKLM-x32\...\Run: [iTSecMng] %ProgramFiles%\TOSHIBA\Bluetooth Toshiba Stack\ItSecMng.exe /START [80840 2011-04-01] (TOSHIBA CORPORATION)

HKLM-x32\...\Run: [ToshibaServiceStation] "C:\Program Files (x86)\TOSHIBA\TOSHIBA Service Station\ToshibaServiceStation.exe" /hide:60 [1298816 2011-07-11] (TOSHIBA Corporation)

HKLM-x32\...\Run: [TSleepSrv] %ProgramFiles(x86)%\TOSHIBA\TOSHIBA Sleep Utility\TSleepSrv.exe [x]

HKLM-x32\...\Run: [NortonOnlineBackupReminder] "C:\Program Files (x86)\Toshiba\Toshiba Online Backup\Activation\TOBuActivation.exe" UNATTENDED [3218864 2011-06-22] (Toshiba)

HKLM-x32\...\Run: [ToshibaAppPlace] "C:\Program Files (x86)\Toshiba\Toshiba App Place\ToshibaAppPlace.exe" [552960 2010-09-23] (Toshiba)

HKLM-x32\...\Run: [mcui_exe] "C:\Program Files\McAfee.com\Agent\mcagent.exe" /runkey [1675160 2011-11-22] (McAfee, Inc.)

HKLM-x32\...\Run: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [59720 2013-01-28] (Apple Inc.)

HKLM-x32\...\Run: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [843712 2012-01-02] (Adobe Systems Incorporated)

HKLM-x32\...\Run: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe" [152392 2013-02-20] (Apple Inc.)

HKU\Kirsty\...\Run: [swg] "C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [39408 2011-08-18] (Google Inc.)

HKU\Kirsty\...\Run: [qcgce2mrvjq91kk1e7pnbb19m52fx] C:\Users\Kirsty\Documents\262b5a51.exe [31232 2013-05-12] ()

HKU\Kirsty\...\RunOnce: [FlashPlayerUpdate] C:\windows\SysWOW64\Macromed\Flash\FlashUtil32_11_6_602_180_ActiveX.exe -update activex [706776 2013-03-21] (Adobe Systems Incorporated)

HKU\Kirsty\...\Winlogon: [shell] cmd.exe [345088 2010-11-20] (Microsoft Corporation)

Startup: C:\Users\Kirsty\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk

ShortcutTarget: Dropbox.lnk -> (No File)

==================== Services (Whitelisted) =================

S2 Browser Manager; C:\ProgramData\Browser Manager\2.6.1125.80\{61d8b74e-8d89-46ff-afa6-33382c54ac73}\browsermngr.exe [2569168 2013-03-06] ()

S2 McAfee SiteAdvisor Service; C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe [249936 2011-01-27] (McAfee, Inc.)

S3 McAWFwk; c:\PROGRA~1\mcafee\msc\mcawfwk.exe [225216 2011-01-28] (McAfee, Inc.)

S2 McMPFSvc; C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe [249936 2011-01-27] (McAfee, Inc.)

S2 mcmscsvc; C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe [249936 2011-01-27] (McAfee, Inc.)

S2 McNaiAnn; C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe [249936 2011-01-27] (McAfee, Inc.)

S2 McNASvc; C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe [249936 2011-01-27] (McAfee, Inc.)

S3 McODS; C:\Program Files\McAfee\VirusScan\mcods.exe [502032 2011-10-18] (McAfee, Inc.)

S4 McOobeSv; C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe [249936 2011-01-27] (McAfee, Inc.)

S2 McProxy; C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe [249936 2011-01-27] (McAfee, Inc.)

S2 McShield; C:\Program Files\Common Files\McAfee\SystemCore\\mcshield.exe [199272 2011-12-06] (McAfee, Inc.)

S2 mfefire; C:\Program Files\Common Files\McAfee\SystemCore\\mfefire.exe [208536 2011-12-06] (McAfee, Inc.)

S2 mfevtp; C:\windows\system32\mfevtps.exe [161168 2011-12-06] (McAfee, Inc.)

S2 MSK80Service; C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe [249936 2011-01-27] (McAfee, Inc.)

S2 Norton PC Checkup Application Launcher; C:\Program Files (x86)\Norton PC Checkup\Engine\2.0.13.11\SymcPCCULaunchSvc.exe /s [x]

S2 PCCUJobMgr; "C:\Program Files (x86)\Norton PC Checkup\Engine\2.0.13.11\ccSvcHst.exe" /s "PCCUJobMgr" /m "C:\Program Files (x86)\Norton PC Checkup\Engine\2.0.13.11\diMaster.dll" /prefetch:1 [x]

==================== Drivers (Whitelisted) ====================

S3 cfwids; C:\Windows\System32\drivers\cfwids.sys [65264 2011-10-15] (McAfee, Inc.)

S0 McPvDrv; C:\Windows\System32\drivers\McPvDrv.sys [71800 2011-04-11] (McAfee, Inc.)

S3 mfeapfk; C:\Windows\System32\drivers\mfeapfk.sys [160280 2011-10-15] (McAfee, Inc.)

S3 mfeavfk; C:\Windows\System32\drivers\mfeavfk.sys [229528 2011-10-15] (McAfee, Inc.)

S3 mfefirek; C:\Windows\System32\drivers\mfefirek.sys [481768 2011-10-15] (McAfee, Inc.)

S0 mfehidk; C:\Windows\System32\drivers\mfehidk.sys [647080 2011-10-15] (McAfee, Inc.)

S1 mfenlfk; C:\Windows\System32\DRIVERS\mfenlfk.sys [75808 2011-10-15] (McAfee, Inc.)

S3 mferkdet; C:\Windows\System32\drivers\mferkdet.sys [100912 2011-10-15] (McAfee, Inc.)

