Ransomware attack, please help

[wallkerrmartin]

Hi There,
I may have become a victim of a ransom ware attack. It blocked my PC and I panicked and forced it close. 
I managed to boot into Windows safe mode. Can I find out from here if the PC has been infected?
I should be most grateful if you would advise me on what to do next.
PC is an HP All-In-One TouchSmart IQ830be with a dual boot Vista/Ubuntu. 
Many thanks in Advance,
M
PS meanwhile my daughter managed to boot into Ubuntu (which works fine).., How do I get back into Windows SafeMode?

[AdvancedSetup]

Hello @wallkerrmartin and

Ubuntu should have a grub loader to select which operating system you want to run. Consult with your daughter if needed and she may be able to assist you.

 

Farbar Recovery Scan Tool (FRST) - Recovery Environment Scan
Follow the instructions below to download and execute a scan on your system with FRST from the Recovery Environment, and provide the logs in your next reply.

Item(s) required:

• USB Flash Drive (size depend on if you have to create a USB Recovery or Installation media)
• CD/DVD (optional: only needed if you need to create a Recovery or Installation media and your USB Flash Drive is too small)
• Another computer (optional: only needed if you cannot work from the infected computer directly)

Preparing the USB Flash Drive

• Download the right version of FRST for your system:
  • FRST 32-bit
  • FRST 64-bit
    Note: Only the right version will run on your system, the other will throw an error message. So if you don't know what your system's version is, simply download both of them, and the one that works is the one you should be using.
• Move the executable (FRST.exe or FRST64.exe) on your USB Flash Drive;

Boot in the Recovery Environment

• Plug your USB Flash Drive in the infected computer;
• To enter the Recovery Environment with Windows Vista and Windows 7, follow the instructions below:
  • Restart the computer;
  • Once you've seen your BIOS splashscreen (the computer manufacturer logo), tap the F8 key repeatedly until the Advanced Boot Options menu appears;
  • Use the arrow keys to select Repair your computer, and press on Enter;
  • Select your keyboard layout (US, French, etc.) and click on Next;
  • Click on Command Prompt to open the command prompt;
    Note: If you can't access the Recovery Environment using the F8 method above, you'll need to create a Windows installation or repair media. It can be made on the computer itself or another one running the same version of Windows as the one you plan to use it on. For more information, check out this tutorial on SevenForums.
• To enter the Recovery Environment with Windows 8 or Windows 8.1, follow the instructions in this tutorial on EightForums;
  Note: If you can't access the Recovery Environment using the method above, you'll need to create a Windows installation or repair media. It can be made on the computer itself or another one running the same version of Windows as the one you plan to use it on. For more information, check out this tutorial.
• To enter the Recovery Environment with Windows 10, follow the instructions in this tutorial on TenForums;
  Note: If you can't access the Recovery Environment using the method above, you'll need to create a Windows installation or repair media. It can be made on the computer itself or another one running the same version of Windows as the one you plan to use it on. For more information, check out this tutorial on TenForums.

Once in the command prompt

• In the command prompt, type notepad and press on Enter;
• Notepad will open. Click on the File menu and select Open;
• Click on Computer/This PC, find the letter for your USB Flash Drive, then close the window and Notepad;
• In the command prompt, type e:\frst.exe (for the x64 version, type e:\frst64.exe and press on Enter;
• Note: Replace the letter e with the drive letter of your USB Flash Drive;
• FRST will open;
• Click on Yes to accept the disclaimer;
• Click on the Scan button and wait for the scan to complete;
• A log called FRST.txt will be saved on your USB Flash Drive. Attach it in your next reply;

 

Let me know if you have any questions.

Thanks

Ron