Ukash police ransom Kickstart 2.1 Boot options not responding

[stevemb]

Hi, my PC running XP Professional SP3 has been infected with the Bedford Police version of the Ukash ransomware (about 2 weeks ago) I .cannot boot in safe mode, safe mode with networking or safe mode with command prompt, without the hijack screen taking over and not allowing me any access to Windows.I also tried running malwarebytes (which was already insta led on the PC) via New Task inTask Mgr. After searching the web for advice I have made a usb with Hitmanpro and have changed the boot order in BIOS Setup and can get the Kickstart USB Boot Options menu up, but I cannot enter a choice. The cursor is flashing but the wireless keyboard is not responding. Sorry for the lack of new paragraphs in this post but the return key on the Samsung netbook I am using to post this will not work here. Hope you can help.

[MrCharlie]

Welcome to the forum.

You can try the Kaspersky Disk w/unlocker and see if that works:

http://maddoktor2.com/forums/index.php/topic,55928.0.html

Let me know....MrC

[stevemb]

Thanks for the speedy reply MrCharlie. I was unable to burn a cd at the moment as I only had a netbook that's up and running, but the link that you posted had instructions for entering Command Prompt and from there although I could not access Windows Start button (It always shut down and reloaded with the ransom page)I could CtrlAltDelete my way into the Task Mgr and from there enter system restore. I restored the PC to well before (I think) I first got this virus. This appears to have worked as I can now access everything as normal. I have downloaded the latest Malwarebytes and I am performing a full scan on all available drives. I will then update windows and scan with CCleaner and Spybot. I run AVG free edition and I am good at updating this, but it obviously got past this.

Any advice as how to make sure the virus is completely removed and how to avoid further infections would be greatly appreciated especially as my children use my PC for browsing and gaming.

PS Is it a good idea to burn a CD of the Kaspersky Rescue Disc and Unlocker to keep or is this programme quickly outdated?

Thanks again

[MrCharlie]

I restored the PC to well before (I think) I first got this virus.

Good

PS Is it a good idea to burn a CD of the Kaspersky Rescue Disc and Unlocker to keep or is this programme quickly outdated?

You're able to update it but I think it's a good idea to always burn a fresh one.

--------------------------

Run you scans and then run......

Download Security Check by screen317 from HERE or HERE.

• Save it to your Desktop.
  
• Double click SecurityCheck.exe and follow the onscreen instructions inside of the black box.
  
• A Notepad document should open automatically called checkup.txt.
  
• Please Post the contents of that document.
  
• Do Not Attach It!!!
  

MrC

[stevemb]

Hi MrC, hope you are well today,

After gaining control I updated all my security software before scanning for threats, and several Trojans were found both by AVG and Malwarebytes. I then followed the link you supplied and here is the result of the Security Check scan.

Results of screen317's Security Check version 0.99.64

Windows XP Service Pack 3 x86

``````````````Antivirus/Firewall Check:``````````````

Windows Firewall Enabled!

AVG AntiVirus Free Edition 2013

Antivirus up to date!

`````````Anti-malware/Other Utilities Check:`````````

Spybot - Search & Destroy

Malwarebytes Anti-Malware version 1.70.0.1100

CCleaner

Java 7 Update 7

Java version out of Date!

Adobe Reader 8 Adobe Reader out of Date!

````````Process Check: objlist.exe by Laurent````````

AVG avgwdsvc.exe

AVG avgrsx.exe

AVG avgnsx.exe

AVG avgemc.exe

`````````````````System Health check`````````````````

Total Fragmentation on Drive C:: 5%

````````````````````End of Log``````````````````````

Hope this helps

stevemb

[MrCharlie]

Out dated programs on the system are vulnerable to malware.

Please update or uninstall them:

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Java 7 Update 7 <----please update, should be Update 21

Java version out of Date! <--------Go to control panel > Java > Update Tab > Update Now

Uncheck the box to install the Ask toolbar!!! and any other free "stuff".

If there's no update tab in Java, uninstall it and Download and install the latest version from Here

Uncheck the box to install the Ask toolbar!!! and any other free "stuff".

--------------------------------------------------------------------------------------------------------

Adobe Reader 8 Adobe Reader out of Date! <---please check for an update if available or uninstall and download and install Foxit Reader which is less vulnerable to malware and much better than Adobe. Don't install any toolbars that may come with it (ASK Toolbar).

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

A little clean up to do....

Please Uninstall ComboFix: (if you used it)

Press the Windows logo key + R to bring up the "run box"

Copy and paste next command in the field:

ComboFix /uninstall

Make sure there's a space between Combofix and /

Then hit enter.

This will uninstall Combofix, delete its related folders and files, hide file extensions, hide the system/hidden files and clears System Restore cache and create new Restore point

(If that doesn't work.....you can simply rename ComboFix.exe to Uninstall.exe and double click it to complete the uninstall)

---------------------------------

If you used DeFogger to disable your CD Emulation drivers, please re-enable them.

-------------------------------

Please download OTC to your desktop.

http://oldtimer.geekstogo.com/OTC.exe

Double-click OTC to run it. (Vista and up users, please right click on OTC and select "Run as an Administrator")

Click on the CleanUp! button and follow the prompts.

(If you get a warning from your firewall or other security programs regarding OTC attempting to contact the Internet, please allow the connection.)

You will be asked to reboot the machine to finish the Cleanup process, choose Yes.

After the reboot all the tools we used should be gone.

Note: Some more recently created tools may not yet be removed by OTC. Feel free to manually delete any tools it leaves behind.

Any other programs or logs you can manually delete.

IE: RogueKiller.exe, RKreport.txt, RK_Quarantine folder, C:\FRST, MBAR, etc....AdwCleaner > just run the program and click uninstall.

-------------------------------

Any questions...please post back.

If you think I've helped you, please leave a comment > click on my avatar picture > click Profile Feed.

Take a look at My Preventive Maintenance to avoid being infected again.

Good Luck and Thanks for using the forum, MrC

[Maurice Naggar]

Glad we could help.

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.

Other members who need assistance please start your own topic in a new thread. Thanks!