S0 mfewfpk; C:\Windows\System32\drivers\mfewfpk.sys [284648 2011-10-15] (McAfee, Inc.)

S3 Tosrfcom; No ImagePath

==================== NetSvcs (Whitelisted) ===================

==================== One Month Created Files and Folders ========

2013-05-12 20:55 - 2013-05-12 20:55 - 00016796 ____A C:\FRST.txt

2013-05-12 20:53 - 2013-05-12 20:53 - 00000000 ____D C:\FRST

2013-05-12 09:05 - 2013-05-12 09:06 - 00000000 ____D C:\Users\Kirsty\AppData\Roaming\Luury

2013-05-12 09:05 - 2013-05-12 09:05 - 01038449 ____A C:\Users\Kirsty\AppData\Local\2433f433

2013-05-12 09:05 - 2013-05-12 09:05 - 01038440 ____A C:\ProgramData\2433f433

2013-05-12 09:05 - 2013-05-12 09:05 - 01038394 ____A C:\Users\Kirsty\AppData\Roaming\2433f433

2013-05-12 09:05 - 2013-05-12 09:05 - 00000112 ____A C:\ProgramData\e5x8gAhd8.dat

2013-05-12 09:05 - 2013-05-12 09:05 - 00000000 ____D C:\Users\Kirsty\AppData\Roaming\Quwim

2013-05-12 09:05 - 2013-05-12 09:05 - 00000000 ____D C:\Users\Kirsty\AppData\Roaming\Ekfi

2013-05-12 09:04 - 2013-05-12 09:04 - 00151552 ____A (UNAUTH PRODUCTIONS) C:\Users\Kirsty\o2bvineum1n8c.exe

2013-05-12 09:04 - 2013-05-12 09:04 - 00133526 ____A (LOpiytexwe AQoijcru) C:\Users\Kirsty\eacd2r2meuadt.exe

2013-05-12 09:04 - 2013-05-12 09:04 - 00133526 ____A (LOpiytexwe AQoijcru) C:\ProgramData\0yN8C4v0.exe

2013-05-12 09:04 - 2013-05-12 09:04 - 00031232 ____A C:\Users\Kirsty\Documents\262b5a51.exe

2013-05-12 09:04 - 2013-05-12 09:04 - 00000001 ____A C:\ProgramData\0yN8C4v0.exe_.b

2013-05-12 09:04 - 2013-05-12 09:04 - 00000001 ____A C:\ProgramData\0yN8C4v0.exe.b

2013-05-10 03:36 - 2013-05-10 03:36 - 00000000 ____D C:\Users\Kirsty\AppData\Local\{DBA0BCAA-F197-4D2F-AA61-06011767CFC2}

2013-04-25 07:33 - 2013-04-25 07:33 - 00001754 ____A C:\Users\Public\Desktop\iTunes.lnk

2013-04-25 07:31 - 2013-04-25 07:33 - 00000000 ____D C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69

2013-04-25 07:31 - 2013-04-25 07:33 - 00000000 ____D C:\Program Files\iTunes

2013-04-25 07:31 - 2013-04-25 07:33 - 00000000 ____D C:\Program Files (x86)\iTunes

2013-04-25 07:31 - 2013-04-25 07:31 - 00000000 ____D C:\Program Files\iPod

2013-04-25 02:10 - 2013-04-25 02:11 - 00000000 ____D C:\Users\Kirsty\AppData\Local\{B6684DE1-19EA-483D-9DCE-B38DBD00C3C5}

2013-04-25 02:10 - 2013-04-25 02:10 - 00000000 ____D C:\Users\Kirsty\AppData\Local\{CBA1343B-140B-42B4-928D-DDD4C3C1116A}

2013-04-23 12:51 - 2013-04-23 12:52 - 00000000 ____D C:\Users\Kirsty\AppData\Local\{5309BA36-2275-4C89-88C8-7BE7246FF323}

2013-04-23 12:42 - 2013-04-12 06:45 - 01656680 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\ntfs.sys

2013-04-23 12:38 - 2013-04-23 12:38 - 00000000 ____D C:\Users\Kirsty\AppData\Roaming\Roxio Log Files

==================== One Month Modified Files and Folders =======

2013-05-12 20:55 - 2013-05-12 20:55 - 00016796 ____A C:\FRST.txt

2013-05-12 20:53 - 2013-05-12 20:53 - 00000000 ____D C:\FRST

2013-05-12 11:47 - 2011-08-18 17:22 - 00000908 ____A C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job

2013-05-12 11:47 - 2009-07-13 21:08 - 00000006 ___AH C:\Windows\Tasks\SA.DAT

2013-05-12 11:47 - 2009-07-13 20:51 - 00055128 ____A C:\Windows\setupact.log

2013-05-12 11:42 - 2011-08-18 17:22 - 00000912 ____A C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job

2013-05-12 11:42 - 2009-07-13 21:13 - 00726444 ____A C:\Windows\System32\PerfStringBackup.INI

2013-05-12 11:41 - 2011-08-18 16:22 - 01280267 ____A C:\Windows\WindowsUpdate.log

2013-05-12 11:35 - 2009-07-13 20:45 - 00024608 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

2013-05-12 11:35 - 2009-07-13 20:45 - 00024608 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

2013-05-12 09:44 - 2009-07-13 21:08 - 00032608 ____A C:\Windows\Tasks\SCHEDLGU.TXT

2013-05-12 09:24 - 2012-05-14 10:19 - 00000830 ____A C:\Windows\Tasks\Adobe Flash Player Updater.job

2013-05-12 09:06 - 2013-05-12 09:05 - 00000000 ____D C:\Users\Kirsty\AppData\Roaming\Luury