PC locked
Thread Starter
Join Date: Aug 2001
Location: Surrey, UK
Posts: 30
Likes: 0
Received 0 Likes
on
0 Posts
PC locked
Booted the PC up this morning and after a slow startup a screen appeared claiming to be something to do with Gema in association with the Metropolitan Police. Said it detected illegal music downloads (not so) and I need to pay £50 to UKASH to get a code to unlock said PC. Also shows what is claimed to be my IP address but that is incorrect.
I need to unplug the PC to switch off and when rebooting using the delete key to enter setup I get a red password box that I've never seen before.
Running XP, any ideas?
I need to unplug the PC to switch off and when rebooting using the delete key to enter setup I get a red password box that I've never seen before.
Running XP, any ideas?
Last edited by R for Robert; 2nd Nov 2011 at 15:26. Reason: adding info
Join Date: Apr 2005
Location: Earth
Posts: 366
Likes: 0
Received 0 Likes
on
0 Posts
Rob,
Can you explain why you need to press the delete key on boot? Is that something you do each time on start up?
Does the computer boot to the desktop, and you then get the password box?
Does pressing the Escape key, Alt F4, or any key, remove the password box?
Sounds like this is a variation of the Virus scanner software scam to relieve people of their credit card details.
when rebooting using the delete key to enter setup
Does the computer boot to the desktop, and you then get the password box?
Does pressing the Escape key, Alt F4, or any key, remove the password box?
Sounds like this is a variation of the Virus scanner software scam to relieve people of their credit card details.
Controversial, moi?
Sounds like a clever virus. I would suggest the recommendations in post #29 in this thread.
Official PPRuNe Chaplain
Join Date: Apr 2001
Location: Witnesham, Suffolk
Age: 80
Posts: 3,498
Likes: 0
Received 0 Likes
on
0 Posts
You've been hacked/virused. If it throws up a password box on startup, it's a nasty one.
Don't pay money to that lot - they're crooks.
Don't pay money to that lot - they're crooks.
Join Date: Apr 2005
Location: Earth
Posts: 366
Likes: 0
Received 0 Likes
on
0 Posts
Try this
It's no good, I can't wait. I'm going postal...
Down load Microsoft Standalone System Sweeper on another machine.
Follow the instructions.
Run Malwarebytes. Let it update, if required. Run a full scan and remove any rubbish found.
If that doesn’t do it…
• Unplug the bad machine from the Internet.
• Start it and Log On.
• Log off.
• Log on and then immediately start pressing Ctrl/Alt/Del several times until you get to the System configuration box. (msconfig)
• Look for any unusual Startup items:
(random characters).exe
avsuite.exe
avsoft.exe, or something similar which may be connected to the message you are getting. Google for ident if not sure.
• Kill them! – oh, alright, untick the box in the Startup Item column. Apply.
• Run Malwarebytes. Let it update, if required. Run a full scan and remove any rubbish found.
• Install Microsoft Security Essentials. Scan.
• Stay away from web sites not on the ‘Main road’. Never click on links in emails. Use a Firewall.
Down load Microsoft Standalone System Sweeper on another machine.
Follow the instructions.
Run Malwarebytes. Let it update, if required. Run a full scan and remove any rubbish found.
If that doesn’t do it…
• Unplug the bad machine from the Internet.
• Start it and Log On.
• Log off.
• Log on and then immediately start pressing Ctrl/Alt/Del several times until you get to the System configuration box. (msconfig)
• Look for any unusual Startup items:
(random characters).exe
avsuite.exe
avsoft.exe, or something similar which may be connected to the message you are getting. Google for ident if not sure.
• Kill them! – oh, alright, untick the box in the Startup Item column. Apply.
• Run Malwarebytes. Let it update, if required. Run a full scan and remove any rubbish found.
• Install Microsoft Security Essentials. Scan.
• Stay away from web sites not on the ‘Main road’. Never click on links in emails. Use a Firewall.
Join Date: Jan 2008
Location: Bracknell, Berks, UK
Age: 52
Posts: 1,133
Likes: 0
Received 0 Likes
on
0 Posts
Thread Starter
Join Date: Aug 2001
Location: Surrey, UK
Posts: 30
Likes: 0
Received 0 Likes
on
0 Posts
Spurlash,
As soon as I log on the virus boots up and I've lost control and am unable to log off.
Mike,
Yes that looks like the German version.
It looked promising until I entered Taskmgr.exe when it told me the task manager had been disabled by the administrator. Looks like they've covered everything.
As soon as I log on the virus boots up and I've lost control and am unable to log off.
Mike,
Yes that looks like the German version.
It looked promising until I entered Taskmgr.exe when it told me the task manager had been disabled by the administrator. Looks like they've covered everything.
More bang for your buck
Join Date: Nov 2005
Location: land of the clanger
Age: 82
Posts: 3,512
Likes: 0
Received 0 Likes
on
0 Posts
Aren't you having fun, presumably you're pressing delete to get into the BIOS set up? If that's so and the virus has accessed the bios and set a password to enter the bios you may have real problems. Switching the M/C off and removing the bios battery may or may not remove the set password, consult your mother board manual for a possible answer.
Do you have an old hard drive anywhere that you could plug in instead of the existing one? If so unplug the current one and insert the old one and power up, if it says operating system not found then insert the XP disc if you have one, or borrow one (you don't need to register the install immediately) and see if you can install it, if you can then plug the other drive in as a slave and you should be able to operate on its file system and remove the virus manually.
Do you have an old hard drive anywhere that you could plug in instead of the existing one? If so unplug the current one and insert the old one and power up, if it says operating system not found then insert the XP disc if you have one, or borrow one (you don't need to register the install immediately) and see if you can install it, if you can then plug the other drive in as a slave and you should be able to operate on its file system and remove the virus manually.
Thread Starter
Join Date: Aug 2001
Location: Surrey, UK
Posts: 30
Likes: 0
Received 0 Likes
on
0 Posts
Had trouble at first trying to boot the MSSS from a stick so tried a disc. It looked promising finding errors but then booted up with the same problem.
I have a couple of old HDDs so will try installing one of those and then connecting the infected one via a usb connection as a slave, but not before I've downloaded the Malwarebytes program. Job for tomorrow!
I have a couple of old HDDs so will try installing one of those and then connecting the infected one via a usb connection as a slave, but not before I've downloaded the Malwarebytes program. Job for tomorrow!
