police hijack ransom spyware

[WRATH OF BOD]

police hijack ransom spyware
i have found on a few systems over the last few weeks & removed the bug with malwarebytes & emsisoft emergancy kit.
but i have one at the moment that i cant get rid of.
i dont want to have to format but it may be the only way with this pc.
it will not go into safe mode, i used the drive in another pc & scanned it but still no joy
any ideas?

[muttleymacclad]

Have you tried combofix on it?
mml

[WRATH OF BOD]

like i said i cant get it in safe mode, normal boot locks out any access to anything, only the police screen.
metropolitan_police_virus.jpg

[neilb]

Have a look here, lower down the page is a section on using a rescue disk to remove the virus.

[akimba]

Yeah I have had this before, I am sure I slaved the drive on another comp and scanned it from there which it will remove the dodgy file then could boot into it on the original comp and think did sfc /scannow to check everything over ;-)

[WRATH OF BOD]

Yeah I have had this before, I am sure I slaved the drive on another comp and scanned it from there which it will remove the dodgy file then could boot into it on the original comp and think did sfc /scannow to check everything over ;-)

ye did that but would not remove the bug.
@ neilb: cant get into any safe mode to try, thats how i have done it in the past, same link.

looks like backup docs & format.

[Nibb]

You tried slaving it and scanning the affected drive with combofix?

I have had this on numerous m8s PCs/ laptops, never been unable to boot it in safe mode.

You can always try a DOS boot disc with combofix in a separate folder.

Once booted into DOS switch to combofix folder and run combofix.exe.

Or download the rescue disc on another PC as shown in the link and boot via the disc rather than the HD and follow the rest of the instructions.

[neilb]

@ neilb: cant get into any safe mode to try, thats how i have done it in the past, same link.

The part I'm on about is lower down, it uses a 'live cd' that you boot from, safe mode's not needed.

[raelmadrid]

i can confirm paying the charge also gets rid of it

[liveseytowers]

Have you tried to find an activation key for it? I've had these before were it was a real pain in the ass to get remove unless it was activated. Then I could just uninstall it. A quick google revealed the activation codes. Worth a try.

[WRATH OF BOD]

Have you tried to find an activation key for it? I've had these before were it was a real pain in the ass to get remove unless it was activated. Then I could just uninstall it. A quick google revealed the activation codes. Worth a try.

i have found a few
this one
aes987156
and this one x= random numbers
will give ago in the morning.
0XXXXXXXXXXXXXXX

[consoles]

cant you use something like ERD Commander with malware bytes on the image, no services are started so removing should be easy.

[Nibb]

Also Hirens Boot CD....loads of utilities on there to sort it especially if you have a boot sector infection.

[WRATH OF BOD]

sorted, thanks guys for the help.

[muttleymacclad]

AArrggghh. So come on wrath, tell us what worked then?
mml

[WRATH OF BOD]

The Code 0xxxxxxxxxxxxxxx was accepted & told me upto 72hours for activation PMSL..
i put the drive into another pc running xp(i think it didnt work on the last PC cos it was running windows 8)
ran emsisoft emergancy kit. then malwarebytes and got rid that way,
i got the system up & running but O/S was shagged so ended up re installing all.

again thanks for all the help.
emsisoft emergancy kit has worked with no hasle in the past so i think windows 8 was the problem with hard drive

[Zoots]

Great.. Neighbour's just pulled me about this. Their brat's lappy has it so that's my evening sorted..

[WRATH OF BOD]

from all the one's i have done it seems to come from porn sites,

[raelmadrid]

it takes 5 minutes, dunno what all the drama is about

[WRATH OF BOD]

it takes 5 minutes, dunno what all the drama is about

normally yes but this pc was riddled & had the ransom on twice,combined with all the crap on it & the fact it couldnt start in safe mode & adding in the windows 8 pc not liking the removal software, shit happens.lol